From 8c1edbd0e4184de3afce9462ad6cf8d73f825008 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Wed, 3 Feb 2021 15:31:04 +0100 Subject: [PATCH 001/626] Make tests-pr.yml more "welcoming" --- tests-pr.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests-pr.yml b/tests-pr.yml index 5b5e020..f06af2b 100644 --- a/tests-pr.yml +++ b/tests-pr.yml @@ -5,8 +5,8 @@ pre_tasks: - name: Generate list of tests in this PR shell: | - git fetch https://src.fedoraproject.org/tests/selinux.git master:upstream-master - git log --format= --stat --name-only upstream-master..HEAD | sed '/\//!d;s#\(.*\)/.*#\1#' | sort -u | xargs + git fetch https://src.fedoraproject.org/tests/selinux.git main:upstream-main + git log --format= --stat --name-only upstream-main..HEAD | sed '/\//!d;s#\(.*\)/.*#\1#' | sort -u | xargs delegate_to: localhost register: tests_list From a01344bd641ad12beb7d4d2eb14d980b86af824d Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Wed, 3 Feb 2021 15:28:56 +0100 Subject: [PATCH 002/626] Add test for kernel deadlock via setsebool Signed-off-by: Ondrej Mosnacek --- kernel/setsebool-deadlock/Makefile | 7 +++++ kernel/setsebool-deadlock/main.fmf | 24 ++++++++++++++++ kernel/setsebool-deadlock/runtest.sh | 43 ++++++++++++++++++++++++++++ 3 files changed, 74 insertions(+) create mode 100644 kernel/setsebool-deadlock/Makefile create mode 100644 kernel/setsebool-deadlock/main.fmf create mode 100755 kernel/setsebool-deadlock/runtest.sh diff --git a/kernel/setsebool-deadlock/Makefile b/kernel/setsebool-deadlock/Makefile new file mode 100644 index 0000000..e6e0bfb --- /dev/null +++ b/kernel/setsebool-deadlock/Makefile @@ -0,0 +1,7 @@ +# Minimal Makefile for standard-test-roles-beakerlib + +R="RhtsRequires: audit policycoreutils" + +run: + chmod +x runtest.sh + TEST=/SELinux/kernel/setsebool-deadlock ./runtest.sh diff --git a/kernel/setsebool-deadlock/main.fmf b/kernel/setsebool-deadlock/main.fmf new file mode 100644 index 0000000..5a69da9 --- /dev/null +++ b/kernel/setsebool-deadlock/main.fmf @@ -0,0 +1,24 @@ +summary: Regression test for deadlock when changing booleans +description: | + Verify that setting booleans with SELinux audit exclude rules present + doesn't deadlock itself. + WARNING: This test will lockup the machine if the bug is present! + https://bugzilla.redhat.com/show_bug.cgi?id=1924230 +contact: Ondrej Mosnacek +component: +- kernel +framework: beakerlib +require: +- audit +- policycoreutils +duration: 5m +tier: 3 +enabled: true +adjust: + enabled: false + when: distro < fedora-34 + because: some kernels on Fedora 33 and below don't have the fix +adjust: + enabled: false + when: distro ~< rhel-8.4 + because: not expected to be fixed in RHEL-8 below 8.4 diff --git a/kernel/setsebool-deadlock/runtest.sh b/kernel/setsebool-deadlock/runtest.sh new file mode 100755 index 0000000..20239b4 --- /dev/null +++ b/kernel/setsebool-deadlock/runtest.sh @@ -0,0 +1,43 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# SPDX-License-Identifier: GPLv2 +# Copyright (c) 2021 Red Hat, Inc. +# Author: Ondrej Mosnacek + +# Include Beakerlib environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +function boolGet() { + getsebool "$1" | cut -d ' ' -f 3 +} +function boolSet() { + getsebool "$1" &>/dev/null || return 0 + setsebool "$1" "$2" || return 1 + [ "$(boolGet "$1")" == "$2" ] +} + +TEST_BOOLEAN="domain_can_mmap_files" + +rlJournalStart + rlPhaseStartSetup + rlRun "bool_default=\$(boolGet domain_can_mmap_files)" 0 \ + "Get the initial boolean value" + rlRun "auditctl -a exclude,never -F subj_user=sysadm_u" 0 \ + "Add an audit rule that triggers the bug" + rlPhaseEnd + + rlPhaseStartTest + rlRun "setsebool domain_can_mmap_files $(( 1 - $bool_default )) &" 0 \ + "Start setsebool in the background (it may hang)" + rlRun "sleep 5s" 0 "Give it a grace period of 5 seconds" + rlRun "test \$(jobs -r | wc -l) -eq 0" 0 "Check that it has exited" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "auditctl -d exclude,never -F subj_user=sysadm_u" 0 \ + "Remove the audit rule" + rlRun "boolSet domain_can_mmap_files $bool_default" 0 \ + "Restore the boolean value" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd From 33abfe035c2124566ef8f4b2319b18998e5f233d Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Thu, 4 Feb 2021 17:36:30 +0100 Subject: [PATCH 003/626] policycoreutils/setfiles: Basic sanity test for setfiles --- policycoreutils/setfiles/Makefile | 70 ++++++++++++++++++++++ policycoreutils/setfiles/PURPOSE | 3 + policycoreutils/setfiles/main.fmf | 16 +++++ policycoreutils/setfiles/runtest.sh | 93 +++++++++++++++++++++++++++++ 4 files changed, 182 insertions(+) create mode 100644 policycoreutils/setfiles/Makefile create mode 100644 policycoreutils/setfiles/PURPOSE create mode 100644 policycoreutils/setfiles/main.fmf create mode 100755 policycoreutils/setfiles/runtest.sh diff --git a/policycoreutils/setfiles/Makefile b/policycoreutils/setfiles/Makefile new file mode 100644 index 0000000..6e1a5af --- /dev/null +++ b/policycoreutils/setfiles/Makefile @@ -0,0 +1,70 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/policycoreutils/Sanity/setfiles +# Description: Basic sanity tests for setfiles +# Author: Michal Trunecka +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2021 Red Hat, Inc. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/policycoreutils/Sanity/setfiles +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + test -x runtest.sh || chmod a+x runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Michal Trunecka " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: Basic sanity tests for setfiles" >> $(METADATA) + @echo "Type: Sanity" >> $(METADATA) + @echo "TestTime: 30m" >> $(METADATA) + @echo "RunFor: policycoreutils" >> $(METADATA) + @echo "Requires: policycoreutils" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Bug: 1098062" >> $(METADATA) # RHEL-6 + @echo "Bug: 1086572" >> $(METADATA) # RHEL-6 + @echo "Bug: 1086456" >> $(METADATA) # RHEL-6 + @echo "Bug: 1271326" >> $(METADATA) # RHEL-7 + @echo "Bug: 1271327" >> $(METADATA) # RHEL-7 + @echo "Bug: 1584116" >> $(METADATA) # RHEL-7 + @echo "Bug: 1794518" >> $(METADATA) # RHEL-8 + + rhts-lint $(METADATA) diff --git a/policycoreutils/setfiles/PURPOSE b/policycoreutils/setfiles/PURPOSE new file mode 100644 index 0000000..eb93ba3 --- /dev/null +++ b/policycoreutils/setfiles/PURPOSE @@ -0,0 +1,3 @@ +PURPOSE of /CoreOS/policycoreutils/Sanity/setfiles +Description: Basic sanity tests for setfiles +Author: Michal Trunecka diff --git a/policycoreutils/setfiles/main.fmf b/policycoreutils/setfiles/main.fmf new file mode 100644 index 0000000..23b5eec --- /dev/null +++ b/policycoreutils/setfiles/main.fmf @@ -0,0 +1,16 @@ +summary: Basic sanity tests for setfiles +description: Basic sanity tests for setfiles +contact: Petr Lautrbach +component: +- policycoreutils +framework: beakerlib +require: +- e2fsprogs +- policycoreutils +duration: 5m +tier: 1 +enabled: true +adjust: + enabled: false + when: distro ~< rhel-8.4 + because: not expected to be fixed in RHEL-8 below 8.4 diff --git a/policycoreutils/setfiles/runtest.sh b/policycoreutils/setfiles/runtest.sh new file mode 100755 index 0000000..539eaae --- /dev/null +++ b/policycoreutils/setfiles/runtest.sh @@ -0,0 +1,93 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/policycoreutils/Sanity/setfiles +# Description: Basic sanity tests for setfiles +# Author: Michal Trunecka +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2021 Red Hat, Inc. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="policycoreutils" + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm $PACKAGE + rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" + rlRun "pushd $TmpDir" + OUTPUT=`mktemp` + rlPhaseEnd + + rlPhaseStartTest "bz1086456 + bz1086572 + bz1098062 + bz1584116" + rlLog "Check for bz#1086456" + rlRun "touch /tmp/file" + rlRun "cat > spec_file < Date: Fri, 5 Feb 2021 15:28:21 +0100 Subject: [PATCH 004/626] policycoreutils/setfiles: Make the relabel test robust - use directory which is not usually mounted as tmpfs - use own spec_file - use -F option - check context of all directories and files inside chroot --- policycoreutils/setfiles/runtest.sh | 40 ++++++++++++++++++++--------- 1 file changed, 28 insertions(+), 12 deletions(-) diff --git a/policycoreutils/setfiles/runtest.sh b/policycoreutils/setfiles/runtest.sh index 539eaae..a760694 100755 --- a/policycoreutils/setfiles/runtest.sh +++ b/policycoreutils/setfiles/runtest.sh @@ -66,23 +66,39 @@ EOF" rlPhaseStartTest "setfiles should not abort when it can't label a file - bz#1794518" USER=$(mktemp -u userXXXX) - USERTMP=$(mktemp -d) + USERTMP=$(mktemp -d -p /var/tmp) rlRun "useradd ${USER}" + rlRun "cat > ${USERTMP}/spec_file < Date: Fri, 5 Feb 2021 15:43:57 +0100 Subject: [PATCH 005/626] policycoreutils/setfiles: Add path to main.fmf --- policycoreutils/setfiles/main.fmf | 1 + 1 file changed, 1 insertion(+) diff --git a/policycoreutils/setfiles/main.fmf b/policycoreutils/setfiles/main.fmf index 23b5eec..78018a0 100644 --- a/policycoreutils/setfiles/main.fmf +++ b/policycoreutils/setfiles/main.fmf @@ -1,6 +1,7 @@ summary: Basic sanity tests for setfiles description: Basic sanity tests for setfiles contact: Petr Lautrbach +path: /policycoreutils/setfiles component: - policycoreutils framework: beakerlib From 7b3df8350d1fb6a423b7dc84fb63354724491fa2 Mon Sep 17 00:00:00 2001 From: Amith Kumar Date: Wed, 10 Feb 2021 02:25:05 +0530 Subject: [PATCH 006/626] pcp-daemons: Fix upstream failures One of the testcase failed due to absence of chkconfig and initrc related files. Make existing code compatible with higher versions of Fedora and fix the failures. Signed-off-by: Amith Kumar --- .../pcp-daemons-and-similar/runtest.sh | 34 ++++++++++++++----- 1 file changed, 25 insertions(+), 9 deletions(-) diff --git a/selinux-policy/pcp-daemons-and-similar/runtest.sh b/selinux-policy/pcp-daemons-and-similar/runtest.sh index 0b8321c..9103fda 100755 --- a/selinux-policy/pcp-daemons-and-similar/runtest.sh +++ b/selinux-policy/pcp-daemons-and-similar/runtest.sh @@ -394,12 +394,20 @@ rlJournalStart rlRun "semodule -l | grep pcp" rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" for SERVICE_NAME in pmcd pmie pmlogger pmproxy ; do - rlRun "chkconfig ${SERVICE_NAME} on" + if rlIsFedora '>=33' || rlIsRHEL ">=8.1" ; then + rlRun "systemctl enable ${SERVICE_NAME}" + else + rlRun "chkconfig ${SERVICE_NAME} on" + fi done for TRIPLET in ${TRIPLETSLIST} ; do - if ! rlSEDefined "${SEDEFINED}" ; then - # for RHELs where the SELinux domain does not exist yet - PROCESS_CONTEXT="initrc_t" + if rlIsFedora '<33' || rlIsRHEL "<8" ; then + if ! rlSEDefined "${SEDEFINED}" ; then + # for RHELs where the SELinux domain does not exist yet + PROCESS_CONTEXT="initrc_t" + else + PROCESS_CONTEXT=`echo ${TRIPLET} | cut -d : -f 3` + fi else PROCESS_CONTEXT=`echo ${TRIPLET} | cut -d : -f 3` fi @@ -411,11 +419,15 @@ rlJournalStart rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status restart status" 1 done for TRIPLET in ${TRIPLETSLIST} ; do - if ! rlSEDefined "${SEDEFINED}" ; then - # for RHELs where the SELinux domain does not exist yet - PROCESS_CONTEXT="initrc_t" + if rlIsFedora '<33' || rlIsRHEL "<8" ; then + if ! rlSEDefined "${SEDEFINED}" ; then + # for RHELs where the SELinux domain does not exist yet + PROCESS_CONTEXT="initrc_t" + else + PROCESS_CONTEXT=`echo ${TRIPLET} | cut -d : -f 3` + fi else - PROCESS_CONTEXT=`echo ${TRIPLET} | cut -d : -f 3` + PROCESS_CONTEXT=`echo ${TRIPLET} | cut -d : -f 3` fi PROCESS_NAME=`echo ${TRIPLET} | cut -d : -f 4` SERVICE_NAME=${PROCESS_NAME} @@ -425,7 +437,11 @@ rlJournalStart rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "stop" 1 done for SERVICE_NAME in pmcd pmie pmlogger pmproxy ; do - rlRun "chkconfig ${SERVICE_NAME} off" + if rlIsFedora '>=33' || rlIsRHEL ">=8.1" ; then + rlRun "systemctl disable ${SERVICE_NAME}" + else + rlRun "chkconfig ${SERVICE_NAME} off" + fi done rlPhaseEnd From a17c57ee31b5b4ef17ae30c14df787abb80397fb Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Wed, 10 Feb 2021 10:40:27 +0100 Subject: [PATCH 007/626] add the dmidecode test to upstream repo The dmidecode component is also used by various users on Fedora and RHEL, so it makes sense to run this TC in upstream testing too. There are no changes in the TC functionality. Moving the downstream TC to upstream repository. --- selinux-policy/dmidecode-and-similar/Makefile | 73 +++++++++ selinux-policy/dmidecode-and-similar/PURPOSE | 5 + selinux-policy/dmidecode-and-similar/main.fmf | 2 + .../dmidecode-and-similar/runtest.sh | 151 ++++++++++++++++++ selinux-policy/dmidecode-and-similar/ssh.exp | 20 +++ .../dmidecode-and-similar/testpolicy.te | 18 +++ 6 files changed, 269 insertions(+) create mode 100644 selinux-policy/dmidecode-and-similar/Makefile create mode 100644 selinux-policy/dmidecode-and-similar/PURPOSE create mode 100644 selinux-policy/dmidecode-and-similar/main.fmf create mode 100755 selinux-policy/dmidecode-and-similar/runtest.sh create mode 100644 selinux-policy/dmidecode-and-similar/ssh.exp create mode 100644 selinux-policy/dmidecode-and-similar/testpolicy.te diff --git a/selinux-policy/dmidecode-and-similar/Makefile b/selinux-policy/dmidecode-and-similar/Makefile new file mode 100644 index 0000000..386e4f3 --- /dev/null +++ b/selinux-policy/dmidecode-and-similar/Makefile @@ -0,0 +1,73 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/dmidecode-and-similar +# Description: SELinux interferes with dmidecode and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2017 Red Hat, Inc. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/dmidecode-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE testpolicy.te ssh.exp + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh ssh.exp + chcon -t bin_t runtest.sh ssh.exp + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with dmidecode and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 15m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "RunFor: dmidecode" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools setools-console dmidecode selinux-policy-devel shadow-utils openssh-clients expect" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4" >> $(METADATA) + @echo "Bug: 263141" >> $(METADATA) # RHEL-5 + @echo "Bug: 1289274" >> $(METADATA) # RHEL-7 + @echo "Bug: 1300799" >> $(METADATA) # RHEL-7 + @echo "Bug: 1608480" >> $(METADATA) # RHEL-7 + @echo "Bug: 1926696" >> $(METADATA) # Fedora 34 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/dmidecode-and-similar/PURPOSE b/selinux-policy/dmidecode-and-similar/PURPOSE new file mode 100644 index 0000000..06eaabe --- /dev/null +++ b/selinux-policy/dmidecode-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/dmidecode-and-similar +Author: Milos Malik + +SELinux interferes with dmidecode and related programs. + diff --git a/selinux-policy/dmidecode-and-similar/main.fmf b/selinux-policy/dmidecode-and-similar/main.fmf new file mode 100644 index 0000000..af1851c --- /dev/null +++ b/selinux-policy/dmidecode-and-similar/main.fmf @@ -0,0 +1,2 @@ +path: /selinux-policy/dmidecode-and-similar +tier: 2 diff --git a/selinux-policy/dmidecode-and-similar/runtest.sh b/selinux-policy/dmidecode-and-similar/runtest.sh new file mode 100755 index 0000000..0defe7a --- /dev/null +++ b/selinux-policy/dmidecode-and-similar/runtest.sh @@ -0,0 +1,151 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/dmidecode-and-similar +# Description: SELinux interferes with dmidecode and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2017 Red Hat, Inc. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +ALLOWED_USERS=${ALLOWED_USERS:-"sysadm_u unconfined_u"} +DENIED_USERS=${DENIED_USERS:-"staff_u user_u guest_u xguest_u"} + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm dmidecode + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "bz#263141" + rlSEMatchPathCon "/usr/sbin/dmidecode" "dmidecode_exec_t" + rlSESearchRule "allow dmidecode_t sysfs_t : dir { getattr open search } [ ]" + rlSESearchRule "allow dmidecode_t sysfs_t : file { getattr open read } [ ]" + rlPhaseEnd + + if ! rlIsRHEL 5 6 ; then + rlPhaseStartTest "bz#1289274" + rlSEMatchPathCon "/usr/sbin/dmidecode" "dmidecode_exec_t" + rlSEMatchPathCon "/dev/urandom" "urandom_device_t" + rlSESearchRule "allow dmidecode_t urandom_device_t : chr_file { getattr open read } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1300799" + rlSEMatchPathCon "/usr/sbin/dmidecode" "dmidecode_exec_t" + rlSEMatchPathCon "/run/lock/subsys/rhsmcertd" "rhsmcertd_lock_t" + rlSEMatchPathCon "/var/log/rhsm/rhsm.log" "rhsmcertd_log_t" + rlSESearchRule "allow dmidecode_t rhsmcertd_lock_t : file { open }" + rlSESearchRule "allow dmidecode_t rhsmcertd_log_t : file { open read }" + rlPhaseEnd + fi + + if ! rlIsRHEL 5 6 ; then + rlPhaseStartTest "bz#1608480" + rlSEMatchPathCon "/usr/sbin/dmidecode" "dmidecode_exec_t" + rlSESearchRule "allow rhsmcertd_t dmidecode_exec_t : file { map } [ ]" + rlPhaseEnd + fi + + if seinfo -c | grep -q lockdown ; then + rlPhaseStartTest "bz#1926696" + rlSEMatchPathCon "/usr/sbin/biosdecode" "dmidecode_exec_t" + rlSEMatchPathCon "/usr/sbin/vpddecode" "dmidecode_exec_t" + rlSESearchRule "allow dmidecode_t dmidecode_t : lockdown { integrity } [ ]" + rlPhaseEnd + fi + + rlPhaseStartTest "real scenario -- runcon" + # this TC does not belong to the small set of SELinux domains which can run dmidecode in the system_u:system_r:dmidecode_t:s0 context, therefore we need some help + # TODO: use sysadm_t user instead of initrc_t to run dmidecode, because sysadm_t is allowed to transition to dmidecode_t + rlRun "ls -l testpolicy.*" + rlRun "make -f /usr/share/selinux/devel/Makefile testpolicy.pp" + rlRun "semodule -i testpolicy.pp" + + rlRun "runcon system_u:system_r:initrc_t:s0 bash -c /usr/sbin/dmidecode" + if [ -f /usr/sbin/biosdecode ] ; then + rlRun "runcon system_u:system_r:initrc_t:s0 bash -c /usr/sbin/biosdecode" + fi + if [ -f /usr/sbin/vpddecode ] ; then + rlRun "runcon system_u:system_r:initrc_t:s0 bash -c /usr/sbin/vpddecode" + fi + if [ -f /usr/sbin/ownership ] ; then + rlRun "runcon system_u:system_r:initrc_t:s0 bash -c /usr/sbin/ownership" + fi + + rlRun "semodule -l | grep testpolicy" + rlRun "semodule -r testpolicy" + rlRun "semodule -l | grep testpolicy" 1 + rlPhaseEnd + + rlPhaseStartTest "real scenario -- confined users" + rlFileBackup /etc/ssh/sshd_config + rlRun "sed -i 's/^.*PermitRootLogin.*$/PermitRootLogin yes/' /etc/ssh/sshd_config" + rlRun "sed -i 's/^.*PasswordAuthentication.*$/PasswordAuthentication yes/' /etc/ssh/sshd_config" + rlRun "service sshd restart" + + rlRun "setsebool ssh_sysadm_login on" + rlLog "configuration says not to test SELinux users: ${DENIED_USERS}" + for SELINUX_USER in ${ALLOWED_USERS} ; do + USER_NAME="user${RANDOM}" + USER_SECRET="S3kr3t${RANDOM}" + rlRun "useradd -o -u 0 -g 0 -Z ${SELINUX_USER} ${USER_NAME}" + rlRun "echo ${USER_SECRET} | passwd --stdin ${USER_NAME}" + rlRun "restorecon -RvF /home/${USER_NAME}" + if [ -f /usr/sbin/dmidecode ] ; then + rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost /usr/sbin/dmidecode" + fi + if [ -f /usr/sbin/biosdecode ] ; then + rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost /usr/sbin/biosdecode" + fi + if [ -f /usr/sbin/vpddecode ] ; then + rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost /usr/sbin/vpddecode" + fi + if [ -f /usr/sbin/ownership ] ; then + rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost /usr/sbin/ownership" + fi + sleep 2 + rlRun "userdel -rfZ ${USER_NAME}" + done + rlRun "setsebool ssh_sysadm_login off" + rlFileRestore + rlRun "service sshd restart" + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/dmidecode-and-similar/ssh.exp b/selinux-policy/dmidecode-and-similar/ssh.exp new file mode 100644 index 0000000..1244013 --- /dev/null +++ b/selinux-policy/dmidecode-and-similar/ssh.exp @@ -0,0 +1,20 @@ +#!/usr/bin/expect -f +# Expect script for SSH logging as $username to $hostname using $password and executing $command. +# Usage: +# ./ssh.exp username password hostname command +set username [lrange $argv 0 0] +set password [lrange $argv 1 1] +set hostname [lrange $argv 2 2] +set command [lrange $argv 3 10] +set timeout 15 +# connect to remote host and execute given command +log_user 1 +spawn ssh -t $username@$hostname "$command ; sleep 5" +expect { + -nocase "yes/no" { send -- "yes\r" ; exp_continue } + -nocase "password" { send -- "$password\r" } +} +log_user 1 +# send -- "\r" +expect eof + diff --git a/selinux-policy/dmidecode-and-similar/testpolicy.te b/selinux-policy/dmidecode-and-similar/testpolicy.te new file mode 100644 index 0000000..9f732dd --- /dev/null +++ b/selinux-policy/dmidecode-and-similar/testpolicy.te @@ -0,0 +1,18 @@ +policy_module(testpolicy,1.0) + +require { + type initrc_t; + type dmidecode_t; + type dmidecode_exec_t; + type console_device_t; + class file { getattr open read execute }; + class process { transition }; + class chr_file { read write }; +} + +allow initrc_t dmidecode_exec_t : file { getattr open read execute }; +type_transition initrc_t dmidecode_exec_t : process dmidecode_t; +allow initrc_t dmidecode_t : process { transition }; +allow dmidecode_t initrc_t:process { sigchld }; +allow dmidecode_t console_device_t : chr_file { read write }; + From fa3b0fe2ce4ef92e523a6c0c10141dc69214fe7b Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Wed, 24 Feb 2021 16:29:36 +0100 Subject: [PATCH 008/626] kernel/synflood: disable on s390x There are no s390x machines with enough cores to run this test in RH's Beaker and likely won't be available in any CI system in the near future. Thus, exclude the test from this arch so that testing doesn't fail due to lack of matching hardware. Signed-off-by: Ondrej Mosnacek --- kernel/synflood/main.fmf | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/kernel/synflood/main.fmf b/kernel/synflood/main.fmf index 94c46d0..f548123 100644 --- a/kernel/synflood/main.fmf +++ b/kernel/synflood/main.fmf @@ -21,9 +21,12 @@ duration: 1h enabled: true tier: 3 adjust: - enabled: false + - enabled: false when: distro < rhel-8 because: The test doesn't work well on RHEL-7 + - enabled: false + when: arch = s390x + because: No machines likely available with required HW configuration extra-hardware: | keyvalue = PROCESSORS >= 64 hostrequire = From 9be7e22519f35d64e309ead9687de80ce41ad95e Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Fri, 19 Feb 2021 19:46:13 +0100 Subject: [PATCH 009/626] add the numad test to upstream repo The numad component is used in various versions of RHEL and Fedora, so it makes sense to run this TC in upstream testing too. Moving the downstream TC to upstream repository. There are some minor changes when comparing the upstream and downstream versions of the TC. --- selinux-policy/numad-and-similar/Makefile | 84 +++++++++++++ selinux-policy/numad-and-similar/PURPOSE | 5 + selinux-policy/numad-and-similar/main.fmf | 2 + selinux-policy/numad-and-similar/runtest.sh | 125 ++++++++++++++++++++ 4 files changed, 216 insertions(+) create mode 100644 selinux-policy/numad-and-similar/Makefile create mode 100644 selinux-policy/numad-and-similar/PURPOSE create mode 100644 selinux-policy/numad-and-similar/main.fmf create mode 100644 selinux-policy/numad-and-similar/runtest.sh diff --git a/selinux-policy/numad-and-similar/Makefile b/selinux-policy/numad-and-similar/Makefile new file mode 100644 index 0000000..cff1beb --- /dev/null +++ b/selinux-policy/numad-and-similar/Makefile @@ -0,0 +1,84 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/numad-and-similar +# Description: SELinux interferes with numad and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2021 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/numad-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with numad and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "RunFor: numad" >> $(METADATA) + @echo "Requires: audit" >> $(METADATA) + @echo "Requires: expect" >> $(METADATA) + @echo "Requires: grep" >> $(METADATA) + @echo "Requires: initscripts" >> $(METADATA) + @echo "Requires: libselinux" >> $(METADATA) + @echo "Requires: libselinux-utils" >> $(METADATA) + @echo "Requires: numad" >> $(METADATA) + @echo "Requires: policycoreutils" >> $(METADATA) + @echo "Requires: procps" >> $(METADATA) + @echo "Requires: selinux-policy" >> $(METADATA) + @echo "Requires: setools" >> $(METADATA) + @echo "Requires: setools-console" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Architectures: i386 ppc64 x86_64" >> $(METADATA) + @echo "Releases: -RHEL4 -RHELServer5 -RHELClient5" >> $(METADATA) + @echo "Bug: 807157" >> $(METADATA) # RHEL-6 + @echo "Bug: 857086" >> $(METADATA) # RHEL-7 + @echo "Bug: 1074449" >> $(METADATA) # RHEL-7 + @echo "Bug: 1118515" >> $(METADATA) # RHEL-7 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/numad-and-similar/PURPOSE b/selinux-policy/numad-and-similar/PURPOSE new file mode 100644 index 0000000..e3fd202 --- /dev/null +++ b/selinux-policy/numad-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/numad-and-similar +Author: Milos Malik + +SELinux interferes with numad and related programs. + diff --git a/selinux-policy/numad-and-similar/main.fmf b/selinux-policy/numad-and-similar/main.fmf new file mode 100644 index 0000000..e1d0e95 --- /dev/null +++ b/selinux-policy/numad-and-similar/main.fmf @@ -0,0 +1,2 @@ +path: /selinux-policy/numad-and-similar +tier: 2 diff --git a/selinux-policy/numad-and-similar/runtest.sh b/selinux-policy/numad-and-similar/runtest.sh new file mode 100644 index 0000000..0c639ef --- /dev/null +++ b/selinux-policy/numad-and-similar/runtest.sh @@ -0,0 +1,125 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/numad-and-similar +# Description: SELinux interferes with numad and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2021 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include rhts environment +. /usr/bin/rhts-environment.sh +. /usr/share/beakerlib/beakerlib.sh + +PACKAGE="selinux-policy" +ROOT_PASSWORD="redhat" +SERVICE_NAME="numad" +PROCESS_NAME="numad" +PROCESS_CONTEXT="numad_t" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm numad + + rlServiceStop ${SERVICE_NAME} + rlFileBackup /etc/shadow + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + if rlSEDefined "numad_t numad_exec_t" ; then + rlPhaseStartTest "bz#807157" + rlSEMatchPathCon "/usr/bin/numad" "numad_exec_t" + rlSESearchRule "allow initrc_t numad_t : process { transition }" + rlPhaseEnd + fi + + if rlSEDefined "numad_exec_t cgroup_t numad_t" ; then + rlPhaseStartTest "bz#857086" + rlSEMatchPathCon "/usr/bin/numad" "numad_exec_t" + if rlIsRHEL 6 ; then + MOUNT_POINT="/cgroup/cpuset" + rlSEMatchPathCon "${MOUNT_POINT}" "cgroup_t" + else + MOUNT_POINT="/sys/fs/cgroup/cpuset" + if [ -d ${MOUNT_POINT} ] ; then + rlRun "ls -dZ ${MOUNT_POINT} | grep :cgroup_t" + else + rlSEMatchPathCon "/sys/fs/cgroup" "cgroup_t" + fi + fi + rlSESearchRule "allow numad_t cgroup_t : dir { getattr search }" + rlSESearchRule "allow numad_t numad_t : msg { send receive }" + rlPhaseEnd + fi + + if ! rlIsRHEL 5 6 ; then + rlPhaseStartTest "bz#1074449" + rlSEMatchPathCon "/usr/bin/numad" "numad_exec_t" + rlSESearchRule "allow numad_t sysfs_t : file { write }" + rlPhaseEnd + + rlPhaseStartTest "bz#1118515" + rlSEMatchPathCon "/usr/bin/numad" "numad_exec_t" + rlSEMatchPathCon "/var/log/numad.log" "numad_var_log_t" + rlSEMatchPathCon "/var/run/numad.pid" "numad_var_run_t" + rlSESearchRule "allow virtd_t numad_exec_t : file { getattr open read execute }" + rlSESearchRule "type_transition virtd_t numad_exec_t : process numad_t" + rlSESearchRule "allow virtd_t numad_t : process { transition }" + rlSESearchRule "allow numad_t numad_var_log_t : file { open }" + rlSESearchRule "allow numad_t numad_t : msg { send receive }" + rlSESearchRule "allow numad_t numad_t : msgq { associate unix_read unix_write read write }" + rlSESearchRule "allow numad_t numad_var_run_t : file { getattr open read }" + rlPhaseEnd + fi + + rlPhaseStartTest "real scenario" + rlRun "mkdir -p ${MOUNT_POINT}" + if ! mount | grep -q "cgroup.*cpuset" ; then + rlRun "mount cgroup -t cgroup -o cpuset ${MOUNT_POINT}" 0,32 + fi + rlRun "semodule -l | grep numad" + rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "numad -S 0" + rlRun "numad -S 1" + rlRun "restorecon -Rv /run /var" + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + rlFileRestore + + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd + rlJournalPrintText +rlJournalEnd + From d5312d22c018dd04fe31d932ce87368ce7fa3e20 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Mon, 14 Dec 2020 20:09:28 +0100 Subject: [PATCH 010/626] add the colord test to upstream repo The colord service is available in various Fedoras and RHELs, so it makes sense to run the TC in upstream testing too. There are no changes in the TC functionality. Moving the downstream TC to upstream repo. --- selinux-policy/colord-and-similar/Makefile | 74 +++++++++ selinux-policy/colord-and-similar/PURPOSE | 5 + selinux-policy/colord-and-similar/main.fmf | 2 + selinux-policy/colord-and-similar/runtest.sh | 153 +++++++++++++++++++ selinux-policy/colord-and-similar/ssh.exp | 20 +++ 5 files changed, 254 insertions(+) create mode 100644 selinux-policy/colord-and-similar/Makefile create mode 100644 selinux-policy/colord-and-similar/PURPOSE create mode 100644 selinux-policy/colord-and-similar/main.fmf create mode 100755 selinux-policy/colord-and-similar/runtest.sh create mode 100755 selinux-policy/colord-and-similar/ssh.exp diff --git a/selinux-policy/colord-and-similar/Makefile b/selinux-policy/colord-and-similar/Makefile new file mode 100644 index 0000000..4a609b8 --- /dev/null +++ b/selinux-policy/colord-and-similar/Makefile @@ -0,0 +1,74 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/colord-and-similar +# Description: SELinux interferes with colord and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/colord-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE ssh.exp + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh ssh.exp + chcon -t bin_t runtest.sh ssh.exp + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with colord and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "RunFor: colord" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted glib2 setools-console colord initscripts expect" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Releases: -RHEL4 -RHELServer5 -RHELClient5 -RHEL6" >> $(METADATA) + @echo "Bug: 1373082" >> $(METADATA) # RHEL-7 + @echo "Bug: 1381579" >> $(METADATA) # RHEL-7 + @echo "Bug: 1398030" >> $(METADATA) # RHEL-7 + @echo "Bug: 1421247" >> $(METADATA) # RHEL-7 + @echo "Bug: 1460480" >> $(METADATA) # RHEL-7 + @echo "Bug: 1772669" >> $(METADATA) # RHEL-8 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/colord-and-similar/PURPOSE b/selinux-policy/colord-and-similar/PURPOSE new file mode 100644 index 0000000..eca8438 --- /dev/null +++ b/selinux-policy/colord-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/colord-and-similar +Author: Milos Malik + +SELinux interferes with colord and related programs. + diff --git a/selinux-policy/colord-and-similar/main.fmf b/selinux-policy/colord-and-similar/main.fmf new file mode 100644 index 0000000..418c370 --- /dev/null +++ b/selinux-policy/colord-and-similar/main.fmf @@ -0,0 +1,2 @@ +path: /selinux-policy/colord-and-similar +tier: 2 diff --git a/selinux-policy/colord-and-similar/runtest.sh b/selinux-policy/colord-and-similar/runtest.sh new file mode 100755 index 0000000..b385f8c --- /dev/null +++ b/selinux-policy/colord-and-similar/runtest.sh @@ -0,0 +1,153 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/colord-and-similar +# Description: SELinux interferes with colord and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +ROOT_PASSWORD="redhat" +SERVICE_PACKAGE="colord" +SERVICE_NAME="colord" +PROCESS_NAME="colord" +PROCESS_CONTEXT="colord_t" +ALLOWED_USERS=${ALLOWED_USERS:-"staff_u user_u sysadm_u unconfined_u"} +DENIED_USERS=${DENIED_USERS:-"guest_u xguest_u"} + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} + rlFileBackup /etc/shadow + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "bz#1373082 + bz#1381579 + bz#1398030 + bz#1421247 + bz#1460480" + rlSEMatchPathCon "/usr/libexec/colord" "colord_exec_t" + rlSEMatchPathCon "/etc/udev/hwdb.bin" "systemd_hwdb_etc_t" + rlSESearchRule "allow colord_t systemd_hwdb_etc_t : file { getattr open read } [ ]" + rlPhaseEnd + + if ! rlIsRHEL 5 ; then + rlPhaseStartTest "real scenario -- DBus service" + DESTINATION="org.freedesktop.ColorManager" + rlRun "gdbus introspect --system --object-path / --dest ${DESTINATION} >& /dev/null" + sleep 1 + rlRun "ps -efZ | grep -v grep | grep ${PROCESS_NAME}" + rlRun "ps -efZ | grep -v grep | grep \"${PROCESS_CONTEXT}.*${PROCESS_NAME}\"" + rlPhaseEnd + fi + + if ! rlIsRHEL 5 6 7 ; then + rlPhaseStartTest "real scenario -- user session service" + rlFileBackup /etc/ssh/sshd_config + rlRun "sed -i 's/^.*PermitRootLogin.*$/PermitRootLogin yes/' /etc/ssh/sshd_config" + rlRun "sed -i 's/^.*PasswordAuthentication.*$/PasswordAuthentication yes/' /etc/ssh/sshd_config" + rlRun "service sshd restart" + + rlRun "setsebool ssh_sysadm_login on" + rlLog "configuration says not to test SELinux users: ${DENIED_USERS}" + for SELINUX_USER in ${ALLOWED_USERS} ; do + USER_NAME="user${RANDOM}" + USER_SECRET="S3kr3t${RANDOM}" + rlRun "useradd -Z ${SELINUX_USER} ${USER_NAME}" + rlRun "echo ${USER_SECRET} | passwd --stdin ${USER_NAME}" + rlRun "restorecon -RvF /home/${USER_NAME}" + rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost /usr/bin/systemctl --user --no-pager status colord-session" + rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost /usr/bin/systemctl --user --no-pager start colord-session" + rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost /usr/bin/systemctl --user --no-pager stop colord-session" + rlRun "userdel -rfZ ${USER_NAME}" + sleep 10 + done + rlRun "setsebool ssh_sysadm_login off" + rlPhaseEnd + + rlPhaseStartTest "bz#1772669" + # TODO: find an agreement about which confined users should be allowed + rlSESearchRule "allow staff_t colord_t : dbus { send_msg } [ ]" + rlSESearchRule "allow colord_t staff_t : dbus { send_msg } [ ]" + rlSESearchRule "allow user_t colord_t : dbus { send_msg } [ ]" + rlSESearchRule "allow colord_t user_t : dbus { send_msg } [ ]" + rlSESearchRule "allow sysadm_t colord_t : dbus { send_msg } [ ]" + rlSESearchRule "allow colord_t sysadm_t : dbus { send_msg } [ ]" + rlSESearchRule "allow unconfined_t colord_t : dbus { send_msg } [ ]" + rlSESearchRule "allow colord_t unconfined_t : dbus { send_msg } [ ]" + rlPhaseEnd + + rlPhaseStartTest "real scenario -- bz#1772669" + rlRun "setsebool ssh_sysadm_login on" + rlLog "configuration says not to test SELinux users: ${DENIED_USERS}" + for SELINUX_USER in ${ALLOWED_USERS} ; do + USER_NAME="user${RANDOM}" + USER_SECRET="S3kr3t${RANDOM}" + rlRun "useradd -Z ${SELINUX_USER} ${USER_NAME}" + rlRun "echo ${USER_SECRET} | passwd --stdin ${USER_NAME}" + rlRun "restorecon -RvF /home/${USER_NAME}" + rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost colormgr get-devices" + sleep 2 + rlRun "userdel -rfZ ${USER_NAME}" + sleep 10 + done + rlRun "setsebool ssh_sysadm_login off" + rlPhaseEnd + fi + + rlPhaseStartTest "real scenario" + rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + if rlIsRHEL 5 6 ; then + PROCESS_CONTEXT="initrc_t" + else + PROCESS_CONTEXT="unconfined_service_t" + fi + fi + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /run /var" + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlRun "service sshd restart" + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/colord-and-similar/ssh.exp b/selinux-policy/colord-and-similar/ssh.exp new file mode 100755 index 0000000..1244013 --- /dev/null +++ b/selinux-policy/colord-and-similar/ssh.exp @@ -0,0 +1,20 @@ +#!/usr/bin/expect -f +# Expect script for SSH logging as $username to $hostname using $password and executing $command. +# Usage: +# ./ssh.exp username password hostname command +set username [lrange $argv 0 0] +set password [lrange $argv 1 1] +set hostname [lrange $argv 2 2] +set command [lrange $argv 3 10] +set timeout 15 +# connect to remote host and execute given command +log_user 1 +spawn ssh -t $username@$hostname "$command ; sleep 5" +expect { + -nocase "yes/no" { send -- "yes\r" ; exp_continue } + -nocase "password" { send -- "$password\r" } +} +log_user 1 +# send -- "\r" +expect eof + From 0ff14c982096476e3b05a5c0ff82d086b1c97d42 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Mon, 14 Dec 2020 21:52:53 +0100 Subject: [PATCH 011/626] add the fwupd test to upstream repo The fwupd service is available in various Fedoras and RHELs, so it makes sense to run the TC in upstream testing too. There are no changes in the TC functionality. Moving the downstream TC to upstream repo. --- selinux-policy/fwupd-and-similar/Makefile | 73 ++++++++ selinux-policy/fwupd-and-similar/PURPOSE | 6 + selinux-policy/fwupd-and-similar/main.fmf | 2 + selinux-policy/fwupd-and-similar/runtest.sh | 189 ++++++++++++++++++++ selinux-policy/fwupd-and-similar/ssh.exp | 20 +++ 5 files changed, 290 insertions(+) create mode 100644 selinux-policy/fwupd-and-similar/Makefile create mode 100644 selinux-policy/fwupd-and-similar/PURPOSE create mode 100644 selinux-policy/fwupd-and-similar/main.fmf create mode 100755 selinux-policy/fwupd-and-similar/runtest.sh create mode 100755 selinux-policy/fwupd-and-similar/ssh.exp diff --git a/selinux-policy/fwupd-and-similar/Makefile b/selinux-policy/fwupd-and-similar/Makefile new file mode 100644 index 0000000..6f28850 --- /dev/null +++ b/selinux-policy/fwupd-and-similar/Makefile @@ -0,0 +1,73 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/fwupd-and-similar +# Description: SELinux interferes with fwupd and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/fwupd-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE ssh.exp + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh ssh.exp + chcon -t bin_t runtest.sh ssh.exp + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with fwupd and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: fwupd" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console glib2 fwupd initscripts expect" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHELClient5 -RHELServer5 -RHEL6" >> $(METADATA) + @echo "Bug: 1772619" >> $(METADATA) # RHEL-8 + @echo "Bug: 1832231" >> $(METADATA) # RHEL-8 + @echo "Bug: 1832234" >> $(METADATA) # RHEL-8 + @echo "Bug: 1832772" >> $(METADATA) # RHEL-8 + @echo "Bug: 1851932" >> $(METADATA) # RHEL-8 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/fwupd-and-similar/PURPOSE b/selinux-policy/fwupd-and-similar/PURPOSE new file mode 100644 index 0000000..b988125 --- /dev/null +++ b/selinux-policy/fwupd-and-similar/PURPOSE @@ -0,0 +1,6 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/fwupd-and-similar +Author: Milos Malik + +SELinux interferes with fwupd and related programs. +Standalone service and confined users are tested. + diff --git a/selinux-policy/fwupd-and-similar/main.fmf b/selinux-policy/fwupd-and-similar/main.fmf new file mode 100644 index 0000000..2425d89 --- /dev/null +++ b/selinux-policy/fwupd-and-similar/main.fmf @@ -0,0 +1,2 @@ +path: /selinux-policy/fwupd-and-similar +tier: 2 diff --git a/selinux-policy/fwupd-and-similar/runtest.sh b/selinux-policy/fwupd-and-similar/runtest.sh new file mode 100755 index 0000000..4a49c73 --- /dev/null +++ b/selinux-policy/fwupd-and-similar/runtest.sh @@ -0,0 +1,189 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/fwupd-and-similar +# Description: SELinux interferes with fwupd and related programs. +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +ROOT_PASSWORD="redhat" +FILE_PATH="/usr/libexec/fwupd/fwupd" +FILE_CONTEXT="fwupd_exec_t" +SERVICE_PACKAGE="fwupd" +SERVICE_NAME="fwupd" +PROCESS_NAME="fwupd" +PROCESS_CONTEXT="fwupd_t" +ALLOWED_USERS=${ALLOWED_USERS:-"staff_u user_u sysadm_u unconfined_u"} +DENIED_USERS=${DENIED_USERS:-"guest_u xguest_u"} + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} + rlFileBackup /etc/shadow + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + if rlSEDefined ${PROCESS_CONTEXT} ; then + rlPhaseStartTest "SELinux contexts and rules" + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + if rlIsRHEL 5 ; then + SOURCE_TYPE="initrc_t" + BOOLEANS="[ ]" + elif rlIsRHEL 6 ; then + SOURCE_TYPE="initrc_t" + else # RHEL-7 etc. + SOURCE_TYPE="init_t" # systemd runs the process + fi + rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" + rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" + rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" + rlPhaseEnd + fi + + if ! rlIsRHEL 5 ; then + rlPhaseStartTest "real scenario -- DBus service" + DESTINATION="org.freedesktop.fwupd" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + # RHEL-4, RHEL-5, RHEL-6 is excluded + PROCESS_CONTEXT="unconfined_service_t" + fi + rlRun "gdbus introspect --system --object-path / --dest ${DESTINATION} >& /dev/null" + sleep 1 + rlRun "ps -efZ | grep -v grep | grep ${PROCESS_NAME}" + rlRun "ps -efZ | grep -v grep | grep \"${PROCESS_CONTEXT}.*${PROCESS_NAME}\"" + rlPhaseEnd + fi + + rlPhaseStartTest "real scenario -- standalone service" + rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + # RHEL-4, RHEL-5, RHEL-6 is excluded + PROCESS_CONTEXT="unconfined_service_t" + fi + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /run /var" 0-255 + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + + if rlSEDefined "fwupd_t" ; then + rlPhaseStartTest "bz#1772619" + # TODO: find an agreement about which confined users should be allowed + rlSESearchRule "allow staff_t fwupd_t : dbus { send_msg } [ ]" + rlSESearchRule "allow fwupd_t staff_t : dbus { send_msg } [ ]" + rlSESearchRule "allow user_t fwupd_t : dbus { send_msg } [ ]" + rlSESearchRule "allow fwupd_t user_t : dbus { send_msg } [ ]" + rlSESearchRule "allow sysadm_t fwupd_t : dbus { send_msg } [ ]" + rlSESearchRule "allow fwupd_t sysadm_t : dbus { send_msg } [ ]" + rlSESearchRule "allow unconfined_t fwupd_t : dbus { send_msg } [ ]" + rlSESearchRule "allow fwupd_t unconfined_t : dbus { send_msg } [ ]" + rlPhaseEnd + fi + + if rlSEDefined "fwupd_var_lib_t" ; then + rlPhaseStartTest "bz#1832231" + rlSEMatchPathCon "/var/lib/fwupd" "fwupd_var_lib_t" + rlSESearchRule "allow init_t fwupd_var_lib_t : dir { setattr } [ init_create_dirs ]" + rlPhaseEnd + fi + + if rlSEDefined "fwupd_cache_t" ; then + rlPhaseStartTest "bz#1832234" + rlSEMatchPathCon "/var/cache/fwupd" "fwupd_cache_t" + rlSEMatchPathCon "/var/cache/fwupd/motd.d" "fwupd_cache_t" + rlSEMatchPathCon "/var/cache/fwupd/motd.d/85-fwupd" "fwupd_cache_t" + rlSESearchRule "allow init_t pam_var_run_t : dir { mounton } [ init_create_dirs ]" + rlPhaseEnd + fi + + if ! rlIsRHEL 5 6 7 ; then + rlPhaseStartTest "bz#1851932" + rlSESearchRule "allow systemd_logind_t fwupd_t : dbus { send_msg } [ ]" + rlSESearchRule "allow fwupd_t systemd_logind_t : dbus { send_msg } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1832772" + rlSEMatchPathCon "/dev/shm/lldpad.state" "lldpad_tmpfs_t" + rlSESearchRule "allow init_t lldpad_tmpfs_t : file { getattr } [ ]" + rlSESearchRule "allow init_t squid_tmpfs_t : file { getattr } [ ]" + rlSESearchRule "allow init_t vhostmd_tmpfs_t : file { getattr } [ ]" + rlSESearchRule "allow init_t wdmd_tmpfs_t : file { getattr } [ ]" + rlPhaseEnd + + rlPhaseStartTest "real scenario -- bz#1832772" + rlRun "ls -Z /dev/shm" + rlRun "service fwupd-refresh start" 0-255 + sleep 1 + rlRun "service fwupd-refresh status" 0-255 + sleep 1 + rlRun "service fwupd-refresh stop" 0-255 + rlPhaseEnd + fi + + rlPhaseStartTest "real scenario -- confined users -- bz#1772619" + rlFileBackup /etc/ssh/sshd_config + rlRun "sed -i 's/^.*PermitRootLogin.*$/PermitRootLogin yes/' /etc/ssh/sshd_config" + rlRun "sed -i 's/^.*PasswordAuthentication.*$/PasswordAuthentication yes/' /etc/ssh/sshd_config" + rlRun "service sshd restart" + + rlRun "setsebool ssh_sysadm_login on" + rlLog "configuration says not to test SELinux users: ${DENIED_USERS}" + for SELINUX_USER in ${ALLOWED_USERS} ; do + USER_NAME="user${RANDOM}" + USER_SECRET="S3kr3t${RANDOM}" + rlRun "useradd -Z ${SELINUX_USER} ${USER_NAME}" + rlRun "echo ${USER_SECRET} | passwd --stdin ${USER_NAME}" + rlRun "restorecon -RvF /home/${USER_NAME}" + rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost fwupdmgr get-devices" + sleep 2 + rlRun "userdel -rfZ ${USER_NAME}" + sleep 10 + done + rlRun "setsebool ssh_sysadm_login off" + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlRun "service sshd restart" + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/fwupd-and-similar/ssh.exp b/selinux-policy/fwupd-and-similar/ssh.exp new file mode 100755 index 0000000..58c9647 --- /dev/null +++ b/selinux-policy/fwupd-and-similar/ssh.exp @@ -0,0 +1,20 @@ +#!/usr/bin/expect -f +# Expect script for SSH logging as $username to $hostname using $password and executing $command. +# Usage: +# ./ssh.exp username password hostname command +set username [lrange $argv 0 0] +set password [lrange $argv 1 1] +set hostname [lrange $argv 2 2] +set command [lrange $argv 3 10] +set timeout 15 +# connect to remote host and execute given command +log_user 1 +spawn ssh -t $username@$hostname $command +expect { + -nocase "yes/no" { send -- "yes\r" ; exp_continue } + -nocase "password" { send -- "$password\r" } +} +log_user 1 +# send -- "\r" +expect eof + From 1cdc4059919ddee7a577ce3e3f02e72bf5a9aa18 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 15 Dec 2020 08:52:02 +0100 Subject: [PATCH 012/626] add the journalctl test to upstream repo The journalctl command is frequently used by various users on Fedora and RHEL, so it makes sense to run this TC in upstream testing too. There are no changes in the TC functionality. Moving the downstream TC to upstream repo. --- .../journalctl-and-similar/Makefile | 72 ++++++++++ selinux-policy/journalctl-and-similar/PURPOSE | 5 + .../journalctl-and-similar/main.fmf | 2 + .../journalctl-and-similar/runtest.sh | 124 ++++++++++++++++++ selinux-policy/journalctl-and-similar/ssh.exp | 20 +++ 5 files changed, 223 insertions(+) create mode 100644 selinux-policy/journalctl-and-similar/Makefile create mode 100644 selinux-policy/journalctl-and-similar/PURPOSE create mode 100644 selinux-policy/journalctl-and-similar/main.fmf create mode 100755 selinux-policy/journalctl-and-similar/runtest.sh create mode 100755 selinux-policy/journalctl-and-similar/ssh.exp diff --git a/selinux-policy/journalctl-and-similar/Makefile b/selinux-policy/journalctl-and-similar/Makefile new file mode 100644 index 0000000..255fcdf --- /dev/null +++ b/selinux-policy/journalctl-and-similar/Makefile @@ -0,0 +1,72 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/journalctl-and-similar +# Description: SELinux interferes with journalctl executed by various users +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/journalctl-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE ssh.exp + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh ssh.exp + chcon -t bin_t runtest.sh ssh.exp + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with journalctl executed by various users" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "RunFor: systemd" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console expect openssh-clients systemd shadow-utils" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6" >> $(METADATA) + @echo "Bug: 1176713" >> $(METADATA) # Fedora 21 + @echo "Bug: 1288255" >> $(METADATA) # RHEL-7 + @echo "Bug: 1685689" >> $(METADATA) # RHEL-8 + @echo "Bug: 1825894" >> $(METADATA) # RHEL-8 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/journalctl-and-similar/PURPOSE b/selinux-policy/journalctl-and-similar/PURPOSE new file mode 100644 index 0000000..806f597 --- /dev/null +++ b/selinux-policy/journalctl-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/journalctl-and-similar +Author: Milos Malik + +SELinux interferes with journalctl executed by various users. + diff --git a/selinux-policy/journalctl-and-similar/main.fmf b/selinux-policy/journalctl-and-similar/main.fmf new file mode 100644 index 0000000..cf8103f --- /dev/null +++ b/selinux-policy/journalctl-and-similar/main.fmf @@ -0,0 +1,2 @@ +path: /selinux-policy/journalctl-and-similar +tier: 2 diff --git a/selinux-policy/journalctl-and-similar/runtest.sh b/selinux-policy/journalctl-and-similar/runtest.sh new file mode 100755 index 0000000..7a53398 --- /dev/null +++ b/selinux-policy/journalctl-and-similar/runtest.sh @@ -0,0 +1,124 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/journalctl-and-similar +# Description: SELinux interferes with journalctl executed by various users +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +FILE_PATH="/usr/bin/journalctl" +FILE_CONTEXT="journalctl_exec_t" +SERVICE_PACKAGE="systemd" +SERVICE_NAME="" +PROCESS_NAME="journalctl" +PROCESS_CONTEXT="journalctl_t" +ALLOWED_USERS=${ALLOWED_USERS:-"staff_u user_u sysadm_u unconfined_u"} +DENIED_USERS=${DENIED_USERS:-"guest_u xguest_u"} + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "bz#1176713" + rlSEMatchPathCon "/usr/bin/journalctl" "journalctl_exec_t" + rlSEMatchPathCon "/dev/urandom" "urandom_device_t" + rlSESearchRule "allow journalctl_t urandom_device_t : chr_file { getattr open read } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1288255" + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + rlSESearchRule "allow staff_t ${FILE_CONTEXT} : file { getattr open read execute } [ ]" + rlSESearchRule "allow sysadm_t ${FILE_CONTEXT} : file { getattr open read execute } [ ]" + rlSESearchRule "allow user_t ${FILE_CONTEXT} : file { getattr open read execute } [ ]" + rlSESearchRule "allow staff_t ${PROCESS_CONTEXT} : process { transition } [ ]" + rlSESearchRule "allow sysadm_t ${PROCESS_CONTEXT} : process { transition } [ ]" + rlSESearchRule "allow user_t ${PROCESS_CONTEXT} : process { transition } [ ]" + rlSESearchRule "type_transition staff_t ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} [ ]" + rlSESearchRule "type_transition sysadm_t ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} [ ]" + rlSESearchRule "type_transition user_t ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1685689" + rlSEMatchPathCon "/usr/bin/journalctl" "journalctl_exec_t" + rlSEMatchPathCon "/run/log/journal/bfd37efc55db4f44a0f350821db2b810/system.journal" "syslogd_var_run_t" + if rlIsRHEL 7 ; then + # the domain_can_mmap_files boolean is enabled by default + rlSESearchRule "allow journalctl_t syslogd_var_run_t : file { map }" + else + # the domain_can_mmap_files boolean is disabled by default + rlSESearchRule "allow journalctl_t syslogd_var_run_t : file { map } [ ]" + fi + rlPhaseEnd + + rlPhaseStartTest "bz#1825894" + rlSEMatchPathCon "/usr/bin/journalctl" "journalctl_exec_t" + rlSESearchRule "allow journalctl_t journalctl_t : process { setrlimit } [ ]" + rlPhaseEnd + + rlPhaseStartTest "real scenario -- confined users" + rlFileBackup /etc/ssh/sshd_config + rlRun "sed -i 's/^.*PermitRootLogin.*$/PermitRootLogin yes/' /etc/ssh/sshd_config" + rlRun "sed -i 's/^.*PasswordAuthentication.*$/PasswordAuthentication yes/' /etc/ssh/sshd_config" + rlRun "service sshd restart" + + rlRun "setsebool ssh_sysadm_login on" + rlLog "configuration says not to test SELinux users: ${DENIED_USERS}" + for SELINUX_USER in ${ALLOWED_USERS} ; do + USER_NAME="user${RANDOM}" + USER_SECRET="S3kr3t${RANDOM}" + rlRun "useradd -Z ${SELINUX_USER} ${USER_NAME}" + rlRun "echo ${USER_SECRET} | passwd --stdin ${USER_NAME}" + rlRun "usermod -G systemd-journal ${USER_NAME}" + rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost journalctl -n 10 --no-pager --user" + rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost journalctl -n 10 --no-pager --system" + rlRun "userdel -rfZ ${USER_NAME}" + sleep 10 + done + rlRun "setsebool ssh_sysadm_login off" + + rlFileRestore + rlRun "service sshd restart" + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/journalctl-and-similar/ssh.exp b/selinux-policy/journalctl-and-similar/ssh.exp new file mode 100755 index 0000000..58c9647 --- /dev/null +++ b/selinux-policy/journalctl-and-similar/ssh.exp @@ -0,0 +1,20 @@ +#!/usr/bin/expect -f +# Expect script for SSH logging as $username to $hostname using $password and executing $command. +# Usage: +# ./ssh.exp username password hostname command +set username [lrange $argv 0 0] +set password [lrange $argv 1 1] +set hostname [lrange $argv 2 2] +set command [lrange $argv 3 10] +set timeout 15 +# connect to remote host and execute given command +log_user 1 +spawn ssh -t $username@$hostname $command +expect { + -nocase "yes/no" { send -- "yes\r" ; exp_continue } + -nocase "password" { send -- "$password\r" } +} +log_user 1 +# send -- "\r" +expect eof + From 3accb351d093cce2a08350034aac65bd5dd634ed Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Mon, 14 Dec 2020 20:51:18 +0100 Subject: [PATCH 013/626] add the boltd test to upstream repo The boltd service is available in various Fedoras and RHELs, so it makes sense to run the TC in upstream testing too. There are no changes in the TC functionality. Moving the downstream TC to upstream repo. --- selinux-policy/boltd-and-similar/Makefile | 74 +++++++++ selinux-policy/boltd-and-similar/PURPOSE | 5 + selinux-policy/boltd-and-similar/main.fmf | 2 + selinux-policy/boltd-and-similar/runtest.sh | 166 ++++++++++++++++++++ selinux-policy/boltd-and-similar/ssh.exp | 20 +++ 5 files changed, 267 insertions(+) create mode 100644 selinux-policy/boltd-and-similar/Makefile create mode 100644 selinux-policy/boltd-and-similar/PURPOSE create mode 100644 selinux-policy/boltd-and-similar/main.fmf create mode 100755 selinux-policy/boltd-and-similar/runtest.sh create mode 100755 selinux-policy/boltd-and-similar/ssh.exp diff --git a/selinux-policy/boltd-and-similar/Makefile b/selinux-policy/boltd-and-similar/Makefile new file mode 100644 index 0000000..e1a39c5 --- /dev/null +++ b/selinux-policy/boltd-and-similar/Makefile @@ -0,0 +1,74 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/boltd-and-similar +# Description: SELinux interferes with boltd and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/boltd-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE ssh.exp + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh ssh.exp + chcon -t bin_t runtest.sh ssh.exp + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with boltd and related programs." >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 30m" >> $(METADATA) + @echo "RunFor: bolt" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit initscripts libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console glib2 expect openssh-clients bolt" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6" >> $(METADATA) + @echo "Bug: 1589086" >> $(METADATA) # RHEL-7 + @echo "Bug: 1625786" >> $(METADATA) # Fedora 28 + @echo "Bug: 1684103" >> $(METADATA) # RHEL-8 + @echo "Bug: 1685591" >> $(METADATA) # RHEL-7 + @echo "Bug: 1702243" >> $(METADATA) # RHEL-8 + @echo "Bug: 1704766" >> $(METADATA) # RHEL-7 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/boltd-and-similar/PURPOSE b/selinux-policy/boltd-and-similar/PURPOSE new file mode 100644 index 0000000..69f4521 --- /dev/null +++ b/selinux-policy/boltd-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/boltd-and-similar +Author: Milos Malik + +SELinux interferes with boltd and related programs. + diff --git a/selinux-policy/boltd-and-similar/main.fmf b/selinux-policy/boltd-and-similar/main.fmf new file mode 100644 index 0000000..501df63 --- /dev/null +++ b/selinux-policy/boltd-and-similar/main.fmf @@ -0,0 +1,2 @@ +path: /selinux-policy/boltd-and-similar +tier: 2 diff --git a/selinux-policy/boltd-and-similar/runtest.sh b/selinux-policy/boltd-and-similar/runtest.sh new file mode 100755 index 0000000..bd26c50 --- /dev/null +++ b/selinux-policy/boltd-and-similar/runtest.sh @@ -0,0 +1,166 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/boltd-and-similar +# Description: SELinux interferes with boltd and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +ROOT_PASSWORD="redhat" +FILE_PATH="/usr/libexec/boltd" +FILE_CONTEXT="boltd_exec_t" +SERVICE_PACKAGE="bolt" +SERVICE_NAME="bolt" +PROCESS_NAME="boltd" +PROCESS_CONTEXT="boltd_t" +ALLOWED_USERS="staff_u user_u xguest_u sysadm_u unconfined_u" +DENIED_USERS="guest_u" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} + rlFileBackup /etc/shadow + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "bz#1589086 + bz#1684103 + bz#1685591" + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + rlSEMatchPathCon "/var/lib/boltd" "boltd_var_lib_t" + rlSEMatchPathCon "/var/run/dbus" "system_dbusd_var_run_t" + rlSEMatchPathCon "/var/run/dbus/system_bus_socket" "system_dbusd_var_run_t" + rlSEMatchPathCon "/var/lib/sss" "sssd_var_lib_t" + rlSEMatchPathCon "/var/lib/sss/mc" "sssd_public_t" + rlSEMatchPathCon "/var/lib/sss/mc/passwd" "sssd_public_t" + rlSEMatchPathCon "/var/lib/sss/pipes" "sssd_var_lib_t" + rlSEMatchPathCon "/var/lib/sss/pipes/nss" "sssd_var_lib_t" + rlSEMatchPathCon "/run/udev" "udev_var_run_t" + rlSEMatchPathCon "/run/udev/control" "udev_var_run_t" + if rlIsRHEL 5 ; then + SOURCE_TYPE="initrc_t" + BOOLEANS="[ ]" + elif rlIsRHEL 6 ; then + SOURCE_TYPE="initrc_t" + else # RHEL-7 etc. + SOURCE_TYPE="init_t" # systemd runs the process + fi + rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" + rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" + rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" + rlSESearchRule "allow unconfined_t boltd_t : dbus { send_msg }" + rlSESearchRule "allow boltd_t unconfined_t : dbus { send_msg }" + rlSESearchRule "allow boltd_t sssd_public_t : dir { search }" + rlSESearchRule "allow boltd_t sssd_public_t : file { getattr map open read }" + rlSESearchRule "allow boltd_t sssd_var_lib_t : sock_file { write }" + rlSESearchRule "allow boltd_t udev_var_run_t : dir { search }" + rlSESearchRule "allow boltd_t system_dbusd_var_run_t : dir { search }" + rlSESearchRule "allow boltd_t system_dbusd_t : dbus { send_msg } [ ]" + rlSESearchRule "allow boltd_t system_dbusd_t : unix_stream_socket { connectto } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1625786" + rlSESearchRule "allow boltd_t policykit_t : dbus { send_msg } [ ]" + rlSESearchRule "allow policykit_t boltd_t : dbus { send_msg } [ ]" + rlSESearchRule "allow boltd_t system_dbusd_t : dbus { acquire_svc } [ ]" + rlSESearchRule "allow boltd_t xdm_t : dbus { send_msg } [ ]" + rlSESearchRule "allow xdm_t boltd_t : dbus { send_msg } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1702243 + bz#1704766" + rlSESearchRule "allow staff_t boltd_t : dbus { send_msg } [ ]" + rlSESearchRule "allow boltd_t staff_t : dbus { send_msg } [ ]" + rlSESearchRule "allow user_t boltd_t : dbus { send_msg } [ ]" + rlSESearchRule "allow boltd_t user_t : dbus { send_msg } [ ]" + rlSESearchRule "allow xguest_t boltd_t : dbus { send_msg } [ ]" + rlSESearchRule "allow boltd_t xguest_t : dbus { send_msg } [ ]" + rlPhaseEnd + + rlPhaseStartTest "real scenario -- system D-bus" + DESTINATION="org.freedesktop.bolt" + rlRun "gdbus introspect --system --object-path / --dest ${DESTINATION} >& /dev/null" + sleep 2 + rlRun "ps -efZ | grep -v grep | grep ${PROCESS_NAME}" + rlRun "ps -efZ | grep -v grep | grep \"${PROCESS_CONTEXT}.*${PROCESS_NAME}\"" + rlPhaseEnd + + rlPhaseStartTest "real scenario -- standalone service" + rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + if rlIsRHEL 5 6 ; then + PROCESS_CONTEXT="initrc_t" + else + PROCESS_CONTEXT="unconfined_service_t" + fi + fi + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /run /var" + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + + rlPhaseStartTest "real scenario -- confined users" + rlFileBackup /etc/ssh/sshd_config + rlRun "sed -i 's/^.*PermitRootLogin.*$/PermitRootLogin yes/' /etc/ssh/sshd_config" + rlRun "sed -i 's/^.*PasswordAuthentication.*$/PasswordAuthentication yes/' /etc/ssh/sshd_config" + rlRun "service sshd restart" + + rlRun "setsebool ssh_sysadm_login on" + rlLog "configuration says not to test SELinux users: ${DENIED_USERS}" + for SELINUX_USER in ${ALLOWED_USERS} ; do + USER_NAME="user${RANDOM}" + USER_SECRET="S3kr3t${RANDOM}" + rlRun "useradd -Z ${SELINUX_USER} ${USER_NAME}" + rlRun "echo ${USER_SECRET} | passwd --stdin ${USER_NAME}" + rlRun "restorecon -RvF /home/${USER_NAME}" + rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost boltctl list" + sleep 2 + rlRun "userdel -rfZ ${USER_NAME}" + sleep 10 + done + rlRun "setsebool ssh_sysadm_login off" + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlRun "service sshd restart" + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/boltd-and-similar/ssh.exp b/selinux-policy/boltd-and-similar/ssh.exp new file mode 100755 index 0000000..58c9647 --- /dev/null +++ b/selinux-policy/boltd-and-similar/ssh.exp @@ -0,0 +1,20 @@ +#!/usr/bin/expect -f +# Expect script for SSH logging as $username to $hostname using $password and executing $command. +# Usage: +# ./ssh.exp username password hostname command +set username [lrange $argv 0 0] +set password [lrange $argv 1 1] +set hostname [lrange $argv 2 2] +set command [lrange $argv 3 10] +set timeout 15 +# connect to remote host and execute given command +log_user 1 +spawn ssh -t $username@$hostname $command +expect { + -nocase "yes/no" { send -- "yes\r" ; exp_continue } + -nocase "password" { send -- "$password\r" } +} +log_user 1 +# send -- "\r" +expect eof + From 3915ebfb3dbcdc9a0f12c8ab146fd18f0c39caaf Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Thu, 4 Mar 2021 11:42:16 +0100 Subject: [PATCH 014/626] kernel/selinux-testsuite: Bump upstream commit Highlights: - fixed lockdown and perf_event tests to work with latest Fedora policy - userfaultfd test added - removed dependency on `which` Signed-off-by: Ondrej Mosnacek --- kernel/selinux-testsuite/runtest.sh | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/kernel/selinux-testsuite/runtest.sh b/kernel/selinux-testsuite/runtest.sh index a3ca98f..c373309 100755 --- a/kernel/selinux-testsuite/runtest.sh +++ b/kernel/selinux-testsuite/runtest.sh @@ -35,7 +35,7 @@ PACKAGE="selinux-policy" # This should be updated as needed after verifying that the new version # doesn't break testing and after applying all necessary tweaks in the TC. # Run with GIT_BRANCH=master to run the latest upstream version. -DEFAULT_COMMIT="24bb5c0090710767ff187f1682e5bf355166caa3" +DEFAULT_COMMIT="9ef6c43a3ffa810c9a0061eb4625980dd178f60a" # Default pull requests to merge before running the test. # If non-empty, then after checking out GIT_BRANCH the listed upstream pull # requests (by number) are merged, creating a new temporary local branch. @@ -180,7 +180,6 @@ rlJournalStart rdma-core-devel selinux-policy-devel setools-console - which xfsprogs-devel " rlRun "installDeps \$REQUIRES" 0 "Install requires" From 3ef78f944656686969e524de099aed18dd6f5c0c Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Fri, 19 Feb 2021 19:14:18 +0100 Subject: [PATCH 015/626] add the rngd test to upstream repo The rng-tools component is used in various versions of RHEL and Fedora, so it makes sense to run this TC in upstream testing too. There are no changes in the TC functionality. Moving the downstream TC to upstream repository. --- selinux-policy/rngd-and-similar/Makefile | 90 +++++++++++ selinux-policy/rngd-and-similar/PURPOSE | 5 + selinux-policy/rngd-and-similar/main.fmf | 2 + selinux-policy/rngd-and-similar/runtest.sh | 176 +++++++++++++++++++++ 4 files changed, 273 insertions(+) create mode 100644 selinux-policy/rngd-and-similar/Makefile create mode 100644 selinux-policy/rngd-and-similar/PURPOSE create mode 100644 selinux-policy/rngd-and-similar/main.fmf create mode 100755 selinux-policy/rngd-and-similar/runtest.sh diff --git a/selinux-policy/rngd-and-similar/Makefile b/selinux-policy/rngd-and-similar/Makefile new file mode 100644 index 0000000..43f6ad4 --- /dev/null +++ b/selinux-policy/rngd-and-similar/Makefile @@ -0,0 +1,90 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/rngd-and-similar +# Description: SELinux interferes with rngd and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/rngd-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with rngd and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 15m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "RunFor: rng-tools" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console rng-tools initscripts" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6" >> $(METADATA) + @echo "Bug: 869810" >> $(METADATA) # Fedora 18 + @echo "Bug: 869813" >> $(METADATA) # Fedora 18 + @echo "Bug: 1451735" >> $(METADATA) # RHEL-7 + @echo "Bug: 1452629" >> $(METADATA) # RHEL-7 + @echo "Bug: 1496260" >> $(METADATA) # RHEL-7 + @echo "Bug: 1609466" >> $(METADATA) # RHEL-7 + @echo "Bug: 1611413" >> $(METADATA) # RHEL-7 + @echo "Bug: 1612456" >> $(METADATA) # RHEL-7 + @echo "Bug: 1653872" >> $(METADATA) # RHEL-8 + @echo "Bug: 1655079" >> $(METADATA) # RHEL-8 + @echo "Bug: 1656054" >> $(METADATA) # RHEL-8 + @echo "Bug: 1657250" >> $(METADATA) # RHEL-8 + @echo "Bug: 1658234" >> $(METADATA) # RHEL-8 + @echo "Bug: 1698575" >> $(METADATA) # RHEL-8 + @echo "Bug: 1699278" >> $(METADATA) # RHEL-8 + @echo "Bug: 1700222" >> $(METADATA) # RHEL-8 + @echo "Bug: 1787663" >> $(METADATA) # Fedora 32 + @echo "Bug: 1789902" >> $(METADATA) # Fedora 32 + @echo "Bug: 1787661" >> $(METADATA) # Fedora 32 + @echo "Bug: 1928572" >> $(METADATA) # Fedora 33 + @echo "Bug: 1929360" >> $(METADATA) # Fedora 33 + @echo "Bug: 1929366" >> $(METADATA) # Fedora 33 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/rngd-and-similar/PURPOSE b/selinux-policy/rngd-and-similar/PURPOSE new file mode 100644 index 0000000..8c46dd0 --- /dev/null +++ b/selinux-policy/rngd-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/rngd-and-similar +Author: Milos Malik + +SELinux interferes with rngd and related programs. + diff --git a/selinux-policy/rngd-and-similar/main.fmf b/selinux-policy/rngd-and-similar/main.fmf new file mode 100644 index 0000000..9c9828b --- /dev/null +++ b/selinux-policy/rngd-and-similar/main.fmf @@ -0,0 +1,2 @@ +path: /selinux-policy/rngd-and-similar +tier: 2 diff --git a/selinux-policy/rngd-and-similar/runtest.sh b/selinux-policy/rngd-and-similar/runtest.sh new file mode 100755 index 0000000..5113fdc --- /dev/null +++ b/selinux-policy/rngd-and-similar/runtest.sh @@ -0,0 +1,176 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/rngd-and-similar +# Description: SELinux interferes with rngd and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +ROOT_PASSWORD="redhat" +FILE_PATH="/sbin/rngd" +FILE_CONTEXT="rngd_exec_t" +SERVICE_PACKAGE="rng-tools" +SERVICE_NAME="rngd" +PROCESS_NAME="rngd" +PROCESS_CONTEXT="rngd_t" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} + rlFileBackup /etc/shadow + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "SELinux contexts and rules" + if rlIsRHEL 5 ; then + SOURCE_TYPE="initrc_t" + BOOLEANS="[ ]" + elif rlIsRHEL 6 ; then + SOURCE_TYPE="initrc_t" + else # RHEL-7 etc. + SOURCE_TYPE="init_t" # systemd runs the process + fi + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute }" + rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } ${BOOLEANS}" + rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} ${BOOLEANS}" + rlPhaseEnd + + rlPhaseStartTest "bz#869810 + bz#869813" + rlSEMatchPathCon "/usr/sbin/rngd" "rngd_exec_t" + rlRun "ls -Z /proc | grep :proc_t" + rlRun "ls -Z /proc/sys | grep :sysctl_t" + rlRun "ls -Z /proc/sys/kernel | grep :sysctl_kernel_t" + rlRun "ls -Z /proc/sys/kernel/random | grep :sysctl_kernel_t" + rlRun "ls -Z /proc/sys/kernel/random/poolsize | grep :sysctl_kernel_t" + rlSESearchRule "allow rngd_t proc_t : dir { getattr open search }" + rlSESearchRule "allow rngd_t sysctl_t : dir { getattr open search }" + rlSESearchRule "allow rngd_t sysctl_kernel_t : dir { getattr open search }" + rlSESearchRule "allow rngd_t sysctl_kernel_t : file { getattr open read }" + rlPhaseEnd + + rlPhaseStartTest "bz#1451735 + bz#1452629" + rlSEMatchPathCon "/usr/sbin/rngd" "rngd_exec_t" + rlSESearchRule "allow rngd_t sysfs_t : dir { getattr open search }" + rlSESearchRule "allow rngd_t sysfs_t : file { getattr open read }" + rlPhaseEnd + + rlPhaseStartTest "bz#1496260" + rlSEMatchPathCon "/usr/sbin/rngd" "rngd_exec_t" + rlSEMatchPathCon "/dev/ttyUSB0" "usbtty_device_t" + rlSESearchRule "allow rngd_t usbtty_device_t : chr_file { getattr open read }" + rlPhaseEnd + + rlPhaseStartTest "bz#1609466 + bz#1611413 + bz#1612456" + rlSEMatchPathCon "/usr/sbin/rngd" "rngd_exec_t" + rlSEMatchPathCon "/etc/pki" "cert_t" + rlSEMatchPathCon "/etc/pki/tls" "cert_t" + rlSEMatchPathCon "/etc/pki/tls/legacy-settings" "cert_t" + rlSESearchRule "allow rngd_t cert_t : dir { getattr open search }" + rlSESearchRule "allow rngd_t cert_t : file { getattr open read }" + rlPhaseEnd + + if ! rlIsRHEL 5 6 7 ; then + rlPhaseStartTest "bz#1653872 + bz#1655079 + bz#1657250 + bz#1658234" + rlSEMatchPathCon "/usr/sbin/rngd" "rngd_exec_t" + rlSESearchRule "allow rngd_t rngd_t : process { setsched } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1656054" + rlSEMatchPathCon "/usr/sbin/rngd" "rngd_exec_t" + rlRun "ls -Z /proc/cpuinfo | grep :proc_t" + rlSESearchRule "allow rngd_t proc_t : file { getattr open read } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1698575 + bz#1699278 + bz#1700222" + rlSEMatchPathCon "/usr/sbin/rngd" "rngd_exec_t" + rlRun "ls -Z /proc/sys/kernel/random/write_wakeup_threshold | grep :sysctl_kernel_t" + rlSESearchRule "allow rngd_t sysctl_kernel_t : file { write } [ ]" + rlPhaseEnd + fi + + if rlIsFedora ; then + rlPhaseStartTest "bz#1787661 + bz#1787663 + bz#1789902" + rlSEMatchPathCon "/usr/sbin/rngd" "rngd_exec_t" + rlSEMatchPathCon "/var/lib/sss" "sssd_var_lib_t" + rlSEMatchPathCon "/var/lib/sss/mc" "sssd_public_t" + rlSEMatchPathCon "/var/lib/sss/mc/passwd" "sssd_public_t" + rlSEMatchPathCon "/var/lib/sss/pipes" "sssd_var_lib_t" + rlSEMatchPathCon "/var/lib/sss/pipes/nss" "sssd_var_lib_t" + rlSESearchRule "allow rngd_t passwd_file_t : file { getattr open read } [ ]" + rlSESearchRule "allow rngd_t sssd_public_t : dir { search } [ ]" + rlSESearchRule "allow rngd_t sssd_public_t : file { getattr open read map } [ ]" + rlSESearchRule "allow rngd_t sssd_t : unix_stream_socket { connectto } [ ]" + rlSESearchRule "allow rngd_t sssd_var_lib_t : dir { search } [ ]" + rlSESearchRule "allow rngd_t sssd_var_lib_t : sock_file { getattr open write } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1928572 + bz#1929360 + bz#1929366" + rlSEMatchPathCon "/sys" "sysfs_t" + rlSESearchRule "allow rngd_t sysfs_t : filesystem { getattr } [ ]" + rlPhaseEnd + fi + + rlPhaseStartTest "real scenario" + rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" + rlRun "modprobe tpm-rng" 0,1 + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + if rlIsRHEL 5 6 ; then + PROCESS_CONTEXT="initrc_t" + else + PROCESS_CONTEXT="unconfined_service_t" + fi + fi + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "setsebool daemons_use_tty on" + rlRun "runcon system_u:system_r:initrc_t:s0 bash -c 'rngd -l'" 0-255 + rlRun "setsebool daemons_use_tty off" + rlRun "restorecon -Rv /run /var" + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + From 60c10ba7e13ead1dbe74ad3c31f387f54527c3ac Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Tue, 9 Mar 2021 15:37:09 +0100 Subject: [PATCH 016/626] kernel/selinux-testsuite: exclude userfaultfd on old kernels On RHEL-7 (and other old kernels), __NR_userfaultfd may not be defined on some arches, so add a kernel version check for now to exclude userfaultfd test when it would be skipped anyway. I'll fix this more nicely in upstream, this is just a temporary solution until that gets merged. Signed-off-by: Ondrej Mosnacek --- kernel/selinux-testsuite/runtest.sh | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/kernel/selinux-testsuite/runtest.sh b/kernel/selinux-testsuite/runtest.sh index c373309..51dbadc 100755 --- a/kernel/selinux-testsuite/runtest.sh +++ b/kernel/selinux-testsuite/runtest.sh @@ -375,6 +375,11 @@ rlJournalStart rlRun "sed -i 's/SCTP_SEND_FAILED_EVENT/SCTP_STREAM_CHANGE_EVENT + 1/g' tests/sctp/*.c" 0 \ "Fix SCTP test compilation on old RHEL kernels" fi + if kver_lt 5.12; then + # __NR_userfaultfd not defined in s390x headers on RHEL-7 + # For now just disable it on kernels without the feature. + exclude_tests+=" userfaultfd" + fi # CONFIG_KEYS_DH_COMPUTE not enabled on RHEL-8 :( exclude_tests+=" keys" From c0c790f80127dcbdabe73f92ad617fdffcaa6eaa Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 9 Mar 2021 14:42:14 +0100 Subject: [PATCH 017/626] test if systemd-sleep can getattr() a partition Hibernation which uses a swap partition instead of a swap file fails because SELinux prevents systemd-sleep from getattr operation on the swap partition. This is a common configuration, which means that SELinux policy should allow it. The TC does not reproduce the scenario, it only looks for appropriate policy rules. The TC covers BZ#1928539, BZ#1912385, BZ#1926536. --- selinux-policy/swap-file-and-systemd-access/Makefile | 3 +++ selinux-policy/swap-file-and-systemd-access/runtest.sh | 4 ++++ 2 files changed, 7 insertions(+) diff --git a/selinux-policy/swap-file-and-systemd-access/Makefile b/selinux-policy/swap-file-and-systemd-access/Makefile index dc3fe58..492b8e8 100644 --- a/selinux-policy/swap-file-and-systemd-access/Makefile +++ b/selinux-policy/swap-file-and-systemd-access/Makefile @@ -67,6 +67,9 @@ $(METADATA): Makefile @echo "Bug: 1798872" >> $(METADATA) # RHEL 8 @echo "Bug: 1845594" >> $(METADATA) # Fedora 32 @echo "Bug: 1850177" >> $(METADATA) # RHEL 8 + @echo "Bug: 1912385" >> $(METADATA) # Fedora 32 + @echo "Bug: 1926536" >> $(METADATA) # RHEL 9 + @echo "Bug: 1928539" >> $(METADATA) # Fedora 32 rhts-lint $(METADATA) diff --git a/selinux-policy/swap-file-and-systemd-access/runtest.sh b/selinux-policy/swap-file-and-systemd-access/runtest.sh index 6ce368d..4a60b43 100755 --- a/selinux-policy/swap-file-and-systemd-access/runtest.sh +++ b/selinux-policy/swap-file-and-systemd-access/runtest.sh @@ -79,6 +79,10 @@ rlJournalStart rlPhaseEnd fi + rlPhaseStartTest "bz#1912385 + bz#1926536 + bz#1928539" + rlSESearchRule "allow systemd_sleep_t fixed_disk_device_t : blk_file { getattr } [ ]" + rlPhaseEnd + if ${REAL_SCENARIOS} ; then rlPhaseStartTest "real scenario" rlRun "rm -f /swapfile" From 6e4e2d367b945ada33da148874b245b87e02eed2 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Fri, 19 Mar 2021 15:18:24 +0100 Subject: [PATCH 018/626] disable fapolicyd test on Fedora The fapolicyd test causes that dnf/yum hangs, which blocks the whole gating process for 4 hours. The test will be temporarily disabled so that new selinux-policy builds could go through gating. --- selinux-policy/fapolicyd-and-similar/main.fmf | 1 + selinux-policy/ladvd/Makefile | 2 +- selinux-policy/ladvd/runtest.sh | 2 +- 3 files changed, 3 insertions(+), 2 deletions(-) diff --git a/selinux-policy/fapolicyd-and-similar/main.fmf b/selinux-policy/fapolicyd-and-similar/main.fmf index 8faf6ba..b5b7e06 100644 --- a/selinux-policy/fapolicyd-and-similar/main.fmf +++ b/selinux-policy/fapolicyd-and-similar/main.fmf @@ -1,2 +1,3 @@ path: /selinux-policy/fapolicyd-and-similar tier: 2 +component: disabled diff --git a/selinux-policy/ladvd/Makefile b/selinux-policy/ladvd/Makefile index 8572b36..45928c4 100644 --- a/selinux-policy/ladvd/Makefile +++ b/selinux-policy/ladvd/Makefile @@ -6,7 +6,7 @@ # # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # -# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# Copyright (c) 2021 Red Hat, Inc. All rights reserved. # # This copyrighted material is made available to anyone wishing # to use, modify, copy, or redistribute it subject to the terms diff --git a/selinux-policy/ladvd/runtest.sh b/selinux-policy/ladvd/runtest.sh index b0080a9..d4945c4 100755 --- a/selinux-policy/ladvd/runtest.sh +++ b/selinux-policy/ladvd/runtest.sh @@ -8,7 +8,7 @@ # # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # -# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# Copyright (c) 2021 Red Hat, Inc. All rights reserved. # # This copyrighted material is made available to anyone wishing # to use, modify, copy, or redistribute it subject to the terms From 6548af6fcf9d0d6bc0a53190f078914fd1fa5513 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Fri, 26 Mar 2021 13:34:11 +0100 Subject: [PATCH 019/626] Add test for genfscon fallback support This feature is required for proper support of virtiofs with SELinux. Add a trivial test that verifies that this feature works via a dummy SELinux module and ramfs mount. Signed-off-by: Ondrej Mosnacek --- kernel/genfs_fallback/Makefile | 7 +++++++ kernel/genfs_fallback/main.fmf | 29 +++++++++++++++++++++++++++++ kernel/genfs_fallback/runtest.sh | 31 +++++++++++++++++++++++++++++++ 3 files changed, 67 insertions(+) create mode 100644 kernel/genfs_fallback/Makefile create mode 100644 kernel/genfs_fallback/main.fmf create mode 100755 kernel/genfs_fallback/runtest.sh diff --git a/kernel/genfs_fallback/Makefile b/kernel/genfs_fallback/Makefile new file mode 100644 index 0000000..7abf97c --- /dev/null +++ b/kernel/genfs_fallback/Makefile @@ -0,0 +1,7 @@ +# Minimal Makefile for standard-test-roles-beakerlib + +R="RhtsRequires: policycoreutils" + +run: + chmod +x runtest.sh + ./runtest.sh diff --git a/kernel/genfs_fallback/main.fmf b/kernel/genfs_fallback/main.fmf new file mode 100644 index 0000000..4006f0b --- /dev/null +++ b/kernel/genfs_fallback/main.fmf @@ -0,0 +1,29 @@ +summary: Test genfscon fallback for fs_use_xattr when no xattr support +description: | + Test that a fs_use_xattr filesystem mount falls back to genfscon when it + doesn't have xattr support. + + See also: + https://lore.kernel.org/selinux/CAFqZXNsGabHBfV36nNAVLJgEzjkBev-O3YZ1vnmXyVoaDdjiHQ@mail.gmail.com/T/ + https://lore.kernel.org/selinux/20210113123802.63563-1-omosnace@redhat.com/ +contact: Ondrej Mosnacek +component: +- kernel +framework: beakerlib +require: +- policycoreutils +duration: 5m +tier: 2 +enabled: true +adjust: + enabled: false + when: distro < rhel-8.5 + because: RHEL-8.5 and below are not expected to support this +adjust: + enabled: false + when: distro < fedora-35 + because: This feature may not be supported on kernels in F34 and below +link: +- verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1899703 +- verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1915825 +- verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1937297 diff --git a/kernel/genfs_fallback/runtest.sh b/kernel/genfs_fallback/runtest.sh new file mode 100755 index 0000000..63d8e1e --- /dev/null +++ b/kernel/genfs_fallback/runtest.sh @@ -0,0 +1,31 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# SPDX-License-Identifier: GPLv2 +# Copyright (c) 2021 Red Hat, Inc. +# Author: Ondrej Mosnacek + +# Include Beakerlib environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +rlJournalStart + rlPhaseStartSetup + rlRun "uname -r" + + rlRun "echo '(fsuse xattr ramfs (system_u object_r fs_t ((s0) (s0))))' >ramfs_xattr.cil" + rlRun "semodule -i ramfs_xattr.cil" + rlRun "mkdir /mnt/test-ramfs" + rlPhaseEnd + + rlPhaseStartTest + rlRun "mount -t ramfs none /mnt/test-ramfs" + rlRun "[ \"\$(secon -t -f /mnt/test-ramfs)\" = ramfs_t ]" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "umount /mnt/test-ramfs" 0-1 + rlRun "rmdir /mnt/test-ramfs" + rlRun "semodule -r ramfs_xattr" + rlRun "rm -f ramfs_xattr.cil" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd From 15cc76eaf9ab0d4b7a80550dcb2f882c5e3d85aa Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Mon, 29 Mar 2021 12:16:16 +0200 Subject: [PATCH 020/626] update all rlSE* functions to the latest version Many changes were done in downstream SELinux beakerlib library and they were not propagated to upstream. Now, it's fixed. The audit daemon is restarted everytime the SELinux beakerlib library is loaded, which usually happens once at the beginning of each test. This change is necessary because the audit daemon sometimes dies and gathering of SELinux denials via ausearch relies on fact that audit daemon is running and logging them. Without a running audit daemon many tests can pass (false positive) because no SELinux denials were found. --- selinux-policy/Library/common/Makefile | 4 +- selinux-policy/Library/common/lib.sh | 146 +++++++++++++++++++---- selinux-policy/Library/common/runtest.sh | 4 +- 3 files changed, 125 insertions(+), 29 deletions(-) diff --git a/selinux-policy/Library/common/Makefile b/selinux-policy/Library/common/Makefile index 8c2004f..07d41bb 100644 --- a/selinux-policy/Library/common/Makefile +++ b/selinux-policy/Library/common/Makefile @@ -1,7 +1,7 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # # Makefile of /CoreOS/selinux-policy/Library/common -# Description: Wrapper library for /CoreOS/selinux-policy/common +# Description: Common library for SELinux related components # Author: David Spurek # # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ @@ -43,7 +43,7 @@ $(METADATA): Makefile @echo "Name: $(TEST)" >> $(METADATA) @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: Common library for SELinux" >> $(METADATA) + @echo "Description: Common library for SELinux related components" >> $(METADATA) @echo "Type: Library" >> $(METADATA) @echo "TestTime: 120m" >> $(METADATA) @echo "Requires: setools" >> $(METADATA) diff --git a/selinux-policy/Library/common/lib.sh b/selinux-policy/Library/common/lib.sh index 8d6785f..21bd0bb 100644 --- a/selinux-policy/Library/common/lib.sh +++ b/selinux-policy/Library/common/lib.sh @@ -3,7 +3,7 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # # lib.sh of /CoreOS/selinux-policy/Library/common -# Description: Common library for selinux-policy component +# Description: Common library for SELinux related components # Authors: Milos Malik # Michal Trunecka # David Spurek @@ -29,7 +29,7 @@ # # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # library-prefix = rlSE -# library-version = 40 +# library-version = 42 # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ : <<'=cut' @@ -49,7 +49,6 @@ selinux-policy/common - BeakerLib extension for managing SELinux =pod =head1 VARIABLES - =over =item rlSE_CACHE_DIR @@ -66,9 +65,6 @@ rlSE_CACHE_DIR="${rlSE_CACHE_DIR:-$__INTERNAL_PERSISTENT_TMP/BEAKERLIB-rlSE}" __INTERNAL_rlSE_CACHEFILE="$rlSE_CACHE_DIR/cache.db" __INTERNAL_rlSE_SUMFILE="$rlSE_CACHE_DIR/cache.policy-checksum" -SETOOLS_MAJOR_VERSION=`sesearch --version 2>&1| sed -n 's/sesearch //;s/\..*$//p'` - - # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Functions # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ @@ -322,6 +318,7 @@ function rlSEMatchPathCon() { local FILE_PATH local LINK_PATH local REAL_TYPE=`rlSETranslateAlias $2` + rlLogDebug "$FUNCNAME(): REAL_TYPE=$REAL_TYPE" FILE_PATH=$1 if ! rlIsRHEL '<6'; then @@ -333,16 +330,22 @@ function rlSEMatchPathCon() { done fi + rlLogDebug "$FUNCNAME(): FILE_PATH=$FILE_PATH" + local ec=0 while [[ -n "$FILE_PATH" ]]; do if [ -L ${FILE_PATH} ] ; then + rlLogDebug "$FUNCNAME(): evaluating symlink" LINK_PATH=`readlink -f ${FILE_PATH}` - matchpathcon ${FILE_PATH} ${LINK_PATH} - matchpathcon ${FILE_PATH} ${LINK_PATH} | grep :${REAL_TYPE} > /dev/null + local out="$(matchpathcon ${FILE_PATH} ${LINK_PATH})" + echo "$out" + echo "$out" | grep -q ":${REAL_TYPE}:" rlAssert0 "Results of matchpathcon ${FILE_PATH} ${LINK_PATH} should contain ${REAL_TYPE}" $? || ec=1 else - matchpathcon ${FILE_PATH} - matchpathcon ${FILE_PATH} | grep :${REAL_TYPE} > /dev/null + rlLogDebug "$FUNCNAME(): evaluating file" + local out="$(matchpathcon ${FILE_PATH})" + echo "$out" + echo "$out" | grep -q ":${REAL_TYPE}:" rlAssert0 "Result of matchpathcon ${FILE_PATH} should contain ${REAL_TYPE}" $? || ec=1 fi FILE_PATH=( "${FILE_PATH[@]:1}" ) @@ -869,7 +872,7 @@ Pair functions to check AVC messages from the given moment. The starting timesta function rlSESetTimestamp() { - local STAMP=`date "+%m/%d/%Y %T"` + local STAMP=`LC_ALL=en_US.UTF-8 date "+%x %T"` local NAME="TIMESTAMP" [ -z "$1" ] || NAME="${NAME}_$1" @@ -927,7 +930,7 @@ function rlSEAVCCheck() { return 1 else rlLog "$FUNCNAME: Search for AVCs, USER_AVCs, SELINUX_ERRs, and USER_SELINUX_ERRs since timestamp '$NAME' [$STAMP]" - local ausearch_output=$(LC_TIME='en_US.UTF-8' ausearch -i -m AVC -m USER_AVC -m SELINUX_ERR -m USER_SELINUX_ERR -ts $STAMP 2>&1) + local ausearch_output=$(LC_ALL='en_US.UTF-8' ausearch --input-logs -i -m AVC -m USER_AVC -m SELINUX_ERR -m USER_SELINUX_ERR -ts $STAMP 2>&1) echo "$ausearch_output" >&2 local res=0 # filter out ignored patterns @@ -1402,41 +1405,59 @@ Limitation: seinfo does not report aliases on RHEL-5 and RHEL-6 now. =cut function rlSETranslateAlias { + local res if rlIsRHEL 5 ; then + rlLogDebug "$FUNCNAME(): RHEL5 - no translation, using $1" echo $1 return 0 elif rlIsRHEL 6 ; then + rlLogDebug "$FUNCNAME(): RHEL6" if seinfo -t$1 2>&1 | grep -q "ERROR:" ; then + rlLogDebug "$FUNCNAME(): got an error - no translation, using $1" echo $1 return 1 elif seinfo -t$1 2>&1 | grep -q " $1" ; then + rlLogDebug "$FUNCNAME(): seinfo confirmed the name - no translation, using $1" echo $1 return 0 - else # the type should be used either as a source or as a target in an allow rule - ( sesearch -s $1 -A | tr -s ' ' | cut -d ' ' -f 3 ; sesearch -t $1 -A | tr -s ' ' | cut -d ' ' -f 4 ) | sort | uniq | grep "^.*_t$" + else + rlLogDebug "$FUNCNAME(): the type should be used either as a source or as a target in an allow rule" + res="$(( sesearch -s $1 -A | tr -s ' ' | cut -d ' ' -f 3 ; sesearch -t $1 -A | tr -s ' ' | cut -d ' ' -f 4 ) | sort | uniq | grep "^.*_t$")" + rlLogDebug "$FUNCNAME(): translated name: $res" + echo "$res" return 0 fi else + rlLogDebug "$FUNCNAME(): RHEL>6 && Fedora" + rlLogDebug "$FUNCNAME(): setools version ${SETOOLS_MAJOR_VERSION}" local seinfo_out seinfo_out="$(seinfo -t$1 2>&1 )" + rlLogDebug "$FUNCNAME(): seinfo_out='$seinfo_out'" if echo "$seinfo_out" | grep -q "ERROR:" ; then - # the type was not recognized + rlLogDebug "$FUNCNAME(): the type was not recognized - no translation, using $1" echo $1 return 1 elif echo "$seinfo_out" | grep -q "TypeName " ; then - seinfo -t$1 2>/dev/null | grep TypeName | tr -s ' ' | cut -d ' ' -f 3 + rlLogDebug "$FUNCNAME(): translation done using TypeName" + res="$(seinfo -t$1 2>/dev/null | grep TypeName | tr -s ' ' | cut -d ' ' -f 3)" + rlLogDebug "$FUNCNAME(): translated name: $res" + echo "$res" return 0 elif echo "$seinfo_out" | grep -q "Types: 0" ; then - # cannot translate alias, if setools v.4 are used then BZ#1581761 + rlLogDebug "$FUNCNAME(): # cannot translate alias, if setools v.4 are used then BZ#1581761 - no translation, using $1" echo $1 return 1 elif [[ ${SETOOLS_MAJOR_VERSION} == "4" ]] ; then - # setools v.4 - seinfo -t$1 2>/dev/null | tail -n 1 | tr -s ' ' | cut -d ' ' -f 2 + rlLogDebug "$FUNCNAME(): translation done using seinfo v.4 parsing" + res="$(seinfo -t$1 2>/dev/null | tail -n 1 | tr -s ' ' | cut -d ' ' -f 2)" + rlLogDebug "$FUNCNAME(): translated name: $res" + echo "$res" return 0 else - # setools v.3 - seinfo -t$1 2>/dev/null | head -n 1 | tr -s ' ' | cut -d ' ' -f 2 + rlLogDebug "$FUNCNAME(): translation done using seinfo v.3 parsing" + res="$(seinfo -t$1 2>/dev/null | head -n 1 | tr -s ' ' | cut -d ' ' -f 2)" + rlLogDebug "$FUNCNAME(): translated name: $res" + echo "$res" return 0 fi fi @@ -1463,7 +1484,7 @@ function rlSEListServices() { SERVICES_ARRAY[21]='vsftpd proftpd pure-ftpd lighttpd' # FTP servers SERVICES_ARRAY[25]='exim postfix sendmail' # SMTP servers - SERVICES_ARRAY[53]='named named-sdb unbound yadifad nsd pdns' # DNS servers + SERVICES_ARRAY[53]='named named-sdb unbound yadifad nsd pdns systemd-resolved dnsmasq' # DNS servers SERVICES_ARRAY[80]='httpd cherokee lighttpd nginx thttpd' # HTTP servers SERVICES_ARRAY[123]='ntpd chronyd' # NTP servers @@ -1498,6 +1519,8 @@ function rlSESetEnforce() { + + __INTERNAL_rlSEModuleList() { local semodule_list eval semodule_list="\$($__INTERNAL_SEMODULE_LISTING)"; @@ -1742,7 +1765,7 @@ __INTERNAL_rlSEenable_full_auditing() { fi local final_rules=/etc/audit/audit.rules local config_file=/etc/audit/auditd.conf - local auditd_need_restart=0 + local auditd_need_restart=1 local rules="-D"$'\n'"-w /etc/shadow -p w" local res=0 if ! diff -u <(grep -v -e '^$' -e '^#' $final_rules) <(echo "$rules") > /dev/null; then @@ -1901,10 +1924,81 @@ __INTERNAL_rlSEcache_sesearch() { esac } -rlSELibraryLoaded() { - return 0 -} +rlSELibraryLoaded() { + __INTERNAL_SEMODULE_LISTING="semodule -lfull" + local tmp + eval tmp="\$($__INTERNAL_SEMODULE_LISTING 2>&1 )" + if [[ "$tmp" =~ invalid\ option ]]; then + __INTERNAL_SEMODULE_LISTING='semodule -l' + fi + rlLogInfo "SELinux: using '$__INTERNAL_SEMODULE_LISTING' to list modules" + __INTERNAL_POLICY_NAME="$(sestatus | grep -i 'Loaded policy name' | sed -r 's/.*:\s*([^:]+)\s*/\1/')" + __INTERNAL_POLICY_NAME="${__INTERNAL_POLICY_NAME:-$(sestatus | grep -i 'Policy from config file' | sed -r 's/.*:\s*([^:]+)\s*/\1/')}" + __INTERNAL_POLICY_NAME="${__INTERNAL_POLICY_NAME:-targeted}" + __INTERNAL_POLICY_ROOT="$(sestatus | grep -i 'SELinux root directory' | sed -r 's/.*:\s*([^:]+)\s*/\1/')" + __INTERNAL_POLICY_ROOT="${__INTERNAL_POLICY_ROOT:-/etc/selinux}" + __INTERNAL_POLICY_PATH="$__INTERNAL_POLICY_ROOT/$__INTERNAL_POLICY_NAME" + __INTERNAL_POLICY_FILE="$__INTERNAL_POLICY_PATH/policy/policy.$(ls -1 -d $__INTERNAL_POLICY_PATH/policy/policy.* | sed -r 's/[^.]*\.//' | sort -nr | head -n 1)" + __INTERNAL_POLICY_STORE_ROOT="/var/lib/selinux" + rlIsRHEL '<8' && __INTERNAL_POLICY_STORE_ROOT="/etc/selinux" + export rlSEpolicyRoot="$__INTERNAL_POLICY_ROOT" + export rlSEstoreRoot="$__INTERNAL_POLICY_STORE_ROOT" + export rlSEpolicyName="$__INTERNAL_POLICY_NAME" + rlLogInfo "Running with policy located in $__INTERNAL_POLICY_FILE" + if rlIsRHEL 4 5; then + rlSE_REQUIRES="setools expect policycoreutils" + elif rlIsRHEL 6 ; then + rlSE_REQUIRES="setools-console expect policycoreutils-python" + elif rlIsRHEL 7 ; then + rlSE_REQUIRES="setools-console expect policycoreutils-python selinux-policy-devel" + else + rlSE_REQUIRES="setools-console expect policycoreutils-python-utils selinux-policy-devel" + fi + + __INTERNAL_rlSEenable_full_auditing + + local t=$(date +%s) + rlLogInfo "SELinux related packages listing:" + rlLogInfo "$(rpm -qa | grep -e ^selinux-policy -e ^libsemanage -e ^policycoreutils -e ^setools -e ^libselinux -e ^libsepol -e ^checkpolicy -e ^mcstrans -e ^setroubleshoot | sort | sed 's/^/ /')" + rlLogInfo " listing took $(($(date +%s)-$t)) second(s)" + + if rlCheckRequirements $rlSE_REQUIRES; then + SETOOLS_MAJOR_VERSION=`sesearch --version 2>&1| sed -n 's/sesearch //;s/\..*$//p'` + rlLogDebug "FUNCNAME(): sesearch --version: $(sesearch --version 2>&1)" + rlLogDebug "FUNCNAME(): SETOOLS_MAJOR_VERSION=$SETOOLS_MAJOR_VERSION" + rlLogDebug "rlSE Library: Requires installed." + return 0 + fi + + if rlIsRHEL 7 ; then + if uname -r | grep -q x86_64 ; then + local LIBSEPOL_VER_REL=`rpm -q --queryformat "%{version},%{release}" libsepol` + local LIBSELINUX_VER_REL=`rpm -q --queryformat "%{version},%{release}" libselinux` + local SETOOLS_VER_REL=`rpm -q --queryformat "%{version},%{release}" setools-libs` + # remove all i686 setools* packages + rlRun "yum -y remove setools\*.i686" + # install necessary packages + rlRun "yum -y install setools-libs setools-console libsepol libselinux libselinux-python libselinux-utils -x \*.i686" 0,1 + fi + fi + + if rlIsRHEL; then + rlRun "yum -y --skip-broken install $rlSE_REQUIRES" + else + rlRun "dnf -y --skip-broken install $rlSE_REQUIRES" + fi + if rlCheckRequirements $rlSE_REQUIRES; then + SETOOLS_MAJOR_VERSION=`sesearch --version 2>&1| sed -n 's/sesearch //;s/\..*$//p'` + rlLogDebug "FUNCNAME(): sesearch --version: $(sesearch --version 2>&1)" + rlLogDebug "FUNCNAME(): SETOOLS_MAJOR_VERSION=$SETOOLS_MAJOR_VERSION" + rlLogDebug "rlSE Library: Requires installed." + return 0 + fi + + rlLogError "rlSE Library: Not all required packages installed." + return 1 +} # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Authors diff --git a/selinux-policy/Library/common/runtest.sh b/selinux-policy/Library/common/runtest.sh index 46d5d95..73c2a3e 100755 --- a/selinux-policy/Library/common/runtest.sh +++ b/selinux-policy/Library/common/runtest.sh @@ -18,6 +18,8 @@ rlIsRHEL 5 && { rlJournalStart rlPhaseStartSetup rlRun "rlImport selinux-policy/common" + rlRun "uname -a" + rlRun "sestatus" rlPhaseEnd rlPhaseStartTest "rlSEBoolean test" @@ -178,7 +180,7 @@ rlJournalStart rlSESearchRule "allow unconfined_t smbcontrol_t : fd use mls" 1 rlSESearchRule "allow ftpd_t public_content_rw_t : dir { create write }" rlSESearchRule "allow ftpd_t public_content_rw_t : dir { create write } [ rsync_client ]" 1 - rlSESearchRule "allow ftpd_t public_content_rw_t : dir { create write } [ allow_ftpd_anon_write ]" 0 + rlSESearchRule "allow ftpd_t public_content_rw_t : dir { create write } [ ftpd_anon_write ]" 0 rlPhaseEnd if rlIsRHEL '>=8'; then From 9f4cbb46a4922ccef503f6916961e20f42bcb0b7 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Tue, 6 Apr 2021 15:11:48 +0200 Subject: [PATCH 021/626] Fix invalid FMF syntax Fixes: Invalid yaml syntax: Failed to parse '/home/omosnace/Dokumenty/Fedora/tests/selinux/kernel/genfs_fallback/main.fmf'. Duplicate key 'adjust' detected. Signed-off-by: Ondrej Mosnacek --- kernel/genfs_fallback/main.fmf | 5 ++--- kernel/setsebool-deadlock/main.fmf | 5 ++--- 2 files changed, 4 insertions(+), 6 deletions(-) diff --git a/kernel/genfs_fallback/main.fmf b/kernel/genfs_fallback/main.fmf index 4006f0b..5b42e80 100644 --- a/kernel/genfs_fallback/main.fmf +++ b/kernel/genfs_fallback/main.fmf @@ -16,11 +16,10 @@ duration: 5m tier: 2 enabled: true adjust: - enabled: false + - enabled: false when: distro < rhel-8.5 because: RHEL-8.5 and below are not expected to support this -adjust: - enabled: false + - enabled: false when: distro < fedora-35 because: This feature may not be supported on kernels in F34 and below link: diff --git a/kernel/setsebool-deadlock/main.fmf b/kernel/setsebool-deadlock/main.fmf index 5a69da9..48a51f5 100644 --- a/kernel/setsebool-deadlock/main.fmf +++ b/kernel/setsebool-deadlock/main.fmf @@ -15,10 +15,9 @@ duration: 5m tier: 3 enabled: true adjust: - enabled: false + - enabled: false when: distro < fedora-34 because: some kernels on Fedora 33 and below don't have the fix -adjust: - enabled: false + - enabled: false when: distro ~< rhel-8.4 because: not expected to be fixed in RHEL-8 below 8.4 From 9e8c0e21071f8437c5aac99fa27c794b2554e664 Mon Sep 17 00:00:00 2001 From: Amith Kumar Date: Wed, 31 Mar 2021 09:12:30 +0530 Subject: [PATCH 022/626] file-contexts: Add test for bug1822100 Add an semanage case to file-contexts test suite which verifies bug 1822100. The fix checks for the broken pipe error generated by the 'semanage fcontext -l | egrep ..' command. Signed-off-by: Amith Kumar --- policycoreutils/file-contexts/Makefile | 1 + policycoreutils/file-contexts/runtest.sh | 9 +++++++++ 2 files changed, 10 insertions(+) diff --git a/policycoreutils/file-contexts/Makefile b/policycoreutils/file-contexts/Makefile index fde8428..37dce15 100644 --- a/policycoreutils/file-contexts/Makefile +++ b/policycoreutils/file-contexts/Makefile @@ -60,5 +60,6 @@ $(METADATA): Makefile @echo "Confidential: no" >> $(METADATA) @echo "Destructive: no" >> $(METADATA) @echo "Releases: -RHEL4 -RHELClient5 -RHELServer5 -RHEL6" >> $(METADATA) + @echo "Bug: 1822100" >> $(METADATA) # RHEL-8 rhts-lint $(METADATA) diff --git a/policycoreutils/file-contexts/runtest.sh b/policycoreutils/file-contexts/runtest.sh index d421ec8..c4f28f8 100755 --- a/policycoreutils/file-contexts/runtest.sh +++ b/policycoreutils/file-contexts/runtest.sh @@ -205,6 +205,15 @@ rlJournalStart rlRun "rm -rf /tmp/test" rlPhaseEnd + rlPhaseStartTest "semanage loses sys.stderr bz#1822100" + rlRun "semanage fcontext -l | egrep -s -q -e '^/home'" 0 + # Capture Broken pipe error + rlRun "semanage fcontext -l 2> /tmp/output_file | egrep -s -q -e '^/home'" + rlAssertGrep "Broken pipe" /tmp/output_file + rlAssertNotGrep "lost sys.stderr" /tmp/output_file + rlRun "rm -f /tmp/output_file" + rlPhaseEnd + rlPhaseStartCleanup rlRun "rm -rf stdout" rlPhaseEnd From d85b0bfed91c8d4ddfae36e2dbfc90cc0b775eff Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Mon, 29 Mar 2021 10:44:55 +0200 Subject: [PATCH 023/626] kernel/selinux-testsuite: Bump upstream commit ...to pull in two fixes for the userfaultfd test so it builds sucessfully on RHEL-7 and remove the associated workaround from the wrapper. Signed-off-by: Ondrej Mosnacek --- kernel/selinux-testsuite/runtest.sh | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/kernel/selinux-testsuite/runtest.sh b/kernel/selinux-testsuite/runtest.sh index 51dbadc..75fefce 100755 --- a/kernel/selinux-testsuite/runtest.sh +++ b/kernel/selinux-testsuite/runtest.sh @@ -35,7 +35,7 @@ PACKAGE="selinux-policy" # This should be updated as needed after verifying that the new version # doesn't break testing and after applying all necessary tweaks in the TC. # Run with GIT_BRANCH=master to run the latest upstream version. -DEFAULT_COMMIT="9ef6c43a3ffa810c9a0061eb4625980dd178f60a" +DEFAULT_COMMIT="1defa850ae71bc27c9dd101d19f543a42abc9537" # Default pull requests to merge before running the test. # If non-empty, then after checking out GIT_BRANCH the listed upstream pull # requests (by number) are merged, creating a new temporary local branch. @@ -375,11 +375,6 @@ rlJournalStart rlRun "sed -i 's/SCTP_SEND_FAILED_EVENT/SCTP_STREAM_CHANGE_EVENT + 1/g' tests/sctp/*.c" 0 \ "Fix SCTP test compilation on old RHEL kernels" fi - if kver_lt 5.12; then - # __NR_userfaultfd not defined in s390x headers on RHEL-7 - # For now just disable it on kernels without the feature. - exclude_tests+=" userfaultfd" - fi # CONFIG_KEYS_DH_COMPUTE not enabled on RHEL-8 :( exclude_tests+=" keys" From caadab746cf0b1dae4b089426462227476d72c3e Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Thu, 15 Apr 2021 16:55:27 +0200 Subject: [PATCH 024/626] test if systemd-modules-load can read files under /sys/firmware/efi According to several BZ reports, the systemd-modules-load program wants to read /sys/firmware/efi/efivars/SecureBoot-* files. Unfortunately, SELinux policy denies that access. The TC reproduces the issue on machines where the EFI variable FS is mounted (the /sys/firmware/efi/efivars/ directory exists). I believe the access is needed for correct function of the systemd-modules-load service. The TC looks for appropriate policy rule. The TC covers BZ#1819161 and its duplicates. --- selinux-policy/systemd-modules-load-and-similar/Makefile | 5 +++++ selinux-policy/systemd-modules-load-and-similar/runtest.sh | 6 ++++++ 2 files changed, 11 insertions(+) diff --git a/selinux-policy/systemd-modules-load-and-similar/Makefile b/selinux-policy/systemd-modules-load-and-similar/Makefile index aeca98e..97e3bb3 100644 --- a/selinux-policy/systemd-modules-load-and-similar/Makefile +++ b/selinux-policy/systemd-modules-load-and-similar/Makefile @@ -74,7 +74,12 @@ $(METADATA): Makefile @echo "Bug: 1697632" >> $(METADATA) # Fedora 30 @echo "Bug: 1698200" >> $(METADATA) # Fedora 30 @echo "Bug: 1699559" >> $(METADATA) # Fedora 30 + @echo "Bug: 1819161" >> $(METADATA) # Fedora 32 @echo "Bug: 1823246" >> $(METADATA) # RHEL-8 + @echo "Bug: 1824196" >> $(METADATA) # Fedora 32 + @echo "Bug: 1829700" >> $(METADATA) # Fedora 32 + @echo "Bug: 1833502" >> $(METADATA) # Fedora 32 + @echo "Bug: 1838933" >> $(METADATA) # Fedora 32 rhts-lint $(METADATA) diff --git a/selinux-policy/systemd-modules-load-and-similar/runtest.sh b/selinux-policy/systemd-modules-load-and-similar/runtest.sh index b345047..4c896ba 100755 --- a/selinux-policy/systemd-modules-load-and-similar/runtest.sh +++ b/selinux-policy/systemd-modules-load-and-similar/runtest.sh @@ -99,6 +99,12 @@ rlJournalStart rlSESearchRule "allow systemd_modules_load_t bin_t : file { execute execute_no_trans map } [ ]" rlPhaseEnd + rlPhaseStartTest "bz#1819161 + bz#1824196 + bz#1829700 + bz#1833502 + bz#1838933" + rlSEMatchPathCon "/sys/firmware/efi" "efivarfs_t" + rlSESearchRule "allow systemd_modules_load_t efivarfs_t : file { getattr open read } [ ]" + rlSESearchRule "allow systemd_resolved_t efivarfs_t : file { getattr open read } [ ]" + rlPhaseEnd + rlPhaseStartTest "real scenario -- standalone service" rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" rlRun "echo ${KERNEL_MODULE} > /etc/modules-load.d/${KERNEL_MODULE}.conf" From e6f890f6cef576ae54c06eaa28175b36d1de1f52 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Fri, 16 Apr 2021 20:50:57 +0200 Subject: [PATCH 025/626] kernel/netlabel_many_ifaces: fix relevancy for RHEL The bug was only fixed in RHEL-8.4, so disable the tests on anything older. Signed-off-by: Ondrej Mosnacek --- kernel/netlabel_many_ifaces/main.fmf | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kernel/netlabel_many_ifaces/main.fmf b/kernel/netlabel_many_ifaces/main.fmf index 4fbbffe..4aaeb04 100644 --- a/kernel/netlabel_many_ifaces/main.fmf +++ b/kernel/netlabel_many_ifaces/main.fmf @@ -14,5 +14,5 @@ tier: 2 enabled: true adjust: enabled: false - when: distro < rhel-7 - because: RHEL-6 and below is too old... + when: distro < rhel-8.4 + because: not fixed below RHEL 8.4... From ff195852b26067dca2d7d303b961dacf5d253497 Mon Sep 17 00:00:00 2001 From: Amith Kumar Date: Wed, 14 Apr 2021 04:12:43 +0530 Subject: [PATCH 026/626] libsepol-sanity: Add test for bug1838257 Add a sanity test suite which verifies but 1838257. The fix evaluates the rpm scripts for components libsepol, libsemanage and libselinux. It looks for obsolete commands like telinit. Signed-off-by: Amith Kumar --- .../Makefile | 72 +++++++++++++++++++ .../PURPOSE | 11 +++ .../main.fmf | 2 + .../runtest.sh | 52 ++++++++++++++ 4 files changed, 137 insertions(+) create mode 100644 libsepol/Sanity/bz1838257-rpm-scripts-use-deprecated-telinit/Makefile create mode 100644 libsepol/Sanity/bz1838257-rpm-scripts-use-deprecated-telinit/PURPOSE create mode 100644 libsepol/Sanity/bz1838257-rpm-scripts-use-deprecated-telinit/main.fmf create mode 100755 libsepol/Sanity/bz1838257-rpm-scripts-use-deprecated-telinit/runtest.sh diff --git a/libsepol/Sanity/bz1838257-rpm-scripts-use-deprecated-telinit/Makefile b/libsepol/Sanity/bz1838257-rpm-scripts-use-deprecated-telinit/Makefile new file mode 100644 index 0000000..b1cceb1 --- /dev/null +++ b/libsepol/Sanity/bz1838257-rpm-scripts-use-deprecated-telinit/Makefile @@ -0,0 +1,72 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/libsepol/Sanity/bz1838257-rpm-scripts-use-deprecated-telinit +# Description: The rpm scripts from libsepol uses out of date commands like telinit. +# Author: Amith Kumar +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2010 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/libsepol/Sanity/bz1838257-rpm-scripts-use-deprecated-telinit +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Amith Kumar " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: The rpm scripts from libsepol uses out of date commands like telinit" >> $(METADATA) + @echo "Type: Sanity" >> $(METADATA) + @echo "TestTime: 5m" >> $(METADATA) + @echo "RunFor: libsepol" >> $(METADATA) + @echo "RunFor: libselinux" >> $(METADATA) + @echo "RunFor: libsemanage" >> $(METADATA) + @echo "Requires: libsepol" >> $(METADATA) + @echo "Requires: libsepol-devel" >> $(METADATA) + @echo "Requires: libselinux" >> $(METADATA) + @echo "Requires: libselinux-devel" >> $(METADATA) + @echo "Requires: libsemanage" >> $(METADATA) + @echo "Requires: libsemanage-devel" >> $(METADATA) + @echo "Requires: pkgconfig" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Bug: 1838257" >> $(METADATA) + + rhts-lint $(METADATA) + diff --git a/libsepol/Sanity/bz1838257-rpm-scripts-use-deprecated-telinit/PURPOSE b/libsepol/Sanity/bz1838257-rpm-scripts-use-deprecated-telinit/PURPOSE new file mode 100644 index 0000000..21b5178 --- /dev/null +++ b/libsepol/Sanity/bz1838257-rpm-scripts-use-deprecated-telinit/PURPOSE @@ -0,0 +1,11 @@ +PURPOSE of /CoreOS/libsepol/Sanity/bz1838257-rpm-scripts-use-deprecated-telinit + +Description: libsepol rpm scripts use deprecated telinit command + +Author: Amith Kumar + +Bugzilla links: +https://bugzilla.redhat.com/show_bug.cgi?id=1838257 + +Description of problem: +The rpm scripts from the rpm is using out of date commands like telinit. diff --git a/libsepol/Sanity/bz1838257-rpm-scripts-use-deprecated-telinit/main.fmf b/libsepol/Sanity/bz1838257-rpm-scripts-use-deprecated-telinit/main.fmf new file mode 100644 index 0000000..d79a34a --- /dev/null +++ b/libsepol/Sanity/bz1838257-rpm-scripts-use-deprecated-telinit/main.fmf @@ -0,0 +1,2 @@ +path: /libsepol/Sanity/bz1838257-rpm-scripts-use-deprecated-telinit +tier: 1 diff --git a/libsepol/Sanity/bz1838257-rpm-scripts-use-deprecated-telinit/runtest.sh b/libsepol/Sanity/bz1838257-rpm-scripts-use-deprecated-telinit/runtest.sh new file mode 100755 index 0000000..18dbf39 --- /dev/null +++ b/libsepol/Sanity/bz1838257-rpm-scripts-use-deprecated-telinit/runtest.sh @@ -0,0 +1,52 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/libsepol/Sanity/bz1838257-rpm-scripts-use-deprecated-telinit +# Description: The rpm scripts from the rpm is using out of date commands like telinit. +# Author: Amith Kumar +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2010 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include rhts environment +. /usr/bin/rhts-environment.sh +. /usr/share/beakerlib/beakerlib.sh + +PACKAGE=libsepol +rlJournalStart + rlPhaseStartSetup + rlAssertRpm $PACKAGE + rlPhaseEnd + + if rlIsFedora '>=33' || rlIsRHEL ">=7" ; then + rlPhaseStartTest "libsepol rpm scripts use deprecated telinit command bz#1838257" + for COMPONENT in "libsepol" "libsemanage" "libselinux" ; do + rlRun "rpm -qa --scripts \*$COMPONENT\* 2>&1 | tee output_file" + rlAssertNotGrep "telinit" output_file + rlRun "rm -f output_file" + done + rlPhaseEnd + fi + + rlPhaseStartCleanup + rlPhaseEnd +rlJournalPrintText +rlJournalEnd From 64ddb60efd3092fd0ad3de16aabef8b3de5f9ec2 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Fri, 23 Apr 2021 15:25:04 +0200 Subject: [PATCH 027/626] exit from irrelevant tests quickly Some tests are not relevant for certain versions of RHEL. Their execution leads to failures there. After this change, they will exit quickly and print a short message explaining why. --- selinux-policy/ladvd/runtest.sh | 5 +++++ selinux-policy/rpmdb-and-similar/runtest.sh | 6 ++++++ selinux-policy/systemd-homed/runtest.sh | 6 ++++++ selinux-policy/tlp-and-similar/runtest.sh | 6 ++++++ 4 files changed, 23 insertions(+) diff --git a/selinux-policy/ladvd/runtest.sh b/selinux-policy/ladvd/runtest.sh index d4945c4..c213597 100755 --- a/selinux-policy/ladvd/runtest.sh +++ b/selinux-policy/ladvd/runtest.sh @@ -33,6 +33,11 @@ PACKAGE="selinux-policy" rlJournalStart + if rlIsRHEL ; then + rlLog "Not applicable to this OS version." + rlJournalEnd + exit 0 + fi rlPhaseStartSetup rlRun "rlImport 'selinux-policy/common'" rlSESatisfyRequires diff --git a/selinux-policy/rpmdb-and-similar/runtest.sh b/selinux-policy/rpmdb-and-similar/runtest.sh index b4187f8..af6e687 100755 --- a/selinux-policy/rpmdb-and-similar/runtest.sh +++ b/selinux-policy/rpmdb-and-similar/runtest.sh @@ -38,6 +38,12 @@ PROCESS_NAME="rpmdb" PROCESS_CONTEXT="rpmdb_t" rlJournalStart + if rlIsRHEL '<9' ; then + rlLog "Not applicable to this OS version." + rlJournalEnd + exit 0 + fi + rlLog "If this test fails, please contact mmalik or IRC #selinux" rlLog "This test should fail if tested bugs are NOT fixed yet" rlPhaseStartSetup diff --git a/selinux-policy/systemd-homed/runtest.sh b/selinux-policy/systemd-homed/runtest.sh index 7c0a45f..975bf39 100755 --- a/selinux-policy/systemd-homed/runtest.sh +++ b/selinux-policy/systemd-homed/runtest.sh @@ -110,6 +110,12 @@ expect -f - <<<' } rlJournalStart + if rlIsRHEL '<9' ; then + rlLog "Not applicable to this OS version." + rlJournalEnd + exit 0 + fi + rlPhaseStartSetup rlRun "rlImport 'selinux-policy/common'" rlSESatisfyRequires diff --git a/selinux-policy/tlp-and-similar/runtest.sh b/selinux-policy/tlp-and-similar/runtest.sh index 55a0f5f..6e11025 100755 --- a/selinux-policy/tlp-and-similar/runtest.sh +++ b/selinux-policy/tlp-and-similar/runtest.sh @@ -40,6 +40,12 @@ PROCESS_NAME="tlp" PROCESS_CONTEXT="tlp_t" rlJournalStart + if ! rlIsRHEL 7 8 && ! rlIsFedora ; then + rlLog "Not applicable to this OS version." + rlJournalEnd + exit 0 + fi + rlPhaseStartSetup rlRun "rlImport 'selinux-policy/common'" rlSESatisfyRequires From 6fc1caeb52fc91fb3cc8d7e9551e1bcbea66d1c5 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Thu, 1 Apr 2021 15:27:47 +0200 Subject: [PATCH 028/626] Add a minimal test for the recent setsebool kernel regression It doesn't have a bugzilla, but better to have a regression test for it. It's a very low-effort test, but still better than nothing :) Signed-off-by: Ondrej Mosnacek --- kernel/wrong-rules-after-setsebool/Makefile | 7 +++++ kernel/wrong-rules-after-setsebool/main.fmf | 20 +++++++++++++ kernel/wrong-rules-after-setsebool/runtest.sh | 29 +++++++++++++++++++ 3 files changed, 56 insertions(+) create mode 100644 kernel/wrong-rules-after-setsebool/Makefile create mode 100644 kernel/wrong-rules-after-setsebool/main.fmf create mode 100755 kernel/wrong-rules-after-setsebool/runtest.sh diff --git a/kernel/wrong-rules-after-setsebool/Makefile b/kernel/wrong-rules-after-setsebool/Makefile new file mode 100644 index 0000000..1b54785 --- /dev/null +++ b/kernel/wrong-rules-after-setsebool/Makefile @@ -0,0 +1,7 @@ +# Minimal Makefile for standard-test-roles-beakerlib + +R="RhtsRequires: policycoreutils setools-console" + +run: + chmod +x runtest.sh + ./runtest.sh diff --git a/kernel/wrong-rules-after-setsebool/main.fmf b/kernel/wrong-rules-after-setsebool/main.fmf new file mode 100644 index 0000000..d31ce1f --- /dev/null +++ b/kernel/wrong-rules-after-setsebool/main.fmf @@ -0,0 +1,20 @@ +summary: Regression test for broken rules after setting booleans +description: | + Test that conditional rules are not broken after changing SELinux booleans. + + Originally discovered in: + https://src.fedoraproject.org/tests/selinux/pull-request/203#comment-71053 +contact: Ondrej Mosnacek +component: +- kernel +framework: beakerlib +require: +- policycoreutils +- setools-console +duration: 5m +tier: 2 +enabled: true +adjust: + enabled: false + when: distro < rhel-7 + because: RHEL-6 and below are not worth supporting by this test diff --git a/kernel/wrong-rules-after-setsebool/runtest.sh b/kernel/wrong-rules-after-setsebool/runtest.sh new file mode 100755 index 0000000..6aad544 --- /dev/null +++ b/kernel/wrong-rules-after-setsebool/runtest.sh @@ -0,0 +1,29 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# SPDX-License-Identifier: GPLv2 +# Copyright (c) 2021 Red Hat, Inc. +# Author: Ondrej Mosnacek + +# Include Beakerlib environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +rlJournalStart + rlPhaseStartSetup + rlRun "uname -r" + rlPhaseEnd + + rlPhaseStartTest + rlRun "sesearch -s ftpd_t -t public_content_rw_t -c dir -p create -A | \ + tee sesearch-before.txt" + rlRun "setsebool ftpd_anon_write=off ftpd_connect_all_unreserved=off \ + ftpd_connect_db=off ftpd_full_access=off" + rlRun "sesearch -s ftpd_t -t public_content_rw_t -c dir -p create -A | \ + tee sesearch-after.txt" + rlAssertNotDiffer "sesearch-before.txt" "sesearch-after.txt" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "rm -f sesearch-before.txt sesearch-after.txt" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd From ca4b8c77c1f3afd237b06bf05bc3df8d19f12188 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Wed, 14 Apr 2021 17:42:33 +0200 Subject: [PATCH 029/626] test if systemd-timesyncd can watch the / directory Recent testing revealed, that systemd-timesyncd service wants to use the inotify_add_watch syscall on the root directory during boot. Unfortunately, SELinux policy denies that access. I believe that the access is harmless and should be allowed. The TC looks for appropriate policy rule. The TC covers BZ#1949315. --- selinux-policy/systemd-timesyncd-and-similar/Makefile | 1 + selinux-policy/systemd-timesyncd-and-similar/runtest.sh | 7 +++++++ 2 files changed, 8 insertions(+) diff --git a/selinux-policy/systemd-timesyncd-and-similar/Makefile b/selinux-policy/systemd-timesyncd-and-similar/Makefile index 25410b7..e47a5c9 100644 --- a/selinux-policy/systemd-timesyncd-and-similar/Makefile +++ b/selinux-policy/systemd-timesyncd-and-similar/Makefile @@ -73,6 +73,7 @@ $(METADATA): Makefile @echo "Bug: 1694272" >> $(METADATA) # Fedora 29 @echo "Bug: 1822131" >> $(METADATA) # Fedora 32 @echo "Bug: 1869979" >> $(METADATA) # RHEL-8 + @echo "Bug: 1949315" >> $(METADATA) # Fedora 34 rhts-lint $(METADATA) diff --git a/selinux-policy/systemd-timesyncd-and-similar/runtest.sh b/selinux-policy/systemd-timesyncd-and-similar/runtest.sh index 18950fe..9fc18cf 100755 --- a/selinux-policy/systemd-timesyncd-and-similar/runtest.sh +++ b/selinux-policy/systemd-timesyncd-and-similar/runtest.sh @@ -102,6 +102,13 @@ rlJournalStart rlSESearchRule "allow systemd_timedated_t efivarfs_t : file { getattr open read } [ ]" rlPhaseEnd + rlPhaseStartTest "bz#1949315" + rlSEMatchPathCon "/" "root_t" + rlSEMatchPathCon "/run" "var_run_t" + rlSESearchRule "allow systemd_timedated_t root_t : dir { watch } [ ]" + rlSESearchRule "allow systemd_timedated_t var_run_t : dir { watch } [ ]" + rlPhaseEnd + rlPhaseStartTest "real scenario -- standalone service" rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" if ! rlSEDefined ${PROCESS_CONTEXT} ; then From 8ea2e4bd982f2b583496a1a63a5ea682f6845b59 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Tue, 27 Apr 2021 14:52:57 +0200 Subject: [PATCH 030/626] Add a basic test for SELinux AVC tracepoint See the test description for more info. Signed-off-by: Ondrej Mosnacek --- kernel/avc_tracepoint/Makefile | 7 +++++++ kernel/avc_tracepoint/main.fmf | 25 +++++++++++++++++++++++++ kernel/avc_tracepoint/runtest.sh | 30 ++++++++++++++++++++++++++++++ 3 files changed, 62 insertions(+) create mode 100644 kernel/avc_tracepoint/Makefile create mode 100644 kernel/avc_tracepoint/main.fmf create mode 100755 kernel/avc_tracepoint/runtest.sh diff --git a/kernel/avc_tracepoint/Makefile b/kernel/avc_tracepoint/Makefile new file mode 100644 index 0000000..e266c68 --- /dev/null +++ b/kernel/avc_tracepoint/Makefile @@ -0,0 +1,7 @@ +# Minimal Makefile for standard-test-roles-beakerlib + +R="RhtsRequires: perf" + +run: + chmod +x runtest.sh + ./runtest.sh diff --git a/kernel/avc_tracepoint/main.fmf b/kernel/avc_tracepoint/main.fmf new file mode 100644 index 0000000..cfa723e --- /dev/null +++ b/kernel/avc_tracepoint/main.fmf @@ -0,0 +1,25 @@ +summary: Basic test for SELinux AVC tracepoint support +description: | + Tests basic functionality of the built-in kernel tracepoint for audited + SELinux denials that has been introduced in kernel v5.10. + + See also: + https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=dd8166212d9a2eca3181567c953d5687aea4d7dc +contact: Ondrej Mosnacek +component: +- kernel +framework: beakerlib +require: +- perf +duration: 5m +tier: 2 +enabled: true +adjust: +- enabled: false + when: distro < rhel-8.5 + because: RHEL-8.5 and below are not expected to support this +- enabled: false + when: distro < fedora-35 + because: This feature may not be available in kernels in F34 and below +link: +- verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1954024 diff --git a/kernel/avc_tracepoint/runtest.sh b/kernel/avc_tracepoint/runtest.sh new file mode 100755 index 0000000..d5f292f --- /dev/null +++ b/kernel/avc_tracepoint/runtest.sh @@ -0,0 +1,30 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# SPDX-License-Identifier: GPLv2 +# Copyright (c) 2021 Red Hat, Inc. +# Author: Ondrej Mosnacek + +# Include Beakerlib environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +rlJournalStart + rlPhaseStartSetup + rlRun "uname -r" + rlPhaseEnd + + rlPhaseStartTest + rlAssertExists /sys/kernel/tracing/events/avc/selinux_audited/enable + rlRun "perf list | grep avc:selinux_audited" + rlRun "perf record -o perf.data -e avc:selinux_audited \ + -g --call-graph dwarf \ + runcon system_u:system_r:kernel_t:s0 echo" 0-255 + rlRun "perf script -i perf.data" + rlAssertGreater "'perf script' output should have more than 0 lines" \ + "$(perf script -i perf.data | wc -l)" "0" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "rm -f perf.data" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd From d96170f11041959cd7f35e6dfd8ffa6fc6fbbd9a Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Wed, 28 Apr 2021 16:34:10 +0200 Subject: [PATCH 031/626] kernel/selinux-testsuite: Bump upstream commit This pulls in a fix to account for the following kernel commit: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?h=v5.12&id=db2e718a47984b9d71ed890eb2ea36ecf150de18 Signed-off-by: Ondrej Mosnacek --- kernel/selinux-testsuite/runtest.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/selinux-testsuite/runtest.sh b/kernel/selinux-testsuite/runtest.sh index 75fefce..140d4c8 100755 --- a/kernel/selinux-testsuite/runtest.sh +++ b/kernel/selinux-testsuite/runtest.sh @@ -35,7 +35,7 @@ PACKAGE="selinux-policy" # This should be updated as needed after verifying that the new version # doesn't break testing and after applying all necessary tweaks in the TC. # Run with GIT_BRANCH=master to run the latest upstream version. -DEFAULT_COMMIT="1defa850ae71bc27c9dd101d19f543a42abc9537" +DEFAULT_COMMIT="fd4254f09316f6db0410a9187cb8866571f109b5" # Default pull requests to merge before running the test. # If non-empty, then after checking out GIT_BRANCH the listed upstream pull # requests (by number) are merged, creating a new temporary local branch. From 118ffc5219d9f4eccbbe6906e178edb25507c510 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Thu, 29 Apr 2021 07:48:30 +0200 Subject: [PATCH 032/626] kernel/avc_tracepoint: disable restraint's AVC check Set AVC_ERROR=+no_avc_check in environment to disable restraint's built-in AVC check so that it doesn't interpret the (expected) AVCs as failure. Signed-off-by: Ondrej Mosnacek --- kernel/avc_tracepoint/main.fmf | 2 ++ 1 file changed, 2 insertions(+) diff --git a/kernel/avc_tracepoint/main.fmf b/kernel/avc_tracepoint/main.fmf index cfa723e..5f6ff5d 100644 --- a/kernel/avc_tracepoint/main.fmf +++ b/kernel/avc_tracepoint/main.fmf @@ -23,3 +23,5 @@ adjust: because: This feature may not be available in kernels in F34 and below link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1954024 +environment: + AVC_ERROR: +no_avc_check From f6ee2087e8f1a98ef0920a72f3e1545fc19cee5a Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Tue, 4 May 2021 10:35:03 +0200 Subject: [PATCH 033/626] kernel/selinux-testsuite: Bump upstream commit This pulls in two fixes for running on the latest v5.13 kernels. Signed-off-by: Ondrej Mosnacek --- kernel/selinux-testsuite/runtest.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/selinux-testsuite/runtest.sh b/kernel/selinux-testsuite/runtest.sh index 140d4c8..825855a 100755 --- a/kernel/selinux-testsuite/runtest.sh +++ b/kernel/selinux-testsuite/runtest.sh @@ -35,7 +35,7 @@ PACKAGE="selinux-policy" # This should be updated as needed after verifying that the new version # doesn't break testing and after applying all necessary tweaks in the TC. # Run with GIT_BRANCH=master to run the latest upstream version. -DEFAULT_COMMIT="fd4254f09316f6db0410a9187cb8866571f109b5" +DEFAULT_COMMIT="58eaa31c9e0e0a0567990336ae355b4cd309e6e3" # Default pull requests to merge before running the test. # If non-empty, then after checking out GIT_BRANCH the listed upstream pull # requests (by number) are merged, creating a new temporary local branch. From 3750c47bc8c2f9de4c6c382e1bed401f625bef61 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Tue, 6 Apr 2021 17:20:28 +0200 Subject: [PATCH 034/626] kernel/selinux-testsuite: move keys test exclude under RHEL-8 The relevant config option is now enabled on RHEL-9, so we can skip it on RHEL-8 only to get coverage on RHEL-9 and above. Tested on latest RHEL-9 VM image. Signed-off-by: Ondrej Mosnacek --- kernel/selinux-testsuite/runtest.sh | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/kernel/selinux-testsuite/runtest.sh b/kernel/selinux-testsuite/runtest.sh index 825855a..ad700e2 100755 --- a/kernel/selinux-testsuite/runtest.sh +++ b/kernel/selinux-testsuite/runtest.sh @@ -324,6 +324,10 @@ rlJournalStart rlRun "sed -i 's/^corecmd_bin_entry_type(\(.*\))$/corecmd_bin_entry_type(\1)\ncorecmd_sbin_entry_type(\1)/' policy/*.te" 0 rlRun "sed -i 's/^userdom_search_user_home_dirs(\(.*\))$/userdom_search_user_home_dirs(user, \1)/' policy/*.te" 0 fi + if rlIsRHEL 8; then + # CONFIG_KEY_DH_OPERATIONS not enabled on RHEL-8 :( + exclude_tests+=" keys" + fi if rlIsRHEL "<8.2"; then rlRun "sed -i '/SUBDIRS += bpf/d;/export CFLAGS += -DHAVE_BPF/d' tests/Makefile" 0 \ "RHEL < 8.2 doesn't ship libbpf => disable BPF subtests" @@ -375,8 +379,6 @@ rlJournalStart rlRun "sed -i 's/SCTP_SEND_FAILED_EVENT/SCTP_STREAM_CHANGE_EVENT + 1/g' tests/sctp/*.c" 0 \ "Fix SCTP test compilation on old RHEL kernels" fi - # CONFIG_KEYS_DH_COMPUTE not enabled on RHEL-8 :( - exclude_tests+=" keys" # Needs: # e4cfa05e9bfe ("selinux: Add xfs quota command types") From 1a7541ad66373cf791e9123344cbace016ffc682 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Wed, 5 May 2021 15:57:15 +0200 Subject: [PATCH 035/626] kernel/selinux-testsuite: update the XFS quota bug workaround The bugfix has been backported in RHEL-8.4, so we can now replace this with a kernel version check, increasing the coverage on RHEL-8.4 and above. Verified that the testsuite still passes on RHEL-8.3, 8.4, and RHEL-9. Signed-off-by: Ondrej Mosnacek --- kernel/selinux-testsuite/runtest.sh | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-) diff --git a/kernel/selinux-testsuite/runtest.sh b/kernel/selinux-testsuite/runtest.sh index ad700e2..73ce274 100755 --- a/kernel/selinux-testsuite/runtest.sh +++ b/kernel/selinux-testsuite/runtest.sh @@ -379,16 +379,15 @@ rlJournalStart rlRun "sed -i 's/SCTP_SEND_FAILED_EVENT/SCTP_STREAM_CHANGE_EVENT + 1/g' tests/sctp/*.c" 0 \ "Fix SCTP test compilation on old RHEL kernels" fi - - # Needs: - # e4cfa05e9bfe ("selinux: Add xfs quota command types") - # (not backported to any RHEL at this point - TODO update the check once it is) - script1='s/\$test_count += 62;/$test_count = 55;/g' - script2='s/\$quota_checks += 1;/$quota_checks = 0;/g' - # for some reason this is needed for older RHEL 7 versions... - script3='s/\$test_count += 69;/$test_count = 55;/g' - rlRun "sed -i -E -e '$script1' -e '$script2' -e '$script3' tests/filesystem/test" 0 \ - "Apply workaround for missing XFS quota checks" + if kver_lt 4.18.0-252; then + # 8a4d5985551b [security] selinux: Add xfs quota command types + script1='s/\$test_count += 62;/$test_count = 55;/g' + script2='s/\$quota_checks += 1;/$quota_checks = 0;/g' + # for some reason this is needed for older RHEL 7 versions... + script3='s/\$test_count += 69;/$test_count = 55;/g' + rlRun "sed -i -E -e '$script1' -e '$script2' -e '$script3' tests/filesystem/test" 0 \ + "Apply workaround for missing XFS quota checks" + fi fi # CKI mainline kernels don't ship with module build infrastructure From 455409b672a52926a4df99cf469ab4ff1f47a007 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Thu, 6 May 2021 11:15:06 +0200 Subject: [PATCH 036/626] kernel/selinux-testsuite: fix condition for skipping the keys subtest It actually doesn't work (and doesn't get excluded automatically) on RHEL-7 either, so change the condition to rhel < 9. Signed-off-by: Ondrej Mosnacek --- kernel/selinux-testsuite/runtest.sh | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/kernel/selinux-testsuite/runtest.sh b/kernel/selinux-testsuite/runtest.sh index 73ce274..3256ea4 100755 --- a/kernel/selinux-testsuite/runtest.sh +++ b/kernel/selinux-testsuite/runtest.sh @@ -324,14 +324,15 @@ rlJournalStart rlRun "sed -i 's/^corecmd_bin_entry_type(\(.*\))$/corecmd_bin_entry_type(\1)\ncorecmd_sbin_entry_type(\1)/' policy/*.te" 0 rlRun "sed -i 's/^userdom_search_user_home_dirs(\(.*\))$/userdom_search_user_home_dirs(user, \1)/' policy/*.te" 0 fi - if rlIsRHEL 8; then - # CONFIG_KEY_DH_OPERATIONS not enabled on RHEL-8 :( - exclude_tests+=" keys" - fi if rlIsRHEL "<8.2"; then rlRun "sed -i '/SUBDIRS += bpf/d;/export CFLAGS += -DHAVE_BPF/d' tests/Makefile" 0 \ "RHEL < 8.2 doesn't ship libbpf => disable BPF subtests" fi + if rlIsRHEL "<9"; then + # CONFIG_KEY_DH_OPERATIONS not enabled on RHEL-8 :( + # on RHEL-7, KEYCTL_DH_COMPUTE is not defined in the header + exclude_tests+=" keys" + fi rlRun "sed -i 's/tm\.tv_sec = [0-9]*;/tm.tv_sec = $NETWORK_TIMEOUT;/' ./tests/*/*.c" 0 \ "Tweak timeout in networking tests" # 2 secs is too little for SCTP test From e624bebd02cc83ad0224c9c1151f14af47ee67a9 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Wed, 24 Feb 2021 22:08:01 +0100 Subject: [PATCH 037/626] add the usbmuxd test to upstream repo The usbmuxd component is used in various versions of RHEL and Fedora, so it makes sense to run this TC in upstream testing too. Moving the downstream TC to upstream repository. There are only slight changes when comparing the upstream and downstream version of this TC. --- selinux-policy/usbmuxd-and-similar/Makefile | 70 +++++++++++++ selinux-policy/usbmuxd-and-similar/PURPOSE | 5 + selinux-policy/usbmuxd-and-similar/main.fmf | 2 + selinux-policy/usbmuxd-and-similar/runtest.sh | 97 +++++++++++++++++++ 4 files changed, 174 insertions(+) create mode 100644 selinux-policy/usbmuxd-and-similar/Makefile create mode 100644 selinux-policy/usbmuxd-and-similar/PURPOSE create mode 100644 selinux-policy/usbmuxd-and-similar/main.fmf create mode 100755 selinux-policy/usbmuxd-and-similar/runtest.sh diff --git a/selinux-policy/usbmuxd-and-similar/Makefile b/selinux-policy/usbmuxd-and-similar/Makefile new file mode 100644 index 0000000..bb52aaf --- /dev/null +++ b/selinux-policy/usbmuxd-and-similar/Makefile @@ -0,0 +1,70 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/usbmuxd-and-similar +# Description: SELinux interferes with usbmuxd and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/usbmuxd-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with usbmuxd and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 15m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "RunFor: usbmuxd" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console usbmuxd initscripts" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6" >> $(METADATA) + @echo "Bug: 1521054" >> $(METADATA) # RHEL-7 + @echo "Bug: 1582205" >> $(METADATA) # RHEL-7 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/usbmuxd-and-similar/PURPOSE b/selinux-policy/usbmuxd-and-similar/PURPOSE new file mode 100644 index 0000000..b81475e --- /dev/null +++ b/selinux-policy/usbmuxd-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/usbmuxd-and-similar +Author: Milos Malik + +SELinux interferes with usbmuxd and related programs. + diff --git a/selinux-policy/usbmuxd-and-similar/main.fmf b/selinux-policy/usbmuxd-and-similar/main.fmf new file mode 100644 index 0000000..9c8cf66 --- /dev/null +++ b/selinux-policy/usbmuxd-and-similar/main.fmf @@ -0,0 +1,2 @@ +path: /selinux-policy/usbmuxd-and-similar +tier: 2 diff --git a/selinux-policy/usbmuxd-and-similar/runtest.sh b/selinux-policy/usbmuxd-and-similar/runtest.sh new file mode 100755 index 0000000..7c9729b --- /dev/null +++ b/selinux-policy/usbmuxd-and-similar/runtest.sh @@ -0,0 +1,97 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/usbmuxd-and-similar +# Description: SELinux interferes with usbmuxd and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +ROOT_PASSWORD="redhat" +FILE_PATH="/usr/sbin/usbmuxd" +FILE_CONTEXT="usbmuxd_exec_t" +SERVICE_PACKAGE="usbmuxd" +SERVICE_NAME="usbmuxd" +PROCESS_NAME="usbmuxd" +PROCESS_CONTEXT="usbmuxd_t" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} + rlFileBackup /etc/shadow + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "bz#1521054 + bz#1582205" + if rlIsRHEL 5 ; then + SOURCE_TYPE="initrc_t" + BOOLEANS="[ ]" + elif rlIsRHEL 6 ; then + SOURCE_TYPE="initrc_t" + else # RHEL-7 etc. + SOURCE_TYPE="init_t" # systemd runs the process + fi + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + rlSEMatchPathCon "/run/udev/data" "udev_var_run_t" + rlSEMatchPathCon "/run/udev/data/c189:0" "udev_var_run_t" + rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute }" + rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } ${BOOLEANS}" + rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} ${BOOLEANS}" + rlSESearchRule "allow usbmuxd_t udev_var_run_t : dir { getattr open search } [ ]" + rlSESearchRule "allow usbmuxd_t udev_var_run_t : file { getattr open read } [ ]" + rlPhaseEnd + + rlPhaseStartTest "real scenario" + rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + PROCESS_CONTEXT="unconfined_service_t" + fi + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /var /run" + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + From c0798bf2bcd923532f67e77e782a2584f18074da Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 19 Jan 2021 11:39:42 +0100 Subject: [PATCH 038/626] add new test which covers the lockdown class In comparison to kernel, which recognizes the lockdown class and its permissions, SELinux policy does not recognize them yet. But that situation should change soon. Purpose of the TC is to find out if the same lockdown class and its permissions recognized by kernel are also recognized by SELinux policy. The TC covers BZ#1915184. --- selinux-policy/lockdown-class/Makefile | 68 ++++++++++++++++++++++++ selinux-policy/lockdown-class/PURPOSE | 5 ++ selinux-policy/lockdown-class/main.fmf | 3 ++ selinux-policy/lockdown-class/runtest.sh | 60 +++++++++++++++++++++ 4 files changed, 136 insertions(+) create mode 100644 selinux-policy/lockdown-class/Makefile create mode 100644 selinux-policy/lockdown-class/PURPOSE create mode 100644 selinux-policy/lockdown-class/main.fmf create mode 100755 selinux-policy/lockdown-class/runtest.sh diff --git a/selinux-policy/lockdown-class/Makefile b/selinux-policy/lockdown-class/Makefile new file mode 100644 index 0000000..5d3e856 --- /dev/null +++ b/selinux-policy/lockdown-class/Makefile @@ -0,0 +1,68 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Sanity/lockdown-class +# Description: Is the lockdown class + its permissions defined in SELinux policy? +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2020 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Sanity/lockdown-class +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: Is the lockdown class + its permissions defined in SELinux policy?" >> $(METADATA) + @echo "Type: Sanity" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) + @echo "Bug: 1915184" >> $(METADATA) # Fedora rawhide + + rhts-lint $(METADATA) + diff --git a/selinux-policy/lockdown-class/PURPOSE b/selinux-policy/lockdown-class/PURPOSE new file mode 100644 index 0000000..17dd1ab --- /dev/null +++ b/selinux-policy/lockdown-class/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Sanity/lockdown-class +Author: Milos Malik + +Description: Is the lockdown class + its permissions defined in SELinux policy? + diff --git a/selinux-policy/lockdown-class/main.fmf b/selinux-policy/lockdown-class/main.fmf new file mode 100644 index 0000000..be3fc65 --- /dev/null +++ b/selinux-policy/lockdown-class/main.fmf @@ -0,0 +1,3 @@ +path: /selinux-policy/lockdown-class +tier: 2 + diff --git a/selinux-policy/lockdown-class/runtest.sh b/selinux-policy/lockdown-class/runtest.sh new file mode 100755 index 0000000..09efc90 --- /dev/null +++ b/selinux-policy/lockdown-class/runtest.sh @@ -0,0 +1,60 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Sanity/lockdown-class +# Description: Is the lockdown class + its permissions defined in SELinux policy? +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2020 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "bz#1915184" + rlRun "seinfo -c lockdown" + rlRun "seinfo -c lockdown -x | grep confidentiality" + rlRun "seinfo -c lockdown -x | grep integrity" + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + From f422258a047a9f4568b7326e9db771a579122841 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 9 Mar 2021 18:49:08 +0100 Subject: [PATCH 039/626] test if unconfined process can lockdown kernel for integrity purposes SELinux policy recently introduced a new lockdown class which contains 2 permissions: integrity and confidentiality. As you know, processes labeled as unconfined_t should be allowed to use all permissions from all classes, because they are not confined. Unfortunately, our internal testing revealed that processes running as unconfined_t are not allowed to use integrity permission. The TC does not reproduce the scenario, it only checks the existence of appropriate allow rules. The TC covers BZ#1929332 and BZ#1933134. --- selinux-policy/lockdown-class/Makefile | 2 ++ selinux-policy/lockdown-class/runtest.sh | 4 ++++ 2 files changed, 6 insertions(+) diff --git a/selinux-policy/lockdown-class/Makefile b/selinux-policy/lockdown-class/Makefile index 5d3e856..135635d 100644 --- a/selinux-policy/lockdown-class/Makefile +++ b/selinux-policy/lockdown-class/Makefile @@ -63,6 +63,8 @@ $(METADATA): Makefile @echo "Destructive: no" >> $(METADATA) @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) @echo "Bug: 1915184" >> $(METADATA) # Fedora rawhide + @echo "Bug: 1929332" >> $(METADATA) # RHEL-9 + @echo "Bug: 1933134" >> $(METADATA) # RHEL-9 rhts-lint $(METADATA) diff --git a/selinux-policy/lockdown-class/runtest.sh b/selinux-policy/lockdown-class/runtest.sh index 09efc90..a8376a2 100755 --- a/selinux-policy/lockdown-class/runtest.sh +++ b/selinux-policy/lockdown-class/runtest.sh @@ -51,6 +51,10 @@ rlJournalStart rlRun "seinfo -c lockdown -x | grep integrity" rlPhaseEnd + rlPhaseStartTest "bz#1929332 + bz#1933134" + rlSESearchRule "allow unconfined_t unconfined_t : lockdown { integrity } [ ]" + rlPhaseEnd + rlPhaseStartCleanup sleep 2 rlSECheckAVC From 28aaa75dde48779df78ffec408732e0f215c7339 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Fri, 14 May 2021 09:36:49 +0200 Subject: [PATCH 040/626] skip the policy which is not installed The TC expected that all SELinux policies are installed before the TC is executed. If some of them is not installed, one of the test phases failed. Now, the test phase checks if particular policy is installed before calling the D-bus interface on it. --- .../org-selinux-dbus-interfaces/Makefile | 1 + .../org-selinux-dbus-interfaces/runtest.sh | 15 +++++++++------ 2 files changed, 10 insertions(+), 6 deletions(-) diff --git a/policycoreutils/org-selinux-dbus-interfaces/Makefile b/policycoreutils/org-selinux-dbus-interfaces/Makefile index 92c8af6..6756710 100644 --- a/policycoreutils/org-selinux-dbus-interfaces/Makefile +++ b/policycoreutils/org-selinux-dbus-interfaces/Makefile @@ -63,3 +63,4 @@ $(METADATA): Makefile @echo "Bug: 1754873" >> $(METADATA) # RHEL-8 rhts-lint $(METADATA) + diff --git a/policycoreutils/org-selinux-dbus-interfaces/runtest.sh b/policycoreutils/org-selinux-dbus-interfaces/runtest.sh index 458c695..14779a5 100755 --- a/policycoreutils/org-selinux-dbus-interfaces/runtest.sh +++ b/policycoreutils/org-selinux-dbus-interfaces/runtest.sh @@ -91,13 +91,16 @@ rlJournalStart rlPhaseEnd rlPhaseStartTest "org.selinux.change_default_policy" + # 1 argument is missing rlRun "dbus-send --system --print-reply --dest=org.selinux /org/selinux/object org.selinux.change_default_policy" 1 - rlRun "dbus-send --system --print-reply --dest=org.selinux /org/selinux/object org.selinux.change_default_policy string:minimum" - rlRun "grep SELINUXTYPE=minimum /etc/selinux/config" - rlRun "dbus-send --system --print-reply --dest=org.selinux /org/selinux/object org.selinux.change_default_policy string:mls" - rlRun "grep SELINUXTYPE=mls /etc/selinux/config" - rlRun "dbus-send --system --print-reply --dest=org.selinux /org/selinux/object org.selinux.change_default_policy string:targeted" - rlRun "grep SELINUXTYPE=targeted /etc/selinux/config" + # test existing policies + for POLICY_KIND in minimum mls targeted ; do + if rpm -q selinux-policy-${POLICY_KIND} ; then + rlRun "dbus-send --system --print-reply --dest=org.selinux /org/selinux/object org.selinux.change_default_policy string:${POLICY_KIND}" + rlRun "grep SELINUXTYPE=${POLICY_KIND} /etc/selinux/config" + fi + done + # test a non-existent policy rlRun "dbus-send --system --print-reply --dest=org.selinux /org/selinux/object org.selinux.change_default_policy string:xyz" 1 rlPhaseEnd From 30ada8fa616fa77e57cd83414ff2871832067bd0 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Wed, 12 May 2021 10:47:36 +0200 Subject: [PATCH 041/626] test if usbmuxd can call statfs on /sys filesystem Recent testing revealed that the usbmuxd service triggers SELinux denials during its start. SELinux prevented the usbmuxd process from accessing the /sys filesystem. The TC reproduces the situation. I believe this access should be allowed in SELinux policy. The TC looks for appropriate policy rules. The TC covers BZ#1930992. --- selinux-policy/usbmuxd-and-similar/Makefile | 1 + selinux-policy/usbmuxd-and-similar/runtest.sh | 5 +++++ 2 files changed, 6 insertions(+) diff --git a/selinux-policy/usbmuxd-and-similar/Makefile b/selinux-policy/usbmuxd-and-similar/Makefile index bb52aaf..f960b22 100644 --- a/selinux-policy/usbmuxd-and-similar/Makefile +++ b/selinux-policy/usbmuxd-and-similar/Makefile @@ -65,6 +65,7 @@ $(METADATA): Makefile @echo "Releases: -RHEL4 -RHEL5 -RHEL6" >> $(METADATA) @echo "Bug: 1521054" >> $(METADATA) # RHEL-7 @echo "Bug: 1582205" >> $(METADATA) # RHEL-7 + @echo "Bug: 1930992" >> $(METADATA) # Fedora 33 rhts-lint $(METADATA) diff --git a/selinux-policy/usbmuxd-and-similar/runtest.sh b/selinux-policy/usbmuxd-and-similar/runtest.sh index 7c9729b..9f63eda 100755 --- a/selinux-policy/usbmuxd-and-similar/runtest.sh +++ b/selinux-policy/usbmuxd-and-similar/runtest.sh @@ -75,6 +75,11 @@ rlJournalStart rlSESearchRule "allow usbmuxd_t udev_var_run_t : file { getattr open read } [ ]" rlPhaseEnd + rlPhaseStartTest "bz#1930992" + rlSEMatchPathCon "/sys" "sysfs_t" + rlSESearchRule "allow usbmuxd_t sysfs_t : filesystem { getattr } [ ]" + rlPhaseEnd + rlPhaseStartTest "real scenario" rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" if ! rlSEDefined ${PROCESS_CONTEXT} ; then From f4761fdb7e7fbfb86ba577a33e7328b0367900cd Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Wed, 12 May 2021 10:57:20 +0200 Subject: [PATCH 042/626] test if usbmuxd can call statfs on /sys/fs/cgroup filesystem Recent testing revealed that the usbmuxd service triggers SELinux denials during its start, because SELinux prevents the usbmuxd process from accessing the /sys/fs/cgroup filesystem. The TC is able to reproduces the situation. I believe this access should be allowed in SELinux policy. The TC looks for appropriate policy rules. The TC covers BZ#1936705. --- selinux-policy/usbmuxd-and-similar/Makefile | 1 + selinux-policy/usbmuxd-and-similar/runtest.sh | 5 +++++ 2 files changed, 6 insertions(+) diff --git a/selinux-policy/usbmuxd-and-similar/Makefile b/selinux-policy/usbmuxd-and-similar/Makefile index f960b22..c05b47b 100644 --- a/selinux-policy/usbmuxd-and-similar/Makefile +++ b/selinux-policy/usbmuxd-and-similar/Makefile @@ -66,6 +66,7 @@ $(METADATA): Makefile @echo "Bug: 1521054" >> $(METADATA) # RHEL-7 @echo "Bug: 1582205" >> $(METADATA) # RHEL-7 @echo "Bug: 1930992" >> $(METADATA) # Fedora 33 + @echo "Bug: 1936705" >> $(METADATA) # Fedora 34 rhts-lint $(METADATA) diff --git a/selinux-policy/usbmuxd-and-similar/runtest.sh b/selinux-policy/usbmuxd-and-similar/runtest.sh index 9f63eda..2905f19 100755 --- a/selinux-policy/usbmuxd-and-similar/runtest.sh +++ b/selinux-policy/usbmuxd-and-similar/runtest.sh @@ -80,6 +80,11 @@ rlJournalStart rlSESearchRule "allow usbmuxd_t sysfs_t : filesystem { getattr } [ ]" rlPhaseEnd + rlPhaseStartTest "bz#1936705" + rlSEMatchPathCon "/sys/fs/cgroup" "cgroup_t" + rlSESearchRule "allow usbmuxd_t cgroup_t : filesystem { getattr } [ ]" + rlPhaseEnd + rlPhaseStartTest "real scenario" rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" if ! rlSEDefined ${PROCESS_CONTEXT} ; then From bcdbcff58c78061b5df757024ce26f7fc2c4f080 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Wed, 12 May 2021 11:46:15 +0200 Subject: [PATCH 043/626] test if usbmuxd can access /proc/1/environ file Recent testing revealed that the usbmuxd service triggers SELinux denials during its start. SELinux prevented the usbmuxd process from accessing the /proc/1/environ file. The TC reproduces the situation. I believe this access should be dontaudited in SELinux policy, because it is not necessary. The TC looks for appropriate policy rules. The TC covers BZ#1959747. --- selinux-policy/usbmuxd-and-similar/Makefile | 1 + selinux-policy/usbmuxd-and-similar/runtest.sh | 7 +++++++ 2 files changed, 8 insertions(+) diff --git a/selinux-policy/usbmuxd-and-similar/Makefile b/selinux-policy/usbmuxd-and-similar/Makefile index c05b47b..d397168 100644 --- a/selinux-policy/usbmuxd-and-similar/Makefile +++ b/selinux-policy/usbmuxd-and-similar/Makefile @@ -67,6 +67,7 @@ $(METADATA): Makefile @echo "Bug: 1582205" >> $(METADATA) # RHEL-7 @echo "Bug: 1930992" >> $(METADATA) # Fedora 33 @echo "Bug: 1936705" >> $(METADATA) # Fedora 34 + @echo "Bug: 1959747" >> $(METADATA) # Fedora 35 rhts-lint $(METADATA) diff --git a/selinux-policy/usbmuxd-and-similar/runtest.sh b/selinux-policy/usbmuxd-and-similar/runtest.sh index 2905f19..b94e525 100755 --- a/selinux-policy/usbmuxd-and-similar/runtest.sh +++ b/selinux-policy/usbmuxd-and-similar/runtest.sh @@ -85,6 +85,13 @@ rlJournalStart rlSESearchRule "allow usbmuxd_t cgroup_t : filesystem { getattr } [ ]" rlPhaseEnd + rlPhaseStartTest "bz#1959747" + rlRun "ls -dZ /proc/1 | grep :init_t" + rlRun "ls -Z /proc/1/environ | grep :init_t" + rlSESearchRule "dontaudit usbmuxd_t init_t : dir { search } [ ]" + rlSESearchRule "dontaudit usbmuxd_t init_t : file { getattr open read ioctl } [ ]" + rlPhaseEnd + rlPhaseStartTest "real scenario" rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" if ! rlSEDefined ${PROCESS_CONTEXT} ; then From 600c907d1e33b3b987a63d34d698f41fa8354625 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Fri, 5 Mar 2021 13:13:57 +0100 Subject: [PATCH 044/626] add the pcscd test to upstream repo The pcsc-lite package is available in various versions of RHEL and Fedora. The pcscd service is also used in these environments, so it makes sense to run this TC in upstream testing too. Moving the downstream TC to upstream repository. There are only slight changes when comparing the upstream and downstream version of this TC. --- .../bz624405-pcsc-and-similar/Makefile | 92 ++++++++++++++ .../bz624405-pcsc-and-similar/PURPOSE | 5 + .../bz624405-pcsc-and-similar/main.fmf | 3 + .../bz624405-pcsc-and-similar/runtest.sh | 118 ++++++++++++++++++ 4 files changed, 218 insertions(+) create mode 100644 selinux-policy/bz624405-pcsc-and-similar/Makefile create mode 100644 selinux-policy/bz624405-pcsc-and-similar/PURPOSE create mode 100644 selinux-policy/bz624405-pcsc-and-similar/main.fmf create mode 100755 selinux-policy/bz624405-pcsc-and-similar/runtest.sh diff --git a/selinux-policy/bz624405-pcsc-and-similar/Makefile b/selinux-policy/bz624405-pcsc-and-similar/Makefile new file mode 100644 index 0000000..d0e27fd --- /dev/null +++ b/selinux-policy/bz624405-pcsc-and-similar/Makefile @@ -0,0 +1,92 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/bz624405-pcsc-and-similar +# Description: SELinux interferes with pcscd +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2021 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/bz624405-pcsc-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with pcscd" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 15m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "RunFor: pcsc-lite" >> $(METADATA) + @echo "Requires: audit" >> $(METADATA) + @echo "Requires: expect" >> $(METADATA) + @echo "Requires: grep" >> $(METADATA) + @echo "Requires: initscripts" >> $(METADATA) + @echo "Requires: libselinux" >> $(METADATA) + @echo "Requires: libselinux-utils" >> $(METADATA) + @echo "Requires: pcsc-lite" >> $(METADATA) + @echo "Requires: policycoreutils" >> $(METADATA) + @echo "Requires: procps" >> $(METADATA) + @echo "Requires: selinux-policy" >> $(METADATA) + @echo "Requires: selinux-policy-mls" >> $(METADATA) + @echo "Requires: selinux-policy-targeted" >> $(METADATA) + @echo "Requires: setools" >> $(METADATA) + @echo "Requires: setools-console" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Releases: -RHEL4" >> $(METADATA) + @echo "Architectures: i386 ia64 ppc ppc64 x86_64" >> $(METADATA) + @echo "Bug: 624405" >> $(METADATA) # RHEL-6 + @echo "Bug: 752453" >> $(METADATA) # RHEL-6 + @echo "Bug: 1605641" >> $(METADATA) # RHEL-7 + @echo "Bug: 1802423" >> $(METADATA) # Fedora 32 + @echo "Bug: 1805719" >> $(METADATA) # Fedora 32 + @echo "Bug: 1806129" >> $(METADATA) # Fedora 32 + @echo "Bug: 1816787" >> $(METADATA) # Fedora 32 + @echo "Bug: 1818759" >> $(METADATA) # Fedora 32 + @echo "Bug: 1825182" >> $(METADATA) # Fedora 32 + @echo "Bug: 1825188" >> $(METADATA) # Fedora 32 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/bz624405-pcsc-and-similar/PURPOSE b/selinux-policy/bz624405-pcsc-and-similar/PURPOSE new file mode 100644 index 0000000..c9c36f2 --- /dev/null +++ b/selinux-policy/bz624405-pcsc-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/bz624405-pcsc-and-similar +Author: Milos Malik + +SELinux interferes with pcscd and related programs. + diff --git a/selinux-policy/bz624405-pcsc-and-similar/main.fmf b/selinux-policy/bz624405-pcsc-and-similar/main.fmf new file mode 100644 index 0000000..798179e --- /dev/null +++ b/selinux-policy/bz624405-pcsc-and-similar/main.fmf @@ -0,0 +1,3 @@ +path: /selinux-policy/bz624405-pcsc-and-similar +tier: 2 + diff --git a/selinux-policy/bz624405-pcsc-and-similar/runtest.sh b/selinux-policy/bz624405-pcsc-and-similar/runtest.sh new file mode 100755 index 0000000..5123da8 --- /dev/null +++ b/selinux-policy/bz624405-pcsc-and-similar/runtest.sh @@ -0,0 +1,118 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/bz624405-pcsc-and-similar +# Description: SELinux interferes with pcscd +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2021 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include rhts environment +. /usr/bin/rhts-environment.sh +. /usr/share/beakerlib/beakerlib.sh + +PACKAGE="selinux-policy" +ROOT_PASSWORD="redhat" +SERVICE_NAME="pcscd" +PROCESS_CONTEXT="pcscd_t" +PROCESS_NAME="pcscd" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-mls + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm pcsc-lite + + rlServiceStop ${SERVICE_NAME} + rlFileBackup /etc/shadow + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "bz#624405" + rlSEMatchPathCon "/usr/sbin/pcscd" "pcscd_exec_t" + if rlIsRHEL 5 ; then + rlRun "ls -dZ /sys | grep :sysfs_t" + rlRun "ls -dZ /sys/devices | grep :sysfs_t" + rlSESearchRule "allow pcscd_t sysfs_t : dir { getattr search }" + else + rlSEMatchPathCon "/sys" "sysfs_t" + rlSEMatchPathCon "/sys/devices" "sysfs_t" + rlSESearchRule "allow pcscd_t sysfs_t : dir { getattr open read search }" + rlSESearchRule "allow pcscd_t sysfs_t : file { getattr open read }" + fi + rlPhaseEnd + + rlPhaseStartTest "bz#752453" + rlSEMatchPathCon "/usr/sbin/pcscd" "pcscd_exec_t" + rlSESearchRule "allow pcscd_t usb_device_t : chr_file { getattr read write }" + rlPhaseEnd + + if ! rlIsRHEL 5 6 7 ; then + rlPhaseStartTest "bz#1605641" + rlSEMatchPathCon "/usr/sbin/pcscd" "pcscd_exec_t" + rlSESearchRule "dontaudit pcscd_t pcscd_t : capability { sys_admin }" + rlPhaseEnd + fi + + if rlIsFedora ; then + rlPhaseStartTest "bz#1806129 + bz#1816787 + bz#1818759 + bz#1825182 + bz#1825188" + rlSEMatchPathCon "/usr/sbin/pcscd" "pcscd_exec_t" + rlSESearchRule "dontaudit pcscd_t pcscd_t : capability { sys_nice } [ daemons_dontaudit_scheduling ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1802423 + bz#1805719" + rlSEMatchPathCon "/usr/sbin/pcscd" "pcscd_exec_t" + rlSESearchRule "dontaudit pcscd_t pcscd_t : process { setsched } [ ]" + rlPhaseEnd + fi + + rlPhaseStartTest "real scenario -- bz#624405" + rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + if rlIsRHEL 5 6 ; then + PROCESS_CONTEXT="initrc_t" + else + PROCESS_CONTEXT="unconfined_service_t" + fi + fi + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /run /var" 0-255 + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd + rlJournalPrintText +rlJournalEnd + From 122599c15a40903a2bf61bcee2bb772a64fa3478 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Fri, 5 Mar 2021 11:23:26 +0100 Subject: [PATCH 045/626] add the cups-browsed test to upstream repo The cups-filters package is available in various versions of RHEL and Fedora. The cups-browsed service is also used in these environments, so it makes sense to run this TC in upstream testing too. Moving the downstream TC to upstream repository. There are only slight changes when comparing the upstream and downstream version of this TC. --- .../cups-browsed-and-similar/Makefile | 71 ++++++++++++++ .../cups-browsed-and-similar/PURPOSE | 5 + .../cups-browsed-and-similar/main.fmf | 3 + .../cups-browsed-and-similar/runtest.sh | 97 +++++++++++++++++++ 4 files changed, 176 insertions(+) create mode 100644 selinux-policy/cups-browsed-and-similar/Makefile create mode 100644 selinux-policy/cups-browsed-and-similar/PURPOSE create mode 100644 selinux-policy/cups-browsed-and-similar/main.fmf create mode 100755 selinux-policy/cups-browsed-and-similar/runtest.sh diff --git a/selinux-policy/cups-browsed-and-similar/Makefile b/selinux-policy/cups-browsed-and-similar/Makefile new file mode 100644 index 0000000..3986103 --- /dev/null +++ b/selinux-policy/cups-browsed-and-similar/Makefile @@ -0,0 +1,71 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/cups-browsed-and-similar +# Description: SELinux interferes with cups-browsed and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2021 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/cups-browsed-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with cups-browsed and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 15m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "RunFor: cups" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console cups-filters cups initscripts" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Releases: -RHEL4 -RHELServer5 -RHELClient5 -RHEL6" >> $(METADATA) + @echo "Bug: 1395801" >> $(METADATA) # Fedora 26 + @echo "Bug: 1401634" >> $(METADATA) # Fedora 26 + @echo "Bug: 1719754" >> $(METADATA) # RHEL-7 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/cups-browsed-and-similar/PURPOSE b/selinux-policy/cups-browsed-and-similar/PURPOSE new file mode 100644 index 0000000..91bc83d --- /dev/null +++ b/selinux-policy/cups-browsed-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/cups-browsed-and-similar +Author: Milos Malik + +SELinux interferes with cups-browsed and related programs. + diff --git a/selinux-policy/cups-browsed-and-similar/main.fmf b/selinux-policy/cups-browsed-and-similar/main.fmf new file mode 100644 index 0000000..6eda278 --- /dev/null +++ b/selinux-policy/cups-browsed-and-similar/main.fmf @@ -0,0 +1,3 @@ +path: /selinux-policy/cups-browsed-and-similar +tier: 2 + diff --git a/selinux-policy/cups-browsed-and-similar/runtest.sh b/selinux-policy/cups-browsed-and-similar/runtest.sh new file mode 100755 index 0000000..41bc812 --- /dev/null +++ b/selinux-policy/cups-browsed-and-similar/runtest.sh @@ -0,0 +1,97 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/cups-browsed-and-similar +# Description: SELinux interferes with cups-browsed and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2021 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +ROOT_PASSWORD="redhat" +FILE_PATH="/usr/sbin/cups-browsed" +FILE_CONTEXT="cupsd_exec_t" +SERVICE_PACKAGE="cups-filters" +SERVICE_NAME="cups-browsed" +PROCESS_NAME="cups-browsed" +PROCESS_CONTEXT="cupsd_t" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlFileBackup /etc/shadow + rlServiceStop ${SERVICE_NAME} + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "SELinux contexts and rules" + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + rlSESearchRule "allow initrc_t ${FILE_CONTEXT} : file { getattr open read execute }" + rlSESearchRule "allow initrc_t ${PROCESS_CONTEXT} : process { transition }" + rlSESearchRule "type_transition initrc_t ${FILE_CONTEXT} : process ${PROCESS_CONTEXT}" + rlPhaseEnd + + rlPhaseStartTest "bz#1395801 + bz#1401634 + bz#1719754" + rlSEMatchPathCon "/usr/sbin/cups-browsed" "cupsd_exec_t" + rlSEMatchPathCon "/tmp" "tmp_t" + rlSESearchRule "allow cupsd_t tmp_t : dir { write add_name } [ ]" + rlSESearchRule "type_transition cupsd_t tmp_t : lnk_file cupsd_tmp_t" + rlSESearchRule "allow cupsd_t cupsd_tmp_t : lnk_file { create unlink } [ ]" + rlPhaseEnd + + rlPhaseStartTest "real scenario" + rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + if rlIsRHEL 5 6 ; then + PROCESS_CONTEXT="initrc_t" + else + PROCESS_CONTEXT="unconfined_service_t" + fi + fi + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /run /var" + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + From 18f6387bc8aa6dc258f95d8e65190acc63110deb Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Fri, 5 Mar 2021 11:07:48 +0100 Subject: [PATCH 046/626] add the sslh test to upstream repo The sslh package is available in various versions of Fedora, so it makes sense to run this TC in upstream testing. Moving the downstream TC to upstream repository. There are only slight changes when comparing the upstream and downstream version of this TC. --- selinux-policy/sslh-and-similar/Makefile | 68 +++++++++++++ selinux-policy/sslh-and-similar/PURPOSE | 5 + selinux-policy/sslh-and-similar/main.fmf | 3 + selinux-policy/sslh-and-similar/runtest.sh | 107 +++++++++++++++++++++ 4 files changed, 183 insertions(+) create mode 100644 selinux-policy/sslh-and-similar/Makefile create mode 100644 selinux-policy/sslh-and-similar/PURPOSE create mode 100644 selinux-policy/sslh-and-similar/main.fmf create mode 100755 selinux-policy/sslh-and-similar/runtest.sh diff --git a/selinux-policy/sslh-and-similar/Makefile b/selinux-policy/sslh-and-similar/Makefile new file mode 100644 index 0000000..7a8ea3d --- /dev/null +++ b/selinux-policy/sslh-and-similar/Makefile @@ -0,0 +1,68 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/sslh-and-similar +# Description: SELinux interferes with sslh and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2021 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/sslh-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with sslh and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools setools-console sslh initscripts" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHELClient5 -RHELServer5 -RHEL6" >> $(METADATA) + @echo "Bug: 1534624" >> $(METADATA) # Fedora 27 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/sslh-and-similar/PURPOSE b/selinux-policy/sslh-and-similar/PURPOSE new file mode 100644 index 0000000..774a1be --- /dev/null +++ b/selinux-policy/sslh-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/sslh-and-similar +Author: Milos Malik + +SELinux interferes with sslh and related programs. + diff --git a/selinux-policy/sslh-and-similar/main.fmf b/selinux-policy/sslh-and-similar/main.fmf new file mode 100644 index 0000000..68fc1a3 --- /dev/null +++ b/selinux-policy/sslh-and-similar/main.fmf @@ -0,0 +1,3 @@ +path: /selinux-policy/sslh-and-similar +tier: 2 + diff --git a/selinux-policy/sslh-and-similar/runtest.sh b/selinux-policy/sslh-and-similar/runtest.sh new file mode 100755 index 0000000..e39975e --- /dev/null +++ b/selinux-policy/sslh-and-similar/runtest.sh @@ -0,0 +1,107 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/sslh-and-similar +# Description: SELinux interferes with sslh and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2021 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +ROOT_PASSWORD="redhat" +FILE_PATH="/usr/sbin/sslh" +FILE_CONTEXT="sslh_exec_t" +SERVICE_PACKAGE="sslh" +SERVICE_NAME="sslh" +PROCESS_NAME="sslh" +PROCESS_CONTEXT="sslh_t" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} + rlFileBackup /etc/shadow + rlFileBackup /etc/sslh.cfg + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + if rlSEDefined ${PROCESS_CONTEXT} ; then + rlPhaseStartTest "bz#1534624" + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + rlSEMatchPathCon "/var/lib/sss" "sssd_var_lib_t" + rlSEMatchPathCon "/var/lib/sss/mc" "sssd_public_t" + rlSEMatchPathCon "/var/lib/sss/mc/passwd" "sssd_public_t" + rlSEMatchPathCon "/var/lib/sss/pipes" "sssd_var_lib_t" + rlSEMatchPathCon "/var/lib/sss/pipes/nss" "sssd_var_lib_t" + if rlIsRHEL 5 ; then + SOURCE_TYPE="initrc_t" + BOOLEANS="[ ]" + elif rlIsRHEL 6 ; then + SOURCE_TYPE="initrc_t" + else # RHEL-7 etc. + SOURCE_TYPE="init_t" # systemd runs the process + fi + rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" + rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" + rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" + rlSESearchRule "allow sslh_t sssd_var_lib_t : dir { search }" + rlSESearchRule "allow sslh_t sssd_public_t : file { getattr open read map }" + rlSESearchRule "allow sslh_t sssd_var_lib_t : sock_file { write }" + rlSESearchRule "allow sslh_t sssd_t : unix_stream_socket { connectto }" + rlPhaseEnd + fi + + rlPhaseStartTest "real scenario -- standalone service" + rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" + rlRun "sed -i 's/thelonious/localhost/' /etc/sslh.cfg" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + # RHEL-4, RHEL-5, RHEL-6 are excluded + PROCESS_CONTEXT="unconfined_service_t" + fi + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /run /var" + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + From fa8b441345d26d7d01a3c74c3ed1484df9abf489 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Mon, 22 Feb 2021 10:47:31 +0100 Subject: [PATCH 047/626] add the policykit test to upstream repo The polkit component is used in various versions of RHEL and Fedora, so it makes sense to run this TC in upstream testing too. There are no changes in the TC functionality. Moving the downstream TC to upstream repository. --- selinux-policy/policykit-general/Makefile | 77 +++++++++ selinux-policy/policykit-general/PURPOSE | 5 + selinux-policy/policykit-general/runtest.sh | 175 ++++++++++++++++++++ selinux-policy/policykit-general/ssh.exp | 20 +++ 4 files changed, 277 insertions(+) create mode 100644 selinux-policy/policykit-general/Makefile create mode 100644 selinux-policy/policykit-general/PURPOSE create mode 100755 selinux-policy/policykit-general/runtest.sh create mode 100644 selinux-policy/policykit-general/ssh.exp diff --git a/selinux-policy/policykit-general/Makefile b/selinux-policy/policykit-general/Makefile new file mode 100644 index 0000000..0309190 --- /dev/null +++ b/selinux-policy/policykit-general/Makefile @@ -0,0 +1,77 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/policykit-general +# Description: Test for BZ#962791 (SELinux is preventing /usr/lib/polkit-1/polkitd) +# Author: Michal Trunecka +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2013 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/policykit-general +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE ssh.exp + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh ssh.exp + chcon -t bin_t runtest.sh ssh.exp + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Michal Trunecka " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: Test for BZ#962791 (SELinux is preventing /usr/lib/polkit-1/polkitd)" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 20m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "RunFor: polkit" >> $(METADATA) + @echo "Requires: audit selinux-policy polkit glib2 libselinux libselinux-utils policycoreutils setools-console psmisc shadow-utils expect openssh-clients" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5" >> $(METADATA) + @echo "Bug: 960669" >> $(METADATA) # RHEL-7 + @echo "Bug: 962791" >> $(METADATA) # RHEL-7 + @echo "Bug: 965143" >> $(METADATA) # RHEL-7 + @echo "Bug: 1003799" >> $(METADATA) # RHEL-6 + @echo "Bug: 1301561" >> $(METADATA) # RHEL-6 + @echo "Bug: 1364513" >> $(METADATA) # RHEL-7 + @echo "Bug: 1574389" >> $(METADATA) # RHEL-7 + @echo "Bug: 1583082" >> $(METADATA) # RHEL-7 + @echo "Bug: 1727902" >> $(METADATA) # RHEL-8 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/policykit-general/PURPOSE b/selinux-policy/policykit-general/PURPOSE new file mode 100644 index 0000000..98cfd05 --- /dev/null +++ b/selinux-policy/policykit-general/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/policykit-general +Author: Michal Trunecka + +SELinux interferes with polkitd and related programs. + diff --git a/selinux-policy/policykit-general/runtest.sh b/selinux-policy/policykit-general/runtest.sh new file mode 100755 index 0000000..867f2de --- /dev/null +++ b/selinux-policy/policykit-general/runtest.sh @@ -0,0 +1,175 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/policykit-general +# Description: Test for BZ#962791 (SELinux is preventing /usr/lib/polkit-1/polkitd) +# Author: Michal Trunecka +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2013 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +ROOT_PASSWORD="redhat" +SERVICE_NAME="polkit" +SERVICE_PACKAGE="polkit" +PROCESS_NAME="polkitd" +PROCESS_CONTEXT="policykit_t" +if rlIsRHEL 6 7 ; then + ALLOWED_USERS="staff_u user_u xguest_u sysadm_u unconfined_u" +else + ALLOWED_USERS="staff_u user_u guest_u xguest_u sysadm_u unconfined_u" +fi + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} + rlFileBackup /etc/shadow + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "bz#960669 + bz#962791 + bz#965143" + if rlIsRHEL 6 ; then + rlSEMatchPathCon "/usr/libexec/polkit-1/polkitd" "policykit_exec_t" + else + rlSEMatchPathCon "/usr/lib/polkit-1/polkitd" "policykit_exec_t" + rlSESearchRule "allow policykit_t cgroup_t : dir { open read getattr lock search ioctl }" + fi + rlSESearchRule "allow initrc_t policykit_exec_t : file { getattr open read execute }" + rlSESearchRule "type_transition initrc_t policykit_exec_t : process policykit_t" + rlSESearchRule "allow initrc_t policykit_t : process { transition }" + rlSESearchRule "allow system_dbusd_t policykit_exec_t : file { getattr open read execute }" + rlSESearchRule "type_transition system_dbusd_t policykit_exec_t : process policykit_t" + rlSESearchRule "allow system_dbusd_t policykit_t : process { transition }" + rlPhaseEnd + + rlPhaseStartTest "bz#1003799" + if rlIsRHEL 6 ; then + rlSEMatchPathCon "/usr/libexec/polkit-1/polkitd" "policykit_exec_t" + else + rlSEMatchPathCon "/usr/lib/polkit-1/polkitd" "policykit_exec_t" + fi + rlSEMatchPathCon "/var/lib/sss" "sssd_var_lib_t" + rlSEMatchPathCon "/var/lib/sss/mc" "sssd_public_t" + rlSEMatchPathCon "/var/lib/sss/mc/passwd" "sssd_public_t" + rlSESearchRule "allow policykit_t sssd_var_lib_t : dir { getattr open search }" + rlSESearchRule "allow policykit_t sssd_public_t : dir { getattr open search }" + rlSESearchRule "allow policykit_t sssd_public_t : file { getattr open read }" + rlSESearchRule "allow policykit_t sssd_var_lib_t : sock_file { getattr open write }" + rlSESearchRule "allow policykit_t sssd_t : unix_stream_socket { connectto }" + rlPhaseEnd + + if ! rlIsRHEL 5 ; then + rlPhaseStartTest "bz#1301561" + rlSEMatchPathCon "/usr/libexec/polkit-1/polkitd" "policykit_exec_t" + rlSESearchRule "allow policykit_t fs_t : filesystem { getattr }" + rlPhaseEnd + + rlPhaseStartTest "real scenario -- DBus service" + rlRun "killall polkitd" 0,1 + sleep 1 + DESTINATION="org.freedesktop.PolicyKit1" + rlRun "gdbus introspect --system --object-path / --dest ${DESTINATION} >& /dev/null" + sleep 1 + rlRun "ps -efZ | grep -v grep | grep ${PROCESS_NAME}" + rlRun "ps -efZ | grep -v grep | grep \"${PROCESS_CONTEXT}.*${PROCESS_NAME}\"" + rlPhaseEnd + fi + + if ! rlIsRHEL 5 6 ; then + rlPhaseStartTest "bz#1364513" + rlSESearchRule "allow dhcpc_t policykit_t : dbus { send_msg }" + rlSESearchRule "allow policykit_t dhcpc_t : dbus { send_msg }" + rlPhaseEnd + + rlPhaseStartTest "bz#1574389 + bz#1583082" + rlSEMatchPathCon "/usr/bin/pkla-check-authorization" "policykit_auth_exec_t" + rlSESearchRule "allow policykit_t policykit_auth_exec_t : file { map } [ ]" + rlPhaseEnd + fi + + if ! rlIsRHEL 5 6 7 ; then + rlPhaseStartTest "bz#1727902" + rlSEMatchPathCon "/run/dbus" "system_dbusd_var_run_t" + rlSEMatchPathCon "/run/dbus/system_bus_socket" "system_dbusd_var_run_t" + rlSESearchRule "allow guest_t system_dbusd_var_run_t : dir { search } [ ]" + rlSESearchRule "allow guest_t system_dbusd_var_run_t : sock_file { write } [ ]" + rlSESearchRule "allow guest_t system_dbusd_t : unix_stream_socket { connectto } [ ]" + rlSESearchRule "allow guest_t policykit_t : dbus { send_msg } [ ]" + rlSESearchRule "allow policykit_t guest_t : dbus { send_msg } [ ]" + rlSESearchRule "allow guest_t system_dbusd_t : dbus { send_msg } [ ]" + rlSESearchRule "allow system_dbusd_t guest_t : dbus { send_msg } [ ]" + rlPhaseEnd + fi + + if ! rlIsRHEL 5 6 ; then + rlPhaseStartTest "real scenario -- standalone service" + rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + if rlIsRHEL 5 6 ; then + PROCESS_CONTEXT="initrc_t" + else + PROCESS_CONTEXT="unconfined_service_t" + fi + fi + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /run /var" + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + + rlPhaseStartTest "real scenario -- confined users" + rlRun "setsebool ssh_sysadm_login on" + for SELINUX_USER in ${ALLOWED_USERS} ; do + USER_NAME="user${RANDOM}" + USER_SECRET="S3kr3t${RANDOM}" + rlRun "useradd -Z ${SELINUX_USER} ${USER_NAME}" + rlRun "echo ${USER_SECRET} | passwd --stdin ${USER_NAME}" + rlRun "restorecon -Rv /home/${USER_NAME}" + rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost pkaction" + rlRun "userdel -rfZ ${USER_NAME}" + done + rlRun "setsebool ssh_sysadm_login off" + rlPhaseEnd + fi + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/policykit-general/ssh.exp b/selinux-policy/policykit-general/ssh.exp new file mode 100644 index 0000000..1244013 --- /dev/null +++ b/selinux-policy/policykit-general/ssh.exp @@ -0,0 +1,20 @@ +#!/usr/bin/expect -f +# Expect script for SSH logging as $username to $hostname using $password and executing $command. +# Usage: +# ./ssh.exp username password hostname command +set username [lrange $argv 0 0] +set password [lrange $argv 1 1] +set hostname [lrange $argv 2 2] +set command [lrange $argv 3 10] +set timeout 15 +# connect to remote host and execute given command +log_user 1 +spawn ssh -t $username@$hostname "$command ; sleep 5" +expect { + -nocase "yes/no" { send -- "yes\r" ; exp_continue } + -nocase "password" { send -- "$password\r" } +} +log_user 1 +# send -- "\r" +expect eof + From 2f3961e36d3b6fea9306d6092862bad04dd261c5 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Fri, 19 Feb 2021 19:36:53 +0100 Subject: [PATCH 048/626] add the acpid test to upstream repo The acpid component is used in various versions of RHEL and Fedora, so it makes sense to run this TC in upstream testing too. Moving the downstream TC to upstream repository. There are slight changes in the TC functionality when comparing the downstream and the upstream version. --- selinux-policy/acpid-and-similar/Makefile | 74 ++++++++++++ selinux-policy/acpid-and-similar/PURPOSE | 5 + selinux-policy/acpid-and-similar/main.fmf | 2 + selinux-policy/acpid-and-similar/runtest.sh | 125 ++++++++++++++++++++ 4 files changed, 206 insertions(+) create mode 100644 selinux-policy/acpid-and-similar/Makefile create mode 100644 selinux-policy/acpid-and-similar/PURPOSE create mode 100644 selinux-policy/acpid-and-similar/main.fmf create mode 100755 selinux-policy/acpid-and-similar/runtest.sh diff --git a/selinux-policy/acpid-and-similar/Makefile b/selinux-policy/acpid-and-similar/Makefile new file mode 100644 index 0000000..3803c53 --- /dev/null +++ b/selinux-policy/acpid-and-similar/Makefile @@ -0,0 +1,74 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/acpid-and-similar +# Description: SELinux interferes with acpid and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/acpid-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with acpid and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 30m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "RunFor: acpid" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools setools-console acpid initscripts" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Releases: -RHEL4" >> $(METADATA) + @echo "Architectures: i386 x86_64" >> $(METADATA) + @echo "Bug: 995898" >> $(METADATA) # RHEL-7 + @echo "Bug: 1358478" >> $(METADATA) # RHEL-7 + @echo "Bug: 1468548" >> $(METADATA) # RHEL-7 + @echo "Bug: 1622417" >> $(METADATA) # RHEL-7 + @echo "Bug: 1623342" >> $(METADATA) # RHEL-7 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/acpid-and-similar/PURPOSE b/selinux-policy/acpid-and-similar/PURPOSE new file mode 100644 index 0000000..e4b9ffe --- /dev/null +++ b/selinux-policy/acpid-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/acpid-and-similar +Author: Milos Malik + +SELinux interferes with acpid and related programs + diff --git a/selinux-policy/acpid-and-similar/main.fmf b/selinux-policy/acpid-and-similar/main.fmf new file mode 100644 index 0000000..4d7c29e --- /dev/null +++ b/selinux-policy/acpid-and-similar/main.fmf @@ -0,0 +1,2 @@ +path: /selinux-policy/acpid-and-similar +tier: 2 diff --git a/selinux-policy/acpid-and-similar/runtest.sh b/selinux-policy/acpid-and-similar/runtest.sh new file mode 100755 index 0000000..bad833b --- /dev/null +++ b/selinux-policy/acpid-and-similar/runtest.sh @@ -0,0 +1,125 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/acpid-and-similar +# Description: SELinux interferes with acpid and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +ROOT_PASSWORD="redhat" +FILE_PATH="/usr/sbin/acpid" +FILE_CONTEXT="apmd_exec_t" +SERVICE_PACKAGE="acpid" +SERVICE_NAME="acpid" +PROCESS_NAME="acpid" +PROCESS_CONTEXT="apmd_t" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} + rlFileBackup /etc/shadow + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "SELinux contexts and rules" + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + rlSESearchRule "allow initrc_t ${FILE_CONTEXT} : file { getattr open read execute }" + rlSESearchRule "allow initrc_t ${PROCESS_CONTEXT} : process { transition }" + rlSESearchRule "type_transition initrc_t ${FILE_CONTEXT} : process ${PROCESS_CONTEXT}" + rlPhaseEnd + + if ! rlIsRHEL 5 6 ; then + rlPhaseStartTest "bz#995898" + rlSEMatchPathCon "/usr/sbin/acpid" "apmd_exec_t" + rlSEMatchPathCon "/usr/lib/systemd/system/poweroff.target" "power_unit_file_t" + rlSESearchRule "allow apmd_t init_t : dbus { send_msg }" + rlSESearchRule "allow init_t apmd_t : dbus { send_msg }" + rlSESearchRule "allow apmd_t power_unit_file_t : service { start }" + rlPhaseEnd + + rlPhaseStartTest "bz#1358478 + bz#1468548" + rlSEMatchPathCon "/usr/sbin/acpid" "apmd_exec_t" + rlSESearchRule "allow apmd_t apmd_t : netlink_generic_socket { create setopt bind } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1622417 + bz#1623342" + rlSEMatchPathCon "/usr/sbin/acpid" "apmd_exec_t" + rlSEMatchPathCon "/dev/input/event20" "event_device_t" + rlSEMatchPathCon "/dev/input/event21" "event_device_t" + rlSEMatchPathCon "/dev/input/event22" "event_device_t" + rlSEMatchPathCon "/dev/input/event23" "event_device_t" + rlSEMatchPathCon "/dev/input/event24" "event_device_t" + rlSEMatchPathCon "/dev/input/event25" "event_device_t" + rlSEMatchPathCon "/dev/input/event26" "event_device_t" + rlSEMatchPathCon "/dev/input/event27" "event_device_t" + rlSEMatchPathCon "/dev/input/event28" "event_device_t" + rlSEMatchPathCon "/dev/input/event29" "event_device_t" + rlSEMatchPathCon "/dev/input/event30" "event_device_t" + rlSESearchRule "allow apmd_t event_device_t : chr_file { getattr open read } [ ]" + for I in `seq 20 1 30` ; do + rlRun "sesearch -T -s init_t -t device_t -c chr_file | grep \"event_device_t.*event$I\"" + rlRun "sesearch -T -s kernel_t -t device_t -c chr_file | grep \"event_device_t.*event$I\"" + rlRun "sesearch -T -s udev_t -t device_t -c chr_file | grep \"event_device_t.*event$I\"" + done + rlPhaseEnd + fi + + rlPhaseStartTest "real scenario" + rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + if rlIsRHEL 5 6 ; then + PROCESS_CONTEXT="initrc_t" + else + PROCESS_CONTEXT="unconfined_service_t" + fi + fi + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /var /run" + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + From 2bb9a41b7ea4dce49a72a3316a97c8615d29106b Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Fri, 5 Mar 2021 12:57:52 +0100 Subject: [PATCH 049/626] add the cups-lpd test to upstream repo The cups-lpd package is available in various versions of RHEL and Fedora. The cups-lpd service is also used in these environments, so it makes sense to run this TC in upstream testing too. Moving the downstream TC to upstream repository. There are only slight changes when comparing the upstream and downstream version of this TC. --- selinux-policy/cups-lpd-and-similar/Makefile | 71 +++++++++ selinux-policy/cups-lpd-and-similar/PURPOSE | 5 + selinux-policy/cups-lpd-and-similar/main.fmf | 3 + .../cups-lpd-and-similar/runtest.sh | 146 ++++++++++++++++++ 4 files changed, 225 insertions(+) create mode 100644 selinux-policy/cups-lpd-and-similar/Makefile create mode 100644 selinux-policy/cups-lpd-and-similar/PURPOSE create mode 100644 selinux-policy/cups-lpd-and-similar/main.fmf create mode 100755 selinux-policy/cups-lpd-and-similar/runtest.sh diff --git a/selinux-policy/cups-lpd-and-similar/Makefile b/selinux-policy/cups-lpd-and-similar/Makefile new file mode 100644 index 0000000..dcbcdc2 --- /dev/null +++ b/selinux-policy/cups-lpd-and-similar/Makefile @@ -0,0 +1,71 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/cups-lpd-and-similar +# Description: SELinux interferes with cups-lpd and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2021 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/cups-lpd-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with cups-lpd and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 20m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "RunFor: cups" >> $(METADATA) + @echo "Requires: audit expect policycoreutils-python-utils selinux-policy-devel libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools setools-console xinetd nmap-ncat nc net-tools cups-lpd chkconfig initscripts" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Releases: -RHEL4" >> $(METADATA) + @echo "Bug: 1004198" >> $(METADATA) # RHEL-7 + @echo "Bug: 1554118" >> $(METADATA) # RHEL-8 + @echo "Bug: 1919399" >> $(METADATA) # RHEL-8 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/cups-lpd-and-similar/PURPOSE b/selinux-policy/cups-lpd-and-similar/PURPOSE new file mode 100644 index 0000000..4bf0246 --- /dev/null +++ b/selinux-policy/cups-lpd-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/cups-lpd-and-similar +Author: Milos Malik + +SELinux interferes with cups-lpd and related programs. + diff --git a/selinux-policy/cups-lpd-and-similar/main.fmf b/selinux-policy/cups-lpd-and-similar/main.fmf new file mode 100644 index 0000000..c9e7c44 --- /dev/null +++ b/selinux-policy/cups-lpd-and-similar/main.fmf @@ -0,0 +1,3 @@ +path: /selinux-policy/cups-lpd-and-similar +tier: 2 + diff --git a/selinux-policy/cups-lpd-and-similar/runtest.sh b/selinux-policy/cups-lpd-and-similar/runtest.sh new file mode 100755 index 0000000..e9e01a5 --- /dev/null +++ b/selinux-policy/cups-lpd-and-similar/runtest.sh @@ -0,0 +1,146 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/cups-lpd-and-similar +# Description: SELinux interferes with cups-lpd and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2021 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +ROOT_PASSWORD="redhat" +FILE_PATH="/usr/lib/cups/daemon/cups-lpd" +FILE_CONTEXT="cupsd_lpd_exec_t" +SERVICE_PACKAGE="cups-lpd" +SERVICE_NAME="cups-lpd" +PROCESS_NAME="cups-lpd" +PROCESS_CONTEXT="cupsd_lpd_t" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" + # rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + if rlIsRHEL 5 6 ; then + rlServiceStop ${SERVICE_NAME} + else + rlSocketStop ${SERVICE_NAME} + fi + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "bz#1004198" + if rlIsRHEL 5 ; then + SOURCE_TYPE="inetd_t" # xinetd runs the process + BOOLEANS="[ cupsd_lpd_disable_trans ]" + elif rlIsRHEL 6 ; then + SOURCE_TYPE="inetd_t" # xinetd runs the process + else # RHEL-7 etc. + SOURCE_TYPE="init_t" # systemd runs the process + fi + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + rlSEMatchPortCon "tcp" "515" "printer_port_t" + rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute }" + rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } ${BOOLEANS}" + rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} ${BOOLEANS}" + if ! rlIsRHEL 5 6 ; then + rlSESearchRule "allow ${PROCESS_CONTEXT} printer_port_t : tcp_socket { name_bind }" + fi + rlPhaseEnd + + rlPhaseStartTest "bz#1554118" + rlSEMatchPathCon "/usr/lib/cups/daemon/cups-lpd" "cupsd_lpd_exec_t" + rlSESearchRule "allow init_t cupsd_lpd_t : tcp_socket { create setopt bind listen }" + rlPhaseEnd + + rlPhaseStartTest "bz#1919399" + rlSEMatchPathCon "/usr/lib/cups/daemon/cups-lpd" "cupsd_lpd_exec_t" + rlSEMatchPathCon "/run/cups/cups.sock" "cupsd_var_run_t" + rlSESearchRule "allow cupsd_lpd_t cupsd_var_run_t : sock_file { read } [ ]" + rlPhaseEnd + + rlPhaseStartTest "real scenario -- BZ#1919399" + rlRun "systemctl start cups.service" + rlRun "systemctl enable cups-lpd.socket" + rlRun "systemctl start cups-lpd.socket" + rlRun "lpadmin -p test -E" + rlRun "DEVICE_URI=lpd://127.0.0.1/test /usr/lib/cups/backend/lpd 1 user test 1 '' /etc/fstab" + sleep 5 + rlRun "systemctl stop cups-lpd.socket" + rlRun "systemctl disable cups-lpd.socket" + rlRun "systemctl stop cups.service" + rlPhaseEnd + + rlPhaseStartTest "real scenario -- xinetd service" + HOST_ADDRESS="127.0.0.1" # IP address or nothing + PORT_NUMBER="515" # number or socket path + PORT_TYPE="" # default is TCP, otherwise use -u (UDP) or --sctp (SCTP) + if rlIsRHEL 5 6 ; then + rlRun "chkconfig ${SERVICE_NAME} on" + rlRun "service xinetd restart" + rlLog "starting provocateur job" + ( tail -f - | nc ${PORT_TYPE} ${HOST_ADDRESS} ${PORT_NUMBER} ) & + PROVOCATEUR_PID=$! + else + rlRun "systemctl enable ${SERVICE_NAME}.socket" + rlRun "systemctl start ${SERVICE_NAME}.socket" + rlLog "starting provocateur job" + ( tail -f - | ncat ${PORT_TYPE} ${HOST_ADDRESS} ${PORT_NUMBER} ) & + PROVOCATEUR_PID=$! + fi + sleep 1 + rlRun "netstat -tupan | grep :${PORT_NUMBER}" + rlRun "ps -o pid,user,context,args -C ${PROCESS_NAME}" + rlRun "ps -o pid,user,context,args -C ${PROCESS_NAME} | grep :${PROCESS_CONTEXT}" + rlRun "kill ${PROVOCATEUR_PID}" + if rlIsRHEL 5 6 ; then + rlRun "chkconfig ${SERVICE_NAME} off" + rlRun "service xinetd stop" + else + rlRun "systemctl stop ${SERVICE_NAME}.socket" + rlRun "systemctl disable ${SERVICE_NAME}.socket" + fi + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + if rlIsRHEL 5 6 ; then + rlServiceRestore ${SERVICE_NAME} + else + rlSocketRestore ${SERVICE_NAME} + fi + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + From 71a4371e20c6edfe596b3ddf43849b3587eae8d3 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Thu, 4 Mar 2021 16:35:42 +0100 Subject: [PATCH 050/626] add the accounts-daemon test to upstream repo The accountsservice package is available in various versions of RHEL and Fedora. The accounts-daemon service is also used in these environments, so it makes sense to run this TC in upstream testing too. Moving the downstream TC to upstream repository. There are only slight changes when comparing the upstream and downstream version of this TC. --- .../accounts-daemon-and-similar/Makefile | 85 ++++++++++ .../accounts-daemon-and-similar/PURPOSE | 5 + .../accounts-daemon-and-similar/main.fmf | 3 + .../accounts-daemon-and-similar/runtest.sh | 149 ++++++++++++++++++ 4 files changed, 242 insertions(+) create mode 100644 selinux-policy/accounts-daemon-and-similar/Makefile create mode 100644 selinux-policy/accounts-daemon-and-similar/PURPOSE create mode 100644 selinux-policy/accounts-daemon-and-similar/main.fmf create mode 100755 selinux-policy/accounts-daemon-and-similar/runtest.sh diff --git a/selinux-policy/accounts-daemon-and-similar/Makefile b/selinux-policy/accounts-daemon-and-similar/Makefile new file mode 100644 index 0000000..1923789 --- /dev/null +++ b/selinux-policy/accounts-daemon-and-similar/Makefile @@ -0,0 +1,85 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/accounts-daemon-and-similar +# Description: SELinux interferes with accounts daemon and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/accounts-daemon-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with accounts daemon and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: accountsservice" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console accountsservice glib2 procps-ng realmd initscripts" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Releases: -RHEL4 -RHELServer5 -RHELClient5 -RHEL6" >> $(METADATA) + @echo "Bug: 1456760" >> $(METADATA) # RHEL-7 + @echo "Bug: 1507089" >> $(METADATA) # RHEL-7 + @echo "Bug: 1518211" >> $(METADATA) # RHEL-7 + @echo "Bug: 1595667" >> $(METADATA) # RHEL-7 + @echo "Bug: 1792895" >> $(METADATA) # RHEL-8 + @echo "Bug: 1806126" >> $(METADATA) # Fedora 32 + @echo "Bug: 1811407" >> $(METADATA) # Fedora 32 + @echo "Bug: 1815312" >> $(METADATA) # Fedora 32 + @echo "Bug: 1818696" >> $(METADATA) # Fedora 32 + @echo "Bug: 1819040" >> $(METADATA) # Fedora 32 + @echo "Bug: 1820978" >> $(METADATA) # Fedora 32 + @echo "Bug: 1820992" >> $(METADATA) # Fedora 32 + @echo "Bug: 1821156" >> $(METADATA) # RHEL-8 + @echo "Bug: 1828809" >> $(METADATA) # RHEL-8 + @echo "Bug: 1829013" >> $(METADATA) # Fedora 32 + @echo "Bug: 1829075" >> $(METADATA) # Fedora 32 + @echo "Bug: 1829128" >> $(METADATA) # Fedora 32 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/accounts-daemon-and-similar/PURPOSE b/selinux-policy/accounts-daemon-and-similar/PURPOSE new file mode 100644 index 0000000..24bd6f7 --- /dev/null +++ b/selinux-policy/accounts-daemon-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/accounts-daemon-and-similar +Author: Milos Malik + +SELinux interferes with accounts daemon and related programs. + diff --git a/selinux-policy/accounts-daemon-and-similar/main.fmf b/selinux-policy/accounts-daemon-and-similar/main.fmf new file mode 100644 index 0000000..18f5328 --- /dev/null +++ b/selinux-policy/accounts-daemon-and-similar/main.fmf @@ -0,0 +1,3 @@ +path: /selinux-policy/accounts-daemon-and-similar +tier: 2 + diff --git a/selinux-policy/accounts-daemon-and-similar/runtest.sh b/selinux-policy/accounts-daemon-and-similar/runtest.sh new file mode 100755 index 0000000..e173541 --- /dev/null +++ b/selinux-policy/accounts-daemon-and-similar/runtest.sh @@ -0,0 +1,149 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/accounts-daemon-and-similar +# Description: SELinux interferes with accounts daemon and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +ROOT_PASSWORD="redhat" +FILE_PATH="/usr/libexec/accounts-daemon" +FILE_CONTEXT="accountsd_exec_t" +SERVICE_PACKAGE="accountsservice" +SERVICE_NAME="accounts-daemon" +PROCESS_NAME="accounts-daemon" +PROCESS_CONTEXT="accountsd_t" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} + rlFileBackup /etc/shadow + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "SELinux contexts and rules" + if rlIsRHEL 5 ; then + SOURCE_TYPE="initrc_t" + BOOLEANS="[ ]" # a boolean name + elif rlIsRHEL 6 ; then + SOURCE_TYPE="initrc_t" + else # RHEL-7 etc. + SOURCE_TYPE="init_t" # systemd runs the process + fi + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute }" + rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition }" + rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT}" + rlPhaseEnd + + rlPhaseStartTest "bz#1456760 + bz#1518211" + rlSEMatchPathCon "/usr/libexec/accounts-daemon" "accountsd_exec_t" + rlSEMatchPathCon "/root" "admin_home_t" + rlSESearchRule "dontaudit accountsd_t admin_home_t : dir { write } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1507089" + rlSEMatchPathCon "/usr/libexec/accounts-daemon" "accountsd_exec_t" + rlSESearchRule "allow accountsd_t accountsd_t : capability { dac_read_search } [ ]" + rlPhaseEnd + + if ! rlIsRHEL 5 6 ; then + rlPhaseStartTest "bz#1595667" + rlSEMatchPathCon "/usr/sbin/useradd" "useradd_exec_t" + rlSESearchRule "allow accountsd_t useradd_exec_t : file { map } [ ]" + rlPhaseEnd + fi + + if ! rlIsRHEL 5 6 7 ; then + rlPhaseStartTest "bz#1792895 + bz#1821156" + rlSESearchRule "allow accountsd_t realmd_t : dbus { send_msg } [ ]" + rlSESearchRule "allow realmd_t accountsd_t : dbus { send_msg } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1828809" + for USER_TYPE in user_t staff_t sysadm_t xguest_t unconfined_t ; do + rlSESearchRule "allow ${USER_TYPE} accountsd_t : dbus { send_msg } [ ]" + rlSESearchRule "allow accountsd_t ${USER_TYPE} : dbus { send_msg } [ ]" + done + rlPhaseEnd + fi + + if ! rlIsRHEL 5 ; then + rlPhaseStartTest "real scenario -- DBus service" + DESTINATION="org.freedesktop.Accounts" + rlRun "gdbus introspect --system --object-path / --dest ${DESTINATION} >& /dev/null" + sleep 1 + rlRun "ps -efZ | grep -v grep | grep ${PROCESS_NAME}" + rlRun "ps -efZ | grep -v grep | grep \"${PROCESS_CONTEXT}.*${PROCESS_NAME}\"" + rlPhaseEnd + fi + + if rlIsFedora ; then + rlPhaseStartTest "bz#1806126, bz#1811407, bz#1815312, bz#1818696, bz#1819040, bz#1820978, bz#1820992, bz#1829013, bz#1829075, bz#1829128" + rlSEMatchPathCon "/usr/libexec/accounts-daemon" "accountsd_exec_t" + rlSESearchRule "dontaudit accountsd_t accountsd_t : capability { sys_nice } [ daemons_dontaudit_scheduling ]" + rlPhaseEnd + fi + + rlPhaseStartTest "real scenario" + rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + if rlIsRHEL 5 6 ; then + PROCESS_CONTEXT="initrc_t" + else + PROCESS_CONTEXT="unconfined_service_t" + fi + fi + rlRun "mkdir -p /etc/gdm" + rlRun "restorecon -Rv /etc" + rlRun "service realmd start" # helps to reproduce BZ#1792895 + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /run /var" 0-255 + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + From 69871d74cc78569e129c2f4b83fc0b06c2984a10 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Wed, 24 Feb 2021 18:52:45 +0100 Subject: [PATCH 051/626] test if fapolicyd can watch* various mount points Recent testing of fapolicyd with the latest SELinux policy, which introduced various watch* permission, revealed that SELinux prevents the fapolicyd from using fanotify_mark syscall on various mount points like /dev/shm, /boot etc. The TC reproduces the situation and it also looks for appropriate policy rules. I believe these actions should be allowed, because they are expected from the fapolicyd process. The TC covers BZ#1932225. --- selinux-policy/fapolicyd-and-similar/Makefile | 1 + selinux-policy/fapolicyd-and-similar/runtest.sh | 15 +++++++++++++++ 2 files changed, 16 insertions(+) diff --git a/selinux-policy/fapolicyd-and-similar/Makefile b/selinux-policy/fapolicyd-and-similar/Makefile index 5ceb8a2..cdfcfed 100644 --- a/selinux-policy/fapolicyd-and-similar/Makefile +++ b/selinux-policy/fapolicyd-and-similar/Makefile @@ -66,6 +66,7 @@ $(METADATA): Makefile @echo "Bug: 1865818" >> $(METADATA) # RHEL-8 @echo "Bug: 1874491" >> $(METADATA) # Fedora 33 @echo "Bug: 1876538" >> $(METADATA) # Fedora 33 + @echo "Bug: 1932225" >> $(METADATA) rhts-lint $(METADATA) diff --git a/selinux-policy/fapolicyd-and-similar/runtest.sh b/selinux-policy/fapolicyd-and-similar/runtest.sh index 720f008..6709ce5 100755 --- a/selinux-policy/fapolicyd-and-similar/runtest.sh +++ b/selinux-policy/fapolicyd-and-similar/runtest.sh @@ -88,6 +88,21 @@ rlJournalStart rlSESearchRule "allow fapolicyd_t rpm_var_lib_t : file { create } [ ]" rlPhaseEnd + if seinfo --common file -x | grep -q watch ; then + rlPhaseStartTest "bz#1932225" + rlSEMatchPathCon "/boot" "boot_t" + rlSEMatchPathCon "/" "root_t" + rlSEMatchPathCon "/dev/shm" "tmpfs_t" + rlSEMatchPathCon "/tmp" "tmp_t" + rlSEMatchPathCon "/run/user/0" "user_tmp_t" + rlSESearchRule "allow fapolicyd_t boot_t : dir { watch_mount watch_with_perm } [ ]" + rlSESearchRule "allow fapolicyd_t root_t : dir { watch_mount watch_with_perm } [ ]" + rlSESearchRule "allow fapolicyd_t tmpfs_t : dir { watch_mount watch_with_perm } [ ]" + rlSESearchRule "allow fapolicyd_t tmp_t : dir { watch_mount watch_with_perm } [ ]" + rlSESearchRule "allow fapolicyd_t user_tmp_t : dir { watch_mount watch_with_perm } [ ]" + rlPhaseEnd + fi + rlPhaseStartTest "real scenario -- standalone service" rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" if ! rlSEDefined ${PROCESS_CONTEXT} ; then From eb78c1e3eb76eb56bb06347b90dc68f59671fc2d Mon Sep 17 00:00:00 2001 From: Zdenek Pytela Date: Thu, 13 May 2021 21:24:47 +0200 Subject: [PATCH 052/626] Remove all references to anon_inodefs_t Since kernel commit 3836a03d978e ("anon_inodes: mark the anon inode private") - i.e. for over 10 years ago (!) - anon_inodefs inodes are no longer exposed to LSMs so all rules containing reference to the anon_inodefs_t type were removed from selinux-policy. --- selinux-policy/kerberos-and-similar/runtest.sh | 4 ---- 1 file changed, 4 deletions(-) diff --git a/selinux-policy/kerberos-and-similar/runtest.sh b/selinux-policy/kerberos-and-similar/runtest.sh index 79acf20..60a9c1a 100755 --- a/selinux-policy/kerberos-and-similar/runtest.sh +++ b/selinux-policy/kerberos-and-similar/runtest.sh @@ -67,10 +67,6 @@ rlJournalStart rlPhaseStartTest "bz#860666" rlSEMatchPathCon "/usr/sbin/krb5kdc" "krb5kdc_exec_t" rlSEMatchPathCon "/usr/sbin/kadmind" "kadmind_exec_t" - rlSESearchRule "allow krb5kdc_t anon_inodefs_t : file { getattr read write }" - rlSESearchRule "allow krb5kdc_t anon_inodefs_t : dir { getattr search }" - rlSESearchRule "allow kadmind_t anon_inodefs_t : file { getattr read write }" - rlSESearchRule "allow kadmind_t anon_inodefs_t : dir { getattr search }" rlPhaseEnd if ! rlIsRHEL 5 6 ; then From 0fdeb90e08016e6e68ccf7edadf6a7f924c3522c Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Fri, 21 May 2021 15:42:39 +0200 Subject: [PATCH 053/626] configure sshd to allow password auth for users Several TCs rely on the fact that tested users can login via SSH using a password, but this option is disabled by default. If the TCs should succeed the option must be enabled at least temporarily, which is done in this change. --- selinux-policy/Library/common/lib.sh | 7 +++++++ selinux-policy/boltd-and-similar/runtest.sh | 5 +---- selinux-policy/bz481628-send-msg-to-dbus/runtest.sh | 5 +++++ selinux-policy/colord-and-similar/runtest.sh | 5 +---- selinux-policy/cups-pdf-and-similar/runtest.sh | 3 +++ selinux-policy/dmidecode-and-similar/runtest.sh | 5 +---- selinux-policy/fwupd-and-similar/runtest.sh | 5 +---- selinux-policy/journalctl-and-similar/runtest.sh | 5 +---- selinux-policy/pam_console-and-related/runtest.sh | 3 +++ selinux-policy/pam_timestamp-and-related/runtest.sh | 4 ++++ selinux-policy/perf_event-and-related/runtest.sh | 7 ++----- selinux-policy/ping-and-similar/runtest.sh | 3 +++ selinux-policy/policykit-general/runtest.sh | 3 +++ selinux-policy/systemd-userdbd-and-similar/runtest.sh | 3 +++ 14 files changed, 38 insertions(+), 25 deletions(-) diff --git a/selinux-policy/Library/common/lib.sh b/selinux-policy/Library/common/lib.sh index 21bd0bb..149e1a2 100644 --- a/selinux-policy/Library/common/lib.sh +++ b/selinux-policy/Library/common/lib.sh @@ -1285,6 +1285,13 @@ function rlSERunWithContext() { } +function rlSEConfigureSSH () { + rlFileBackup /etc/ssh/sshd_config + rlRun "sed -i 's/^.*PermitRootLogin.*$/PermitRootLogin yes/' /etc/ssh/sshd_config" + rlRun "sed -i 's/^.*PasswordAuthentication.*$/PasswordAuthentication yes/' /etc/ssh/sshd_config" + rlRun "service sshd restart" +} + true <<'=cut' =pod diff --git a/selinux-policy/boltd-and-similar/runtest.sh b/selinux-policy/boltd-and-similar/runtest.sh index bd26c50..73c0ae6 100755 --- a/selinux-policy/boltd-and-similar/runtest.sh +++ b/selinux-policy/boltd-and-similar/runtest.sh @@ -132,10 +132,7 @@ rlJournalStart rlPhaseEnd rlPhaseStartTest "real scenario -- confined users" - rlFileBackup /etc/ssh/sshd_config - rlRun "sed -i 's/^.*PermitRootLogin.*$/PermitRootLogin yes/' /etc/ssh/sshd_config" - rlRun "sed -i 's/^.*PasswordAuthentication.*$/PasswordAuthentication yes/' /etc/ssh/sshd_config" - rlRun "service sshd restart" + rlSEConfigureSSH rlRun "setsebool ssh_sysadm_login on" rlLog "configuration says not to test SELinux users: ${DENIED_USERS}" diff --git a/selinux-policy/bz481628-send-msg-to-dbus/runtest.sh b/selinux-policy/bz481628-send-msg-to-dbus/runtest.sh index 97c4f41..c0bdbd9 100755 --- a/selinux-policy/bz481628-send-msg-to-dbus/runtest.sh +++ b/selinux-policy/bz481628-send-msg-to-dbus/runtest.sh @@ -130,6 +130,8 @@ rlJournalStart rlPhaseEnd rlPhaseStartTest "real scenario -- user session service" + rlSEConfigureSSH + rlRun "setsebool ssh_sysadm_login on" rlRun "setsebool selinuxuser_tcp_server on" # TODO: guest_u, xguest_u cannot successfully run systemctl @@ -161,6 +163,9 @@ rlJournalStart sleep 2 rlSECheckAVC rm -f files.txt + + rlFileRestore + rlRun "service sshd restart" rlPhaseEnd rlJournalPrintText rlJournalEnd diff --git a/selinux-policy/colord-and-similar/runtest.sh b/selinux-policy/colord-and-similar/runtest.sh index b385f8c..552a1bd 100755 --- a/selinux-policy/colord-and-similar/runtest.sh +++ b/selinux-policy/colord-and-similar/runtest.sh @@ -74,10 +74,7 @@ rlJournalStart if ! rlIsRHEL 5 6 7 ; then rlPhaseStartTest "real scenario -- user session service" - rlFileBackup /etc/ssh/sshd_config - rlRun "sed -i 's/^.*PermitRootLogin.*$/PermitRootLogin yes/' /etc/ssh/sshd_config" - rlRun "sed -i 's/^.*PasswordAuthentication.*$/PasswordAuthentication yes/' /etc/ssh/sshd_config" - rlRun "service sshd restart" + rlSEConfigureSSH rlRun "setsebool ssh_sysadm_login on" rlLog "configuration says not to test SELinux users: ${DENIED_USERS}" diff --git a/selinux-policy/cups-pdf-and-similar/runtest.sh b/selinux-policy/cups-pdf-and-similar/runtest.sh index 328ad07..9636625 100755 --- a/selinux-policy/cups-pdf-and-similar/runtest.sh +++ b/selinux-policy/cups-pdf-and-similar/runtest.sh @@ -108,6 +108,8 @@ rlJournalStart rlPhaseEnd rlPhaseStartTest "real scenario -- confined users" + rlSEConfigureSSH + rlRun "lpadmin -x cups-pdf" 0-255 rlRun "lpadmin -p cups-pdf -v cups-pdf:/ -E -P /usr/share/cups/model/CUPS-PDF_opt.ppd" rlRun "setsebool ssh_sysadm_login on" @@ -136,6 +138,7 @@ rlJournalStart rlFileRestore rlServiceRestore ${SERVICE_NAME} + rlRun "service sshd restart" rlPhaseEnd rlJournalPrintText rlJournalEnd diff --git a/selinux-policy/dmidecode-and-similar/runtest.sh b/selinux-policy/dmidecode-and-similar/runtest.sh index 0defe7a..c488c8f 100755 --- a/selinux-policy/dmidecode-and-similar/runtest.sh +++ b/selinux-policy/dmidecode-and-similar/runtest.sh @@ -109,10 +109,7 @@ rlJournalStart rlPhaseEnd rlPhaseStartTest "real scenario -- confined users" - rlFileBackup /etc/ssh/sshd_config - rlRun "sed -i 's/^.*PermitRootLogin.*$/PermitRootLogin yes/' /etc/ssh/sshd_config" - rlRun "sed -i 's/^.*PasswordAuthentication.*$/PasswordAuthentication yes/' /etc/ssh/sshd_config" - rlRun "service sshd restart" + rlSEConfigureSSH rlRun "setsebool ssh_sysadm_login on" rlLog "configuration says not to test SELinux users: ${DENIED_USERS}" diff --git a/selinux-policy/fwupd-and-similar/runtest.sh b/selinux-policy/fwupd-and-similar/runtest.sh index 4a49c73..e7f5b3f 100755 --- a/selinux-policy/fwupd-and-similar/runtest.sh +++ b/selinux-policy/fwupd-and-similar/runtest.sh @@ -155,10 +155,7 @@ rlJournalStart fi rlPhaseStartTest "real scenario -- confined users -- bz#1772619" - rlFileBackup /etc/ssh/sshd_config - rlRun "sed -i 's/^.*PermitRootLogin.*$/PermitRootLogin yes/' /etc/ssh/sshd_config" - rlRun "sed -i 's/^.*PasswordAuthentication.*$/PasswordAuthentication yes/' /etc/ssh/sshd_config" - rlRun "service sshd restart" + rlSEConfigureSSH rlRun "setsebool ssh_sysadm_login on" rlLog "configuration says not to test SELinux users: ${DENIED_USERS}" diff --git a/selinux-policy/journalctl-and-similar/runtest.sh b/selinux-policy/journalctl-and-similar/runtest.sh index 7a53398..95e5d64 100755 --- a/selinux-policy/journalctl-and-similar/runtest.sh +++ b/selinux-policy/journalctl-and-similar/runtest.sh @@ -91,10 +91,7 @@ rlJournalStart rlPhaseEnd rlPhaseStartTest "real scenario -- confined users" - rlFileBackup /etc/ssh/sshd_config - rlRun "sed -i 's/^.*PermitRootLogin.*$/PermitRootLogin yes/' /etc/ssh/sshd_config" - rlRun "sed -i 's/^.*PasswordAuthentication.*$/PasswordAuthentication yes/' /etc/ssh/sshd_config" - rlRun "service sshd restart" + rlSEConfigureSSH rlRun "setsebool ssh_sysadm_login on" rlLog "configuration says not to test SELinux users: ${DENIED_USERS}" diff --git a/selinux-policy/pam_console-and-related/runtest.sh b/selinux-policy/pam_console-and-related/runtest.sh index 297d590..8d35eac 100755 --- a/selinux-policy/pam_console-and-related/runtest.sh +++ b/selinux-policy/pam_console-and-related/runtest.sh @@ -77,6 +77,8 @@ rlJournalStart fi rlPhaseStartTest "real scenario -- confined users" + rlSEConfigureSSH + rlRun "setsebool ssh_sysadm_login on" rlLog "configuration says not to test SELinux users: ${DENIED_USERS}" for SELINUX_USER in ${ALLOWED_USERS} ; do @@ -108,6 +110,7 @@ rlJournalStart rlSECheckAVC rlFileRestore + rlRun "service sshd restart" rlPhaseEnd rlJournalPrintText rlJournalEnd diff --git a/selinux-policy/pam_timestamp-and-related/runtest.sh b/selinux-policy/pam_timestamp-and-related/runtest.sh index d808a62..051cdaa 100755 --- a/selinux-policy/pam_timestamp-and-related/runtest.sh +++ b/selinux-policy/pam_timestamp-and-related/runtest.sh @@ -70,6 +70,8 @@ rlJournalStart fi rlPhaseStartTest "real scenario -- confined users" + rlSEConfigureSSH + rlRun "setsebool ssh_sysadm_login on" rlRun "mkdir -p ${TIMESTAMP_DIR}" rlRun "touch ${TIMESTAMP_DIR}/_pam_timestamp_key" @@ -99,7 +101,9 @@ rlJournalStart sleep 2 rlSECheckAVC rlRun "rm -f ${TIMESTAMP_DIR}/_pam_timestamp_key" + rlFileRestore + rlRun "service sshd restart" rlPhaseEnd rlJournalPrintText rlJournalEnd diff --git a/selinux-policy/perf_event-and-related/runtest.sh b/selinux-policy/perf_event-and-related/runtest.sh index a971635..f5fb5c1 100755 --- a/selinux-policy/perf_event-and-related/runtest.sh +++ b/selinux-policy/perf_event-and-related/runtest.sh @@ -72,11 +72,8 @@ rlJournalStart rlPhaseEnd rlPhaseStartTest "real scenario -- confined root sysadm_u" - rlRun "grep -i permit /etc/ssh/sshd_config" - rlFileBackup /etc/ssh/sshd_config - rlRun "sed -i 's/^.*PermitRootLogin.*$/PermitRootLogin yes/' /etc/ssh/sshd_config" - rlRun "sed -i 's/^.*PasswordAuthentication.*$/PasswordAuthentication yes/' /etc/ssh/sshd_config" - rlRun "service sshd restart" + rlSEConfigureSSH + rlRun "setsebool ssh_sysadm_login on" USER_NAME="toor" USER_SECRET="S3kr3t${RANDOM}" diff --git a/selinux-policy/ping-and-similar/runtest.sh b/selinux-policy/ping-and-similar/runtest.sh index 83a004f..e00656a 100755 --- a/selinux-policy/ping-and-similar/runtest.sh +++ b/selinux-policy/ping-and-similar/runtest.sh @@ -90,6 +90,8 @@ rlJournalStart # this phase is useful if you want to run some commands under confined users rlPhaseStartTest "real scenario -- confined users" + rlSEConfigureSSH + rlRun "setsebool ssh_sysadm_login on" rlRun "setsebool user_ping on" for SELINUX_USER in staff_u user_u sysadm_u unconfined_u ; do @@ -116,6 +118,7 @@ rlJournalStart rlSECheckAVC rlFileRestore + rlRun "service sshd restart" rlPhaseEnd rlJournalPrintText rlJournalEnd diff --git a/selinux-policy/policykit-general/runtest.sh b/selinux-policy/policykit-general/runtest.sh index 867f2de..b3b11e5 100755 --- a/selinux-policy/policykit-general/runtest.sh +++ b/selinux-policy/policykit-general/runtest.sh @@ -149,6 +149,8 @@ rlJournalStart rlPhaseEnd rlPhaseStartTest "real scenario -- confined users" + rlSEConfigureSSH + rlRun "setsebool ssh_sysadm_login on" for SELINUX_USER in ${ALLOWED_USERS} ; do USER_NAME="user${RANDOM}" @@ -169,6 +171,7 @@ rlJournalStart rlFileRestore rlServiceRestore ${SERVICE_NAME} + rlRun "service sshd restart" rlPhaseEnd rlJournalPrintText rlJournalEnd diff --git a/selinux-policy/systemd-userdbd-and-similar/runtest.sh b/selinux-policy/systemd-userdbd-and-similar/runtest.sh index 9fba8c9..f817604 100755 --- a/selinux-policy/systemd-userdbd-and-similar/runtest.sh +++ b/selinux-policy/systemd-userdbd-and-similar/runtest.sh @@ -82,6 +82,8 @@ rlJournalStart fi rlPhaseStartTest "real scenario -- confined users" + rlSEConfigureSSH + rlRun "setsebool ssh_sysadm_login on" rlRun "setsebool selinuxuser_tcp_server on" rlLog "configuration says not to test SELinux users: ${DENIED_USERS}" @@ -126,6 +128,7 @@ rlJournalStart rlFileRestore rlServiceRestore ${SERVICE_NAME} + rlRun "service sshd restart" rlPhaseEnd rlJournalPrintText rlJournalEnd From 9b9952f92ceb8c61cb43e0a293a50ae6e974b2f3 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Fri, 12 Mar 2021 14:52:46 +0100 Subject: [PATCH 054/626] kernel/selinux-testsuite: update metadata to better match TCMS ...to allow switching the TCMS entry to refer directly here via a FMF link. Note: I'm not adding the tags, as most of those is RHEL/RH-specific and they can be maintained just in TCMS. Signed-off-by: Ondrej Mosnacek --- kernel/selinux-testsuite/main.fmf | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) diff --git a/kernel/selinux-testsuite/main.fmf b/kernel/selinux-testsuite/main.fmf index 358efb6..f22925c 100644 --- a/kernel/selinux-testsuite/main.fmf +++ b/kernel/selinux-testsuite/main.fmf @@ -1,10 +1,16 @@ -path: /kernel/selinux-testsuite - summary: Wrapper for selinux-testuite description: | This TC runs a functional test suite for the LSM-based SELinux security module. -duration: 60m -tier: 2 +contact: Milos Malik +component: +- kernel +- selinux-policy +framework: beakerlib +duration: 1h +tier: 1 +enabled: true adjust: -- enabled: false - when: distro < rhel-5 +- enabled: false + when: distro < rhel-5 +- enabled: false + when: arch = i386 From 9ecceccc71d2770ad9991cc6ede5b259c7b21647 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Wed, 12 May 2021 16:33:36 +0200 Subject: [PATCH 055/626] add new test which uses pam_limits and nonewprivs The pam_limits.so module can apply various limits on users, groups and other domains. Purpose of this TC is to find out if these limits do not interfere with current SELinux policy. If nonewprivs limit is used on confined or unconfined users, SELinux denials with { nnp_transition } appear when users log in. The TC reproduces the situation. I believe this operation should be allowed to make the security feature work. The TC looks for appropriate SELinux policy rules. The TC covers BZ#1958819. --- .../pam_limits-and-related/Makefile | 69 ++++++++++++++ selinux-policy/pam_limits-and-related/PURPOSE | 10 +++ .../pam_limits-and-related/main.fmf | 2 + .../pam_limits-and-related/runtest.sh | 89 +++++++++++++++++++ selinux-policy/pam_limits-and-related/ssh.exp | 20 +++++ 5 files changed, 190 insertions(+) create mode 100644 selinux-policy/pam_limits-and-related/Makefile create mode 100644 selinux-policy/pam_limits-and-related/PURPOSE create mode 100644 selinux-policy/pam_limits-and-related/main.fmf create mode 100755 selinux-policy/pam_limits-and-related/runtest.sh create mode 100755 selinux-policy/pam_limits-and-related/ssh.exp diff --git a/selinux-policy/pam_limits-and-related/Makefile b/selinux-policy/pam_limits-and-related/Makefile new file mode 100644 index 0000000..2fb85ca --- /dev/null +++ b/selinux-policy/pam_limits-and-related/Makefile @@ -0,0 +1,69 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/pam_limits-and-related +# Description: Does SELinux cooperate with pam_limits.so? +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2020 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/pam_limits-and-related +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE ssh.exp + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh ssh.exp + chcon -t bin_t runtest.sh ssh.exp + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: Does SELinux cooperate with pam_limits.so?" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: pam" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console expect openssh-clients pam shadow-utils" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) + @echo "Bug: 1958819" >> $(METADATA) # Fedora 34 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/pam_limits-and-related/PURPOSE b/selinux-policy/pam_limits-and-related/PURPOSE new file mode 100644 index 0000000..9b9e9c4 --- /dev/null +++ b/selinux-policy/pam_limits-and-related/PURPOSE @@ -0,0 +1,10 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/pam_limits-and-related +Author: Milos Malik + +Does SELinux cooperate with pam_limits.so? +Confined and unconfined users are tested using SSH. + +This TC uses following parameters which can be overriden: + * ALLOWED_USERS - which SELinux users should be tested? + * DENIED_USERS - which SELinux users should NOT be tested? + diff --git a/selinux-policy/pam_limits-and-related/main.fmf b/selinux-policy/pam_limits-and-related/main.fmf new file mode 100644 index 0000000..7d613d7 --- /dev/null +++ b/selinux-policy/pam_limits-and-related/main.fmf @@ -0,0 +1,2 @@ +path: /selinux-policy/pam_limits-and-related +tier: 2 diff --git a/selinux-policy/pam_limits-and-related/runtest.sh b/selinux-policy/pam_limits-and-related/runtest.sh new file mode 100755 index 0000000..d9c6a3e --- /dev/null +++ b/selinux-policy/pam_limits-and-related/runtest.sh @@ -0,0 +1,89 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/pam_limits-and-related +# Description: Does SELinux cooperate with pam_limits.so? +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2020 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +SERVICE_PACKAGE="pam" +DENIED_USERS=${DENIED_USERS:-""} +ALLOWED_USERS=${ALLOWED_USERS:-"guest_u xguest_u user_u staff_u sysadm_u unconfined_u"} + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlFileBackup /etc/shadow + rlFileBackup /etc/security/limits.conf + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "bz#1958819" + rlSESearchRule "allow init_t guest_t : process2 { nnp_transition } [ ]" + rlSESearchRule "allow init_t staff_t : process2 { nnp_transition } [ ]" + rlSESearchRule "allow init_t sysadm_t : process2 { nnp_transition } [ ]" + rlSESearchRule "allow init_t unconfined_t : process2 { nnp_transition } [ ]" + rlSESearchRule "allow init_t user_t : process2 { nnp_transition } [ ]" + rlSESearchRule "allow init_t xguest_t : process2 { nnp_transition } [ ]" + rlPhaseEnd + + rlPhaseStartTest "real scenario -- confined users" + rlRun "setsebool ssh_sysadm_login on" + rlLog "configuration says not to test SELinux users: ${DENIED_USERS}" + for SELINUX_USER in ${ALLOWED_USERS} ; do + USER_NAME="user${RANDOM}" + USER_SECRET="S3kr3t${RANDOM}" + rlRun "useradd -Z ${SELINUX_USER} ${USER_NAME}" + rlRun "echo ${USER_SECRET} | passwd --stdin ${USER_NAME}" + rlRun "echo \"${USER_NAME} - nonewprivs 1\" >> /etc/security/limits.conf" + rlRun "restorecon -RvF /home/${USER_NAME}" + rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost id" + rlRun "userdel -rfZ ${USER_NAME}" + sleep 10 + done + rlRun "setsebool ssh_sysadm_login off" + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/pam_limits-and-related/ssh.exp b/selinux-policy/pam_limits-and-related/ssh.exp new file mode 100755 index 0000000..58c9647 --- /dev/null +++ b/selinux-policy/pam_limits-and-related/ssh.exp @@ -0,0 +1,20 @@ +#!/usr/bin/expect -f +# Expect script for SSH logging as $username to $hostname using $password and executing $command. +# Usage: +# ./ssh.exp username password hostname command +set username [lrange $argv 0 0] +set password [lrange $argv 1 1] +set hostname [lrange $argv 2 2] +set command [lrange $argv 3 10] +set timeout 15 +# connect to remote host and execute given command +log_user 1 +spawn ssh -t $username@$hostname $command +expect { + -nocase "yes/no" { send -- "yes\r" ; exp_continue } + -nocase "password" { send -- "$password\r" } +} +log_user 1 +# send -- "\r" +expect eof + From d33212fe88616f2b58d7525f871366d2e4687405 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Thu, 24 Jun 2021 13:20:06 +0200 Subject: [PATCH 056/626] skip the real scenario if the service is missing The systemd-timesyncd service is present on both RHEL-8 and Fedora, but may not be present on other RHELs, even though the policy which confines the systemd-timesyncd program is present there. If the systemd-timesyncd service is not present then the TC checks policy definitions only (types, rules, file context patterns etc.) If the systemd-timesyncd service is present then the TC will also test basic actions of the service (start, restart, status etc.) --- selinux-policy/systemd-timesyncd-and-similar/runtest.sh | 2 ++ 1 file changed, 2 insertions(+) diff --git a/selinux-policy/systemd-timesyncd-and-similar/runtest.sh b/selinux-policy/systemd-timesyncd-and-similar/runtest.sh index 9fc18cf..f9b1b7f 100755 --- a/selinux-policy/systemd-timesyncd-and-similar/runtest.sh +++ b/selinux-policy/systemd-timesyncd-and-similar/runtest.sh @@ -109,6 +109,7 @@ rlJournalStart rlSESearchRule "allow systemd_timedated_t var_run_t : dir { watch } [ ]" rlPhaseEnd + if systemctl list-units | grep -q ${SERVICE_NAME} ; then rlPhaseStartTest "real scenario -- standalone service" rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" if ! rlSEDefined ${PROCESS_CONTEXT} ; then @@ -118,6 +119,7 @@ rlJournalStart rlRun "restorecon -Rv /run /var" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd + fi rlPhaseStartCleanup sleep 2 From 72a7f9e56568ef8e15d93eb2286f5f3159aeb294 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Fri, 11 Jun 2021 21:35:55 +0200 Subject: [PATCH 057/626] test if systemd-sleep can create new file in /sys/power directory Recent testing of the hybrid-sleep service on RHEL-8 revealed that SELinux prevents the systemd-sleep process from creating the state file in /sys/power/ directory. I believe this action should be allowed, because the behavior is expected, the scenario is supported and security is not violated. Unfortunately, the TC cannot reproduce the scenario because it's difficult to wake up the machine after invoking the hybrid-sleep service. The TC looks for appropriate policy rules and file context patterns. The TC covers BZ#1968610. --- selinux-policy/swap-file-and-systemd-access/Makefile | 1 + selinux-policy/swap-file-and-systemd-access/runtest.sh | 6 ++++++ 2 files changed, 7 insertions(+) diff --git a/selinux-policy/swap-file-and-systemd-access/Makefile b/selinux-policy/swap-file-and-systemd-access/Makefile index 492b8e8..8ec066f 100644 --- a/selinux-policy/swap-file-and-systemd-access/Makefile +++ b/selinux-policy/swap-file-and-systemd-access/Makefile @@ -70,6 +70,7 @@ $(METADATA): Makefile @echo "Bug: 1912385" >> $(METADATA) # Fedora 32 @echo "Bug: 1926536" >> $(METADATA) # RHEL 9 @echo "Bug: 1928539" >> $(METADATA) # Fedora 32 + @echo "Bug: 1968610" >> $(METADATA) # RHEL 8 rhts-lint $(METADATA) diff --git a/selinux-policy/swap-file-and-systemd-access/runtest.sh b/selinux-policy/swap-file-and-systemd-access/runtest.sh index 4a60b43..1bcb508 100755 --- a/selinux-policy/swap-file-and-systemd-access/runtest.sh +++ b/selinux-policy/swap-file-and-systemd-access/runtest.sh @@ -83,6 +83,12 @@ rlJournalStart rlSESearchRule "allow systemd_sleep_t fixed_disk_device_t : blk_file { getattr } [ ]" rlPhaseEnd + rlPhaseStartTest "bz#1968610" + rlSEMatchPathCon "/sys/power" "sysfs_t" + rlSEMatchPathCon "/sys/power/state" "sysfs_t" + rlSESearchRule "allow systemd_sleep_t sysfs_t : dir { add_name create } [ ]" + rlPhaseEnd + if ${REAL_SCENARIOS} ; then rlPhaseStartTest "real scenario" rlRun "rm -f /swapfile" From 44e725eeffa29925180025ce1dbb3c9342cfc29d Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Thu, 1 Jul 2021 11:08:57 +0200 Subject: [PATCH 058/626] correct policy rule checks related to /sys/power/state One policy rule check related to BZ#1968610 was incorrect, because it assumed that the /sys/power/state is a directory, but it is a file. Now, it is correct. --- selinux-policy/swap-file-and-systemd-access/PURPOSE | 2 +- selinux-policy/swap-file-and-systemd-access/runtest.sh | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/selinux-policy/swap-file-and-systemd-access/PURPOSE b/selinux-policy/swap-file-and-systemd-access/PURPOSE index e92b3f3..83177ef 100644 --- a/selinux-policy/swap-file-and-systemd-access/PURPOSE +++ b/selinux-policy/swap-file-and-systemd-access/PURPOSE @@ -1,5 +1,5 @@ PURPOSE of /CoreOS/selinux-policy/Regression/swap-file-and-systemd-access Author: Milos Malik -SELinux interferes with systemd when accessing a swap file. +SELinux interferes with systemd when accessing swap files or swap partitions. diff --git a/selinux-policy/swap-file-and-systemd-access/runtest.sh b/selinux-policy/swap-file-and-systemd-access/runtest.sh index 1bcb508..430defb 100755 --- a/selinux-policy/swap-file-and-systemd-access/runtest.sh +++ b/selinux-policy/swap-file-and-systemd-access/runtest.sh @@ -86,7 +86,8 @@ rlJournalStart rlPhaseStartTest "bz#1968610" rlSEMatchPathCon "/sys/power" "sysfs_t" rlSEMatchPathCon "/sys/power/state" "sysfs_t" - rlSESearchRule "allow systemd_sleep_t sysfs_t : dir { add_name create } [ ]" + rlSESearchRule "allow systemd_sleep_t sysfs_t : dir { add_name write } [ ]" + rlSESearchRule "allow systemd_sleep_t sysfs_t : file { create } [ ]" rlPhaseEnd if ${REAL_SCENARIOS} ; then From 99db07804ed222e1ab01001f4a847e9f1904f094 Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Fri, 9 Jul 2021 17:07:11 +0200 Subject: [PATCH 059/626] policycoretuils: add new test for setfiles with binary policy setfiles didn't allow using "-c" parameter (binary policy) when path was specified. Verify that setfiles now gives the same results regardless of weather binary policy was provided. The TC covers BZ#1973754 Signed-off-by: Vit Mojzis --- policycoreutils/setfiles_binary/Makefile | 63 ++++++++++++++++++ policycoreutils/setfiles_binary/PURPOSE | 3 + policycoreutils/setfiles_binary/main.fmf | 21 ++++++ policycoreutils/setfiles_binary/runtest.sh | 75 ++++++++++++++++++++++ 4 files changed, 162 insertions(+) create mode 100644 policycoreutils/setfiles_binary/Makefile create mode 100644 policycoreutils/setfiles_binary/PURPOSE create mode 100644 policycoreutils/setfiles_binary/main.fmf create mode 100755 policycoreutils/setfiles_binary/runtest.sh diff --git a/policycoreutils/setfiles_binary/Makefile b/policycoreutils/setfiles_binary/Makefile new file mode 100644 index 0000000..121f784 --- /dev/null +++ b/policycoreutils/setfiles_binary/Makefile @@ -0,0 +1,63 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/policycoreutils/Sanity/setfiles_binary +# Description: setfiles should allow checking given path against binary policy +# Author: Vit Mojzis +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2021 Red Hat, Inc. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/policycoreutils/Sanity/setfiles_binary +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + test -x runtest.sh || chmod a+x runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Vit Mojzis " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: setfiles should allow checking given path against binary policy" >> $(METADATA) + @echo "Type: Sanity" >> $(METADATA) + @echo "TestTime: 5m" >> $(METADATA) + @echo "RunFor: policycoreutils" >> $(METADATA) + @echo "Requires: policycoreutils rpm cpio" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Bug: 1973754" >> $(METADATA) # RHEL-8 + rhts-lint $(METADATA) diff --git a/policycoreutils/setfiles_binary/PURPOSE b/policycoreutils/setfiles_binary/PURPOSE new file mode 100644 index 0000000..7389189 --- /dev/null +++ b/policycoreutils/setfiles_binary/PURPOSE @@ -0,0 +1,3 @@ +PURPOSE of /CoreOS/policycoreutils/Sanity/setfiles_binary +Description: Setfiles should allow checking given path against binary policy +Author: Vit Mojzis diff --git a/policycoreutils/setfiles_binary/main.fmf b/policycoreutils/setfiles_binary/main.fmf new file mode 100644 index 0000000..2eac0ad --- /dev/null +++ b/policycoreutils/setfiles_binary/main.fmf @@ -0,0 +1,21 @@ +summary: setfiles should allow checking given path against binary policy +description: setfiles didn't allow using "-c" parameter (binary policy) +when path was specified. Verify that setfiles now gives the same results +regardless of weather binary policy was provided. +contact: Vit Mojzis +path: /policycoreutils/setfiles_binary +component: +- policycoreutils +framework: beakerlib +require: +- e2fsprogs +- policycoreutils +- rpm +- cpio +duration: 5m +tier: 1 +enabled: true +adjust: + enabled: false + when: distro ~< rhel-8.4 + because: not expected to be fixed in RHEL-8 below 8.4 diff --git a/policycoreutils/setfiles_binary/runtest.sh b/policycoreutils/setfiles_binary/runtest.sh new file mode 100755 index 0000000..e7a292f --- /dev/null +++ b/policycoreutils/setfiles_binary/runtest.sh @@ -0,0 +1,75 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/policycoreutils/Sanity/setfiles_binary +# Description: setfiles should allow checking given path against binary policy +# Author: Vit Mojzis +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2021 Red Hat, Inc. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="policycoreutils" + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm $PACKAGE + rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" + rlRun "pushd $TmpDir" + OUTPUT=`mktemp` + rlRun "mkdir policy" + rlRun "pushd policy" + # download and extract selinux-policy-targeted + rlRun "dnf download selinux-policy-targeted --downloaddir ." + rlRun "rpm2cpio *.rpm | cpio -idm" + rlRun "popd" + # create a mockup of root directory structure + DIRS="bin boot dev etc home lib lib64 media mnt opt proc root run sbin snap srv sys tmp usr var" + rlRun " +mkdir testroot +for DIR in ${DIRS}; do + mkdir -p testroot/\${DIR} +done +" + rlRun "ls -lZ testroot" + rlPhaseEnd + + rlPhaseStartTest "setfiles should allow checking given path against binary policy - bz#1973754" + DIR=$(pwd) + # run setfiles using system policy + rlRun "setfiles -r '$DIR/testroot' -nvF /etc/selinux/targeted/contexts/files/file_contexts '$DIR/testroot' &> setfilesout" + POLICY=$(find "$DIR/policy/etc/selinux/targeted/policy/" -name "policy.*") + # run the same command using the extracted policy + rlRun "setfiles -r '$DIR/testroot' -nvF -c '$POLICY' '$DIR/policy/etc/selinux/targeted/contexts/files/file_contexts' '$DIR/testroot' &> setfilesout2" + rlRun "diff setfilesout setfilesout2" 0 + if [ ! $? -eq 0 ] ; then + rlRun "cat setfilesout" + rlRun "cat setfilesout2" + fi + rlPhaseEnd + rlPhaseStartCleanup + rlRun "popd" + rlRun "rm -r $TmpDir" 0 "Removing tmp directory" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd From d686d5b10c9d4c2e19f1c00a1a646648bca1c0fc Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Fri, 16 Jul 2021 14:14:41 +0200 Subject: [PATCH 060/626] policycoreutils/setfiles_binary: fix yaml formatting Signed-off-by: Vit Mojzis --- policycoreutils/setfiles_binary/main.fmf | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/policycoreutils/setfiles_binary/main.fmf b/policycoreutils/setfiles_binary/main.fmf index 2eac0ad..d33a243 100644 --- a/policycoreutils/setfiles_binary/main.fmf +++ b/policycoreutils/setfiles_binary/main.fmf @@ -1,17 +1,18 @@ summary: setfiles should allow checking given path against binary policy -description: setfiles didn't allow using "-c" parameter (binary policy) -when path was specified. Verify that setfiles now gives the same results -regardless of weather binary policy was provided. +description: > + setfiles didn't allow using "-c" parameter (binary policy) when path + was specified. Verify that setfiles now gives the same results + regardless of weather binary policy was provided. contact: Vit Mojzis path: /policycoreutils/setfiles_binary component: -- policycoreutils + - policycoreutils framework: beakerlib require: -- e2fsprogs -- policycoreutils -- rpm -- cpio + - e2fsprogs + - policycoreutils + - rpm + - cpio duration: 5m tier: 1 enabled: true From b70174e2e9215660106cc9cfd0104b6cd178918f Mon Sep 17 00:00:00 2001 From: Patrik Koncity Date: Wed, 21 Jul 2021 12:01:17 +0200 Subject: [PATCH 061/626] Don't run lockdown-class test on RHEL-8.x Don't run lockdown-clast test scenario on RHEL's 8.x machines. Add conditionals to fix that. --- selinux-policy/lockdown-class/runtest.sh | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/selinux-policy/lockdown-class/runtest.sh b/selinux-policy/lockdown-class/runtest.sh index a8376a2..c008272 100755 --- a/selinux-policy/lockdown-class/runtest.sh +++ b/selinux-policy/lockdown-class/runtest.sh @@ -33,6 +33,11 @@ PACKAGE="selinux-policy" rlJournalStart + if rlIsRHEL '<9' ; then + rlLog "Not applicable to this OS version." + rlJournalEnd + exit 0 + fi rlPhaseStartSetup rlRun "rlImport 'selinux-policy/common'" rlSESatisfyRequires @@ -61,4 +66,3 @@ rlJournalStart rlPhaseEnd rlJournalPrintText rlJournalEnd - From f248ce123e75f5f539893233771da0b3f3ca9c87 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Thu, 29 Jul 2021 09:46:44 +0200 Subject: [PATCH 062/626] python-bindings: Fixes for Fedora CI - fixed indentation - the test requires python3-pip Fixes: Running 'PipVersion=$(pip3 show selinux | grep Version)' /usr/share/beakerlib/testing.sh: line 891: pip3: command not found - import sys Fixes: Running 'python3 -c 'import selinux; rc = selinux.is_selinux_enabled(); sys.exit(rc)'' Traceback (most recent call last): File "", line 1, in NameError: name 'sys' is not defined --- libselinux/python-bindings/Makefile | 2 +- libselinux/python-bindings/runtest.sh | 15 ++++++++------- 2 files changed, 9 insertions(+), 8 deletions(-) diff --git a/libselinux/python-bindings/Makefile b/libselinux/python-bindings/Makefile index f2068e4..9ba0613 100644 --- a/libselinux/python-bindings/Makefile +++ b/libselinux/python-bindings/Makefile @@ -53,7 +53,7 @@ $(METADATA): Makefile @echo "Type: Sanity" >> $(METADATA) @echo "TestTime: 5m" >> $(METADATA) @echo "RunFor: libselinux" >> $(METADATA) - @echo "Requires: python3-libselinux" >> $(METADATA) + @echo "Requires: python3-libselinux python3-pip" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @echo "License: GPLv2+" >> $(METADATA) @echo "Confidential: no" >> $(METADATA) diff --git a/libselinux/python-bindings/runtest.sh b/libselinux/python-bindings/runtest.sh index a8e9b11..dceb975 100755 --- a/libselinux/python-bindings/runtest.sh +++ b/libselinux/python-bindings/runtest.sh @@ -47,13 +47,14 @@ rlJournalStart rlPhaseStartTest "Import selinux module and try selinux.is_selinux_enabled()" rlRun "python3 -c 'import selinux'" 0 - rlRun "python3 -c 'import selinux; rc = selinux.is_selinux_enabled(); sys.exit(rc)'" 0,1 - rlRun "PYTHON_SELINUX_ENABLED=$?" - if selinuxenabled; then - rlAssertEquals "SELinux is enabled" $PYTHON_SELINUX_ENABLED 1 - else - rlAssertNotEquals "SELinux is disabled" $PYTHON_SELINUX_ENABLED 0 - fi + rlRun "python3 -c 'import selinux, sys; rc = selinux.is_selinux_enabled(); sys.exit(rc)'" 0,1 + + rlRun "PYTHON_SELINUX_ENABLED=$?" + if selinuxenabled; then + rlAssertEquals "SELinux is enabled" $PYTHON_SELINUX_ENABLED 1 + else + rlAssertNotEquals "SELinux is disabled" $PYTHON_SELINUX_ENABLED 0 + fi rlPhaseEnd rlPhaseStartCleanup From 5fe4b9e652ef51f34e20453f6c45907ca2c9b30c Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Thu, 29 Jul 2021 12:25:33 +0200 Subject: [PATCH 063/626] selinux_set_callback: fix SETENFORCE callback test MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit When enforcing is switched to permissive and back to enforcing before the status is updated, the SETENFORCE callback is not called as the state is same as before. Also avc_init is deprecated: test_callback.c:62:5: warning: ‘avc_init’ is deprecated: Use avc_open and selinux_set_callback [-Wdeprecated-declarations] --- libselinux/selinux_set_callback/test_callback.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/libselinux/selinux_set_callback/test_callback.c b/libselinux/selinux_set_callback/test_callback.c index 240bd11..9a4cd62 100644 --- a/libselinux/selinux_set_callback/test_callback.c +++ b/libselinux/selinux_set_callback/test_callback.c @@ -58,8 +58,8 @@ int main (int argc, char **argv) { } printf("calling avc_audit to call audit and log functions\n"); - - avc_init("", NULL, NULL, NULL, NULL); + + avc_open(NULL, 0); struct security_id ssid = { "asdf", 5 }; struct security_id tsid = { "asdf", 5 }; @@ -99,11 +99,9 @@ int main (int argc, char **argv) { if (enforcing == 1) { security_setenforce(0); - security_setenforce(1); } else { security_setenforce(1); - security_setenforce(0); } // triggers callbacks @@ -123,5 +121,14 @@ int main (int argc, char **argv) { // triggers callbacks avc_has_perm_noaudit(&ssid, &tsid, 0, 1, NULL, &avd); + printf("switch enforcing back to %d\n", enforcing); + enforcing = security_getenforce(); + if (enforcing == 1) { + security_setenforce(0); + } + else { + security_setenforce(1); + } + return exit_code; } From c07abebad6a78b7e4cde4851971a5d5e4509fbca Mon Sep 17 00:00:00 2001 From: Amith Kumar Date: Thu, 29 Jul 2021 23:51:35 +0530 Subject: [PATCH 064/626] selinux-policy: Add test for bug1942267 Add an rdma test case to selinux-policy test suite which verifies bug1942267. The fix checks for avc generated by rdma service. --- .../systemd-modules-load-and-similar/Makefile | 3 ++- .../systemd-modules-load-and-similar/runtest.sh | 12 ++++++++++++ 2 files changed, 14 insertions(+), 1 deletion(-) diff --git a/selinux-policy/systemd-modules-load-and-similar/Makefile b/selinux-policy/systemd-modules-load-and-similar/Makefile index 97e3bb3..27ec3f9 100644 --- a/selinux-policy/systemd-modules-load-and-similar/Makefile +++ b/selinux-policy/systemd-modules-load-and-similar/Makefile @@ -55,7 +55,7 @@ $(METADATA): Makefile @echo "TestTime: 10m" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) @echo "RunFor: systemd" >> $(METADATA) - @echo "Requires: audit initscripts libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console openssh-clients systemd-udev" >> $(METADATA) + @echo "Requires: audit initscripts libselinux libselinux-utils policycoreutils rdma-core selinux-policy selinux-policy-targeted setools-console openssh-clients systemd-udev" >> $(METADATA) @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @@ -80,6 +80,7 @@ $(METADATA): Makefile @echo "Bug: 1829700" >> $(METADATA) # Fedora 32 @echo "Bug: 1833502" >> $(METADATA) # Fedora 32 @echo "Bug: 1838933" >> $(METADATA) # Fedora 32 + @echo "Bug: 1942267" >> $(METADATA) # Fedora 32 rhts-lint $(METADATA) diff --git a/selinux-policy/systemd-modules-load-and-similar/runtest.sh b/selinux-policy/systemd-modules-load-and-similar/runtest.sh index 4c896ba..8d0adca 100755 --- a/selinux-policy/systemd-modules-load-and-similar/runtest.sh +++ b/selinux-policy/systemd-modules-load-and-similar/runtest.sh @@ -117,6 +117,18 @@ rlJournalStart rlRun "rm -f /etc/modules-load.d/${KERNEL_MODULE}.conf" rlPhaseEnd + rlPhaseStartTest "bz#1942267" + tst_Time="$(date '+%T')" + # Install kernel-module matching the running kernel version + rlRun "dnf -y install kernel-modules-$(uname -r)" + rlRun "systemctl start rdma-load-modules@rdma.service" + rlRun "systemctl status rdma-load-modules@rdma.service" + rlRun "lsmod | grep rdma" + rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time" 1 + rlRun "systemctl stop rdma-load-modules@rdma.service" + rlSESearchRule "allow systemd_modules_load_t systemd_modules_load_t : lockdown { confidentiality } [ ]" + rlPhaseEnd + rlPhaseStartCleanup sleep 2 rlSECheckAVC From a335bae5eac3f70b34ea2b83647aed501ced3e33 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Wed, 4 Aug 2021 08:13:28 +0200 Subject: [PATCH 065/626] Install ansible-playbook using pip3 Sometimes ansible is not available as rpm in repositories, but it should be possible to install ansible using pip3 Fixes: [ FAIL ] :: Checking for the presence of ansible rpm [ FAIL ] :: Command 'ansible-playbook -i localhost, -c local -v tests_all_purge.yml' (Expected 0, got 127) --- .../linux-system-roles.selinux-tests/runtest.sh | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/policycoreutils/linux-system-roles.selinux-tests/runtest.sh b/policycoreutils/linux-system-roles.selinux-tests/runtest.sh index 5332b8e..1fa3809 100755 --- a/policycoreutils/linux-system-roles.selinux-tests/runtest.sh +++ b/policycoreutils/linux-system-roles.selinux-tests/runtest.sh @@ -34,8 +34,14 @@ rlJournalStart rlPhaseStartSetup rlAssertRpm $PACKAGE rlAssertRpm "git" - rlAssertRpm "ansible" - + if ! rpm -q ansible; then + rlLog "There's no ansible rpm, trying: pip3 install ansible" + rlRun "dnf -y install python3-pip" + rlRun "pip3 install ansible" + rlRun "ansible-playbook --version" 0 + else + rlAssertRpm "ansible" + fi rlPhaseEnd rlPhaseStartTest From b96679e0225b2ec0d855d0f5ecf39561b8229826 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Wed, 4 Aug 2021 15:11:52 +0200 Subject: [PATCH 066/626] kernel/selinux-testsuite: apply patch to fix failure on BTRFS The capable_sys test is failing on F35 without his patch, because BTRFS doesn't support the FIBMAP ioctl. Signed-off-by: Ondrej Mosnacek --- kernel/selinux-testsuite/runtest.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/selinux-testsuite/runtest.sh b/kernel/selinux-testsuite/runtest.sh index 3256ea4..24a9c3c 100755 --- a/kernel/selinux-testsuite/runtest.sh +++ b/kernel/selinux-testsuite/runtest.sh @@ -41,7 +41,7 @@ DEFAULT_COMMIT="58eaa31c9e0e0a0567990336ae355b4cd309e6e3" # requests (by number) are merged, creating a new temporary local branch. DEFAULT_PULLS="" # Default SELinux Patchwork series to apply before running the test. -DEFAULT_PATCHES="" +DEFAULT_PATCHES="526253" # Optional test parameter - location of testuite git. GIT_URL=${GIT_URL:-"git://github.com/SELinuxProject/selinux-testsuite"} From 134253d9800e6a027c792f35807b959cd306fd0d Mon Sep 17 00:00:00 2001 From: Zdenek Pytela Date: Thu, 1 Jul 2021 17:12:48 +0200 Subject: [PATCH 067/626] selinux-policy: do not test watch in systemd-timesyncd on RHEL < 9 The watch permissions are present only in RHEL 9 and Fedora, so the subtests for watch should not be executed in the systemd-timesyncd test on a system with RHEL up to version 8. --- selinux-policy/systemd-timesyncd-and-similar/runtest.sh | 2 ++ 1 file changed, 2 insertions(+) diff --git a/selinux-policy/systemd-timesyncd-and-similar/runtest.sh b/selinux-policy/systemd-timesyncd-and-similar/runtest.sh index f9b1b7f..66f114f 100755 --- a/selinux-policy/systemd-timesyncd-and-similar/runtest.sh +++ b/selinux-policy/systemd-timesyncd-and-similar/runtest.sh @@ -102,12 +102,14 @@ rlJournalStart rlSESearchRule "allow systemd_timedated_t efivarfs_t : file { getattr open read } [ ]" rlPhaseEnd + if ! rlIsRHEL '<9' ; then rlPhaseStartTest "bz#1949315" rlSEMatchPathCon "/" "root_t" rlSEMatchPathCon "/run" "var_run_t" rlSESearchRule "allow systemd_timedated_t root_t : dir { watch } [ ]" rlSESearchRule "allow systemd_timedated_t var_run_t : dir { watch } [ ]" rlPhaseEnd + fi if systemctl list-units | grep -q ${SERVICE_NAME} ; then rlPhaseStartTest "real scenario -- standalone service" From c40e0ae1604dd771cb34ce0dd8eb8f96293b978d Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 17 Aug 2021 13:03:00 +0200 Subject: [PATCH 068/626] skip not relevant test phases on RHEL-8 The automated tests also contain test phases which cover Fedora bugs. These test phases should not be executed on RHEL-8, because they are not relevant there. --- selinux-policy/dhclient-and-similar/runtest.sh | 2 ++ selinux-policy/nfsdcld-and-similar/runtest.sh | 2 ++ selinux-policy/pam_limits-and-related/runtest.sh | 2 ++ selinux-policy/systemd-modules-load-and-similar/runtest.sh | 4 +++- selinux-policy/usbmuxd-and-similar/runtest.sh | 2 ++ 5 files changed, 11 insertions(+), 1 deletion(-) diff --git a/selinux-policy/dhclient-and-similar/runtest.sh b/selinux-policy/dhclient-and-similar/runtest.sh index 4db364a..f8263b5 100755 --- a/selinux-policy/dhclient-and-similar/runtest.sh +++ b/selinux-policy/dhclient-and-similar/runtest.sh @@ -53,6 +53,7 @@ rlJournalStart sleep 2 rlPhaseEnd + if ! rlIsRHEL 8 ; then rlPhaseStartTest "bz#1897388" rlSEMatchPathCon "/usr/sbin/dhclient-script" "dhcpc_exec_t" rlSEMatchPathCon "/usr/bin/chronyc" "chronyc_exec_t" @@ -60,6 +61,7 @@ rlJournalStart rlSESearchRule "type_transition dhcpc_t chronyc_exec_t : process chronyc_t" rlSESearchRule "allow dhcpc_t chronyc_t : process { transition } [ ]" rlPhaseEnd + fi rlPhaseStartTest "real scenario" rlRun "dhclient" diff --git a/selinux-policy/nfsdcld-and-similar/runtest.sh b/selinux-policy/nfsdcld-and-similar/runtest.sh index 0fd7a54..5303eac 100755 --- a/selinux-policy/nfsdcld-and-similar/runtest.sh +++ b/selinux-policy/nfsdcld-and-similar/runtest.sh @@ -56,6 +56,7 @@ rlJournalStart sleep 2 rlPhaseEnd + if ! rlIsRHEL 8 ; then rlPhaseStartTest "bz#1834234" rlSEMatchPathCon "/usr/sbin/nfsdcld" "rpcd_exec_t" rlSESearchRule "allow init_t rpcd_exec_t : file { getattr open read execute } [ ]" @@ -63,6 +64,7 @@ rlJournalStart rlSESearchRule "allow init_t rpcd_t : process { transition } [ ]" rlSESearchRule "allow rpcd_t nfsd_fs_t : file { getattr open read } [ ]" rlPhaseEnd + fi rlPhaseStartTest "real scenario -- standalone service" rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" diff --git a/selinux-policy/pam_limits-and-related/runtest.sh b/selinux-policy/pam_limits-and-related/runtest.sh index d9c6a3e..cfc7036 100755 --- a/selinux-policy/pam_limits-and-related/runtest.sh +++ b/selinux-policy/pam_limits-and-related/runtest.sh @@ -52,6 +52,7 @@ rlJournalStart sleep 2 rlPhaseEnd + if ! rlIsRHEL 8 ; then rlPhaseStartTest "bz#1958819" rlSESearchRule "allow init_t guest_t : process2 { nnp_transition } [ ]" rlSESearchRule "allow init_t staff_t : process2 { nnp_transition } [ ]" @@ -60,6 +61,7 @@ rlJournalStart rlSESearchRule "allow init_t user_t : process2 { nnp_transition } [ ]" rlSESearchRule "allow init_t xguest_t : process2 { nnp_transition } [ ]" rlPhaseEnd + fi rlPhaseStartTest "real scenario -- confined users" rlRun "setsebool ssh_sysadm_login on" diff --git a/selinux-policy/systemd-modules-load-and-similar/runtest.sh b/selinux-policy/systemd-modules-load-and-similar/runtest.sh index 8d0adca..0bf4cf2 100755 --- a/selinux-policy/systemd-modules-load-and-similar/runtest.sh +++ b/selinux-policy/systemd-modules-load-and-similar/runtest.sh @@ -126,7 +126,9 @@ rlJournalStart rlRun "lsmod | grep rdma" rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time" 1 rlRun "systemctl stop rdma-load-modules@rdma.service" - rlSESearchRule "allow systemd_modules_load_t systemd_modules_load_t : lockdown { confidentiality } [ ]" + if ! rlIsRHEL 8 ; then + rlSESearchRule "allow systemd_modules_load_t systemd_modules_load_t : lockdown { confidentiality } [ ]" + fi rlPhaseEnd rlPhaseStartCleanup diff --git a/selinux-policy/usbmuxd-and-similar/runtest.sh b/selinux-policy/usbmuxd-and-similar/runtest.sh index b94e525..f1d6c77 100755 --- a/selinux-policy/usbmuxd-and-similar/runtest.sh +++ b/selinux-policy/usbmuxd-and-similar/runtest.sh @@ -75,6 +75,7 @@ rlJournalStart rlSESearchRule "allow usbmuxd_t udev_var_run_t : file { getattr open read } [ ]" rlPhaseEnd + if ! rlIsRHEL 8 ; then rlPhaseStartTest "bz#1930992" rlSEMatchPathCon "/sys" "sysfs_t" rlSESearchRule "allow usbmuxd_t sysfs_t : filesystem { getattr } [ ]" @@ -91,6 +92,7 @@ rlJournalStart rlSESearchRule "dontaudit usbmuxd_t init_t : dir { search } [ ]" rlSESearchRule "dontaudit usbmuxd_t init_t : file { getattr open read ioctl } [ ]" rlPhaseEnd + fi rlPhaseStartTest "real scenario" rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" From 25396ff474ed6d4862d162ddddd61befba89bf51 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Mon, 6 Sep 2021 13:05:48 +0200 Subject: [PATCH 069/626] kernel/selinux-testsuite: bump upstream commit This adds a new VSOCK test and drops an already merged bugfix. Signed-off-by: Ondrej Mosnacek --- kernel/selinux-testsuite/runtest.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kernel/selinux-testsuite/runtest.sh b/kernel/selinux-testsuite/runtest.sh index 24a9c3c..a86e669 100755 --- a/kernel/selinux-testsuite/runtest.sh +++ b/kernel/selinux-testsuite/runtest.sh @@ -35,13 +35,13 @@ PACKAGE="selinux-policy" # This should be updated as needed after verifying that the new version # doesn't break testing and after applying all necessary tweaks in the TC. # Run with GIT_BRANCH=master to run the latest upstream version. -DEFAULT_COMMIT="58eaa31c9e0e0a0567990336ae355b4cd309e6e3" +DEFAULT_COMMIT="4ed5d11312d673203d93dafbcdad441c3afc36f9" # Default pull requests to merge before running the test. # If non-empty, then after checking out GIT_BRANCH the listed upstream pull # requests (by number) are merged, creating a new temporary local branch. DEFAULT_PULLS="" # Default SELinux Patchwork series to apply before running the test. -DEFAULT_PATCHES="526253" +DEFAULT_PATCHES="" # Optional test parameter - location of testuite git. GIT_URL=${GIT_URL:-"git://github.com/SELinuxProject/selinux-testsuite"} From 87fa61ef9c75b0358a0f7aba6460e2124a6bfc43 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Mon, 6 Sep 2021 13:06:57 +0200 Subject: [PATCH 070/626] kernel/selinux-testsuite: fix module_load test on clang-built kernels CKI is running the testsuite also on clang-built kernels, which need the modules to be built using clang, too. Apply pending patches from upstream to make the testsuite work on these kernels. Signed-off-by: Ondrej Mosnacek --- kernel/selinux-testsuite/runtest.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/selinux-testsuite/runtest.sh b/kernel/selinux-testsuite/runtest.sh index a86e669..61d4112 100755 --- a/kernel/selinux-testsuite/runtest.sh +++ b/kernel/selinux-testsuite/runtest.sh @@ -41,7 +41,7 @@ DEFAULT_COMMIT="4ed5d11312d673203d93dafbcdad441c3afc36f9" # requests (by number) are merged, creating a new temporary local branch. DEFAULT_PULLS="" # Default SELinux Patchwork series to apply before running the test. -DEFAULT_PATCHES="" +DEFAULT_PATCHES="542465" # Optional test parameter - location of testuite git. GIT_URL=${GIT_URL:-"git://github.com/SELinuxProject/selinux-testsuite"} From 7a66f3c2ad875f353bc92ef27629bc01e28c50d7 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Tue, 7 Sep 2021 20:05:02 +0200 Subject: [PATCH 071/626] kernel/selinux-testsuite: apply a patch to fix building on RHEL-7 I missed that the new vsock_socket subtest fails to build on RHEL-7. Apply a patch that excludes it when the necessary header/definition is not available. Signed-off-by: Ondrej Mosnacek --- kernel/selinux-testsuite/runtest.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/selinux-testsuite/runtest.sh b/kernel/selinux-testsuite/runtest.sh index 61d4112..41d99ee 100755 --- a/kernel/selinux-testsuite/runtest.sh +++ b/kernel/selinux-testsuite/runtest.sh @@ -41,7 +41,7 @@ DEFAULT_COMMIT="4ed5d11312d673203d93dafbcdad441c3afc36f9" # requests (by number) are merged, creating a new temporary local branch. DEFAULT_PULLS="" # Default SELinux Patchwork series to apply before running the test. -DEFAULT_PATCHES="542465" +DEFAULT_PATCHES="542465 543285" # Optional test parameter - location of testuite git. GIT_URL=${GIT_URL:-"git://github.com/SELinuxProject/selinux-testsuite"} From 180ee684debde65ee882f2d78f43420945a0407c Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Wed, 8 Sep 2021 13:54:34 +0200 Subject: [PATCH 072/626] kernel/selinux-testsuite: update vsock_socket build fix patch On RHEL-7.2, also the vsock_socket class is missing from the policy - update the patch to v2, which also checks for the presence of the class. Signed-off-by: Ondrej Mosnacek --- kernel/selinux-testsuite/runtest.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/selinux-testsuite/runtest.sh b/kernel/selinux-testsuite/runtest.sh index 41d99ee..60c2bf1 100755 --- a/kernel/selinux-testsuite/runtest.sh +++ b/kernel/selinux-testsuite/runtest.sh @@ -41,7 +41,7 @@ DEFAULT_COMMIT="4ed5d11312d673203d93dafbcdad441c3afc36f9" # requests (by number) are merged, creating a new temporary local branch. DEFAULT_PULLS="" # Default SELinux Patchwork series to apply before running the test. -DEFAULT_PATCHES="542465 543285" +DEFAULT_PATCHES="542465 543757" # Optional test parameter - location of testuite git. GIT_URL=${GIT_URL:-"git://github.com/SELinuxProject/selinux-testsuite"} From 818ae3f6baa85729d801462d59dc6bd039049f0e Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Wed, 8 Sep 2021 16:20:19 +0200 Subject: [PATCH 073/626] kernel/selinux-testsuite: exclude vsock_socket on RHEL kernels without required fix Kernels before 4.18.0-314.el8 lack the bugfix that is required for this test to pass, so exclude it on these kernels. Signed-off-by: Ondrej Mosnacek --- kernel/selinux-testsuite/runtest.sh | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/kernel/selinux-testsuite/runtest.sh b/kernel/selinux-testsuite/runtest.sh index 60c2bf1..b12338c 100755 --- a/kernel/selinux-testsuite/runtest.sh +++ b/kernel/selinux-testsuite/runtest.sh @@ -389,6 +389,10 @@ rlJournalStart rlRun "sed -i -E -e '$script1' -e '$script2' -e '$script3' tests/filesystem/test" 0 \ "Apply workaround for missing XFS quota checks" fi + if kver_lt 4.18.0-314; then + # a17f0671017f selinux: vsock: Set SID for socket returned by accept() + exclude_tests+=" vsock_socket" + fi fi # CKI mainline kernels don't ship with module build infrastructure From 08dcaa35346d7d80301a9bb026207f8d70ea2ebe Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Wed, 22 Sep 2021 22:00:04 +0200 Subject: [PATCH 074/626] kernel/selinux-testsuite: patch the policy for restraint When this test in run via restraint (e.g. on Beaker), it inherits some file descriptors originating from it, labeled unconfined_service_t. This leads to a huge amount of denials when test programs are exectuted. To work around this, add a rule to the policy that allows the test domains to inherit these descriptors from unconfined_service_t. Signed-off-by: Ondrej Mosnacek --- kernel/selinux-testsuite/runtest.sh | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/kernel/selinux-testsuite/runtest.sh b/kernel/selinux-testsuite/runtest.sh index b12338c..188c240 100755 --- a/kernel/selinux-testsuite/runtest.sh +++ b/kernel/selinux-testsuite/runtest.sh @@ -304,6 +304,10 @@ rlJournalStart } | rlRun "tee -a tests/tun_tap/tun_common.h" 0 \ "Harden tun_tap test against missing defs" + # needed to avoid a flood of AVCs when run via restraint + rlRun "sed -i 's/type unconfined_t;/type unconfined_t, unconfined_service_t;/' policy/test_policy.if" 0 + rlRun "sed -i 's/\\(allow \\\$1 initrc_t:fd use;\\)/\\1 allow \$1 unconfined_service_t:fd use;/' policy/test_policy.if" 0 + exclude_tests="" force_tests="" for file in ./tests/nnp*/execnnp.c; do From 153042bdadf7fc139b8b9516921510424e7b8e59 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Fri, 24 Sep 2021 12:00:01 +0200 Subject: [PATCH 075/626] kernel/selinux-testsuite: guard against missing unconfined_service_t RHEL-6 didn't have unconfined_service_t yet, so we must skip the fd::use workaround there. Signed-off-by: Ondrej Mosnacek --- kernel/selinux-testsuite/runtest.sh | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/kernel/selinux-testsuite/runtest.sh b/kernel/selinux-testsuite/runtest.sh index 188c240..bafc765 100755 --- a/kernel/selinux-testsuite/runtest.sh +++ b/kernel/selinux-testsuite/runtest.sh @@ -305,8 +305,11 @@ rlJournalStart "Harden tun_tap test against missing defs" # needed to avoid a flood of AVCs when run via restraint - rlRun "sed -i 's/type unconfined_t;/type unconfined_t, unconfined_service_t;/' policy/test_policy.if" 0 - rlRun "sed -i 's/\\(allow \\\$1 initrc_t:fd use;\\)/\\1 allow \$1 unconfined_service_t:fd use;/' policy/test_policy.if" 0 + # (RHEL-6 doesn't have unconfined_service_t) + if ! rlIsRHEL '<7'; then + rlRun "sed -i 's/type unconfined_t;/type unconfined_t, unconfined_service_t;/' policy/test_policy.if" 0 + rlRun "sed -i 's/\\(allow \\\$1 initrc_t:fd use;\\)/\\1 allow \$1 unconfined_service_t:fd use;/' policy/test_policy.if" 0 + fi exclude_tests="" force_tests="" From 0f43ff1aad958a36cc7fef05f0555735f402cb58 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Mon, 27 Sep 2021 10:50:33 +0200 Subject: [PATCH 076/626] kernel/selinux-testsuite: bump upstream ref This revision integrates two patch series and adds a fix for: https://gitlab.com/cki-project/kernel-tests/-/issues/750 Signed-off-by: Ondrej Mosnacek --- kernel/selinux-testsuite/runtest.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kernel/selinux-testsuite/runtest.sh b/kernel/selinux-testsuite/runtest.sh index bafc765..728c237 100755 --- a/kernel/selinux-testsuite/runtest.sh +++ b/kernel/selinux-testsuite/runtest.sh @@ -35,13 +35,13 @@ PACKAGE="selinux-policy" # This should be updated as needed after verifying that the new version # doesn't break testing and after applying all necessary tweaks in the TC. # Run with GIT_BRANCH=master to run the latest upstream version. -DEFAULT_COMMIT="4ed5d11312d673203d93dafbcdad441c3afc36f9" +DEFAULT_COMMIT="29c42c865a9f43a15ae72ebd19642c3d88a7d5ce" # Default pull requests to merge before running the test. # If non-empty, then after checking out GIT_BRANCH the listed upstream pull # requests (by number) are merged, creating a new temporary local branch. DEFAULT_PULLS="" # Default SELinux Patchwork series to apply before running the test. -DEFAULT_PATCHES="542465 543757" +DEFAULT_PATCHES="" # Optional test parameter - location of testuite git. GIT_URL=${GIT_URL:-"git://github.com/SELinuxProject/selinux-testsuite"} From 8b594e7b591f7e0fb778c301c6932cee4a379fc1 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Thu, 30 Sep 2021 10:46:08 +0200 Subject: [PATCH 077/626] do not start the hybrid-sleep / hibernate services by default Some machines do not survive the start of systemd-hybrid-sleep or systemd-hibernate services, even though their configuration contains PrivateDevices=yes. They simply do not wake up. To avoid such problems, one of the test phases will not be executed unless the environment variable REAL_SCENARIOS is set to true. --- selinux-policy/swap-file-and-systemd-access/runtest.sh | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/selinux-policy/swap-file-and-systemd-access/runtest.sh b/selinux-policy/swap-file-and-systemd-access/runtest.sh index 430defb..76c651a 100755 --- a/selinux-policy/swap-file-and-systemd-access/runtest.sh +++ b/selinux-policy/swap-file-and-systemd-access/runtest.sh @@ -30,7 +30,11 @@ . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" -REAL_SCENARIOS=${REAL_SCENARIOS:-true} +# The real scenario phase is not executed by default, because some +# machines do not survive the start of systemd-hybrid-sleep or +# systemd-hibernate services, even though their configuration contains +# PrivateDevices=yes. Override is possible by setting REAL_SCENARIOS=true. +REAL_SCENARIOS=${REAL_SCENARIOS:-false} rlJournalStart if ! seinfo -t | grep -q systemd_sleep ; then From d16f70fe3a2202a7e020ff1a2891cb9d98e4a808 Mon Sep 17 00:00:00 2001 From: Amith Kumar Date: Fri, 1 Oct 2021 01:33:51 +0530 Subject: [PATCH 078/626] sepolicy::anon_inode Add test for bz1974559 Add a new selinux-policy testsuite to address issues related to tclass anon_inode and also verifies bug 1974559. In this case, selinux policy denies write permissons to userfaultfd syscall. Signed-off-by: Amith Kumar --- .../anon_inode-and-similar/Makefile | 68 +++++++++++++++ selinux-policy/anon_inode-and-similar/PURPOSE | 4 + .../anon_inode-and-similar/main.fmf | 8 ++ .../anon_inode-and-similar/reproducer.c | 84 +++++++++++++++++++ .../anon_inode-and-similar/runtest.sh | 63 ++++++++++++++ 5 files changed, 227 insertions(+) create mode 100644 selinux-policy/anon_inode-and-similar/Makefile create mode 100644 selinux-policy/anon_inode-and-similar/PURPOSE create mode 100644 selinux-policy/anon_inode-and-similar/main.fmf create mode 100644 selinux-policy/anon_inode-and-similar/reproducer.c create mode 100755 selinux-policy/anon_inode-and-similar/runtest.sh diff --git a/selinux-policy/anon_inode-and-similar/Makefile b/selinux-policy/anon_inode-and-similar/Makefile new file mode 100644 index 0000000..d7b7a26 --- /dev/null +++ b/selinux-policy/anon_inode-and-similar/Makefile @@ -0,0 +1,68 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/anon_inode-and-similar +# Description: Upstream coverage for SELinux issues with anon_inode tclass. +# Author: Author: Amith Kumar +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2021 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/anon_inode-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE reproducer.c + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Amith Kumar " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux AVC issues related to anon_inode tclass policies." >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 30m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: libselinux policycoreutils selinux-policy selinux-policy-targeted gcc glibc-headers" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Releases: -RHEL4" >> $(METADATA) + @echo "Bug: 1974559" >> $(METADATA) + + rhts-lint $(METADATA) + diff --git a/selinux-policy/anon_inode-and-similar/PURPOSE b/selinux-policy/anon_inode-and-similar/PURPOSE new file mode 100644 index 0000000..7799186 --- /dev/null +++ b/selinux-policy/anon_inode-and-similar/PURPOSE @@ -0,0 +1,4 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/anon_inode-and-similar +Author: Amith Kumar + +SELinux denials affect processes that deals with anon_inode tclass. diff --git a/selinux-policy/anon_inode-and-similar/main.fmf b/selinux-policy/anon_inode-and-similar/main.fmf new file mode 100644 index 0000000..18a148c --- /dev/null +++ b/selinux-policy/anon_inode-and-similar/main.fmf @@ -0,0 +1,8 @@ +path: /selinux-policy/anon_inode-and-similar +summary: Test AVC issues related to tclass anon_inode +description: | + Test coverage for cases verifying avc denial issues related to + anon_inode tclass. +adjust: +- enabled: false + when: distro < rhel-9 diff --git a/selinux-policy/anon_inode-and-similar/reproducer.c b/selinux-policy/anon_inode-and-similar/reproducer.c new file mode 100644 index 0000000..9759c2c --- /dev/null +++ b/selinux-policy/anon_inode-and-similar/reproducer.c @@ -0,0 +1,84 @@ +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +static void test_assert(int cond) { + if (!cond) { + abort(); + } +} + +static void do_child(int sock) { + int fd; + struct msghdr msg; + char mbuf; + struct iovec iov = { &mbuf, 1 }; + char cbuf[CMSG_SPACE(sizeof(fd))]; + const struct cmsghdr* cmsg; + + memset(&msg, 0, sizeof(msg)); + msg.msg_iov = &iov; + msg.msg_iovlen = 1; + msg.msg_control = cbuf; + msg.msg_controllen = sizeof(cbuf); + + test_assert(recvmsg(sock, &msg, 0) == 1); + test_assert(mbuf == 'x'); + + test_assert(!(msg.msg_flags & MSG_CTRUNC)); + test_assert(msg.msg_controllen == CMSG_SPACE(sizeof(fd))); + cmsg = CMSG_FIRSTHDR(&msg); + test_assert(SOL_SOCKET == cmsg->cmsg_level && SCM_RIGHTS == cmsg->cmsg_type); + memcpy(&fd, CMSG_DATA(cmsg), sizeof(fd)); + + printf("fd=%d\n", fd); +} + +#define USER_MODE_ONLY 1 + +int main(void) { + int sockfds[2]; + pid_t child; + int fd; + struct msghdr msg; + struct iovec iov = { "x", 1 }; + char cbuf[CMSG_SPACE(sizeof(fd))]; + struct cmsghdr* cmsg; + ssize_t nsent; + int status; + + test_assert(0 == socketpair(AF_LOCAL, SOCK_STREAM, 0, sockfds)); + + if (0 == (child = fork())) { + do_child(sockfds[1]); + return 0; + } + + fd = syscall(SYS_userfaultfd, USER_MODE_ONLY); + test_assert(fd >= 0); + + memset(&msg, 0, sizeof(msg)); + msg.msg_iov = &iov; + msg.msg_iovlen = 1; + msg.msg_control = cbuf; + msg.msg_controllen = sizeof(cbuf); + cmsg = CMSG_FIRSTHDR(&msg); + cmsg->cmsg_level = SOL_SOCKET; + cmsg->cmsg_type = SCM_RIGHTS; + cmsg->cmsg_len = CMSG_LEN(sizeof(fd)); + memcpy(CMSG_DATA(cmsg), &fd, sizeof(fd)); + + test_assert(sendmsg(sockfds[0], &msg, 0) == 1); + + test_assert(child == waitpid(child, &status, 0)); + test_assert(WIFEXITED(status) && 0 == WEXITSTATUS(status)); + + return 0; +} diff --git a/selinux-policy/anon_inode-and-similar/runtest.sh b/selinux-policy/anon_inode-and-similar/runtest.sh new file mode 100755 index 0000000..0a2bf68 --- /dev/null +++ b/selinux-policy/anon_inode-and-similar/runtest.sh @@ -0,0 +1,63 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/anon_inode-and-similar +# Description: Test coverage for cases verifying avc denial issues related to anon_inode tclass. +# Author: Amith Kumar +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2021 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include rhts environment +. /usr/bin/rhts-environment.sh +. /usr/share/beakerlib/beakerlib.sh + +PACKAGE="selinux-policy" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm gcc + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "SELinux policy prevents userfaultfds bz1974559" + rlRun "gcc -o reproducer reproducer.c" + tst_Time="$(date '+%T')" + rlRun "./reproducer" + sleep 3 + rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time" 1 + rlSESearchRule "allow unconfined_t unconfined_t : anon_inode { write }" + rlRun "rm -f reproducer" + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + rlPhaseEnd + rlJournalPrintText +rlJournalEnd From 37adc8484f605fb6ec13bd0e31e932eb86cb1202 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 5 Oct 2021 10:08:23 +0200 Subject: [PATCH 079/626] avoid testing empty CIL modules SELinux user-space of version 3.3 and higher does not support loading of empty CIL modules. If such version is installed, one of the test phases will be skipped. --- .../CIL-modules-without-compilation/Makefile | 2 +- .../runtest.sh | 20 ++++++++++++++++++- 2 files changed, 20 insertions(+), 2 deletions(-) diff --git a/policycoreutils/CIL-modules-without-compilation/Makefile b/policycoreutils/CIL-modules-without-compilation/Makefile index 2d8a660..a16e88d 100644 --- a/policycoreutils/CIL-modules-without-compilation/Makefile +++ b/policycoreutils/CIL-modules-without-compilation/Makefile @@ -53,7 +53,7 @@ $(METADATA): Makefile @echo "Type: Sanity" >> $(METADATA) @echo "TestTime: 5m" >> $(METADATA) @echo "RunFor: policycoreutils" >> $(METADATA) - @echo "Requires: policycoreutils" >> $(METADATA) + @echo "Requires: /usr/sbin/semodule /usr/sbin/semanage" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @echo "License: GPLv2" >> $(METADATA) @echo "Confidential: no" >> $(METADATA) diff --git a/policycoreutils/CIL-modules-without-compilation/runtest.sh b/policycoreutils/CIL-modules-without-compilation/runtest.sh index 451461a..a121c58 100755 --- a/policycoreutils/CIL-modules-without-compilation/runtest.sh +++ b/policycoreutils/CIL-modules-without-compilation/runtest.sh @@ -31,14 +31,18 @@ . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="policycoreutils" +PACKAGE_VERSION=`rpm -q --queryformat '%{version}' ${PACKAGE}` rlJournalStart rlPhaseStartSetup rlAssertRpm $PACKAGE rlRun "echo '()' > empty.cil" + rlRun "echo '( auditallow init_t security_t ( security ( setsecparam )))' > valid.cil" rlRun "echo '(())' > invalid.cil" rlPhaseEnd + # version 3.3 of SELinux user-space does not accept empty CIL module + if echo "${PACKAGE_VERSION} < 3.3" | bc | grep -q 1 ; then rlPhaseStartTest "empty CIL module" rlRun "semodule -lfull | grep '400.*empty.*cil'" 1 rlRun "semodule -i empty.cil" @@ -51,6 +55,20 @@ rlJournalStart rlRun "semanage module -r empty" rlRun "semanage module -l | grep 'empty.*400.*cil'" 1 rlPhaseEnd + fi + + rlPhaseStartTest "valid CIL module" + rlRun "semodule -lfull | grep '400.*valid.*cil'" 1 + rlRun "semodule -i valid.cil" + rlRun "semodule -lfull | grep '400.*valid.*cil'" + rlRun "semodule -r valid" + rlRun "semodule -lfull | grep '400.*valid.*cil'" 1 + rlRun "semanage module -l | grep 'valid.*400.*cil'" 1 + rlRun "semanage module -a valid.cil" + rlRun "semanage module -l | grep 'valid.*400.*cil'" + rlRun "semanage module -r valid" + rlRun "semanage module -l | grep 'valid.*400.*cil'" 1 + rlPhaseEnd rlPhaseStartTest "invalid CIL module" rlRun "semodule -lfull | grep '400.*invalid.*cil'" 1 @@ -66,7 +84,7 @@ rlJournalStart rlPhaseEnd rlPhaseStartCleanup - rlRun "rm -f empty.cil invalid.cil" + rlRun "rm -f empty.cil valid.cil invalid.cil" rlPhaseEnd rlJournalPrintText rlJournalEnd From c1eb05380135ceaae0eb51c3de56730de065b5cb Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Wed, 13 Oct 2021 11:01:00 +0200 Subject: [PATCH 080/626] kernel/selinux-testsuite: bump upstream ref This pulls in the lockdown test removal, which will be needed for successful testing of new kernels. Signed-off-by: Ondrej Mosnacek --- kernel/selinux-testsuite/runtest.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/selinux-testsuite/runtest.sh b/kernel/selinux-testsuite/runtest.sh index 728c237..583276f 100755 --- a/kernel/selinux-testsuite/runtest.sh +++ b/kernel/selinux-testsuite/runtest.sh @@ -35,7 +35,7 @@ PACKAGE="selinux-policy" # This should be updated as needed after verifying that the new version # doesn't break testing and after applying all necessary tweaks in the TC. # Run with GIT_BRANCH=master to run the latest upstream version. -DEFAULT_COMMIT="29c42c865a9f43a15ae72ebd19642c3d88a7d5ce" +DEFAULT_COMMIT="bba37c007a0c7a12dd603bdac5e4431796f3e2e1" # Default pull requests to merge before running the test. # If non-empty, then after checking out GIT_BRANCH the listed upstream pull # requests (by number) are merged, creating a new temporary local branch. From 735763c486c0be541c4772b4b39be8e0b6134f92 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Wed, 13 Oct 2021 20:35:51 +0200 Subject: [PATCH 081/626] require the service command instead of its package Recently, the service command was moved from the initscripts package to the initscripts-service package. The service command is necessary for operations with audit daemon, because it's not possible to restart the audit daemon using the systemctl command. Now, the SELinux beaker library requires the /usr/sbin/service command instead of a package name. --- selinux-policy/Library/common/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/selinux-policy/Library/common/Makefile b/selinux-policy/Library/common/Makefile index 07d41bb..b274700 100644 --- a/selinux-policy/Library/common/Makefile +++ b/selinux-policy/Library/common/Makefile @@ -46,11 +46,11 @@ $(METADATA): Makefile @echo "Description: Common library for SELinux related components" >> $(METADATA) @echo "Type: Library" >> $(METADATA) @echo "TestTime: 120m" >> $(METADATA) - @echo "Requires: setools" >> $(METADATA) @echo "Requires: setools-console" >> $(METADATA) @echo "Requires: expect" >> $(METADATA) @echo "Requires: policycoreutils" >> $(METADATA) @echo "Requires: /usr/sbin/semanage" >> $(METADATA) + @echo "Requires: /usr/sbin/service" >> $(METADATA) @echo "Requires: selinux-policy-devel" >> $(METADATA) @echo "Requires: yum-utils" >> $(METADATA) @echo "Requires: python3 sqlite" >> $(METADATA) From b0f7063a8d1044ee7c47e5befe9c5ce7399f91a9 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Wed, 27 Oct 2021 13:52:48 +0200 Subject: [PATCH 082/626] kernel/selinux-testsuite: bump upstream commit Pull in a fix that allows the testsuite to succeed on kernels with CONFIG_IP_TABLES=n (e.g. Fedora ELN kernels; future RHEL 10+ kernels). Signed-off-by: Ondrej Mosnacek --- kernel/selinux-testsuite/runtest.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/selinux-testsuite/runtest.sh b/kernel/selinux-testsuite/runtest.sh index 583276f..4bf8617 100755 --- a/kernel/selinux-testsuite/runtest.sh +++ b/kernel/selinux-testsuite/runtest.sh @@ -35,7 +35,7 @@ PACKAGE="selinux-policy" # This should be updated as needed after verifying that the new version # doesn't break testing and after applying all necessary tweaks in the TC. # Run with GIT_BRANCH=master to run the latest upstream version. -DEFAULT_COMMIT="bba37c007a0c7a12dd603bdac5e4431796f3e2e1" +DEFAULT_COMMIT="b2d0f3c5f946e58e3e6f8f1fff81d8435b005f92" # Default pull requests to merge before running the test. # If non-empty, then after checking out GIT_BRANCH the listed upstream pull # requests (by number) are merged, creating a new temporary local branch. From bf766edd958204a94cfb012ffe31b1531133fd2e Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Wed, 27 Oct 2021 09:29:26 +0200 Subject: [PATCH 083/626] fix 2 failing test phases Test phase devoted to BZ#1614236 looked for getattr and open permissions, but they are not listed in the bug report. The only permission mentioned in the bug report is read and that will be tested from now on. Because BZ#1878094 is not yet fixed, the cleanup phase finds certain SELinux denials that appeared during the run of the automated test. These SELinux denials are related to the way systemd and SELinux policy handle the creation of objects under /run/user// directory. Because they are not related to D-bus services, they will be ignored from now on. --- selinux-policy/bz481628-send-msg-to-dbus/runtest.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/selinux-policy/bz481628-send-msg-to-dbus/runtest.sh b/selinux-policy/bz481628-send-msg-to-dbus/runtest.sh index c0bdbd9..1ad9cb7 100755 --- a/selinux-policy/bz481628-send-msg-to-dbus/runtest.sh +++ b/selinux-policy/bz481628-send-msg-to-dbus/runtest.sh @@ -99,7 +99,7 @@ rlJournalStart rlPhaseStartTest "bz#1614236" rlSEMatchPathCon "/usr/bin/dbus-daemon" "dbusd_exec_t" rlSEMatchPathCon "/dev/nvme0n1p1" "nvme_device_t" - rlSESearchRule "allow system_dbusd_t nvme_device_t : blk_file { getattr open read }" + rlSESearchRule "allow system_dbusd_t nvme_device_t : blk_file { read } [ ]" rlPhaseEnd fi @@ -161,7 +161,7 @@ rlJournalStart rlPhaseStartCleanup sleep 2 - rlSECheckAVC + rlSECheckAVC --ignore 'type=AVC .* create .*systemd .*:user_t:.*:user_tmp_t:.*tclass=dir' rm -f files.txt rlFileRestore From 282a711d46f475cbe3318ff3c1a9664401c6e008 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Thu, 25 Nov 2021 10:31:26 +0100 Subject: [PATCH 084/626] test if the nfsdcld service is confined on RHEL-8 The same issue as described in BZ#1834234 is reproducible on RHEL-8. It will be tested the same way. The TC covers BZ#2026588. --- selinux-policy/nfsdcld-and-similar/Makefile | 3 ++- selinux-policy/nfsdcld-and-similar/runtest.sh | 4 +--- 2 files changed, 3 insertions(+), 4 deletions(-) diff --git a/selinux-policy/nfsdcld-and-similar/Makefile b/selinux-policy/nfsdcld-and-similar/Makefile index 0de572a..cece726 100644 --- a/selinux-policy/nfsdcld-and-similar/Makefile +++ b/selinux-policy/nfsdcld-and-similar/Makefile @@ -54,7 +54,7 @@ $(METADATA): Makefile @echo "Type: Regression" >> $(METADATA) @echo "TestTime: 10m" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit initscripts libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console nfs-utils" >> $(METADATA) + @echo "Requires: audit /usr/sbin/service libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console nfs-utils" >> $(METADATA) @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @@ -63,6 +63,7 @@ $(METADATA): Makefile @echo "Destructive: no" >> $(METADATA) @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) @echo "Bug: 1834234" >> $(METADATA) # Fedora 32 + @echo "Bug: 2026588" >> $(METADATA) # RHEL-8 rhts-lint $(METADATA) diff --git a/selinux-policy/nfsdcld-and-similar/runtest.sh b/selinux-policy/nfsdcld-and-similar/runtest.sh index 5303eac..bb43287 100755 --- a/selinux-policy/nfsdcld-and-similar/runtest.sh +++ b/selinux-policy/nfsdcld-and-similar/runtest.sh @@ -56,15 +56,13 @@ rlJournalStart sleep 2 rlPhaseEnd - if ! rlIsRHEL 8 ; then - rlPhaseStartTest "bz#1834234" + rlPhaseStartTest "bz#1834234 + bz#2026588" rlSEMatchPathCon "/usr/sbin/nfsdcld" "rpcd_exec_t" rlSESearchRule "allow init_t rpcd_exec_t : file { getattr open read execute } [ ]" rlSESearchRule "type_transition init_t rpcd_exec_t : process rpcd_t" rlSESearchRule "allow init_t rpcd_t : process { transition } [ ]" rlSESearchRule "allow rpcd_t nfsd_fs_t : file { getattr open read } [ ]" rlPhaseEnd - fi rlPhaseStartTest "real scenario -- standalone service" rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" From 4e4c91dbc4252df1769929be23883f4a70026c94 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Thu, 2 Dec 2021 14:39:31 +0100 Subject: [PATCH 085/626] Test semodule -l --checksum --- policycoreutils/semodule-l-checksum/Makefile | 64 +++++++++++++++ policycoreutils/semodule-l-checksum/PURPOSE | 3 + policycoreutils/semodule-l-checksum/main.fmf | 8 ++ .../semodule-l-checksum/runtest.sh | 79 +++++++++++++++++++ 4 files changed, 154 insertions(+) create mode 100644 policycoreutils/semodule-l-checksum/Makefile create mode 100644 policycoreutils/semodule-l-checksum/PURPOSE create mode 100644 policycoreutils/semodule-l-checksum/main.fmf create mode 100755 policycoreutils/semodule-l-checksum/runtest.sh diff --git a/policycoreutils/semodule-l-checksum/Makefile b/policycoreutils/semodule-l-checksum/Makefile new file mode 100644 index 0000000..875a9b8 --- /dev/null +++ b/policycoreutils/semodule-l-checksum/Makefile @@ -0,0 +1,64 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/policycoreutils/Sanity/bz1731501-Test-semodule-l-checksum +# Description: Test semodule -l --checksum +# Author: Petr Lautrbach +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2021 Red Hat, Inc. +# +# This program is free software: you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation, either version 2 of +# the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see http://www.gnu.org/licenses/. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/policycoreutils/Sanity/bz1731501-Test-semodule-l-checksum +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + test -x runtest.sh || chmod a+x runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Petr Lautrbach " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: Test semodule -l --checksum" >> $(METADATA) + @echo "Type: Sanity" >> $(METADATA) + @echo "TestTime: 5m" >> $(METADATA) + @echo "RunFor: policycoreutils" >> $(METADATA) + @echo "Requires: policycoreutils selinux-policy-devel" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2+" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Bug: 1731501 2026680" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL6 -RHEL7 -RHELClient5 -RHELServer5" >> $(METADATA) + + rhts-lint $(METADATA) diff --git a/policycoreutils/semodule-l-checksum/PURPOSE b/policycoreutils/semodule-l-checksum/PURPOSE new file mode 100644 index 0000000..a11f95a --- /dev/null +++ b/policycoreutils/semodule-l-checksum/PURPOSE @@ -0,0 +1,3 @@ +PURPOSE of /CoreOS/policycoreutils/Sanity/bz1731501-Test-semodule-l-checksum +Description: Test semodule -l --checksum +Author: Petr Lautrbach diff --git a/policycoreutils/semodule-l-checksum/main.fmf b/policycoreutils/semodule-l-checksum/main.fmf new file mode 100644 index 0000000..68b9946 --- /dev/null +++ b/policycoreutils/semodule-l-checksum/main.fmf @@ -0,0 +1,8 @@ +path: /policycoreutils/semodule-l-checksum +summary: Test semodule -l --checksum +description: | + semodule -l --checksum shows sha256 checksum of loaded modules and this test is supposed to test it +duration: 10m +adjust: +- enabled: false + when: distro < rhel-8 diff --git a/policycoreutils/semodule-l-checksum/runtest.sh b/policycoreutils/semodule-l-checksum/runtest.sh new file mode 100755 index 0000000..eabd453 --- /dev/null +++ b/policycoreutils/semodule-l-checksum/runtest.sh @@ -0,0 +1,79 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/policycoreutils/Sanity/bz1731501-Test-semodule-l-checksum +# Description: Test semodule -l --checksum +# Author: Petr Lautrbach +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2021 Red Hat, Inc. +# +# This program is free software: you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation, either version 2 of +# the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see http://www.gnu.org/licenses/. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="policycoreutils" + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm $PACKAGE + rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" + rlRun "pushd $TmpDir" + # create new type, allow reading, do not allow writing + rlRun "cat << EOF >test_module.te +module test_module 1.0; + +require { + type unconfined_t; + attribute filesystem_type; + class file { getattr ioctl lock open read relabelto write }; + class filesystem { associate }; +} + +type test_t; + +allow test_t filesystem_type:filesystem { associate }; +allow unconfined_t test_t:file { getattr ioctl lock open read relabelto}; +dontaudit unconfined_t test_t:file { write }; +EOF" + # compile the module + rlRun "make -f /usr/share/selinux/devel/Makefile test_module.pp" + # load it + rlRun "semodule -X 500 -i test_module.pp" + rlRun "/usr/libexec/selinux/hll/pp test_module.pp test_module.cil" + + rlPhaseEnd + + rlPhaseStartTest "semodule -lfull --checksum" + rlRun "semodule -lfull --checksum | grep test_module" + module=($(semodule -lfull --checksum | grep test_module) ) + sha256=($(sha256sum test_module.cil)) + rlAssertEquals "Is the module name 'test_module'?" ${module[1]} "test_module" + rlAssertEquals "Is the module priority '500'?" ${module[0]} "500" + rlAssertEquals "Is the loaded module checksum same as the file checksum? " ${module[3]} ${sha256[0]} + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "semodule -X 500 -r test_module" + rlRun "popd" + rlRun "rm -r $TmpDir" 0 "Removing tmp directory" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd From 2efd81d89986db99cc4b906345196aa998604944 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 30 Nov 2021 17:56:07 +0100 Subject: [PATCH 086/626] add the smbcontrol test to upstream repo The smbcontrol program is frequently used by various users on Fedora and RHEL, so it makes sense to run this TC in upstream testing too. There are no changes in the TC functionality. Moving the downstream TC to upstream repo. --- .../smbcontrol-and-similar/Makefile | 70 +++++++++++ selinux-policy/smbcontrol-and-similar/PURPOSE | 5 + .../smbcontrol-and-similar/main.fmf | 2 + .../smbcontrol-and-similar/runtest.sh | 109 ++++++++++++++++++ 4 files changed, 186 insertions(+) create mode 100644 selinux-policy/smbcontrol-and-similar/Makefile create mode 100644 selinux-policy/smbcontrol-and-similar/PURPOSE create mode 100644 selinux-policy/smbcontrol-and-similar/main.fmf create mode 100755 selinux-policy/smbcontrol-and-similar/runtest.sh diff --git a/selinux-policy/smbcontrol-and-similar/Makefile b/selinux-policy/smbcontrol-and-similar/Makefile new file mode 100644 index 0000000..ff42946 --- /dev/null +++ b/selinux-policy/smbcontrol-and-similar/Makefile @@ -0,0 +1,70 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/smbcontrol-and-similar +# Description: SELinux interferes with smbcontrol and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/smbcontrol-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with smbcontrol and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 15m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console samba-common samba-common-tools" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5" >> $(METADATA) + @echo "Bug: 1326371" >> $(METADATA) # RHEL-7 + @echo "Bug: 1326621" >> $(METADATA) # RHEL-6 + @echo "Bug: 1574518" >> $(METADATA) # RHEL-8 + @echo "Bug: 1574521" >> $(METADATA) # RHEL-7 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/smbcontrol-and-similar/PURPOSE b/selinux-policy/smbcontrol-and-similar/PURPOSE new file mode 100644 index 0000000..fe8b846 --- /dev/null +++ b/selinux-policy/smbcontrol-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/smbcontrol-and-similar +Author: Milos Malik + +SELinux interferes with smbcontrol and related programs. + diff --git a/selinux-policy/smbcontrol-and-similar/main.fmf b/selinux-policy/smbcontrol-and-similar/main.fmf new file mode 100644 index 0000000..9bf5795 --- /dev/null +++ b/selinux-policy/smbcontrol-and-similar/main.fmf @@ -0,0 +1,2 @@ +path: /selinux-policy/smbcontrol-and-similar +tier: 2 diff --git a/selinux-policy/smbcontrol-and-similar/runtest.sh b/selinux-policy/smbcontrol-and-similar/runtest.sh new file mode 100755 index 0000000..be1dd40 --- /dev/null +++ b/selinux-policy/smbcontrol-and-similar/runtest.sh @@ -0,0 +1,109 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/smbcontrol-and-similar +# Description: SELinux interferes with smbcontrol and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +FILE_PATH="/usr/bin/smbcontrol" +FILE_CONTEXT="smbcontrol_exec_t" +if rlIsRHEL 6 ; then + SERVICE_PACKAGE="samba-common" +else + SERVICE_PACKAGE="samba-common-tools" +fi +PROCESS_NAME="smbcontrol" +PROCESS_CONTEXT="smbcontrol_t" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlFileBackup /etc/shadow + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "bz#1326371 + bz#1326621" + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + SOURCE_TYPE="unconfined_t" + BOOLEANS="[ ]" + rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" + rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" + rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" + rlSESearchRule "allow smbcontrol_t samba_var_t : dir { ioctl read write getattr lock add_name remove_name search open }" + rlSESearchRule "allow smbcontrol_t samba_var_t : file { ioctl read write create getattr setattr lock append unlink link rename open }" + rlSESearchRule "allow smbcontrol_t samba_var_t : sock_file { ioctl read write create getattr setattr lock append unlink link rename open }" + rlSESearchRule "allow smbd_t smbcontrol_t : unix_dgram_socket { sendto }" + rlSESearchRule "allow smbcontrol_t smbd_t : unix_dgram_socket { sendto }" + rlSESearchRule "allow nmbd_t smbcontrol_t : unix_dgram_socket { sendto }" + rlSESearchRule "allow smbcontrol_t nmbd_t : unix_dgram_socket { sendto }" + rlSESearchRule "allow winbind_t smbcontrol_t : unix_dgram_socket { sendto }" + rlSESearchRule "allow smbcontrol_t winbind_t : unix_dgram_socket { sendto }" + rlSESearchRule "allow smbcontrol_t smbcontrol_t : unix_dgram_socket { create ioctl read getattr lock write setattr append bind connect getopt setopt shutdown }" + rlSESearchRule "allow smbcontrol_t smbcontrol_t : process { signal signull }" + rlPhaseEnd + + if ! rlIsRHEL 5 6 ; then + rlPhaseStartTest "bz#1574518 + bz#1574521" + rlSEMatchPathCon "/usr/bin/smbcontrol" "smbcontrol_exec_t" + rlSEMatchPathCon "/var/lib/samba/lock" "samba_var_t" + # following rule assumes that samba_var_lock_t type is not defined + rlSESearchRule "allow smbcontrol_t samba_var_t : dir { create add_name write }" + rlPhaseEnd + fi + + rlPhaseStartTest "real scenario" + if ! rlIsRHEL 5 6 ; then + rlRun "ls -Z /var/lib/samba/lock" + fi + rlRun "smbcontrol nmbd ping" 0,1 + rlRun "smbcontrol smbd ping" 0,1 + rlRun "smbcontrol winbindd ping" 0,1 + if ! rlIsRHEL 5 6 ; then + rlRun "ls -Z /var/lib/samba/lock" + fi + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + From 32c565fc64cad5e0ff5d88bb50a7809e4098b7e4 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 30 Nov 2021 18:20:41 +0100 Subject: [PATCH 087/626] test if smbcontrol can work with netlink_route_socket + udp_socket Recent smbcontrol testing revealed that SELinux prevents the program from creating and using netlink_route sockets and UDP sockets. The TC reproduces the situation. Even though the smbcontrol program did not require such permissions in previous versions, I believe that SELinux policy should allow the program to do these actions. Otherwise, the following error messages will keep on appearing: ERROR: Could not determine network interfaces, you must use a interfaces config line The TC covers BZ#2025931, BZ#2027740, BZ#2027751. --- selinux-policy/smbcontrol-and-similar/Makefile | 3 +++ selinux-policy/smbcontrol-and-similar/runtest.sh | 7 +++++++ 2 files changed, 10 insertions(+) diff --git a/selinux-policy/smbcontrol-and-similar/Makefile b/selinux-policy/smbcontrol-and-similar/Makefile index ff42946..853e5b3 100644 --- a/selinux-policy/smbcontrol-and-similar/Makefile +++ b/selinux-policy/smbcontrol-and-similar/Makefile @@ -65,6 +65,9 @@ $(METADATA): Makefile @echo "Bug: 1326621" >> $(METADATA) # RHEL-6 @echo "Bug: 1574518" >> $(METADATA) # RHEL-8 @echo "Bug: 1574521" >> $(METADATA) # RHEL-7 + @echo "Bug: 2025931" >> $(METADATA) # Fedora 35 + @echo "Bug: 2027740" >> $(METADATA) # RHEL-8 + @echo "Bug: 2027751" >> $(METADATA) # RHEL-9 rhts-lint $(METADATA) diff --git a/selinux-policy/smbcontrol-and-similar/runtest.sh b/selinux-policy/smbcontrol-and-similar/runtest.sh index be1dd40..864888f 100755 --- a/selinux-policy/smbcontrol-and-similar/runtest.sh +++ b/selinux-policy/smbcontrol-and-similar/runtest.sh @@ -86,6 +86,13 @@ rlJournalStart rlPhaseEnd fi + if ! rlIsRHEL 5 6 7 ; then + rlPhaseStartTest "bz#2025931 + bz#2027740 + bz#2027751" + rlSESearchRule "allow smbcontrol_t smbcontrol_t : netlink_route_socket { create bind getattr nlmsg_read} [ ]" + rlSESearchRule "allow smbcontrol_t smbcontrol_t : udp_socket { create ioctl } [ ]" + rlPhaseEnd + fi + rlPhaseStartTest "real scenario" if ! rlIsRHEL 5 6 ; then rlRun "ls -Z /var/lib/samba/lock" From 0dab3f0467d6e7cfa5034a99d7a94829bb1b0601 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Wed, 1 Dec 2021 19:59:57 +0100 Subject: [PATCH 088/626] update the cups-lpd test to the latest version The downstream version of the automated test covers more bugs than the upstream version. Before the downstream test can be replaced by a wrapper that calls the upstream one, both versions should be in sync. --- selinux-policy/cups-lpd-and-similar/Makefile | 6 ++++- .../cups-lpd-and-similar/runtest.sh | 26 +++++++++++++++---- 2 files changed, 26 insertions(+), 6 deletions(-) diff --git a/selinux-policy/cups-lpd-and-similar/Makefile b/selinux-policy/cups-lpd-and-similar/Makefile index dcbcdc2..c3a0bdd 100644 --- a/selinux-policy/cups-lpd-and-similar/Makefile +++ b/selinux-policy/cups-lpd-and-similar/Makefile @@ -55,7 +55,7 @@ $(METADATA): Makefile @echo "TestTime: 20m" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) @echo "RunFor: cups" >> $(METADATA) - @echo "Requires: audit expect policycoreutils-python-utils selinux-policy-devel libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools setools-console xinetd nmap-ncat nc net-tools cups-lpd chkconfig initscripts" >> $(METADATA) + @echo "Requires: audit expect policycoreutils-python-utils selinux-policy-devel libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools setools-console xinetd nmap-ncat nc net-tools cups-lpd chkconfig /usr/sbin/service" >> $(METADATA) @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @echo "License: GPLv2" >> $(METADATA) @@ -63,9 +63,13 @@ $(METADATA): Makefile @echo "Destructive: no" >> $(METADATA) @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) @echo "Releases: -RHEL4" >> $(METADATA) + @echo "Bug: 192216" >> $(METADATA) # Fedora 5 @echo "Bug: 1004198" >> $(METADATA) # RHEL-7 + @echo "Bug: 1420522" >> $(METADATA) # Fedora 24 @echo "Bug: 1554118" >> $(METADATA) # RHEL-8 @echo "Bug: 1919399" >> $(METADATA) # RHEL-8 + @echo "Bug: 1947397" >> $(METADATA) # RHEL-9 + @echo "Bug: 2020531" >> $(METADATA) # Fedora 35 rhts-lint $(METADATA) diff --git a/selinux-policy/cups-lpd-and-similar/runtest.sh b/selinux-policy/cups-lpd-and-similar/runtest.sh index e9e01a5..3d30478 100755 --- a/selinux-policy/cups-lpd-and-similar/runtest.sh +++ b/selinux-policy/cups-lpd-and-similar/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" @@ -59,6 +58,13 @@ rlJournalStart sleep 2 rlPhaseEnd + rlPhaseStartTest "bz#192216" + rlSEMatchPathCon "/usr/lib/cups/daemon/cups-lpd" "cupsd_lpd_exec_t" + rlSEMatchPathCon "/var/run/cups" "cupsd_var_run_t" + rlSESearchRule "allow cupsd_lpd_t cupsd_var_run_t : dir { search } [ ]" + rlSESearchRule "allow cupsd_lpd_t cupsd_lpd_t : netlink_route_socket { create } [ ]" + rlPhaseEnd + rlPhaseStartTest "bz#1004198" if rlIsRHEL 5 ; then SOURCE_TYPE="inetd_t" # xinetd runs the process @@ -78,24 +84,34 @@ rlJournalStart fi rlPhaseEnd - rlPhaseStartTest "bz#1554118" + rlPhaseStartTest "bz#1420522 + bz#1554118" rlSEMatchPathCon "/usr/lib/cups/daemon/cups-lpd" "cupsd_lpd_exec_t" rlSESearchRule "allow init_t cupsd_lpd_t : tcp_socket { create setopt bind listen }" rlPhaseEnd - rlPhaseStartTest "bz#1919399" + rlPhaseStartTest "bz#1919399 + bz#1947397" rlSEMatchPathCon "/usr/lib/cups/daemon/cups-lpd" "cupsd_lpd_exec_t" rlSEMatchPathCon "/run/cups/cups.sock" "cupsd_var_run_t" rlSESearchRule "allow cupsd_lpd_t cupsd_var_run_t : sock_file { read } [ ]" rlPhaseEnd - rlPhaseStartTest "real scenario -- BZ#1919399" + if ! rlIsRHEL 5 6 7 8 ; then + rlPhaseStartTest "bz#2020531" + rlSEMatchPathCon "/usr/lib/cups/daemon/cups-lpd" "cupsd_lpd_exec_t" + rlRun "ls -Z /proc/1/environ | grep :init_t" + rlSESearchRule "dontaudit cupsd_lpd_t init_t : dir { search } [ ]" + rlPhaseEnd + fi + + rlPhaseStartTest "real scenario -- bz#1919399 + bz#1947397" rlRun "systemctl start cups.service" rlRun "systemctl enable cups-lpd.socket" rlRun "systemctl start cups-lpd.socket" - rlRun "lpadmin -p test -E" + sleep 2 + rlRun "lpadmin -p test -o printer-is-shared=true -E" rlRun "DEVICE_URI=lpd://127.0.0.1/test /usr/lib/cups/backend/lpd 1 user test 1 '' /etc/fstab" sleep 5 + rlRun "lpadmin -x test" rlRun "systemctl stop cups-lpd.socket" rlRun "systemctl disable cups-lpd.socket" rlRun "systemctl stop cups.service" From 9cc7eb5ca3c3c26d634d499f7486daa0d3a94aa9 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Thu, 9 Dec 2021 16:00:53 +0100 Subject: [PATCH 089/626] test if user can check status of its user manager Recent confined users testing revealed that SELinux prevents the user_u user from checking the status of its user@ service. The TC reproduces the scenario. The TC checks the related file context patterns and looks for appropriate policy rules which make this scenario working again. The TC covers BZ#2017838. --- selinux-policy/journalctl-and-similar/Makefile | 1 + selinux-policy/journalctl-and-similar/runtest.sh | 13 ++++++++++++- 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/selinux-policy/journalctl-and-similar/Makefile b/selinux-policy/journalctl-and-similar/Makefile index 255fcdf..65967a4 100644 --- a/selinux-policy/journalctl-and-similar/Makefile +++ b/selinux-policy/journalctl-and-similar/Makefile @@ -67,6 +67,7 @@ $(METADATA): Makefile @echo "Bug: 1288255" >> $(METADATA) # RHEL-7 @echo "Bug: 1685689" >> $(METADATA) # RHEL-8 @echo "Bug: 1825894" >> $(METADATA) # RHEL-8 + @echo "Bug: 2017838" >> $(METADATA) # RHEL-9 rhts-lint $(METADATA) diff --git a/selinux-policy/journalctl-and-similar/runtest.sh b/selinux-policy/journalctl-and-similar/runtest.sh index 95e5d64..d7b8fd7 100755 --- a/selinux-policy/journalctl-and-similar/runtest.sh +++ b/selinux-policy/journalctl-and-similar/runtest.sh @@ -90,6 +90,15 @@ rlJournalStart rlSESearchRule "allow journalctl_t journalctl_t : process { setrlimit } [ ]" rlPhaseEnd + if ! rlIsFedora ; then + rlPhaseStartTest "bz#2017838" + rlSEMatchPathCon "/run/log/journal/somehash/system.journal" "syslogd_var_run_t" + rlSEMatchPathCon "/var/lib/systemd/catalog/database" "init_var_lib_t" + rlSESearchRule "allow user_t init_var_lib_t : file { open read map } [ ]" + rlSESearchRule "allow user_t syslogd_var_run_t : file { open read map } [ ]" + rlPhaseEnd + fi + rlPhaseStartTest "real scenario -- confined users" rlSEConfigureSSH @@ -103,6 +112,8 @@ rlJournalStart rlRun "usermod -G systemd-journal ${USER_NAME}" rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost journalctl -n 10 --no-pager --user" rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost journalctl -n 10 --no-pager --system" + USER_ID=`id -u ${USER_NAME}` + rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost systemctl status user@${USER_ID}" rlRun "userdel -rfZ ${USER_NAME}" sleep 10 done @@ -114,7 +125,7 @@ rlJournalStart rlPhaseStartCleanup sleep 2 - rlSECheckAVC + rlSECheckAVC --ignore 'type=AVC .* create .*systemd.* scontext=.*:user_t:.* tcontext=.*:user_tmp_t:.* tclass=dir' rlPhaseEnd rlJournalPrintText rlJournalEnd From 9329983a575d4176258195dd689e81baf24c086f Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Thu, 6 Jan 2022 10:51:50 +0100 Subject: [PATCH 090/626] test if smbcontrol can read the /proc/net/unix file Recent smbcontrol testing in certain environments revealed that the smbcontrol process wants to read the /proc/net/unix file, but SELinux denies that access. The TC reproduces the situation. Not sure why the smbcontrol process wants to access the /proc/net/unix file, but current SELinux policy allows a lot of SELinux domains to read that file, which means that the behavior is pretty common. The TC looks for appropriate allow rule. The TC covers BZ#2033873. --- selinux-policy/smbcontrol-and-similar/Makefile | 1 + selinux-policy/smbcontrol-and-similar/runtest.sh | 5 +++++ 2 files changed, 6 insertions(+) diff --git a/selinux-policy/smbcontrol-and-similar/Makefile b/selinux-policy/smbcontrol-and-similar/Makefile index 853e5b3..14bc31f 100644 --- a/selinux-policy/smbcontrol-and-similar/Makefile +++ b/selinux-policy/smbcontrol-and-similar/Makefile @@ -68,6 +68,7 @@ $(METADATA): Makefile @echo "Bug: 2025931" >> $(METADATA) # Fedora 35 @echo "Bug: 2027740" >> $(METADATA) # RHEL-8 @echo "Bug: 2027751" >> $(METADATA) # RHEL-9 + @echo "Bug: 2033873" >> $(METADATA) # RHEL-8 rhts-lint $(METADATA) diff --git a/selinux-policy/smbcontrol-and-similar/runtest.sh b/selinux-policy/smbcontrol-and-similar/runtest.sh index 864888f..1d618bc 100755 --- a/selinux-policy/smbcontrol-and-similar/runtest.sh +++ b/selinux-policy/smbcontrol-and-similar/runtest.sh @@ -91,6 +91,11 @@ rlJournalStart rlSESearchRule "allow smbcontrol_t smbcontrol_t : netlink_route_socket { create bind getattr nlmsg_read} [ ]" rlSESearchRule "allow smbcontrol_t smbcontrol_t : udp_socket { create ioctl } [ ]" rlPhaseEnd + + rlPhaseStartTest "bz#2033873" + rlSEMatchPathCon "/proc/net/unix" "proc_net_t" + rlSESearchRule "allow smbcontrol_t proc_net_t : file { getattr open read } [ ]" + rlPhaseEnd fi rlPhaseStartTest "real scenario" From e12be9d139b20207884c6b4bdb398a06f3a464ad Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 11 Jan 2022 09:06:39 +0100 Subject: [PATCH 091/626] fix the /proc/net/unix SELinux context check The test phase failed because the following command returned <>: matchpathcon /proc/net/unix SELinux policy does not define a default label for the /proc/net/unix file. The file inherits its SELinux context from the /proc filesystem. As a fix, a simple 'ls -Z' command is used to check the SELinux context. The test phase also covers BZ#2038963 and BZ#2038157, because the same issue appears on RHEL-8 and Fedora 35. --- selinux-policy/smbcontrol-and-similar/Makefile | 2 ++ selinux-policy/smbcontrol-and-similar/runtest.sh | 4 ++-- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/selinux-policy/smbcontrol-and-similar/Makefile b/selinux-policy/smbcontrol-and-similar/Makefile index 14bc31f..1f8ca03 100644 --- a/selinux-policy/smbcontrol-and-similar/Makefile +++ b/selinux-policy/smbcontrol-and-similar/Makefile @@ -69,6 +69,8 @@ $(METADATA): Makefile @echo "Bug: 2027740" >> $(METADATA) # RHEL-8 @echo "Bug: 2027751" >> $(METADATA) # RHEL-9 @echo "Bug: 2033873" >> $(METADATA) # RHEL-8 + @echo "Bug: 2038157" >> $(METADATA) # RHEL-9 + @echo "Bug: 2038963" >> $(METADATA) # Fedora 35 rhts-lint $(METADATA) diff --git a/selinux-policy/smbcontrol-and-similar/runtest.sh b/selinux-policy/smbcontrol-and-similar/runtest.sh index 1d618bc..f6f219e 100755 --- a/selinux-policy/smbcontrol-and-similar/runtest.sh +++ b/selinux-policy/smbcontrol-and-similar/runtest.sh @@ -92,8 +92,8 @@ rlJournalStart rlSESearchRule "allow smbcontrol_t smbcontrol_t : udp_socket { create ioctl } [ ]" rlPhaseEnd - rlPhaseStartTest "bz#2033873" - rlSEMatchPathCon "/proc/net/unix" "proc_net_t" + rlPhaseStartTest "bz#2033873 + bz#2038157 + bz#2038963" + rlRun "ls -Z /proc/net/unix | grep :proc_net_t" rlSESearchRule "allow smbcontrol_t proc_net_t : file { getattr open read } [ ]" rlPhaseEnd fi From dca9d3c17ee3b5948a04e2bae14c42b9a7014ac6 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Tue, 11 Jan 2022 11:19:16 +0100 Subject: [PATCH 092/626] kernel/selinux-testsuite: use HTTPS git URL Recently GitHub has deprecated the git:// protocol and cloning now fails with this message: ``` fatal: remote error: The unauthenticated git protocol on port 9418 is no longer supported. Please see https://github.blog/2021-09-01-improving-git-protocol-security-github/ for more information. ``` The only reason that git:// was being used instead of https:// was allowing the test to run on RHEL-5, which has problems with accessing GitHub via HTTPS due to protocol disparity. By now it should be okay to throw RHEL-5 under the bus and use the https:// URL. Since we are definitely making this test unable to run on RHEL-5, also remove all RHEL-5-specific hacks from the code. Signed-off-by: Ondrej Mosnacek --- kernel/selinux-testsuite/main.fmf | 2 +- kernel/selinux-testsuite/runtest.sh | 52 ++++++++--------------------- 2 files changed, 15 insertions(+), 39 deletions(-) diff --git a/kernel/selinux-testsuite/main.fmf b/kernel/selinux-testsuite/main.fmf index f22925c..2e1376c 100644 --- a/kernel/selinux-testsuite/main.fmf +++ b/kernel/selinux-testsuite/main.fmf @@ -11,6 +11,6 @@ tier: 1 enabled: true adjust: - enabled: false - when: distro < rhel-5 + when: distro < rhel-6 - enabled: false when: arch = i386 diff --git a/kernel/selinux-testsuite/runtest.sh b/kernel/selinux-testsuite/runtest.sh index 4bf8617..184cc68 100755 --- a/kernel/selinux-testsuite/runtest.sh +++ b/kernel/selinux-testsuite/runtest.sh @@ -44,7 +44,7 @@ DEFAULT_PULLS="" DEFAULT_PATCHES="" # Optional test parameter - location of testuite git. -GIT_URL=${GIT_URL:-"git://github.com/SELinuxProject/selinux-testsuite"} +GIT_URL=${GIT_URL:-"https://github.com/SELinuxProject/selinux-testsuite"} # Optional test parameter - timeout for detecting lost packets NETWORK_TIMEOUT=${NETWORK_TIMEOUT:-4} @@ -70,22 +70,14 @@ else PIPEFAIL_DISABLE="" fi -if rlIsRHEL 5 ; then - # On RHEL-5 sort -V doesn't work, so just pretend we have the oldest kernel - function kver_ge() { false; } - function kver_lt() { true; } - function kver_le() { true; } - function kver_gt() { false; } -else - function version_le() { - { echo "$1"; echo "$2"; } | sort -V | tail -n 1 | grep -qx "$2" - } +function version_le() { + { echo "$1"; echo "$2"; } | sort -V | tail -n 1 | grep -qx "$2" +} - function kver_ge() { version_le "$1" "$(uname -r)"; } - function kver_lt() { ! kver_ge "$1"; } - function kver_le() { version_le "$(uname -r)" "$1"; } - function kver_gt() { ! kver_le "$1"; } -fi +function kver_ge() { version_le "$1" "$(uname -r)"; } +function kver_lt() { ! kver_ge "$1"; } +function kver_le() { version_le "$(uname -r)" "$1"; } +function kver_gt() { ! kver_le "$1"; } function installDepsYum() { local yum="$1"; shift @@ -201,14 +193,12 @@ rlJournalStart # rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" # rlRun "pushd $TmpDir" - if ! rlIsRHEL 5 ; then - # version_le() sanity check: - rlRun "version_le 4.10 4.10" - rlRun "version_le 4.10 4.10.0" - rlRun "version_le 4.10 4.10.1" - rlRun "! version_le 4.10 4.9" - rlRun "! version_le 4.10.0 4.10" - fi + # version_le() sanity check: + rlRun "version_le 4.10 4.10" + rlRun "version_le 4.10 4.10.0" + rlRun "version_le 4.10 4.10.1" + rlRun "! version_le 4.10 4.9" + rlRun "! version_le 4.10.0 4.10" if [ -d /sys/fs/selinux ]; then selinuxfs=/sys/fs/selinux @@ -317,20 +307,6 @@ rlJournalStart rlRun "sed -i 's/3.18/3.9/' $file" 0 \ "Fix up kernel version in nnp test" done - if rlIsRHEL 5 ; then - rlRun "sed -i '/unconfined_devpts_t/d' policy/test_policy.if" 0 - - rlRun "sed -i 's/read_file_perms/r_file_perms/' policy/*.te" 0 - rlRun "sed -i 's/mmap_file_perms/rx_file_perms/' policy/*.te" 0 - rlRun "sed -i 's/list_dir_perms/r_dir_perms/' policy/*.te" 0 - rlRun "sed -i 's/ open / /' policy/*.te" 0 - - rlRun "sed -i 's/^sysadm_bin_spec_domtrans_to/userdom_sysadm_bin_spec_domtrans_to/' policy/*.te" 0 - - rlRun "sed -i 's/^corecmd_exec_bin(\(.*\))$/corecmd_exec_bin(\1)\ncorecmd_exec_sbin(\1)/' policy/*.te" 0 - rlRun "sed -i 's/^corecmd_bin_entry_type(\(.*\))$/corecmd_bin_entry_type(\1)\ncorecmd_sbin_entry_type(\1)/' policy/*.te" 0 - rlRun "sed -i 's/^userdom_search_user_home_dirs(\(.*\))$/userdom_search_user_home_dirs(user, \1)/' policy/*.te" 0 - fi if rlIsRHEL "<8.2"; then rlRun "sed -i '/SUBDIRS += bpf/d;/export CFLAGS += -DHAVE_BPF/d' tests/Makefile" 0 \ "RHEL < 8.2 doesn't ship libbpf => disable BPF subtests" From df22c3b60beedc937afff4a67a8f9c2a2f9faf7f Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Wed, 12 Jan 2022 11:43:03 +0100 Subject: [PATCH 093/626] exit the tests if their required services are missing Services like systemd-homed and systemd-userdbd are available on Fedora, but they are not available on RHEL. It makes no sense to run their tests in environments, where the services are not available. Without these services being present the tests would fail. --- selinux-policy/systemd-homed/runtest.sh | 2 +- selinux-policy/systemd-userdbd-and-similar/runtest.sh | 3 +-- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/selinux-policy/systemd-homed/runtest.sh b/selinux-policy/systemd-homed/runtest.sh index 975bf39..3357cae 100755 --- a/selinux-policy/systemd-homed/runtest.sh +++ b/selinux-policy/systemd-homed/runtest.sh @@ -110,7 +110,7 @@ expect -f - <<<' } rlJournalStart - if rlIsRHEL '<9' ; then + if [ ! -f /usr/lib/systemd/systemd-homed ] ; then rlLog "Not applicable to this OS version." rlJournalEnd exit 0 diff --git a/selinux-policy/systemd-userdbd-and-similar/runtest.sh b/selinux-policy/systemd-userdbd-and-similar/runtest.sh index f817604..8a439ea 100755 --- a/selinux-policy/systemd-userdbd-and-similar/runtest.sh +++ b/selinux-policy/systemd-userdbd-and-similar/runtest.sh @@ -42,8 +42,7 @@ ALLOWED_USERS=${ALLOWED_USERS:-"staff_u user_u guest_u xguest_u sysadm_u unconfi DENIED_USERS=${DENIED_USERS:-""} rlJournalStart - # the systemd-userdbd service is not available on RHEL-8 - if rlIsRHEL 8 ; then + if [ ! -f /usr/lib/systemd/systemd-userdbd ] ; then rlLog "Not applicable to this OS version." rlJournalEnd exit 0 From edffc3122c7242827f2d65b07465b013d57eae42 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 11 Jan 2022 16:00:21 +0100 Subject: [PATCH 094/626] test if the checksum option is mentioned in help/manpages The test phase checks if the newly added checksum option is listed in the help message and in the semodule man page. --- policycoreutils/semodule-l-checksum/runtest.sh | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/policycoreutils/semodule-l-checksum/runtest.sh b/policycoreutils/semodule-l-checksum/runtest.sh index eabd453..e5b5813 100755 --- a/policycoreutils/semodule-l-checksum/runtest.sh +++ b/policycoreutils/semodule-l-checksum/runtest.sh @@ -70,6 +70,13 @@ EOF" rlAssertEquals "Is the loaded module checksum same as the file checksum? " ${module[3]} ${sha256[0]} rlPhaseEnd + rlPhaseStartTest "is the checksum option listed?" + rlRun "man semodule | col -b | grep checksum" + rlRun "man semodule | col -b | grep 'SHA256.*checksum'" + rlRun "semodule --help | grep checksum" + rlRun "semodule --help | grep 'checksum.*SHA256'" + rlPhaseEnd + rlPhaseStartCleanup rlRun "semodule -X 500 -r test_module" rlRun "popd" From 41dfc8126eb762efcf335851f781ac41e2605613 Mon Sep 17 00:00:00 2001 From: Zdenek Pytela Date: Tue, 11 Jan 2022 19:26:35 +0100 Subject: [PATCH 095/626] Update efivars path in selinux-policy/systemd-modules-load-and-similar With the selinux-policy fix for bz#1972372 in RHEL 9, the efivarfs_t type is assigned to /sys/firmware/efi/efivars instead of /sys/firmware/efi as such label should presumably be only on the efivarfs filesystem, not the entire /sys/firmware/efi. --- selinux-policy/systemd-modules-load-and-similar/Makefile | 1 + selinux-policy/systemd-modules-load-and-similar/runtest.sh | 4 ++-- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/selinux-policy/systemd-modules-load-and-similar/Makefile b/selinux-policy/systemd-modules-load-and-similar/Makefile index 27ec3f9..8631adb 100644 --- a/selinux-policy/systemd-modules-load-and-similar/Makefile +++ b/selinux-policy/systemd-modules-load-and-similar/Makefile @@ -81,6 +81,7 @@ $(METADATA): Makefile @echo "Bug: 1833502" >> $(METADATA) # Fedora 32 @echo "Bug: 1838933" >> $(METADATA) # Fedora 32 @echo "Bug: 1942267" >> $(METADATA) # Fedora 32 + @echo "Bug: 1972372" >> $(METADATA) # RHEL 9 rhts-lint $(METADATA) diff --git a/selinux-policy/systemd-modules-load-and-similar/runtest.sh b/selinux-policy/systemd-modules-load-and-similar/runtest.sh index 0bf4cf2..07c0385 100755 --- a/selinux-policy/systemd-modules-load-and-similar/runtest.sh +++ b/selinux-policy/systemd-modules-load-and-similar/runtest.sh @@ -99,8 +99,8 @@ rlJournalStart rlSESearchRule "allow systemd_modules_load_t bin_t : file { execute execute_no_trans map } [ ]" rlPhaseEnd - rlPhaseStartTest "bz#1819161 + bz#1824196 + bz#1829700 + bz#1833502 + bz#1838933" - rlSEMatchPathCon "/sys/firmware/efi" "efivarfs_t" + rlPhaseStartTest "bz#1819161 + bz#1824196 + bz#1829700 + bz#1833502 + bz#1838933 + bz#1972372" + rlSEMatchPathCon "/sys/firmware/efi/efivarfs" "efivarfs_t" rlSESearchRule "allow systemd_modules_load_t efivarfs_t : file { getattr open read } [ ]" rlSESearchRule "allow systemd_resolved_t efivarfs_t : file { getattr open read } [ ]" rlPhaseEnd From 5672c531ab4036c351b4e7ed7abee4cd54f9a13e Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Fri, 14 Jan 2022 14:04:12 +0100 Subject: [PATCH 096/626] Add test for ocontext race condition in the kernel Signed-off-by: Ondrej Mosnacek --- kernel/ocontext-race/Makefile | 6 +++ kernel/ocontext-race/main.fmf | 22 ++++++++++ kernel/ocontext-race/runtest.sh | 74 +++++++++++++++++++++++++++++++++ 3 files changed, 102 insertions(+) create mode 100644 kernel/ocontext-race/Makefile create mode 100644 kernel/ocontext-race/main.fmf create mode 100755 kernel/ocontext-race/runtest.sh diff --git a/kernel/ocontext-race/Makefile b/kernel/ocontext-race/Makefile new file mode 100644 index 0000000..966ae43 --- /dev/null +++ b/kernel/ocontext-race/Makefile @@ -0,0 +1,6 @@ +# Minimal Makefile for standard-test-roles-beakerlib + +R="RhtsRequires: attr" +run: + chmod +x runtest.sh + ./runtest.sh diff --git a/kernel/ocontext-race/main.fmf b/kernel/ocontext-race/main.fmf new file mode 100644 index 0000000..657b38c --- /dev/null +++ b/kernel/ocontext-race/main.fmf @@ -0,0 +1,22 @@ +summary: Regression test for ocontext kernel structure race condition +description: | + Test that a race condition around the kernel's ocontext structures + doesn't cause an incorrect label to be assigned to files/mounts. +contact: Ondrej Mosnacek +component: +- kernel +framework: beakerlib +require: +- attr +duration: 15m +tier: 2 +enabled: true +adjust: + enabled: false + when: distro < rhel-7 + because: RHEL-6 and below are not worth supporting by this test +extra-hardware: | + keyvalue = PROCESSORS >= 4 +link: +- verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1969344 +- verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2040196 diff --git a/kernel/ocontext-race/runtest.sh b/kernel/ocontext-race/runtest.sh new file mode 100755 index 0000000..b7f49ca --- /dev/null +++ b/kernel/ocontext-race/runtest.sh @@ -0,0 +1,74 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# SPDX-License-Identifier: GPLv2 +# Copyright (c) 2022 Red Hat, Inc. +# Author: Ondrej Mosnacek + +# Include Beakerlib environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PREFIX=/tmp/repro- +NTHREADS=8 +TRIALS=20 + +function get_file_con() { + getfattr -h --absolute-names --only-values -n security.selinux "$1" | tr -d '\000' +} + +function strip_mls() { + # strip the MLS -- mcstrans might be running, leading to different MLS + # fields than expected + sed 's/\([^:]*:[^:]*:[^:]*\):.*$/\1/g' +} + +function check_file_con() { + rlAssertEquals "Check expected context of $1" \ + "$(get_file_con "$1" | strip_mls)" \ + "$(echo "$2" | strip_mls)" +} + +rlJournalStart + rlPhaseStartSetup + rlRun "uname -r" + + rlRun "test \$(nproc) -ge 4" 0 "Test needs an SMP machine, otherwise it may pass regardless of the bug" + + rlRun "tmpdir=\$(mktemp -d)" 0 "Create a temporary directory" + + prefix="$tmpdir/repro-" + + for (( i = 0; i < $NTHREADS; i++ )); do + rlRun "mkdir -p \"\${PREFIX}$i\"" 0 "Create subdirectory #$i" + done + rlPhaseEnd + +for (( k = 0; k < $TRIALS; k++ )); do + rlPhaseStartTest "Trial #$k" + rlRun "load_policy" 0 "Reload SELinux policy to reset internal state" + + # NOTE: this must be ran in a single rlRun, otherwise beakerlib + # overhead decreases the chance of a race condition + rlRun " + for (( i = 0; i < $NTHREADS; i++)); do + mount -t tmpfs tmpfs \"\${PREFIX}\$i\" & + done + wait + " 0 "Create $NTHREADS tmpfs mounts at once" + + for (( i = 0; i < $NTHREADS; i++)); do + rlRun "touch \"\${PREFIX}$i/file\"" 0 "Create a file in dir #$i" + check_file_con "$PREFIX$i" "unconfined_u:object_r:user_tmp_t" + check_file_con "$PREFIX$i/file" "unconfined_u:object_r:user_tmp_t" + done + + for (( i = 0; i < $NTHREADS; i++)); do + rlRun "umount \"\${PREFIX}$i\" &" 0 "Unmount dir #$i" + done + rlPhaseEnd +done + + rlPhaseStartCleanup + rlRun "rm -rf \$tmpdir" 0 "Clean up the temporary directory" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd From 64bda4528c094e580336fab208a669b723312369 Mon Sep 17 00:00:00 2001 From: Zdenek Pytela Date: Tue, 18 Jan 2022 10:54:16 +0100 Subject: [PATCH 097/626] Fix a typo in the "/sys/firmware/efi/efivars" path While the filesystem name for efi variables is efivarfs and the relevant type efivarfs_t, the path for the variables list reads just efivars, so rlSEMatchPathCon needs to be used with the correct path. --- selinux-policy/systemd-modules-load-and-similar/runtest.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/selinux-policy/systemd-modules-load-and-similar/runtest.sh b/selinux-policy/systemd-modules-load-and-similar/runtest.sh index 07c0385..2f69ac8 100755 --- a/selinux-policy/systemd-modules-load-and-similar/runtest.sh +++ b/selinux-policy/systemd-modules-load-and-similar/runtest.sh @@ -100,7 +100,7 @@ rlJournalStart rlPhaseEnd rlPhaseStartTest "bz#1819161 + bz#1824196 + bz#1829700 + bz#1833502 + bz#1838933 + bz#1972372" - rlSEMatchPathCon "/sys/firmware/efi/efivarfs" "efivarfs_t" + rlSEMatchPathCon "/sys/firmware/efi/efivars" "efivarfs_t" rlSESearchRule "allow systemd_modules_load_t efivarfs_t : file { getattr open read } [ ]" rlSESearchRule "allow systemd_resolved_t efivarfs_t : file { getattr open read } [ ]" rlPhaseEnd From 14a6d433c15d844a26da8a69fd186448a43bbe1e Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Wed, 19 Jan 2022 16:26:19 +0100 Subject: [PATCH 098/626] add the cockpit test to upstream repo The cockpit* services are frequently used by various users on Fedora and RHEL, so it makes sense to run this TC in upstream testing too. There are no changes in the TC functionality. Moving the downstream TC to upstream repo. --- .../cockpit-ws-and-similar/Makefile | 85 +++++++ selinux-policy/cockpit-ws-and-similar/PURPOSE | 5 + .../cockpit-ws-and-similar/main.fmf | 3 + .../cockpit-ws-and-similar/runtest.sh | 232 ++++++++++++++++++ .../cockpit-ws-and-similar/testpolicy.te | 17 ++ 5 files changed, 342 insertions(+) create mode 100644 selinux-policy/cockpit-ws-and-similar/Makefile create mode 100644 selinux-policy/cockpit-ws-and-similar/PURPOSE create mode 100644 selinux-policy/cockpit-ws-and-similar/main.fmf create mode 100755 selinux-policy/cockpit-ws-and-similar/runtest.sh create mode 100644 selinux-policy/cockpit-ws-and-similar/testpolicy.te diff --git a/selinux-policy/cockpit-ws-and-similar/Makefile b/selinux-policy/cockpit-ws-and-similar/Makefile new file mode 100644 index 0000000..d048f53 --- /dev/null +++ b/selinux-policy/cockpit-ws-and-similar/Makefile @@ -0,0 +1,85 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/cockpit-ws-and-similar +# Description: SELinux interferes with cockpit-ws and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/cockpit-ws-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE testpolicy.te + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with cockpit-ws and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console glib2 cockpit-ws net-tools nmap-ncat cockpit-dashboard cockpit-bridge psmisc selinux-policy-devel" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Architectures: x86_64" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6" >> $(METADATA) + @echo "Bug: 1100808" >> $(METADATA) # RHEL-7 + @echo "Bug: 1214223" >> $(METADATA) # RHEL-7 + @echo "Bug: 1279429" >> $(METADATA) # RHEL-7 + @echo "Bug: 1283955" >> $(METADATA) # RHEL-7 + @echo "Bug: 1374572" >> $(METADATA) # RHEL-7 + @echo "Bug: 1381914" >> $(METADATA) # RHEL-7 + @echo "Bug: 1402316" >> $(METADATA) # RHEL-7 + @echo "Bug: 1402495" >> $(METADATA) # RHEL-7 + @echo "Bug: 1413509" >> $(METADATA) # RHEL-7 + @echo "Bug: 1561053" >> $(METADATA) # Fedora 28 + @echo "Bug: 1584167" >> $(METADATA) # Fedora 28 + @echo "Bug: 1609929" >> $(METADATA) # Fedora 28 + @echo "Bug: 1613638" >> $(METADATA) # Fedora 28 + @echo "Bug: 1615318" >> $(METADATA) # RHEL-8 + @echo "Bug: 1629678" >> $(METADATA) # RHEL-8 + @echo "Bug: 1718814" >> $(METADATA) # RHEL-8 + @echo "Bug: 1979182" >> $(METADATA) # RHEL-8 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/cockpit-ws-and-similar/PURPOSE b/selinux-policy/cockpit-ws-and-similar/PURPOSE new file mode 100644 index 0000000..b42781c --- /dev/null +++ b/selinux-policy/cockpit-ws-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/cockpit-ws-and-similar +Author: Milos Malik + +SELinux interferes with cockpit-ws, cockpit-ssh, cockpit-session and related programs. + diff --git a/selinux-policy/cockpit-ws-and-similar/main.fmf b/selinux-policy/cockpit-ws-and-similar/main.fmf new file mode 100644 index 0000000..adb81d8 --- /dev/null +++ b/selinux-policy/cockpit-ws-and-similar/main.fmf @@ -0,0 +1,3 @@ +path: /selinux-policy/cockpit-ws-and-similar +tier: 2 + diff --git a/selinux-policy/cockpit-ws-and-similar/runtest.sh b/selinux-policy/cockpit-ws-and-similar/runtest.sh new file mode 100755 index 0000000..e0b6a92 --- /dev/null +++ b/selinux-policy/cockpit-ws-and-similar/runtest.sh @@ -0,0 +1,232 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/cockpit-ws-and-similar +# Description: SELinux interferes with cockpit-ws and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +ROOT_PASSWORD="redhat" +FILE_PATH="/usr/libexec/cockpit-ws" +FILE_CONTEXT="cockpit_ws_exec_t" +SERVICE_PACKAGE="cockpit-ws" +SERVICE_NAME="cockpit" +if grep "cockpit-tls" /usr/lib/systemd/system/cockpit.service; then + PROCESS_NAME="cockpit-tls" +else + PROCESS_NAME="cockpit-ws" +fi +PROCESS_CONTEXT="cockpit_ws_t" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} + rlFileBackup /etc/shadow + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "bz#1100808" + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + if rlIsRHEL 5 ; then + SOURCE_TYPE="initrc_t" + BOOLEANS="[ ]" + elif rlIsRHEL 6 ; then + SOURCE_TYPE="initrc_t" + else # RHEL-7 etc. + SOURCE_TYPE="init_t" # systemd runs the process + fi + rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" + rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" + rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" + rlPhaseEnd + + if ! rlIsRHEL 5 6 ; then + rlPhaseStartTest "bz#1214223" + rlSEMatchPathCon "/usr/libexec/cockpit-session" "cockpit_session_exec_t" + rlSEMatchPathCon "/var/tmp" "tmp_t" + rlSESearchRule "allow cockpit_session_t tmp_t : dir { read write add_name remove_name getattr open search } [ ]" + rlSESearchRule "type_transition cockpit_session_t tmp_t : file cockpit_tmp_t" + rlSESearchRule "allow cockpit_session_t cockpit_tmp_t : file { create write open unlink } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1279429 + bz#1283955" + rlSEMatchPathCon "/usr/libexec/cockpit-ws" "cockpit_ws_exec_t" + rlSEMatchPathCon "/tmp" "tmp_t" + rlSEMatchPathCon "/var/run" "var_run_t" + rlSEMatchPathCon "/var/run/cockpit-ws" "cockpit_var_run_t" + rlSESearchRule "allow cockpit_ws_t var_run_t : dir { write add_name } [ ]" + rlSESearchRule "type_transition cockpit_ws_t var_run_t : dir cockpit_var_run_t [ ]" + rlSESearchRule "allow cockpit_ws_t cockpit_var_run_t : dir { create } [ ]" + rlSESearchRule "allow cockpit_ws_t tmp_t : dir { write add_name } [ ]" + rlSESearchRule "type_transition cockpit_ws_t tmp_t : dir cockpit_tmp_t [ ]" + rlSESearchRule "type_transition cockpit_ws_t tmp_t : file cockpit_tmp_t [ ]" + rlSESearchRule "allow cockpit_ws_t cockpit_tmp_t : dir { read write create getattr setattr lock unlink link rename add_name remove_name search rmdir open } [ ]" + rlSESearchRule "allow cockpit_ws_t cockpit_tmp_t : file { read write create getattr setattr lock append unlink link rename open } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1374572" + rlSEMatchPathCon "/usr/libexec/cockpit-session" "cockpit_session_exec_t" + rlSEMatchPathCon "/usr/share/cracklib" "crack_db_t" + rlSEMatchPathCon "/usr/share/cracklib/pw_dict.pwd" "crack_db_t" + rlSEMatchPathCon "/etc/nshadow" "shadow_t" + rlSESearchRule "allow cockpit_session_t crack_db_t : dir { search }" + rlSESearchRule "allow cockpit_session_t crack_db_t : file { getattr open read }" + rlSESearchRule "allow cockpit_session_t shadow_t : file { create write setattr }" + rlSESearchRule "allow cockpit_session_t passwd_file_t : file { write }" + rlPhaseEnd + + rlPhaseStartTest "bz#1413509" + rlSEMatchPathCon "/usr/libexec/cockpit-ws" "cockpit_ws_exec_t" + rlSEMatchPathCon "/usr/libexec/cockpit-ssh" "cockpit_session_exec_t" + rlSEMatchPathCon "/var/lib/cockpit" "cockpit_var_lib_t" + rlSEMatchPortCon tcp 22 ssh_port_t + rlSESearchRule "allow cockpit_ws_t cockpit_session_exec_t : file { getattr open read execute }" + rlSESearchRule "type_transition cockpit_ws_t cockpit_session_exec_t : process cockpit_session_t" + rlSESearchRule "allow cockpit_ws_t cockpit_session_t : process { transition }" + rlSESearchRule "allow cockpit_session_t cockpit_var_lib_t : dir { search }" + rlSESearchRule "allow cockpit_session_t ssh_port_t : tcp_socket { name_connect } [ ]" + rlPhaseEnd + + if ! rlIsRHEL 7 ; then + rlPhaseStartTest "bz#1584167 + bz#1609929 + bz#1613638 + bz#1615318" + rlSEMatchPathCon "/usr/sbin/sshd" "sshd_exec_t" + rlSEMatchPathCon "/var/run/cockpit" "cockpit_var_run_t" + rlSEMatchPathCon "/var/run/cockpit/active.motd" "cockpit_var_run_t" + rlSESearchRule "allow sshd_t cockpit_var_run_t : dir { getattr open search } [ ]" + rlSESearchRule "allow sshd_t cockpit_var_run_t : file { getattr open read } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1629678" + rlSEMatchPathCon "/usr/lib/systemd/system/cockpit.socket" "cockpit_unit_file_t" + rlSESearchRule "allow cockpit_ws_t cockpit_unit_file_t : service { status } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1561053" + rlSEMatchPathCon "/usr/libexec/cockpit-ws" "cockpit_ws_exec_t" + rlRun "ls -Z /proc/cpuinfo | grep :proc_t" + rlSESearchRule "allow cockpit_ws_t proc_t : file { getattr open read } [ ]" + rlPhaseEnd + fi + fi + + rlPhaseStartTest "real scenario -- standalone service" + rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + if rlIsRHEL 5 6 ; then + PROCESS_CONTEXT="initrc_t" + else + PROCESS_CONTEXT="unconfined_service_t" + fi + fi + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status restart status stop status" 1 + rlPhaseEnd + + rlPhaseStartTest "bz#1402316 + bz#1402495" + rlSEMatchPathCon "/usr/libexec/cockpit-session" "cockpit_session_exec_t" + rlSESearchRule "allow cockpit_session_t cockpit_session_t : process { setrlimit }" + rlPhaseEnd + + if ! rlIsRHEL 7 ; then + rlPhaseStartTest "bz#1718814" + # staff_u section + rlSESearchRule "allow staff_ssh_agent_t cockpit_session_t : fifo_file { getattr read write } [ ]" + rlSESearchRule "allow staff_ssh_agent_t ssh_agent_tmp_t : dir { write } [ ]" + rlSESearchRule "allow staff_t cockpit_ws_t : unix_stream_socket { getattr ioctl shutdown } [ ]" + # rlSESearchRule "allow staff_sudo_t staff_t : unix_stream_socket { ioctl } [ ]" + rlSESearchRule "allow cockpit_session_t staff_ssh_agent_t : process { signal } [ ]" + # user_u section + rlSESearchRule "allow user_ssh_agent_t cockpit_session_t : fifo_file { getattr read write } [ ]" + rlSESearchRule "allow user_ssh_agent_t ssh_agent_tmp_t : dir { write } [ ]" + rlSESearchRule "allow user_t cockpit_ws_t : unix_stream_socket { getattr ioctl shutdown } [ ]" + # user_u cannot run sudo - tested in a different TC + rlSESearchRule "allow cockpit_session_t user_ssh_agent_t : process { signal } [ ]" + # sysadm_u section + rlSESearchRule "allow sysadm_ssh_agent_t cockpit_session_t : fifo_file { getattr read write } [ ]" + rlSESearchRule "allow sysadm_ssh_agent_t ssh_agent_tmp_t : dir { write } [ ]" + + # rlSESearchRule "allow sysadm_sudo_t sysadm_t : unix_stream_socket { ioctl } [ ]" + rlSESearchRule "allow sysadm_t cockpit_ws_t : unix_stream_socket { getattr ioctl shutdown } [ ]" + rlSESearchRule "allow cockpit_session_t sysadm_ssh_agent_t : process { signal } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1979182" + rlSESearchRule "allow cockpit_ws_t fs_t : filesystem { getattr } [ ]" + rlPhaseEnd + fi + + rlPhaseStartTest "real scenario -- xinetd service" + HOST_ADDRESS="127.0.0.1" # IP address or nothing + PORT_NUMBER="9090" # number or socket path + PORT_TYPE="" # default is TCP, otherwise use -u (UDP) or --sctp (SCTP) + if rlIsRHEL 5 6 ; then + rlRun "chkconfig ${SERVICE_NAME} on" + rlRun "service xinetd restart" + rlLog "starting provocateur job" + ( tail -f - | nc ${PORT_TYPE} ${HOST_ADDRESS} ${PORT_NUMBER} ) & + PROVOCATEUR_PID=$! + else + rlRun "systemctl enable ${SERVICE_NAME}.socket" + rlRun "systemctl start ${SERVICE_NAME}.socket" + rlLog "starting provocateur job" + ( tail -f - | ncat ${PORT_TYPE} ${HOST_ADDRESS} ${PORT_NUMBER} ) & + PROVOCATEUR_PID=$! + fi + sleep 1 + rlRun "netstat -tupan | grep :${PORT_NUMBER}" + rlRun "ps -o pid,user,context,args -C ${PROCESS_NAME}" + rlRun "ps -o pid,user,context,args -C ${PROCESS_NAME} | grep :${PROCESS_CONTEXT}" + rlRun "kill ${PROVOCATEUR_PID}" + if rlIsRHEL 5 6 ; then + rlRun "chkconfig ${SERVICE_NAME} off" + rlRun "service xinetd stop" + else + rlRun "systemctl stop ${SERVICE_NAME}.socket" + rlRun "systemctl disable ${SERVICE_NAME}.socket" + fi + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/cockpit-ws-and-similar/testpolicy.te b/selinux-policy/cockpit-ws-and-similar/testpolicy.te new file mode 100644 index 0000000..10b6586 --- /dev/null +++ b/selinux-policy/cockpit-ws-and-similar/testpolicy.te @@ -0,0 +1,17 @@ +policy_module(testpolicy,1.0) + +require { + type initrc_t; + type cockpit_session_exec_t; + type cockpit_session_t; + type user_devpts_t; + class file { getattr open read execute entrypoint }; + class process { transition }; + class chr_file { getattr open read write append }; +} + +allow initrc_t cockpit_session_exec_t : file { getattr open read execute entrypoint }; +allow initrc_t cockpit_session_t : process { transition }; +type_transition initrc_t cockpit_session_exec_t : process cockpit_session_t; +allow cockpit_session_t user_devpts_t : chr_file { getattr open read write append }; + From ee424688c6cd7cb2cf8236c835821cbaaec3e8d5 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Mon, 24 Jan 2022 10:13:18 +0100 Subject: [PATCH 099/626] kernel/ocontext-race: disable the test on s390x Only at most 2-CPU s390x machines are available in Beaker and the bug is not reproducible on them, so just disable the test on s390x. Signed-off-by: Ondrej Mosnacek --- kernel/ocontext-race/main.fmf | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/kernel/ocontext-race/main.fmf b/kernel/ocontext-race/main.fmf index 657b38c..8add542 100644 --- a/kernel/ocontext-race/main.fmf +++ b/kernel/ocontext-race/main.fmf @@ -12,9 +12,12 @@ duration: 15m tier: 2 enabled: true adjust: - enabled: false - when: distro < rhel-7 - because: RHEL-6 and below are not worth supporting by this test +- enabled: false + when: distro < rhel-7 + because: RHEL-6 and below are not worth supporting by this test +- enabled: false + when: arch = s390x + because: No machines likely available with required HW configuration extra-hardware: | keyvalue = PROCESSORS >= 4 link: From 6f3d0475b223fc0f903803edcad04efe03fd7c5e Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Wed, 26 Jan 2022 20:09:36 +0100 Subject: [PATCH 100/626] delete all users at the end When the first user is deleted before the second user is created, they will have the same UID and the systemd processes will be confused. The confusion leads to incorrect SELinux labels on subdirectories of /run/user//. By deleting all users at the end, we ensure that each of them will have a different UID and their directories will be labeled correctly. --- selinux-policy/bz481628-send-msg-to-dbus/runtest.sh | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/selinux-policy/bz481628-send-msg-to-dbus/runtest.sh b/selinux-policy/bz481628-send-msg-to-dbus/runtest.sh index 1ad9cb7..19e95d7 100755 --- a/selinux-policy/bz481628-send-msg-to-dbus/runtest.sh +++ b/selinux-policy/bz481628-send-msg-to-dbus/runtest.sh @@ -134,6 +134,7 @@ rlJournalStart rlRun "setsebool ssh_sysadm_login on" rlRun "setsebool selinuxuser_tcp_server on" + CREATED_USERS="" # TODO: guest_u, xguest_u cannot successfully run systemctl for SELINUX_USER in user_u staff_u sysadm_u unconfined_u ; do USER_NAME="user${RANDOM}" @@ -151,8 +152,10 @@ rlJournalStart rlRun "grep \"${SELINUX_USER}:object_r:session_dbusd_tmp_t:.* services\" files.txt" fi rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost /usr/bin/busctl --user --no-pager" + CREATED_USERS="${USER_NAME} ${CREATED_USERS}" + done + for USER_NAME in ${CREATED_USERS} ; do rlRun "userdel -rfZ ${USER_NAME}" - sleep 10 done rlRun "setsebool selinuxuser_tcp_server off" rlRun "setsebool ssh_sysadm_login off" From c0794774fb34ebbda0ffaa061a855e07e9758562 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Thu, 27 Jan 2022 17:27:40 +0100 Subject: [PATCH 101/626] quit immediately if the anon_inode class is not defined in policy It makes no sense to run the test in environments where the anon_inode class is not defined. --- selinux-policy/anon_inode-and-similar/Makefile | 2 +- selinux-policy/anon_inode-and-similar/runtest.sh | 6 ++++++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/selinux-policy/anon_inode-and-similar/Makefile b/selinux-policy/anon_inode-and-similar/Makefile index d7b7a26..f7866fa 100644 --- a/selinux-policy/anon_inode-and-similar/Makefile +++ b/selinux-policy/anon_inode-and-similar/Makefile @@ -54,7 +54,7 @@ $(METADATA): Makefile @echo "Type: Regression" >> $(METADATA) @echo "TestTime: 30m" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: libselinux policycoreutils selinux-policy selinux-policy-targeted gcc glibc-headers" >> $(METADATA) + @echo "Requires: libselinux policycoreutils selinux-policy selinux-policy-targeted gcc glibc-headers setools-console audit" >> $(METADATA) @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @echo "License: GPLv2" >> $(METADATA) diff --git a/selinux-policy/anon_inode-and-similar/runtest.sh b/selinux-policy/anon_inode-and-similar/runtest.sh index 0a2bf68..11ab2a0 100755 --- a/selinux-policy/anon_inode-and-similar/runtest.sh +++ b/selinux-policy/anon_inode-and-similar/runtest.sh @@ -33,6 +33,12 @@ PACKAGE="selinux-policy" rlJournalStart + if ! seinfo -c anon_inode | grep -q anon_inode ; then + rlLog "Not applicable to this OS version." + rlJournalEnd + exit 0 + fi + rlPhaseStartSetup rlRun "rlImport 'selinux-policy/common'" rlSESatisfyRequires From 45e145b4e11ee50a0f6a0b59d235d1d967042a6e Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Fri, 21 May 2021 13:47:42 +0200 Subject: [PATCH 102/626] add the amanda test to upstream repo The amanda component is frequently used by various users on Fedora and RHEL, so it makes sense to run this TC in upstream testing too. There are no changes in the TC functionality. Moving the downstream TC to upstream repo. --- .../bz733494-amanda-and-similar/Makefile | 96 +++++++ .../bz733494-amanda-and-similar/PURPOSE | 5 + .../bz733494-amanda-and-similar/krb5.conf | 27 ++ .../bz733494-amanda-and-similar/krb5.keytab | Bin 0 -> 118 bytes .../bz733494-amanda-and-similar/main.fmf | 3 + .../bz733494-amanda-and-similar/runtest.sh | 264 ++++++++++++++++++ 6 files changed, 395 insertions(+) create mode 100644 selinux-policy/bz733494-amanda-and-similar/Makefile create mode 100644 selinux-policy/bz733494-amanda-and-similar/PURPOSE create mode 100644 selinux-policy/bz733494-amanda-and-similar/krb5.conf create mode 100644 selinux-policy/bz733494-amanda-and-similar/krb5.keytab create mode 100644 selinux-policy/bz733494-amanda-and-similar/main.fmf create mode 100755 selinux-policy/bz733494-amanda-and-similar/runtest.sh diff --git a/selinux-policy/bz733494-amanda-and-similar/Makefile b/selinux-policy/bz733494-amanda-and-similar/Makefile new file mode 100644 index 0000000..695123f --- /dev/null +++ b/selinux-policy/bz733494-amanda-and-similar/Makefile @@ -0,0 +1,96 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/bz733494-amanda-and-similar +# Description: SELinux interferes with amanda and related tools +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2011 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/bz733494-amanda-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE krb5.conf krb5.keytab + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with amanda and related tools" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 15m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "RunFor: amanda" >> $(METADATA) + @echo "Requires: amanda" >> $(METADATA) + @echo "Requires: amanda-client" >> $(METADATA) + @echo "Requires: amanda-server" >> $(METADATA) + @echo "Requires: audit" >> $(METADATA) + @echo "Requires: initscripts" >> $(METADATA) + @echo "Requires: libselinux" >> $(METADATA) + @echo "Requires: libselinux-utils" >> $(METADATA) + @echo "Requires: nc" >> $(METADATA) + @echo "Requires: net-tools" >> $(METADATA) + @echo "Requires: nmap-ncat" >> $(METADATA) + @echo "Requires: policycoreutils" >> $(METADATA) + @echo "Requires: procps-ng" >> $(METADATA) + @echo "Requires: krb5-workstation" >> $(METADATA) + @echo "Requires: selinux-policy" >> $(METADATA) + @echo "Requires: selinux-policy-targeted" >> $(METADATA) + @echo "Requires: setools" >> $(METADATA) + @echo "Requires: setools-console" >> $(METADATA) + @echo "Requires: xinetd" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Releases: -RHEL4" >> $(METADATA) + @echo "Bug: 283971" >> $(METADATA) # RHEL-5 + @echo "Bug: 498596" >> $(METADATA) # RHEL-5 + @echo "Bug: 729361" >> $(METADATA) # RHEL-6 + @echo "Bug: 733494" >> $(METADATA) # RHEL-6 + @echo "Bug: 965140" >> $(METADATA) # RHEL-7 + @echo "Bug: 1371561" >> $(METADATA) # RHEL-7 + @echo "Bug: 1452444" >> $(METADATA) # RHEL-7 + @echo "Bug: 1623052" >> $(METADATA) # RHEL-7 + @echo "Bug: 1630963" >> $(METADATA) # RHEL-7 + @echo "Bug: 1739137" >> $(METADATA) # RHEL-8 + @echo "Bug: 1960513" >> $(METADATA) # Fedora 34 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/bz733494-amanda-and-similar/PURPOSE b/selinux-policy/bz733494-amanda-and-similar/PURPOSE new file mode 100644 index 0000000..f6d2f5d --- /dev/null +++ b/selinux-policy/bz733494-amanda-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/bz733494-amanda-and-similar +Author: Milos Malik + +SELinux interferes with amandad and related programs. + diff --git a/selinux-policy/bz733494-amanda-and-similar/krb5.conf b/selinux-policy/bz733494-amanda-and-similar/krb5.conf new file mode 100644 index 0000000..981c0de --- /dev/null +++ b/selinux-policy/bz733494-amanda-and-similar/krb5.conf @@ -0,0 +1,27 @@ +# Configuration snippets may be placed in this directory as well +includedir /etc/krb5.conf.d/ + +[logging] + default = FILE:/var/log/krb5libs.log + kdc = FILE:/var/log/krb5kdc.log + admin_server = FILE:/var/log/kadmind.log + +[libdefaults] + dns_lookup_realm = false + ticket_lifetime = 24h + renew_lifetime = 7d + forwardable = true + rdns = false + pkinit_anchors = /etc/pki/tls/certs/ca-bundle.crt + default_realm = EXAMPLE.COM + default_ccache_name = KEYRING:persistent:%{uid} + +[realms] + EXAMPLE.COM = { + kdc = kerberos.example.com + admin_server = kerberos.example.com + } + +[domain_realm] + .example.com = EXAMPLE.COM + example.com = EXAMPLE.COM diff --git a/selinux-policy/bz733494-amanda-and-similar/krb5.keytab b/selinux-policy/bz733494-amanda-and-similar/krb5.keytab new file mode 100644 index 0000000000000000000000000000000000000000..c8207137e5063832a99a32ff62a9151187cabcde GIT binary patch literal 118 zcmZQ&Vqjn}V_;(7c8&0L4DfN)bN2UTV9CfYE@9xz$xlwq0W%pG7^AcHZe?T;WMCCC U39Fa@5<%#6^u@1p-*r@-0M4Zu^8f$< literal 0 HcmV?d00001 diff --git a/selinux-policy/bz733494-amanda-and-similar/main.fmf b/selinux-policy/bz733494-amanda-and-similar/main.fmf new file mode 100644 index 0000000..ee89c6c --- /dev/null +++ b/selinux-policy/bz733494-amanda-and-similar/main.fmf @@ -0,0 +1,3 @@ +path: /selinux-policy/bz733494-amanda-and-similar +tier: 2 + diff --git a/selinux-policy/bz733494-amanda-and-similar/runtest.sh b/selinux-policy/bz733494-amanda-and-similar/runtest.sh new file mode 100755 index 0000000..9fd5386 --- /dev/null +++ b/selinux-policy/bz733494-amanda-and-similar/runtest.sh @@ -0,0 +1,264 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/bz733494-amanda-and-similar +# Description: SELinux interferes with amanda and related tools +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2011 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include rhts environment +. /usr/bin/rhts-environment.sh +. /usr/share/beakerlib/beakerlib.sh + +PACKAGE="selinux-policy" +ROOT_PASSWORD="redhat" +FILE_PATH="/usr/lib/amanda/amandad" +FILE_CONTEXT="amanda_inetd_exec_t" +SERVICE_NAME="amanda" +PROCESS_NAME="amandad" +PROCESS_CONTEXT="amanda_t" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm amanda + rlAssertRpm amanda-client + rlAssertRpm amanda-server + + if rlIsRHEL 5 6 ; then + rlServiceStop xinetd + fi + rlFileBackup /etc/shadow + rlFileBackup /etc/krb5.conf + rlFileBackup /etc/krb5.keytab + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "bz#283971" + # META-Fixed-In: selinux-policy-2.4.6-91.el5 + if ! rlIsRHEL 5 ; then + rlSEMatchPathCon "/usr/sbin/amandad" "bin_t" + fi + rlSEMatchPathCon "/usr/lib/amanda/amandad" "amanda_inetd_exec_t" + rlSEMatchPortCon "tcp" "389" "ldap_port_t" + if ! rlIsRHEL 7 ; then + rlSESearchRule "allow amanda_t ldap_port_t : tcp_socket { name_connect }" + fi + rlPhaseEnd + + rlPhaseStartTest "bz#498596" + # META-Fixed-In: selinux-policy-2.4.6-230.el5 + rlSEMatchPathCon "/usr/lib/amanda/killpgrp" "amanda_exec_t" + rlSESearchRule "allow amanda_t fsadm_t : process { signal }" + rlPhaseEnd + + if rlIsRHEL 6 ; then + rlPhaseStartTest "bz#729361" + rlSEMatchPathCon "/bin/mailx" "sendmail_exec_t" + rlSEMatchPathCon "/var/lib/amanda/Data/amdump" "amanda_data_t" + rlSEMatchPathCon "/var/lib/amanda/Data/log" "amanda_log_t" + rlSESearchRule "allow sendmail_t amanda_var_lib_t : file { getattr open append }" + # FIXME: based on known AVCs there is a problem with initrc_tmp_t file + rlPhaseEnd + fi + + if ! rlIsRHEL 5 ; then + rlPhaseStartTest "bz#733494" + # META-Fixed-In: selinux-policy-3.7.19-109.el6 + rlSESearchRule "allow amanda_t amanda_t : process { setsched }" + rlSESearchRule "allow amanda_t amanda_data_t : lnk_file { create unlink }" + rlSESearchRule "allow amanda_t amanda_data_t : dir { add_name remove_name create rmdir write }" + # FIXME: dontaudit rules for getattr operations on directories in /proc are missing + rlPhaseEnd + fi + + if ! rlIsRHEL 5 6 ; then + rlPhaseStartTest "bz#1371561" + rlSEMatchPathCon "/var/lib" "var_lib_t" + rlSEMatchPathCon "/var/lib/amanda" "amanda_var_lib_t" + rlSESearchRule "allow amanda_t var_lib_t : dir { add_name write }" + rlSESearchRule "allow amanda_t amanda_t : capability { sys_admin }" + rlSESearchRule "type_transition amanda_t var_lib_t : dir amanda_var_lib_t" + rlSESearchRule "allow amanda_t amanda_var_lib_t : dir { create setattr }" + rlSESearchRule "allow amanda_t amanda_var_lib_t : file { create setattr write }" + rlPhaseEnd + + rlPhaseStartTest "bz#1452444" + rlSEMatchPathCon "/usr/lib64/amanda/amandad" "amanda_inetd_exec_t" + rlSEMatchPathCon "/dev/shm" "tmpfs_t" + rlSESearchRule "type_transition amanda_t tmpfs_t : dir amanda_tmpfs_t" + rlSESearchRule "type_transition amanda_t tmpfs_t : file amanda_tmpfs_t" + rlSESearchRule "allow amanda_t tmpfs_t : filesystem { getattr }" + rlSESearchRule "allow amanda_t tmpfs_t : dir { read write add_name remove_name }" + rlSESearchRule "allow amanda_t amanda_tmpfs_t : dir { getattr open read write search add_name remove_name }" + rlSESearchRule "allow amanda_t amanda_tmpfs_t : file { getattr open read write create link unlink }" + rlSESearchRule "allow amanda_t amanda_t : capability { setgid }" + rlSESearchRule "allow amanda_t proc_net_t : file { getattr open read }" + rlPhaseEnd + fi + + if false ; then + rlPhaseStartTest "bz#1623052" + rlSEMatchPathCon "/usr/lib64/amanda/amandad" "amanda_inetd_exec_t" + rlSEMatchPathCon "/var/tmp/host_0" "krb5_host_rcache_t" + rlSESearchRule "allow amanda_t krb5_host_rcache_t : file { write unlink } [ ]" + rlPhaseEnd + fi + + rlPhaseStartTest "bz#965140" + if rlIsRHEL 5 ; then + SOURCE_TYPE="inetd_t" # xinetd runs the process + BOOLEANS="[ amanda_disable_trans ]" + elif rlIsRHEL 6 ; then + SOURCE_TYPE="inetd_t" # xinetd runs the process + else # RHEL-7 etc. + SOURCE_TYPE="init_t" # systemd runs the process + fi + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + rlSEMatchPathCon "/usr/sbin/prelink" "prelink_exec_t" + rlSEMatchPathCon "/usr/lib/amanda/*" "amanda_exec_t" + rlSEMatchPathCon "/usr/lib64/amanda/*" "amanda_exec_t" + rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute }" + rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } ${BOOLEANS}" + rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} ${BOOLEANS}" + rlSESearchRule "allow prelink_t amanda_exec_t : file { getattr }" + rlSESearchRule "allow setroubleshootd_t amanda_exec_t : file { getattr }" + rlSESearchRule "allow unconfined_t amanda_exec_t : file { getattr }" + rlPhaseEnd + + if ! rlIsRHEL 5 6 ; then + rlPhaseStartTest "bz#1630963" + rlSESearchRule "allow amanda_t amanda_tmpfs_t : file { map } [ ]" + rlPhaseEnd + fi + + if ! rlIsRHEL 5 6 7 ; then + rlPhaseStartTest "bz#1739137" + # xfsdump is executed from amanda_t and stays in amanda_t + rlSEMatchPathCon "/usr/sbin/xfsdump" "bin_t" + rlSEMatchPathCon "/dev/random" "random_device_t" + rlSEMatchPathCon "/var/lib/xfsdump" "var_lib_t" + rlSEMatchPathCon "/var/lib/xfsdump/inventory" "amanda_var_lib_t" + rlSEMatchPathCon "/var/lib/xfsdump/inventory/1fa2bf89-02c1-4bba-bc3d-a265cbd5eff2.InvIndex" "amanda_var_lib_t" + rlSESearchRule "allow amanda_t random_device_t : chr_file { getattr open read } [ ]" + rlSESearchRule "allow amanda_t amanda_var_lib_t : file { create write setattr } [ ]" + rlPhaseEnd + fi + + if ! rlIsRHEL 5 6 7 8 ; then + rlPhaseStartTest "bz#1960513" + rlRun "ls -l /usr/sbin/amandad" + rlSEMatchPathCon "/usr/lib64/amanda/amandad" "amanda_inetd_exec_t" + rlSEMatchPathCon "/sys/fs/cgroup" "cgroup_t" + rlSESearchRule "allow amanda_t cgroup_t : filesystem { getattr } [ ]" + rlPhaseEnd + fi + + if ! rlIsRHEL 5 6 ; then + rlPhaseStartTest "real scenario -- amanda-udp" + rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + # for RHELs where the SELinux domain does not exist yet + PROCESS_CONTEXT="unconfined_service_t" + fi + rlRun "systemctl enable amanda-udp.socket" + rlRun "systemctl start amanda-udp.socket" + rlSEService ${ROOT_PASSWORD} amanda-udp amandad amanda_t "start status restart status stop status" 1 + rlRun "systemctl stop amanda-udp.socket" + rlRun "systemctl disable amanda-udp.socket" + rlPhaseEnd + + rlPhaseStartTest "real scenario -- kamanda" + rlRun "rm -f /etc/krb5.conf /etc/krb5.keytab" + FQDN=`hostname -f` + rlRun 'echo -en "read_kt krb5.keytab\nclear\nadd_entry -password -p host/${FQDN}@EXAMPLE.COM -k 2 -e aes128-cts-hmac-sha1-96\nblahblah\nwrite_kt krb5.keytab\nl\nq\n" | ktutil' + rlRun "cp krb5.conf krb5.keytab /etc" + rlRun "restorecon -Rv /etc" + PORT_NUMBER="10082" + HOST_ADDRESS="127.0.0.1" + rlRun "systemctl enable kamanda.socket" + rlRun "systemctl start kamanda.socket" + rlLog "starting provocateur job" + ( tail -f - | ncat ${HOST_ADDRESS} ${PORT_NUMBER} ) & + PROVOCATEUR_PID=$! + sleep 1 + rlRun "netstat -tupan | grep :${PORT_NUMBER}" + rlRun "ps -o pid,user,context,args -C ${PROCESS_NAME}" + rlRun "ps -o pid,user,context,args -C ${PROCESS_NAME} | grep :${PROCESS_CONTEXT}" + rlRun "kill ${PROVOCATEUR_PID}" + rlRun "systemctl stop kamanda.socket" + rlRun "systemctl disable kamanda.socket" + rlPhaseEnd + fi + + rlPhaseStartTest "real scenario -- xinetd service" + HOST_ADDRESS="127.0.0.1" + PORT_NUMBER="10080" # number or socket path + if rlIsRHEL 5 6 ; then + PORT_TYPE="-u" # default is TCP, otherwise use -u (UDP) or --sctp (SCTP) + rlRun "chkconfig ${SERVICE_NAME} on" + rlRun "service xinetd restart" + rlLog "starting provocateur job" + ( echo | nc ${PORT_TYPE} ${HOST_ADDRESS} ${PORT_NUMBER} ) & + PROVOCATEUR_PID=$! + else + PORT_TYPE="" # default is TCP, otherwise use -u (UDP) or --sctp (SCTP) + rlRun "systemctl enable ${SERVICE_NAME}.socket" + rlRun "systemctl start ${SERVICE_NAME}.socket" + rlLog "starting provocateur job" + ( tail -f - | ncat ${PORT_TYPE} ${HOST_ADDRESS} ${PORT_NUMBER} ) & + PROVOCATEUR_PID=$! + fi + sleep 1 + rlRun "netstat -tupan | grep :${PORT_NUMBER}" + rlRun "ps -o pid,user,context,args -C ${PROCESS_NAME}" + rlRun "ps -o pid,user,context,args -C ${PROCESS_NAME} | grep :${PROCESS_CONTEXT}" + rlRun "kill ${PROVOCATEUR_PID}" + if rlIsRHEL 5 6 ; then + rlRun "chkconfig ${SERVICE_NAME} off" + rlRun "service xinetd stop" + else + rlRun "systemctl stop ${SERVICE_NAME}.socket" + rlRun "systemctl disable ${SERVICE_NAME}.socket" + fi + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + if rlIsRHEL 5 6 ; then + rlServiceRestore xinetd + fi + rlPhaseEnd + rlJournalPrintText +rlJournalEnd + From bb05179a3052db55df3f260b00f91473c4311ef6 Mon Sep 17 00:00:00 2001 From: Zdenek Pytela Date: Tue, 1 Feb 2022 20:01:23 +0100 Subject: [PATCH 103/626] Change default context for timesync runtime files With the fix for bz#1822131, the default file context for /run/systemd/timesync and /run/systemd/timesync/synchronized changed to systemd_timedated_var_run_t, so the test requires to be updated, too. Additionally, rules for checking access to the directory and file for systemd-timesyncd need to be updated. --- selinux-policy/systemd-timesyncd-and-similar/runtest.sh | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/selinux-policy/systemd-timesyncd-and-similar/runtest.sh b/selinux-policy/systemd-timesyncd-and-similar/runtest.sh index 66f114f..fab5ec7 100755 --- a/selinux-policy/systemd-timesyncd-and-similar/runtest.sh +++ b/selinux-policy/systemd-timesyncd-and-similar/runtest.sh @@ -72,10 +72,11 @@ rlJournalStart if rlIsFedora ; then rlPhaseStartTest "bz#1649671" - rlSEMatchPathCon "/run/systemd/timesync" "init_var_run_t" - rlSEMatchPathCon "/run/systemd/timesync/synchronized" "init_var_run_t" + rlSEMatchPathCon "/run/systemd/timesync" "systemd_timedated_var_run_t" + rlSEMatchPathCon "/run/systemd/timesync/synchronized" "systemd_timedated_var_run_t" rlSESearchRule "allow systemd_timedated_t init_var_run_t : dir { write add_name } [ ]" - rlSESearchRule "allow systemd_timedated_t init_var_run_t : file { create write open } [ ]" + rlSESearchRule "allow systemd_timedated_t systemd_timedated_var_run_t : dir { write add_name } [ ]" + rlSESearchRule "allow systemd_timedated_t systemd_timedated_var_run_t : file { create write open } [ ]" rlPhaseEnd rlPhaseStartTest "bz#1694272" From 7323ae1899ffee8699fd2949758ef92837457f7f Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Thu, 3 Feb 2022 14:35:12 +0100 Subject: [PATCH 104/626] test the lockdown class only if it defined The lockdown class was removed from SELinux policy in BZ#2017848. There are test phases in various automated tests which look for policy rules related to the lockdown class. These tests were failing. From now on, they should not fail because the problematic test phases are skipped. --- selinux-policy/lockdown-class/runtest.sh | 2 +- selinux-policy/systemd-modules-load-and-similar/runtest.sh | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/selinux-policy/lockdown-class/runtest.sh b/selinux-policy/lockdown-class/runtest.sh index c008272..9bed740 100755 --- a/selinux-policy/lockdown-class/runtest.sh +++ b/selinux-policy/lockdown-class/runtest.sh @@ -33,7 +33,7 @@ PACKAGE="selinux-policy" rlJournalStart - if rlIsRHEL '<9' ; then + if ! seinfo -c | grep -q lockdown ; then rlLog "Not applicable to this OS version." rlJournalEnd exit 0 diff --git a/selinux-policy/systemd-modules-load-and-similar/runtest.sh b/selinux-policy/systemd-modules-load-and-similar/runtest.sh index 2f69ac8..d62bd6f 100755 --- a/selinux-policy/systemd-modules-load-and-similar/runtest.sh +++ b/selinux-policy/systemd-modules-load-and-similar/runtest.sh @@ -126,7 +126,7 @@ rlJournalStart rlRun "lsmod | grep rdma" rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time" 1 rlRun "systemctl stop rdma-load-modules@rdma.service" - if ! rlIsRHEL 8 ; then + if seinfo -c | grep -q lockdown ; then rlSESearchRule "allow systemd_modules_load_t systemd_modules_load_t : lockdown { confidentiality } [ ]" fi rlPhaseEnd From 8b59d115d30b183743de8d3026a22c44130e9174 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Sun, 13 Feb 2022 14:39:34 +0100 Subject: [PATCH 105/626] Add preliminary SCTP client-side peeloff coverage Add a variant of the selinux-testsuite test that adds a patch adding coverage for SCTP client peeloff so that we can conveniently verify related bugs until the fix and testsuite coverage are merged upstream. Signed-off-by: Ondrej Mosnacek --- kernel/selinux-testsuite/sctp-peeloff/main.fmf | 12 ++++++++++++ 1 file changed, 12 insertions(+) create mode 100644 kernel/selinux-testsuite/sctp-peeloff/main.fmf diff --git a/kernel/selinux-testsuite/sctp-peeloff/main.fmf b/kernel/selinux-testsuite/sctp-peeloff/main.fmf new file mode 100644 index 0000000..1ae5b52 --- /dev/null +++ b/kernel/selinux-testsuite/sctp-peeloff/main.fmf @@ -0,0 +1,12 @@ +summary: Wrapper for selinux-testuite (+ extra SCTP peeloff tests) +description: | + This TC runs a functional test suite for the LSM-based SELinux security module. + + This variant additionaly includes a proposed patch for client-side SCTP + peeloff coverage. +contact: Ondrej Mosnacek +test: ../runtest.sh +environment: + GIT_PATCHES: 613793 +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2015525 From 06baee37d520a77a06928ed869e8d722bf9da7ce Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Sun, 13 Feb 2022 16:03:49 +0100 Subject: [PATCH 106/626] Revert "Add preliminary SCTP client-side peeloff coverage" This reverts commit 8b59d115d30b183743de8d3026a22c44130e9174. Never mind, I realized this is not actually needed... Signed-off-by: Ondrej Mosnacek --- kernel/selinux-testsuite/sctp-peeloff/main.fmf | 12 ------------ 1 file changed, 12 deletions(-) delete mode 100644 kernel/selinux-testsuite/sctp-peeloff/main.fmf diff --git a/kernel/selinux-testsuite/sctp-peeloff/main.fmf b/kernel/selinux-testsuite/sctp-peeloff/main.fmf deleted file mode 100644 index 1ae5b52..0000000 --- a/kernel/selinux-testsuite/sctp-peeloff/main.fmf +++ /dev/null @@ -1,12 +0,0 @@ -summary: Wrapper for selinux-testuite (+ extra SCTP peeloff tests) -description: | - This TC runs a functional test suite for the LSM-based SELinux security module. - - This variant additionaly includes a proposed patch for client-side SCTP - peeloff coverage. -contact: Ondrej Mosnacek -test: ../runtest.sh -environment: - GIT_PATCHES: 613793 -link: - - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2015525 From 7b6ee73ecbf37c183dea55e663d717ae469f61bf Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Sun, 13 Feb 2022 18:09:29 +0100 Subject: [PATCH 107/626] Add a test for two-way SCTP association setup This test reproduces a bug that may cause an AVC with sctp_socket, association, unlabeled_t, unlabeled_t (and also another bug related to SCTP peeloff on the client side). SCTP code taken and modified from selinux-testsuite's sctp subtest. Signed-off-by: Ondrej Mosnacek --- kernel/sctp_peer_label_bug/Makefile | 8 + kernel/sctp_peer_label_bug/main.fmf | 25 ++ kernel/sctp_peer_label_bug/runtest.sh | 61 +++ .../sctp_bz2048251_client.c | 109 +++++ .../sctp_bz2048251_server.c | 132 ++++++ kernel/sctp_peer_label_bug/sctp_common.c | 381 ++++++++++++++++++ kernel/sctp_peer_label_bug/sctp_common.h | 38 ++ 7 files changed, 754 insertions(+) create mode 100644 kernel/sctp_peer_label_bug/Makefile create mode 100644 kernel/sctp_peer_label_bug/main.fmf create mode 100755 kernel/sctp_peer_label_bug/runtest.sh create mode 100644 kernel/sctp_peer_label_bug/sctp_bz2048251_client.c create mode 100644 kernel/sctp_peer_label_bug/sctp_bz2048251_server.c create mode 100644 kernel/sctp_peer_label_bug/sctp_common.c create mode 100644 kernel/sctp_peer_label_bug/sctp_common.h diff --git a/kernel/sctp_peer_label_bug/Makefile b/kernel/sctp_peer_label_bug/Makefile new file mode 100644 index 0000000..30c86c8 --- /dev/null +++ b/kernel/sctp_peer_label_bug/Makefile @@ -0,0 +1,8 @@ +# Minimal Makefile for standard-test-roles-beakerlib + +R="Requires: kernel-modules-extra" +R="RhtsRequires: make gcc lksctp-tools-devel audit kernel-modules" + +run: + chmod +x runtest.sh + ./runtest.sh diff --git a/kernel/sctp_peer_label_bug/main.fmf b/kernel/sctp_peer_label_bug/main.fmf new file mode 100644 index 0000000..ae87830 --- /dev/null +++ b/kernel/sctp_peer_label_bug/main.fmf @@ -0,0 +1,25 @@ +summary: Verify that two-way SCTP association setup doesn't trigger AVCs +description: | + Verify that two-way SCTP association setup doesn't trigger AVCs. +contact: Ondrej Mosnacek +component: + - kernel +framework: beakerlib +require: + - make + - gcc + - lksctp-tools-devel + - audit + - kernel-modules +recommend: + - kernel-modules-extra +duration: 10m +tier: 2 +enabled: true +adjust: + - enabled: false + when: distro < rhel-8 + because: RHEL-7 and below don't have SCTP SELinux support +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2048251 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2015525 diff --git a/kernel/sctp_peer_label_bug/runtest.sh b/kernel/sctp_peer_label_bug/runtest.sh new file mode 100755 index 0000000..22d2150 --- /dev/null +++ b/kernel/sctp_peer_label_bug/runtest.sh @@ -0,0 +1,61 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# SPDX-License-Identifier: GPLv2 +# Copyright (c) 2022 Red Hat, Inc. +# Author: Ondrej Mosnacek + +# Include Beakerlib environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +function check_avc_begin() { + sleep 1.1 + date +'%x %T' + sleep 1.1 +} + +function check_avc_end() { + marker="marker-$RANDOM" + + auditctl -m "$marker" + + for (( i = 0; i < 100; i++ )); do + if ausearch -i -m user -ts $1 2>/dev/null flag" 0 "Wait for the server to start listening" + rlRun "./sctp_bz2048251_client 127.0.0.1 9999" 0 "Run the client" + rlRun "wait" 0 "Wait for the server to exit" + + rlRun "check_avc_end \"\$audit_ts\"" 1 "Check if there are AVC denials" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "rm -f sctp_bz2048251_client sctp_bz2048251_server flag" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/kernel/sctp_peer_label_bug/sctp_bz2048251_client.c b/kernel/sctp_peer_label_bug/sctp_bz2048251_client.c new file mode 100644 index 0000000..03fbd09 --- /dev/null +++ b/kernel/sctp_peer_label_bug/sctp_bz2048251_client.c @@ -0,0 +1,109 @@ +#include "sctp_common.h" + +static void usage(char *progname) +{ + fprintf(stderr, + "usage: %s [-v] addr port\n" + "\nWhere:\n\t" + + "-v Print context and ip options information.\n\t" + "addr IPv4 or IPv6 address (e.g. 127.0.0.1 or ::1).\n\t" + "port Port for accessing server.\n", progname); + exit(1); +} + +int main(int argc, char **argv) +{ + int opt, sock, result; + struct addrinfo hints, *serverinfo; + bool verbose = false; + struct timeval tm; + socklen_t sinlen; + struct sockaddr_storage sin; + + while ((opt = getopt(argc, argv, "v")) != -1) { + switch (opt) { + case 'v': + verbose = true; + break; + default: + usage(argv[0]); + } + } + + if ((argc - optind) != 2) + usage(argv[0]); + + memset(&hints, 0, sizeof(struct addrinfo)); + hints.ai_protocol = IPPROTO_SCTP; + hints.ai_socktype = SOCK_SEQPACKET; + + result = getaddrinfo(argv[optind], argv[optind + 1], &hints, + &serverinfo); + if (result < 0) { + fprintf(stderr, "Client getaddrinfo: %s\n", + gai_strerror(result)); + exit(2); + } + + sock = socket(serverinfo->ai_family, serverinfo->ai_socktype, + serverinfo->ai_protocol); + if (sock < 0) { + perror("Client socket"); + exit(3); + } + + /* + * These timeouts are set to test whether the peer { recv } completes + * or not when the permission is denied. + */ + tm.tv_sec = 4; + tm.tv_usec = 0; + result = setsockopt(sock, SOL_SOCKET, SO_SNDTIMEO, &tm, sizeof(tm)); + if (result < 0) { + perror("Client setsockopt: SO_SNDTIMEO"); + exit(4); + } + + result = setsockopt(sock, SOL_SOCKET, SO_RCVTIMEO, &tm, sizeof(tm)); + if (result < 0) { + perror("Client setsockopt: SO_RCVTIMEO"); + exit(5); + } + + if (listen(sock, SOMAXCONN)) { + perror("Client listen"); + close(sock); + exit(1); + } + + /* Subscribe to assoc_id events */ + result = set_subscr_events(sock, off, on, off, off); + if (result < 0) { + perror("Client setsockopt: SCTP_EVENTS"); + return 1; + } + + result = open_assoc(sock, serverinfo->ai_addr, serverinfo->ai_addrlen, + verbose); + if (result) { + close(sock); + exit(result); + } + + result = receive_assoc(sock, &sin, &sinlen, verbose); + if (result) { + close(sock); + exit(result); + } + + result = open_assoc(sock, serverinfo->ai_addr, serverinfo->ai_addrlen, + verbose); + if (result) { + close(sock); + exit(result); + } + + close(sock); + exit(0); +} diff --git a/kernel/sctp_peer_label_bug/sctp_bz2048251_server.c b/kernel/sctp_peer_label_bug/sctp_bz2048251_server.c new file mode 100644 index 0000000..bf47257 --- /dev/null +++ b/kernel/sctp_peer_label_bug/sctp_bz2048251_server.c @@ -0,0 +1,132 @@ +#include "sctp_common.h" + +static void usage(char *progname) +{ + fprintf(stderr, + "usage: %s [-4] [-f file] [-v] port\n" + "\nWhere:\n\t" + "-4 Listen on IPv4 addresses only.\n\t" + "-f Write a line to the file when listening starts.\n\t" + " \"nopeer\" message to client, otherwise the peer context\n\t" + " will be retrieved and sent to client.\n\t" + "-v Print context and ip options information.\n\t" + "port Listening port.\n", progname); + exit(1); +} + +int main(int argc, char **argv) +{ + int opt, sock, result; + socklen_t sinlen; + struct sockaddr_storage sin; + struct addrinfo hints, *res; + char *flag_file = NULL; + bool verbose = false, ipv4 = false; + unsigned short port; + + while ((opt = getopt(argc, argv, "4f:v")) != -1) { + switch (opt) { + case '4': + ipv4 = true; + break; + case 'f': + flag_file = optarg; + break; + case 'v': + verbose = true; + break; + default: + usage(argv[0]); + } + } + + if ((argc - optind) != 1) + usage(argv[0]); + + port = atoi(argv[optind]); + if (!port) + usage(argv[0]); + + memset(&hints, 0, sizeof(struct addrinfo)); + hints.ai_flags = AI_PASSIVE; + hints.ai_protocol = IPPROTO_SCTP; + + if (ipv4) + hints.ai_family = AF_INET; + else + hints.ai_family = AF_INET6; + + /* sctp_peeloff(3) must be from 1 to Many style socket */ + hints.ai_socktype = SOCK_SEQPACKET; + + result = getaddrinfo(NULL, argv[optind], &hints, &res); + if (result < 0) { + fprintf(stderr, "Server getaddrinfo: %s\n", + gai_strerror(result)); + exit(1); + } + + sock = socket(res->ai_family, res->ai_socktype, res->ai_protocol); + if (sock < 0) { + perror("Server socket"); + exit(1); + } + + result = setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on)); + if (result < 0) { + perror("Server setsockopt: SO_REUSEADDR"); + close(sock); + exit(1); + } + + result = bind(sock, res->ai_addr, res->ai_addrlen); + if (result < 0) { + perror("Server bind"); + close(sock); + exit(1); + } + + if (listen(sock, SOMAXCONN)) { + perror("Server listen"); + close(sock); + exit(1); + } + + if (flag_file) { + FILE *f = fopen(flag_file, "w"); + if (!f) { + perror("Flag file open"); + exit(1); + } + fprintf(f, "listening\n"); + fclose(f); + } + + /* Subscribe to assoc_id events */ + result = set_subscr_events(sock, off, on, off, off); + if (result < 0) { + perror("Client setsockopt: SCTP_EVENTS"); + return 1; + } + + result = receive_assoc(sock, &sin, &sinlen, verbose); + if (result) { + close(sock); + exit(result); + } + + result = open_assoc(sock, (struct sockaddr *)&sin, sinlen, verbose); + if (result) { + close(sock); + exit(result); + } + + result = receive_assoc(sock, &sin, &sinlen, verbose); + if (result) { + close(sock); + exit(result); + } + + close(sock); + exit(0); +} diff --git a/kernel/sctp_peer_label_bug/sctp_common.c b/kernel/sctp_peer_label_bug/sctp_common.c new file mode 100644 index 0000000..99ab7cb --- /dev/null +++ b/kernel/sctp_peer_label_bug/sctp_common.c @@ -0,0 +1,381 @@ +#include "sctp_common.h" + +#define member_size(type, member) sizeof(((type *)0)->member) +#define sizeof_up_to(type, member) (offsetof(type, member) + member_size(type, member)) + +void print_addr_info(struct sockaddr *sin, char *text) +{ + struct sockaddr_in *addr4; + struct sockaddr_in6 *addr6; + char addr_str[INET6_ADDRSTRLEN + 1]; + + switch (sin->sa_family) { + case AF_INET: + addr4 = (struct sockaddr_in *)sin; + inet_ntop(sin->sa_family, + (void *)&addr4->sin_addr, + addr_str, INET6_ADDRSTRLEN + 1); + printf("%s IPv4 addr %s\n", text, addr_str); + break; + case AF_INET6: + addr6 = (struct sockaddr_in6 *)sin; + if (IN6_IS_ADDR_V4MAPPED(&addr6->sin6_addr)) { + inet_ntop(AF_INET, + (void *)&addr6->sin6_addr.s6_addr32[3], + addr_str, INET6_ADDRSTRLEN + 1); + printf("%s IPv6->IPv4 MAPPED addr %s\n", + text, addr_str); + } else if (IN6_IS_ADDR_LINKLOCAL(&addr6->sin6_addr)) { + inet_ntop(sin->sa_family, + (void *)&addr6->sin6_addr, + addr_str, INET6_ADDRSTRLEN + 1); + printf("%s IPv6 local link addr %s scope_id %d\n", + text, addr_str, + ((struct sockaddr_in6 *)addr6)->sin6_scope_id); + } else { + inet_ntop(sin->sa_family, + (void *)&addr6->sin6_addr, + addr_str, INET6_ADDRSTRLEN + 1); + printf("%s IPv6 addr %s\n", text, + addr_str); + } + break; + default: + printf("%s Unknown IP family %d\n", text, sin->sa_family); + break; + } +} + +int set_subscr_events(int fd, int data_io, int assoc, int addr, int shutd) +{ + struct sctp_event_subscribe subscr_events; + + memset(&subscr_events, 0, sizeof(subscr_events)); + subscr_events.sctp_data_io_event = data_io; + subscr_events.sctp_association_event = assoc; + subscr_events.sctp_address_event = addr; + subscr_events.sctp_shutdown_event = shutd; + + /* + * Truncate optlen to just the fields we touch to avoid errors when + * the uapi headers are newer than the running kernel. + */ + return setsockopt(fd, IPPROTO_SCTP, SCTP_EVENTS, &subscr_events, + sizeof_up_to(struct sctp_event_subscribe, + sctp_shutdown_event)); +} + +/* + * Currently only SCTP_ASSOC_CHANGE, SCTP_PEER_ADDR_CHANGE and + * SCTP_SHUTDOWN_EVENT are enabled via set_subscr_events(). + */ +int handle_event(void *buf, char *cmp_addr, sctp_assoc_t *assoc_id, + bool verbose, char *text) +{ + union sctp_notification *snp = buf; + char addrbuf[INET6_ADDRSTRLEN]; + struct sockaddr_in *sin; + struct sockaddr_in6 *sin6; + const char *ap; + struct sctp_paddr_change *spc; + struct sctp_assoc_change *sac; + struct sctp_remote_error *sre; + struct sctp_send_failed *ssf; + struct sctp_authkey_event *auth_event; + + switch (snp->sn_header.sn_type) { + case SCTP_ASSOC_CHANGE: + sac = &snp->sn_assoc_change; + + if (verbose) + printf("%s SCTP_ASSOC_CHANGE event for assoc_id: %d ERR: 0x%x\n", + text, sac->sac_assoc_id, sac->sac_error); + + if (assoc_id) + *assoc_id = sac->sac_assoc_id; + break; + case SCTP_PEER_ADDR_CHANGE: + spc = &snp->sn_paddr_change; + + if (verbose) + /* + * Not all spc_error codes are errors - linux/sctp.h + * (e.g. SCTP_HEARTBEAT_SUCCESS = 0x02) + */ + printf("%s SCTP_PEER_ADDR_CHANGE event for assoc_id: %d ERR: 0x%x\n", + text, spc->spc_assoc_id, spc->spc_error); + + if (spc->spc_aaddr.ss_family == AF_INET) { + sin = (struct sockaddr_in *) &spc->spc_aaddr; + ap = inet_ntop(AF_INET, &sin->sin_addr, addrbuf, + INET6_ADDRSTRLEN); + } else { + sin6 = (struct sockaddr_in6 *) &spc->spc_aaddr; + ap = inet_ntop(AF_INET6, &sin6->sin6_addr, addrbuf, + INET6_ADDRSTRLEN); + } + if (verbose) /* Print additional address details */ + print_addr_info((struct sockaddr *)&spc->spc_aaddr, + "Peer Address change:\n\t"); + + switch (spc->spc_state) { + case SCTP_ADDR_AVAILABLE: + if (verbose) + printf("\t%s is available\n", text); + break; + case SCTP_ADDR_UNREACHABLE: + if (verbose) + printf("\t%s is not available - Error: 0x%x\n", + text, spc->spc_error); + break; + case SCTP_ADDR_REMOVED: + if (verbose) + printf("\t%s was removed\n", text); + break; + case SCTP_ADDR_ADDED: + if (verbose) + printf("\t%s was added\n", text); + break; + case SCTP_ADDR_MADE_PRIM: + if (verbose) + printf("\t%s is primary\n", text); + if (cmp_addr) { + if (!strcmp(ap, cmp_addr)) { + if (verbose) + printf("\t%s and is now the new primary\n", text); + + return EVENT_ADDR_MATCH; + } + } + break; + case SCTP_ADDR_CONFIRMED: + if (verbose) + printf("\t%s is confirmed\n", text); + break; + default: + if (verbose) + printf("%s unknown state: %d\n", text, + spc->spc_state); + break; + } + break; + case SCTP_SEND_FAILED: + ssf = &snp->sn_send_failed; + + if (verbose) + printf("%s SCTP_SEND_FAILED event assoc_id: %d ERR: 0x%x\n", + text, ssf->ssf_assoc_id, ssf->ssf_error); + break; + case SCTP_REMOTE_ERROR: + sre = &snp->sn_remote_error; + if (verbose) /* Error in network byte order - linux/sctp.h */ + printf("%s SCTP_REMOTE_ERROR event ERR: 0x%x\n", + text, ntohs(sre->sre_error)); + break; + case SCTP_SHUTDOWN_EVENT: + if (verbose) + printf("%s SCTP_SHUTDOWN_EVENT\n", text); + + return EVENT_SHUTDOWN; + case SCTP_PARTIAL_DELIVERY_EVENT: + if (verbose) + printf("%s SCTP_PARTIAL_DELIVERY_EVENT\n", text); + break; + case SCTP_ADAPTATION_INDICATION: + if (verbose) + printf("%s SCTP_ADAPTATION_INDICATION event\n", text); + break; + case SCTP_AUTHENTICATION_INDICATION: + auth_event = &snp->sn_authkey_event; + + if (verbose) { + printf("%s SCTP_AUTHENTICATION_INDICATION event\n" + "\tauth_event->auth_type: 0x%x\n" + "\tauth_event->auth_flags: 0x%x\n" + "\tauth_event->auth_length: 0x%x\n" + "\tauth_event->auth_keynumber: 0x%x\n" + "\tauth_event->auth_indication: 0x%x\n" + "\tauth_event->auth_assoc_id: %d\n", + text, auth_event->auth_type, + auth_event->auth_flags, + auth_event->auth_length, + auth_event->auth_keynumber, + auth_event->auth_indication, + auth_event->auth_assoc_id); + } + /* SCTP_AUTH_NO_AUTH defined in linux/sctp.h */ + if (auth_event->auth_indication == SCTP_AUTH_NO_AUTH) + return EVENT_NO_AUTH; + break; + case SCTP_SENDER_DRY_EVENT: + if (verbose) + printf("%s SCTP_SENDER_DRY_EVENT\n", text); + break; + case SCTP_STREAM_RESET_EVENT: + if (verbose) + printf("%s SCTP_STREAM_RESET_EVENT\n", text); + break; + case SCTP_ASSOC_RESET_EVENT: + if (verbose) + printf("%s SCTP_ASSOC_RESET_EVENT\n", text); + break; + case SCTP_STREAM_CHANGE_EVENT: + if (verbose) + printf("%s SCTP_STREAM_CHANGE_EVENT\n", text); + break; + case SCTP_SEND_FAILED_EVENT: + if (verbose) + printf("%s SCTP_SEND_FAILED_EVENT\n", text); + break; + default: + fprintf(stderr, "%s unknown event: 0x%x\n", text, + snp->sn_header.sn_type); + break; + } + + return EVENT_OK; +} + +int receive_assoc(int sock, struct sockaddr_storage *sin, socklen_t *sinlen, + int verbose) +{ + int result, peeloff_sk = 0, flags; + sctp_assoc_t assoc_id = 0; + char *peerlabel, msglabel[256]; + + *sinlen = sizeof(*sin); + flags = 0; + + result = sctp_recvmsg(sock, msglabel, sizeof(msglabel), + (struct sockaddr *)sin, sinlen, + NULL, &flags); + if (result < 0) { + perror("Server sctp_recvmsg-1"); + return 1; + } + + if (verbose) + print_addr_info((struct sockaddr *)sin, + "Server SEQPACKET recvmsg"); + + if (!(flags & MSG_NOTIFICATION) || !(flags & MSG_EOR)) { + printf("Invalid sctp_recvmsg response FLAGS: %x\n", + flags); + return 1; + } + + handle_event(msglabel, NULL, &assoc_id, + verbose, "Peeloff Server"); + if (assoc_id <= 0) { + printf("Server Invalid association ID: %d\n", + assoc_id); + return 1; + } + peeloff_sk = sctp_peeloff(sock, assoc_id); + if (peeloff_sk < 0) { + perror("Server sctp_peeloff"); + return 1; + } + if (verbose) { + printf("Server sctp_peeloff(3) on sk: %d with association ID: %d\n", + peeloff_sk, assoc_id); + } + + /* Now get the client msg on peeloff socket */ + result = sctp_recvmsg(peeloff_sk, msglabel, sizeof(msglabel), + (struct sockaddr *)sin, sinlen, + NULL, &flags); + if (result < 0) { + perror("Server sctp_recvmsg-2"); + close(peeloff_sk); + return 1; + } + + if (verbose) { + print_addr_info((struct sockaddr *)sin, + "Server SEQPACKET peeloff recvmsg"); + printf("peeloff association ID: %d\n", + assoc_id); + } + + peerlabel = strdup("nopeer"); + + printf("Server PEELOFF peer label: %s\n", peerlabel); + + result = sctp_sendmsg(peeloff_sk, peerlabel, + strlen(peerlabel), + NULL, 0, + 0, 0, 0, 0, 0); + if (result < 0) { + perror("Server sctp_sendmsg"); + close(peeloff_sk); + close(sock); + exit(1); + } + + if (verbose) + printf("Server PEELOFF sent: %s\n", peerlabel); + + free(peerlabel); + + close(peeloff_sk); + return 0; +} + +int open_assoc(int sock, struct sockaddr *sin, socklen_t sinlen, + int verbose) +{ + int result, peeloff_sk = 0, flags; + sctp_assoc_t assoc_id = 0; + char byte = 0x41, label[1024]; + + result = connect(sock, sin, sinlen); + if (result < 0) { + perror("Client connect"); + return 1; + } + + /* Get assoc_id for sctp_peeloff() */ + flags = 0; + result = sctp_recvmsg(sock, label, sizeof(label), + NULL, 0, NULL, &flags); + if (result < 0) { + perror("Client sctp_recvmsg-1"); + return 1; + } + + if ((flags & (MSG_NOTIFICATION | MSG_EOR)) != (MSG_NOTIFICATION | MSG_EOR)) { + printf("Invalid sctp_recvmsg response FLAGS: %x\n", flags); + return 1; + } + handle_event(label, NULL, &assoc_id, verbose, "Peeloff Client"); + if (assoc_id <= 0) { + printf("Client Invalid association ID: %d\n", assoc_id); + return 1; + } + + peeloff_sk = sctp_peeloff(sock, assoc_id); + if (peeloff_sk < 0) { + perror("Client sctp_peeloff"); + return 1; + } + + result = sctp_sendmsg(peeloff_sk, &byte, 1, NULL, 0, + 0, 0, 0, 0, 0); + if (result < 0) { + perror("Client sctp_sendmsg"); + close(peeloff_sk); + return 1; + } + + result = sctp_recvmsg(peeloff_sk, label, sizeof(label), + NULL, 0, NULL, NULL); + if (result < 0) { + perror("Client sctp_recvmsg"); + close(peeloff_sk); + return 1; + } + + close(peeloff_sk); + return 0; +} diff --git a/kernel/sctp_peer_label_bug/sctp_common.h b/kernel/sctp_peer_label_bug/sctp_common.h new file mode 100644 index 0000000..aeec4d2 --- /dev/null +++ b/kernel/sctp_peer_label_bug/sctp_common.h @@ -0,0 +1,38 @@ +#ifndef _GNU_SOURCE +#define _GNU_SOURCE /* For poll(2) POLLRDHUP - Detect client close(2) */ +#endif + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +enum event_ret { + EVENT_OK, + EVENT_ADDR_MATCH, + EVENT_SHUTDOWN, + EVENT_NO_AUTH +}; + +void print_addr_info(struct sockaddr *sin, char *text); +int set_subscr_events(int fd, int data_io, int assoc, int addr, int shutd); +int handle_event(void *buf, char *cmp_addr, sctp_assoc_t *assoc_id, + bool verbose, char *text); + +static const int on = 1, off = 0; + +int receive_assoc(int sock, struct sockaddr_storage *sin, socklen_t *sinlen, + int verbose); +int open_assoc(int sock, struct sockaddr *sin, socklen_t sinlen, int verbose); From c776c35f825bc4e504c48ead56d559f0c09766bc Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Mon, 14 Feb 2022 22:38:43 +0100 Subject: [PATCH 108/626] kernel/sctp_peer_label_bug: subscribe to events early (server) This is needed to avoid a race condition. Signed-off-by: Ondrej Mosnacek --- kernel/sctp_peer_label_bug/sctp_bz2048251_server.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/kernel/sctp_peer_label_bug/sctp_bz2048251_server.c b/kernel/sctp_peer_label_bug/sctp_bz2048251_server.c index bf47257..2af11f6 100644 --- a/kernel/sctp_peer_label_bug/sctp_bz2048251_server.c +++ b/kernel/sctp_peer_label_bug/sctp_bz2048251_server.c @@ -92,6 +92,13 @@ int main(int argc, char **argv) exit(1); } + /* Subscribe to assoc_id events */ + result = set_subscr_events(sock, off, on, off, off); + if (result < 0) { + perror("Client setsockopt: SCTP_EVENTS"); + return 1; + } + if (flag_file) { FILE *f = fopen(flag_file, "w"); if (!f) { @@ -102,13 +109,6 @@ int main(int argc, char **argv) fclose(f); } - /* Subscribe to assoc_id events */ - result = set_subscr_events(sock, off, on, off, off); - if (result < 0) { - perror("Client setsockopt: SCTP_EVENTS"); - return 1; - } - result = receive_assoc(sock, &sin, &sinlen, verbose); if (result) { close(sock); From fab242726e7c14e299c45d24a8397c8019a36bfd Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Mon, 14 Feb 2022 22:43:25 +0100 Subject: [PATCH 109/626] kernel/sctp_peer_label_bug: timeout the server In case of a bug/error, the server may end up hanging, so make sure it terminates in some reasonable time. Signed-off-by: Ondrej Mosnacek --- kernel/sctp_peer_label_bug/runtest.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/sctp_peer_label_bug/runtest.sh b/kernel/sctp_peer_label_bug/runtest.sh index 22d2150..96973c2 100755 --- a/kernel/sctp_peer_label_bug/runtest.sh +++ b/kernel/sctp_peer_label_bug/runtest.sh @@ -46,7 +46,7 @@ rlJournalStart rlPhaseStartTest rlRun "audit_ts=\"\$(check_avc_begin)\"" - rlRun "./sctp_bz2048251_server -f flag -4 9999 &" 0 "Start the server" + rlRun "timeout 30 ./sctp_bz2048251_server -f flag -4 9999 &" 0 "Start the server" rlRun "read -t 5 <>flag" 0 "Wait for the server to start listening" rlRun "./sctp_bz2048251_client 127.0.0.1 9999" 0 "Run the client" rlRun "wait" 0 "Wait for the server to exit" From 003e7202d6cf3777bd88f32e854ac716eb4ef738 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Mon, 14 Feb 2022 23:33:26 +0100 Subject: [PATCH 110/626] kernel/sctp_peer_label_bug: sleep before open_assoc It seems none of the attempts to synchronize before connecting are good enough - add some extra sleep time to the beginning of open_assoc(). Signed-off-by: Ondrej Mosnacek --- kernel/sctp_peer_label_bug/sctp_common.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/kernel/sctp_peer_label_bug/sctp_common.c b/kernel/sctp_peer_label_bug/sctp_common.c index 99ab7cb..f8c6fbf 100644 --- a/kernel/sctp_peer_label_bug/sctp_common.c +++ b/kernel/sctp_peer_label_bug/sctp_common.c @@ -329,6 +329,9 @@ int open_assoc(int sock, struct sockaddr *sin, socklen_t sinlen, sctp_assoc_t assoc_id = 0; char byte = 0x41, label[1024]; + /* otherwise we might connect too fast */ + sleep(1); + result = connect(sock, sin, sinlen); if (result < 0) { perror("Client connect"); From c6c5a1fbe6d09973a23275ea2c38f9baaa2afad1 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Sat, 19 Feb 2022 11:26:57 +0100 Subject: [PATCH 111/626] semodule-l-checksum: checksum format changed In the latest update, the checksum format in `semodule -l --checksum` changed from "$SHA256" to "sha256:$SHA256" --- policycoreutils/semodule-l-checksum/runtest.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/policycoreutils/semodule-l-checksum/runtest.sh b/policycoreutils/semodule-l-checksum/runtest.sh index e5b5813..898a9c7 100755 --- a/policycoreutils/semodule-l-checksum/runtest.sh +++ b/policycoreutils/semodule-l-checksum/runtest.sh @@ -67,7 +67,7 @@ EOF" sha256=($(sha256sum test_module.cil)) rlAssertEquals "Is the module name 'test_module'?" ${module[1]} "test_module" rlAssertEquals "Is the module priority '500'?" ${module[0]} "500" - rlAssertEquals "Is the loaded module checksum same as the file checksum? " ${module[3]} ${sha256[0]} + rlAssertEquals "Is the loaded module checksum same as the file checksum? " ${module[3]} "sha256:${sha256[0]}" rlPhaseEnd rlPhaseStartTest "is the checksum option listed?" From aa575878d40cc219215c0b9ed32e1b9ed1920e51 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Wed, 23 Feb 2022 10:04:49 +0100 Subject: [PATCH 112/626] test if systemd-sysctl can read files under /proc/sys/ directory Recent systemd-sysctl testing revealed that the systemd-sysctl process wants to read certain files located under /proc/sys/ directory, but SELinux denies that access. The TC reproduces the situation. Because the systemd-sysctl service is executed by default during each reboot, I believe that SELinux policy should allow the service to work successfully. The TC looks for appropriate policy rules and file context patterns. The TC covers BZ#2056207 and BZ#2056999. --- .../systemd-sysctl-and-similar/Makefile | 69 +++++++++++++++++ .../systemd-sysctl-and-similar/PURPOSE | 5 ++ .../systemd-sysctl-and-similar/main.fmf | 2 + .../systemd-sysctl-and-similar/runtest.sh | 76 +++++++++++++++++++ 4 files changed, 152 insertions(+) create mode 100644 selinux-policy/systemd-sysctl-and-similar/Makefile create mode 100644 selinux-policy/systemd-sysctl-and-similar/PURPOSE create mode 100644 selinux-policy/systemd-sysctl-and-similar/main.fmf create mode 100755 selinux-policy/systemd-sysctl-and-similar/runtest.sh diff --git a/selinux-policy/systemd-sysctl-and-similar/Makefile b/selinux-policy/systemd-sysctl-and-similar/Makefile new file mode 100644 index 0000000..5b5981e --- /dev/null +++ b/selinux-policy/systemd-sysctl-and-similar/Makefile @@ -0,0 +1,69 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/systemd-sysctl-and-similar +# Description: Does the systemd-sysctl work correctly under SELinux confinement? +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2022 Red Hat, Inc. +# +# This program is free software: you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation, either version 2 of +# the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see http://www.gnu.org/licenses/. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/systemd-sysctl-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + test -x runtest.sh || chmod a+x runtest.sh + test -x runtest.sh || chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: Does the systemd-sysctl work correctly under SELinux confinement?" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "RunFor: systemd" >> $(METADATA) + @echo "Requires: audit libselinux-utils policycoreutils selinux-policy setools-console systemd /usr/sbin/service" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2+" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL6 -RHEL7 -RHELClient5 -RHELServer5" >> $(METADATA) + @echo "Bug: 2056207" >> $(METADATA) # Fedora 36 + @echo "Bug: 2056999" >> $(METADATA) # RHEL-9 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/systemd-sysctl-and-similar/PURPOSE b/selinux-policy/systemd-sysctl-and-similar/PURPOSE new file mode 100644 index 0000000..6660acb --- /dev/null +++ b/selinux-policy/systemd-sysctl-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/systemd-sysctl-and-similar +Author: Milos Malik + +Does the systemd-sysctl work correctly under SELinux confinement? + diff --git a/selinux-policy/systemd-sysctl-and-similar/main.fmf b/selinux-policy/systemd-sysctl-and-similar/main.fmf new file mode 100644 index 0000000..88d805d --- /dev/null +++ b/selinux-policy/systemd-sysctl-and-similar/main.fmf @@ -0,0 +1,2 @@ +path: /selinux-policy/systemd-sysctl-and-similar +tier: 2 diff --git a/selinux-policy/systemd-sysctl-and-similar/runtest.sh b/selinux-policy/systemd-sysctl-and-similar/runtest.sh new file mode 100755 index 0000000..52ce90c --- /dev/null +++ b/selinux-policy/systemd-sysctl-and-similar/runtest.sh @@ -0,0 +1,76 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/systemd-sysctl-and-similar +# Description: Does the systemd-sysctl work correctly under SELinux confinement? +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2022 Red Hat, Inc. +# +# This program is free software: you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation, either version 2 of +# the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see http://www.gnu.org/licenses/. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +PROCESS_CONTEXT="systemd_sysctl_t" +PROCESS_NAME="systemd-sysctl" +SERVICE_NAME="systemd-sysctl" +SERVICE_PACKAGE="systemd" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "bz#2056207 + bz#2056999" + rlSEMatchPathCon "/usr/lib/systemd/systemd-sysctl" "systemd_sysctl_exec_t" + rlRun "ls -Z /proc/sys/fs/suid_dumpable | grep :proc_security_t" + rlRun "ls -Z /proc/sys/fs/protected_hardlinks | grep :proc_security_t" + rlRun "ls -Z /proc/sys/fs/protected_symlinks | grep :proc_security_t" + rlRun "ls -Z /proc/sys/kernel/kptr_restrict | grep :proc_security_t" + rlSESearchRule "allow systemd_sysctl_t proc_security_t : file { read } [ ]" + rlPhaseEnd + + rlPhaseStartTest "real scenario" + rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /run /var" 0-255 + rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + From 7a766b5ecdf594d01f6e0587d59b5dab72aa2c48 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 22 Feb 2022 15:01:56 +0100 Subject: [PATCH 113/626] install the required packages For unknown reason, the selinux-policy-mls package is not installed before execution of the TC, even though it it a required package. From now on, the TC will install the package explicitely. --- checkpolicy/checkpolicy/runtest.sh | 1 + 1 file changed, 1 insertion(+) diff --git a/checkpolicy/checkpolicy/runtest.sh b/checkpolicy/checkpolicy/runtest.sh index 7bdfbba..821d735 100644 --- a/checkpolicy/checkpolicy/runtest.sh +++ b/checkpolicy/checkpolicy/runtest.sh @@ -35,6 +35,7 @@ PACKAGE="checkpolicy" rlJournalStart rlPhaseStartSetup rlAssertRpm ${PACKAGE} + rlRun "yum -y install selinux-policy-minimum selinux-policy-mls selinux-policy-targeted" rlAssertRpm selinux-policy-minimum rlAssertRpm selinux-policy-mls rlAssertRpm selinux-policy-targeted From 8b7e684a0d514c5fe0046ea145ee8ea7d4345144 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Tue, 1 Mar 2022 10:42:23 +0100 Subject: [PATCH 114/626] Add a test for semodule --rebuild-if-modules-changed Signed-off-by: Ondrej Mosnacek --- .../Makefile | 7 ++ .../main.fmf | 28 +++++++ .../runtest.sh | 82 +++++++++++++++++++ 3 files changed, 117 insertions(+) create mode 100644 policycoreutils/semodule-rebuild-if-modules-changed/Makefile create mode 100644 policycoreutils/semodule-rebuild-if-modules-changed/main.fmf create mode 100755 policycoreutils/semodule-rebuild-if-modules-changed/runtest.sh diff --git a/policycoreutils/semodule-rebuild-if-modules-changed/Makefile b/policycoreutils/semodule-rebuild-if-modules-changed/Makefile new file mode 100644 index 0000000..313928c --- /dev/null +++ b/policycoreutils/semodule-rebuild-if-modules-changed/Makefile @@ -0,0 +1,7 @@ +# Minimal Makefile for standard-test-roles-beakerlib + +R="RhtsRequires: policycoreutils checkpolicy setools-console selinux-policy-targeted" + +run: + chmod +x runtest.sh + ./runtest.sh diff --git a/policycoreutils/semodule-rebuild-if-modules-changed/main.fmf b/policycoreutils/semodule-rebuild-if-modules-changed/main.fmf new file mode 100644 index 0000000..1a8db10 --- /dev/null +++ b/policycoreutils/semodule-rebuild-if-modules-changed/main.fmf @@ -0,0 +1,28 @@ +summary: Test rebuild-on-change support in semodule +description: | + Verifies that semodule --rebuild-if-modules-changed command-line option + works as it should. +contact: Ondrej Mosnacek +component: + - policycoreutils +framework: beakerlib +require: + - policycoreutils + - checkpolicy + - setools-console + - selinux-policy-targeted +duration: 15m +tier: 2 +enabled: true +adjust: + - enabled: false + when: distro < rhel-8 + because: RHEL-7 and below are not expected to support this + - enabled: false + when: distro < fedora-36 + because: This feature may not be available in F35 and below +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2049186 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2049189 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2049191 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2049193 diff --git a/policycoreutils/semodule-rebuild-if-modules-changed/runtest.sh b/policycoreutils/semodule-rebuild-if-modules-changed/runtest.sh new file mode 100755 index 0000000..8f55dda --- /dev/null +++ b/policycoreutils/semodule-rebuild-if-modules-changed/runtest.sh @@ -0,0 +1,82 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# SPDX-License-Identifier: GPLv2 +# Copyright (c) 2021 Red Hat, Inc. +# Author: Ondrej Mosnacek + +# Include Beakerlib environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +STORE_ROOT=/var/lib/selinux +STORE_TYPE=targeted +MODULES_ROOT="$STORE_ROOT/$STORE_TYPE/active/modules" +STORE_POLICY="$STORE_ROOT/$STORE_TYPE/active/policy.kern" +TEST_MODULE_DIR="$MODULES_ROOT/400/test_module" + +CHECKSUM_CMD=sha256sum + +function policy_checksum() { + local policyvers="$1" + + "$CHECKSUM_CMD" "/etc/selinux/$STORE_TYPE/policy/policy.$policyvers" +} + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm "libsemanage" + rlAssertRpm "policycoreutils" + + policyvers="$(checkpolicy -V | cut -f 1 -d ' ')" + policyvers_kernel="$(cat /sys/fs/selinux/policyvers)" + if [ "$policyvers" -lt "$policyvers_kernel" ]; then + policyvers="$policyvers_kernel" + fi + rlPhaseEnd + + rlPhaseStartTest + if semodule --help | grep -q -- --rebuild-if-modules-changed; then + rlRun "semodule -N -B" 0 \ + "Make sure policy store is in a consistent state initially" + + checksum_before="$(policy_checksum "$policyvers")" + rlRun "semodule -N --rebuild-if-modules-changed" + checksum_after="$(policy_checksum "$policyvers")" + rlAssertEquals "Binary policy must not change after rebuild" \ + "$checksum_before" "$checksum_after" + + rlRun "semodule -N -B" 0 \ + "Make sure policy store is in a consistent state initially" + + rlLog "Inject a new module into the store" + rlRun "mkdir -p \"\$TEST_MODULE_DIR\"" + rlRun "echo -n cil >\"\$TEST_MODULE_DIR/lang_ext\"" + rlRun "echo '(type test_module_type_t)' >\"\$TEST_MODULE_DIR/cil\"" + rlRun "semodule -N --rebuild-if-modules-changed" 0 \ + "Do a conditional rebuild" + rlRun "semodule -l | grep test_module" 0 \ + "Verify that the module has been picked up" + rlRun "seinfo -t test_module_type_t \"\$STORE_POLICY\" | grep test_module_type_t" 0 \ + "Verify that the new type is included in the built policy" + + rlLog "Now remove the module" + rlRun "rm -rf \"\$TEST_MODULE_DIR\"" + rlRun "semodule -N --rebuild-if-modules-changed" + rlRun "semodule -l | grep test_module" 1 \ + "Verify that the module has been removed" + rlRun "seinfo -t test_module_type_t \"\$STORE_POLICY\" | grep test_module_type_t" 1 \ + "Verify that the new type is NOT included in the built policy" + + # Make sure policy is restored regardless of any previous failures + rlRun "semodule -N -B" 0 \ + "Force a rebuild to clean things up" + #rlRun "setsebool -NP daemons_use_tty=on" + # TODO test changing booleans (persistently) + else + rlLog "--rebuild-if-modules-changed command-line option not supported; skipping tests..." + fi + rlPhaseEnd + + rlPhaseStartCleanup + rlPhaseEnd +rlJournalPrintText +rlJournalEnd From a8158ee0bf7dd21acf908357a702396ba1dfc1f8 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Mon, 14 Mar 2022 08:39:51 +0100 Subject: [PATCH 115/626] remove users forcefully Sometimes the userdel commands end up with the following error: userdel: user is currently used by process which leads to a situation where the subsequent useradd commands (which use the same username) also end up with an error: useradd: user already exists To avoid such errors, the '-f' option was added to all userdel commands. --- .../usepasswd-in-semanage-conf/Makefile | 2 +- .../usepasswd-in-semanage-conf/runtest.sh | 30 +++++++++---------- 2 files changed, 16 insertions(+), 16 deletions(-) diff --git a/libsemanage/usepasswd-in-semanage-conf/Makefile b/libsemanage/usepasswd-in-semanage-conf/Makefile index 04e5715..f63aae5 100644 --- a/libsemanage/usepasswd-in-semanage-conf/Makefile +++ b/libsemanage/usepasswd-in-semanage-conf/Makefile @@ -53,7 +53,7 @@ $(METADATA): Makefile @echo "Type: Sanity" >> $(METADATA) @echo "TestTime: 10m" >> $(METADATA) @echo "RunFor: libsemanage" >> $(METADATA) - @echo "Requires: libselinux libselinux-utils libsemanage policycoreutils policycoreutils-python-utils selinux-policy selinux-policy-devel" >> $(METADATA) + @echo "Requires: libselinux libselinux-utils libsemanage policycoreutils policycoreutils-python-utils selinux-policy selinux-policy-devel shadow-utils" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @echo "License: GPLv2" >> $(METADATA) @echo "Confidential: no" >> $(METADATA) diff --git a/libsemanage/usepasswd-in-semanage-conf/runtest.sh b/libsemanage/usepasswd-in-semanage-conf/runtest.sh index 8aadf23..b1ec6fd 100755 --- a/libsemanage/usepasswd-in-semanage-conf/runtest.sh +++ b/libsemanage/usepasswd-in-semanage-conf/runtest.sh @@ -61,9 +61,9 @@ rlJournalStart rlRun "semodule -B" # rebuild file_contexts.homedirs rlRun "semanage fcontext -l 2>&1 > ${OUTPUT_FILE}" # file context with new selinux login rlRun "diff -u ${CMP_FILE} ${OUTPUT_FILE}" 0 - rlRun "userdel duck-home" - rlRun "userdel duck-tmp" - rlRun "userdel duck-var-lib" + rlRun "userdel -f duck-home" + rlRun "userdel -f duck-tmp" + rlRun "userdel -f duck-var-lib" rlLog "SELinux users with home in / shoud not trigger a policy change" rlRun "useradd -Z unconfined_u -d /tmp duck-tmp" @@ -71,8 +71,8 @@ rlJournalStart rlRun "semodule -B" # rebuild file_contexts.homedirs rlRun "semanage fcontext -l 2>&1 > ${OUTPUT_FILE}" # file context with new selinux login rlRun "diff -u ${CMP_FILE} ${OUTPUT_FILE}" 0 - rlRun "userdel -Z duck-tmp" - rlRun "userdel -Z duck-var" + rlRun "userdel -fZ duck-tmp" + rlRun "userdel -fZ duck-var" rlLog "Other SELinux users should trigger a policy change" rlRun "useradd -Z unconfined_u duck-home" @@ -80,8 +80,8 @@ rlJournalStart rlRun "semodule -B" # rebuild file_contexts.homedirs rlRun "semanage fcontext -l 2>&1 > ${OUTPUT_FILE}" # file context with new selinux login rlRun "diff -u ${CMP_FILE} ${OUTPUT_FILE} | grep -E 'duck-(home|var-home)'" 0 - rlRun "userdel -Z duck-home" - rlRun "userdel -Z duck-var-home" + rlRun "userdel -fZ duck-home" + rlRun "userdel -fZ duck-var-home" rlFileRestore rlPhaseEnd @@ -98,14 +98,14 @@ rlJournalStart rlRun "semodule -B" # rebuild file_contexts.homedirs rlRun "semanage fcontext -l 2>&1 > ${OUTPUT_FILE}" # file context with new selinux login rlRun "diff -u ${CMP_FILE} ${OUTPUT_FILE}" 0 - rlRun "userdel duck-home" + rlRun "userdel -f duck-home" rlLog "Standard users with home in directory like /var/home should trigger a policy change" rlRun "useradd -d /var/home/duck duck-var-home" rlRun "semodule -B" # rebuild file_contexts.homedirs rlRun "semanage fcontext -l 2>&1 > ${OUTPUT_FILE}" # file context with new selinux login rlRun "diff -u ${CMP_FILE} ${OUTPUT_FILE} | grep -E '/var/home/'" 0 - rlRun "userdel duck-var-home" + rlRun "userdel -f duck-var-home" rlLog "Standard users with home in / shoud not trigger a policy change" rlRun "useradd -d /tmp duck-tmp" @@ -113,8 +113,8 @@ rlJournalStart rlRun "semodule -B" # rebuild file_contexts.homedirs rlRun "semanage fcontext -l 2>&1 > ${OUTPUT_FILE}" # file context with new selinux login rlRun "diff -u ${CMP_FILE} ${OUTPUT_FILE}" 0 - rlRun "userdel -Z duck-tmp" - rlRun "userdel -Z duck-var" + rlRun "userdel -fZ duck-tmp" + rlRun "userdel -fZ duck-var" rlLog "SELinux users with home in / shoud not trigger a policy change" rlRun "useradd -Z unconfined_u -d /tmp duck-tmp" @@ -122,8 +122,8 @@ rlJournalStart rlRun "semodule -B" # rebuild file_contexts.homedirs rlRun "semanage fcontext -l 2>&1 > ${OUTPUT_FILE}" # file context with new selinux login rlRun "diff -u ${CMP_FILE} ${OUTPUT_FILE}" 0 - rlRun "userdel -Z duck-tmp" - rlRun "userdel -Z duck-var" + rlRun "userdel -fZ duck-tmp" + rlRun "userdel -fZ duck-var" rlLog "Other SELinux users should trigger a policy change" rlRun "useradd -Z unconfined_u duck-home" @@ -131,8 +131,8 @@ rlJournalStart rlRun "semodule -B" # rebuild file_contexts.homedirs rlRun "semanage fcontext -l 2>&1 > ${OUTPUT_FILE}" # file context with new selinux login rlRun "diff -u ${CMP_FILE} ${OUTPUT_FILE} | grep -E 'duck-(home|var-home)'" 0 - rlRun "userdel -Z duck-home" - rlRun "userdel -Z duck-var-home" + rlRun "userdel -fZ duck-home" + rlRun "userdel -fZ duck-var-home" rlFileRestore rlPhaseEnd From 66fc71a9d1bc0cd880af230c1e7f54f2b56d5312 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Fri, 18 Mar 2022 20:33:56 +0100 Subject: [PATCH 116/626] skip irrelevant test phases Test phase devoted to BZ#2056207 and BZ#2056999 should not be executed on RHEL-8.x, because the SELinux denials do not appear there. --- selinux-policy/systemd-sysctl-and-similar/runtest.sh | 2 ++ 1 file changed, 2 insertions(+) diff --git a/selinux-policy/systemd-sysctl-and-similar/runtest.sh b/selinux-policy/systemd-sysctl-and-similar/runtest.sh index 52ce90c..51ec449 100755 --- a/selinux-policy/systemd-sysctl-and-similar/runtest.sh +++ b/selinux-policy/systemd-sysctl-and-similar/runtest.sh @@ -51,6 +51,7 @@ rlJournalStart sleep 2 rlPhaseEnd + if ! rlIsRHEL 8 ; then rlPhaseStartTest "bz#2056207 + bz#2056999" rlSEMatchPathCon "/usr/lib/systemd/systemd-sysctl" "systemd_sysctl_exec_t" rlRun "ls -Z /proc/sys/fs/suid_dumpable | grep :proc_security_t" @@ -59,6 +60,7 @@ rlJournalStart rlRun "ls -Z /proc/sys/kernel/kptr_restrict | grep :proc_security_t" rlSESearchRule "allow systemd_sysctl_t proc_security_t : file { read } [ ]" rlPhaseEnd + fi rlPhaseStartTest "real scenario" rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "start status" 1 From 538b4654134dfd2de8b6b90a5228633e112c7086 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Sat, 19 Mar 2022 22:48:39 +0100 Subject: [PATCH 117/626] add new nasd test Introducing a basic automated test which covers the nasd service. --- selinux-policy/nasd-and-similar/Makefile | 68 ++++++++++++++ selinux-policy/nasd-and-similar/PURPOSE | 5 ++ selinux-policy/nasd-and-similar/main.fmf | 2 + selinux-policy/nasd-and-similar/runtest.sh | 100 +++++++++++++++++++++ 4 files changed, 175 insertions(+) create mode 100644 selinux-policy/nasd-and-similar/Makefile create mode 100644 selinux-policy/nasd-and-similar/PURPOSE create mode 100644 selinux-policy/nasd-and-similar/main.fmf create mode 100755 selinux-policy/nasd-and-similar/runtest.sh diff --git a/selinux-policy/nasd-and-similar/Makefile b/selinux-policy/nasd-and-similar/Makefile new file mode 100644 index 0000000..ed1c757 --- /dev/null +++ b/selinux-policy/nasd-and-similar/Makefile @@ -0,0 +1,68 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/nasd-and-similar +# Description: SELinux interferes with the nasd service and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2020 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/nasd-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with the nasd service and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: nas" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console nas /usr/sbin/service" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) + + rhts-lint $(METADATA) + diff --git a/selinux-policy/nasd-and-similar/PURPOSE b/selinux-policy/nasd-and-similar/PURPOSE new file mode 100644 index 0000000..3315a94 --- /dev/null +++ b/selinux-policy/nasd-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/nasd-and-similar +Author: Milos Malik + +SELinux interferes with the nasd service and related programs. + diff --git a/selinux-policy/nasd-and-similar/main.fmf b/selinux-policy/nasd-and-similar/main.fmf new file mode 100644 index 0000000..f026e8d --- /dev/null +++ b/selinux-policy/nasd-and-similar/main.fmf @@ -0,0 +1,2 @@ +path: /selinux-policy/nasd-and-similar +tier: 2 diff --git a/selinux-policy/nasd-and-similar/runtest.sh b/selinux-policy/nasd-and-similar/runtest.sh new file mode 100755 index 0000000..77e9ca6 --- /dev/null +++ b/selinux-policy/nasd-and-similar/runtest.sh @@ -0,0 +1,100 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/nasd-and-similar +# Description: SELinux interferes with the nasd service and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2020 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +ROOT_PASSWORD="N0t-1mp0rt4nT" +FILE_PATH="/usr/bin/nasd" +FILE_CONTEXT="soundd_exec_t" +SERVICE_PACKAGE="nas" +SERVICE_NAME="nasd" +PROCESS_NAME="nasd" +PROCESS_CONTEXT="soundd_t" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} + rlFileBackup /etc/shadow + rlFileBackup /etc/sysconfig/nasd + sed -i 's/^NASD_OPTIONS.*$/NASD_OPTIONS="-aa -pn"/' /etc/sysconfig/nasd + rlRun "uname -r" + rlRun "dnf -y install kernel-modules-`uname -r`" + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "SELinux contexts and rules" + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + if rlIsRHEL 5 ; then + SOURCE_TYPE="initrc_t" + BOOLEANS="[ ]" + elif rlIsRHEL 6 ; then + SOURCE_TYPE="initrc_t" + else # RHEL-7 etc. + SOURCE_TYPE="init_t" # systemd runs the process + fi + rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" + rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" + rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" + rlPhaseEnd + + rlPhaseStartTest "real scenario -- standalone service" + rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + # for environments where the SELinux type is not defined yet + PROCESS_CONTEXT="unconfined_service_t" + fi + rlRun "modprobe snd_pcm_oss" + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "ls -lZ /dev/dsp*" + rlRun "restorecon -Rv /run /var" 0-255 + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + From 6b44611dd26be19ff23838ccca81c2034af1a53e Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 15 Mar 2022 16:28:56 +0100 Subject: [PATCH 118/626] add the hostapd test to upstream repo The hostapd component is frequently used by various users on Fedora and RHEL, so it makes sense to run this TC in upstream testing too. There are no changes in the TC functionality. Moving the downstream TC to upstream repo. --- selinux-policy/hostapd-and-similar/Makefile | 81 +++++++++++ selinux-policy/hostapd-and-similar/PURPOSE | 5 + selinux-policy/hostapd-and-similar/main.fmf | 2 + selinux-policy/hostapd-and-similar/runtest.sh | 128 ++++++++++++++++++ 4 files changed, 216 insertions(+) create mode 100644 selinux-policy/hostapd-and-similar/Makefile create mode 100644 selinux-policy/hostapd-and-similar/PURPOSE create mode 100644 selinux-policy/hostapd-and-similar/main.fmf create mode 100755 selinux-policy/hostapd-and-similar/runtest.sh diff --git a/selinux-policy/hostapd-and-similar/Makefile b/selinux-policy/hostapd-and-similar/Makefile new file mode 100644 index 0000000..594646a --- /dev/null +++ b/selinux-policy/hostapd-and-similar/Makefile @@ -0,0 +1,81 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/hostapd-and-similar +# Description: SELinux interferes with hostapd and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/hostapd-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with hostapd and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: hostapd" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console hostapd /usr/sbin/service kernel-modules-internal" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6" >> $(METADATA) + @echo "Bug: 1224405" >> $(METADATA) # Fedora 22 + @echo "Bug: 1225245" >> $(METADATA) # Fedora 22 + @echo "Bug: 1237343" >> $(METADATA) # Fedora 22 + @echo "Bug: 1266068" >> $(METADATA) # Fedora 23 + @echo "Bug: 1273570" >> $(METADATA) # Fedora 23 + @echo "Bug: 1278569" >> $(METADATA) # Fedora 23 + @echo "Bug: 1282179" >> $(METADATA) # Fedora 23 + @echo "Bug: 1334021" >> $(METADATA) # Fedora 24 + @echo "Bug: 1343683" >> $(METADATA) # Fedora 24 + @echo "Bug: 1977676" >> $(METADATA) # RHEL-8 + @echo "Bug: 1979968" >> $(METADATA) # RHEL-9 + @echo "Bug: 1784253" >> $(METADATA) # Fedora 35 + @echo "Bug: 2032277" >> $(METADATA) # Fedora 35 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/hostapd-and-similar/PURPOSE b/selinux-policy/hostapd-and-similar/PURPOSE new file mode 100644 index 0000000..7f50b6d --- /dev/null +++ b/selinux-policy/hostapd-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/hostapd-and-similar +Author: Milos Malik + +SELinux interferes with hostapd and related programs. + diff --git a/selinux-policy/hostapd-and-similar/main.fmf b/selinux-policy/hostapd-and-similar/main.fmf new file mode 100644 index 0000000..2c5835e --- /dev/null +++ b/selinux-policy/hostapd-and-similar/main.fmf @@ -0,0 +1,2 @@ +path: /selinux-policy/hostapd-and-similar +tier: 2 diff --git a/selinux-policy/hostapd-and-similar/runtest.sh b/selinux-policy/hostapd-and-similar/runtest.sh new file mode 100755 index 0000000..c2323e0 --- /dev/null +++ b/selinux-policy/hostapd-and-similar/runtest.sh @@ -0,0 +1,128 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/hostapd-and-similar +# Description: SELinux interferes with hostapd and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +ROOT_PASSWORD="redhat" +FILE_PATH="/usr/sbin/hostapd" +FILE_CONTEXT="hostapd_exec_t" +SERVICE_PACKAGE="hostapd" +SERVICE_NAME="hostapd" +PROCESS_NAME="hostapd" +PROCESS_CONTEXT="hostapd_t" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + rlRun "rpm -qa kernel\*" + rlRun "uname -a" + rlServiceStop ${SERVICE_NAME} + rlFileBackup /etc/shadow + rlFileBackup /etc/hostapd/hostapd.conf + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + if rlSEDefined ${PROCESS_CONTEXT} ; then + rlPhaseStartTest "bz#1224405" + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + rlSEMatchPathCon "/run/hostapd" "hostapd_var_run_t" + rlSEMatchPathCon "/run/hostapd/wlan0" "hostapd_var_run_t" + SOURCE_TYPE="init_t" # systemd runs the process + rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" + rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" + rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" + rlSESearchRule "dontaudit hostapd_t debugfs_t : dir { search } [ ]" + rlSESearchRule "allow hostapd_t hostapd_var_run_t : sock_file { create setattr unlink } [ ]" + rlSESearchRule "allow hostapd_t hostapd_t : capability { fsetid } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1225245" + rlSESearchRule "allow hostapd_t hostapd_t : capability { net_admin } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1237343" + rlSESearchRule "allow hostapd_t hostapd_t : capability { net_raw } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1266068 + bz#1273570 + bz#1278569 + bz#1282179 + bz#1334021 + bz#1343683" + rlSESearchRule "allow hostapd_t hostapd_t : netlink_generic_socket { create setopt bind getattr } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1977676 + bz#1979968" + rlSEMatchPathCon "/usr/sbin/hostapd" "hostapd_exec_t" + rlSEMatchPortCon udp 67 dhcpd_port_t + rlSESearchRule "allow hostapd_t hostapd_t : capability { net_bind_service } [ ]" + rlSESearchRule "allow hostapd_t dhcpd_port_t : udp_socket { name_bind } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1784253 + bz#2032277" + rlSESearchRule "allow hostapd_t user_tmp_t : sock_file { write } [ ]" + rlSESearchRule "allow hostapd_t unconfined_t : unix_dgram_socket { sendto } [ ]" + rlPhaseEnd + fi + + rlPhaseStartTest "real scenario -- standalone service" + rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" + rlRun "modprobe mac80211_hwsim" + rlRun "sed -i 's/^interface=.*$//' /etc/hostapd/hostapd.conf" + rlRun "sed -i 's/^hw_mode=.*$//' /etc/hostapd/hostapd.conf" + rlRun "sed -i 's/^channel=.*$//' /etc/hostapd/hostapd.conf" + rlRun "sed -i 's/^ssid=.*//' /etc/hostapd/hostapd.conf" + rlRun "echo interface=wlan0 >> /etc/hostapd/hostapd.conf" + rlRun "echo hw_mode=g >> /etc/hostapd/hostapd.conf" + rlRun "echo channel=10 >> /etc/hostapd/hostapd.conf" + rlRun "echo ssid=somename >> /etc/hostapd/hostapd.conf" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + PROCESS_CONTEXT="unconfined_service_t" + fi + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /run /var" + rlRun "hostapd_cli all_sta" + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + From 1270f13156ac561bd9651d2b7a99868423de4e6e Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 15 Mar 2022 16:24:26 +0100 Subject: [PATCH 119/626] add the firewalld test to upstream repo The firewalld component is frequently used by various users on Fedora and RHEL, so it makes sense to run this TC in upstream testing too. There are no changes in the TC functionality. Moving the downstream TC to upstream repo. --- selinux-policy/firewalld-and-similar/Makefile | 88 +++++++ selinux-policy/firewalld-and-similar/PURPOSE | 5 + selinux-policy/firewalld-and-similar/main.fmf | 2 + .../firewalld-and-similar/runtest.sh | 226 ++++++++++++++++++ 4 files changed, 321 insertions(+) create mode 100644 selinux-policy/firewalld-and-similar/Makefile create mode 100644 selinux-policy/firewalld-and-similar/PURPOSE create mode 100644 selinux-policy/firewalld-and-similar/main.fmf create mode 100755 selinux-policy/firewalld-and-similar/runtest.sh diff --git a/selinux-policy/firewalld-and-similar/Makefile b/selinux-policy/firewalld-and-similar/Makefile new file mode 100644 index 0000000..9938f8f --- /dev/null +++ b/selinux-policy/firewalld-and-similar/Makefile @@ -0,0 +1,88 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/firewalld-and-similar +# Description: SELinux interferes with firewalld and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/firewalld-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with firewalld and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 30m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "RunFor: firewalld" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console firewalld glib2 nftables procps-ng" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6" >> $(METADATA) + @echo "Bug: 907902" >> $(METADATA) # RHEL-7 + @echo "Bug: 989922" >> $(METADATA) # RHEL-7 + @echo "Bug: 1067494" >> $(METADATA) # RHEL-7 + @echo "Bug: 1214853" >> $(METADATA) # RHEL-7 + @echo "Bug: 1221326" >> $(METADATA) # RHEL-7 + @echo "Bug: 1243403" >> $(METADATA) # RHEL-7 + @echo "Bug: 1284902" >> $(METADATA) # RHEL-7 + @echo "Bug: 1304721" >> $(METADATA) # RHEL-7 + @echo "Bug: 1304723" >> $(METADATA) # RHEL-7 + @echo "Bug: 1342235" >> $(METADATA) # RHEL-7 + @echo "Bug: 1342587" >> $(METADATA) # RHEL-7 + @echo "Bug: 1346316" >> $(METADATA) # RHEL-7 + @echo "Bug: 1375576" >> $(METADATA) # RHEL-7 + @echo "Bug: 1418391" >> $(METADATA) # RHEL-7 + @echo "Bug: 1438708" >> $(METADATA) # RHEL-7 + @echo "Bug: 1573501" >> $(METADATA) # RHEL-8 + @echo "Bug: 1593687" >> $(METADATA) # RHEL-8 + @echo "Bug: 1600903" >> $(METADATA) # RHEL-8 + @echo "Bug: 1759010" >> $(METADATA) # RHEL-8 + @echo "Bug: 1989641" >> $(METADATA) # RHEL-9 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/firewalld-and-similar/PURPOSE b/selinux-policy/firewalld-and-similar/PURPOSE new file mode 100644 index 0000000..04c3f20 --- /dev/null +++ b/selinux-policy/firewalld-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/firewalld-and-similar +Author: Milos Malik + +SELinux interferes with firewalld and related programs. + diff --git a/selinux-policy/firewalld-and-similar/main.fmf b/selinux-policy/firewalld-and-similar/main.fmf new file mode 100644 index 0000000..4fc8344 --- /dev/null +++ b/selinux-policy/firewalld-and-similar/main.fmf @@ -0,0 +1,2 @@ +path: /selinux-policy/firewalld-and-similar +tier: 2 diff --git a/selinux-policy/firewalld-and-similar/runtest.sh b/selinux-policy/firewalld-and-similar/runtest.sh new file mode 100755 index 0000000..57cab77 --- /dev/null +++ b/selinux-policy/firewalld-and-similar/runtest.sh @@ -0,0 +1,226 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/firewalld-and-similar +# Description: SELinux interferes with firewalld and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/bin/rhts-environment.sh || exit 1 +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +ROOT_PASSWORD="redhat" +SERVICE_PACKAGE="firewalld" +SERVICE_NAME="firewalld" +PROCESS_NAME="firewalld" +PROCESS_CONTEXT="firewalld_t" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} + rlFileBackup /etc/firewalld/lockdown-whitelist.xml + rlFileBackup /etc/shadow + rlFileBackup /run/firewalld + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "bz#907902" + rlSEMatchPathCon "/usr/sbin/firewalld" "firewalld_exec_t" + rlSEMatchPathCon "/usr/lib64/python2.7/site.pyc" "lib_t" + rlSESearchRule "allow firewalld_t lib_t : dir { getattr open read search }" + rlSESearchRule "allow firewalld_t lib_t : file { getattr open read execute }" + rlPhaseEnd + + rlPhaseStartTest "bz#989922" + rlSEMatchPathCon "/usr/sbin/firewalld" "firewalld_exec_t" + rlSEMatchPathCon "/etc/firewalld/lockdown-whitelist.xml" "firewalld_etc_rw_t" + rlSESearchRule "allow firewalld_t firewalld_etc_rw_t : lnk_file { getattr read }" + rlPhaseEnd + + rlPhaseStartTest "bz#1067494" + for USER_TYPE in user_t staff_t unconfined_t ; do + rlSESearchRule "allow ${USER_TYPE} firewalld_t : dbus { send_msg }" + rlSESearchRule "allow firewalld_t ${USER_TYPE} : dbus { send_msg }" + done + rlPhaseEnd + + rlPhaseStartTest "bz#1214853" + rlSESearchRule "allow firewalld_t puppetagent_t : dbus { send_msg }" + rlSESearchRule "allow puppetagent_t firewalld_t : dbus { send_msg }" + rlPhaseEnd + + rlPhaseStartTest "bz#1221326" + rlSESearchRule "allow firewalld_t openshift_initrc_t : dbus { send_msg }" + rlSESearchRule "allow openshift_initrc_t firewalld_t : dbus { send_msg }" + rlPhaseEnd + + rlPhaseStartTest "bz#1243403" + rlSEMatchPathCon "/var/run" "var_run_t" + rlSEMatchPathCon "/var/run/xtables.lock" "iptables_var_run_t" + rlSESearchRule "allow iptables_t iptables_var_run_t : file { getattr open read lock } [ ]" + rlSESearchRule "type_transition iptables_t var_run_t : file iptables_var_run_t [ ]" + rlSESearchRule "allow iptables_t var_run_t : dir { read write add_name remove_name getattr open search } [ ]" + rlRun "sesearch -s unconfined_t -t var_run_t -c file -T | grep \"iptables_var_run_t.*xtables.lock\"" + rlPhaseEnd + + rlPhaseStartTest "bz#1284902" + rlSESearchRule "allow firewalld_t system_cronjob_t : dbus { send_msg }" + rlSESearchRule "allow system_cronjob_t firewalld_t : dbus { send_msg }" + rlPhaseEnd + + rlPhaseStartTest "bz#1342235" + rlSEMatchPathCon "/var/run/firewalld" "firewalld_var_run_t" + rlSESearchRule "allow iptables_t firewalld_var_run_t : file { getattr open read } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1304723 + bz#1346316" + rlSEMatchPathCon "/usr/sbin/firewalld" "firewalld_exec_t" + rlSEMatchPathCon "/var/log" "var_log_t" + rlSEMatchPathCon "/var/log/firewalld" "firewalld_var_log_t" + rlSEMatchPathCon "/etc/sysconfig/network-scripts" "net_conf_t" + rlSEMatchPathCon "/etc/sysconfig/network-scripts/ifcfg-enp0s25.NdcLYC" "net_conf_t" + rlSESearchRule "allow firewalld_t var_log_t : dir { write add_name } [ ]" + rlSESearchRule "type_transition firewalld_t var_log_t : file firewalld_var_log_t [ ]" + rlSESearchRule "allow firewalld_t firewalld_var_log_t : file { create } [ ]" + rlSESearchRule "allow firewalld_t net_conf_t : dir { write add_name }" + rlSESearchRule "allow firewalld_t net_conf_t : file { getattr open read write rename create unlink setattr }" + rlPhaseEnd + + rlPhaseStartTest "bz#1342587" + rlSEMatchPathCon "/usr/sbin/firewalld" "firewalld_exec_t" + rlSEMatchPathCon "/var/run" "var_run_t" + rlSEMatchPathCon "/var/run/firewalld" "firewalld_var_run_t" + rlSESearchRule "allow firewalld_t var_run_t : dir { read write add_name remove_name getattr open search } [ ]" + rlSESearchRule "type_transition firewalld_t var_run_t : dir firewalld_var_run_t [ ]" + rlSESearchRule "allow firewalld_t firewalld_var_run_t : dir { create } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1304721" + rlSESearchRule "allow firewalld_t firewalld_etc_rw_t : file { ioctl read write create getattr setattr lock relabelfrom relabelto append unlink link rename open } ;" + rlPhaseEnd + + rlPhaseStartTest "bz#1418391" + rlSEMatchPathCon "/usr/sbin/firewalld" "firewalld_exec_t" + rlSESearchRule "allow firewalld_t modules_object_t : dir { getattr open read search }" + rlPhaseEnd + + rlPhaseStartTest "bz#1438708" + rlSEMatchPathCon "/usr/sbin/firewalld" "firewalld_exec_t" + rlSEMatchPathCon "/root" "admin_home_t" + rlSESearchRule "dontaudit firewalld_t admin_home_t : dir { write }" + rlPhaseEnd + + rlPhaseStartTest "bz#1375576" + rlSESearchRule "allow firewalld_t ldconfig_exec_t : file { getattr open read execute_no_trans } [ ]" + rlSESearchRule "type_transition firewalld_t ldconfig_exec_t : process ldconfig_t" 1 + rlSESearchRule "allow firewalld_t ldconfig_t : process { transition }" 1 + rlPhaseEnd + + if ! rlIsRHEL 5 6 7 ; then + rlPhaseStartTest "bz#1573501 + bz#1593687 + bz#1600903" + rlSEMatchPathCon "/usr/sbin/nft" "iptables_exec_t" + rlSESearchRule "allow firewalld_t firewalld_t : netlink_netfilter_socket { create }" + rlSESearchRule "allow firewalld_t kernel_t : system { module_request } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1759010" + rlSEMatchPathCon "/root/.cache" "cache_home_t" + rlSEMatchPathCon "/home/user/.cache" "cache_home_t" + rlSESearchRule "dontaudit firewalld_t firewalld_t : capability { dac_override }" + rlSESearchRule "allow firewalld_t cache_home_t : dir { create }" 1 + rlPhaseEnd + fi + + if ! rlIsRHEL 5 6 ; then + rlPhaseStartTest "remnants from BZ#1574383" + rlSESearchRule "allow firewalld_t iptables_exec_t : file { map } [ ]" + rlPhaseEnd + fi + + if ! rlIsRHEL 5 6 7 8 ; then + rlPhaseStartTest "bz#1989641" + rlSESearchRule "allow firewalld_t firewalld_t : capability { setpcap } [ ]" + rlSESearchRule "allow firewalld_t firewalld_t : process { setcap } [ ]" + rlPhaseEnd + fi + + rlPhaseStartTest "real scenario -- bz#1304721" + rlServiceStart "firewalld" + rlRun "firewall-cmd --add-port 1234/tcp --permanent" + rlRun "firewall-cmd --remove-port 1234/tcp --permanent" + rlPhaseEnd + + rlPhaseStartTest "real scenario -- DBus service" + DESTINATION="org.fedoraproject.FirewallD1" + rlRun "gdbus introspect --system --object-path / --dest ${DESTINATION} >& /dev/null" + sleep 1 + rlRun "ps -efZ | grep -v grep | grep ${PROCESS_NAME}" + rlRun "ps -efZ | grep -v grep | grep \"${PROCESS_CONTEXT}.*${PROCESS_NAME}\"" + rlServiceStop "firewalld" + rlPhaseEnd + + rlPhaseStartTest "real scenario" + rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" + rlRun "rm -rf /run/firewalld" + rlRun "rm -f /run/xtables.lock" + rlRun "mv /etc/firewalld/lockdown-whitelist.xml /etc/firewalld/lockdown-whitelist.xml.orig" + rlRun "ln -s /etc/firewalld/lockdown-whitelist.xml.orig /etc/firewalld/lockdown-whitelist.xml" + # see https://bugzilla.redhat.com/show_bug.cgi?id=907902#c7 + # rlRun "rm -f /usr/lib{,64}/python2.7/site.{pyc,pyo}" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + if rlIsRHEL 5 6 ; then + PROCESS_CONTEXT="initrc_t" + else + PROCESS_CONTEXT="unconfined_service_t" + fi + fi + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status restart status stop status" 1 + rlRun "rm -f /etc/firewalld/lockdown-whitelist.xml*" + rlRun "ls -dZ /run/firewalld | grep :firewalld_var_run_t" + if rlIsRHEL 7 ; then + rlRun "ls -Z /run/xtables.lock | grep :iptables_var_run_t" + fi + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + From 5914ae131facb8084299587c8342f9b06f9fe00f Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Fri, 25 Mar 2022 13:51:41 +0100 Subject: [PATCH 120/626] do not run the nasd test on RHEL The nas package is available for various versions of Fedora, but it's not available for any RHEL. The automated test will exit immediately if executed on RHEL. --- selinux-policy/nasd-and-similar/runtest.sh | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/selinux-policy/nasd-and-similar/runtest.sh b/selinux-policy/nasd-and-similar/runtest.sh index 77e9ca6..bcf3369 100755 --- a/selinux-policy/nasd-and-similar/runtest.sh +++ b/selinux-policy/nasd-and-similar/runtest.sh @@ -40,6 +40,12 @@ PROCESS_NAME="nasd" PROCESS_CONTEXT="soundd_t" rlJournalStart + if rlIsRHEL ; then + rlLog "Not applicable to this OS version." + rlJournalEnd + exit 0 + fi + rlPhaseStartSetup rlRun "rlImport 'selinux-policy/common'" rlSESatisfyRequires From fff6691dcdb5cb38ef30fb86e83ad7ee8c716957 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Wed, 20 Apr 2022 11:05:28 +0200 Subject: [PATCH 121/626] kernel/selinux-testsuite: bump upstream commit ...and remove some workarounds that are no longer needed. Also add code to enable/disable SCTP client peeloff tests based on where SCTP client peeloff is currently fixed in RHEL. Signed-off-by: Ondrej Mosnacek --- kernel/selinux-testsuite/runtest.sh | 37 +++++++++++++---------------- 1 file changed, 17 insertions(+), 20 deletions(-) diff --git a/kernel/selinux-testsuite/runtest.sh b/kernel/selinux-testsuite/runtest.sh index 184cc68..3ac3078 100755 --- a/kernel/selinux-testsuite/runtest.sh +++ b/kernel/selinux-testsuite/runtest.sh @@ -35,7 +35,7 @@ PACKAGE="selinux-policy" # This should be updated as needed after verifying that the new version # doesn't break testing and after applying all necessary tweaks in the TC. # Run with GIT_BRANCH=master to run the latest upstream version. -DEFAULT_COMMIT="b2d0f3c5f946e58e3e6f8f1fff81d8435b005f92" +DEFAULT_COMMIT="b11701a55614eeb20e85fee9829d1699cc13c39a" # Default pull requests to merge before running the test. # If non-empty, then after checking out GIT_BRANCH the listed upstream pull # requests (by number) are merged, creating a new temporary local branch. @@ -304,7 +304,7 @@ rlJournalStart exclude_tests="" force_tests="" for file in ./tests/nnp*/execnnp.c; do - rlRun "sed -i 's/3.18/3.9/' $file" 0 \ + rlRun "sed -i 's/3\.18/3.9/' $file" 0 \ "Fix up kernel version in nnp test" done if rlIsRHEL "<8.2"; then @@ -376,6 +376,21 @@ rlJournalStart # a17f0671017f selinux: vsock: Set SID for socket returned by accept() exclude_tests+=" vsock_socket" fi + + sctp_client_peeloff=0 + if kver_ge 4.18.0-305.39.1 && kver_lt 4.18.0-306; then + sctp_client_peeloff=1 + fi + if kver_ge 4.18.0-348.19.1 && kver_lt 4.18.0-349; then + sctp_client_peeloff=1 + fi + if kver_ge 4.18.0-372.1.1 && kver_lt 5.14; then + sctp_client_peeloff=1 + fi + if [ "$sctp_client_peeloff" -eq 1 ]; then + rlRun "sed -i 's/5\.18/4.18/g' tests/sctp/test" 0 \ + "Fix up kernel version in sctp test" + fi fi # CKI mainline kernels don't ship with module build infrastructure @@ -403,24 +418,6 @@ rlJournalStart "Force applicable tests: $force_tests" fi - if ! modprobe sctp 2>/dev/null; then - script1='s/runcon -t test_sctp_socket_t/true/g' - script2='s/runcon -t test_no_sctp_socket_t/false/g' - rlRun "sed -i -e '$script1' -e '$script2' ./tests/extended_socket_class/test" 0 \ - "No SCTP support => fix up extended_socket_class test" - fi - - # on aarch64 and s390x the kernel support for Bluetooth is turned - # off so we disable the Bluetooth socket tests there - case "$(rlGetPrimaryArch)" in - aarch64|s390x) - script1='s/runcon -t test_bluetooth_socket_t/true/g' - script2='s/runcon -t test_no_bluetooth_socket_t/false/g' - rlRun "sed -i -e '$script1' -e '$script2' ./tests/extended_socket_class/test" 0 \ - "No Bluetooth support => fix up extended_socket_class test" - ;; - esac - # Initialize report. rlRun "echo 'Remote: $GIT_URL' >results.log" 0 rlRun "echo 'Branch: $GIT_BRANCH' >>results.log" 0 From 120532d05ef1e95b2976acd817318f3817a8a654 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Wed, 20 Apr 2022 16:25:08 +0200 Subject: [PATCH 122/626] kernel/selinux-testsuite: always run in /root Running in paths containing ':' or in /tmp doesn't work, so make sure that the testsuite is run in /root. Signed-off-by: Ondrej Mosnacek --- kernel/selinux-testsuite/runtest.sh | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/kernel/selinux-testsuite/runtest.sh b/kernel/selinux-testsuite/runtest.sh index 3ac3078..3fc6e17 100755 --- a/kernel/selinux-testsuite/runtest.sh +++ b/kernel/selinux-testsuite/runtest.sh @@ -189,9 +189,8 @@ rlJournalStart rlAssertRpm ${PACKAGE} rlAssertRpm audit rlFileBackup /etc/selinux/semanage.conf - # running the testsuite in /tmp causes permission denied messages - # rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" - # rlRun "pushd $TmpDir" + # run the testsuite in /root to avoid problems with other paths + rlRun "pushd /root" # version_le() sanity check: rlRun "version_le 4.10 4.10" @@ -468,6 +467,8 @@ rlJournalStart rlRun "sleep 5" 0 rlRun "dmesg | grep -i \"rcu_sched detected stalls\"" 1 + + rlRun "popd" 0 "Leave /root" rlFileRestore rlPhaseEnd rlJournalPrintText From 6cde87c598c1ecee24d9654df2460c20d5290923 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Thu, 21 Apr 2022 09:52:36 +0200 Subject: [PATCH 123/626] end tests quickly if required packages are not installed If required packages are not installed at the beginning of the automated test, it makes no sense to run the test, because it would fail anyway. --- selinux-policy/bz733494-amanda-and-similar/runtest.sh | 6 ++++++ selinux-policy/sslh-and-similar/runtest.sh | 6 ++++++ selinux-policy/usbmuxd-and-similar/runtest.sh | 6 ++++++ 3 files changed, 18 insertions(+) diff --git a/selinux-policy/bz733494-amanda-and-similar/runtest.sh b/selinux-policy/bz733494-amanda-and-similar/runtest.sh index 9fd5386..dbb4624 100755 --- a/selinux-policy/bz733494-amanda-and-similar/runtest.sh +++ b/selinux-policy/bz733494-amanda-and-similar/runtest.sh @@ -39,6 +39,12 @@ PROCESS_NAME="amandad" PROCESS_CONTEXT="amanda_t" rlJournalStart + if ! rpm -q amanda amanda-client amanda-server ; then + rlLog "Required packages are not available/installed." + rlJournalEnd + exit 0 + fi + rlPhaseStartSetup rlRun "rlImport 'selinux-policy/common'" rlSESatisfyRequires diff --git a/selinux-policy/sslh-and-similar/runtest.sh b/selinux-policy/sslh-and-similar/runtest.sh index e39975e..7979d33 100755 --- a/selinux-policy/sslh-and-similar/runtest.sh +++ b/selinux-policy/sslh-and-similar/runtest.sh @@ -40,6 +40,12 @@ PROCESS_NAME="sslh" PROCESS_CONTEXT="sslh_t" rlJournalStart + if ! rpm -q ${SERVICE_PACKAGE} ; then + rlLog "Required packages are not available/installed." + rlJournalEnd + exit 0 + fi + rlPhaseStartSetup rlRun "rlImport 'selinux-policy/common'" rlSESatisfyRequires diff --git a/selinux-policy/usbmuxd-and-similar/runtest.sh b/selinux-policy/usbmuxd-and-similar/runtest.sh index f1d6c77..c3c4c24 100755 --- a/selinux-policy/usbmuxd-and-similar/runtest.sh +++ b/selinux-policy/usbmuxd-and-similar/runtest.sh @@ -40,6 +40,12 @@ PROCESS_NAME="usbmuxd" PROCESS_CONTEXT="usbmuxd_t" rlJournalStart + if ! rpm -q ${SERVICE_PACKAGE} ; then + rlLog "Required packages are not available/installed." + rlJournalEnd + exit 0 + fi + rlPhaseStartSetup rlRun "rlImport 'selinux-policy/common'" rlSESatisfyRequires From 94b4e53487e221a4c78b481c897bc5965c23ae4e Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Thu, 21 Apr 2022 10:31:02 +0200 Subject: [PATCH 124/626] kernel/selinux-testsuite: apply an urgent fix to the ioctl test The ioctl number is not consistent across arches. The fix adds the numbers for other arches to make the test work on all arches again. Signed-off-by: Ondrej Mosnacek --- kernel/selinux-testsuite/runtest.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/selinux-testsuite/runtest.sh b/kernel/selinux-testsuite/runtest.sh index 3fc6e17..496b11c 100755 --- a/kernel/selinux-testsuite/runtest.sh +++ b/kernel/selinux-testsuite/runtest.sh @@ -41,7 +41,7 @@ DEFAULT_COMMIT="b11701a55614eeb20e85fee9829d1699cc13c39a" # requests (by number) are merged, creating a new temporary local branch. DEFAULT_PULLS="" # Default SELinux Patchwork series to apply before running the test. -DEFAULT_PATCHES="" +DEFAULT_PATCHES="634066" # Optional test parameter - location of testuite git. GIT_URL=${GIT_URL:-"https://github.com/SELinuxProject/selinux-testsuite"} From 86053995e5cc688eeec4bbf562c8e9b3227c51a8 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Fri, 22 Apr 2022 08:56:43 +0200 Subject: [PATCH 125/626] add new test which covers the stalld service SELinux policy now contains a new policy module which confines the stalld service. This TC covers basic scenarios of running the service in default configuration. The TC also looks for appropriate policy rules and file context patterns. The TC covers BZ#2042614. --- selinux-policy/stalld-and-similar/Makefile | 69 +++++++++++++ selinux-policy/stalld-and-similar/PURPOSE | 5 + selinux-policy/stalld-and-similar/main.fmf | 42 ++++++++ selinux-policy/stalld-and-similar/runtest.sh | 100 +++++++++++++++++++ 4 files changed, 216 insertions(+) create mode 100644 selinux-policy/stalld-and-similar/Makefile create mode 100644 selinux-policy/stalld-and-similar/PURPOSE create mode 100644 selinux-policy/stalld-and-similar/main.fmf create mode 100755 selinux-policy/stalld-and-similar/runtest.sh diff --git a/selinux-policy/stalld-and-similar/Makefile b/selinux-policy/stalld-and-similar/Makefile new file mode 100644 index 0000000..4a4124a --- /dev/null +++ b/selinux-policy/stalld-and-similar/Makefile @@ -0,0 +1,69 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/stalld-and-similar +# Description: SELinux interferes with stalld and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2022 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/stalld-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with stalld and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "RunFor: stalld" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console stalld /usr/sbin/service" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA) + @echo "Bug: 2042614" >> $(METADATA) # RHEL-9 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/stalld-and-similar/PURPOSE b/selinux-policy/stalld-and-similar/PURPOSE new file mode 100644 index 0000000..5d0d6a3 --- /dev/null +++ b/selinux-policy/stalld-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/stalld-and-similar +Author: Milos Malik + +SELinux interferes with stalld and related programs. + diff --git a/selinux-policy/stalld-and-similar/main.fmf b/selinux-policy/stalld-and-similar/main.fmf new file mode 100644 index 0000000..a1196b2 --- /dev/null +++ b/selinux-policy/stalld-and-similar/main.fmf @@ -0,0 +1,42 @@ +summary: SELinux interferes with stalld and related programs +description: |+ + SELinux interferes with stalld and related programs. + +contact: Milos Malik +component: + - selinux-policy +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - stalld + - /usr/sbin/service +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - NoRHEL8 + - Tier2 + - Tier2se + - targeted +tier: '2' +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2042614 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 + continue: false +extra-nitrate: TC#0613202 +extra-summary: /CoreOS/selinux-policy/Regression/stalld-and-similar +extra-task: /CoreOS/selinux-policy/Regression/stalld-and-similar diff --git a/selinux-policy/stalld-and-similar/runtest.sh b/selinux-policy/stalld-and-similar/runtest.sh new file mode 100755 index 0000000..0624de5 --- /dev/null +++ b/selinux-policy/stalld-and-similar/runtest.sh @@ -0,0 +1,100 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/stalld-and-similar +# Description: SELinux interferes with stalld and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2022 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +FILE_PATH="/usr/bin/stalld" +FILE_CONTEXT="stalld_exec_t" +SERVICE_PACKAGE="stalld" +SERVICE_NAME="stalld" +PROCESS_NAME="stalld" +PROCESS_CONTEXT="stalld_t" + +rlJournalStart + if ! rpm -q ${SERVICE_PACKAGE} ; then + rlLog "Required packages are not available/installed." + rlJournalEnd + exit 0 + fi + + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} + rlFileBackup /etc/sysconfig/stalld + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "bz#2042614" + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + rlRun "ls -Z /proc/sys/kernel/sched_rt_runtime_us | grep :sysctl_kernel_t:" + rlRun "ls -Z /sys/kernel/debug/sched/debug | grep :debugfs_t:" + rlRun "ls -Z /sys/kernel/debug/sched/features | grep :debugfs_t:" + SOURCE_TYPE="init_t" # systemd runs the process + rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" + rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" + rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" + rlSESearchRule "allow ${PROCESS_CONTEXT} sysctl_kernel_t : file { getattr open read } [ fips_mode ]" + rlSESearchRule "allow ${PROCESS_CONTEXT} debugfs_t : file { getattr open read } [ ]" + rlPhaseEnd + + rlPhaseStartTest "real scenario -- standalone service" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + PROCESS_CONTEXT="unconfined_service_t" + fi + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "sed -i 's/^LOGGING=.*$/LOGGING=--log_syslog/' /etc/sysconfig/stalld" + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status" 1 + rlRun "sed -i 's/^LOGGING=.*$/LOGGING=--log_kmsg/' /etc/sysconfig/stalld" + rlRun "setsebool domain_can_write_kmsg on" + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status" 1 + rlRun "restorecon -Rv /run /var" 0-255 + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "stop status" 1 + rlRun "setsebool domain_can_write_kmsg off" + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + From 7a1caf666f444b9595ed8eed5e721c931c5d2e67 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Thu, 21 Apr 2022 12:01:32 +0200 Subject: [PATCH 126/626] add a CI-for-tests plan This plan should run only tests that have been modified in the given pull request. --- plans/ci.fmf | 9 +++++ .../rtkit-daemon-and-similar/Makefile | 2 +- .../rtkit-daemon-and-similar/main.fmf | 21 ++++++++++ .../rtkit-daemon-and-similar/runtest.sh | 3 +- tests-pr.yml | 39 ------------------- 5 files changed, 32 insertions(+), 42 deletions(-) create mode 100644 plans/ci.fmf delete mode 100644 tests-pr.yml diff --git a/plans/ci.fmf b/plans/ci.fmf new file mode 100644 index 0000000..454574d --- /dev/null +++ b/plans/ci.fmf @@ -0,0 +1,9 @@ +summary: CI test plan that runs only modified tests +discover: + how: fmf + modified-only: true + modified-url: https://src.fedoraproject.org/tests/selinux + modified-ref: reference/main +execute: + how: tmt + diff --git a/selinux-policy/rtkit-daemon-and-similar/Makefile b/selinux-policy/rtkit-daemon-and-similar/Makefile index 4e5588f..35430d8 100644 --- a/selinux-policy/rtkit-daemon-and-similar/Makefile +++ b/selinux-policy/rtkit-daemon-and-similar/Makefile @@ -1,7 +1,7 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # # Makefile of /CoreOS/selinux-policy/Regression/rtkit-daemon-and-similar -# Description: the service was running as initrc_t, now it is confined by SELinux +# Description: SELinux interferes with rtkit daemon and related programs # Author: Milos Malik # # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ diff --git a/selinux-policy/rtkit-daemon-and-similar/main.fmf b/selinux-policy/rtkit-daemon-and-similar/main.fmf index 358e482..1aec75d 100644 --- a/selinux-policy/rtkit-daemon-and-similar/main.fmf +++ b/selinux-policy/rtkit-daemon-and-similar/main.fmf @@ -2,3 +2,24 @@ path: /selinux-policy/rtkit-daemon-and-similar summary: SELinux interferes with rtkit daemon and related programs description: | Test coverage for SELinux AVC issues against rtkit daemon and related programs. +component: + - selinux-policy +framework: beakerlib +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux-utils + - policycoreutils + - rtkit + - selinux-policy + - selinux-policy-targeted + - setools-console + - /usr/sbin/service +duration: 15m +tier: '2' +adjust: + - enabled: false + when: distro == rhel-4, rhel-5 + continue: false + diff --git a/selinux-policy/rtkit-daemon-and-similar/runtest.sh b/selinux-policy/rtkit-daemon-and-similar/runtest.sh index b6e88e8..f7e2613 100755 --- a/selinux-policy/rtkit-daemon-and-similar/runtest.sh +++ b/selinux-policy/rtkit-daemon-and-similar/runtest.sh @@ -3,7 +3,7 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # # runtest.sh of /CoreOS/selinux-policy/Regression/rtkit-daemon-and-similar -# Description: the service was running as initrc_t, now it is confined by SELinux +# Description: SELinux interferes with rtkit daemon and related programs # Author: Milos Malik # # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" diff --git a/tests-pr.yml b/tests-pr.yml deleted file mode 100644 index f06af2b..0000000 --- a/tests-pr.yml +++ /dev/null @@ -1,39 +0,0 @@ -- hosts: localhost - tags: - - classic - - pre_tasks: - - name: Generate list of tests in this PR - shell: | - git fetch https://src.fedoraproject.org/tests/selinux.git main:upstream-main - git log --format= --stat --name-only upstream-main..HEAD | sed '/\//!d;s#\(.*\)/.*#\1#' | sort -u | xargs - delegate_to: localhost - register: tests_list - - - name: Set tests - set_fact: - tests: "{{ tests_list.stdout.split(' ') }}" - - # Update to the latest kernel to allow installing kernel-* packages - # matching the running kernel version. - # See: https://pagure.io/fedora-ci/general/issue/162 - # May be removed once the issue above is resolved. - - name: Update kernel packages and reboot - block: - - name: Update kernel-core - shell: dnf update -y kernel-core - - - name: Restart host - shell: sleep 2 && shutdown -r now "Ansible updates triggered" - async: 1 - poll: 0 - ignore_errors: true - - - name: Wait for host to come back - wait_for_connection: - delay: 10 - timeout: 300 - - roles: - - role: standard-test-beakerlib - From 8dfebbced5939777e1499c89cf3aa2e1e9644fda Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Wed, 16 Mar 2022 17:00:24 +0100 Subject: [PATCH 127/626] add the blueman test to upstream repo The blueman component is used by various users on Fedora, so it makes sense to run this TC in upstream testing too. There are no changes in the TC functionality. Moving the downstream TC to upstream repo. --- selinux-policy/blueman-and-similar/Makefile | 67 +++++++++++ selinux-policy/blueman-and-similar/PURPOSE | 5 + selinux-policy/blueman-and-similar/main.fmf | 41 +++++++ selinux-policy/blueman-and-similar/runtest.sh | 104 ++++++++++++++++++ 4 files changed, 217 insertions(+) create mode 100644 selinux-policy/blueman-and-similar/Makefile create mode 100644 selinux-policy/blueman-and-similar/PURPOSE create mode 100644 selinux-policy/blueman-and-similar/main.fmf create mode 100755 selinux-policy/blueman-and-similar/runtest.sh diff --git a/selinux-policy/blueman-and-similar/Makefile b/selinux-policy/blueman-and-similar/Makefile new file mode 100644 index 0000000..79f0160 --- /dev/null +++ b/selinux-policy/blueman-and-similar/Makefile @@ -0,0 +1,67 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/blueman-and-similar +# Description: SELinux interferes with blueman* programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/blueman-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with blueman* programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console glib2 gtk3 blueman python-cairo pygtk2 /usr/sbin/service" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHELClient5 -RHELServer5 -RHEL6 -RHEL7" >> $(METADATA) + @echo "Bug: 1470501" >> $(METADATA) # Fedora + + rhts-lint $(METADATA) + diff --git a/selinux-policy/blueman-and-similar/PURPOSE b/selinux-policy/blueman-and-similar/PURPOSE new file mode 100644 index 0000000..585f5a1 --- /dev/null +++ b/selinux-policy/blueman-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/blueman-and-similar +Author: Milos Malik + +SELinux interferes with blueman* programs. + diff --git a/selinux-policy/blueman-and-similar/main.fmf b/selinux-policy/blueman-and-similar/main.fmf new file mode 100644 index 0000000..d405840 --- /dev/null +++ b/selinux-policy/blueman-and-similar/main.fmf @@ -0,0 +1,41 @@ +summary: SELinux interferes with blueman* programs +description: |+ + SELinux interferes with blueman* programs. + +contact: Milos Malik +component: + - selinux-policy +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - glib2 + - gtk3 + - blueman + - python-cairo + - pygtk2 + - /usr/sbin/service +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - failinfedora + - targeted +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1470501 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7, rhel-8, rhel-9 + continue: false +extra-nitrate: TC#0563638 +extra-summary: /CoreOS/selinux-policy/Regression/blueman-and-similar +extra-task: /CoreOS/selinux-policy/Regression/blueman-and-similar diff --git a/selinux-policy/blueman-and-similar/runtest.sh b/selinux-policy/blueman-and-similar/runtest.sh new file mode 100755 index 0000000..5ef0cac --- /dev/null +++ b/selinux-policy/blueman-and-similar/runtest.sh @@ -0,0 +1,104 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/blueman-and-similar +# Description: SELinux interferes with blueman* programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +ROOT_PASSWORD="redhat" +FILE_PATH="/usr/libexec/blueman-mechanism" +FILE_CONTEXT="blueman_exec_t" +SERVICE_PACKAGE="blueman" +SERVICE_NAME="blueman-mechanism" +PROCESS_NAME="blueman-mechanism" +PROCESS_CONTEXT="blueman_t" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} + rlFileBackup /etc/shadow + rlRun "mkdir -p -Z ~/.cache" + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "bz#1470501" + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + if rlIsRHEL 5 ; then + SOURCE_TYPE="initrc_t" + BOOLEANS="[ ]" + elif rlIsRHEL 6 ; then + SOURCE_TYPE="initrc_t" + else # RHEL-7 etc. + SOURCE_TYPE="init_t" # systemd runs the process + fi + rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" + rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" + rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" + rlSESearchRule "allow blueman_t policykit_t : dbus { send_msg }" + rlSESearchRule "allow policykit_t blueman_t : dbus { send_msg }" + rlPhaseEnd + + if ! rlIsRHEL 5 ; then + rlPhaseStartTest "real scenario -- DBus service" + DESTINATION="org.blueman.Mechanism" + rlRun "gdbus introspect --system --object-path / --dest ${DESTINATION} >& /dev/null" + sleep 1 + rlRun "ps -efZ | grep -v grep | grep ${PROCESS_NAME}" + rlRun "ps -efZ | grep -v grep | grep \"${PROCESS_CONTEXT}.*${PROCESS_NAME}\"" + rlPhaseEnd + fi + + rlPhaseStartTest "real scenario -- standalone service" + rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + # for RHELs where the SELinux domain does not exist yet + PROCESS_CONTEXT="initrc_t" + fi + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status restart status stop status" 1 + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + From 521001ac7a7b4302be056882074cbdab28cc71d6 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Mon, 13 Sep 2021 16:33:11 +0200 Subject: [PATCH 128/626] add the dhcpcd test to upstream repo The dhcpcd component is frequently used by various users on Fedora and RHEL, so it makes sense to run this TC in upstream testing too. There are no changes in the TC functionality. Moving the downstream TC to upstream repo. --- selinux-policy/dhcpcd-and-similar/Makefile | 69 +++++++++++++ selinux-policy/dhcpcd-and-similar/PURPOSE | 5 + selinux-policy/dhcpcd-and-similar/main.fmf | 40 +++++++ selinux-policy/dhcpcd-and-similar/runtest.sh | 103 +++++++++++++++++++ 4 files changed, 217 insertions(+) create mode 100644 selinux-policy/dhcpcd-and-similar/Makefile create mode 100644 selinux-policy/dhcpcd-and-similar/PURPOSE create mode 100644 selinux-policy/dhcpcd-and-similar/main.fmf create mode 100755 selinux-policy/dhcpcd-and-similar/runtest.sh diff --git a/selinux-policy/dhcpcd-and-similar/Makefile b/selinux-policy/dhcpcd-and-similar/Makefile new file mode 100644 index 0000000..4259442 --- /dev/null +++ b/selinux-policy/dhcpcd-and-similar/Makefile @@ -0,0 +1,69 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/dhcpcd-and-similar +# Description: SELinux interferes with dhcpcd and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/dhcpcd-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with dhcpcd and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console dhcpcd /usr/sbin/service" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6" >> $(METADATA) + @echo "Bug: 1585971" >> $(METADATA) # Fedora 28 + @echo "Bug: 1602343" >> $(METADATA) # Fedora 28 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/dhcpcd-and-similar/PURPOSE b/selinux-policy/dhcpcd-and-similar/PURPOSE new file mode 100644 index 0000000..503905e --- /dev/null +++ b/selinux-policy/dhcpcd-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/dhcpcd-and-similar +Author: Milos Malik + +SELinux interferes with dhcpcd and related programs. + diff --git a/selinux-policy/dhcpcd-and-similar/main.fmf b/selinux-policy/dhcpcd-and-similar/main.fmf new file mode 100644 index 0000000..428d042 --- /dev/null +++ b/selinux-policy/dhcpcd-and-similar/main.fmf @@ -0,0 +1,40 @@ +summary: SELinux interferes with dhcpcd and related programs +description: |+ + SELinux interferes with dhcpcd and related programs. + +contact: Milos Malik +component: + - selinux-policy +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - dhcpcd + - /usr/sbin/service +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - TIPfail_Security + - failinfedora + - targeted +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1585971 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1602343 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7, rhel-8, rhel-9 + continue: false +extra-nitrate: TC#0574611 +extra-summary: /CoreOS/selinux-policy/Regression/dhcpcd-and-similar +extra-task: /CoreOS/selinux-policy/Regression/dhcpcd-and-similar diff --git a/selinux-policy/dhcpcd-and-similar/runtest.sh b/selinux-policy/dhcpcd-and-similar/runtest.sh new file mode 100755 index 0000000..edb8185 --- /dev/null +++ b/selinux-policy/dhcpcd-and-similar/runtest.sh @@ -0,0 +1,103 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/dhcpcd-and-similar +# Description: SELinux interferes with dhcpcd and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +ROOT_PASSWORD="redhat" +FILE_PATH="/usr/sbin/dhcpcd" +FILE_CONTEXT="dhcpc_exec_t" +SERVICE_PACKAGE="dhcpcd" +SERVICE_NAME="dhcpcd" +PROCESS_NAME="dhcpcd" +PROCESS_CONTEXT="dhcpc_t" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} + rlFileBackup /etc/shadow + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "bz#1585971 + bz#1602343" + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + rlSEMatchPathCon "/var/run" "var_run_t" + rlSEMatchPathCon "/var/run/dhcpcd" "dhcpc_var_run_t" + rlSEMatchPathCon "/var/run/dhcpcd/sock" "dhcpc_var_run_t" + if rlIsRHEL 5 ; then + SOURCE_TYPE="initrc_t" + BOOLEANS="[ ]" + elif rlIsRHEL 6 ; then + SOURCE_TYPE="initrc_t" + else # RHEL-7 etc. + SOURCE_TYPE="init_t" # systemd runs the process + fi + rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" + rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" + rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" + rlSESearchRule "allow dhcpc_t dhcpc_t : netlink_generic_socket { create bind }" + rlSESearchRule "allow dhcpc_t dhcpc_t : netlink_kobject_uevent_socket { create setopt bind getattr }" + rlSESearchRule "allow dhcpc_t dhcpc_t : rawip_socket { create setopt }" + rlSESearchRule "allow dhcpc_t var_run_t : dir { write add_name }" + rlSESearchRule "type_transition dhcpc_t var_run_t : sock_file dhcpc_var_run_t" + rlSESearchRule "allow dhcpc_t dhcpc_var_run_t : sock_file { create unlink }" + rlPhaseEnd + + rlPhaseStartTest "real scenario -- standalone service" + rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + if rlIsRHEL 5 6 ; then + PROCESS_CONTEXT="initrc_t" + else + PROCESS_CONTEXT="unconfined_service_t" + fi + fi + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status restart status stop status" 1 + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + From 61078d379a26cd4dda08b91778b60008baca2c80 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Mon, 25 Apr 2022 08:33:53 +0200 Subject: [PATCH 129/626] convert metadata of all checkpolicy tests to TMT/FMF --- checkpolicy/checkmodule/main.fmf | 40 ++++++++++++++++++++++- checkpolicy/checkmodule/runtest.sh | 1 - checkpolicy/checkpolicy-docs/main.fmf | 38 +++++++++++++++++++++- checkpolicy/checkpolicy-docs/runtest.sh | 1 - checkpolicy/checkpolicy/main.fmf | 43 +++++++++++++++++++++++-- checkpolicy/checkpolicy/runtest.sh | 1 - checkpolicy/sedismod/main.fmf | 35 +++++++++++++++++++- checkpolicy/sedismod/runtest.sh | 1 - checkpolicy/sedispol/main.fmf | 35 +++++++++++++++++++- checkpolicy/sedispol/runtest.sh | 1 - 10 files changed, 185 insertions(+), 11 deletions(-) mode change 100644 => 100755 checkpolicy/checkmodule/runtest.sh mode change 100644 => 100755 checkpolicy/checkpolicy-docs/runtest.sh mode change 100644 => 100755 checkpolicy/checkpolicy/runtest.sh diff --git a/checkpolicy/checkmodule/main.fmf b/checkpolicy/checkmodule/main.fmf index 6173448..c990752 100644 --- a/checkpolicy/checkmodule/main.fmf +++ b/checkpolicy/checkmodule/main.fmf @@ -1 +1,39 @@ -path: /checkpolicy/checkmodule +summary: runs checkmodule with various options to find out if it behaves correctly +description: |+ + This TC runs checkmodule with various options to find out if it behaves correctly. + +contact: Milos Malik +component: + - checkpolicy +recommend: + - checkpolicy + - man + - grep + - mktemp + - policycoreutils + - policycoreutils-devel +duration: 10m +enabled: true +tag: + - CI-Tier-1 + - NoRHEL4 + - TIPpass_Security + - Tier1 + - Tier1se + - f31friendly + - f32friendly + - targeted +tier: '1' +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1329217 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=533796 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=588294 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1392394 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1064603 +adjust: + - enabled: false + when: distro == rhel-4 + continue: false +extra-nitrate: TC#0062301 +extra-summary: /CoreOS/checkpolicy/Sanity/checkmodule +extra-task: /CoreOS/checkpolicy/Sanity/checkmodule diff --git a/checkpolicy/checkmodule/runtest.sh b/checkpolicy/checkmodule/runtest.sh old mode 100644 new mode 100755 index 590a799..49dc17f --- a/checkpolicy/checkmodule/runtest.sh +++ b/checkpolicy/checkmodule/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include rhts environment -. /usr/bin/rhts-environment.sh . /usr/share/beakerlib/beakerlib.sh PACKAGE="checkpolicy" diff --git a/checkpolicy/checkpolicy-docs/main.fmf b/checkpolicy/checkpolicy-docs/main.fmf index f303b47..368c6bd 100644 --- a/checkpolicy/checkpolicy-docs/main.fmf +++ b/checkpolicy/checkpolicy-docs/main.fmf @@ -1 +1,37 @@ -path: /checkpolicy/checkpolicy-docs +summary: covers an issue where manpage included an unsupported option. +description: |+ + Description: covers an issue where manpage included an unsupported option. + + Author: Milos Malik + + +contact: Milos Malik +component: + - setools + - checkpolicy +recommend: + - checkpolicy +duration: 1m +enabled: true +tag: + - CI-Tier-1 + - NoRHEL4 + - TIPpass_Security + - Tier1 + - Tier1se + - f31friendly + - f32friendly + - targeted +tier: '1' +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1328966 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1328979 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=739866 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=533790 +adjust: + - enabled: false + when: distro == rhel-4 + continue: false +extra-nitrate: TC#0062302 +extra-summary: /CoreOS/checkpolicy/Sanity/checkpolicy +extra-task: /CoreOS/checkpolicy/Sanity/checkpolicy diff --git a/checkpolicy/checkpolicy-docs/runtest.sh b/checkpolicy/checkpolicy-docs/runtest.sh old mode 100644 new mode 100755 index 83a7079..fc207c9 --- a/checkpolicy/checkpolicy-docs/runtest.sh +++ b/checkpolicy/checkpolicy-docs/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include rhts environment -. /usr/bin/rhts-environment.sh . /usr/share/beakerlib/beakerlib.sh PACKAGE="checkpolicy" diff --git a/checkpolicy/checkpolicy/main.fmf b/checkpolicy/checkpolicy/main.fmf index 0436b60..f11940a 100644 --- a/checkpolicy/checkpolicy/main.fmf +++ b/checkpolicy/checkpolicy/main.fmf @@ -1,2 +1,41 @@ -path: /checkpolicy/checkpolicy -tier: 1 +summary: runs checkpolicy with various options to find out if it behaves correctly +description: |+ + Description: runs checkpolicy with various options to find out if it behaves correctly + + Author: Milos Malik + + +contact: Milos Malik +component: + - setools + - checkpolicy +recommend: + - checkpolicy + - setools-console + - selinux-policy-minimum + - selinux-policy-mls + - selinux-policy-targeted +duration: 10m +enabled: true +tag: + - CI-Tier-1 + - NoRHEL4 + - TIPpass_Security + - Tier1 + - Tier1se + - f31friendly + - f32friendly + - targeted +tier: '1' +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1328966 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1328979 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=739866 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=533790 +adjust: + - enabled: false + when: distro == rhel-4 + continue: false +extra-nitrate: TC#0062302 +extra-summary: /CoreOS/checkpolicy/Sanity/checkpolicy +extra-task: /CoreOS/checkpolicy/Sanity/checkpolicy diff --git a/checkpolicy/checkpolicy/runtest.sh b/checkpolicy/checkpolicy/runtest.sh old mode 100644 new mode 100755 index 821d735..fda1e8e --- a/checkpolicy/checkpolicy/runtest.sh +++ b/checkpolicy/checkpolicy/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include rhts environment -. /usr/bin/rhts-environment.sh . /usr/share/beakerlib/beakerlib.sh PACKAGE="checkpolicy" diff --git a/checkpolicy/sedismod/main.fmf b/checkpolicy/sedismod/main.fmf index 05e7b34..4c103ca 100644 --- a/checkpolicy/sedismod/main.fmf +++ b/checkpolicy/sedismod/main.fmf @@ -1 +1,34 @@ -path: /checkpolicy/sedismod +summary: Does sedismod work correctly? +description: |+ + Does sedismod work correctly? + +contact: Milos Malik +component: + - checkpolicy +recommend: + - checkpolicy + - selinux-policy-targeted + - expect + - policycoreutils + - psmisc +duration: 10m +enabled: true +tag: + - CI-Tier-1 + - NoRHEL4 + - NoRHEL5 + - TIPpass_Security + - Tier2 + - Tier2se + - TierCandidatesPASS + - f31friendly + - f32friendly + - targeted +tier: '2' +adjust: + - enabled: false + when: distro == rhel-4, rhel-5 + continue: false +extra-nitrate: TC#0518635 +extra-summary: /CoreOS/checkpolicy/Sanity/sedismod +extra-task: /CoreOS/checkpolicy/Sanity/sedismod diff --git a/checkpolicy/sedismod/runtest.sh b/checkpolicy/sedismod/runtest.sh index 8f86e9e..c15b882 100755 --- a/checkpolicy/sedismod/runtest.sh +++ b/checkpolicy/sedismod/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="checkpolicy" diff --git a/checkpolicy/sedispol/main.fmf b/checkpolicy/sedispol/main.fmf index 840a2e0..b141118 100644 --- a/checkpolicy/sedispol/main.fmf +++ b/checkpolicy/sedispol/main.fmf @@ -1 +1,34 @@ -path: /checkpolicy/sedispol +summary: Does sedispol work correctly? +description: |+ + Does sedispol work correctly? + +contact: Milos Malik +component: + - checkpolicy +recommend: + - checkpolicy + - selinux-policy + - expect +duration: 10m +enabled: true +tag: + - CI-Tier-1 + - NoRHEL4 + - NoRHEL5 + - TIPfail_Security + - Tier2 + - Tier2se + - f31friendly + - f32friendly + - targeted +tier: '2' +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1303696 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1337890 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5 + continue: false +extra-nitrate: TC#0518626 +extra-summary: /CoreOS/checkpolicy/Sanity/sedispol +extra-task: /CoreOS/checkpolicy/Sanity/sedispol diff --git a/checkpolicy/sedispol/runtest.sh b/checkpolicy/sedispol/runtest.sh index 5ed441b..3a182e1 100755 --- a/checkpolicy/sedispol/runtest.sh +++ b/checkpolicy/sedispol/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="checkpolicy" From 1bf11b6606efaf02b0b5555e0cae103d7e69ac1f Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Mon, 25 Apr 2022 08:48:54 +0200 Subject: [PATCH 130/626] convert metadata of all policycoreutils tests to TMT/FMF --- .../CIL-modules-without-compilation/main.fmf | 32 ++++++++++- .../runtest.sh | 1 - policycoreutils/booleans/main.fmf | 32 ++++++++--- policycoreutils/booleans/runtest.sh | 1 - policycoreutils/file-contexts/main.fmf | 32 +++++++++-- policycoreutils/file-contexts/runtest.sh | 1 - policycoreutils/fixfiles-F-B-N/main.fmf | 14 ++--- policycoreutils/fixfiles-F-B-N/runtest.sh | 1 - .../linux-system-roles.selinux-tests/main.fmf | 16 +++++- .../runtest.sh | 1 - policycoreutils/load_policy/main.fmf | 32 ++++++++++- policycoreutils/load_policy/runtest.sh | 1 - policycoreutils/modules/main.fmf | 34 +++++++---- policycoreutils/modules/runtest.sh | 1 - .../org-selinux-dbus-interfaces/main.fmf | 36 ++++++++++-- .../org-selinux-dbus-interfaces/runtest.sh | 1 - policycoreutils/restorecon/main.fmf | 57 ++++++++++++++++++- policycoreutils/restorecon/runtest.sh | 1 - policycoreutils/sctp_test/main.fmf | 28 +++++---- policycoreutils/sctp_test/runtest.sh | 1 - .../selinux-autorelabel-service/main.fmf | 36 +++++++++++- .../selinux-autorelabel-service/runtest.sh | 1 - policycoreutils/selinux-info/main.fmf | 33 ++++++++--- policycoreutils/selinux-info/runtest.sh | 1 - policycoreutils/semanage-interface/main.fmf | 33 ++++++++++- policycoreutils/semanage-interface/runtest.sh | 1 - policycoreutils/semanage-login/main.fmf | 34 ++++++++++- policycoreutils/semanage-login/runtest.sh | 1 - .../semanage-permissive-d-problems/main.fmf | 19 ++++++- .../semanage-permissive-d-problems/runtest.sh | 1 - .../main.fmf | 19 ++++++- .../runtest.sh | 1 - policycoreutils/semanage-user/main.fmf | 36 +++++++++++- policycoreutils/semanage-user/runtest.sh | 1 - policycoreutils/semodule-l-checksum/main.fmf | 18 +++--- .../semodule-l-checksum/runtest.sh | 1 - policycoreutils/sepolicy-generate/main.fmf | 40 ++++++++++++- policycoreutils/sepolicy-generate/runtest.sh | 1 - policycoreutils/sestatus/main.fmf | 33 ++++++++++- policycoreutils/sestatus/runtest.sh | 1 - policycoreutils/setfiles/main.fmf | 40 ++++++++----- policycoreutils/setfiles_binary/main.fmf | 39 +++++++------ policycoreutils/setsebool/main.fmf | 45 ++++++++++++++- policycoreutils/setsebool/runtest.sh | 1 - 44 files changed, 626 insertions(+), 133 deletions(-) mode change 100644 => 100755 policycoreutils/sestatus/runtest.sh diff --git a/policycoreutils/CIL-modules-without-compilation/main.fmf b/policycoreutils/CIL-modules-without-compilation/main.fmf index 02538f7..179a8ee 100644 --- a/policycoreutils/CIL-modules-without-compilation/main.fmf +++ b/policycoreutils/CIL-modules-without-compilation/main.fmf @@ -1 +1,31 @@ -path: /policycoreutils/CIL-modules-without-compilation +summary: What the test does +description: |+ + Is it possible to manage policy modules written in CIL without any compilation? Does semanage and semodule understand them? + +contact: Milos Malik +component: + - policycoreutils +recommend: + - /usr/sbin/semodule + - /usr/sbin/semanage +enabled: true +tag: + - CI-Tier-1 + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - TIPpass_Security + - Tier1 + - Tier1se + - TierCandidatesPASS + - f32friendly + - f33friendly + - targeted +tier: '1' +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6 + continue: false +extra-nitrate: TC#0535087 +extra-summary: /CoreOS/policycoreutils/Sanity/CIL-modules-without-compilation +extra-task: /CoreOS/policycoreutils/Sanity/CIL-modules-without-compilation diff --git a/policycoreutils/CIL-modules-without-compilation/runtest.sh b/policycoreutils/CIL-modules-without-compilation/runtest.sh index a121c58..8e96081 100755 --- a/policycoreutils/CIL-modules-without-compilation/runtest.sh +++ b/policycoreutils/CIL-modules-without-compilation/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="policycoreutils" diff --git a/policycoreutils/booleans/main.fmf b/policycoreutils/booleans/main.fmf index 2b7a3ac..5d39c1b 100644 --- a/policycoreutils/booleans/main.fmf +++ b/policycoreutils/booleans/main.fmf @@ -1,9 +1,25 @@ -path: /policycoreutils/booleans -summary: Test basic operations with booleans -description: | - The test defines its own booleans and tests setting it on and off - using setsebool and semanage boolean. -tier: 1 +summary: Basic operations with booleans +description: '' +contact: Milos Malik +component: + - policycoreutils +recommend: + - policycoreutils +enabled: true +tag: + - CI-Tier-1 + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - TIPpass_Security + - TierCandidatesPASS + - f32friendly + - f33friendly + - targeted adjust: -- enabled: false - when: distro < rhel-7 + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6 + continue: false +extra-nitrate: TC#0571350 +extra-summary: /CoreOS/policycoreutils/Sanity/booleans +extra-task: /CoreOS/policycoreutils/Sanity/booleans diff --git a/policycoreutils/booleans/runtest.sh b/policycoreutils/booleans/runtest.sh index 925d3d9..ab3760e 100755 --- a/policycoreutils/booleans/runtest.sh +++ b/policycoreutils/booleans/runtest.sh @@ -26,7 +26,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="policycoreutils" diff --git a/policycoreutils/file-contexts/main.fmf b/policycoreutils/file-contexts/main.fmf index 4c27a2c..fe1d35f 100644 --- a/policycoreutils/file-contexts/main.fmf +++ b/policycoreutils/file-contexts/main.fmf @@ -1,8 +1,28 @@ -path: /policycoreutils/file-contexts summary: Test semanage fcontext, restorecon, fixfiles, chcon -description: | - The test adds custom file contexts, runs restorecon and checks file - contexts. The chcon command is also tested. +description: '' +contact: Milos Malik +component: + - policycoreutils +recommend: + - policycoreutils + - policycoreutils-python-utils +enabled: true +tag: + - CI-Tier-1 + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - TIPpass_Security + - TierCandidatesPASS + - f32friendly + - f33friendly + - targeted +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1822100 adjust: -- enabled: false - when: distro < rhel-7 + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6 + continue: false +extra-nitrate: TC#0576069 +extra-summary: /CoreOS/policycoreutils/Sanity/file-contexts +extra-task: /CoreOS/policycoreutils/Sanity/file-contexts diff --git a/policycoreutils/file-contexts/runtest.sh b/policycoreutils/file-contexts/runtest.sh index c4f28f8..3375f00 100755 --- a/policycoreutils/file-contexts/runtest.sh +++ b/policycoreutils/file-contexts/runtest.sh @@ -26,7 +26,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="policycoreutils" diff --git a/policycoreutils/fixfiles-F-B-N/main.fmf b/policycoreutils/fixfiles-F-B-N/main.fmf index 70e58e3..1472b82 100644 --- a/policycoreutils/fixfiles-F-B-N/main.fmf +++ b/policycoreutils/fixfiles-F-B-N/main.fmf @@ -1,7 +1,7 @@ -path: /policycoreutils/fixfiles-F-B-N -summary: Test fixfiles [-F] [-B] onboot -description: | - Run fixfiles with -F and -B options and check /.autorelabel -adjust: -- enabled: false - when: distro < rhel-7 +summary: Tests fixfiles -F | -B | -N options +description: '' +contact: Petr Lautrbach +component: + - policycoreutils +extra-summary: /CoreOS/policycoreutils/Sanity/fixfiles-F-B-N +extra-task: /CoreOS/policycoreutils/Sanity/fixfiles-F-B-N diff --git a/policycoreutils/fixfiles-F-B-N/runtest.sh b/policycoreutils/fixfiles-F-B-N/runtest.sh index ab401df..34eb5fc 100755 --- a/policycoreutils/fixfiles-F-B-N/runtest.sh +++ b/policycoreutils/fixfiles-F-B-N/runtest.sh @@ -26,7 +26,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="policycoreutils" diff --git a/policycoreutils/linux-system-roles.selinux-tests/main.fmf b/policycoreutils/linux-system-roles.selinux-tests/main.fmf index df9c7a2..6007bf5 100644 --- a/policycoreutils/linux-system-roles.selinux-tests/main.fmf +++ b/policycoreutils/linux-system-roles.selinux-tests/main.fmf @@ -1,2 +1,14 @@ -path: /policycoreutils/linux-system-roles.selinux-tests -tags: [fedora] +summary: Run linux-system-roles.selinux (https://github.com/linux-system-roles/selinux.git) + Ansible role tests +description: | + Run linux-system-roles.selinux (https://github.com/linux-system-roles/selinux.git) Ansible role tests +contact: Petr Lautrbach +component: + - policycoreutils +recommend: + - policycoreutils + - ansible + - git +duration: 10m +extra-summary: linux-system-roles.selinux-tests +extra-task: linux-system-roles.selinux-tests diff --git a/policycoreutils/linux-system-roles.selinux-tests/runtest.sh b/policycoreutils/linux-system-roles.selinux-tests/runtest.sh index 1fa3809..20bae06 100755 --- a/policycoreutils/linux-system-roles.selinux-tests/runtest.sh +++ b/policycoreutils/linux-system-roles.selinux-tests/runtest.sh @@ -25,7 +25,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="policycoreutils" diff --git a/policycoreutils/load_policy/main.fmf b/policycoreutils/load_policy/main.fmf index e375cb8..274d8bd 100644 --- a/policycoreutils/load_policy/main.fmf +++ b/policycoreutils/load_policy/main.fmf @@ -1 +1,31 @@ -path: /policycoreutils/load_policy +summary: Does load_policy work as expected? Does it produce correct audit messages? +description: |+ + Does load_policy work as expected? Does it produce correct audit messages? + +contact: Milos Malik +component: + - policycoreutils +recommend: + - audit + - policycoreutils + - selinux-policy-targeted + - initscripts +enabled: true +tag: + - CI-Tier-1 + - NoRHEL4 + - NoRHEL5 + - TIPpass + - TIPpass_Security + - TierCandidatesPASS + - f32friendly + - f33friendly + - failinrhel8ci + - targeted +adjust: + - enabled: false + when: distro == rhel-4, rhel-5 + continue: false +extra-nitrate: TC#0542457 +extra-summary: /CoreOS/policycoreutils/Sanity/load_policy +extra-task: /CoreOS/policycoreutils/Sanity/load_policy diff --git a/policycoreutils/load_policy/runtest.sh b/policycoreutils/load_policy/runtest.sh index 2698d94..a0402a9 100755 --- a/policycoreutils/load_policy/runtest.sh +++ b/policycoreutils/load_policy/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="policycoreutils" diff --git a/policycoreutils/modules/main.fmf b/policycoreutils/modules/main.fmf index dc4e4a5..2ec292c 100644 --- a/policycoreutils/modules/main.fmf +++ b/policycoreutils/modules/main.fmf @@ -1,12 +1,26 @@ -path: /policycoreutils/modules -summary: test basic module functionality -description: | - The test compiles a TE module, loads it via semodule, and checks - that the rules are enforced. The same is done with a CIL module. - Module overriding using priorities and module disabling is also - tested. This test requires policycoreutils and selinux-policy-devel - packages. +summary: Test module compiling and loading +description: '' +contact: Milos Malik +component: + - policycoreutils +recommend: + - policycoreutils + - selinux-policy-devel duration: 10m +enabled: true +tag: + - CI-Tier-1 + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - TIPpass_Security + - TierCandidatesPASS + - f32friendly + - f33friendly adjust: -- enabled: false - when: distro < rhel-7 + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6 + continue: false +extra-nitrate: TC#0571503 +extra-summary: /CoreOS/policycoreutils/Sanity/modules +extra-task: /CoreOS/policycoreutils/Sanity/modules diff --git a/policycoreutils/modules/runtest.sh b/policycoreutils/modules/runtest.sh index 280c831..408d04c 100755 --- a/policycoreutils/modules/runtest.sh +++ b/policycoreutils/modules/runtest.sh @@ -26,7 +26,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="policycoreutils" diff --git a/policycoreutils/org-selinux-dbus-interfaces/main.fmf b/policycoreutils/org-selinux-dbus-interfaces/main.fmf index 8ecc4af..40a568b 100644 --- a/policycoreutils/org-selinux-dbus-interfaces/main.fmf +++ b/policycoreutils/org-selinux-dbus-interfaces/main.fmf @@ -1,9 +1,33 @@ -path: /policycoreutils/org-selinux-dbus-interfaces summary: Do the D-bus interfaces/methods of /org/selinux/object work as expected? -description: | - Do the D-bus interfaces/methods of /org/selinux/object work as expected? +description: '' +contact: Milos Malik component: -- policycoreutils + - policycoreutils +recommend: + - dbus-tools + - policycoreutils-dbus + - selinux-policy-minimum + - selinux-policy-mls + - selinux-policy-targeted +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - TIPfail + - TIPfail_Security + - TierCandidatesPASS + - f32friendly + - f33friendly + - targeted +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1415988 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1754873 adjust: -- enabled: false - when: distro < rhel-8 + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6 + continue: false +extra-nitrate: TC#0546187 +extra-summary: /CoreOS/policycoreutils/Sanity/org-selinux-dbus-interfaces +extra-task: /CoreOS/policycoreutils/Sanity/org-selinux-dbus-interfaces diff --git a/policycoreutils/org-selinux-dbus-interfaces/runtest.sh b/policycoreutils/org-selinux-dbus-interfaces/runtest.sh index 14779a5..720fe5a 100755 --- a/policycoreutils/org-selinux-dbus-interfaces/runtest.sh +++ b/policycoreutils/org-selinux-dbus-interfaces/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="policycoreutils" diff --git a/policycoreutils/restorecon/main.fmf b/policycoreutils/restorecon/main.fmf index 90bf595..d6fc352 100644 --- a/policycoreutils/restorecon/main.fmf +++ b/policycoreutils/restorecon/main.fmf @@ -1,2 +1,55 @@ -path: /policycoreutils/restorecon -tier: 1 +summary: does restorecon work correctly ? +description: | + Does restorecon work correctly? + + + Description: does restorecon work correctly ? + + Author: Milos Malik + + Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=736153 + + Description: + touch test + chcon -u staff_u -t shadow_t -l s0:c1 test + restorecon test + ls -lZ test + You should still see the user as staff_u and the level as s0:c1 but the type should be changed. + restorecon -F test + You should see the user become system_u and the level become s0 +contact: Milos Malik +component: + - policycoreutils +recommend: + - policycoreutils + - grep + - e2fsprogs + - libselinux + - selinux-policy-devel + - libselinux-utils +duration: 15m +enabled: true +tag: + - CI-Tier-1 + - NoRHEL4 + - TIPpass_Security + - Tier1 + - Tier1se + - f31friendly + - f32friendly + - targeted +tier: '1' +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=739587 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=767568 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=741555 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=736153 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=741371 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=740669 +adjust: + - enabled: false + when: distro == rhel-4 + continue: false +extra-nitrate: TC#0111587 +extra-summary: /CoreOS/policycoreutils/Sanity/restorecon +extra-task: /CoreOS/policycoreutils/Sanity/restorecon diff --git a/policycoreutils/restorecon/runtest.sh b/policycoreutils/restorecon/runtest.sh index 9ab71d7..115b612 100755 --- a/policycoreutils/restorecon/runtest.sh +++ b/policycoreutils/restorecon/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include rhts environment -. /usr/bin/rhts-environment.sh . /usr/share/beakerlib/beakerlib.sh PACKAGE="policycoreutils" diff --git a/policycoreutils/sctp_test/main.fmf b/policycoreutils/sctp_test/main.fmf index dad2354..c82f8da 100644 --- a/policycoreutils/sctp_test/main.fmf +++ b/policycoreutils/sctp_test/main.fmf @@ -1,12 +1,16 @@ -path: /policycoreutils/sctp_test -summary: Is SCTP supported by "semanage port"? -description: | - Simulates a use case where a user wants to confine a client-server application communicating over SCTP - Bug summary: semanage port does not support SCTP protocol - Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=1563742 -component: -- policycoreutils -- libsemanage -adjust: -- enabled: false - when: distro < rhel-8 +summary: Test for BZ#1563742 (RFE add SCTP protocol support to semanage port) +contact: vmojzis +recommend: + - git + - libselinux-utils + - policycoreutils + - lksctp-tools + - psmisc + - /usr/sbin/semanage + - /usr/sbin/semodule +duration: 10m +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1563742 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1770238 +extra-summary: /selinux/policycoreutils/sctp_test +extra-task: /selinux/policycoreutils/sctp_test diff --git a/policycoreutils/sctp_test/runtest.sh b/policycoreutils/sctp_test/runtest.sh index ee18ced..39572be 100755 --- a/policycoreutils/sctp_test/runtest.sh +++ b/policycoreutils/sctp_test/runtest.sh @@ -29,7 +29,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="policycoreutils" diff --git a/policycoreutils/selinux-autorelabel-service/main.fmf b/policycoreutils/selinux-autorelabel-service/main.fmf index 6b8d0eb..82c489a 100644 --- a/policycoreutils/selinux-autorelabel-service/main.fmf +++ b/policycoreutils/selinux-autorelabel-service/main.fmf @@ -1,2 +1,34 @@ -path: /policycoreutils/selinux-autorelabel-service -tier: 2 +summary: incorrectly set StandardInput and StandardOutput of selinux-autorelabel service +description: |+ + Description: incorrectly set StandardInput and StandardOutput of selinux-autorelabel service + + Bugzilla links: + * https://bugzilla.redhat.com/show_bug.cgi?id=1766578 + * https://bugzilla.redhat.com/show_bug.cgi?id=1778094 + +contact: Milos Malik +component: + - policycoreutils +recommend: + - policycoreutils +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - TIPpass + - TIPpass_Security + - f32friendly + - f33friendly + - targeted +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1766578 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1778094 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + continue: false +extra-nitrate: TC#0605819 +extra-summary: /CoreOS/policycoreutils/Regression/selinux-autorelabel-service +extra-task: /CoreOS/policycoreutils/Regression/selinux-autorelabel-service diff --git a/policycoreutils/selinux-autorelabel-service/runtest.sh b/policycoreutils/selinux-autorelabel-service/runtest.sh index 49fca5b..2244e2c 100755 --- a/policycoreutils/selinux-autorelabel-service/runtest.sh +++ b/policycoreutils/selinux-autorelabel-service/runtest.sh @@ -26,7 +26,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="policycoreutils" diff --git a/policycoreutils/selinux-info/main.fmf b/policycoreutils/selinux-info/main.fmf index a3a9057..94d42af 100644 --- a/policycoreutils/selinux-info/main.fmf +++ b/policycoreutils/selinux-info/main.fmf @@ -1,9 +1,26 @@ -path: /policycoreutils/selinux-info -summary: test sestatus, avcstat, getenforce -description: | - Test that output of sestatus matches information in /sys/fs/selinux. - Test that avcstat works. Test getenforce. Warning: this tests runs - setenforce. +summary: Test sestatus, avcstat, getenforce and other information gathering tools +description: '' +contact: Milos Malik +component: + - policycoreutils +recommend: + - policycoreutils +duration: 1m +enabled: true +tag: + - CI-Tier-1 + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - TIPpass_Security + - TierCandidatesPASS + - f32friendly + - f33friendly + - targeted adjust: -- enabled: false - when: distro < rhel-7 + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6 + continue: false +extra-nitrate: TC#0571360 +extra-summary: /CoreOS/policycoreutils/Sanity/selinux-info +extra-task: /CoreOS/policycoreutils/Sanity/selinux-info diff --git a/policycoreutils/selinux-info/runtest.sh b/policycoreutils/selinux-info/runtest.sh index 13a92e6..5e71cb2 100755 --- a/policycoreutils/selinux-info/runtest.sh +++ b/policycoreutils/selinux-info/runtest.sh @@ -26,7 +26,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="policycoreutils" diff --git a/policycoreutils/semanage-interface/main.fmf b/policycoreutils/semanage-interface/main.fmf index 4fd3a5e..f24537b 100644 --- a/policycoreutils/semanage-interface/main.fmf +++ b/policycoreutils/semanage-interface/main.fmf @@ -1 +1,32 @@ -path: /policycoreutils/semanage-interface +summary: Does semanage interface ... work correctly? +description: '' +contact: Milos Malik +component: + - policycoreutils +recommend: + - policycoreutils + - policycoreutils-python-utils + - grep + - selinux-policy-minimum + - selinux-policy-mls + - selinux-policy-targeted +duration: 20m +enabled: true +tag: + - CI-Tier-1 + - NoRHEL4 + - TIPpass_Security + - TierCandidatesPASS + - f32friendly + - f33friendly + - rhel-7.0 + - targeted +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=953826 +adjust: + - enabled: false + when: distro == rhel-4 + continue: false +extra-nitrate: TC#0092119 +extra-summary: /CoreOS/policycoreutils/Regression/semanage-interface +extra-task: /CoreOS/policycoreutils/Regression/semanage-interface diff --git a/policycoreutils/semanage-interface/runtest.sh b/policycoreutils/semanage-interface/runtest.sh index ba8608b..70dbbc7 100755 --- a/policycoreutils/semanage-interface/runtest.sh +++ b/policycoreutils/semanage-interface/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="policycoreutils" diff --git a/policycoreutils/semanage-login/main.fmf b/policycoreutils/semanage-login/main.fmf index 9a2165f..b518544 100644 --- a/policycoreutils/semanage-login/main.fmf +++ b/policycoreutils/semanage-login/main.fmf @@ -1 +1,33 @@ -path: /policycoreutils/semanage-login +summary: Does semanage login ... work correctly? +description: '' +contact: Milos Malik +component: + - policycoreutils +recommend: + - policycoreutils + - policycoreutils-python-utils + - grep + - shadow-utils + - selinux-policy-minimum + - selinux-policy-mls + - selinux-policy-targeted +duration: 10m +enabled: true +tag: + - CI-Tier-1 + - NoRHEL4 + - TIPpass_Security + - TierCandidatesPASS + - f32friendly + - f33friendly + - rhel-7.0 + - targeted +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=953826 +adjust: + - enabled: false + when: distro == rhel-4 + continue: false +extra-nitrate: TC#0092123 +extra-summary: /CoreOS/policycoreutils/Regression/semanage-login +extra-task: /CoreOS/policycoreutils/Regression/semanage-login diff --git a/policycoreutils/semanage-login/runtest.sh b/policycoreutils/semanage-login/runtest.sh index a69d21a..97111d8 100755 --- a/policycoreutils/semanage-login/runtest.sh +++ b/policycoreutils/semanage-login/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="policycoreutils" diff --git a/policycoreutils/semanage-permissive-d-problems/main.fmf b/policycoreutils/semanage-permissive-d-problems/main.fmf index 50e8c68..3256315 100644 --- a/policycoreutils/semanage-permissive-d-problems/main.fmf +++ b/policycoreutils/semanage-permissive-d-problems/main.fmf @@ -1 +1,18 @@ -path: /policycoreutils/semanage-permissive-d-problems +summary: semanage permissive -d accepts more than domain types, its behavior is not + reliable +description: |+ + Does semanage permissive work correctly? + +contact: Milos Malik +component: + - policycoreutils +recommend: + - policycoreutils + - policycoreutils-python-utils + - policycoreutils-devel + - selinux-policy-devel + - grep + - coreutils +duration: 20m +extra-summary: /CoreOS/policycoreutils/Regression/semanage-permissive-d-problems +extra-task: /CoreOS/policycoreutils/Regression/semanage-permissive-d-problems diff --git a/policycoreutils/semanage-permissive-d-problems/runtest.sh b/policycoreutils/semanage-permissive-d-problems/runtest.sh index 67a5b3e..1d33e4c 100755 --- a/policycoreutils/semanage-permissive-d-problems/runtest.sh +++ b/policycoreutils/semanage-permissive-d-problems/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include rhts environment -. /usr/bin/rhts-environment.sh . /usr/share/beakerlib/beakerlib.sh PACKAGE="policycoreutils" diff --git a/policycoreutils/semanage-port-add-delete-problems/main.fmf b/policycoreutils/semanage-port-add-delete-problems/main.fmf index f2655dc..d0609a9 100644 --- a/policycoreutils/semanage-port-add-delete-problems/main.fmf +++ b/policycoreutils/semanage-port-add-delete-problems/main.fmf @@ -1 +1,18 @@ -path: /policycoreutils/semanage-port-add-delete-problems +summary: semanage accepts invalid port numbers and then cannot delete them +description: |+ + semanage accepts invalid port numbers and then cannot delete them + +contact: Milos Malik +component: + - policycoreutils +recommend: + - policycoreutils + - policycoreutils-python-utils + - setools-console + - libselinux + - libselinux-utils + - coreutils + - grep +duration: 15m +extra-summary: /CoreOS/policycoreutils/Regression/semanage-port-add-delete-problems +extra-task: /CoreOS/policycoreutils/Regression/semanage-port-add-delete-problems diff --git a/policycoreutils/semanage-port-add-delete-problems/runtest.sh b/policycoreutils/semanage-port-add-delete-problems/runtest.sh index ef13e5f..2069299 100755 --- a/policycoreutils/semanage-port-add-delete-problems/runtest.sh +++ b/policycoreutils/semanage-port-add-delete-problems/runtest.sh @@ -26,7 +26,6 @@ # # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="policycoreutils" diff --git a/policycoreutils/semanage-user/main.fmf b/policycoreutils/semanage-user/main.fmf index 0111538..761cd94 100644 --- a/policycoreutils/semanage-user/main.fmf +++ b/policycoreutils/semanage-user/main.fmf @@ -1 +1,35 @@ -path: /policycoreutils/semanage-user +summary: Does semanage user ... work correctly? +description: '' +contact: Milos Malik +component: + - policycoreutils +recommend: + - policycoreutils + - policycoreutils-python-utils + - grep + - selinux-policy-devel + - selinux-policy-minimum + - selinux-policy-mls + - selinux-policy-targeted + - selinux-policy-devel +duration: 20m +enabled: true +tag: + - CI-Tier-1 + - NoRHEL4 + - TIPpass_Security + - TierCandidatesPASS + - f32friendly + - f33friendly + - rhel-7.0 + - targeted +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=953826 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=987444 +adjust: + - enabled: false + when: distro == rhel-4 + continue: false +extra-nitrate: TC#0092120 +extra-summary: /CoreOS/policycoreutils/Regression/semanage-user +extra-task: /CoreOS/policycoreutils/Regression/semanage-user diff --git a/policycoreutils/semanage-user/runtest.sh b/policycoreutils/semanage-user/runtest.sh index b2413fb..eb4035d 100755 --- a/policycoreutils/semanage-user/runtest.sh +++ b/policycoreutils/semanage-user/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="policycoreutils" diff --git a/policycoreutils/semodule-l-checksum/main.fmf b/policycoreutils/semodule-l-checksum/main.fmf index 68b9946..5b72615 100644 --- a/policycoreutils/semodule-l-checksum/main.fmf +++ b/policycoreutils/semodule-l-checksum/main.fmf @@ -1,8 +1,12 @@ -path: /policycoreutils/semodule-l-checksum summary: Test semodule -l --checksum -description: | - semodule -l --checksum shows sha256 checksum of loaded modules and this test is supposed to test it -duration: 10m -adjust: -- enabled: false - when: distro < rhel-8 +description: '' +contact: Petr Lautrbach +component: + - policycoreutils +recommend: + - policycoreutils + - selinux-policy-devel +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1731501 +extra-summary: /CoreOS/policycoreutils/Sanity/bz1731501-Test-semodule-l-checksum +extra-task: /CoreOS/policycoreutils/Sanity/bz1731501-Test-semodule-l-checksum diff --git a/policycoreutils/semodule-l-checksum/runtest.sh b/policycoreutils/semodule-l-checksum/runtest.sh index 898a9c7..5096fbc 100755 --- a/policycoreutils/semodule-l-checksum/runtest.sh +++ b/policycoreutils/semodule-l-checksum/runtest.sh @@ -26,7 +26,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="policycoreutils" diff --git a/policycoreutils/sepolicy-generate/main.fmf b/policycoreutils/sepolicy-generate/main.fmf index 29abfee..878ee66 100644 --- a/policycoreutils/sepolicy-generate/main.fmf +++ b/policycoreutils/sepolicy-generate/main.fmf @@ -1 +1,39 @@ -path: /policycoreutils/sepolicy-generate +summary: sepolicy generate sanity test +description: '' +contact: Milos Malik +component: + - policycoreutils +recommend: + - policycoreutils + - policycoreutils-devel + - rpm-build +duration: 115m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - TIPpass_FIPS + - TIPpass_Security + - Tier3 + - Tier3se + - TipWaived7 + - f31friendly + - f32friendly + - targeted +tier: '3' +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1271324 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=924686 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1512590 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=924696 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=962752 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=924107 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=924121 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6 + continue: false +extra-nitrate: TC#0248603 +extra-summary: /CoreOS/policycoreutils/Sanity/sepolicy-generate +extra-task: /CoreOS/policycoreutils/Sanity/sepolicy-generate diff --git a/policycoreutils/sepolicy-generate/runtest.sh b/policycoreutils/sepolicy-generate/runtest.sh index e318ecc..e51e519 100755 --- a/policycoreutils/sepolicy-generate/runtest.sh +++ b/policycoreutils/sepolicy-generate/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="policycoreutils" diff --git a/policycoreutils/sestatus/main.fmf b/policycoreutils/sestatus/main.fmf index 0ca1ec2..22f1a56 100644 --- a/policycoreutils/sestatus/main.fmf +++ b/policycoreutils/sestatus/main.fmf @@ -1 +1,32 @@ -path: /policycoreutils/sestatus +summary: tests everything about sestatus +description: |4 + +contact: Milos Malik +component: + - policycoreutils +recommend: + - policycoreutils + - grep + - man +enabled: true +tag: + - CI-Tier-1 + - NoRHEL4 + - TIPpass_Security + - Tier1 + - Tier1se + - f31friendly + - f32friendly + - targeted +tier: '1' +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=705027 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=705031 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1723859 +adjust: + - enabled: false + when: distro == rhel-4 + continue: false +extra-nitrate: TC#0103609 +extra-summary: /CoreOS/policycoreutils/Sanity/sestatus +extra-task: /CoreOS/policycoreutils/Sanity/sestatus diff --git a/policycoreutils/sestatus/runtest.sh b/policycoreutils/sestatus/runtest.sh old mode 100644 new mode 100755 index 14ad828..c8c73d2 --- a/policycoreutils/sestatus/runtest.sh +++ b/policycoreutils/sestatus/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include rhts environment -. /usr/bin/rhts-environment.sh . /usr/share/beakerlib/beakerlib.sh PACKAGE="policycoreutils" diff --git a/policycoreutils/setfiles/main.fmf b/policycoreutils/setfiles/main.fmf index 78018a0..e49118d 100644 --- a/policycoreutils/setfiles/main.fmf +++ b/policycoreutils/setfiles/main.fmf @@ -1,17 +1,29 @@ summary: Basic sanity tests for setfiles -description: Basic sanity tests for setfiles -contact: Petr Lautrbach -path: /policycoreutils/setfiles +description: '' +contact: Milos Malik component: -- policycoreutils -framework: beakerlib -require: -- e2fsprogs -- policycoreutils -duration: 5m -tier: 1 + - policycoreutils +recommend: + - policycoreutils +duration: 30m enabled: true -adjust: - enabled: false - when: distro ~< rhel-8.4 - because: not expected to be fixed in RHEL-8 below 8.4 +tag: + - CI-Tier-1 + - TIPfail_Security + - Tier1 + - Tier1se + - f31friendly + - f32friendly + - targeted +tier: '1' +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1098062 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1086572 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1086456 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1271326 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1271327 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1584116 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1794518 +extra-nitrate: TC#0392756 +extra-summary: /CoreOS/policycoreutils/Sanity/setfiles +extra-task: /CoreOS/policycoreutils/Sanity/setfiles diff --git a/policycoreutils/setfiles_binary/main.fmf b/policycoreutils/setfiles_binary/main.fmf index d33a243..9c1c4f8 100644 --- a/policycoreutils/setfiles_binary/main.fmf +++ b/policycoreutils/setfiles_binary/main.fmf @@ -1,22 +1,25 @@ summary: setfiles should allow checking given path against binary policy -description: > - setfiles didn't allow using "-c" parameter (binary policy) when path - was specified. Verify that setfiles now gives the same results - regardless of weather binary policy was provided. -contact: Vit Mojzis -path: /policycoreutils/setfiles_binary +description: '' +contact: Milos Malik component: - - policycoreutils -framework: beakerlib -require: - - e2fsprogs - - policycoreutils - - rpm - - cpio -duration: 5m -tier: 1 + - policycoreutils +recommend: + - policycoreutils + - rpm + - cpio enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - targeted +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1973754 adjust: - enabled: false - when: distro ~< rhel-8.4 - because: not expected to be fixed in RHEL-8 below 8.4 + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + continue: false +extra-nitrate: TC#0611169 +extra-summary: /CoreOS/policycoreutils/Sanity/setfiles_binary +extra-task: /CoreOS/policycoreutils/Sanity/setfiles_binary diff --git a/policycoreutils/setsebool/main.fmf b/policycoreutils/setsebool/main.fmf index 7da7113..3ff5791 100644 --- a/policycoreutils/setsebool/main.fmf +++ b/policycoreutils/setsebool/main.fmf @@ -1 +1,44 @@ -path: /policycoreutils/setsebool +summary: does setsebool work correctly ? +description: |+ + Does setsebool work as expected? Does it produce correct audit messages? + +contact: Milos Malik +component: + - policycoreutils +recommend: + - audit + - policycoreutils + - libselinux-utils + - shadow-utils + - grep +duration: 45m +enabled: true +tag: + - CI-Tier-1 + - NoRHEL4 + - TIPpass + - TIPpass_FIPS + - TIPpass_Security + - Tier1 + - Tier1se + - TipWaived7 + - f31friendly + - f33friendly + - failinrhel8ci + - targeted +tier: '1' +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1002529 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=856550 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1029965 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=953917 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=825176 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=666365 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=998974 +adjust: + - enabled: false + when: distro == rhel-4 + continue: false +extra-nitrate: TC#0078073 +extra-summary: /CoreOS/policycoreutils/Sanity/setsebool +extra-task: /CoreOS/policycoreutils/Sanity/setsebool diff --git a/policycoreutils/setsebool/runtest.sh b/policycoreutils/setsebool/runtest.sh index 202d641..36357f7 100755 --- a/policycoreutils/setsebool/runtest.sh +++ b/policycoreutils/setsebool/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include rhts environment -. /usr/bin/rhts-environment.sh . /usr/share/beakerlib/beakerlib.sh PACKAGE="policycoreutils" From 1bf77a6669b1764ad3162b304717824004ca0cd3 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Mon, 25 Apr 2022 09:07:09 +0200 Subject: [PATCH 131/626] convert metadata of all selinux-policy tests to TMT/FMF --- .../accounts-daemon-and-similar/main.fmf | 74 ++++++++++++++++++- .../accounts-daemon-and-similar/runtest.sh | 1 - selinux-policy/acpid-and-similar/main.fmf | 56 +++++++++++++- selinux-policy/acpid-and-similar/runtest.sh | 1 - .../anon_inode-and-similar/main.fmf | 41 ++++++++-- .../anon_inode-and-similar/runtest.sh | 1 - selinux-policy/boltd-and-similar/main.fmf | 56 +++++++++++++- selinux-policy/boltd-and-similar/runtest.sh | 1 - .../bz481628-send-msg-to-dbus/main.fmf | 52 ++++++++++++- .../bz481628-send-msg-to-dbus/runtest.sh | 1 - .../bz624405-pcsc-and-similar/main.fmf | 62 +++++++++++++++- .../bz624405-pcsc-and-similar/runtest.sh | 1 - .../bz733494-amanda-and-similar/main.fmf | 67 ++++++++++++++++- .../bz733494-amanda-and-similar/runtest.sh | 1 - .../cockpit-ws-and-similar/main.fmf | 66 ++++++++++++++++- .../cockpit-ws-and-similar/runtest.sh | 1 - selinux-policy/colord-and-similar/main.fmf | 59 ++++++++++++++- selinux-policy/colord-and-similar/runtest.sh | 1 - .../cups-browsed-and-similar/main.fmf | 54 +++++++++++++- .../cups-browsed-and-similar/runtest.sh | 1 - selinux-policy/cups-lpd-and-similar/main.fmf | 65 +++++++++++++++- selinux-policy/cups-pdf-and-similar/main.fmf | 56 +++++++++++++- .../cups-pdf-and-similar/runtest.sh | 1 - selinux-policy/dhclient-and-similar/main.fmf | 29 +++++++- .../dhclient-and-similar/runtest.sh | 1 - selinux-policy/dmidecode-and-similar/main.fmf | 57 +++++++++++++- .../dmidecode-and-similar/runtest.sh | 1 - selinux-policy/fapolicyd-and-similar/main.fmf | 47 +++++++++++- .../fapolicyd-and-similar/runtest.sh | 1 - selinux-policy/firewalld-and-similar/main.fmf | 72 +++++++++++++++++- .../firewalld-and-similar/runtest.sh | 1 - selinux-policy/fwupd-and-similar/main.fmf | 57 +++++++++++++- selinux-policy/fwupd-and-similar/runtest.sh | 1 - selinux-policy/getrlimit-permission/main.fmf | 47 +++++++++++- .../getrlimit-permission/runtest.sh | 1 - selinux-policy/hostapd-and-similar/main.fmf | 59 ++++++++++++++- .../journalctl-and-similar/main.fmf | 53 ++++++++++++- .../journalctl-and-similar/runtest.sh | 1 - selinux-policy/kerberos-and-similar/main.fmf | 66 +++++++++++++++-- .../kerberos-and-similar/runtest.sh | 1 - selinux-policy/ladvd/main.fmf | 38 ++++++++-- selinux-policy/ladvd/runtest.sh | 1 - selinux-policy/lockdown-class/main.fmf | 27 ++++++- selinux-policy/lockdown-class/runtest.sh | 1 - selinux-policy/nasd-and-similar/main.fmf | 26 ++++++- selinux-policy/nasd-and-similar/runtest.sh | 1 - selinux-policy/nfsdcld-and-similar/main.fmf | 42 ++++++++++- selinux-policy/nfsdcld-and-similar/runtest.sh | 1 - selinux-policy/numad-and-similar/main.fmf | 55 +++++++++++++- selinux-policy/numad-and-similar/runtest.sh | 1 - .../pam_console-and-related/main.fmf | 54 +++++++++++++- .../pam_console-and-related/runtest.sh | 1 - .../pam_limits-and-related/main.fmf | 49 +++++++++++- .../pam_limits-and-related/runtest.sh | 1 - .../pam_timestamp-and-related/main.fmf | 61 ++++++++++++++- .../pam_timestamp-and-related/runtest.sh | 1 - .../pcp-daemons-and-similar/main.fmf | 71 +++++++++++++++++- .../pcp-daemons-and-similar/runtest.sh | 1 - .../perf_event-and-related/main.fmf | 44 ++++++++++- .../perf_event-and-related/runtest.sh | 1 - selinux-policy/ping-and-similar/main.fmf | 48 +++++++++++- selinux-policy/ping-and-similar/runtest.sh | 1 - selinux-policy/policy-rpm-macros/main.fmf | 44 ++++++++++- selinux-policy/policy-rpm-macros/runtest.sh | 1 - selinux-policy/policykit-general/main.fmf | 60 +++++++++++++++ selinux-policy/policykit-general/runtest.sh | 1 - selinux-policy/rngd-and-similar/main.fmf | 72 +++++++++++++++++- selinux-policy/rngd-and-similar/runtest.sh | 1 - selinux-policy/rpmdb-and-similar/main.fmf | 46 +++++++++++- selinux-policy/rpmdb-and-similar/runtest.sh | 1 - .../rrdcached-service-and-related/main.fmf | 42 ++++++++++- .../rrdcached-service-and-related/runtest.sh | 1 - selinux-policy/rsyslog-and-similar/main.fmf | 49 ++++++++++-- selinux-policy/rsyslog-and-similar/runtest.sh | 1 - .../rtkit-daemon-and-similar/main.fmf | 52 ++++++++++--- .../smbcontrol-and-similar/main.fmf | 52 ++++++++++++- .../smbcontrol-and-similar/runtest.sh | 1 - selinux-policy/sslh-and-similar/main.fmf | 46 +++++++++++- selinux-policy/sslh-and-similar/runtest.sh | 1 - .../swap-file-and-systemd-access/main.fmf | 51 ++++++++++++- .../swap-file-and-systemd-access/runtest.sh | 1 - .../systemd-bootchart-and-similar/main.fmf | 40 +++++++++- .../systemd-bootchart-and-similar/runtest.sh | 1 - selinux-policy/systemd-homed/main.fmf | 34 ++++++--- selinux-policy/systemd-homed/runtest.sh | 1 - .../systemd-modules-load-and-similar/main.fmf | 62 +++++++++++++++- .../runtest.sh | 1 - .../systemd-rfkill-and-similar/main.fmf | 57 +++++++++++++- .../systemd-rfkill-and-similar/runtest.sh | 1 - .../systemd-sysctl-and-similar/main.fmf | 40 +++++++++- .../systemd-sysctl-and-similar/runtest.sh | 1 - .../systemd-timesyncd-and-similar/main.fmf | 60 ++++++++++++++- .../systemd-timesyncd-and-similar/runtest.sh | 1 - .../systemd-userdbd-and-similar/main.fmf | 50 ++++++++++++- .../systemd-userdbd-and-similar/runtest.sh | 1 - selinux-policy/tlp-and-similar/main.fmf | 50 +++++++++++-- selinux-policy/tlp-and-similar/runtest.sh | 1 - .../usbguard-daemon-and-similar/main.fmf | 50 ++++++++++++- .../usbguard-daemon-and-similar/runtest.sh | 1 - selinux-policy/usbmuxd-and-similar/main.fmf | 55 +++++++++++++- selinux-policy/usbmuxd-and-similar/runtest.sh | 1 - 101 files changed, 2569 insertions(+), 202 deletions(-) mode change 100644 => 100755 selinux-policy/numad-and-similar/runtest.sh create mode 100644 selinux-policy/policykit-general/main.fmf diff --git a/selinux-policy/accounts-daemon-and-similar/main.fmf b/selinux-policy/accounts-daemon-and-similar/main.fmf index 18f5328..86dea1b 100644 --- a/selinux-policy/accounts-daemon-and-similar/main.fmf +++ b/selinux-policy/accounts-daemon-and-similar/main.fmf @@ -1,3 +1,73 @@ -path: /selinux-policy/accounts-daemon-and-similar -tier: 2 +summary: SELinux interferes with accounts daemon and related programs +description: |+ + SELinux interferes with accounts daemon and related programs. +contact: Milos Malik +component: + - selinux-policy +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - accountsservice + - glib2 + - procps-ng + - realmd + - initscripts +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - TIPpass + - TIPpass_Security + - Tier3 + - Tier3se + - TierCandidatesPASS + - failinfedora + - targeted +tier: '3' +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1456760 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1507089 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1518211 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1595667 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1792895 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1806126 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1811407 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1815312 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1818696 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1819040 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1820978 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1820992 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1821156 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1828809 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1829013 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1829075 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1829128 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1935232 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1933842 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1933687 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1928546 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1934573 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1928565 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1928567 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6 + continue: false + - enabled: false + when: arch == aarch64, s390x + continue: false +extra-nitrate: TC#0075208 +extra-summary: /CoreOS/selinux-policy/Regression/accounts-daemon-and-similar +extra-task: /CoreOS/selinux-policy/Regression/accounts-daemon-and-similar diff --git a/selinux-policy/accounts-daemon-and-similar/runtest.sh b/selinux-policy/accounts-daemon-and-similar/runtest.sh index e173541..0c64eb0 100755 --- a/selinux-policy/accounts-daemon-and-similar/runtest.sh +++ b/selinux-policy/accounts-daemon-and-similar/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" diff --git a/selinux-policy/acpid-and-similar/main.fmf b/selinux-policy/acpid-and-similar/main.fmf index 4d7c29e..cb45cc1 100644 --- a/selinux-policy/acpid-and-similar/main.fmf +++ b/selinux-policy/acpid-and-similar/main.fmf @@ -1,2 +1,54 @@ -path: /selinux-policy/acpid-and-similar -tier: 2 +summary: SELinux interferes with acpid and related programs +description: |+ + SELinux interferes with acpid and related programs + +contact: Milos Malik +component: + - selinux-policy + - acpid +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools + - setools-console + - acpid + - initscripts +environment: + AVC_ERROR: +no_avc_check +duration: 30m +enabled: true +tag: + - NoRHEL4 + - TIPfail_infra + - TIPpass + - TIPpass_Security + - Tier2 + - Tier2se + - f31friendly + - f32friendly + - targeted +tier: '2' +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=995898 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1358478 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1468548 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1622417 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1623342 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1932294 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1919167 +adjust: + - enabled: false + when: distro == rhel-4 + continue: false + - enabled: false + when: arch == ia64, ppc64, ppc64le, s390, s390x + continue: false +extra-nitrate: TC#0075209 +extra-summary: /CoreOS/selinux-policy/Regression/acpid-and-similar +extra-task: /CoreOS/selinux-policy/Regression/acpid-and-similar diff --git a/selinux-policy/acpid-and-similar/runtest.sh b/selinux-policy/acpid-and-similar/runtest.sh index bad833b..9034f7d 100755 --- a/selinux-policy/acpid-and-similar/runtest.sh +++ b/selinux-policy/acpid-and-similar/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" diff --git a/selinux-policy/anon_inode-and-similar/main.fmf b/selinux-policy/anon_inode-and-similar/main.fmf index 18a148c..e490f04 100644 --- a/selinux-policy/anon_inode-and-similar/main.fmf +++ b/selinux-policy/anon_inode-and-similar/main.fmf @@ -1,8 +1,37 @@ -path: /selinux-policy/anon_inode-and-similar -summary: Test AVC issues related to tclass anon_inode +summary: SELinux AVC issues related to anon_inode tclass policies. description: | - Test coverage for cases verifying avc denial issues related to - anon_inode tclass. + SELinux denials affect processes that deals with anon_inode tclass. +contact: Milos Malik +component: + - selinux-policy +require: + - library(selinux-policy/common) +recommend: + - libselinux + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - gcc + - glibc-headers + - setools-console + - audit +environment: + AVC_ERROR: +no_avc_check +duration: 30m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - targeted +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1974559 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2027660 adjust: -- enabled: false - when: distro < rhel-9 + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 + continue: false +extra-nitrate: TC#0612643 +extra-summary: /CoreOS/selinux-policy/Regression/anon_inode-and-similar +extra-task: /CoreOS/selinux-policy/Regression/anon_inode-and-similar diff --git a/selinux-policy/anon_inode-and-similar/runtest.sh b/selinux-policy/anon_inode-and-similar/runtest.sh index 11ab2a0..e09760a 100755 --- a/selinux-policy/anon_inode-and-similar/runtest.sh +++ b/selinux-policy/anon_inode-and-similar/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include rhts environment -. /usr/bin/rhts-environment.sh . /usr/share/beakerlib/beakerlib.sh PACKAGE="selinux-policy" diff --git a/selinux-policy/boltd-and-similar/main.fmf b/selinux-policy/boltd-and-similar/main.fmf index 501df63..0b236f2 100644 --- a/selinux-policy/boltd-and-similar/main.fmf +++ b/selinux-policy/boltd-and-similar/main.fmf @@ -1,2 +1,54 @@ -path: /selinux-policy/boltd-and-similar -tier: 2 +summary: SELinux interferes with boltd and related programs. +description: |+ + SELinux interferes with boltd and related programs. + +contact: Milos Malik +component: + - selinux-policy +require: + - library(selinux-policy/common) +recommend: + - audit + - initscripts + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - glib2 + - expect + - openssh-clients + - bolt +environment: + AVC_ERROR: +no_avc_check +duration: 30m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - TIPfail_Security + - Tier2 + - Tier2se + - TierCandidatesPASS + - f31friendly + - f32friendly + - failinfedora + - targeted +tier: '2' +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1589086 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1625786 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1684103 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1685591 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1702243 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1704766 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1951114 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6 + continue: false +extra-nitrate: TC#0575292 +extra-summary: /CoreOS/selinux-policy/Regression/boltd-and-similar +extra-task: /CoreOS/selinux-policy/Regression/boltd-and-similar diff --git a/selinux-policy/boltd-and-similar/runtest.sh b/selinux-policy/boltd-and-similar/runtest.sh index 73c0ae6..17359a7 100755 --- a/selinux-policy/boltd-and-similar/runtest.sh +++ b/selinux-policy/boltd-and-similar/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" diff --git a/selinux-policy/bz481628-send-msg-to-dbus/main.fmf b/selinux-policy/bz481628-send-msg-to-dbus/main.fmf index 8763a30..efb8889 100644 --- a/selinux-policy/bz481628-send-msg-to-dbus/main.fmf +++ b/selinux-policy/bz481628-send-msg-to-dbus/main.fmf @@ -1,2 +1,50 @@ -path: /selinux-policy/bz481628-send-msg-to-dbus -tier: 2 +summary: checks if dbus daemon is able to send message to hal daemon and vice versa +description: |+ + SELinux interferes with D-bus daemon and related programs. + +contact: Milos Malik +component: + - dbus + - selinux-policy +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools + - setools-console + - expect + - openssh-clients + - dbus-daemon + - shadow-utils +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - CI-Tier-1 + - NoRHEL4 + - TIPfail_Security + - TIPpass + - TierCandidatesPASS + - failinfedora + - targeted +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=463267 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=481628 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1546721 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1614236 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1688671 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1727887 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1754476 +adjust: + - enabled: false + when: distro == rhel-4 + continue: false +extra-nitrate: TC#0057414 +extra-summary: /CoreOS/selinux-policy/Regression/bz481628-send-msg-to-dbus +extra-task: /CoreOS/selinux-policy/Regression/bz481628-send-msg-to-dbus diff --git a/selinux-policy/bz481628-send-msg-to-dbus/runtest.sh b/selinux-policy/bz481628-send-msg-to-dbus/runtest.sh index 19e95d7..bf6648e 100755 --- a/selinux-policy/bz481628-send-msg-to-dbus/runtest.sh +++ b/selinux-policy/bz481628-send-msg-to-dbus/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include rhts environment -. /usr/bin/rhts-environment.sh . /usr/share/beakerlib/beakerlib.sh PACKAGE="selinux-policy" diff --git a/selinux-policy/bz624405-pcsc-and-similar/main.fmf b/selinux-policy/bz624405-pcsc-and-similar/main.fmf index 798179e..685536f 100644 --- a/selinux-policy/bz624405-pcsc-and-similar/main.fmf +++ b/selinux-policy/bz624405-pcsc-and-similar/main.fmf @@ -1,3 +1,61 @@ -path: /selinux-policy/bz624405-pcsc-and-similar -tier: 2 +summary: SELinux interferes with pcscd +description: |+ + SELinux interferes with pcscd and related programs. +contact: Milos Malik +component: + - pcsc-lite + - selinux-policy +require: + - library(selinux-policy/common) +recommend: + - audit + - expect + - grep + - initscripts + - libselinux + - libselinux-utils + - pcsc-lite + - policycoreutils + - procps + - selinux-policy + - selinux-policy-mls + - selinux-policy-targeted + - setools + - setools-console +environment: + AVC_ERROR: +no_avc_check +duration: 15m +enabled: true +tag: + - NoRHEL4 + - TIPpass + - TIPpass_FIPS + - TIPpass_Security + - Tier3 + - Tier3se + - f31friendly + - f32friendly + - targeted +tier: '3' +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=624405 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=752453 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1605641 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1802423 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1805719 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1806129 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1816787 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1818759 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1825182 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1825188 +adjust: + - enabled: false + when: arch == s390, s390x + continue: false + - enabled: false + when: distro == rhel-4 + continue: false +extra-nitrate: TC#0057525 +extra-summary: /CoreOS/selinux-policy/Regression/bz624405-pcsc-and-similar +extra-task: /CoreOS/selinux-policy/Regression/bz624405-pcsc-and-similar diff --git a/selinux-policy/bz624405-pcsc-and-similar/runtest.sh b/selinux-policy/bz624405-pcsc-and-similar/runtest.sh index 5123da8..5a2838f 100755 --- a/selinux-policy/bz624405-pcsc-and-similar/runtest.sh +++ b/selinux-policy/bz624405-pcsc-and-similar/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include rhts environment -. /usr/bin/rhts-environment.sh . /usr/share/beakerlib/beakerlib.sh PACKAGE="selinux-policy" diff --git a/selinux-policy/bz733494-amanda-and-similar/main.fmf b/selinux-policy/bz733494-amanda-and-similar/main.fmf index ee89c6c..f062952 100644 --- a/selinux-policy/bz733494-amanda-and-similar/main.fmf +++ b/selinux-policy/bz733494-amanda-and-similar/main.fmf @@ -1,3 +1,66 @@ -path: /selinux-policy/bz733494-amanda-and-similar -tier: 2 +summary: SELinux interferes with amanda and related tools +description: |+ + SELinux interferes with amandad and related programs. +contact: Milos Malik +component: + - amanda + - selinux-policy +require: + - library(selinux-policy/common) +recommend: + - amanda + - amanda-client + - amanda-server + - audit + - initscripts + - libselinux + - libselinux-utils + - nc + - net-tools + - nmap-ncat + - policycoreutils + - procps-ng + - krb5-workstation + - selinux-policy + - selinux-policy-targeted + - setools + - setools-console + - xinetd +environment: + AVC_ERROR: +no_avc_check +duration: 15m +enabled: true +tag: + - NoRHEL4 + - TIP_fedora_fail + - TIPfail_Apps + - TIPfail_Security + - TIPfail_fedora + - TIPpass + - TierCandidatesFAIL + - f32friendly + - failinfedora + - rhel9-buildroot + - targeted +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=283971 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=498596 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=729361 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=733494 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=965140 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1371561 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1452444 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1623052 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1630963 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1739137 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1960513 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1065002 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1572696 +adjust: + - enabled: false + when: distro == rhel-4, rhel-9 + continue: false +extra-nitrate: TC#0114575 +extra-summary: /CoreOS/selinux-policy/Regression/bz733494-amanda-and-similar +extra-task: /CoreOS/selinux-policy/Regression/bz733494-amanda-and-similar diff --git a/selinux-policy/bz733494-amanda-and-similar/runtest.sh b/selinux-policy/bz733494-amanda-and-similar/runtest.sh index dbb4624..8e832c8 100755 --- a/selinux-policy/bz733494-amanda-and-similar/runtest.sh +++ b/selinux-policy/bz733494-amanda-and-similar/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include rhts environment -. /usr/bin/rhts-environment.sh . /usr/share/beakerlib/beakerlib.sh PACKAGE="selinux-policy" diff --git a/selinux-policy/cockpit-ws-and-similar/main.fmf b/selinux-policy/cockpit-ws-and-similar/main.fmf index adb81d8..1180f0a 100644 --- a/selinux-policy/cockpit-ws-and-similar/main.fmf +++ b/selinux-policy/cockpit-ws-and-similar/main.fmf @@ -1,3 +1,65 @@ -path: /selinux-policy/cockpit-ws-and-similar -tier: 2 +summary: SELinux interferes with cockpit-ws and related programs +description: |+ + SELinux interferes with cockpit-ws, cockpit-ssh, cockpit-session and related programs. +contact: Milos Malik +component: + - selinux-policy +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - glib2 + - cockpit-ws + - net-tools + - nmap-ncat + - cockpit-dashboard + - cockpit-bridge + - psmisc + - selinux-policy-devel +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - TIPfail_Security + - TierCandidatesPASS + - failinfedora + - targeted +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1100808 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1214223 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1279429 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1283955 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1374572 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1381914 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1402316 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1402495 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1413509 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1561053 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1584167 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1609929 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1613638 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1615318 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1629678 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1718814 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1979182 +adjust: + - enabled: false + when: arch != x86_64 + continue: false + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6 + continue: false +extra-nitrate: TC#0419451 +extra-summary: /CoreOS/selinux-policy/Regression/cockpit-ws-and-similar +extra-task: /CoreOS/selinux-policy/Regression/cockpit-ws-and-similar diff --git a/selinux-policy/cockpit-ws-and-similar/runtest.sh b/selinux-policy/cockpit-ws-and-similar/runtest.sh index e0b6a92..a2807c9 100755 --- a/selinux-policy/cockpit-ws-and-similar/runtest.sh +++ b/selinux-policy/cockpit-ws-and-similar/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" diff --git a/selinux-policy/colord-and-similar/main.fmf b/selinux-policy/colord-and-similar/main.fmf index 418c370..36914c4 100644 --- a/selinux-policy/colord-and-similar/main.fmf +++ b/selinux-policy/colord-and-similar/main.fmf @@ -1,2 +1,57 @@ -path: /selinux-policy/colord-and-similar -tier: 2 +summary: SELinux interferes with colord and related programs +description: |+ + SELinux interferes with colord and related programs. + +contact: Milos Malik +component: + - selinux-policy +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - glib2 + - setools-console + - colord + - initscripts + - expect +environment: + AVC_ERROR: +no_avc_check + ALLOWED_USERS: staff_u user_u sysadm_u unconfined_u + DENIED_USERS: guest_u xguest_u +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - RHEL8 + - TIPpass + - TIPpass_FIPS + - TIPpass_Security + - Tier2 + - Tier2se + - f31friendly + - f32friendly + - targeted +tier: '2' +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1373082 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1381579 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1398030 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1421247 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1460480 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1772669 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1951114 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1878094 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6 + continue: false +extra-nitrate: TC#0276310 +extra-summary: /CoreOS/selinux-policy/Regression/colord-and-similar +extra-task: /CoreOS/selinux-policy/Regression/colord-and-similar diff --git a/selinux-policy/colord-and-similar/runtest.sh b/selinux-policy/colord-and-similar/runtest.sh index 552a1bd..f082735 100755 --- a/selinux-policy/colord-and-similar/runtest.sh +++ b/selinux-policy/colord-and-similar/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" diff --git a/selinux-policy/cups-browsed-and-similar/main.fmf b/selinux-policy/cups-browsed-and-similar/main.fmf index 6eda278..7e59ea2 100644 --- a/selinux-policy/cups-browsed-and-similar/main.fmf +++ b/selinux-policy/cups-browsed-and-similar/main.fmf @@ -1,3 +1,53 @@ -path: /selinux-policy/cups-browsed-and-similar -tier: 2 +summary: SELinux interferes with cups-browsed and related programs +description: |+ + SELinux interferes with cups-browsed and related programs. +contact: Milos Malik +component: + - cups + - selinux-policy +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - cups-filters + - cups + - initscripts +environment: + AVC_ERROR: +no_avc_check +duration: 15m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - RHEL8 + - TIP_fedora_pass + - TIPfail_infra + - TIPpass + - TIPpass_FIPS + - TIPpass_Security + - Tier1 + - Tier1security + - Tier2se + - f32friendly + - targeted +tier: '1' +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1395801 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1401634 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1719754 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1929329 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6 + continue: false +extra-nitrate: TC#0300676 +extra-summary: /CoreOS/selinux-policy/Regression/cups-browsed-and-similar +extra-task: /CoreOS/selinux-policy/Regression/cups-browsed-and-similar diff --git a/selinux-policy/cups-browsed-and-similar/runtest.sh b/selinux-policy/cups-browsed-and-similar/runtest.sh index 41bc812..3b7c056 100755 --- a/selinux-policy/cups-browsed-and-similar/runtest.sh +++ b/selinux-policy/cups-browsed-and-similar/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" diff --git a/selinux-policy/cups-lpd-and-similar/main.fmf b/selinux-policy/cups-lpd-and-similar/main.fmf index c9e7c44..b2ad36f 100644 --- a/selinux-policy/cups-lpd-and-similar/main.fmf +++ b/selinux-policy/cups-lpd-and-similar/main.fmf @@ -1,3 +1,64 @@ -path: /selinux-policy/cups-lpd-and-similar -tier: 2 +summary: SELinux interferes with cups-lpd and related programs +description: |+ + SELinux interferes with cups-lpd and related programs. +contact: Milos Malik +component: + - cups + - selinux-policy +require: + - library(selinux-policy/common) +recommend: + - audit + - expect + - policycoreutils-python-utils + - selinux-policy-devel + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools + - setools-console + - xinetd + - nmap-ncat + - nc + - net-tools + - cups-lpd + - chkconfig + - /usr/sbin/service +environment: + AVC_ERROR: +no_avc_check +duration: 20m +enabled: true +tag: + - NoRHEL4 + - RHEL8 + - TIPfail + - TIPfail_infra + - TIPpass_Security + - Tier2 + - Tier2se + - TierCandidatesFAIL + - customer_scenario + - f32friendly + - rhel9-buildroot + - targeted +tier: '2' +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=192216 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1004198 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1420522 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1554118 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1919399 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1947397 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2020531 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2039449 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1919173 +adjust: + - enabled: false + when: distro == rhel-4 + continue: false +extra-nitrate: TC#0305784 +extra-summary: /CoreOS/selinux-policy/Regression/cups-lpd-and-similar +extra-task: /CoreOS/selinux-policy/Regression/cups-lpd-and-similar diff --git a/selinux-policy/cups-pdf-and-similar/main.fmf b/selinux-policy/cups-pdf-and-similar/main.fmf index 699c0b8..eee7981 100644 --- a/selinux-policy/cups-pdf-and-similar/main.fmf +++ b/selinux-policy/cups-pdf-and-similar/main.fmf @@ -1,2 +1,54 @@ -path: /selinux-policy/cups-pdf-and-similar -tier: 2 +summary: SELinux interferes with cups-pdf and related programs +description: |+ + SELinux interferes with cups-pdf and related programs. + +contact: Milos Malik +component: + - cups + - selinux-policy +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - expect + - openssh-clients + - shadow-utils + - cups + - cups-pdf + - cups-client + - cups-filters +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - TIPfail_infra + - failinfedora + - targeted +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=560220 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=563977 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=570782 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1516282 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1517509 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1532043 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1594271 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1700442 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1832521 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-alt-7, rhel-8 + continue: false +extra-nitrate: TC#0607292 +extra-summary: /CoreOS/selinux-policy/Regression/cups-pdf-and-similar +extra-task: /CoreOS/selinux-policy/Regression/cups-pdf-and-similar diff --git a/selinux-policy/cups-pdf-and-similar/runtest.sh b/selinux-policy/cups-pdf-and-similar/runtest.sh index 9636625..2e20f6e 100755 --- a/selinux-policy/cups-pdf-and-similar/runtest.sh +++ b/selinux-policy/cups-pdf-and-similar/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" diff --git a/selinux-policy/dhclient-and-similar/main.fmf b/selinux-policy/dhclient-and-similar/main.fmf index d61123a..0504956 100644 --- a/selinux-policy/dhclient-and-similar/main.fmf +++ b/selinux-policy/dhclient-and-similar/main.fmf @@ -1,2 +1,27 @@ -path: /selinux-policy/dhclient-and-similar -tier: 2 +summary: SELinux interferes with dhclient and related programs +description: |+ + SELinux interferes with dhclient and related programs. + +contact: Milos Malik +component: + - selinux-policy +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - psmisc + - chrony + - dhcp-client +environment: + AVC_ERROR: +no_avc_check +duration: 10m +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1897388 +extra-summary: /CoreOS/selinux-policy/Regression/dhclient-and-similar +extra-task: /CoreOS/selinux-policy/Regression/dhclient-and-similar diff --git a/selinux-policy/dhclient-and-similar/runtest.sh b/selinux-policy/dhclient-and-similar/runtest.sh index f8263b5..9639e39 100755 --- a/selinux-policy/dhclient-and-similar/runtest.sh +++ b/selinux-policy/dhclient-and-similar/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" diff --git a/selinux-policy/dmidecode-and-similar/main.fmf b/selinux-policy/dmidecode-and-similar/main.fmf index af1851c..659e4f9 100644 --- a/selinux-policy/dmidecode-and-similar/main.fmf +++ b/selinux-policy/dmidecode-and-similar/main.fmf @@ -1,2 +1,55 @@ -path: /selinux-policy/dmidecode-and-similar -tier: 2 +summary: SELinux interferes with dmidecode and related programs +description: |+ + SELinux interferes with dmidecode and related programs. + +contact: Milos Malik +component: + - selinux-policy + - dmidecode +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools + - setools-console + - dmidecode + - selinux-policy-devel + - shadow-utils + - openssh-clients + - expect +environment: + AVC_ERROR: +no_avc_check +duration: 15m +enabled: true +tag: + - CI-Tier-1 + - NoRHEL4 + - TIPpass_Security + - Tier2 + - Tier2se + - TierCandidatesFAIL + - f31friendly + - f32friendly + - targeted +tier: '2' +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=263141 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1289274 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1300799 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1608480 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1926696 +adjust: + - enabled: false + when: distro == rhel-4 + continue: false + - enabled: false + when: arch != aarch64 and arch != i386 and arch != x86_64 + continue: false +extra-nitrate: TC#0550595 +extra-summary: /CoreOS/selinux-policy/Regression/dmidecode-and-similar +extra-task: /CoreOS/selinux-policy/Regression/dmidecode-and-similar diff --git a/selinux-policy/dmidecode-and-similar/runtest.sh b/selinux-policy/dmidecode-and-similar/runtest.sh index c488c8f..1885ae8 100755 --- a/selinux-policy/dmidecode-and-similar/runtest.sh +++ b/selinux-policy/dmidecode-and-similar/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" diff --git a/selinux-policy/fapolicyd-and-similar/main.fmf b/selinux-policy/fapolicyd-and-similar/main.fmf index b5b7e06..64bc4d9 100644 --- a/selinux-policy/fapolicyd-and-similar/main.fmf +++ b/selinux-policy/fapolicyd-and-similar/main.fmf @@ -1,3 +1,44 @@ -path: /selinux-policy/fapolicyd-and-similar -tier: 2 -component: disabled +summary: SELinux interferes with fapolicyd and related programs +description: |+ + SELinux interferes with fapolicyd and related programs. + +contact: Milos Malik +component: + - fapolicyd + - selinux-policy +require: + - library(selinux-policy/common) +recommend: + - audit + - initscripts + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - fapolicyd + - fapolicyd-selinux +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - fedora-wanted + - targeted +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1865818 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1874491 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1876538 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1932225 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + continue: false +extra-nitrate: TC#0608224 +extra-summary: /CoreOS/selinux-policy/Regression/fapolicyd-and-similar +extra-task: /CoreOS/selinux-policy/Regression/fapolicyd-and-similar diff --git a/selinux-policy/fapolicyd-and-similar/runtest.sh b/selinux-policy/fapolicyd-and-similar/runtest.sh index 6709ce5..49ccb65 100755 --- a/selinux-policy/fapolicyd-and-similar/runtest.sh +++ b/selinux-policy/fapolicyd-and-similar/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" diff --git a/selinux-policy/firewalld-and-similar/main.fmf b/selinux-policy/firewalld-and-similar/main.fmf index 4fc8344..3134d71 100644 --- a/selinux-policy/firewalld-and-similar/main.fmf +++ b/selinux-policy/firewalld-and-similar/main.fmf @@ -1,2 +1,70 @@ -path: /selinux-policy/firewalld-and-similar -tier: 2 +summary: SELinux interferes with firewalld and related programs +description: |+ + SELinux interferes with firewalld and related programs. + +contact: Milos Malik +component: + - selinux-policy + - firewalld +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - firewalld + - glib2 + - nftables + - procps-ng +environment: + AVC_ERROR: +no_avc_check +duration: 30m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - TIP_fedora_pass + - TIPfail_fedora + - TIPpass + - TIPpass_FIPS + - TIPpass_Security + - Tier3 + - Tier3se + - TierCandidatesPASS + - f32friendly + - f33friendly + - targeted +tier: '3' +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=907902 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=989922 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1067494 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1214853 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1221326 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1243403 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1284902 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1304721 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1304723 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1342235 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1342587 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1346316 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1375576 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1418391 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1438708 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1573501 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1593687 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1600903 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1759010 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1989641 +adjust: + - enabled: false + when: distro < rhel-7 + continue: false +extra-nitrate: TC#0175059 +extra-summary: /CoreOS/selinux-policy/Regression/firewalld-and-similar +extra-task: /CoreOS/selinux-policy/Regression/firewalld-and-similar diff --git a/selinux-policy/firewalld-and-similar/runtest.sh b/selinux-policy/firewalld-and-similar/runtest.sh index 57cab77..f81a5ab 100755 --- a/selinux-policy/firewalld-and-similar/runtest.sh +++ b/selinux-policy/firewalld-and-similar/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" diff --git a/selinux-policy/fwupd-and-similar/main.fmf b/selinux-policy/fwupd-and-similar/main.fmf index 2425d89..1017ddb 100644 --- a/selinux-policy/fwupd-and-similar/main.fmf +++ b/selinux-policy/fwupd-and-similar/main.fmf @@ -1,2 +1,55 @@ -path: /selinux-policy/fwupd-and-similar -tier: 2 +summary: SELinux interferes with fwupd and related programs +description: |+ + SELinux interferes with fwupd and related programs. + Standalone service and confined users are tested. + +contact: Milos Malik +component: + - selinux-policy +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - glib2 + - fwupd + - initscripts + - expect +environment: + AVC_ERROR: +no_avc_check + ALLOWED_USERS: staff_u user_u sysadm_u unconfined_u + DENIED_USERS: guest_u xguest_u +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - TIPfail + - TIPfail_Security + - Tier3 + - Tier3se + - TierCandidatesPASS + - failinfedora + - targeted +tier: '3' +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1772619 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1832231 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1832234 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1832772 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1851932 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1860924 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1878094 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6 + continue: false +extra-nitrate: TC#0563429 +extra-summary: /CoreOS/selinux-policy/Regression/fwupd-and-similar +extra-task: /CoreOS/selinux-policy/Regression/fwupd-and-similar diff --git a/selinux-policy/fwupd-and-similar/runtest.sh b/selinux-policy/fwupd-and-similar/runtest.sh index e7f5b3f..91b2300 100755 --- a/selinux-policy/fwupd-and-similar/runtest.sh +++ b/selinux-policy/fwupd-and-similar/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" diff --git a/selinux-policy/getrlimit-permission/main.fmf b/selinux-policy/getrlimit-permission/main.fmf index 2ddf9f6..b092bb7 100644 --- a/selinux-policy/getrlimit-permission/main.fmf +++ b/selinux-policy/getrlimit-permission/main.fmf @@ -1,5 +1,44 @@ -path: /selinux-policy/getrlimit-permission -tier: 2 +summary: Is the getrlimit permission defined? Are appropriate checks applied? +description: |+ + Is the getrlimit permission defined? Are { getrlimit } SELinux denials triggered when certain access happens? + +contact: Milos Malik +component: + - selinux-policy +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - util-linux +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - CI-Tier-1 + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - TIPfail_Security + - Tier1 + - Tier1se + - f33friendly + - targeted +tier: '1' +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1549691 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1549772 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2008965 adjust: -- enabled: false - when: distro < rhel-7 + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7 + continue: false +extra-nitrate: TC#0574397 +extra-summary: /CoreOS/selinux-policy/Sanity/getrlimit-permission +extra-task: /CoreOS/selinux-policy/Sanity/getrlimit-permission diff --git a/selinux-policy/getrlimit-permission/runtest.sh b/selinux-policy/getrlimit-permission/runtest.sh index 846434e..d1313eb 100755 --- a/selinux-policy/getrlimit-permission/runtest.sh +++ b/selinux-policy/getrlimit-permission/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" diff --git a/selinux-policy/hostapd-and-similar/main.fmf b/selinux-policy/hostapd-and-similar/main.fmf index 2c5835e..6701f36 100644 --- a/selinux-policy/hostapd-and-similar/main.fmf +++ b/selinux-policy/hostapd-and-similar/main.fmf @@ -1,2 +1,57 @@ -path: /selinux-policy/hostapd-and-similar -tier: 2 +summary: SELinux interferes with hostapd and related programs +description: |+ + SELinux interferes with hostapd and related programs. + +contact: Milos Malik +component: + - selinux-policy +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - hostapd + - /usr/sbin/service + - kernel-modules-internal +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL8 + - TIPpass_Security + - failinfedora + - targeted +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1224405 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1225245 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1237343 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1266068 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1273570 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1278569 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1282179 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1334021 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1343683 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1977676 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1979968 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1784253 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2032277 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2064688 +adjust: + - enabled: false + when: arch == s390x + continue: false + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6 + continue: false +extra-nitrate: TC#0602539 +extra-summary: /CoreOS/selinux-policy/Regression/hostapd-and-similar +extra-task: /CoreOS/selinux-policy/Regression/hostapd-and-similar diff --git a/selinux-policy/journalctl-and-similar/main.fmf b/selinux-policy/journalctl-and-similar/main.fmf index cf8103f..ae50c2f 100644 --- a/selinux-policy/journalctl-and-similar/main.fmf +++ b/selinux-policy/journalctl-and-similar/main.fmf @@ -1,2 +1,51 @@ -path: /selinux-policy/journalctl-and-similar -tier: 2 +summary: SELinux interferes with journalctl executed by various users +description: |+ + SELinux interferes with journalctl executed by various users. + +contact: Milos Malik +component: + - selinux-policy + - systemd +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - expect + - openssh-clients + - systemd + - shadow-utils +environment: + AVC_ERROR: +no_avc_check + ALLOWED_USERS: staff_u user_u sysadm_u unconfined_u + DENIED_USERS: guest_u xguest_u +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - TIPfail + - TIPfail_Security + - TIPfail_systemd + - failinfedora + - targeted +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1176713 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1288255 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1685689 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1825894 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2017838 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1703241 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6 + continue: false +extra-nitrate: TC#0597884 +extra-summary: /CoreOS/selinux-policy/Regression/journalctl-and-similar +extra-task: /CoreOS/selinux-policy/Regression/journalctl-and-similar diff --git a/selinux-policy/journalctl-and-similar/runtest.sh b/selinux-policy/journalctl-and-similar/runtest.sh index d7b8fd7..7c471e9 100755 --- a/selinux-policy/journalctl-and-similar/runtest.sh +++ b/selinux-policy/journalctl-and-similar/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" diff --git a/selinux-policy/kerberos-and-similar/main.fmf b/selinux-policy/kerberos-and-similar/main.fmf index f55e70a..d51db70 100644 --- a/selinux-policy/kerberos-and-similar/main.fmf +++ b/selinux-policy/kerberos-and-similar/main.fmf @@ -1,5 +1,61 @@ -path: /selinux-policy/kerberos-and-similar -summary: SELinux interferes with various kerberos daemons and related programs. -description: | - Test coverage for SELinux AVC issues against kerberos daemon and related - programs. +summary: SELinux interferes with kerberos programs +description: |+ + SELinux interferes with various kerberos daemons and related programs. + +contact: Milos Malik +component: + - selinux-policy + - krb5 +require: + - library(selinux-policy/common) +recommend: + - audit + - selinux-policy + - selinux-policy-targeted + - setools-console + - libselinux + - libselinux-utils + - policycoreutils + - krb5-server + - krb5-libs +environment: + AVC_ERROR: +no_avc_check +duration: 30m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - TIPpass_Security + - Tier2 + - Tier2se + - TipWaived6 + - TipWaived7 + - targeted +tier: '2' +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=698923 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=713218 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=860666 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=910837 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1041629 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1065460 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1153561 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1210421 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1220691 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1220763 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1319933 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1337895 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1368492 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1452215 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1600705 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1601004 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1619252 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1664983 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1669975 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5 + continue: false +extra-nitrate: TC#0230498 +extra-summary: /CoreOS/selinux-policy/Regression/kerberos-and-similar +extra-task: /CoreOS/selinux-policy/Regression/kerberos-and-similar diff --git a/selinux-policy/kerberos-and-similar/runtest.sh b/selinux-policy/kerberos-and-similar/runtest.sh index 60a9c1a..ce2c4f6 100755 --- a/selinux-policy/kerberos-and-similar/runtest.sh +++ b/selinux-policy/kerberos-and-similar/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" diff --git a/selinux-policy/ladvd/main.fmf b/selinux-policy/ladvd/main.fmf index 4e8b1a5..7fae35a 100644 --- a/selinux-policy/ladvd/main.fmf +++ b/selinux-policy/ladvd/main.fmf @@ -1,8 +1,30 @@ -path: /selinux-policy/ladvd -summary: Test ladvd utility to verify AVC denials -description: | - Test coverage for SELinux AVC issues related ladvd service. This - test suite primarily verifies two bugs ie bz1834325 and bz1855163. -adjust: -- enabled: false - when: distro <= rhel-8 +summary: Tests for ladvd service +description: |+ + Test coverage for SELinux AVC issues related to ladvd service. + +contact: Amith Kumar +component: + - selinux-policy +require: + - library(selinux-policy/common) +recommend: + - audit + - initscripts + - kernel-headers + - ladvd + - ladvd-selinux + - libpcap + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console +environment: + AVC_ERROR: +no_avc_check +duration: 1h +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1834325 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1855163 +extra-summary: /CoreOS/selinux-policy/Regression/ladvd +extra-task: /CoreOS/selinux-policy/Regression/ladvd diff --git a/selinux-policy/ladvd/runtest.sh b/selinux-policy/ladvd/runtest.sh index c213597..211f280 100755 --- a/selinux-policy/ladvd/runtest.sh +++ b/selinux-policy/ladvd/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" diff --git a/selinux-policy/lockdown-class/main.fmf b/selinux-policy/lockdown-class/main.fmf index be3fc65..2ea12ab 100644 --- a/selinux-policy/lockdown-class/main.fmf +++ b/selinux-policy/lockdown-class/main.fmf @@ -1,3 +1,26 @@ -path: /selinux-policy/lockdown-class -tier: 2 +summary: Is the lockdown class + its permissions defined in SELinux policy? +description: |+ + Description: Is the lockdown class + its permissions defined in SELinux policy? +contact: Milos Malik +component: + - selinux-policy +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console +environment: + AVC_ERROR: +no_avc_check +duration: 10m +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1915184 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1929332 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1933134 +extra-summary: /CoreOS/selinux-policy/Sanity/lockdown-class +extra-task: /CoreOS/selinux-policy/Sanity/lockdown-class diff --git a/selinux-policy/lockdown-class/runtest.sh b/selinux-policy/lockdown-class/runtest.sh index 9bed740..02e7682 100755 --- a/selinux-policy/lockdown-class/runtest.sh +++ b/selinux-policy/lockdown-class/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" diff --git a/selinux-policy/nasd-and-similar/main.fmf b/selinux-policy/nasd-and-similar/main.fmf index f026e8d..cd0bc98 100644 --- a/selinux-policy/nasd-and-similar/main.fmf +++ b/selinux-policy/nasd-and-similar/main.fmf @@ -1,2 +1,24 @@ -path: /selinux-policy/nasd-and-similar -tier: 2 +summary: SELinux interferes with the nasd service and related programs +description: |+ + SELinux interferes with the nasd service and related programs. + +contact: Milos Malik +component: + - nas +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - nas + - /usr/sbin/service +environment: + AVC_ERROR: +no_avc_check +duration: 10m +extra-summary: /CoreOS/selinux-policy/Regression/nasd-and-similar +extra-task: /CoreOS/selinux-policy/Regression/nasd-and-similar diff --git a/selinux-policy/nasd-and-similar/runtest.sh b/selinux-policy/nasd-and-similar/runtest.sh index bcf3369..b6f8c17 100755 --- a/selinux-policy/nasd-and-similar/runtest.sh +++ b/selinux-policy/nasd-and-similar/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" diff --git a/selinux-policy/nfsdcld-and-similar/main.fmf b/selinux-policy/nfsdcld-and-similar/main.fmf index 5dbc685..bdad94b 100644 --- a/selinux-policy/nfsdcld-and-similar/main.fmf +++ b/selinux-policy/nfsdcld-and-similar/main.fmf @@ -1,5 +1,39 @@ -path: /selinux-policy/nfsdcld-and-similar -tier: 2 +summary: SELinux interferes with the nfsdcld service and related programs +description: |+ + SELinux interferes with the nfsdcld service and related programs. + +contact: Milos Malik +component: + - selinux-policy +require: + - library(selinux-policy/common) +recommend: + - audit + - /usr/sbin/service + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - nfs-utils +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - targeted +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1834234 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2026588 adjust: -- enabled: false - when: distro < rhel-8 + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + continue: false +extra-nitrate: TC#0608104 +extra-summary: /CoreOS/selinux-policy/Regression/nfsdcld-and-similar +extra-task: /CoreOS/selinux-policy/Regression/nfsdcld-and-similar diff --git a/selinux-policy/nfsdcld-and-similar/runtest.sh b/selinux-policy/nfsdcld-and-similar/runtest.sh index bb43287..bf4b321 100755 --- a/selinux-policy/nfsdcld-and-similar/runtest.sh +++ b/selinux-policy/nfsdcld-and-similar/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" diff --git a/selinux-policy/numad-and-similar/main.fmf b/selinux-policy/numad-and-similar/main.fmf index e1d0e95..fd55273 100644 --- a/selinux-policy/numad-and-similar/main.fmf +++ b/selinux-policy/numad-and-similar/main.fmf @@ -1,2 +1,53 @@ -path: /selinux-policy/numad-and-similar -tier: 2 +summary: SELinux interferes with numad and related programs +description: |+ + SELinux interferes with numad and related programs. + +contact: Milos Malik +component: + - selinux-policy +require: + - library(selinux-policy/common) +recommend: + - audit + - expect + - grep + - initscripts + - libselinux + - libselinux-utils + - numad + - policycoreutils + - procps + - selinux-policy + - setools + - setools-console +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - TIPpass + - TIPpass_FIPS + - TIPpass_Security + - Tier3 + - Tier3se + - TipWaived7 + - failinfedora + - targeted +tier: '3' +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=807157 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=857086 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1074449 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1118515 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5 + continue: false + - enabled: false + when: arch != x86_64 and arch != ppc64 and arch != ppc64le + continue: false +extra-nitrate: TC#0202428 +extra-summary: /CoreOS/selinux-policy/Regression/numad-and-similar +extra-task: /CoreOS/selinux-policy/Regression/numad-and-similar diff --git a/selinux-policy/numad-and-similar/runtest.sh b/selinux-policy/numad-and-similar/runtest.sh old mode 100644 new mode 100755 index 0c639ef..3d2efe1 --- a/selinux-policy/numad-and-similar/runtest.sh +++ b/selinux-policy/numad-and-similar/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include rhts environment -. /usr/bin/rhts-environment.sh . /usr/share/beakerlib/beakerlib.sh PACKAGE="selinux-policy" diff --git a/selinux-policy/pam_console-and-related/main.fmf b/selinux-policy/pam_console-and-related/main.fmf index 96a80b5..6cc4b25 100644 --- a/selinux-policy/pam_console-and-related/main.fmf +++ b/selinux-policy/pam_console-and-related/main.fmf @@ -1,2 +1,52 @@ -path: /selinux-policy/pam_console-and-related -tier: 2 +summary: Does SELinux cooperate with pam_console_apply and pam_console.so? +description: |+ + Does SELinux cooperate with pam_console_apply and pam_console.so? + Confined and unconfined users are tested using SSH. + + This TC uses following parameters which can be overriden: + * ALLOWED_USERS - which SELinux users should be tested? + * DENIED_USERS - which SELinux users should NOT be tested? + +contact: aborah@redhat.com +component: + - pam + - selinux-policy +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - expect + - openssh-clients + - pam + - psmisc + - binutils + - shadow-utils +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - TIPfail + - TIPpass_Security + - failinfedora + - targeted +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=204986 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=251104 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1817690 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6 + continue: false +extra-nitrate: TC#0606229 +extra-summary: /CoreOS/selinux-policy/Regression/pam_console-and-related +extra-task: /CoreOS/selinux-policy/Regression/pam_console-and-related diff --git a/selinux-policy/pam_console-and-related/runtest.sh b/selinux-policy/pam_console-and-related/runtest.sh index 8d35eac..812c07c 100755 --- a/selinux-policy/pam_console-and-related/runtest.sh +++ b/selinux-policy/pam_console-and-related/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" diff --git a/selinux-policy/pam_limits-and-related/main.fmf b/selinux-policy/pam_limits-and-related/main.fmf index 7d613d7..9e10d36 100644 --- a/selinux-policy/pam_limits-and-related/main.fmf +++ b/selinux-policy/pam_limits-and-related/main.fmf @@ -1,2 +1,47 @@ -path: /selinux-policy/pam_limits-and-related -tier: 2 +summary: Does SELinux cooperate with pam_limits.so? +description: |+ + Does SELinux cooperate with pam_limits.so? + Confined and unconfined users are tested using SSH. + + This TC uses following parameters which can be overriden: + * ALLOWED_USERS - which SELinux users should be tested? + * DENIED_USERS - which SELinux users should NOT be tested? + +contact: Milos Malik +component: + - pam + - selinux-policy +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - expect + - openssh-clients + - pam + - shadow-utils +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - targeted +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1958819 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2039453 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + continue: false +extra-nitrate: TC#0612789 +extra-summary: /CoreOS/selinux-policy/Regression/pam_limits-and-related +extra-task: /CoreOS/selinux-policy/Regression/pam_limits-and-related diff --git a/selinux-policy/pam_limits-and-related/runtest.sh b/selinux-policy/pam_limits-and-related/runtest.sh index cfc7036..b7a03ff 100755 --- a/selinux-policy/pam_limits-and-related/runtest.sh +++ b/selinux-policy/pam_limits-and-related/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" diff --git a/selinux-policy/pam_timestamp-and-related/main.fmf b/selinux-policy/pam_timestamp-and-related/main.fmf index a83b2cb..12696ae 100644 --- a/selinux-policy/pam_timestamp-and-related/main.fmf +++ b/selinux-policy/pam_timestamp-and-related/main.fmf @@ -1,2 +1,59 @@ -path: /selinux-policy/pam_timestamp-and-related -tier: 2 +summary: Does SELinux cooperate with pam_timestamp_check and pam_timestamp.so? +description: |+ + Does SELinux cooperate with pam_timestamp_check and pam_timestamp.so? + Confined and unconfined users are tested using SSH. + + This TC uses following parameters which can be overriden: + * ALLOWED_USERS - which SELinux users should be tested? + * DENIED_USERS - which SELinux users should NOT be tested? + * TIMESTAMP_DIR - in which directory is the _pam_timestamp_key file stored? + +contact: aborah@redhat.com +component: + - pam + - selinux-policy +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - expect + - openssh-clients + - pam + - psmisc + - binutils + - shadow-utils +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - TIPpass + - TIPpass_Security + - f32friendly + - failinfedora + - targeted +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1791957 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6 + continue: false + - environment: + TIMESTAMP_DIR: /run/sudo + when: distro == rhel-7 + continue: false + - enabled: false + when: distro ~<= rhel-8.2 + continue: false +extra-nitrate: TC#0606210 +extra-summary: /CoreOS/selinux-policy/Regression/pam_timestamp-and-related +extra-task: /CoreOS/selinux-policy/Regression/pam_timestamp-and-related diff --git a/selinux-policy/pam_timestamp-and-related/runtest.sh b/selinux-policy/pam_timestamp-and-related/runtest.sh index 051cdaa..f1a7b86 100755 --- a/selinux-policy/pam_timestamp-and-related/runtest.sh +++ b/selinux-policy/pam_timestamp-and-related/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" diff --git a/selinux-policy/pcp-daemons-and-similar/main.fmf b/selinux-policy/pcp-daemons-and-similar/main.fmf index d9d0f61..fa32730 100644 --- a/selinux-policy/pcp-daemons-and-similar/main.fmf +++ b/selinux-policy/pcp-daemons-and-similar/main.fmf @@ -1,5 +1,68 @@ -path: /selinux-policy/pcp-daemons-and-similar -summary: SELinux issues related to pcp deamons and related programs -description: | - Test coverage for SELinux AVC issues against pcp and related programs. +summary: the services were running as initrc_t, now they are confined by SELinux +description: |+ + SELinux interferes with various PCP services and related programs. +contact: jkurik@redhat.com +component: + - selinux-policy + - pcp +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools + - setools-console + - glib2 + - pcp + - pcp-manager + - pcp-pmda-dm + - pcp-webapi +environment: + AVC_ERROR: +no_avc_check +duration: 90m +enabled: true +tag: + - NoRHEL4 + - TIPfail_FIPS + - TIPpass + - TIPpass_Security + - TipWaived7 + - f32friendly + - failinfedora + - targeted +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1028598 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1061159 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1064233 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1072785 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1089912 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1130606 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1130934 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1167825 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1196926 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1203153 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1206525 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1211520 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1213709 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1213740 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1252341 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1261811 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1271998 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1286234 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1309883 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1379371 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1770123 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1886369 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1309454 +adjust: + - enabled: false + when: distro == rhel-4 + continue: false +extra-nitrate: TC#0075517 +extra-summary: /CoreOS/selinux-policy/Regression/pcp-daemons-and-similar +extra-task: /CoreOS/selinux-policy/Regression/pcp-daemons-and-similar diff --git a/selinux-policy/pcp-daemons-and-similar/runtest.sh b/selinux-policy/pcp-daemons-and-similar/runtest.sh index 9103fda..c22a7e8 100755 --- a/selinux-policy/pcp-daemons-and-similar/runtest.sh +++ b/selinux-policy/pcp-daemons-and-similar/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" diff --git a/selinux-policy/perf_event-and-related/main.fmf b/selinux-policy/perf_event-and-related/main.fmf index bc46d09..4e794c4 100644 --- a/selinux-policy/perf_event-and-related/main.fmf +++ b/selinux-policy/perf_event-and-related/main.fmf @@ -1,3 +1,43 @@ -path: /selinux-policy/perf_event-and-related -tier: 2 +summary: Is the perf_event class and its permissions defined? +description: |+ + Description: Is the perf_event class and its permissions defined? Does SELinux allow various perf_event aware programs to work? +contact: Milos Malik +component: + - selinux-policy +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - perf + - expect + - openssh-clients + - initscripts +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - targeted +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1901957 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1901958 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2019929 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2070982 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + continue: false +extra-nitrate: TC#0609306 +extra-summary: /CoreOS/selinux-policy/Regression/perf_event-and-related +extra-task: /CoreOS/selinux-policy/Regression/perf_event-and-related diff --git a/selinux-policy/perf_event-and-related/runtest.sh b/selinux-policy/perf_event-and-related/runtest.sh index f5fb5c1..987d2a5 100755 --- a/selinux-policy/perf_event-and-related/runtest.sh +++ b/selinux-policy/perf_event-and-related/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" diff --git a/selinux-policy/ping-and-similar/main.fmf b/selinux-policy/ping-and-similar/main.fmf index 8d535ce..f07662d 100644 --- a/selinux-policy/ping-and-similar/main.fmf +++ b/selinux-policy/ping-and-similar/main.fmf @@ -1,2 +1,46 @@ -path: /selinux-policy/ping-and-similar -tier: 2 +summary: the service was running as initrc_t or init_t, now it is confined by SELinux +description: |+ + SELinux interferes with ping and related programs. + +contact: Milos Malik +component: + - selinux-policy +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - expect + - openssh-clients + - iputils +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - CI-Tier-1 + - NoRHEL4 + - TIPpass + - TIPpass_Security + - TierCandidatesPASS + - failinfedora + - targeted +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1552128 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1596065 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1803759 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1810403 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1848929 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2070870 +adjust: + - enabled: false + when: distro == rhel-4 + continue: false +extra-nitrate: TC#0564077 +extra-summary: /CoreOS/selinux-policy/Regression/ping-and-similar +extra-task: /CoreOS/selinux-policy/Regression/ping-and-similar diff --git a/selinux-policy/ping-and-similar/runtest.sh b/selinux-policy/ping-and-similar/runtest.sh index e00656a..6262122 100755 --- a/selinux-policy/ping-and-similar/runtest.sh +++ b/selinux-policy/ping-and-similar/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" diff --git a/selinux-policy/policy-rpm-macros/main.fmf b/selinux-policy/policy-rpm-macros/main.fmf index 498e8f4..19fdd8e 100644 --- a/selinux-policy/policy-rpm-macros/main.fmf +++ b/selinux-policy/policy-rpm-macros/main.fmf @@ -1,2 +1,42 @@ -path: /selinux-policy/policy-rpm-macros -tier: 1 +summary: Are necessary RPM macros defined for various policy actions? +description: |+ + Are necessary RPM macros defined for various policy actions? Are they defined correctly? + + More information at: + * https://plautrba.fedorapeople.org/blok/Fedora-SELinux-module-packaging.html + * https://github.com/fedora-selinux/selinux-policy-macros/blob/master/README.adoc + +contact: Milos Malik +component: + - selinux-policy +recommend: + - git + - selinux-policy + - /usr/sbin/semanage +duration: 15m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - TIPpass_Security + - Tier1 + - Tier1se + - f32friendly + - targeted +tier: '1' +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1380854 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1415694 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1518609 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1488402 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1633198 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1631814 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1465824 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-8 + continue: false +extra-nitrate: TC#0546229 +extra-summary: /CoreOS/selinux-policy/Sanity/policy-rpm-macros +extra-task: /CoreOS/selinux-policy/Sanity/policy-rpm-macros diff --git a/selinux-policy/policy-rpm-macros/runtest.sh b/selinux-policy/policy-rpm-macros/runtest.sh index b203b16..58aa091 100755 --- a/selinux-policy/policy-rpm-macros/runtest.sh +++ b/selinux-policy/policy-rpm-macros/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" diff --git a/selinux-policy/policykit-general/main.fmf b/selinux-policy/policykit-general/main.fmf new file mode 100644 index 0000000..4b69496 --- /dev/null +++ b/selinux-policy/policykit-general/main.fmf @@ -0,0 +1,60 @@ +summary: Test for BZ#962791 (SELinux is preventing /usr/lib/polkit-1/polkitd) +description: |+ + SELinux interferes with polkitd and related programs. + +contact: Milos Malik +component: + - polkit + - selinux-policy +require: + - library(selinux-policy/common) +recommend: + - audit + - selinux-policy + - polkit + - glib2 + - libselinux + - libselinux-utils + - policycoreutils + - setools-console + - psmisc + - shadow-utils + - expect + - openssh-clients +environment: + AVC_ERROR: +no_avc_check +duration: 20m +enabled: true +tag: + - CI-Tier-1 + - NoRHEL4 + - NoRHEL5 + - TIPpass + - TIPpass_FIPS + - TIPpass_Security + - Tier2 + - Tier2se + - TipWaived7 + - f31friendly + - f32friendly + - targeted +tier: '2' +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=960669 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=962791 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=965143 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1003799 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1301561 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1364513 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1574389 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1583082 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1727902 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1951114 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1878094 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5 + continue: false +extra-nitrate: TC#0267065 +extra-summary: /CoreOS/selinux-policy/Regression/policykit-general +extra-task: /CoreOS/selinux-policy/Regression/policykit-general diff --git a/selinux-policy/policykit-general/runtest.sh b/selinux-policy/policykit-general/runtest.sh index b3b11e5..6388404 100755 --- a/selinux-policy/policykit-general/runtest.sh +++ b/selinux-policy/policykit-general/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" diff --git a/selinux-policy/rngd-and-similar/main.fmf b/selinux-policy/rngd-and-similar/main.fmf index 9c9828b..c42e941 100644 --- a/selinux-policy/rngd-and-similar/main.fmf +++ b/selinux-policy/rngd-and-similar/main.fmf @@ -1,2 +1,70 @@ -path: /selinux-policy/rngd-and-similar -tier: 2 +summary: SELinux interferes with rngd and related programs +description: |+ + SELinux interferes with rngd and related programs. + +contact: Milos Malik +component: + - selinux-policy +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - rng-tools + - initscripts +environment: + AVC_ERROR: +no_avc_check +duration: 15m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - TIPpass + - TIPpass_Security + - Tier2 + - Tier2se + - TierCandidatesPASS + - f31friendly + - f32friendly + - targeted +tier: '2' +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=869810 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=869813 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1451735 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1452629 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1496260 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1609466 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1611413 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1612456 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1653872 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1655079 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1656054 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1657250 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1658234 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1698575 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1699278 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1700222 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1787663 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1789902 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1787661 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1928572 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1929360 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1929366 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1931450 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6 + continue: false + - enabled: false + when: arch == s390x + continue: false +extra-nitrate: TC#0300433 +extra-summary: /CoreOS/selinux-policy/Regression/rngd-and-similar +extra-task: /CoreOS/selinux-policy/Regression/rngd-and-similar diff --git a/selinux-policy/rngd-and-similar/runtest.sh b/selinux-policy/rngd-and-similar/runtest.sh index 5113fdc..884cbdf 100755 --- a/selinux-policy/rngd-and-similar/runtest.sh +++ b/selinux-policy/rngd-and-similar/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" diff --git a/selinux-policy/rpmdb-and-similar/main.fmf b/selinux-policy/rpmdb-and-similar/main.fmf index 9090977..a5fb8b4 100644 --- a/selinux-policy/rpmdb-and-similar/main.fmf +++ b/selinux-policy/rpmdb-and-similar/main.fmf @@ -1,3 +1,45 @@ -path: /selinux-policy/rpmdb-and-similar -tier: 2 +summary: SELinux interferes with rpmdb program, rpmdb-rebuild service and related + programs +description: |+ + SELinux interferes with rpmdb program, rpmdb-rebuild service and related programs. +contact: Milos Malik +component: + - selinux-policy +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - initscripts + - sssd +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - targeted +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1898298 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1899548 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1900383 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1900386 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1900388 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1900390 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1900391 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 + continue: false +extra-nitrate: TC#0609732 +extra-summary: /CoreOS/selinux-policy/Regression/rpmdb-and-similar +extra-task: /CoreOS/selinux-policy/Regression/rpmdb-and-similar diff --git a/selinux-policy/rpmdb-and-similar/runtest.sh b/selinux-policy/rpmdb-and-similar/runtest.sh index af6e687..13c5442 100755 --- a/selinux-policy/rpmdb-and-similar/runtest.sh +++ b/selinux-policy/rpmdb-and-similar/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" diff --git a/selinux-policy/rrdcached-service-and-related/main.fmf b/selinux-policy/rrdcached-service-and-related/main.fmf index 9d47d7a..d46b6a1 100644 --- a/selinux-policy/rrdcached-service-and-related/main.fmf +++ b/selinux-policy/rrdcached-service-and-related/main.fmf @@ -1,2 +1,40 @@ -path: /selinux-policy/rrdcached-service-and-related -tier: 2 +summary: Basic test for rrdcached service +description: '' +contact: Milos Malik +component: + - selinux-policy +require: + - library(selinux-policy/common) +recommend: + - audit + - initscripts + - libselinux-utils + - policycoreutils + - rrdtool + - selinux-policy + - setools-console +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - CI-Tier-1 + - NoFedora30 + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - TIPpass + - TIPpass_Security + - f32friendly + - f33friendly + - targeted +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1726255 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + continue: false +extra-nitrate: TC#0604406 +extra-summary: /CoreOS/selinux-policy/Regression/rrdcached-service-and-related +extra-task: /CoreOS/selinux-policy/Regression/rrdcached-service-and-related diff --git a/selinux-policy/rrdcached-service-and-related/runtest.sh b/selinux-policy/rrdcached-service-and-related/runtest.sh index 56b1a25..d26e456 100755 --- a/selinux-policy/rrdcached-service-and-related/runtest.sh +++ b/selinux-policy/rrdcached-service-and-related/runtest.sh @@ -26,7 +26,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" diff --git a/selinux-policy/rsyslog-and-similar/main.fmf b/selinux-policy/rsyslog-and-similar/main.fmf index 5e28009..0603f76 100644 --- a/selinux-policy/rsyslog-and-similar/main.fmf +++ b/selinux-policy/rsyslog-and-similar/main.fmf @@ -1,8 +1,43 @@ -path: /selinux-policy/rsyslog-and-similar -summary: Test rsyslog service and verify AVC denials -description: | - Test coverage for rsyslog service with different configurations and - verify related SELinux AVC issues. +summary: SELinux AVCs with rsyslog in various configurations +description: |+ + SELinux interferes with rsyslogd and related programs. + +contact: Milos Malik +component: + - rsyslog + - selinux-policy +require: + - library(selinux-policy/common) +recommend: + - audit + - initscripts + - libselinux + - libselinux-utils + - logwatch + - policycoreutils + - policycoreutils-devel + - rsyslog + - rsyslog-gnutls + - selinux-policy + - selinux-policy-targeted + - setools + - setools-console + - shadow-utils + - /usr/sbin/semanage +environment: + AVC_ERROR: +no_avc_check +duration: 30m +enabled: true +tag: + - NoRHEL4 + - targeted +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1823669 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1823672 adjust: -- enabled: false - when: distro < rhel-8 + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7 + continue: false +extra-nitrate: TC#0609007 +extra-summary: /CoreOS/selinux-policy/Regression/rsyslog-and-similar +extra-task: /CoreOS/selinux-policy/Regression/rsyslog-and-similar diff --git a/selinux-policy/rsyslog-and-similar/runtest.sh b/selinux-policy/rsyslog-and-similar/runtest.sh index 24f0b0e..a3f33a9 100755 --- a/selinux-policy/rsyslog-and-similar/runtest.sh +++ b/selinux-policy/rsyslog-and-similar/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include rhts environment -. /usr/bin/rhts-environment.sh . /usr/share/beakerlib/beakerlib.sh PACKAGE="selinux-policy" diff --git a/selinux-policy/rtkit-daemon-and-similar/main.fmf b/selinux-policy/rtkit-daemon-and-similar/main.fmf index 1aec75d..1cba664 100644 --- a/selinux-policy/rtkit-daemon-and-similar/main.fmf +++ b/selinux-policy/rtkit-daemon-and-similar/main.fmf @@ -1,25 +1,59 @@ -path: /selinux-policy/rtkit-daemon-and-similar -summary: SELinux interferes with rtkit daemon and related programs -description: | - Test coverage for SELinux AVC issues against rtkit daemon and related programs. +summary: SELinux interferes with rtkit-daemon and related programs +description: |+ + SELinux interferes with rtkit daemon and related programs. + +contact: Milos Malik component: - selinux-policy -framework: beakerlib require: - library(selinux-policy/common) recommend: - audit + - initscripts + - libselinux - libselinux-utils - policycoreutils - - rtkit - selinux-policy - selinux-policy-targeted + - glib2 - setools-console - - /usr/sbin/service -duration: 15m + - rtkit +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - CI-Tier-1 + - NoRHEL4 + - NoRHEL5 + - TIP_fedora_fail + - TIPfail + - TIPpass_FIPS + - TIPpass_Security + - Tier2 + - Tier2se + - TierCandidatesPASS + - f31friendly + - f32friendly + - targeted tier: '2' +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1626982 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1703241 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1720546 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1750024 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1752583 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1754408 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1755572 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1756755 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1758097 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1760214 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1873658 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1910507 adjust: - enabled: false when: distro == rhel-4, rhel-5 continue: false - +extra-nitrate: TC#0300678 +extra-summary: /CoreOS/selinux-policy/Regression/rtkit-daemon-and-similar +extra-task: /CoreOS/selinux-policy/Regression/rtkit-daemon-and-similar diff --git a/selinux-policy/smbcontrol-and-similar/main.fmf b/selinux-policy/smbcontrol-and-similar/main.fmf index 9bf5795..9be8abc 100644 --- a/selinux-policy/smbcontrol-and-similar/main.fmf +++ b/selinux-policy/smbcontrol-and-similar/main.fmf @@ -1,2 +1,50 @@ -path: /selinux-policy/smbcontrol-and-similar -tier: 2 +summary: SELinux interferes with smbcontrol and related programs +description: |+ + SELinux interferes with smbcontrol and related programs. + +contact: Milos Malik +component: + - selinux-policy +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - samba-common + - samba-common-tools +duration: 15m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - TIPpass_Security + - Tier3 + - Tier3se + - TierCandidatesPASS + - f31friendly + - f32friendly + - targeted +tier: '3' +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1326371 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1326621 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1574518 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1574521 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2025931 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2027740 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2027751 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2033873 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2038157 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2038963 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5 + continue: false +extra-nitrate: TC#0522115 +extra-summary: /CoreOS/selinux-policy/Regression/smbcontrol-and-similar +extra-task: /CoreOS/selinux-policy/Regression/smbcontrol-and-similar diff --git a/selinux-policy/smbcontrol-and-similar/runtest.sh b/selinux-policy/smbcontrol-and-similar/runtest.sh index f6f219e..02d9bc7 100755 --- a/selinux-policy/smbcontrol-and-similar/runtest.sh +++ b/selinux-policy/smbcontrol-and-similar/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" diff --git a/selinux-policy/sslh-and-similar/main.fmf b/selinux-policy/sslh-and-similar/main.fmf index 68fc1a3..b2ebcd6 100644 --- a/selinux-policy/sslh-and-similar/main.fmf +++ b/selinux-policy/sslh-and-similar/main.fmf @@ -1,3 +1,45 @@ -path: /selinux-policy/sslh-and-similar -tier: 2 +summary: SELinux interferes with sslh and related programs +description: |+ + SELinux interferes with sslh and related programs. +contact: Milos Malik +component: + - selinux-policy +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools + - setools-console + - sslh + - initscripts +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - TIPpass_Security + - TierCandidatesPASS + - f32friendly + - f33friendly + - targeted +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1534624 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6 + continue: false + - enabled: false + when: arch == s390x + continue: false +extra-nitrate: TC#0563428 +extra-summary: /CoreOS/selinux-policy/Regression/sslh-and-similar +extra-task: /CoreOS/selinux-policy/Regression/sslh-and-similar diff --git a/selinux-policy/sslh-and-similar/runtest.sh b/selinux-policy/sslh-and-similar/runtest.sh index 7979d33..0bfdece 100755 --- a/selinux-policy/sslh-and-similar/runtest.sh +++ b/selinux-policy/sslh-and-similar/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" diff --git a/selinux-policy/swap-file-and-systemd-access/main.fmf b/selinux-policy/swap-file-and-systemd-access/main.fmf index b2d17da..266f814 100644 --- a/selinux-policy/swap-file-and-systemd-access/main.fmf +++ b/selinux-policy/swap-file-and-systemd-access/main.fmf @@ -1,2 +1,49 @@ -path: /selinux-policy/swap-file-and-systemd-access -tier: 2 +summary: SELinux interferes with systemd when accessing a swap file +description: |+ + SELinux interferes with systemd when accessing swap files or swap partitions. + +contact: Milos Malik +component: + - selinux-policy + - systemd +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux-utils + - policycoreutils + - selinux-policy + - setools-console + - systemd + - util-linux + - binutils +environment: + AVC_ERROR: +no_avc_check + REAL_SCENARIOS: 'false' +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - TIPpass + - targeted +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1367279 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1797543 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1798872 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1845594 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1850177 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1912385 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1926536 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1928539 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1968610 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1890884 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + continue: false +extra-nitrate: TC#0605834 +extra-summary: /CoreOS/selinux-policy/Regression/swap-file-and-systemd-access +extra-task: /CoreOS/selinux-policy/Regression/swap-file-and-systemd-access diff --git a/selinux-policy/swap-file-and-systemd-access/runtest.sh b/selinux-policy/swap-file-and-systemd-access/runtest.sh index 76c651a..4dc1413 100755 --- a/selinux-policy/swap-file-and-systemd-access/runtest.sh +++ b/selinux-policy/swap-file-and-systemd-access/runtest.sh @@ -26,7 +26,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" diff --git a/selinux-policy/systemd-bootchart-and-similar/main.fmf b/selinux-policy/systemd-bootchart-and-similar/main.fmf index 4b59e45..ca151c8 100644 --- a/selinux-policy/systemd-bootchart-and-similar/main.fmf +++ b/selinux-policy/systemd-bootchart-and-similar/main.fmf @@ -1,2 +1,38 @@ -path: /selinux-policy/systemd-bootchart-and-similar -tier: 2 +summary: SELinux interferes with systemd-bootchart and related programs +description: |+ + SELinux interferes with systemd-bootchart and related programs. + +contact: Milos Malik +component: + - selinux-policy +require: + - library(selinux-policy/common) +recommend: + - audit + - initscripts + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - systemd-bootchart +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - targeted +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1757050 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1838163 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-8, rhel-9 + continue: false +extra-nitrate: TC#0608092 +extra-summary: /CoreOS/selinux-policy/Regression/systemd-bootchart-and-similar +extra-task: /CoreOS/selinux-policy/Regression/systemd-bootchart-and-similar diff --git a/selinux-policy/systemd-bootchart-and-similar/runtest.sh b/selinux-policy/systemd-bootchart-and-similar/runtest.sh index 8577ea3..c8bbacd 100755 --- a/selinux-policy/systemd-bootchart-and-similar/runtest.sh +++ b/selinux-policy/systemd-bootchart-and-similar/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" diff --git a/selinux-policy/systemd-homed/main.fmf b/selinux-policy/systemd-homed/main.fmf index 2858935..d74f466 100644 --- a/selinux-policy/systemd-homed/main.fmf +++ b/selinux-policy/systemd-homed/main.fmf @@ -1,10 +1,24 @@ -path: /selinux-policy/systemd-homed -summary: Test homectl utility and its sub-commands to verify AVC denials -description: | - Test coverage for SELinux AVC issues associated with systemd-homed - service. The homectl program calls the systemd-homed service, which - is not yet confined, but it triggers SELinux denials. This test suite - covers command homectl with its subcommands and checks for avc denials. -adjust: -- enabled: false - when: distro < rhel-9 +summary: Tests for systemd-homed service +contact: Amith Kumar +component: + - selinux-policy +require: + - library(selinux-policy/common) +recommend: + - audit + - expect + - initscripts + - systemd + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console +environment: + AVC_ERROR: +no_avc_check +duration: 1h +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1809878 +extra-summary: /CoreOS/selinux-policy/Regression/systemd-homed +extra-task: /CoreOS/selinux-policy/Regression/systemd-homed diff --git a/selinux-policy/systemd-homed/runtest.sh b/selinux-policy/systemd-homed/runtest.sh index 3357cae..6a5d196 100755 --- a/selinux-policy/systemd-homed/runtest.sh +++ b/selinux-policy/systemd-homed/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE1="selinux-policy" diff --git a/selinux-policy/systemd-modules-load-and-similar/main.fmf b/selinux-policy/systemd-modules-load-and-similar/main.fmf index 4fdb6c5..0adedeb 100644 --- a/selinux-policy/systemd-modules-load-and-similar/main.fmf +++ b/selinux-policy/systemd-modules-load-and-similar/main.fmf @@ -1,2 +1,60 @@ -path: /selinux-policy/systemd-modules-load-and-similar -tier: 2 +summary: SELinux interferes with the systemd-modules-load service and related programs +description: |+ + SELinux interferes with the systemd-modules-load service and related programs. + +contact: Milos Malik +component: + - selinux-policy +require: + - library(selinux-policy/common) +recommend: + - audit + - initscripts + - libselinux + - libselinux-utils + - policycoreutils + - rdma-core + - selinux-policy + - selinux-policy-targeted + - setools-console + - openssh-clients + - systemd-udev +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - f33friendly + - targeted +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1358526 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1358960 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1360157 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1360488 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1437153 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1438253 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1490015 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1493293 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1697632 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1698200 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1699559 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1819161 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1823246 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1824196 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1829700 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1833502 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1838933 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1942267 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1972372 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1850953 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7 + continue: false +extra-nitrate: TC#0607299 +extra-summary: /CoreOS/selinux-policy/Regression/systemd-modules-load-and-similar +extra-task: /CoreOS/selinux-policy/Regression/systemd-modules-load-and-similar diff --git a/selinux-policy/systemd-modules-load-and-similar/runtest.sh b/selinux-policy/systemd-modules-load-and-similar/runtest.sh index d62bd6f..b7bc865 100755 --- a/selinux-policy/systemd-modules-load-and-similar/runtest.sh +++ b/selinux-policy/systemd-modules-load-and-similar/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" diff --git a/selinux-policy/systemd-rfkill-and-similar/main.fmf b/selinux-policy/systemd-rfkill-and-similar/main.fmf index ecc2671..8fb5e1e 100644 --- a/selinux-policy/systemd-rfkill-and-similar/main.fmf +++ b/selinux-policy/systemd-rfkill-and-similar/main.fmf @@ -1,5 +1,54 @@ -path: /selinux-policy/systemd-rfkill-and-similar -tier: 2 +summary: SELinux interferes with systemd-rfkill and related programs +description: |+ + SELinux interferes with systemd-rfkill service and related programs. + +contact: Milos Malik +component: + - selinux-policy + - systemd +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - systemd-udev + - initscripts + - procps-ng + - kernel-modules +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - TIPpass + - Tier2 + - Tier2se + - f32friendly + - f33friendly + - targeted +tier: '2' +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1290255 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1309839 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1319499 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1388669 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1543650 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1554838 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1557595 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1638981 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1661724 adjust: -- enabled: false - when: distro ~>= fedora-32 + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7 + continue: false +extra-nitrate: TC#0606118 +extra-summary: /CoreOS/selinux-policy/Regression/systemd-rfkill-and-similar +extra-task: /CoreOS/selinux-policy/Regression/systemd-rfkill-and-similar diff --git a/selinux-policy/systemd-rfkill-and-similar/runtest.sh b/selinux-policy/systemd-rfkill-and-similar/runtest.sh index 2d027fb..73addd0 100755 --- a/selinux-policy/systemd-rfkill-and-similar/runtest.sh +++ b/selinux-policy/systemd-rfkill-and-similar/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" diff --git a/selinux-policy/systemd-sysctl-and-similar/main.fmf b/selinux-policy/systemd-sysctl-and-similar/main.fmf index 88d805d..1f04ab9 100644 --- a/selinux-policy/systemd-sysctl-and-similar/main.fmf +++ b/selinux-policy/systemd-sysctl-and-similar/main.fmf @@ -1,2 +1,38 @@ -path: /selinux-policy/systemd-sysctl-and-similar -tier: 2 +summary: Does the systemd-sysctl work correctly under SELinux confinement? +description: |+ + Does the systemd-sysctl work correctly under SELinux confinement? + +contact: Milos Malik +component: + - selinux-policy + - systemd +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux-utils + - policycoreutils + - selinux-policy + - setools-console + - systemd + - /usr/sbin/service +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - targeted +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2056207 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2056999 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + continue: false +extra-nitrate: TC#0613033 +extra-summary: /CoreOS/selinux-policy/Regression/systemd-sysctl-and-similar +extra-task: /CoreOS/selinux-policy/Regression/systemd-sysctl-and-similar diff --git a/selinux-policy/systemd-sysctl-and-similar/runtest.sh b/selinux-policy/systemd-sysctl-and-similar/runtest.sh index 51ec449..d7f0d06 100755 --- a/selinux-policy/systemd-sysctl-and-similar/runtest.sh +++ b/selinux-policy/systemd-sysctl-and-similar/runtest.sh @@ -26,7 +26,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" diff --git a/selinux-policy/systemd-timesyncd-and-similar/main.fmf b/selinux-policy/systemd-timesyncd-and-similar/main.fmf index 16bf981..4c90d39 100644 --- a/selinux-policy/systemd-timesyncd-and-similar/main.fmf +++ b/selinux-policy/systemd-timesyncd-and-similar/main.fmf @@ -1,2 +1,58 @@ -path: /selinux-policy/systemd-timesyncd-and-similar -tier: 2 +summary: SELinux interferes with systemd-timesyncd and related programs +description: |+ + SELinux interferes with systemd-timesyncd and related programs. + +contact: Milos Malik +component: + - selinux-policy + - systemd +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - systemd-udev + - initscripts + - systemd-timesyncd +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - TIPpass + - TIPpass_Security + - Tier2 + - Tier2se + - epel + - rhel8-epel + - rhel9-epel + - targeted +tier: '2' +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1640801 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1649257 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1649668 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1649671 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1653050 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1666222 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1694272 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1822131 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1869979 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1949315 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1970865 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7 + continue: false +extra-nitrate: TC#0606395 +extra-summary: /CoreOS/selinux-policy/Regression/systemd-timesyncd-and-similar +extra-task: /CoreOS/selinux-policy/Regression/systemd-timesyncd-and-similar diff --git a/selinux-policy/systemd-timesyncd-and-similar/runtest.sh b/selinux-policy/systemd-timesyncd-and-similar/runtest.sh index fab5ec7..886546a 100755 --- a/selinux-policy/systemd-timesyncd-and-similar/runtest.sh +++ b/selinux-policy/systemd-timesyncd-and-similar/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" diff --git a/selinux-policy/systemd-userdbd-and-similar/main.fmf b/selinux-policy/systemd-userdbd-and-similar/main.fmf index 40c698a..7c41ff7 100644 --- a/selinux-policy/systemd-userdbd-and-similar/main.fmf +++ b/selinux-policy/systemd-userdbd-and-similar/main.fmf @@ -1,5 +1,47 @@ -path: /selinux-policy/systemd-userdbd-and-similar -tier: 2 +summary: SELinux interferes with systemd-userdbd and related programs +description: |+ + SELinux interferes with systemd-userdbd and related programs. + +contact: Milos Malik +component: + - selinux-policy + - systemd +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - expect + - openssh-clients + - systemd + - initscripts + - shadow-utils +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - NoRHEL8 + - failinfedora + - targeted +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1835630 adjust: -- enabled: false - when: distro <= rhel-8 + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7, rhel-8, rhel-9 + continue: false + - enabled: false + when: distro == fedora-30, fedora-31 + continue: false +extra-nitrate: TC#0606124 +extra-summary: /CoreOS/selinux-policy/Regression/systemd-userdbd-and-similar +extra-task: /CoreOS/selinux-policy/Regression/systemd-userdbd-and-similar diff --git a/selinux-policy/systemd-userdbd-and-similar/runtest.sh b/selinux-policy/systemd-userdbd-and-similar/runtest.sh index 8a439ea..38bf5c6 100755 --- a/selinux-policy/systemd-userdbd-and-similar/runtest.sh +++ b/selinux-policy/systemd-userdbd-and-similar/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" diff --git a/selinux-policy/tlp-and-similar/main.fmf b/selinux-policy/tlp-and-similar/main.fmf index 3e91f57..cb335dd 100644 --- a/selinux-policy/tlp-and-similar/main.fmf +++ b/selinux-policy/tlp-and-similar/main.fmf @@ -1,8 +1,44 @@ -path: /selinux-policy/tlp-and-similar -summary: SELinux interferes with tlp and related programs -description: | - Test coverage for SELinux AVC issues against tlp and related - programs. +summary: the service was running as initrc_t or init_t, now it is confined by SELinux +description: |+ + SELinux interferes with tlp and related programs. + +contact: Milos Malik +component: + - selinux-policy +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - expect + - openssh-clients + - tlp + - rfkill +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - TIPpass_Security + - TierCandidatesFAIL + - f33friendly + - targeted +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1460481 adjust: -- enabled: false - when: distro < rhel-7 + - enabled: false + when: arch == s390x + continue: false + - enabled: false + when: distro == rhel-4, rhel-5, rhel-9 + continue: false +extra-nitrate: TC#0569976 +extra-summary: /CoreOS/selinux-policy/Regression/tlp-and-similar +extra-task: /CoreOS/selinux-policy/Regression/tlp-and-similar diff --git a/selinux-policy/tlp-and-similar/runtest.sh b/selinux-policy/tlp-and-similar/runtest.sh index 6e11025..84e6f4f 100755 --- a/selinux-policy/tlp-and-similar/runtest.sh +++ b/selinux-policy/tlp-and-similar/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" diff --git a/selinux-policy/usbguard-daemon-and-similar/main.fmf b/selinux-policy/usbguard-daemon-and-similar/main.fmf index 1b207f2..05ea354 100644 --- a/selinux-policy/usbguard-daemon-and-similar/main.fmf +++ b/selinux-policy/usbguard-daemon-and-similar/main.fmf @@ -1,5 +1,47 @@ -path: /selinux-policy/usbguard-daemon-and-similar -tier: 2 +summary: SELinux interferes with usbguard and related programs +description: |+ + SELinux interferes with usbguard and related programs. + +contact: Milos Malik +component: + - usbguard + - selinux-policy +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - initscripts + - usbguard + - usbguard-selinux +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - TIPpass + - f33friendly + - fedora-wanted + - targeted +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1808527 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1840265 adjust: -- enabled: false - when: distro < rhel-7 + - enabled: false + when: arch == s390x + continue: false + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7 + continue: false +extra-nitrate: TC#0606079 +extra-summary: /CoreOS/selinux-policy/Regression/usbguard-daemon-and-similar +extra-task: /CoreOS/selinux-policy/Regression/usbguard-daemon-and-similar diff --git a/selinux-policy/usbguard-daemon-and-similar/runtest.sh b/selinux-policy/usbguard-daemon-and-similar/runtest.sh index ea2c953..a23c68f 100755 --- a/selinux-policy/usbguard-daemon-and-similar/runtest.sh +++ b/selinux-policy/usbguard-daemon-and-similar/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" diff --git a/selinux-policy/usbmuxd-and-similar/main.fmf b/selinux-policy/usbmuxd-and-similar/main.fmf index 9c8cf66..ef0e7e3 100644 --- a/selinux-policy/usbmuxd-and-similar/main.fmf +++ b/selinux-policy/usbmuxd-and-similar/main.fmf @@ -1,2 +1,53 @@ -path: /selinux-policy/usbmuxd-and-similar -tier: 2 +summary: SELinux interferes with usbmuxd and related programs +description: |+ + SELinux interferes with usbmuxd and related programs. + +contact: Milos Malik +component: + - selinux-policy +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - usbmuxd + - initscripts +environment: + AVC_ERROR: +no_avc_check +duration: 15m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - TIPpass_Security + - Tier3 + - Tier3se + - TipWaived7 + - f31friendly + - f32friendly + - targeted +tier: '3' +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1521054 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1582205 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1930992 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1936705 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1959747 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1965411 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1973886 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6 + continue: false + - enabled: false + when: arch == aarch64, s390x + continue: false +extra-nitrate: TC#0300434 +extra-summary: /CoreOS/selinux-policy/Regression/usbmuxd-and-similar +extra-task: /CoreOS/selinux-policy/Regression/usbmuxd-and-similar diff --git a/selinux-policy/usbmuxd-and-similar/runtest.sh b/selinux-policy/usbmuxd-and-similar/runtest.sh index c3c4c24..f96d253 100755 --- a/selinux-policy/usbmuxd-and-similar/runtest.sh +++ b/selinux-policy/usbmuxd-and-similar/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" From 9d5fef01796ca634c1291c8342ec2534b73c8b32 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Mon, 25 Apr 2022 09:10:46 +0200 Subject: [PATCH 132/626] convert metadata of all libsepol tests to TMT/FMF --- .../main.fmf | 28 +++++++++++++++-- .../runtest.sh | 1 - libsepol/sepol_check_context/main.fmf | 30 +++++++++++++++++-- libsepol/sepol_check_context/runtest.sh | 1 - 4 files changed, 54 insertions(+), 6 deletions(-) mode change 100644 => 100755 libsepol/sepol_check_context/runtest.sh diff --git a/libsepol/Sanity/bz1838257-rpm-scripts-use-deprecated-telinit/main.fmf b/libsepol/Sanity/bz1838257-rpm-scripts-use-deprecated-telinit/main.fmf index d79a34a..0687010 100644 --- a/libsepol/Sanity/bz1838257-rpm-scripts-use-deprecated-telinit/main.fmf +++ b/libsepol/Sanity/bz1838257-rpm-scripts-use-deprecated-telinit/main.fmf @@ -1,2 +1,26 @@ -path: /libsepol/Sanity/bz1838257-rpm-scripts-use-deprecated-telinit -tier: 1 +summary: The rpm scripts from libsepol uses out of date commands like telinit +description: | + Description: libsepol rpm scripts use deprecated telinit command + + Author: Amith Kumar + + Bugzilla links: + https://bugzilla.redhat.com/show_bug.cgi?id=1838257 + + Description of problem: + The rpm scripts from the rpm is using out of date commands like telinit. +contact: Amith Kumar +component: + - libsepol +recommend: + - libsepol + - libsepol-devel + - libselinux + - libselinux-devel + - libsemanage + - libsemanage-devel + - pkgconfig +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1838257 +extra-summary: /CoreOS/libsepol/Sanity/bz1838257-rpm-scripts-use-deprecated-telinit +extra-task: /CoreOS/libsepol/Sanity/bz1838257-rpm-scripts-use-deprecated-telinit diff --git a/libsepol/Sanity/bz1838257-rpm-scripts-use-deprecated-telinit/runtest.sh b/libsepol/Sanity/bz1838257-rpm-scripts-use-deprecated-telinit/runtest.sh index 18dbf39..adf27a2 100755 --- a/libsepol/Sanity/bz1838257-rpm-scripts-use-deprecated-telinit/runtest.sh +++ b/libsepol/Sanity/bz1838257-rpm-scripts-use-deprecated-telinit/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include rhts environment -. /usr/bin/rhts-environment.sh . /usr/share/beakerlib/beakerlib.sh PACKAGE=libsepol diff --git a/libsepol/sepol_check_context/main.fmf b/libsepol/sepol_check_context/main.fmf index 3410cea..9b3fd10 100644 --- a/libsepol/sepol_check_context/main.fmf +++ b/libsepol/sepol_check_context/main.fmf @@ -1,2 +1,28 @@ -path: /libsepol/sepol_check_context -tier: 1 +summary: Does sepol_check_context() work as expected? +description: |+ + Does sepol_check_context() work as expected? + +contact: Milos Malik +component: + - libsepol +recommend: + - libsepol + - libsepol-devel + - gcc + - policycoreutils + - selinux-policy-devel +enabled: true +tag: + - CI-Tier-1 + - NoRHEL4 + - NoRHEL5 + - f32friendly + - f33friendly + - targeted +adjust: + - enabled: false + when: distro == rhel-4, rhel-5 + continue: false +extra-nitrate: TC#0554157 +extra-summary: /CoreOS/libsepol/Sanity/sepol_check_context +extra-task: /CoreOS/libsepol/Sanity/sepol_check_context diff --git a/libsepol/sepol_check_context/runtest.sh b/libsepol/sepol_check_context/runtest.sh old mode 100644 new mode 100755 index 6742dd9..66519cd --- a/libsepol/sepol_check_context/runtest.sh +++ b/libsepol/sepol_check_context/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="libsepol" From c6b49a41eff1ce86ede122cc099f4dcfe8977ed4 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Mon, 25 Apr 2022 09:12:55 +0200 Subject: [PATCH 133/626] convert metadata of all libsemanage tests to TMT/FMF --- libsemanage/sanity-tests/main.fmf | 48 ++++++++++++++++++- libsemanage/sanity-tests/runtest.sh | 1 - .../usepasswd-in-semanage-conf/main.fmf | 35 ++++++++++++-- .../verify-options-in-semanage-conf/main.fmf | 37 ++++++++++++-- .../runtest.sh | 1 - 5 files changed, 110 insertions(+), 12 deletions(-) diff --git a/libsemanage/sanity-tests/main.fmf b/libsemanage/sanity-tests/main.fmf index 9c7a7e1..1dc5b00 100644 --- a/libsemanage/sanity-tests/main.fmf +++ b/libsemanage/sanity-tests/main.fmf @@ -1 +1,47 @@ -path: /libsemanage/sanity-tests +summary: Test libsemanage functions +description: '' +contact: Milos Malik +component: + - libsemanage +recommend: + - libsemanage + - libsemanage-devel + - gcc + - CUnit + - CUnit-devel + - checkpolicy + - policycoreutils-python-utils +duration: 60m +enabled: true +tag: + - CI-Tier-1 + - NoRHEL4 + - NoRHEL5 + - TIPfail_Security + - Tier1 + - Tier1se + - f31friendly + - f32friendly + - notip + - rhel8-buildroot + - rhel8-crb + - rhel9-buildroot + - targeted +tier: '1' +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1642305 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1781097 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1636973 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5 + continue: false + - enabled: false + when: distro == rhel-7 and arch == s390x + continue: false + - enabled: false + when: distro == rhel-alt-7 and arch == s390x + continue: false +extra-nitrate: TC#0547810 +extra-summary: /CoreOS/libsemanage/Sanity/sanity-tests +extra-task: /CoreOS/libsemanage/Sanity/sanity-tests diff --git a/libsemanage/sanity-tests/runtest.sh b/libsemanage/sanity-tests/runtest.sh index 0b1785b..ba1931e 100755 --- a/libsemanage/sanity-tests/runtest.sh +++ b/libsemanage/sanity-tests/runtest.sh @@ -26,7 +26,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="libsemanage" diff --git a/libsemanage/usepasswd-in-semanage-conf/main.fmf b/libsemanage/usepasswd-in-semanage-conf/main.fmf index 7cd455b..3a32954 100644 --- a/libsemanage/usepasswd-in-semanage-conf/main.fmf +++ b/libsemanage/usepasswd-in-semanage-conf/main.fmf @@ -1,6 +1,33 @@ -path: /libsemanage/usepasswd-in-semanage-conf summary: Make sure usepasswd option in semanage.conf works properly -tier: 2 +description: |+ + Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=1871786 + + Make sure usepasswd option in semanage.conf works properly + +contact: Milos Malik +component: + - libsemanage +recommend: + - libselinux + - libselinux-utils + - libsemanage + - policycoreutils + - policycoreutils-python-utils + - selinux-policy + - selinux-policy-devel + - shadow-utils +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - targeted +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1871786 adjust: -- enabled: false - when: distro < rhel-7 + - enabled: false + when: distro == rhel-4, rhel-5 + continue: false +extra-nitrate: TC#0609005 +extra-summary: /CoreOS/libsemanage/Sanity/usepasswd-in-semanage-conf +extra-task: /CoreOS/libsemanage/Sanity/usepasswd-in-semanage-conf diff --git a/libsemanage/verify-options-in-semanage-conf/main.fmf b/libsemanage/verify-options-in-semanage-conf/main.fmf index 9444a6c..5f2c7e8 100644 --- a/libsemanage/verify-options-in-semanage-conf/main.fmf +++ b/libsemanage/verify-options-in-semanage-conf/main.fmf @@ -1,12 +1,39 @@ -path: /libsemanage/verify-options-in-semanage-conf summary: Are the verify options in semanage.conf honored? -description: | +description: |+ Are the verify options in semanage.conf honored? Tested options: verify kernel, verify module, verify linked Tested tools: semodule, semanage Positive and negative cases are tested. Original information found at http://selinuxproject.org/page/PolicyValidate -tier: 1 + +contact: Milos Malik +component: + - libsemanage +recommend: + - libselinux + - libselinux-utils + - libsemanage + - policycoreutils + - policycoreutils-python + - selinux-policy + - selinux-policy-devel +duration: 10m +enabled: true +tag: + - CI-Tier-1 + - NoRHEL4 + - NoRHEL5 + - TIPpass_Security + - TierCandidatesFAIL + - f32friendly + - f33friendly + - targeted +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1400705 adjust: -- enabled: false - when: distro < rhel-6 + - enabled: false + when: distro == rhel-4, rhel-5 + continue: false +extra-nitrate: TC#0540246 +extra-summary: /CoreOS/libsemanage/Sanity/verify-options-in-semanage-conf +extra-task: /CoreOS/libsemanage/Sanity/verify-options-in-semanage-conf diff --git a/libsemanage/verify-options-in-semanage-conf/runtest.sh b/libsemanage/verify-options-in-semanage-conf/runtest.sh index c7891f3..d17ed44 100755 --- a/libsemanage/verify-options-in-semanage-conf/runtest.sh +++ b/libsemanage/verify-options-in-semanage-conf/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="libsemanage" From 814a670ca5c3747168b448f613c803db57614b54 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Mon, 25 Apr 2022 09:17:54 +0200 Subject: [PATCH 134/626] convert metadata of all libselinux tests to TMT/FMF --- libselinux/container-selinux_crond/main.fmf | 21 ++++++++- libselinux/container-selinux_crond/runtest.sh | 1 - libselinux/get_default_context/main.fmf | 37 +++++++++++++++- libselinux/get_default_context/runtest.sh | 1 - libselinux/getsebool/main.fmf | 28 +++++++++++- libselinux/python-bindings/main.fmf | 16 ++++--- libselinux/python-bindings/runtest.sh | 1 - .../realpath_not_final-function/main.fmf | 30 ++++++++++++- libselinux/selabel-functions/main.fmf | 29 +++++++++++- libselinux/selabel-functions/runtest.sh | 1 - .../selinux_boolean_sub-function/main.fmf | 28 +++++++++++- .../selinux_restorecon-functions/main.fmf | 27 +++++++++++- .../selinux_restorecon-functions/runtest.sh | 1 - .../selinux_sestatus-functions/main.fmf | 31 ++++++++++++- libselinux/setenforce/main.fmf | 30 ++++++++++++- libselinux/validatetrans/main.fmf | 44 +++++++++++++++++-- libselinux/validatetrans/runtest.sh | 1 - 17 files changed, 299 insertions(+), 28 deletions(-) diff --git a/libselinux/container-selinux_crond/main.fmf b/libselinux/container-selinux_crond/main.fmf index 40f9694..91f9a61 100644 --- a/libselinux/container-selinux_crond/main.fmf +++ b/libselinux/container-selinux_crond/main.fmf @@ -1,2 +1,19 @@ -path: /libselinux/container-selinux_crond -tier: 2 +summary: Does installing container-selinux break crond? +description: | + Does installing container-selinux break crond? + See https://bugzilla.redhat.com/show_bug.cgi?id=1862823 + and https://bugzilla.redhat.com/show_bug.cgi?id=1879368 +contact: Vit Mojzis +component: + - libselinux +recommend: + - cronie + - container-selinux + - libselinux-utils + - policycoreutils +duration: 10m +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1862823 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1879368 +extra-summary: /CoreOS/libselinux/Regression/container-selinux_crond +extra-task: /CoreOS/libselinux/Regression/container-selinux_crond diff --git a/libselinux/container-selinux_crond/runtest.sh b/libselinux/container-selinux_crond/runtest.sh index 071537e..74dde71 100755 --- a/libselinux/container-selinux_crond/runtest.sh +++ b/libselinux/container-selinux_crond/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="libselinux" diff --git a/libselinux/get_default_context/main.fmf b/libselinux/get_default_context/main.fmf index 229106f..d79b364 100644 --- a/libselinux/get_default_context/main.fmf +++ b/libselinux/get_default_context/main.fmf @@ -1,2 +1,35 @@ -path: /libselinux/get_default_context -tier: 1 +summary: Does get_default_context_with_rolelevel work as expected? +description: | + Perform lookup of a default context for system_u:system_r:crond_t. This should + return context derived from "system_r:system_cronjob_t", but fails, + because of a kernel bug, when libselinux uses security_compute_user + (deprecated). + See https://bugzilla.redhat.com/show_bug.cgi?id=1879368 +contact: Milos Malik +component: + - libselinux +recommend: + - python3 + - python3-libselinux + - libselinux + - libselinux-utils +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - targeted +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1879368 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1884282 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + continue: false +extra-nitrate: TC#0608317 +extra-summary: /CoreOS/libselinux/Regression/get_default_context +extra-task: /CoreOS/libselinux/Regression/get_default_context diff --git a/libselinux/get_default_context/runtest.sh b/libselinux/get_default_context/runtest.sh index 14c57fe..83aae88 100755 --- a/libselinux/get_default_context/runtest.sh +++ b/libselinux/get_default_context/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="libselinux" diff --git a/libselinux/getsebool/main.fmf b/libselinux/getsebool/main.fmf index 9227c9b..3f36893 100644 --- a/libselinux/getsebool/main.fmf +++ b/libselinux/getsebool/main.fmf @@ -1,2 +1,26 @@ -path: /libselinux/getsebool -tier: 1 +summary: Does getsebool work as expected? +description: |+ + Does getsebool work as expected? + +contact: Milos Malik +component: + - libselinux +recommend: + - libselinux +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - TIPpass_Security + - f32friendly + - f33friendly + - targeted +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1402140 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5 + continue: false +extra-nitrate: TC#0549303 +extra-summary: /CoreOS/libselinux/Sanity/getsebool +extra-task: /CoreOS/libselinux/Sanity/getsebool diff --git a/libselinux/python-bindings/main.fmf b/libselinux/python-bindings/main.fmf index 03cdc91..934d008 100644 --- a/libselinux/python-bindings/main.fmf +++ b/libselinux/python-bindings/main.fmf @@ -1,8 +1,10 @@ -path: /libselinux/python-bindings summary: Import selinux python module, check its metadata -description: | - The test compares rpm version with python module metadata version and - tries to use selinux python module in a simple operation -adjust: -- enabled: false - when: distro < rhel-8 +description: '' +contact: Petr Lautrbach +component: + - libselinux +recommend: + - python3-libselinux + - python3-pip +extra-summary: /CoreOS/libselinux/Sanity/python-bindings +extra-task: /CoreOS/libselinux/Sanity/python-bindings diff --git a/libselinux/python-bindings/runtest.sh b/libselinux/python-bindings/runtest.sh index dceb975..fcf2890 100755 --- a/libselinux/python-bindings/runtest.sh +++ b/libselinux/python-bindings/runtest.sh @@ -26,7 +26,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="python3-libselinux" diff --git a/libselinux/realpath_not_final-function/main.fmf b/libselinux/realpath_not_final-function/main.fmf index 52d16d0..8ea7d0b 100644 --- a/libselinux/realpath_not_final-function/main.fmf +++ b/libselinux/realpath_not_final-function/main.fmf @@ -1 +1,29 @@ -path: /libselinux/realpath_not_final-function +summary: Test realpath_not_final function +description: '' +contact: Milos Malik +component: + - libselinux +recommend: + - libselinux + - libselinux-devel + - glibc + - gcc +enabled: true +tag: + - CI-Tier-1 + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - TIPpass_Security + - TierCandidatesPASS + - f32friendly + - f33friendly +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1404644 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6 + continue: false +extra-nitrate: TC#0544859 +extra-summary: /CoreOS/libselinux/Sanity/realpath_not_final-function +extra-task: /CoreOS/libselinux/Sanity/realpath_not_final-function diff --git a/libselinux/selabel-functions/main.fmf b/libselinux/selabel-functions/main.fmf index 222b1c8..f079f81 100644 --- a/libselinux/selabel-functions/main.fmf +++ b/libselinux/selabel-functions/main.fmf @@ -1 +1,28 @@ -path: /libselinux/selabel-functions +summary: Test selabel functions +description: '' +contact: Milos Malik +component: + - libselinux +recommend: + - libselinux + - libselinux-devel + - glibc + - gcc +enabled: true +tag: + - CI-Tier-1 + - NoRHEL4 + - NoRHEL5 + - TIPpass_Security + - TierCandidatesPASS + - f33friendly + - targeted +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1390909 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5 + continue: false +extra-nitrate: TC#0536014 +extra-summary: /CoreOS/libselinux/Sanity/selabel-functions +extra-task: /CoreOS/libselinux/Sanity/selabel-functions diff --git a/libselinux/selabel-functions/runtest.sh b/libselinux/selabel-functions/runtest.sh index 64d593f..6a9c404 100755 --- a/libselinux/selabel-functions/runtest.sh +++ b/libselinux/selabel-functions/runtest.sh @@ -26,7 +26,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="libselinux" diff --git a/libselinux/selinux_boolean_sub-function/main.fmf b/libselinux/selinux_boolean_sub-function/main.fmf index efc0f9f..8acf7c6 100644 --- a/libselinux/selinux_boolean_sub-function/main.fmf +++ b/libselinux/selinux_boolean_sub-function/main.fmf @@ -1 +1,27 @@ -path: /libselinux/selinux_boolean_sub-function +summary: Test selinux_boolean_sub function +description: '' +contact: Milos Malik +component: + - libselinux +recommend: + - libselinux + - libselinux-devel + - glibc + - gcc +enabled: true +tag: + - CI-Tier-1 + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - TIPpass_Security + - TierCandidatesPASS + - f32friendly + - f33friendly +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6 + continue: false +extra-nitrate: TC#0544857 +extra-summary: /CoreOS/libselinux/Sanity/selinux_boolean_sub-function +extra-task: /CoreOS/libselinux/Sanity/selinux_boolean_sub-function diff --git a/libselinux/selinux_restorecon-functions/main.fmf b/libselinux/selinux_restorecon-functions/main.fmf index 29aaadf..e3dd75c 100644 --- a/libselinux/selinux_restorecon-functions/main.fmf +++ b/libselinux/selinux_restorecon-functions/main.fmf @@ -1 +1,26 @@ -path: /libselinux/selinux_restorecon-functions +summary: Test functions in selinux_restorecon.c +description: '' +contact: Milos Malik +component: + - libselinux +recommend: + - libselinux + - libselinux-devel + - glibc + - strace +enabled: true +tag: + - CI-Tier-1 + - NoRHEL4 + - NoRHEL5 + - TIPpass_Security + - TierCandidatesPASS + - failinfedora + - targeted +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6 + continue: false +extra-nitrate: TC#0535421 +extra-summary: /CoreOS/libselinux/Sanity/selinux_restorecon-functions +extra-task: /CoreOS/libselinux/Sanity/selinux_restorecon-functions diff --git a/libselinux/selinux_restorecon-functions/runtest.sh b/libselinux/selinux_restorecon-functions/runtest.sh index 2f1b7bd..d5d37ad 100755 --- a/libselinux/selinux_restorecon-functions/runtest.sh +++ b/libselinux/selinux_restorecon-functions/runtest.sh @@ -26,7 +26,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="libselinux" diff --git a/libselinux/selinux_sestatus-functions/main.fmf b/libselinux/selinux_sestatus-functions/main.fmf index 53e4ba1..18c1a60 100644 --- a/libselinux/selinux_sestatus-functions/main.fmf +++ b/libselinux/selinux_sestatus-functions/main.fmf @@ -1 +1,30 @@ -path: /libselinux/selinux_sestatus-functions +summary: Test sestatus.c functions +description: '' +contact: Milos Malik +component: + - libselinux +recommend: + - libselinux + - libselinux-devel + - glibc +enabled: true +tag: + - CI-Tier-1 + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - TIPpass_Security + - Tier1 + - Tier1se + - TierCandidatesPASS + - f32friendly + - f33friendly + - targeted +tier: '1' +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6 + continue: false +extra-nitrate: TC#0535409 +extra-summary: /CoreOS/libselinux/Sanity/selinux_sestatus-functions +extra-task: /CoreOS/libselinux/Sanity/selinux_sestatus-functions diff --git a/libselinux/setenforce/main.fmf b/libselinux/setenforce/main.fmf index 11ebcd7..195774e 100644 --- a/libselinux/setenforce/main.fmf +++ b/libselinux/setenforce/main.fmf @@ -1 +1,29 @@ -path: /libselinux/setenforce +summary: Does setenforce work as expected? Does it produce correct audit messages? +description: |+ + Does setenforce work as expected? Does it produce correct audit messages? + +contact: Milos Malik +component: + - libselinux +recommend: + - audit + - libselinux + - libselinux-utils + - e2fsprogs +enabled: true +tag: + - CI-Tier-1 + - NoRHEL4 + - NoRHEL5 + - TIPpass_Security + - TierCandidatesPASS + - f32friendly + - f33friendly + - targeted +adjust: + - enabled: false + when: distro == rhel-4, rhel-5 + continue: false +extra-nitrate: TC#0543754 +extra-summary: /CoreOS/libselinux/Sanity/setenforce +extra-task: /CoreOS/libselinux/Sanity/setenforce diff --git a/libselinux/validatetrans/main.fmf b/libselinux/validatetrans/main.fmf index a23f02f..624cfec 100644 --- a/libselinux/validatetrans/main.fmf +++ b/libselinux/validatetrans/main.fmf @@ -1,4 +1,42 @@ -path: /libselinux/validatetrans +summary: Does the validatetrans tool work as expected? +description: |+ + Does the validatetrans tool work as expected? + +contact: Milos Malik +component: + - libselinux +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - Tier1 + - f33friendly + - targeted +tier: '1' +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2008965 adjust: -- enabled: false - when: distro < fedora-32 + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 + continue: false + - enabled: false + when: distro < Fedora-32 + continue: false +extra-nitrate: TC#0606254 +extra-summary: /CoreOS/libselinux/Sanity/validatetrans +extra-task: /CoreOS/libselinux/Sanity/validatetrans diff --git a/libselinux/validatetrans/runtest.sh b/libselinux/validatetrans/runtest.sh index 2b201df..d84991e 100755 --- a/libselinux/validatetrans/runtest.sh +++ b/libselinux/validatetrans/runtest.sh @@ -27,7 +27,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="libselinux" From 7c76f01ca2df0715ed82b3184a5bf0252867b8e4 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Mon, 25 Apr 2022 09:21:26 +0200 Subject: [PATCH 135/626] convert metadata of other tests to TMT/FMF --- other/mounting/main.fmf | 32 ++++++++++++++++++++++++-------- other/mounting/runtest.sh | 1 - 2 files changed, 24 insertions(+), 9 deletions(-) diff --git a/other/mounting/main.fmf b/other/mounting/main.fmf index bf52899..a521085 100644 --- a/other/mounting/main.fmf +++ b/other/mounting/main.fmf @@ -1,9 +1,25 @@ -path: /other/mounting -summary: Mount various filesystems, test context options -description: | - Test the context and defcontext options of the mount command. Test - different filesystems: ext2, ext3, ext4. XFS, FAT32. Requires - e2fsprogs and dosfstools. +summary: Mount various filesystems, test context options. +description: '' +contact: Milos Malik +component: + - selinux-policy +recommend: + - selinux-policy + - util-linux + - e2fsprogs + - dosfstools +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - TIPfail_Security + - failinfedora + - targeted adjust: -- enabled: false - when: distro < rhel-7 + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6 + continue: false +extra-nitrate: TC#0571362 +extra-summary: /CoreOS/selinux-policy/Sanity/mounting +extra-task: /CoreOS/selinux-policy/Sanity/mounting diff --git a/other/mounting/runtest.sh b/other/mounting/runtest.sh index d012460..c8532b3 100755 --- a/other/mounting/runtest.sh +++ b/other/mounting/runtest.sh @@ -26,7 +26,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" From 1ddf81f5f147b5ce24399e03cc9d6d36005cda0a Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Mon, 25 Apr 2022 14:01:05 +0200 Subject: [PATCH 136/626] make the expect scripts executable Many automated tests use various expect scripts. Some of these scripts were not executable, which means that they did not work successfully. Now, all expect scripts have the UNIX permissions set to be executable. --- selinux-policy/dmidecode-and-similar/ssh.exp | 0 selinux-policy/policykit-general/ssh.exp | 0 2 files changed, 0 insertions(+), 0 deletions(-) mode change 100644 => 100755 selinux-policy/dmidecode-and-similar/ssh.exp mode change 100644 => 100755 selinux-policy/policykit-general/ssh.exp diff --git a/selinux-policy/dmidecode-and-similar/ssh.exp b/selinux-policy/dmidecode-and-similar/ssh.exp old mode 100644 new mode 100755 diff --git a/selinux-policy/policykit-general/ssh.exp b/selinux-policy/policykit-general/ssh.exp old mode 100644 new mode 100755 From f1ffb0bbe52dba60bc85e5b6dc5299de25ba2ee0 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 26 Apr 2022 08:26:05 +0200 Subject: [PATCH 137/626] remove all rhts-environment.sh includes The rhts-environment.sh files are not needed anymore. The include of beakerlib.sh is sufficient. --- policycoreutils/restorecond_pointer_abuse/runtest.sh | 1 - selinux-policy/Library/common/runtest.sh | 1 - 2 files changed, 2 deletions(-) diff --git a/policycoreutils/restorecond_pointer_abuse/runtest.sh b/policycoreutils/restorecond_pointer_abuse/runtest.sh index 465b1f2..98671dd 100755 --- a/policycoreutils/restorecond_pointer_abuse/runtest.sh +++ b/policycoreutils/restorecond_pointer_abuse/runtest.sh @@ -36,7 +36,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # Include Beaker environment -. /usr/bin/rhts-environment.sh || exit 1 . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="policycoreutils" diff --git a/selinux-policy/Library/common/runtest.sh b/selinux-policy/Library/common/runtest.sh index 73c2a3e..124e96a 100755 --- a/selinux-policy/Library/common/runtest.sh +++ b/selinux-policy/Library/common/runtest.sh @@ -3,7 +3,6 @@ # This is a test file # Include rhts environment -. /usr/bin/rhts-environment.sh . /usr/share/beakerlib/beakerlib.sh list_booleans() { From 58ae65cd1e7916c33ef061d73abca1636a61d7bc Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 26 Apr 2022 09:08:37 +0200 Subject: [PATCH 138/626] unset the default context for /var/ARTIFACTS Many automated tests run the "restorecon -Rv /run /var" command to ensure that file-system objects stored in these locations are labeled correctly. Unfortunately, the command affects SELinux contexts of files/directories stored under /var/ARTIFACTS/. For example: the rlFileBackup function uses this location as well. To avoid such unpleasant effects, the default SELinux context for /var/ARTIFACTS directory is now set to /proc equivalent (meaning: no default context). --- selinux-policy/Library/common/lib.sh | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/selinux-policy/Library/common/lib.sh b/selinux-policy/Library/common/lib.sh index 149e1a2..22a7b31 100644 --- a/selinux-policy/Library/common/lib.sh +++ b/selinux-policy/Library/common/lib.sh @@ -1995,6 +1995,13 @@ rlSELibraryLoaded() { else rlRun "dnf -y --skip-broken install $rlSE_REQUIRES" fi + + # make sure that restorecon does not change SELinux contexts under /var/ARTIFACTS + # otherwise SELinux context of backed up files/directories will be affected + if matchpathcon /var/ARTIFACTS/something | grep -q :var_t: ; then + semanage fcontext -a -e /proc /var/ARTIFACTS + fi + if rlCheckRequirements $rlSE_REQUIRES; then SETOOLS_MAJOR_VERSION=`sesearch --version 2>&1| sed -n 's/sesearch //;s/\..*$//p'` rlLogDebug "FUNCNAME(): sesearch --version: $(sesearch --version 2>&1)" From 2d47988950aa16ed0471ff1c8f388e5106e6ae47 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Wed, 8 Sep 2021 15:48:46 +0200 Subject: [PATCH 139/626] add the ModemManager test to upstream repo The ModemManager component is frequently used by various users on Fedora and RHEL, so it makes sense to run this TC in upstream testing too. There are no changes in the TC functionality. Moving the downstream TC to upstream repo. --- .../ModemManager-and-similar/Makefile | 82 ++++++++++ .../ModemManager-and-similar/PURPOSE | 5 + .../ModemManager-and-similar/main.fmf | 58 +++++++ .../ModemManager-and-similar/runtest.sh | 148 ++++++++++++++++++ 4 files changed, 293 insertions(+) create mode 100644 selinux-policy/ModemManager-and-similar/Makefile create mode 100644 selinux-policy/ModemManager-and-similar/PURPOSE create mode 100644 selinux-policy/ModemManager-and-similar/main.fmf create mode 100755 selinux-policy/ModemManager-and-similar/runtest.sh diff --git a/selinux-policy/ModemManager-and-similar/Makefile b/selinux-policy/ModemManager-and-similar/Makefile new file mode 100644 index 0000000..46dacc6 --- /dev/null +++ b/selinux-policy/ModemManager-and-similar/Makefile @@ -0,0 +1,82 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/ModemManager-and-similar +# Description: SELinux interferes with ModemManager and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/ModemManager-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with ModemManager and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 15m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "RunFor: ModemManager" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console glib2 ModemManager /usr/sbin/service" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5" >> $(METADATA) + @echo "Bug: 1120152" >> $(METADATA) # RHEL-7 + @echo "Bug: 1362273" >> $(METADATA) # RHEL-7 + @echo "Bug: 1365214" >> $(METADATA) # RHEL-7 + @echo "Bug: 1676810" >> $(METADATA) # RHEL-7 + @echo "Bug: 1697868" >> $(METADATA) # RHEL-7 + @echo "Bug: 1961571" >> $(METADATA) # Fedora 35 + @echo "Bug: 1996903" >> $(METADATA) # Fedora 35 + @echo "Bug: 1996905" >> $(METADATA) # Fedora 35 + @echo "Bug: 2000196" >> $(METADATA) # RHEL-9 + @echo "Bug: 2001141" >> $(METADATA) # Fedora 35 + @echo "Bug: 2001143" >> $(METADATA) # Fedora 35 + @echo "Bug: 2001144" >> $(METADATA) # Fedora 35 + @echo "Bug: 2001145" >> $(METADATA) # Fedora 35 + @echo "Bug: 2036582" >> $(METADATA) # RHEL-9 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/ModemManager-and-similar/PURPOSE b/selinux-policy/ModemManager-and-similar/PURPOSE new file mode 100644 index 0000000..ee44526 --- /dev/null +++ b/selinux-policy/ModemManager-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/ModemManager-and-similar +Author: Milos Malik + +SELinux interferes with ModemManager and related programs. + diff --git a/selinux-policy/ModemManager-and-similar/main.fmf b/selinux-policy/ModemManager-and-similar/main.fmf new file mode 100644 index 0000000..c3539d8 --- /dev/null +++ b/selinux-policy/ModemManager-and-similar/main.fmf @@ -0,0 +1,58 @@ +summary: SELinux interferes with ModemManager and related programs +description: |+ + SELinux interferes with ModemManager and related programs. + +contact: Milos Malik +component: + - selinux-policy +test: ./runtest.sh +framework: beakerlib +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - glib2 + - ModemManager + - /usr/sbin/service +environment: + AVC_ERROR: +no_avc_check +duration: 15m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - TIPpass_Security + - Tier2 + - Tier2se + - f31friendly + - f32friendly + - targeted +tier: '2' +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1120152 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1362273 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1365214 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1676810 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1697868 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1961571 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1996903 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1996905 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2000196 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2001141 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2001143 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2001144 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2001145 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2036582 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5 + continue: false +extra-nitrate: TC#0075515 +extra-summary: /CoreOS/selinux-policy/Regression/ModemManager-and-similar +extra-task: /CoreOS/selinux-policy/Regression/ModemManager-and-similar diff --git a/selinux-policy/ModemManager-and-similar/runtest.sh b/selinux-policy/ModemManager-and-similar/runtest.sh new file mode 100755 index 0000000..b41d316 --- /dev/null +++ b/selinux-policy/ModemManager-and-similar/runtest.sh @@ -0,0 +1,148 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/ModemManager-and-similar +# Description: SELinux interferes with ModemManager and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +ROOT_PASSWORD="redhat" +if rlIsRHEL 6 ; then + FILE_PATH="/usr/sbin/modem-manager" + PROCESS_NAME="modem-manager" +else + FILE_PATH="/usr/sbin/ModemManager" + PROCESS_NAME="ModemManager" +fi +FILE_CONTEXT="modemmanager_exec_t" +SERVICE_PACKAGE="ModemManager" +SERVICE_NAME="ModemManager" +PROCESS_CONTEXT="modemmanager_t" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} + rlFileBackup /etc/shadow + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "SELinux contexts and rules" + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + if rlIsRHEL 5 ; then + SOURCE_TYPE="initrc_t" + BOOLEANS="[ ]" + elif rlIsRHEL 6 ; then + SOURCE_TYPE="system_dbusd_t" # D-bus daemon runs the process + else # RHEL-7 etc. + for SOURCE_TYPE in system_dbusd_t init_t ; do + rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute }" + rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition }" + rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT}" + done + fi + rlPhaseEnd + + if ! rlIsRHEL 5 ; then + rlPhaseStartTest "real scenario -- DBus service" + if rlIsRHEL 6 ; then + DESTINATION="org.freedesktop.ModemManager" + else + DESTINATION="org.freedesktop.ModemManager1" + fi + rlRun "gdbus introspect --system --object-path / --dest ${DESTINATION} >& /dev/null" + sleep 1 + rlRun "ps -efZ | grep -v grep | grep ${PROCESS_NAME}" + rlRun "ps -efZ | grep -v grep | grep \"${PROCESS_CONTEXT}.*${PROCESS_NAME}\"" + rlPhaseEnd + fi + + if ! rlIsRHEL 5 6 ; then + rlPhaseStartTest "bz#1120152" + rlSEMatchPathCon "/usr/sbin/ModemManager" "modemmanager_exec_t" + rlSESearchRule "allow modemmanager_t modemmanager_t : unix_stream_socket { connectto }" + rlPhaseEnd + + rlPhaseStartTest "bz#1362273 + bz#1365214" + rlSEMatchPathCon "/usr/sbin/ModemManager" "modemmanager_exec_t" + rlSEMatchPathCon "/run/systemd/inhibit/7.ref" "systemd_logind_inhibit_var_run_t" + rlSESearchRule "allow modemmanager_t systemd_logind_t : dbus { send_msg }" + rlSESearchRule "allow systemd_logind_t modemmanager_t : dbus { send_msg }" + rlSESearchRule "allow modemmanager_t systemd_logind_inhibit_var_run_t : fifo_file { write }" + rlPhaseEnd + + rlPhaseStartTest "bz#1676810 + bz#1697868" + rlSEMatchPathCon "/usr/sbin/ModemManager" "modemmanager_exec_t" + rlSESearchRule "allow modemmanager_t sysfs_t : file { append write } [ ]" + rlPhaseEnd + + rlPhaseStartTest "real scenario -- standalone service" + rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + sleep 1 + rlRun "service systemd-logind restart" + sleep 1 + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + fi + + if ! rlIsRHEL 6 7 8 ; then + rlPhaseStartTest "bz#1996903 + bz#1996905 + bz#2001141 + bz#2001143 + bz#2001144 + bz#2001145 + bz#2036582" + rlSEMatchPathCon "/usr/sbin/ModemManager" "modemmanager_exec_t" + rlSESearchRule "allow modemmanager_t modemmanager_t : qipcrtr_socket { create getattr getopt } [ ]" + rlSESearchRule "allow modemmanager_t kernel_t : system { module_request } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1961571 + bz#2000196" + rlSEMatchPathCon "/usr/sbin/ModemManager" "modemmanager_exec_t" + rlSEMatchPathCon "/dev/wwan0p1QCDM" "modem_device_t" + rlSEMatchPathCon "/dev/wwan0p2MBIM" "modem_device_t" + rlRun "semanage fcontext -l | grep '^/dev/wwan.*char.*modem_device_t'" + rlSESearchRule "allow modemmanager_t modem_device_t : chr_file { getattr open read write ioctl } [ ]" + rlSESearchRule "allow modemmanager_t unconfined_t : unix_stream_socket { connectto } [ ]" + rlPhaseEnd + fi + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + rlFileRestore + + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + From 46081dbdf1a98e3693fc7b04226a2b77beede30c Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Wed, 27 Apr 2022 14:40:22 +0200 Subject: [PATCH 140/626] kernel/synflood: disable the test due to being unreliable The test doesn't detect the presence of the performance issue reliably across machines and architectures, so disable it for now. Signed-off-by: Ondrej Mosnacek --- kernel/synflood/main.fmf | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/kernel/synflood/main.fmf b/kernel/synflood/main.fmf index f548123..369876d 100644 --- a/kernel/synflood/main.fmf +++ b/kernel/synflood/main.fmf @@ -18,7 +18,8 @@ require: recommend: - /usr/sbin/hping3 duration: 1h -enabled: true +# currently disabled due to being unreliable +enabled: false tier: 3 adjust: - enabled: false From c1d19b851628d3c6b4850b2913e5b32660860d2b Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Wed, 27 Apr 2022 15:38:12 +0200 Subject: [PATCH 141/626] kernel/selinux-testsuite: disable Beaker AVC check Add AVC_ERROR=+no_avc_check into test environment to disable Beaker's AVC check, as this test produces s lot of expected AVC denials. Signed-off-by: Ondrej Mosnacek --- kernel/selinux-testsuite/main.fmf | 2 ++ 1 file changed, 2 insertions(+) diff --git a/kernel/selinux-testsuite/main.fmf b/kernel/selinux-testsuite/main.fmf index 2e1376c..ebc5ff6 100644 --- a/kernel/selinux-testsuite/main.fmf +++ b/kernel/selinux-testsuite/main.fmf @@ -14,3 +14,5 @@ adjust: when: distro < rhel-6 - enabled: false when: arch = i386 +environment: + AVC_ERROR: +no_avc_check From a575a54b9a6b738fcb855e490a40bef61085780d Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Thu, 28 Apr 2022 15:07:07 +0200 Subject: [PATCH 142/626] update the rngd test to the latest version TBA --- selinux-policy/rngd-and-similar/Makefile | 5 ++++- selinux-policy/rngd-and-similar/main.fmf | 7 ++++++- selinux-policy/rngd-and-similar/runtest.sh | 23 +++++++++++++++++++++- 3 files changed, 32 insertions(+), 3 deletions(-) diff --git a/selinux-policy/rngd-and-similar/Makefile b/selinux-policy/rngd-and-similar/Makefile index 43f6ad4..e4d0031 100644 --- a/selinux-policy/rngd-and-similar/Makefile +++ b/selinux-policy/rngd-and-similar/Makefile @@ -55,7 +55,7 @@ $(METADATA): Makefile @echo "TestTime: 15m" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) @echo "RunFor: rng-tools" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console rng-tools initscripts" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console rng-tools /usr/sbin/service" >> $(METADATA) @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @echo "License: GPLv2" >> $(METADATA) @@ -85,6 +85,9 @@ $(METADATA): Makefile @echo "Bug: 1928572" >> $(METADATA) # Fedora 33 @echo "Bug: 1929360" >> $(METADATA) # Fedora 33 @echo "Bug: 1929366" >> $(METADATA) # Fedora 33 + @echo "Bug: 2058914" >> $(METADATA) # Fedora 36 + @echo "Bug: 2076641" >> $(METADATA) # RHEL-8 + @echo "Bug: 2076642" >> $(METADATA) # RHEL-9 rhts-lint $(METADATA) diff --git a/selinux-policy/rngd-and-similar/main.fmf b/selinux-policy/rngd-and-similar/main.fmf index c42e941..b599860 100644 --- a/selinux-policy/rngd-and-similar/main.fmf +++ b/selinux-policy/rngd-and-similar/main.fmf @@ -5,6 +5,8 @@ description: |+ contact: Milos Malik component: - selinux-policy +test: ./runtest.sh +framework: beakerlib require: - library(selinux-policy/common) recommend: @@ -16,7 +18,7 @@ recommend: - selinux-policy-targeted - setools-console - rng-tools - - initscripts + - /usr/sbin/service environment: AVC_ERROR: +no_avc_check duration: 15m @@ -58,6 +60,9 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1929360 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1929366 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1931450 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2058914 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2076641 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2076642 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6 diff --git a/selinux-policy/rngd-and-similar/runtest.sh b/selinux-policy/rngd-and-similar/runtest.sh index 884cbdf..9007917 100755 --- a/selinux-policy/rngd-and-similar/runtest.sh +++ b/selinux-policy/rngd-and-similar/runtest.sh @@ -48,6 +48,7 @@ rlJournalStart rlServiceStop ${SERVICE_NAME} rlFileBackup /etc/shadow + rlFileBackup /etc/sysconfig/rngd rlSESetEnforce rlSEStatus @@ -145,6 +146,15 @@ rlJournalStart rlPhaseEnd fi + DROP_PRIV=false + if rngd --help | grep -qi 'drop.*priv' ; then + DROP_PRIV=true + rlPhaseStartTest "bz#2076641 + bz#2076642" + rlSESearchRule "allow rngd_t rngd_t : capability { setgid setuid } [ ]" + rlSESearchRule "allow rngd_t rngd_t : process { setcap } [ ]" + rlPhaseEnd + fi + rlPhaseStartTest "real scenario" rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" rlRun "modprobe tpm-rng" 0,1 @@ -159,7 +169,18 @@ rlJournalStart rlRun "setsebool daemons_use_tty on" rlRun "runcon system_u:system_r:initrc_t:s0 bash -c 'rngd -l'" 0-255 rlRun "setsebool daemons_use_tty off" - rlRun "restorecon -Rv /run /var" + rlRun "restorecon -Rv /run /var" 0-255 + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status" 1 + if ${DROP_PRIV} ; then + rlLog "modifying the /etc/sysconfig/rngd file" + if ! grep -q '^RNGD_ARGS.*daemon:daemon' /etc/sysconfig/rngd ; then + sed -i 's/^\(RNGD_ARGS=.*\)"$/\1 -D daemon:daemon"/' /etc/sysconfig/rngd + fi + if ! grep -q '^RNGD_ARGS.*jitter' /etc/sysconfig/rngd ; then + sed -i 's/^\(RNGD_ARGS=.*\)"$/\1 -x jitter"/' /etc/sysconfig/rngd + fi + fi + rlRun "grep ^RNGD_ARGS= /etc/sysconfig/rngd" rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd From be596e9ba151b12b533f5ffdbb0f230d12f0aa0e Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 3 May 2022 12:44:51 +0200 Subject: [PATCH 143/626] adapt to different validatetrans behavior Error messages produced by the validatetrans tool have changed. The TC needs to adapt. --- libselinux/validatetrans/runtest.sh | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/libselinux/validatetrans/runtest.sh b/libselinux/validatetrans/runtest.sh index d84991e..b38050d 100755 --- a/libselinux/validatetrans/runtest.sh +++ b/libselinux/validatetrans/runtest.sh @@ -85,11 +85,11 @@ rlJournalStart rlPhaseStartTest "incomplete or invalid parameters" # first context incomplete - rlRun "validatetrans unconfined_u:object_r:bin_t: unconfined_u:unconfined_r:unconfined_t:s0 file unconfined_u:object_r:swapfile_t:s0 2>&1 | grep -i 'invalid argument'" + rlRun "validatetrans unconfined_u:object_r:bin_t: unconfined_u:unconfined_r:unconfined_t:s0 file unconfined_u:object_r:swapfile_t:s0 2>&1 | grep -i -e 'invalid argument' -e 'invalid source context'" # second context incomplete - rlRun "validatetrans unconfined_u:object_r:bin_t:s0 unconfined_u:unconfined_r:unconfined_t: file unconfined_u:object_r:swapfile_t:s0 2>&1 | grep -i 'invalid argument'" + rlRun "validatetrans unconfined_u:object_r:bin_t:s0 unconfined_u:unconfined_r:unconfined_t: file unconfined_u:object_r:swapfile_t:s0 2>&1 | grep -i -e 'invalid argument' -e 'invalid target context'" # third context incomplete - rlRun "validatetrans unconfined_u:object_r:bin_t:s0 unconfined_u:unconfined_r:unconfined_t:s0 file unconfined_u:object_r:swapfile_t: 2>&1 | grep -i 'invalid argument'" + rlRun "validatetrans unconfined_u:object_r:bin_t:s0 unconfined_u:unconfined_r:unconfined_t:s0 file unconfined_u:object_r:swapfile_t: 2>&1 | grep -i -e 'invalid argument' -e 'invalid new context'" # invalid target class rlRun "validatetrans unconfined_u:object_r:bin_t:s0 unconfined_u:unconfined_r:unconfined_t:s0 xyz unconfined_u:object_r:swapfile_t:s0 2>&1 | grep -i 'invalid class'" rlPhaseEnd From dbc896ebd6104799bac8d9a33280f999f17d26ca Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Fri, 29 Apr 2022 15:52:24 +0200 Subject: [PATCH 144/626] test if policy rebuild affects layered containers Following error messages appeared when 2 containers (one derived the other) both manipulate the SELinux policy store: libsemanage.semanage_commit_sandbox: Error while renaming /var/lib/selinux/targeted/active to /var/lib/selinux/targeted/previous. (Invalid cross-device link). semodule: Failed! Error: error building at STEP "RUN semodule -B": error while running runtime: exit status 1 Purpose of this automated test is to find out if this situation still happens or not. The TC covers BZ#2068085. --- .../cross-device-link-in-containers/Makefile | 64 ++++++++++++++++ .../cross-device-link-in-containers/PURPOSE | 5 ++ .../cross-device-link-in-containers/main.fmf | 30 ++++++++ .../runtest.sh | 76 +++++++++++++++++++ 4 files changed, 175 insertions(+) create mode 100644 libsemanage/cross-device-link-in-containers/Makefile create mode 100644 libsemanage/cross-device-link-in-containers/PURPOSE create mode 100644 libsemanage/cross-device-link-in-containers/main.fmf create mode 100755 libsemanage/cross-device-link-in-containers/runtest.sh diff --git a/libsemanage/cross-device-link-in-containers/Makefile b/libsemanage/cross-device-link-in-containers/Makefile new file mode 100644 index 0000000..cc5b0cd --- /dev/null +++ b/libsemanage/cross-device-link-in-containers/Makefile @@ -0,0 +1,64 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/libsemanage/Regression/cross-device-link-in-containers +# Description: Does rebuild of policy affect layered containers? +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2022 Red Hat, Inc. +# +# This program is free software: you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation, either version 2 of +# the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see http://www.gnu.org/licenses/. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/libsemanage/Regression/cross-device-link-in-containers +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + test -x runtest.sh || chmod a+x runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: Does rebuild of policy affect layered containers?" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: libsemanage" >> $(METADATA) + @echo "Requires: libsemanage podman policycoreutils selinux-policy libselinux-utils" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2+" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) + @echo "Bug: 2068085" >> $(METADATA) # RHEL-9 + + rhts-lint $(METADATA) + diff --git a/libsemanage/cross-device-link-in-containers/PURPOSE b/libsemanage/cross-device-link-in-containers/PURPOSE new file mode 100644 index 0000000..1f8a6d1 --- /dev/null +++ b/libsemanage/cross-device-link-in-containers/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/libsemanage/Regression/cross-device-link-in-containers +Author: Milos Malik + +Description: Does rebuild of policy affect layered containers? + diff --git a/libsemanage/cross-device-link-in-containers/main.fmf b/libsemanage/cross-device-link-in-containers/main.fmf new file mode 100644 index 0000000..72ddbf7 --- /dev/null +++ b/libsemanage/cross-device-link-in-containers/main.fmf @@ -0,0 +1,30 @@ +summary: Does rebuild of policy affect layered containers? +description: |+ + Does rebuild of policy affect layered containers? + +contact: Milos Malik +component: + - libsemanage +recommend: + - libsemanage + - podman + - policycoreutils + - selinux-policy + - libselinux-utils +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - targeted +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2068085 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + continue: false +extra-summary: /CoreOS/libsemanage/Regression/cross-device-link-in-containers +extra-task: /CoreOS/libsemanage/Regression/cross-device-link-in-containers +extra-nitrate: TC#0613557 diff --git a/libsemanage/cross-device-link-in-containers/runtest.sh b/libsemanage/cross-device-link-in-containers/runtest.sh new file mode 100755 index 0000000..782bbc2 --- /dev/null +++ b/libsemanage/cross-device-link-in-containers/runtest.sh @@ -0,0 +1,76 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/libsemanage/Regression/cross-device-link-in-containers +# Description: Does rebuild of policy affect layered containers? +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2022 Red Hat, Inc. +# +# This program is free software: you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation, either version 2 of +# the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see http://www.gnu.org/licenses/. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="libsemanage" + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm ${PACKAGE} + rlAssertRpm podman + rlRun "semodule -lfull | grep -e container -e podman" + rlRun "getsebool -a | grep -e container -e podman" + rlRun "mkdir selinux1 selinux2" + rlPhaseEnd + + rlPhaseStartTest "bz#2068085" + rlRun "pushd selinux1" +cat <> ./Dockerfile +FROM quay.io/centos/centos:stream9 +RUN dnf install -y selinux-policy selinux-policy-targeted +EOF + rlRun "cat ./Dockerfile" + rlRun -s "podman build -t localhost/selinux . --no-cache" + rlAssertGrep "^complete" $rlRun_LOG -i + rlAssertGrep "^commit" $rlRun_LOG -i + rlRun "popd" + + rlRun "pushd selinux2" +cat <> ./Dockerfile +FROM localhost/selinux +RUN semodule -B +EOF + rlRun "cat ./Dockerfile" + rlRun -s "podman build -t localhost/selinux2 . --no-cache" + rlAssertNotGrep "error" $rlRun_LOG -i + rlAssertNotGrep "failed" $rlRun_LOG -i + rlRun "popd" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "rm -rf selinux1 selinux2" + rlRun "podman images" + for ID in `podman images -q` ; do + rlRun "podman rmi $ID" + done + rlRun "podman images" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + From 00be497d473bfea3d86eaa5e987c6f98f5dafeb3 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Mon, 7 Dec 2020 09:49:06 +0100 Subject: [PATCH 145/626] add a new test which covers systemd-notify The systemd-notify program is confined by SELinux, but there was no SELinux related test coverage sofar. This automated TC will contain some basic scenarios and should improve this situation. As described in BZ#1903106, current SELinux policy is one of the factors which prevent systemd from proper notify handling. Missing rules in SELinux policy lead to the following error message: Failed to invoke barrier: Connection timed out The TC covers BZ#1903305, looks for appropriate SELinux policy rules and it also reproduces the scenario. What if an unconfined service tries to use the systemd-notify? Will it work successfully without SELinux denials? --- .../systemd-notify-and-similar/Makefile | 68 ++++++++++++++ .../systemd-notify-and-similar/PURPOSE | 5 ++ .../local-notifier.service | 7 ++ .../systemd-notify-and-similar/main.fmf | 41 +++++++++ .../systemd-notify-and-similar/notifier.sh | 5 ++ .../systemd-notify-and-similar/runtest.sh | 89 +++++++++++++++++++ 6 files changed, 215 insertions(+) create mode 100644 selinux-policy/systemd-notify-and-similar/Makefile create mode 100644 selinux-policy/systemd-notify-and-similar/PURPOSE create mode 100644 selinux-policy/systemd-notify-and-similar/local-notifier.service create mode 100644 selinux-policy/systemd-notify-and-similar/main.fmf create mode 100755 selinux-policy/systemd-notify-and-similar/notifier.sh create mode 100755 selinux-policy/systemd-notify-and-similar/runtest.sh diff --git a/selinux-policy/systemd-notify-and-similar/Makefile b/selinux-policy/systemd-notify-and-similar/Makefile new file mode 100644 index 0000000..d355f29 --- /dev/null +++ b/selinux-policy/systemd-notify-and-similar/Makefile @@ -0,0 +1,68 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/systemd-notify-and-similar +# Description: SELinux interferes with systemd-notify and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2020 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/systemd-notify-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE local-notifier.service notifier.sh + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh notifier.sh + chcon -t bin_t runtest.sh notifier.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with systemd-notify and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console systemd /usr/sbin/service" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6" >> $(METADATA) + @echo "Bug: 1903305" >> $(METADATA) # Fedora 33 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/systemd-notify-and-similar/PURPOSE b/selinux-policy/systemd-notify-and-similar/PURPOSE new file mode 100644 index 0000000..b236d83 --- /dev/null +++ b/selinux-policy/systemd-notify-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/systemd-notify-and-similar +Author: Milos Malik + +SELinux interferes with systemd-notify and related programs. + diff --git a/selinux-policy/systemd-notify-and-similar/local-notifier.service b/selinux-policy/systemd-notify-and-similar/local-notifier.service new file mode 100644 index 0000000..db5a1b4 --- /dev/null +++ b/selinux-policy/systemd-notify-and-similar/local-notifier.service @@ -0,0 +1,7 @@ +[Unit] +Description=Local notifier service + +[Service] +Type=oneshot +ExecStart=/usr/local/bin/notifier.sh + diff --git a/selinux-policy/systemd-notify-and-similar/main.fmf b/selinux-policy/systemd-notify-and-similar/main.fmf new file mode 100644 index 0000000..7474823 --- /dev/null +++ b/selinux-policy/systemd-notify-and-similar/main.fmf @@ -0,0 +1,41 @@ +summary: SELinux interferes with systemd-notify and related programs +description: |+ + SELinux interferes with systemd-notify and related programs + +contact: Milos Malik +component: + - selinux-policy +test: ./runtest.sh +framework: beakerlib +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - systemd + - /usr/sbin/service +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - Tier2 + - Tier2se + - targeted +tier: '2' +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1903305 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + continue: false +extra-summary: /CoreOS/selinux-policy/Regression/systemd-notify-and-similar +extra-task: /CoreOS/selinux-policy/Regression/systemd-notify-and-similar +extra-nitrate: TC#0613581 diff --git a/selinux-policy/systemd-notify-and-similar/notifier.sh b/selinux-policy/systemd-notify-and-similar/notifier.sh new file mode 100755 index 0000000..e8d7554 --- /dev/null +++ b/selinux-policy/systemd-notify-and-similar/notifier.sh @@ -0,0 +1,5 @@ +#!/bin/bash +id -Z +NOTIFY_SOCKET=/run/systemd/notify systemd-notify --ready +NOTIFY_SOCKET=/run/systemd/notify systemd-notify --ready + diff --git a/selinux-policy/systemd-notify-and-similar/runtest.sh b/selinux-policy/systemd-notify-and-similar/runtest.sh new file mode 100755 index 0000000..24d276f --- /dev/null +++ b/selinux-policy/systemd-notify-and-similar/runtest.sh @@ -0,0 +1,89 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/systemd-notify-and-similar +# Description: SELinux interferes with systemd-notify and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2020 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +SERVICE_PACKAGE="systemd" + +rlJournalStart + rlLog "If this test fails, please contact mmalik on IRC #selinux" + rlLog "This test should fail if tested bugs are NOT fixed yet" + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "bz#1903305" + rlSEMatchPathCon "/usr/bin/systemd-notify" "systemd_notify_exec_t" + rlSESearchRule "allow init_t unconfined_t : fifo_file { write } [ ]" + rlSESearchRule "allow systemd_notify_t user_devpts_t : chr_file { read write append } [ ]" + rlSESearchRule "allow systemd_notify_t systemd_notify_t : capability { net_admin } [ ]" + rlSESearchRule "allow systemd_notify_t kernel_t : unix_dgram_socket { sendto } [ ]" + rlPhaseEnd + + rlPhaseStartTest "real scenario -- bz#1903305" + rlRun "NOTIFY_SOCKET=/run/systemd/notify systemd-notify --ready" + sleep 1 + rlRun "NOTIFY_SOCKET=/run/systemd/notify systemd-notify --ready" + rlPhaseEnd + + rlPhaseStartTest "real scenario -- runcon under root" + rlRun "NOTIFY_SOCKET=/run/systemd/notify runcon system_u:system_r:initrc_t:s0 bash -c 'systemd-notify --ready'" + sleep 1 + rlRun "NOTIFY_SOCKET=/run/systemd/notify runcon system_u:system_r:initrc_t:s0 bash -c 'systemd-notify --ready'" + rlPhaseEnd + + rlPhaseStartTest "real scenario -- unconfined service uses systemd-notify" + rlRun "cp -f notifier.sh /usr/local/bin/" + rlRun "cp -f local-notifier.service /usr/lib/systemd/system/" + rlRun "restorecon -v /usr/local/bin/notifier.sh /usr/lib/systemd/system/local-notifier.service" + rlRun "systemctl daemon-reload" + rlRun "service local-notifier start" + sleep 2 + rlRun "service local-notifier status" + rlRun "rm -f /usr/lib/systemd/system/local-notifier.service /usr/local/bin/notifier.sh" + rlRun "systemctl daemon-reload" + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + From fd520ce6f3cd0e83db4c306bd2e0958ef8518ce5 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Tue, 10 May 2022 15:24:04 +0200 Subject: [PATCH 146/626] Add a test for bogus warning in selinux_ima_measure_state() Verifies: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ce2fc710c9d2b25afc710f49bb2065b4439a62bc Signed-off-by: Ondrej Mosnacek --- .../main.fmf | 22 +++++++++++++ .../runtest.sh | 32 +++++++++++++++++++ 2 files changed, 54 insertions(+) create mode 100644 kernel/bogus-warning-in-selinux_ima_measure_state/main.fmf create mode 100755 kernel/bogus-warning-in-selinux_ima_measure_state/runtest.sh diff --git a/kernel/bogus-warning-in-selinux_ima_measure_state/main.fmf b/kernel/bogus-warning-in-selinux_ima_measure_state/main.fmf new file mode 100644 index 0000000..57e2859 --- /dev/null +++ b/kernel/bogus-warning-in-selinux_ima_measure_state/main.fmf @@ -0,0 +1,22 @@ +summary: Regression test for bogus WARNING in SELinux +description: | + Verify that selinux_ima_measure_state() doesn't trigger a bogus + lock-related WARN_ON() when the mutex is held by another task. +contact: Ondrej Mosnacek +component: +- kernel +framework: beakerlib +require: +- policycoreutils +duration: 5m +tier: 2 +enabled: true +adjust: +- enabled: false + when: distro < fedora-36 + because: some kernels on Fedora 35 and below don't have the fix +- enabled: false + when: distro < rhel-9.1 + because: not expected to be fixed earlier than RHEL-9.1 +link: +- verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2050966 diff --git a/kernel/bogus-warning-in-selinux_ima_measure_state/runtest.sh b/kernel/bogus-warning-in-selinux_ima_measure_state/runtest.sh new file mode 100755 index 0000000..061b9c7 --- /dev/null +++ b/kernel/bogus-warning-in-selinux_ima_measure_state/runtest.sh @@ -0,0 +1,32 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# SPDX-License-Identifier: GPLv2 +# Copyright (c) 2022 Red Hat, Inc. +# Author: Ondrej Mosnacek + +# Include Beakerlib environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +function trigger_the_bug() { + while true; do echo 0 > /sys/fs/selinux/checkreqprot; done & + while true; do load_policy; done & + + sleep 15s + + kill $(jobs -p) + wait $(jobs -p) + return 0 +} + +rlJournalStart + rlPhaseStartSetup + rlRun "uname -r" 0 "Show the running kernel version" + rlPhaseEnd + + rlPhaseStartTest + rlRun "trigger_the_bug" 0 "Run the reproducer" + rlRun "dmesg | grep -E 'WARNING:.*selinux_ima_measure_state'" 1 \ + "Check that dmesg doesn't contain relevant WARNING lines" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd From 81bb79481d66cad1e72013376296671b36f92bc5 Mon Sep 17 00:00:00 2001 From: Amith Kumar Date: Wed, 11 May 2022 04:56:25 +0530 Subject: [PATCH 147/626] policycoreutils: fix main.fmf file Automated tests executed via TMT/FMF are failing due to absence of relevant packages. Fix the main.fmf file to match the list of required packages/programs in `Makefile`. Signed-off-by: Amith Kumar --- policycoreutils/restorecond_pointer_abuse/main.fmf | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/policycoreutils/restorecond_pointer_abuse/main.fmf b/policycoreutils/restorecond_pointer_abuse/main.fmf index d96f84a..00a4fea 100644 --- a/policycoreutils/restorecond_pointer_abuse/main.fmf +++ b/policycoreutils/restorecond_pointer_abuse/main.fmf @@ -11,7 +11,13 @@ description: | Bugzilla link: https://bugzilla.redhat.com/show_bug.cgi?id=1626468 component: -- policycoreutils + - policycoreutils +recommend: + - git-core + - policycoreutils-restorecond + - coreutils + - systemd + - policycoreutils adjust: -- enabled: false + - enabled: false when: distro < rhel-7 From 9ff6e590c0ac5c8c560d17b1b56be3e9390f2bcb Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Fri, 13 May 2022 19:07:34 +0200 Subject: [PATCH 148/626] test if systemd-run can run interactive shell New automated test which covers basic functions of the systemd-run program. Based on bugs filed in the past, SELinux interferes with systemd-run often, which indicates that such an automated test is definitely needed. The TC covers BZ#1647162 and BZ#1980241. --- .../systemd-run-and-similar/Makefile | 68 ++++++++++++++++++ .../systemd-run-and-similar/PURPOSE | 5 ++ .../systemd-run-and-similar/main.fmf | 44 ++++++++++++ .../systemd-run-and-similar/runtest.sh | 71 +++++++++++++++++++ 4 files changed, 188 insertions(+) create mode 100644 selinux-policy/systemd-run-and-similar/Makefile create mode 100644 selinux-policy/systemd-run-and-similar/PURPOSE create mode 100644 selinux-policy/systemd-run-and-similar/main.fmf create mode 100755 selinux-policy/systemd-run-and-similar/runtest.sh diff --git a/selinux-policy/systemd-run-and-similar/Makefile b/selinux-policy/systemd-run-and-similar/Makefile new file mode 100644 index 0000000..db39990 --- /dev/null +++ b/selinux-policy/systemd-run-and-similar/Makefile @@ -0,0 +1,68 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/systemd-run-and-similar +# Description: SELinux interferes with systemd-run and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2022 Red Hat, Inc. +# +# This program is free software: you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation, either version 2 of +# the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see http://www.gnu.org/licenses/. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/systemd-run-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + test -x runtest.sh || chmod a+x runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with systemd-run and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console systemd" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2+" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) + @echo "Bug: 1559409" >> $(METADATA) # Fedora 27 + @echo "Bug: 1647162" >> $(METADATA) # Fedora 29 + @echo "Bug: 1980241" >> $(METADATA) # Fedora 34 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/systemd-run-and-similar/PURPOSE b/selinux-policy/systemd-run-and-similar/PURPOSE new file mode 100644 index 0000000..8aee928 --- /dev/null +++ b/selinux-policy/systemd-run-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/systemd-run-and-similar +Author: Milos Malik + +SELinux interferes with systemd-run and related programs + diff --git a/selinux-policy/systemd-run-and-similar/main.fmf b/selinux-policy/systemd-run-and-similar/main.fmf new file mode 100644 index 0000000..30fce17 --- /dev/null +++ b/selinux-policy/systemd-run-and-similar/main.fmf @@ -0,0 +1,44 @@ +summary: SELinux interferes with systemd-run and related programs +description: |+ + SELinux interferes with systemd-run and related programs. + +contact: Milos Malik +component: + - selinux-policy +test: ./runtest.sh +framework: beakerlib +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - systemd +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - Tier2 + - Tier2se + - targeted +tier: '2' +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1559409 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1647162 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1980241 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + continue: false +extra-summary: /CoreOS/selinux-policy/Regression/systemd-run-and-similar +extra-task: /CoreOS/selinux-policy/Regression/systemd-run-and-similar +extra-nitrate: TC#0613618 diff --git a/selinux-policy/systemd-run-and-similar/runtest.sh b/selinux-policy/systemd-run-and-similar/runtest.sh new file mode 100755 index 0000000..b594138 --- /dev/null +++ b/selinux-policy/systemd-run-and-similar/runtest.sh @@ -0,0 +1,71 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/systemd-run-and-similar +# Description: SELinux interferes with systemd-run and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2022 Red Hat, Inc. +# +# This program is free software: you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation, either version 2 of +# the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see http://www.gnu.org/licenses/. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm systemd + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "bz#1559409 + bz#1647162" + rlSEMatchPathCon "/usr/bin/systemd-run" "bin_t" + rlSESearchRule "allow init_t user_devpts_t : chr_file { setattr open } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1980241" + rlSESearchRule "allow init_t user_devpts_t : chr_file { watch watch_reads } [ ]" + rlPhaseEnd + + rlPhaseStartTest "real scenario" + rlWatchdog "systemd-run -p IPAddressDeny=127.0.0.1 -t /bin/sh" 10 + rlWatchdog "systemd-run --user --pty bash -i" 10 + rlWatchdog "systemd-run --system --pty bash -i" 10 + if systemd-run --help | grep -q -- --shell ; then + rlWatchdog "systemd-run --shell" 10 + fi + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + From db10d20932c2ce4ed4de8a48f65cf65661a5b651 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Mon, 23 May 2022 15:50:13 +0200 Subject: [PATCH 149/626] add new test which covers the ksm service The ksm service will be sooner of later confined by SELinux. Purpose of this automated test is to find out whether the SELinux policy does not prevent the ksm service from doing what is expected. The TC covers BZ#2021131. --- selinux-policy/ksm-and-similar/Makefile | 68 ++++++++++++++++ selinux-policy/ksm-and-similar/PURPOSE | 5 ++ selinux-policy/ksm-and-similar/main.fmf | 37 +++++++++ selinux-policy/ksm-and-similar/runtest.sh | 95 +++++++++++++++++++++++ 4 files changed, 205 insertions(+) create mode 100644 selinux-policy/ksm-and-similar/Makefile create mode 100644 selinux-policy/ksm-and-similar/PURPOSE create mode 100644 selinux-policy/ksm-and-similar/main.fmf create mode 100755 selinux-policy/ksm-and-similar/runtest.sh diff --git a/selinux-policy/ksm-and-similar/Makefile b/selinux-policy/ksm-and-similar/Makefile new file mode 100644 index 0000000..9ff17b0 --- /dev/null +++ b/selinux-policy/ksm-and-similar/Makefile @@ -0,0 +1,68 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/ksm-and-similar +# Description: SELinux interferes with ksm and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2022 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/ksm-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with ksm and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console /usr/libexec/ksmctl /usr/sbin/service" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) + @echo "Bug: 2021131" >> $(METADATA) # RHEL-9 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/ksm-and-similar/PURPOSE b/selinux-policy/ksm-and-similar/PURPOSE new file mode 100644 index 0000000..1f11e4b --- /dev/null +++ b/selinux-policy/ksm-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/ksm-and-similar +Author: Milos Malik + +SELinux interferes with the ksm service (the ksmctl program) and related programs. + diff --git a/selinux-policy/ksm-and-similar/main.fmf b/selinux-policy/ksm-and-similar/main.fmf new file mode 100644 index 0000000..ebab863 --- /dev/null +++ b/selinux-policy/ksm-and-similar/main.fmf @@ -0,0 +1,37 @@ +summary: SELinux interferes with ksm and related programs +description: |+ + SELinux interferes with ksm and related programs. + +contact: Milos Malik +component: + - selinux-policy +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - /usr/libexec/ksmctl + - /usr/sbin/service +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - targeted +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2021131 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + continue: false +extra-summary: /CoreOS/selinux-policy/Regression/ksm-and-similar +extra-task: /CoreOS/selinux-policy/Regression/ksm-and-similar diff --git a/selinux-policy/ksm-and-similar/runtest.sh b/selinux-policy/ksm-and-similar/runtest.sh new file mode 100755 index 0000000..4e19de9 --- /dev/null +++ b/selinux-policy/ksm-and-similar/runtest.sh @@ -0,0 +1,95 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/ksm-and-similar +# Description: SELinux interferes with ksm and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2022 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +FILE_PATH="/usr/libexec/ksmctl" +FILE_CONTEXT="ksm_exec_t" +SERVICE_NAME="ksm" +PROCESS_NAME="ksmctl" +PROCESS_CONTEXT="ksm_t" + +rlJournalStart + if rlIsRHEL 7 ; then + rlLog "Not applicable to this OS version." + rlJournalEnd + exit 0 + fi + + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlRun "rpm -qf ${FILE_PATH}" + + rlServiceStop ${SERVICE_NAME} + rlFileBackup /usr/lib/systemd/system/ksm.service + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + if rlSEDefined ${PROCESS_CONTEXT} ; then + rlPhaseStartTest "bz#2021131" + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + rlSEMatchPathCon "/sys/kernel/mm/ksm" "sysfs_t" + SOURCE_TYPE="init_t" # systemd runs the process + rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" + rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" + rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" + rlSESearchRule "allow ${PROCESS_CONTEXT} sysfs_t : dir { write } [ ]" + rlPhaseEnd + fi + + rlPhaseStartTest "real scenario -- standalone service" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + PROCESS_CONTEXT="unconfined_service_t" + fi + rlRun "sed -i 's/^ConditionVirtualization=.*$//' /usr/lib/systemd/system/ksm.service" + rlRun "systemctl daemon-reload" + rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /etc /run /var" 0-255 + rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlRun "systemctl daemon-reload" + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + From f24d1087c7ce09d551e3bd76ed328992d2499026 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Fri, 22 Apr 2022 14:40:16 +0200 Subject: [PATCH 150/626] Add a test for self keyword support in type rules Signed-off-by: Ondrej Mosnacek --- libsepol/self-keyword-in-type-rules/main.fmf | 27 ++++++ .../rules_expected.txt | 90 +++++++++++++++++++ .../self-keyword-in-type-rules/runtest.sh | 61 +++++++++++++ .../test_self_tt_bad1.cil | 6 ++ .../test_self_tt_bad1.te | 8 ++ .../test_self_tt_bad2.cil | 6 ++ .../test_self_tt_bad2.te | 8 ++ .../test_self_tt_bad3.cil | 11 +++ .../test_self_tt_bad3.te | 11 +++ .../test_self_tt_bad4.cil | 11 +++ .../test_self_tt_bad4.te | 11 +++ .../test_self_tt_bad5.cil | 6 ++ .../test_self_tt_bad5.te | 8 ++ .../test_self_tt_bad6.cil | 6 ++ .../test_self_tt_bad6.te | 8 ++ .../test_self_tt_bad7.cil | 11 +++ .../test_self_tt_bad7.te | 11 +++ .../test_self_tt_bad8.cil | 11 +++ .../test_self_tt_bad8.te | 11 +++ .../test_self_tt_good.cil | 56 ++++++++++++ .../test_self_tt_good.te | 42 +++++++++ 21 files changed, 420 insertions(+) create mode 100644 libsepol/self-keyword-in-type-rules/main.fmf create mode 100644 libsepol/self-keyword-in-type-rules/rules_expected.txt create mode 100755 libsepol/self-keyword-in-type-rules/runtest.sh create mode 100644 libsepol/self-keyword-in-type-rules/test_self_tt_bad1.cil create mode 100644 libsepol/self-keyword-in-type-rules/test_self_tt_bad1.te create mode 100644 libsepol/self-keyword-in-type-rules/test_self_tt_bad2.cil create mode 100644 libsepol/self-keyword-in-type-rules/test_self_tt_bad2.te create mode 100644 libsepol/self-keyword-in-type-rules/test_self_tt_bad3.cil create mode 100644 libsepol/self-keyword-in-type-rules/test_self_tt_bad3.te create mode 100644 libsepol/self-keyword-in-type-rules/test_self_tt_bad4.cil create mode 100644 libsepol/self-keyword-in-type-rules/test_self_tt_bad4.te create mode 100644 libsepol/self-keyword-in-type-rules/test_self_tt_bad5.cil create mode 100644 libsepol/self-keyword-in-type-rules/test_self_tt_bad5.te create mode 100644 libsepol/self-keyword-in-type-rules/test_self_tt_bad6.cil create mode 100644 libsepol/self-keyword-in-type-rules/test_self_tt_bad6.te create mode 100644 libsepol/self-keyword-in-type-rules/test_self_tt_bad7.cil create mode 100644 libsepol/self-keyword-in-type-rules/test_self_tt_bad7.te create mode 100644 libsepol/self-keyword-in-type-rules/test_self_tt_bad8.cil create mode 100644 libsepol/self-keyword-in-type-rules/test_self_tt_bad8.te create mode 100644 libsepol/self-keyword-in-type-rules/test_self_tt_good.cil create mode 100644 libsepol/self-keyword-in-type-rules/test_self_tt_good.te diff --git a/libsepol/self-keyword-in-type-rules/main.fmf b/libsepol/self-keyword-in-type-rules/main.fmf new file mode 100644 index 0000000..f54e8a6 --- /dev/null +++ b/libsepol/self-keyword-in-type-rules/main.fmf @@ -0,0 +1,27 @@ +summary: Test support for self keyword in type rules +description: | + Verifies that libsepol/checkmodule supports the self keyword in type rules. +contact: Ondrej Mosnacek +component: + - libsepol + - checkpolicy +framework: beakerlib +require: + - policycoreutils + - checkpolicy + - setools-console + - selinux-policy + - selinux-policy-devel + - diffutils +duration: 15m +tier: 2 +enabled: true +adjust: + - enabled: false + when: distro < rhel-9.1 + because: RHEL-8 and below are not expected to support this + - enabled: false + when: distro < fedora-37 + because: This feature may not be available in F36 and below +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2069718 diff --git a/libsepol/self-keyword-in-type-rules/rules_expected.txt b/libsepol/self-keyword-in-type-rules/rules_expected.txt new file mode 100644 index 0000000..239acc4 --- /dev/null +++ b/libsepol/self-keyword-in-type-rules/rules_expected.txt @@ -0,0 +1,90 @@ +type_change test_a_t test_a_t:dir test_e_t; +type_change test_a_t test_a_t:file test_e_t; +type_change test_b_t test_b_t:dir test_e_t; +type_change test_b_t test_b_t:file test_e_t; +type_change test_c_t test_c_t:dir test_e_t; +type_change test_c_t test_c_t:file test_e_t; +type_change test_d_t test_d_t:dir test_e_t; +type_change test_d_t test_d_t:file test_e_t; +type_change test_h_t test_a_t:dir test_e_t; +type_change test_h_t test_a_t:file test_e_t; +type_change test_h_t test_b_t:dir test_e_t; +type_change test_h_t test_b_t:file test_e_t; +type_change test_h_t test_c_t:dir test_e_t; +type_change test_h_t test_c_t:file test_e_t; +type_change test_h_t test_d_t:dir test_e_t; +type_change test_h_t test_d_t:file test_e_t; +type_change test_h_t test_h_t:dir test_e_t; +type_change test_h_t test_h_t:file test_e_t; +type_member test_a_t test_a_t:dir test_e_t; +type_member test_a_t test_a_t:file test_e_t; +type_member test_b_t test_b_t:dir test_e_t; +type_member test_b_t test_b_t:file test_e_t; +type_member test_c_t test_c_t:dir test_e_t; +type_member test_c_t test_c_t:file test_e_t; +type_member test_d_t test_d_t:dir test_e_t; +type_member test_d_t test_d_t:file test_e_t; +type_member test_h_t test_a_t:dir test_e_t; +type_member test_h_t test_a_t:file test_e_t; +type_member test_h_t test_b_t:dir test_e_t; +type_member test_h_t test_b_t:file test_e_t; +type_member test_h_t test_c_t:dir test_e_t; +type_member test_h_t test_c_t:file test_e_t; +type_member test_h_t test_d_t:dir test_e_t; +type_member test_h_t test_d_t:file test_e_t; +type_member test_h_t test_h_t:dir test_e_t; +type_member test_h_t test_h_t:file test_e_t; +type_transition test_a_t test_a_t:dir test_e_t; +type_transition test_a_t test_a_t:dir test_f_t filename1; +type_transition test_a_t test_a_t:dir test_g_t filename2; +type_transition test_a_t test_a_t:file test_e_t; +type_transition test_a_t test_a_t:file test_f_t filename1; +type_transition test_a_t test_a_t:file test_g_t filename2; +type_transition test_b_t test_b_t:dir test_e_t; +type_transition test_b_t test_b_t:dir test_f_t filename1; +type_transition test_b_t test_b_t:dir test_g_t filename2; +type_transition test_b_t test_b_t:file test_e_t; +type_transition test_b_t test_b_t:file test_f_t filename1; +type_transition test_b_t test_b_t:file test_g_t filename2; +type_transition test_c_t test_c_t:dir test_e_t; +type_transition test_c_t test_c_t:dir test_f_t filename1; +type_transition test_c_t test_c_t:dir test_g_t filename2; +type_transition test_c_t test_c_t:file test_e_t; +type_transition test_c_t test_c_t:file test_f_t filename1; +type_transition test_c_t test_c_t:file test_g_t filename2; +type_transition test_d_t test_d_t:dir test_e_t; +type_transition test_d_t test_d_t:dir test_f_t filename1; +type_transition test_d_t test_d_t:dir test_g_t filename2; +type_transition test_d_t test_d_t:file test_e_t; +type_transition test_d_t test_d_t:file test_f_t filename1; +type_transition test_d_t test_d_t:file test_g_t filename2; +type_transition test_h_t test_a_t:dir test_e_t; +type_transition test_h_t test_a_t:dir test_f_t filename1; +type_transition test_h_t test_a_t:dir test_g_t filename2; +type_transition test_h_t test_a_t:file test_e_t; +type_transition test_h_t test_a_t:file test_f_t filename1; +type_transition test_h_t test_a_t:file test_g_t filename2; +type_transition test_h_t test_b_t:dir test_e_t; +type_transition test_h_t test_b_t:dir test_f_t filename1; +type_transition test_h_t test_b_t:dir test_g_t filename2; +type_transition test_h_t test_b_t:file test_e_t; +type_transition test_h_t test_b_t:file test_f_t filename1; +type_transition test_h_t test_b_t:file test_g_t filename2; +type_transition test_h_t test_c_t:dir test_e_t; +type_transition test_h_t test_c_t:dir test_f_t filename1; +type_transition test_h_t test_c_t:dir test_g_t filename2; +type_transition test_h_t test_c_t:file test_e_t; +type_transition test_h_t test_c_t:file test_f_t filename1; +type_transition test_h_t test_c_t:file test_g_t filename2; +type_transition test_h_t test_d_t:dir test_e_t; +type_transition test_h_t test_d_t:dir test_f_t filename1; +type_transition test_h_t test_d_t:dir test_g_t filename2; +type_transition test_h_t test_d_t:file test_e_t; +type_transition test_h_t test_d_t:file test_f_t filename1; +type_transition test_h_t test_d_t:file test_g_t filename2; +type_transition test_h_t test_h_t:dir test_e_t; +type_transition test_h_t test_h_t:dir test_f_t filename1; +type_transition test_h_t test_h_t:dir test_g_t filename2; +type_transition test_h_t test_h_t:file test_e_t; +type_transition test_h_t test_h_t:file test_f_t filename1; +type_transition test_h_t test_h_t:file test_g_t filename2; diff --git a/libsepol/self-keyword-in-type-rules/runtest.sh b/libsepol/self-keyword-in-type-rules/runtest.sh new file mode 100755 index 0000000..982a2e9 --- /dev/null +++ b/libsepol/self-keyword-in-type-rules/runtest.sh @@ -0,0 +1,61 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# SPDX-License-Identifier: GPLv2 +# Copyright (c) 2022 Red Hat, Inc. +# Author: Ondrej Mosnacek + +# Include Beakerlib environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +MODULES_BAD="test_self_tt_bad1 test_self_tt_bad2 test_self_tt_bad3 test_self_tt_bad4" + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm "libsepol" + rlAssertRpm "checkpolicy" + rlAssertRpm "policycoreutils" + rlAssertRpm "selinux-policy" + rlPhaseEnd + + rlPhaseStartTest "Test good TE module" + rlRun "make -f /usr/share/selinux/devel/Makefile test_self_tt_good.pp" 0 \ + "Test that test_self_tt_good TE module can be built" + rlRun "semodule -i test_self_tt_good.pp" 0 \ + "Test that test_self_tt_good TE module can be installed" + rlRun "diff rules_expected.txt <(sesearch -T --type_change --type_member -rd -D 'test_[efg]_t' | sort)" 0 \ + "Test that the resulting binary policy rules match the expected ones" + rlRun "semodule -r test_self_tt_good" 0 \ + "Remove the test_self_tt_good TE module" + rlPhaseEnd + + rlPhaseStartTest "Test good CIL module" + rlRun "semodule -i test_self_tt_good.cil" 0 \ + "Test that test_self_tt_good CIL module can be installed" + rlRun "diff rules_expected.txt <(sesearch -T --type_change --type_member -rd -D 'test_[efg]_t' | sort)" 0 \ + "Test that the resulting binary policy rules match the expected ones" + rlRun "semodule -r test_self_tt_good" 0 \ + "Remove the test_self_tt_good CIL module" + rlPhaseEnd + + rlPhaseStartTest "Test bad TE modules" + for i in {1..8}; do + rlRun "make -f /usr/share/selinux/devel/Makefile test_self_tt_bad$i.pp" 0-2 \ + "Try to build test_self_tt_bad$i TE module" + rlRun "semodule -i test_self_tt_bad$i.pp" 1 \ + "Test that test_self_tt_bad$i TE module cannot be installed" + rlRun "semodule -r test_self_tt_bad$i" 1 \ + "Try to remove the test_self_tt_bad$i TE module" + done + rlPhaseEnd + + rlPhaseStartTest "Test bad CIL modules" + for i in {1..8}; do + rlRun "semodule -i test_self_tt_bad$i.cil" 1 \ + "Test that test_self_tt_bad$i CIL module cannot be installed" + rlRun "semodule -r test_self_tt_bad$i" 1 \ + "Try to remove the test_self_tt_bad$i CIL module" + done + rlPhaseEnd + + rlJournalPrintText +rlJournalEnd diff --git a/libsepol/self-keyword-in-type-rules/test_self_tt_bad1.cil b/libsepol/self-keyword-in-type-rules/test_self_tt_bad1.cil new file mode 100644 index 0000000..a686a2b --- /dev/null +++ b/libsepol/self-keyword-in-type-rules/test_self_tt_bad1.cil @@ -0,0 +1,6 @@ +(type test_a_t) +(type test_b_t) +(type test_c_t) + +(typetransition test_a_t self file test_b_t) +(typetransition test_a_t self file test_c_t) diff --git a/libsepol/self-keyword-in-type-rules/test_self_tt_bad1.te b/libsepol/self-keyword-in-type-rules/test_self_tt_bad1.te new file mode 100644 index 0000000..a788670 --- /dev/null +++ b/libsepol/self-keyword-in-type-rules/test_self_tt_bad1.te @@ -0,0 +1,8 @@ +policy_module(test_self_tt_bad1,1.0) + +type test_a_t; +type test_b_t; +type test_c_t; + +type_transition test_a_t self:file test_b_t; +type_transition test_a_t self:file test_c_t; diff --git a/libsepol/self-keyword-in-type-rules/test_self_tt_bad2.cil b/libsepol/self-keyword-in-type-rules/test_self_tt_bad2.cil new file mode 100644 index 0000000..a1815b1 --- /dev/null +++ b/libsepol/self-keyword-in-type-rules/test_self_tt_bad2.cil @@ -0,0 +1,6 @@ +(type test_a_t) +(type test_b_t) +(type test_c_t) + +(typetransition test_a_t self file test_b_t) +(typetransition test_a_t test_a_t file test_c_t) diff --git a/libsepol/self-keyword-in-type-rules/test_self_tt_bad2.te b/libsepol/self-keyword-in-type-rules/test_self_tt_bad2.te new file mode 100644 index 0000000..592880a --- /dev/null +++ b/libsepol/self-keyword-in-type-rules/test_self_tt_bad2.te @@ -0,0 +1,8 @@ +policy_module(test_self_tt_bad2,1.0) + +type test_a_t; +type test_b_t; +type test_c_t; + +type_transition test_a_t self:file test_b_t; +type_transition test_a_t test_a_t:file test_c_t; diff --git a/libsepol/self-keyword-in-type-rules/test_self_tt_bad3.cil b/libsepol/self-keyword-in-type-rules/test_self_tt_bad3.cil new file mode 100644 index 0000000..850305b --- /dev/null +++ b/libsepol/self-keyword-in-type-rules/test_self_tt_bad3.cil @@ -0,0 +1,11 @@ +(typeattribute test_attrib_1) + +(type test_a_t) +(type test_b_t) +(type test_c_t) +(type test_d_t) + +(typeattributeset test_attrib_1 (test_a_t test_b_t)) + +(typetransition test_attrib_1 self file test_b_t) +(typetransition test_a_t test_a_t file test_c_t) diff --git a/libsepol/self-keyword-in-type-rules/test_self_tt_bad3.te b/libsepol/self-keyword-in-type-rules/test_self_tt_bad3.te new file mode 100644 index 0000000..7be110a --- /dev/null +++ b/libsepol/self-keyword-in-type-rules/test_self_tt_bad3.te @@ -0,0 +1,11 @@ +policy_module(test_self_tt_bad3,1.0) + +attribute test_attrib_1; + +type test_a_t, test_attrib_1; +type test_b_t, test_attrib_1; +type test_c_t; +type test_d_t; + +type_transition test_attrib_1 self:file test_c_t; +type_transition test_a_t test_a_t:file test_d_t; diff --git a/libsepol/self-keyword-in-type-rules/test_self_tt_bad4.cil b/libsepol/self-keyword-in-type-rules/test_self_tt_bad4.cil new file mode 100644 index 0000000..0474094 --- /dev/null +++ b/libsepol/self-keyword-in-type-rules/test_self_tt_bad4.cil @@ -0,0 +1,11 @@ +(typeattribute test_attrib_1) + +(type test_a_t) +(type test_b_t) +(type test_c_t) +(type test_d_t) + +(typeattributeset test_attrib_1 (test_a_t test_b_t)) + +(typetransition test_a_t self file test_b_t) +(typetransition test_attrib_1 test_attrib_1 file test_c_t) diff --git a/libsepol/self-keyword-in-type-rules/test_self_tt_bad4.te b/libsepol/self-keyword-in-type-rules/test_self_tt_bad4.te new file mode 100644 index 0000000..2a2cd1e --- /dev/null +++ b/libsepol/self-keyword-in-type-rules/test_self_tt_bad4.te @@ -0,0 +1,11 @@ +policy_module(test_self_tt_bad4,1.0) + +attribute test_attrib_1; + +type test_a_t, test_attrib_1; +type test_b_t, test_attrib_1; +type test_c_t; +type test_d_t; + +type_transition test_a_t self:file test_c_t; +type_transition test_attrib_1 test_attrib_1:file test_d_t; diff --git a/libsepol/self-keyword-in-type-rules/test_self_tt_bad5.cil b/libsepol/self-keyword-in-type-rules/test_self_tt_bad5.cil new file mode 100644 index 0000000..6bd03d0 --- /dev/null +++ b/libsepol/self-keyword-in-type-rules/test_self_tt_bad5.cil @@ -0,0 +1,6 @@ +(type test_a_t) +(type test_b_t) +(type test_c_t) + +(typetransition test_a_t self file "filename" test_b_t) +(typetransition test_a_t self file "filename" test_c_t) diff --git a/libsepol/self-keyword-in-type-rules/test_self_tt_bad5.te b/libsepol/self-keyword-in-type-rules/test_self_tt_bad5.te new file mode 100644 index 0000000..53391c7 --- /dev/null +++ b/libsepol/self-keyword-in-type-rules/test_self_tt_bad5.te @@ -0,0 +1,8 @@ +policy_module(test_self_tt_bad1,1.0) + +type test_a_t; +type test_b_t; +type test_c_t; + +type_transition test_a_t self:file test_b_t "filename"; +type_transition test_a_t self:file test_c_t "filename"; diff --git a/libsepol/self-keyword-in-type-rules/test_self_tt_bad6.cil b/libsepol/self-keyword-in-type-rules/test_self_tt_bad6.cil new file mode 100644 index 0000000..c7c9a12 --- /dev/null +++ b/libsepol/self-keyword-in-type-rules/test_self_tt_bad6.cil @@ -0,0 +1,6 @@ +(type test_a_t) +(type test_b_t) +(type test_c_t) + +(typetransition test_a_t self file "filename" test_b_t) +(typetransition test_a_t test_a_t file "filename" test_c_t) diff --git a/libsepol/self-keyword-in-type-rules/test_self_tt_bad6.te b/libsepol/self-keyword-in-type-rules/test_self_tt_bad6.te new file mode 100644 index 0000000..e2c273d --- /dev/null +++ b/libsepol/self-keyword-in-type-rules/test_self_tt_bad6.te @@ -0,0 +1,8 @@ +policy_module(test_self_tt_bad6,1.0) + +type test_a_t; +type test_b_t; +type test_c_t; + +type_transition test_a_t self:file test_b_t "filename"; +type_transition test_a_t test_a_t:file test_c_t "filename"; diff --git a/libsepol/self-keyword-in-type-rules/test_self_tt_bad7.cil b/libsepol/self-keyword-in-type-rules/test_self_tt_bad7.cil new file mode 100644 index 0000000..e84100f --- /dev/null +++ b/libsepol/self-keyword-in-type-rules/test_self_tt_bad7.cil @@ -0,0 +1,11 @@ +(typeattribute test_attrib_1) + +(type test_a_t) +(type test_b_t) +(type test_c_t) +(type test_d_t) + +(typeattributeset test_attrib_1 (test_a_t test_b_t)) + +(typetransition test_attrib_1 self file "filename" test_b_t) +(typetransition test_a_t test_a_t file "filename" test_c_t) diff --git a/libsepol/self-keyword-in-type-rules/test_self_tt_bad7.te b/libsepol/self-keyword-in-type-rules/test_self_tt_bad7.te new file mode 100644 index 0000000..7b2f74e --- /dev/null +++ b/libsepol/self-keyword-in-type-rules/test_self_tt_bad7.te @@ -0,0 +1,11 @@ +policy_module(test_self_tt_bad7,1.0) + +attribute test_attrib_1; + +type test_a_t, test_attrib_1; +type test_b_t, test_attrib_1; +type test_c_t; +type test_d_t; + +type_transition test_attrib_1 self:file test_c_t "filename"; +type_transition test_a_t test_a_t:file test_d_t "filename"; diff --git a/libsepol/self-keyword-in-type-rules/test_self_tt_bad8.cil b/libsepol/self-keyword-in-type-rules/test_self_tt_bad8.cil new file mode 100644 index 0000000..b90d5a3 --- /dev/null +++ b/libsepol/self-keyword-in-type-rules/test_self_tt_bad8.cil @@ -0,0 +1,11 @@ +(typeattribute test_attrib_1) + +(type test_a_t) +(type test_b_t) +(type test_c_t) +(type test_d_t) + +(typeattributeset test_attrib_1 (test_a_t test_b_t)) + +(typetransition test_a_t self file "filename" test_b_t) +(typetransition test_attrib_1 test_attrib_1 file "filename" test_c_t) diff --git a/libsepol/self-keyword-in-type-rules/test_self_tt_bad8.te b/libsepol/self-keyword-in-type-rules/test_self_tt_bad8.te new file mode 100644 index 0000000..c649ec1 --- /dev/null +++ b/libsepol/self-keyword-in-type-rules/test_self_tt_bad8.te @@ -0,0 +1,11 @@ +policy_module(test_self_tt_bad8,1.0) + +attribute test_attrib_1; + +type test_a_t, test_attrib_1; +type test_b_t, test_attrib_1; +type test_c_t; +type test_d_t; + +type_transition test_a_t self:file test_c_t "filename"; +type_transition test_attrib_1 test_attrib_1:file test_d_t "filename"; diff --git a/libsepol/self-keyword-in-type-rules/test_self_tt_good.cil b/libsepol/self-keyword-in-type-rules/test_self_tt_good.cil new file mode 100644 index 0000000..48dc17c --- /dev/null +++ b/libsepol/self-keyword-in-type-rules/test_self_tt_good.cil @@ -0,0 +1,56 @@ +(typeattribute test_attrib_1) + +(type test_a_t) +(type test_b_t) +(type test_c_t) +(type test_d_t) +(type test_e_t) +(type test_f_t) +(type test_g_t) +(type test_h_t) + +(typeattributeset test_attrib_1 (test_a_t test_b_t test_c_t)) + +(classmap file_dir (set_1)) +(classmapping file_dir set_1 (file (all))) +(classmapping file_dir set_1 (dir (all))) + +(typetransition test_d_t self file_dir test_e_t) +(typetransition test_d_t self file_dir "filename1" test_f_t) +(typetransition test_d_t self file_dir "filename2" test_g_t) + +; duplicate equivalent rules should be allowed +(typetransition test_d_t test_d_t file_dir test_e_t) +(typetransition test_d_t test_d_t file_dir "filename1" test_f_t) +(typetransition test_d_t test_d_t file_dir "filename2" test_g_t) + +(typetransition test_attrib_1 self file_dir test_e_t) +(typetransition test_attrib_1 self file_dir "filename1" test_f_t) +(typetransition test_attrib_1 self file_dir "filename2" test_g_t) + +; CIL doesn't support inline type sets, so just add these rules +; to match the TE version +(typetransition test_h_t test_d_t file_dir test_e_t) +(typetransition test_h_t test_attrib_1 file_dir test_e_t) +(typetransition test_h_t self file_dir test_e_t) +(typetransition test_h_t test_d_t file_dir "filename1" test_f_t) +(typetransition test_h_t test_attrib_1 file_dir "filename1" test_f_t) +(typetransition test_h_t self file_dir "filename1" test_f_t) +(typetransition test_h_t test_d_t file_dir "filename2" test_g_t) +(typetransition test_h_t test_attrib_1 file_dir "filename2" test_g_t) +(typetransition test_h_t self file_dir "filename2" test_g_t) + +; test typechange and typemember as well +(typechange test_d_t self file_dir test_e_t) +(typechange test_d_t test_d_t file_dir test_e_t) +(typechange test_attrib_1 self file_dir test_e_t) +(typechange test_h_t test_d_t file_dir test_e_t) +(typechange test_h_t test_attrib_1 file_dir test_e_t) +(typechange test_h_t self file_dir test_e_t) + +(typemember test_d_t self file_dir test_e_t) +(typemember test_d_t test_d_t file_dir test_e_t) +(typemember test_attrib_1 self file_dir test_e_t) +(typemember test_h_t test_d_t file_dir test_e_t) +(typemember test_h_t test_attrib_1 file_dir test_e_t) +(typemember test_h_t self file_dir test_e_t) diff --git a/libsepol/self-keyword-in-type-rules/test_self_tt_good.te b/libsepol/self-keyword-in-type-rules/test_self_tt_good.te new file mode 100644 index 0000000..4028741 --- /dev/null +++ b/libsepol/self-keyword-in-type-rules/test_self_tt_good.te @@ -0,0 +1,42 @@ +policy_module(test_self_tt_good,1.0) + +attribute test_attrib_1; + +type test_a_t, test_attrib_1; +type test_b_t, test_attrib_1; +type test_c_t, test_attrib_1; +type test_d_t; +type test_e_t; +type test_f_t; +type test_g_t; +type test_h_t; + +type_transition test_d_t self:{ file dir } test_e_t; +type_transition test_d_t self:{ file dir } test_f_t "filename1"; +type_transition test_d_t self:{ file dir } test_g_t "filename2"; + +# duplicate equivalent rules should be allowed +type_transition test_d_t test_d_t:{ file dir } test_e_t; +# ...but not for _filename_ transitions ¯\_(ツ)_/¯ +#type_transition test_d_t test_d_t:{ file dir } test_f_t "filename1"; +#type_transition test_d_t test_d_t:{ file dir } test_g_t "filename2"; + +type_transition test_attrib_1 self:{ file dir } test_e_t; +type_transition test_attrib_1 self:{ file dir } test_f_t "filename1"; +type_transition test_attrib_1 self:{ file dir } test_g_t "filename2"; + +# check this fancy syntax as well +type_transition test_h_t { test_d_t test_attrib_1 self }:{ file dir } test_e_t; +type_transition test_h_t { test_d_t test_attrib_1 self }:{ file dir } test_f_t "filename1"; +type_transition test_h_t { test_d_t test_attrib_1 self }:{ file dir } test_g_t "filename2"; + +# test type_change and type_member as well +type_change test_d_t self:{ file dir } test_e_t; +type_change test_d_t test_d_t:{ file dir } test_e_t; +type_change test_attrib_1 self:{ file dir } test_e_t; +type_change test_h_t { test_d_t test_attrib_1 self }:{ file dir } test_e_t; + +type_member test_d_t self:{ file dir } test_e_t; +type_member test_d_t test_d_t:{ file dir } test_e_t; +type_member test_attrib_1 self:{ file dir } test_e_t; +type_member test_h_t { test_d_t test_attrib_1 self }:{ file dir } test_e_t; From b0e50d2418c4f4309f3e39f9db012c69ff55491e Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Thu, 2 Jun 2022 15:00:18 +0200 Subject: [PATCH 151/626] test if stalld process can use sched_setattr syscall The following messages found in the systemd journal revealed that the stalld service cannot perform all operations it wants: stalld[...]: boost_with_deadline failed to boost pid 0: Operation not permitted stalld[...]: boost_with_fifo failed to boost pid 0: Operation not permitted stalld[...]: boost_with_deadline failed to boost pid 0: Permission denied stalld[...]: boost_with_fifo failed to boost pid 0: Permission denied Unfortunately, SELinux policy contains a dontaudit rule which hides SELinux denials triggered by the stalld service in this situation. In order to fix the issue, SELinux policy should allow the sys_nice capability and the setsched permission to the stalld_t labeled processes. The TC runs the stalld service and looks for such rules. The TC covers BZ#2092864. --- selinux-policy/stalld-and-similar/Makefile | 1 + selinux-policy/stalld-and-similar/main.fmf | 3 ++- selinux-policy/stalld-and-similar/runtest.sh | 9 +++++++++ 3 files changed, 12 insertions(+), 1 deletion(-) diff --git a/selinux-policy/stalld-and-similar/Makefile b/selinux-policy/stalld-and-similar/Makefile index 4a4124a..71dd28f 100644 --- a/selinux-policy/stalld-and-similar/Makefile +++ b/selinux-policy/stalld-and-similar/Makefile @@ -64,6 +64,7 @@ $(METADATA): Makefile @echo "Destructive: no" >> $(METADATA) @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA) @echo "Bug: 2042614" >> $(METADATA) # RHEL-9 + @echo "Bug: 2092864" >> $(METADATA) # RHEL-9 rhts-lint $(METADATA) diff --git a/selinux-policy/stalld-and-similar/main.fmf b/selinux-policy/stalld-and-similar/main.fmf index a1196b2..4aa8e13 100644 --- a/selinux-policy/stalld-and-similar/main.fmf +++ b/selinux-policy/stalld-and-similar/main.fmf @@ -32,7 +32,8 @@ tag: - targeted tier: '2' link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2042614 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2042614 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2092864 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 diff --git a/selinux-policy/stalld-and-similar/runtest.sh b/selinux-policy/stalld-and-similar/runtest.sh index 0624de5..8624863 100755 --- a/selinux-policy/stalld-and-similar/runtest.sh +++ b/selinux-policy/stalld-and-similar/runtest.sh @@ -73,25 +73,34 @@ rlJournalStart rlSESearchRule "allow ${PROCESS_CONTEXT} debugfs_t : file { getattr open read } [ ]" rlPhaseEnd + rlPhaseStartTest "bz#2092864" + rlSESearchRule "allow stalld_t stalld_t : capability { sys_nice } [ ]" + rlSESearchRule "allow stalld_t stalld_t : process { setsched } [ ]" + rlPhaseEnd + rlPhaseStartTest "real scenario -- standalone service" if ! rlSEDefined ${PROCESS_CONTEXT} ; then PROCESS_CONTEXT="unconfined_service_t" fi rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 rlRun "sed -i 's/^LOGGING=.*$/LOGGING=--log_syslog/' /etc/sysconfig/stalld" + rlRun "journalctl -u ${SERVICE_NAME} > before.txt" rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status" 1 rlRun "sed -i 's/^LOGGING=.*$/LOGGING=--log_kmsg/' /etc/sysconfig/stalld" + rlRun "journalctl -u ${SERVICE_NAME} > after.txt" rlRun "setsebool domain_can_write_kmsg on" rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status" 1 rlRun "restorecon -Rv /run /var" 0-255 rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "stop status" 1 rlRun "setsebool domain_can_write_kmsg off" + rlRun "diff before.txt after.txt | grep -i -e 'operation not permitted' -e 'permission denied'" 1 rlPhaseEnd rlPhaseStartCleanup sleep 2 rlSECheckAVC + rm -f before.txt after.txt rlFileRestore rlServiceRestore ${SERVICE_NAME} rlPhaseEnd From 12dd91c7d4b723a91eebcde12f8d61c550b63e45 Mon Sep 17 00:00:00 2001 From: Zdenek Pytela Date: Tue, 7 Jun 2022 11:08:54 +0200 Subject: [PATCH 152/626] avoid testing empty CIL modules SELinux user-space version 3.3 and higher does not support loading of empty CIL modules. If such version is installed, one of the test phases will be skipped. This commit changes existing code to using rlTestVersion. --- policycoreutils/CIL-modules-without-compilation/runtest.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/policycoreutils/CIL-modules-without-compilation/runtest.sh b/policycoreutils/CIL-modules-without-compilation/runtest.sh index 8e96081..f47e67f 100755 --- a/policycoreutils/CIL-modules-without-compilation/runtest.sh +++ b/policycoreutils/CIL-modules-without-compilation/runtest.sh @@ -41,7 +41,7 @@ rlJournalStart rlPhaseEnd # version 3.3 of SELinux user-space does not accept empty CIL module - if echo "${PACKAGE_VERSION} < 3.3" | bc | grep -q 1 ; then + if rlTestVersion "${PACKAGE_VERSION}" "<" "3.3" ; then rlPhaseStartTest "empty CIL module" rlRun "semodule -lfull | grep '400.*empty.*cil'" 1 rlRun "semodule -i empty.cil" From 66bf874becc32987607e863a7ff592e98442730f Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Tue, 7 Jun 2022 16:21:14 +0200 Subject: [PATCH 153/626] kernel/selinux-testsuite: bump upstream commit The only effective difference is that the broken SCTP ASCONF tests will now be skipped, see: https://github.com/SELinuxProject/selinux-testsuite/commit/3e93ece73da162fe58f9ec7d16b01915a4568c11 Signed-off-by: Ondrej Mosnacek --- kernel/selinux-testsuite/runtest.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kernel/selinux-testsuite/runtest.sh b/kernel/selinux-testsuite/runtest.sh index 496b11c..af2f1f1 100755 --- a/kernel/selinux-testsuite/runtest.sh +++ b/kernel/selinux-testsuite/runtest.sh @@ -35,13 +35,13 @@ PACKAGE="selinux-policy" # This should be updated as needed after verifying that the new version # doesn't break testing and after applying all necessary tweaks in the TC. # Run with GIT_BRANCH=master to run the latest upstream version. -DEFAULT_COMMIT="b11701a55614eeb20e85fee9829d1699cc13c39a" +DEFAULT_COMMIT="3e93ece73da162fe58f9ec7d16b01915a4568c11" # Default pull requests to merge before running the test. # If non-empty, then after checking out GIT_BRANCH the listed upstream pull # requests (by number) are merged, creating a new temporary local branch. DEFAULT_PULLS="" # Default SELinux Patchwork series to apply before running the test. -DEFAULT_PATCHES="634066" +DEFAULT_PATCHES="" # Optional test parameter - location of testuite git. GIT_URL=${GIT_URL:-"https://github.com/SELinuxProject/selinux-testsuite"} From b322ded7698608fcf39a047f25297e6b9913b31f Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 7 Jun 2022 11:15:27 +0200 Subject: [PATCH 154/626] test if ksmctl process can create /sys/kernel/mm/ksm/run file Recent use of the ksm service revealed that SELinux prevents the ksmctl process from creating the run file in the /sys/kernel/mm/ksm/ directory. The TC reproduces the situation. The ksmctl binary contains the following locations (the strings command found them): * /sys/kernel/mm/ksm/run * /sys/kernel/mm/ksm/max_kernel_pages In order to make the ksm service fully functional, I believe that SELinux policy should allow the create access to these files. The TC looks for appropriate policy rules and file context patterns. The TC covers BZ#2091416, BZ#2091417 and BZ#2091418. --- selinux-policy/ksm-and-similar/Makefile | 3 +++ selinux-policy/ksm-and-similar/main.fmf | 11 +++++++++-- selinux-policy/ksm-and-similar/runtest.sh | 8 ++++++++ 3 files changed, 20 insertions(+), 2 deletions(-) diff --git a/selinux-policy/ksm-and-similar/Makefile b/selinux-policy/ksm-and-similar/Makefile index 9ff17b0..9a107c7 100644 --- a/selinux-policy/ksm-and-similar/Makefile +++ b/selinux-policy/ksm-and-similar/Makefile @@ -63,6 +63,9 @@ $(METADATA): Makefile @echo "Destructive: no" >> $(METADATA) @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) @echo "Bug: 2021131" >> $(METADATA) # RHEL-9 + @echo "Bug: 2091416" >> $(METADATA) # Fedora 36 + @echo "Bug: 2091417" >> $(METADATA) # Fedora 36 + @echo "Bug: 2091418" >> $(METADATA) # Fedora 36 rhts-lint $(METADATA) diff --git a/selinux-policy/ksm-and-similar/main.fmf b/selinux-policy/ksm-and-similar/main.fmf index ebab863..64fcdfe 100644 --- a/selinux-policy/ksm-and-similar/main.fmf +++ b/selinux-policy/ksm-and-similar/main.fmf @@ -1,6 +1,6 @@ summary: SELinux interferes with ksm and related programs description: |+ - SELinux interferes with ksm and related programs. + SELinux interferes with the ksm service (the ksmctl program) and related programs. contact: Milos Malik component: @@ -26,12 +26,19 @@ tag: - NoRHEL5 - NoRHEL6 - NoRHEL7 + - Tier2 + - Tier2se - targeted +tier: '2' link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2021131 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2021131 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2091416 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2091417 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2091418 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 continue: false +extra-nitrate: TC#0613684 extra-summary: /CoreOS/selinux-policy/Regression/ksm-and-similar extra-task: /CoreOS/selinux-policy/Regression/ksm-and-similar diff --git a/selinux-policy/ksm-and-similar/runtest.sh b/selinux-policy/ksm-and-similar/runtest.sh index 4e19de9..21d276f 100755 --- a/selinux-policy/ksm-and-similar/runtest.sh +++ b/selinux-policy/ksm-and-similar/runtest.sh @@ -69,6 +69,14 @@ rlJournalStart rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" rlSESearchRule "allow ${PROCESS_CONTEXT} sysfs_t : dir { write } [ ]" rlPhaseEnd + + rlPhaseStartTest "bz#2091416 + bz#2091417 + bz#2091418" + rlSEMatchPathCon "/usr/libexec/ksmctl" "ksm_exec_t" + rlSEMatchPathCon "/sys/kernel/mm/ksm" "sysfs_t" + rlSEMatchPathCon "/sys/kernel/mm/ksm/run" "sysfs_t" + rlSESearchRule "allow ksm_t sysfs_t : dir { write add_name } [ ]" + rlSESearchRule "allow ksm_t sysfs_t : file { create } [ ]" + rlPhaseEnd fi rlPhaseStartTest "real scenario -- standalone service" From 341a2e48cabe3aadd6499feb8f04ca0c3b8472d1 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 14 Jun 2022 16:36:47 +0200 Subject: [PATCH 155/626] test if stalld can use sched_getattr on kernel Recent stalld testing revealed that SELinux prevents the stalld processes from using the sched_getattr syscall on the running kernel. The TC does not reproduce the situation. In order to fix the SELinux denials, SELinux policy should either allow or dontaudit the use of sched_getattr syscall. The TC looks for appropriate policy rules. The TC covers BZ#2096776. --- selinux-policy/stalld-and-similar/Makefile | 1 + selinux-policy/stalld-and-similar/main.fmf | 1 + selinux-policy/stalld-and-similar/runtest.sh | 4 ++++ 3 files changed, 6 insertions(+) diff --git a/selinux-policy/stalld-and-similar/Makefile b/selinux-policy/stalld-and-similar/Makefile index 71dd28f..b15214c 100644 --- a/selinux-policy/stalld-and-similar/Makefile +++ b/selinux-policy/stalld-and-similar/Makefile @@ -65,6 +65,7 @@ $(METADATA): Makefile @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA) @echo "Bug: 2042614" >> $(METADATA) # RHEL-9 @echo "Bug: 2092864" >> $(METADATA) # RHEL-9 + @echo "Bug: 2096776" >> $(METADATA) # RHEL-9 rhts-lint $(METADATA) diff --git a/selinux-policy/stalld-and-similar/main.fmf b/selinux-policy/stalld-and-similar/main.fmf index 4aa8e13..23f4aaf 100644 --- a/selinux-policy/stalld-and-similar/main.fmf +++ b/selinux-policy/stalld-and-similar/main.fmf @@ -34,6 +34,7 @@ tier: '2' link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2042614 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2092864 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2096776 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 diff --git a/selinux-policy/stalld-and-similar/runtest.sh b/selinux-policy/stalld-and-similar/runtest.sh index 8624863..28ebee0 100755 --- a/selinux-policy/stalld-and-similar/runtest.sh +++ b/selinux-policy/stalld-and-similar/runtest.sh @@ -78,6 +78,10 @@ rlJournalStart rlSESearchRule "allow stalld_t stalld_t : process { setsched } [ ]" rlPhaseEnd + rlPhaseStartTest "bz#2096776" + rlSESearchRule "allow stalld_t kernel_t : process { getsched } [ ]" + rlPhaseEnd + rlPhaseStartTest "real scenario -- standalone service" if ! rlSEDefined ${PROCESS_CONTEXT} ; then PROCESS_CONTEXT="unconfined_service_t" From 0566a3c8892688983f39f936bb3498fa9ad46a76 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 7 Jun 2022 09:12:19 +0200 Subject: [PATCH 156/626] test if fedora-third-party process can read /etc/passwd file Recent manual testing of the fedora-third-party-refresh service revealed that SELinux prevents the fedora-third-party process from reading the /etc/passwd file. The TC reproduces the situation. Interestingly, the fedora-third-party-refresh service starts and succeeds even if the access is denied, which means that SELinux policy can either allow or dontaudit the access. The TC looks for appropriate policy rules and file context patterns. The TC covers BZ#2093453. --- .../fedora-third-party-and-similar/Makefile | 68 ++++++++++++++ .../fedora-third-party-and-similar/PURPOSE | 5 ++ .../fedora-third-party-and-similar/main.fmf | 45 ++++++++++ .../fedora-third-party-and-similar/runtest.sh | 89 +++++++++++++++++++ 4 files changed, 207 insertions(+) create mode 100644 selinux-policy/fedora-third-party-and-similar/Makefile create mode 100644 selinux-policy/fedora-third-party-and-similar/PURPOSE create mode 100644 selinux-policy/fedora-third-party-and-similar/main.fmf create mode 100755 selinux-policy/fedora-third-party-and-similar/runtest.sh diff --git a/selinux-policy/fedora-third-party-and-similar/Makefile b/selinux-policy/fedora-third-party-and-similar/Makefile new file mode 100644 index 0000000..0f350ab --- /dev/null +++ b/selinux-policy/fedora-third-party-and-similar/Makefile @@ -0,0 +1,68 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/fedora-third-party-and-similar +# Description: SELinux interferes with the fedora-third-party service and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2022 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/fedora-third-party-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with the fedora-third-party service and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console /usr/sbin/service fedora-third-party" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8 -RHEL9" >> $(METADATA) + @echo "Bug: 2093453" >> $(METADATA) # Fedora 37 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/fedora-third-party-and-similar/PURPOSE b/selinux-policy/fedora-third-party-and-similar/PURPOSE new file mode 100644 index 0000000..a57c27d --- /dev/null +++ b/selinux-policy/fedora-third-party-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/fedora-third-party-and-similar +Author: Milos Malik + +SELinux interferes with the fedora-third-party service and related programs. + diff --git a/selinux-policy/fedora-third-party-and-similar/main.fmf b/selinux-policy/fedora-third-party-and-similar/main.fmf new file mode 100644 index 0000000..f44e863 --- /dev/null +++ b/selinux-policy/fedora-third-party-and-similar/main.fmf @@ -0,0 +1,45 @@ +summary: SELinux interferes with the fedora-third-party service and related programs +description: |+ + SELinux interferes with the fedora-third-party service and related programs. + +contact: Milos Malik +component: + - selinux-policy +test: ./runtest.sh +framework: beakerlib +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - /usr/sbin/service + - fedora-third-party +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - NoRHEL8 + - NoRHEL9 + - Tier2 + - Tier2se + - targeted +tier: '2' +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2093453 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, rhel-9 + continue: false +extra-summary: /CoreOS/selinux-policy/Regression/fedora-third-party-and-similar +extra-task: /CoreOS/selinux-policy/Regression/fedora-third-party-and-similar + diff --git a/selinux-policy/fedora-third-party-and-similar/runtest.sh b/selinux-policy/fedora-third-party-and-similar/runtest.sh new file mode 100755 index 0000000..54c4031 --- /dev/null +++ b/selinux-policy/fedora-third-party-and-similar/runtest.sh @@ -0,0 +1,89 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/fedora-third-party-and-similar +# Description: SELinux interferes with the fedora-third-party service and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2022 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +FILE_PATH="/usr/bin/fedora-third-party" +FILE_CONTEXT="fedoratp_exec_t" +SERVICE_PACKAGE="fedora-third-party" +SERVICE_NAME="fedora-third-party-refresh" +PROCESS_NAME="fedora-third-party" +PROCESS_CONTEXT="fedoratp_t" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} + rlFileBackup --missing-ok /run/ostree-booted + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "bz#2093453" + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + rlSEMatchPathCon "/etc/passwd" "passwd_file_t" + SOURCE_TYPE="init_t" # systemd runs the process + rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" + rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" + rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" + rlSESearchRule "allow ${PROCESS_CONTEXT} passwd_file_t : file { getattr open read } [ ]" + rlPhaseEnd + + rlPhaseStartTest "real scenario -- standalone service" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + # for OSes where the SELinux domain does not exist yet + PROCESS_CONTEXT="unconfined_service_t" + fi + rlRun "touch /run/ostree-booted" + rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /etc /var /run" + rlRun "fedora-third-party list" + rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlRun "rm -f /run/ostree-booted" + rlFileRestore + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + From 9cb79c94c6cee7612c83ef3d0799e3f2bba4f654 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 21 Jun 2022 11:35:35 +0200 Subject: [PATCH 157/626] test if setfiles works correctly in chroot-ed environment Recent use of the setfiles program in chroot-ed environment revealed the following error messages: /usr/sbin/setfiles: Could not set context for /usr/include: No such file or directory The problem was identified and fixed in the libselinux code. Purpose of this TC is to test whether the fixfiles behaves correctly in such environments. The TC covers BZ#2094683. --- libselinux/setfiles-in-chroot-env/Makefile | 66 +++++++++++++++++++ libselinux/setfiles-in-chroot-env/PURPOSE | 5 ++ libselinux/setfiles-in-chroot-env/main.fmf | 21 ++++++ libselinux/setfiles-in-chroot-env/runtest.sh | 53 +++++++++++++++ .../setfiles-in-chroot-env/test-script.sh | 7 ++ 5 files changed, 152 insertions(+) create mode 100644 libselinux/setfiles-in-chroot-env/Makefile create mode 100644 libselinux/setfiles-in-chroot-env/PURPOSE create mode 100644 libselinux/setfiles-in-chroot-env/main.fmf create mode 100755 libselinux/setfiles-in-chroot-env/runtest.sh create mode 100755 libselinux/setfiles-in-chroot-env/test-script.sh diff --git a/libselinux/setfiles-in-chroot-env/Makefile b/libselinux/setfiles-in-chroot-env/Makefile new file mode 100644 index 0000000..7d5c948 --- /dev/null +++ b/libselinux/setfiles-in-chroot-env/Makefile @@ -0,0 +1,66 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/libselinux/Regression/setfiles-in-chroot-env +# Description: Does setfiles work correctly in chroot environment? +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2022 Red Hat, Inc. +# +# This program is free software: you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation, either version 2 of +# the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see http://www.gnu.org/licenses/. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/libselinux/Regression/setfiles-in-chroot-env +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE test-script.sh + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + test -x runtest.sh || chmod a+x runtest.sh + test -x test-script.sh || chmod a+x test-script.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: Does setfiles work correctly in chroot environment?" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 15m" >> $(METADATA) + @echo "RunFor: libselinux" >> $(METADATA) + @echo "RunFor: policycoreutils" >> $(METADATA) + @echo "Requires: libselinux policycoreutils" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2+" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) + @echo "Bug: 2094683" >> $(METADATA) # RHEL-9 + + rhts-lint $(METADATA) + diff --git a/libselinux/setfiles-in-chroot-env/PURPOSE b/libselinux/setfiles-in-chroot-env/PURPOSE new file mode 100644 index 0000000..5402a21 --- /dev/null +++ b/libselinux/setfiles-in-chroot-env/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/libselinux/Regression/setfiles-in-chroot-env +Author: Milos Malik + +Does setfiles work correctly in chroot environment? + diff --git a/libselinux/setfiles-in-chroot-env/main.fmf b/libselinux/setfiles-in-chroot-env/main.fmf new file mode 100644 index 0000000..074d84a --- /dev/null +++ b/libselinux/setfiles-in-chroot-env/main.fmf @@ -0,0 +1,21 @@ +summary: Does setfiles work correctly in chroot environment? +description: | + Does setfiles work correctly in chroot environment? + +contact: Milos Malik +component: + - libselinux +test: ./runtest.sh +framework: beakerlib +recommend: + - libselinux + - policycoreutils +duration: 15m +enabled: true +tag: + - targeted +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2094683 +extra-summary: /CoreOS/libselinux/Regression/setfiles-in-chroot-env +extra-task: /CoreOS/libselinux/Regression/setfiles-in-chroot-env + diff --git a/libselinux/setfiles-in-chroot-env/runtest.sh b/libselinux/setfiles-in-chroot-env/runtest.sh new file mode 100755 index 0000000..d9afeb2 --- /dev/null +++ b/libselinux/setfiles-in-chroot-env/runtest.sh @@ -0,0 +1,53 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/libselinux/Regression/setfiles-in-chroot-env +# Description: Does setfiles work correctly in chroot environment? +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2022 Red Hat, Inc. +# +# This program is free software: you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation, either version 2 of +# the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see http://www.gnu.org/licenses/. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="libselinux" +CHROOT_DIR=`mktemp -d` + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm ${PACKAGE} + rlAssertRpm policycoreutils + rlPhaseEnd + + rlPhaseStartTest "bz#2094683" + rlRun "yum -y install filesystem policycoreutils selinux-policy-targeted --installroot=${CHROOT_DIR} --disablerepo 'epel*'" + rlRun "cp ./test-script.sh ${CHROOT_DIR}/usr/bin/" + rlRun -s "chroot ${CHROOT_DIR} /usr/bin/test-script.sh" + rlRun "grep -i -e 'no such file or directory' -e 'not set context' $rlRun_LOG" 1 + rm -f $rlRun_LOG + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "rm -rf ${CHROOT_DIR}" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/libselinux/setfiles-in-chroot-env/test-script.sh b/libselinux/setfiles-in-chroot-env/test-script.sh new file mode 100755 index 0000000..d20ba83 --- /dev/null +++ b/libselinux/setfiles-in-chroot-env/test-script.sh @@ -0,0 +1,7 @@ +#!/bin/bash + +sestatus +ls -lZ / +/usr/sbin/setfiles -F /etc/selinux/targeted/contexts/files/file_contexts / +ls -lZ / + From 9c17ff1ea707291c6052b26c55f6cc6a5c80f903 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Wed, 15 Jun 2022 09:36:30 +0200 Subject: [PATCH 158/626] add new systemd-creds test One of the new systemd features allows passing secret credentials to various services, but SELinux prevents all sd-mkdcreds processes running as init_t from accessing all /dev/shm/.#cred* files. The TC reproduces the situation. In order to support this systemd feature, SELinux policy should allow these actions. The TC looks for appropriate policy rules and file context patterns. The TC covers BZ#2096857 and BZ#2097681. --- selinux-policy/systemd-creds/Makefile | 69 +++++++++++++++++++ selinux-policy/systemd-creds/PURPOSE | 9 +++ selinux-policy/systemd-creds/dmesg.service | 4 ++ selinux-policy/systemd-creds/main.fmf | 36 ++++++++++ selinux-policy/systemd-creds/runtest.sh | 80 ++++++++++++++++++++++ 5 files changed, 198 insertions(+) create mode 100644 selinux-policy/systemd-creds/Makefile create mode 100644 selinux-policy/systemd-creds/PURPOSE create mode 100644 selinux-policy/systemd-creds/dmesg.service create mode 100644 selinux-policy/systemd-creds/main.fmf create mode 100755 selinux-policy/systemd-creds/runtest.sh diff --git a/selinux-policy/systemd-creds/Makefile b/selinux-policy/systemd-creds/Makefile new file mode 100644 index 0000000..83eda9d --- /dev/null +++ b/selinux-policy/systemd-creds/Makefile @@ -0,0 +1,69 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/systemd-creds +# Description: SELinux interferes with services which use credentials +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2022 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/systemd-creds +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE dmesg.service + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with services which use credentials" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console systemd" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA) + @echo "Bug: 2096857" >> $(METADATA) # Fedora 36 + @echo "Bug: 2097681" >> $(METADATA) # Fedora 36 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/systemd-creds/PURPOSE b/selinux-policy/systemd-creds/PURPOSE new file mode 100644 index 0000000..ca6475f --- /dev/null +++ b/selinux-policy/systemd-creds/PURPOSE @@ -0,0 +1,9 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/systemd-creds +Author: Milos Malik + +SELinux interferes with services which use credentials: + * LoadCredential= + * LoadCredentialEncrypted= + +More about this systemd feature can be found at https://systemd.io/CREDENTIALS/ + diff --git a/selinux-policy/systemd-creds/dmesg.service b/selinux-policy/systemd-creds/dmesg.service new file mode 100644 index 0000000..661f441 --- /dev/null +++ b/selinux-policy/systemd-creds/dmesg.service @@ -0,0 +1,4 @@ +[Service] +ExecStart=/usr/bin/dmesg +LoadCredentialEncrypted=bar:/bar + diff --git a/selinux-policy/systemd-creds/main.fmf b/selinux-policy/systemd-creds/main.fmf new file mode 100644 index 0000000..11d0693 --- /dev/null +++ b/selinux-policy/systemd-creds/main.fmf @@ -0,0 +1,36 @@ +summary: SELinux interferes with services which use credentials +description: |+ + SELinux interferes with services which use credentials + +contact: Milos Malik +component: + - selinux-policy +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - systemd +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - Tier2 + - Tier2se +tier: '2' +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 + because: the systemd-creds program is not available there +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2096857 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2097681 +extra-nitrate: TC#0613921 +extra-summary: /CoreOS/selinux-policy/Regression/systemd-creds +extra-task: /CoreOS/selinux-policy/Regression/systemd-creds diff --git a/selinux-policy/systemd-creds/runtest.sh b/selinux-policy/systemd-creds/runtest.sh new file mode 100755 index 0000000..643f9df --- /dev/null +++ b/selinux-policy/systemd-creds/runtest.sh @@ -0,0 +1,80 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/systemd-creds +# Description: SELinux interferes with services which use credentials +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2022 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +SERVICE_PACKAGE="systemd" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlRun "cp dmesg.service /etc/systemd/system/" + rlRun "systemctl daemon-reload" + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "bz#2096857 + bz#2097681" + rlSEMatchPathCon "/usr/bin/systemd-creds" "bin_t" + rlRun "seinfo --genfscon | grep :ramfs_t" + rlSESearchRule "allow init_t ramfs_t : file { read write open setattr rename create } [ ]" + rlPhaseEnd + + rlPhaseStartTest "a systemd service loading credentials" + rlRun "echo hello > /foo" + rlRun "ls -alZ /foo" + rlRun "systemd-creds encrypt /foo /bar" + rlRun "ls -alZ /bar" + rlRun "systemctl start dmesg.service" 0-255 + rlRun "systemctl status dmesg.service" 0-255 + rlRun "systemctl stop dmesg.service" 0-255 + rlRun "systemctl status dmesg.service" 0-255 + rlRun "rm -f /foo /bar" + rlRun "systemd-run -P --wait -p LoadCredential=abc:/etc/hosts systemd-creds cat abc" + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlRun "rm -f /etc/systemd/system/dmesg.service" + rlRun "systemctl daemon-reload" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + From 7710067379c87637e0314c382f2269d91f77cbf8 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Thu, 16 Jun 2022 16:48:00 +0200 Subject: [PATCH 159/626] test if dhclient-script can access /run/chrony-dhcp/ and its content Frequent use of the dhclient program in various environments revealed that SELinux prevents the /etc/dhcp/dhclient.d/chrony.sh script from appending to files stored in the /run/chrony-dhcp/ directory. The TC reproduces the situation. Because the /etc/dhcp/dhclient.d/chrony.sh script is brought by the chrony package and the scripts in the /etc/dhcp/dhclient.d/ directory are by default executed by the dhclient-script program, I believe that SELinux policy should allow the access. The TC looks for appropriate policy rules and file context patterns. The TC covers BZ#2035117, BZ#2093709 and BZ#2094155. --- selinux-policy/dhclient-and-similar/Makefile | 3 +++ selinux-policy/dhclient-and-similar/main.fmf | 6 +++++- selinux-policy/dhclient-and-similar/runtest.sh | 14 +++++++++++++- 3 files changed, 21 insertions(+), 2 deletions(-) diff --git a/selinux-policy/dhclient-and-similar/Makefile b/selinux-policy/dhclient-and-similar/Makefile index 4779e3c..e372ff7 100644 --- a/selinux-policy/dhclient-and-similar/Makefile +++ b/selinux-policy/dhclient-and-similar/Makefile @@ -63,6 +63,9 @@ $(METADATA): Makefile @echo "Destructive: no" >> $(METADATA) @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) @echo "Bug: 1897388" >> $(METADATA) # Fedora 33 + @echo "Bug: 2035117" >> $(METADATA) # Fedora 35 + @echo "Bug: 2093709" >> $(METADATA) # Fedora 36 + @echo "Bug: 2094155" >> $(METADATA) # RHEL-9 rhts-lint $(METADATA) diff --git a/selinux-policy/dhclient-and-similar/main.fmf b/selinux-policy/dhclient-and-similar/main.fmf index 0504956..9c98fb1 100644 --- a/selinux-policy/dhclient-and-similar/main.fmf +++ b/selinux-policy/dhclient-and-similar/main.fmf @@ -22,6 +22,10 @@ environment: AVC_ERROR: +no_avc_check duration: 10m link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1897388 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1897388 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2035117 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2093709 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2094155 extra-summary: /CoreOS/selinux-policy/Regression/dhclient-and-similar extra-task: /CoreOS/selinux-policy/Regression/dhclient-and-similar +extra-nitrate: TC#0613884 diff --git a/selinux-policy/dhclient-and-similar/runtest.sh b/selinux-policy/dhclient-and-similar/runtest.sh index 9639e39..8b988d6 100755 --- a/selinux-policy/dhclient-and-similar/runtest.sh +++ b/selinux-policy/dhclient-and-similar/runtest.sh @@ -30,7 +30,6 @@ . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" -ROOT_PASSWORD="redhat" SERVICE_PACKAGE="chrony" SERVICE_NAME="chronyd" @@ -45,6 +44,7 @@ rlJournalStart rlAssertRpm ${SERVICE_PACKAGE} rlServiceStart ${SERVICE_NAME} + rlFileBackup /run/chrony-dhcp rlSESetEnforce rlSEStatus @@ -60,19 +60,31 @@ rlJournalStart rlSESearchRule "type_transition dhcpc_t chronyc_exec_t : process chronyc_t" rlSESearchRule "allow dhcpc_t chronyc_t : process { transition } [ ]" rlPhaseEnd + + rlPhaseStartTest "bz#2035117 + bz#2093709 + bz#2094155" + rlSEMatchPathCon "/usr/sbin/dhclient-script" "dhcpc_exec_t" + rlSEMatchPathCon "/run/chrony-dhcp" "chronyd_var_run_t" + rlSEMatchPathCon "/run/chrony-dhcp/eth0.sources" "chronyd_var_run_t" + rlSESearchRule "type_transition dhcpc_t var_run_t : dir chronyd_var_run_t chrony-dhcp" + rlSESearchRule "allow dhcpc_t chronyd_var_run_t : dir { read write } [ ]" + rlSESearchRule "allow dhcpc_t chronyd_var_run_t : file { create getattr append } [ ]" + rlPhaseEnd fi rlPhaseStartTest "real scenario" + rlRun "rm -rf /run/chrony-dhcp" rlRun "dhclient" DHCLIENT_PID=`pgrep dhclient` rlRun "ps -efZ | grep dhclient" rlRun "ps -efZ | grep ':dhcpc_t:.*dhclient'" + rlRun "ls -alZ /run/chrony-dhcp" rlPhaseEnd rlPhaseStartCleanup sleep 2 rlSECheckAVC kill ${DHCLIENT_PID} + rlFileRestore rlServiceRestore ${SERVICE_NAME} rlPhaseEnd rlJournalPrintText From 606eccfd7518983b65d081d21233c3a1366fa323 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Thu, 30 Jun 2022 09:51:02 +0200 Subject: [PATCH 160/626] test if stalld can use sched_setattr on kernel Recent stalld testing revealed that SELinux prevents the stalld processes from using the sched_setattr syscall on the running kernel threads. The TC does not reproduce the situation. In order to avoid the SELinux denials and support all functions of the stalld service, SELinux policy should allow the use of sched_setattr syscall. The TC looks for appropriate policy rules. The TC covers BZ#2102224. --- selinux-policy/stalld-and-similar/Makefile | 1 + selinux-policy/stalld-and-similar/main.fmf | 1 + selinux-policy/stalld-and-similar/runtest.sh | 4 ++++ 3 files changed, 6 insertions(+) diff --git a/selinux-policy/stalld-and-similar/Makefile b/selinux-policy/stalld-and-similar/Makefile index b15214c..b42a334 100644 --- a/selinux-policy/stalld-and-similar/Makefile +++ b/selinux-policy/stalld-and-similar/Makefile @@ -66,6 +66,7 @@ $(METADATA): Makefile @echo "Bug: 2042614" >> $(METADATA) # RHEL-9 @echo "Bug: 2092864" >> $(METADATA) # RHEL-9 @echo "Bug: 2096776" >> $(METADATA) # RHEL-9 + @echo "Bug: 2102224" >> $(METADATA) # RHEL-9 rhts-lint $(METADATA) diff --git a/selinux-policy/stalld-and-similar/main.fmf b/selinux-policy/stalld-and-similar/main.fmf index 23f4aaf..1d17a08 100644 --- a/selinux-policy/stalld-and-similar/main.fmf +++ b/selinux-policy/stalld-and-similar/main.fmf @@ -35,6 +35,7 @@ link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2042614 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2092864 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2096776 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2102224 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 diff --git a/selinux-policy/stalld-and-similar/runtest.sh b/selinux-policy/stalld-and-similar/runtest.sh index 28ebee0..217f598 100755 --- a/selinux-policy/stalld-and-similar/runtest.sh +++ b/selinux-policy/stalld-and-similar/runtest.sh @@ -82,6 +82,10 @@ rlJournalStart rlSESearchRule "allow stalld_t kernel_t : process { getsched } [ ]" rlPhaseEnd + rlPhaseStartTest "bz#2102224" + rlSESearchRule "allow stalld_t kernel_t : process { setsched } [ ]" + rlPhaseEnd + rlPhaseStartTest "real scenario -- standalone service" if ! rlSEDefined ${PROCESS_CONTEXT} ; then PROCESS_CONTEXT="unconfined_service_t" From 7f95c9d3a23593e4cda5ff2647f65ef93b2c763f Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Thu, 28 Apr 2022 11:06:47 +0200 Subject: [PATCH 161/626] add new test which covers the bgpd service SELinux policy confines the bgpd program (the bgpd service as well). This TC covers basic scenarios of running the service in default configuration. The TC also looks for appropriate policy rules and file context patterns. The TC covers BZ#2055578. --- selinux-policy/bgpd-and-similar/Makefile | 69 ++++++++++++++++ selinux-policy/bgpd-and-similar/PURPOSE | 5 ++ selinux-policy/bgpd-and-similar/main.fmf | 45 +++++++++++ selinux-policy/bgpd-and-similar/runtest.sh | 93 ++++++++++++++++++++++ 4 files changed, 212 insertions(+) create mode 100644 selinux-policy/bgpd-and-similar/Makefile create mode 100644 selinux-policy/bgpd-and-similar/PURPOSE create mode 100644 selinux-policy/bgpd-and-similar/main.fmf create mode 100755 selinux-policy/bgpd-and-similar/runtest.sh diff --git a/selinux-policy/bgpd-and-similar/Makefile b/selinux-policy/bgpd-and-similar/Makefile new file mode 100644 index 0000000..4abe755 --- /dev/null +++ b/selinux-policy/bgpd-and-similar/Makefile @@ -0,0 +1,69 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/bgpd-and-similar +# Description: SELinux interferes with bgpd and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2022 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/bgpd-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with bgpd and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console openbgpd /usr/sbin/service" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) + @echo "Bug: 1830170" >> $(METADATA) # RHEL-8 + @echo "Bug: 2055578" >> $(METADATA) # RHEL-9 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/bgpd-and-similar/PURPOSE b/selinux-policy/bgpd-and-similar/PURPOSE new file mode 100644 index 0000000..975ccf4 --- /dev/null +++ b/selinux-policy/bgpd-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/bgpd-and-similar +Author: Milos Malik + +SELinux interferes with bgpd and related programs + diff --git a/selinux-policy/bgpd-and-similar/main.fmf b/selinux-policy/bgpd-and-similar/main.fmf new file mode 100644 index 0000000..9fe25a1 --- /dev/null +++ b/selinux-policy/bgpd-and-similar/main.fmf @@ -0,0 +1,45 @@ +summary: SELinux interferes with bgpd and related programs +description: |+ + SELinux interferes with bgpd and related programs + +contact: Milos Malik +component: + - selinux-policy +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - openbgpd + - /usr/sbin/service +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - Tier2 + - Tier2se + - epel + - rhel8-epel + - rhel9-epel + - targeted +tier: '2' +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1830170 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2055578 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + continue: false +extra-nitrate: TC#0613221 +extra-summary: /CoreOS/selinux-policy/Regression/bgpd-and-similar +extra-task: /CoreOS/selinux-policy/Regression/bgpd-and-similar diff --git a/selinux-policy/bgpd-and-similar/runtest.sh b/selinux-policy/bgpd-and-similar/runtest.sh new file mode 100755 index 0000000..c0581ba --- /dev/null +++ b/selinux-policy/bgpd-and-similar/runtest.sh @@ -0,0 +1,93 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/bgpd-and-similar +# Description: SELinux interferes with bgpd and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2022 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +FILE_PATH="/usr/sbin/bgpd" +SERVICE_PACKAGE="openbgpd" +SERVICE_NAME="bgpd" +PROCESS_NAME="bgpd" +if rlIsRHEL 9 ; then + FILE_CONTEXT="bin_t" + PROCESS_CONTEXT="unconfined_service_t" +else + FILE_CONTEXT="zebra_exec_t" + PROCESS_CONTEXT="zebra_t" +fi + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} + rlFileBackup /etc/bgpd.conf + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "bz#1830170 + bz#2055578" + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + if rlIsRHEL 5 ; then + SOURCE_TYPE="initrc_t" + BOOLEANS="[ ]" + elif rlIsRHEL 6 ; then + SOURCE_TYPE="initrc_t" + else # RHEL-7 etc. + SOURCE_TYPE="init_t" # systemd runs the process + fi + rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" + rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" + rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" + rlPhaseEnd + + rlPhaseStartTest "real scenario -- standalone service" + rlRun "sed -i 's/^\(include.*\)$/# \1/' /etc/bgpd.conf" + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /run /var" 0-255 + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + From 01e114b092f2cbd82ba6dacf3f42d9fc3ae94e2b Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Fri, 27 Nov 2020 15:19:46 +0100 Subject: [PATCH 162/626] test how semanage handles spaces in fcontext patterns The semanage tool refuses (for some time already) fcontext patterns which contain spaces. The TC checks if other whitespace characters are treated the same way. The TC covers BZ#1893545. --- .../spaces-in-fcontext-patterns/Makefile | 66 +++++++++++++++++++ .../spaces-in-fcontext-patterns/PURPOSE | 5 ++ .../spaces-in-fcontext-patterns/main.fmf | 37 +++++++++++ .../spaces-in-fcontext-patterns/runtest.sh | 56 ++++++++++++++++ 4 files changed, 164 insertions(+) create mode 100644 policycoreutils/spaces-in-fcontext-patterns/Makefile create mode 100644 policycoreutils/spaces-in-fcontext-patterns/PURPOSE create mode 100644 policycoreutils/spaces-in-fcontext-patterns/main.fmf create mode 100755 policycoreutils/spaces-in-fcontext-patterns/runtest.sh diff --git a/policycoreutils/spaces-in-fcontext-patterns/Makefile b/policycoreutils/spaces-in-fcontext-patterns/Makefile new file mode 100644 index 0000000..b39090e --- /dev/null +++ b/policycoreutils/spaces-in-fcontext-patterns/Makefile @@ -0,0 +1,66 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/policycoreutils/Regression/spaces-in-fcontext-patterns +# Description: Does semanage accept spaces in fcontext patterns? +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2020 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/policycoreutils/Regression/spaces-in-fcontext-patterns +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: Does semanage accept spaces in fcontext patterns?" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: policycoreutils" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted /usr/sbin/semanage" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) + @echo "Bug: 1893545" >> $(METADATA) # Fedora 32 + + rhts-lint $(METADATA) + diff --git a/policycoreutils/spaces-in-fcontext-patterns/PURPOSE b/policycoreutils/spaces-in-fcontext-patterns/PURPOSE new file mode 100644 index 0000000..db31d4a --- /dev/null +++ b/policycoreutils/spaces-in-fcontext-patterns/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/policycoreutils/Regression/spaces-in-fcontext-patterns +Author: Milos Malik + +Description: Does semanage accept spaces in fcontext patterns? + diff --git a/policycoreutils/spaces-in-fcontext-patterns/main.fmf b/policycoreutils/spaces-in-fcontext-patterns/main.fmf new file mode 100644 index 0000000..ad152e7 --- /dev/null +++ b/policycoreutils/spaces-in-fcontext-patterns/main.fmf @@ -0,0 +1,37 @@ +summary: Does semanage accept spaces in fcontext patterns? +description: |+ + Does semanage accept spaces in fcontext patterns? + +contact: Milos Malik +component: + - policycoreutils +test: ./runtest.sh +framework: beakerlib +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - /usr/sbin/semanage +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - CI-Tier-1 + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - Tier1 + - Tier1se + - targeted +tier: '1' +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1893545 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + continue: false diff --git a/policycoreutils/spaces-in-fcontext-patterns/runtest.sh b/policycoreutils/spaces-in-fcontext-patterns/runtest.sh new file mode 100755 index 0000000..ea57c89 --- /dev/null +++ b/policycoreutils/spaces-in-fcontext-patterns/runtest.sh @@ -0,0 +1,56 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/policycoreutils/Regression/spaces-in-fcontext-patterns +# Description: Does semanage accept spaces in fcontext patterns? +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2020 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="policycoreutils" + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm ${PACKAGE} + rlRun "rpm -qf `which semanage`" + rlPhaseEnd + + rlPhaseStartTest "bz#1893545" + rlRun "semanage fcontext -l -C" + rlRun "semanage fcontext -a -t public_content_t '/mnt/media/My\ Dir(/.*)?'" 1 + rlRun "semanage fcontext -a -t public_content_t '/mnt/media/My Dir(/.*)?'" 1 + rlRun "semanage fcontext -a -t public_content_t '/mnt/media/My Dir(/.*)?'" 1 + rlRun "semanage fcontext -l -C" + rlRun "semanage fcontext -d -t public_content_t '/mnt/media/My\ Dir(/.*)?'" 1 + rlRun "semanage fcontext -d -t public_content_t '/mnt/media/My Dir(/.*)?'" 1 + rlRun "semanage fcontext -d -t public_content_t '/mnt/media/My Dir(/.*)?'" 1 + rlRun "semanage fcontext -l -C" + rlPhaseEnd + + rlPhaseStartCleanup + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + From de353795c279c8ac02820fc3e8d4f65c34088d35 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Mon, 18 Jul 2022 13:25:02 +0200 Subject: [PATCH 163/626] kernel/selinux-testsuite: use correct linker to build kernel modules Start applying a testsite patch that fixes kernel module build for kernels built with clang + with LTO enabled. Fixes: https://gitlab.com/redhat/centos-stream/tests/kernel/kernel-tests/-/issues/1272 Signed-off-by: Ondrej Mosnacek --- kernel/selinux-testsuite/runtest.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/selinux-testsuite/runtest.sh b/kernel/selinux-testsuite/runtest.sh index af2f1f1..0a534d0 100755 --- a/kernel/selinux-testsuite/runtest.sh +++ b/kernel/selinux-testsuite/runtest.sh @@ -41,7 +41,7 @@ DEFAULT_COMMIT="3e93ece73da162fe58f9ec7d16b01915a4568c11" # requests (by number) are merged, creating a new temporary local branch. DEFAULT_PULLS="" # Default SELinux Patchwork series to apply before running the test. -DEFAULT_PATCHES="" +DEFAULT_PATCHES="660627" # Optional test parameter - location of testuite git. GIT_URL=${GIT_URL:-"https://github.com/SELinuxProject/selinux-testsuite"} From 09061d27391c6f1e445b19d903ceb2f99aff0137 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 26 Jul 2022 14:19:39 +0200 Subject: [PATCH 164/626] test if semanage can import port definitions correctly Recent testing revealed that `semanage import` cannot import SELinux port definitions correctly if `port -D` is present among them. The TC reproduces the situation. The TC covers BZ#2063353 and BZ#2108174. --- .../semanage-imports-port-defs/main.fmf | 19 ++++++++++++++++ .../semanage-imports-port-defs/test.sh | 22 +++++++++++++++++++ 2 files changed, 41 insertions(+) create mode 100644 policycoreutils/semanage-imports-port-defs/main.fmf create mode 100755 policycoreutils/semanage-imports-port-defs/test.sh diff --git a/policycoreutils/semanage-imports-port-defs/main.fmf b/policycoreutils/semanage-imports-port-defs/main.fmf new file mode 100644 index 0000000..b06c827 --- /dev/null +++ b/policycoreutils/semanage-imports-port-defs/main.fmf @@ -0,0 +1,19 @@ +summary: Can semanage import SELinux port definitions correctly? +test: ./test.sh +contact: Milos Malik +framework: beakerlib +component: + - policycoreutils +recommend: + - policycoreutils + - /usr/sbin/semanage +duration: 10m +enabled: true +tier: 1 +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2063353 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2108174 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6 + because: the test is not relevant there diff --git a/policycoreutils/semanage-imports-port-defs/test.sh b/policycoreutils/semanage-imports-port-defs/test.sh new file mode 100755 index 0000000..29a0ae3 --- /dev/null +++ b/policycoreutils/semanage-imports-port-defs/test.sh @@ -0,0 +1,22 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm policycoreutils + rlRun "rpm -qf /usr/sbin/semanage" + rlRun "semanage port -a -t http_cache_port_t -r s0 -p tcp 3024" + rlPhaseEnd + + rlPhaseStartTest "bz#2063353 + bz#2108174" + rlRun "semanage port -E" + rlRun "echo -e 'port -D\nport -a -t http_cache_port_t -r s0 -p tcp 3024' | semanage import" + rlRun "semanage port -E" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "semanage port -d -t http_cache_port_t -r s0 -p tcp 3024" + rlPhaseEnd +rlJournalEnd + From 98145eff71b99bba0d9fe1da88b29a1d3173c91e Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 2 Aug 2022 10:00:37 +0200 Subject: [PATCH 165/626] add Makefile to enable runs via STI Some CI frameworks still use STI which depends on existence of the Makefile. In order to run this TC successfully in such frameworks, the Makefile was added. Test description was also improved. --- .../semanage-imports-port-defs/Makefile | 67 +++++++++++++++++++ .../semanage-imports-port-defs/main.fmf | 6 +- .../{test.sh => runtest.sh} | 8 +++ 3 files changed, 80 insertions(+), 1 deletion(-) create mode 100644 policycoreutils/semanage-imports-port-defs/Makefile rename policycoreutils/semanage-imports-port-defs/{test.sh => runtest.sh} (66%) diff --git a/policycoreutils/semanage-imports-port-defs/Makefile b/policycoreutils/semanage-imports-port-defs/Makefile new file mode 100644 index 0000000..d977007 --- /dev/null +++ b/policycoreutils/semanage-imports-port-defs/Makefile @@ -0,0 +1,67 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/policycoreutils/Regression/semanage-imports-port-defs +# Description: Can semanage import SELinux port definitions correctly? +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2020 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/policycoreutils/Regression/semanage-imports-port-defs +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: Can semanage import SELinux port definitions correctly?" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: policycoreutils" >> $(METADATA) + @echo "Requires: policycoreutils /usr/sbin/semanage" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6" >> $(METADATA) + @echo "Bug: 2063353" >> $(METADATA) # RHEL-8 + @echo "Bug: 2108174" >> $(METADATA) # RHEL-9 + + rhts-lint $(METADATA) + diff --git a/policycoreutils/semanage-imports-port-defs/main.fmf b/policycoreutils/semanage-imports-port-defs/main.fmf index b06c827..87d7764 100644 --- a/policycoreutils/semanage-imports-port-defs/main.fmf +++ b/policycoreutils/semanage-imports-port-defs/main.fmf @@ -1,5 +1,8 @@ summary: Can semanage import SELinux port definitions correctly? -test: ./test.sh +description: |+ + Can semanage import SELinux port definitions correctly? + +test: ./runtest.sh contact: Milos Malik framework: beakerlib component: @@ -17,3 +20,4 @@ adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6 because: the test is not relevant there +extra-nitrate: TC#0614161 diff --git a/policycoreutils/semanage-imports-port-defs/test.sh b/policycoreutils/semanage-imports-port-defs/runtest.sh similarity index 66% rename from policycoreutils/semanage-imports-port-defs/test.sh rename to policycoreutils/semanage-imports-port-defs/runtest.sh index 29a0ae3..bdd7d52 100755 --- a/policycoreutils/semanage-imports-port-defs/test.sh +++ b/policycoreutils/semanage-imports-port-defs/runtest.sh @@ -1,5 +1,13 @@ #!/bin/bash # vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/policycoreutils/Regression/semanage-imports-port-defs +# Description: Can semanage import SELinux port definitions correctly? +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + . /usr/share/beakerlib/beakerlib.sh || exit 1 rlJournalStart From a77df427546958a8f344c2e1650246d3d9421b33 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Tue, 24 May 2022 16:06:00 +0200 Subject: [PATCH 166/626] semodule-rebuild-if-modules-changed: expand vars early This will make the test output more explicit. Signed-off-by: Ondrej Mosnacek --- .../semodule-rebuild-if-modules-changed/runtest.sh | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/policycoreutils/semodule-rebuild-if-modules-changed/runtest.sh b/policycoreutils/semodule-rebuild-if-modules-changed/runtest.sh index 8f55dda..98e84d6 100755 --- a/policycoreutils/semodule-rebuild-if-modules-changed/runtest.sh +++ b/policycoreutils/semodule-rebuild-if-modules-changed/runtest.sh @@ -48,22 +48,22 @@ rlJournalStart "Make sure policy store is in a consistent state initially" rlLog "Inject a new module into the store" - rlRun "mkdir -p \"\$TEST_MODULE_DIR\"" - rlRun "echo -n cil >\"\$TEST_MODULE_DIR/lang_ext\"" - rlRun "echo '(type test_module_type_t)' >\"\$TEST_MODULE_DIR/cil\"" + rlRun "mkdir -p '$TEST_MODULE_DIR'" + rlRun "echo -n cil >'$TEST_MODULE_DIR/lang_ext'" + rlRun "echo '(type test_module_type_t)' >'$TEST_MODULE_DIR/cil'" rlRun "semodule -N --rebuild-if-modules-changed" 0 \ "Do a conditional rebuild" rlRun "semodule -l | grep test_module" 0 \ "Verify that the module has been picked up" - rlRun "seinfo -t test_module_type_t \"\$STORE_POLICY\" | grep test_module_type_t" 0 \ + rlRun "seinfo -t test_module_type_t '$STORE_POLICY' | grep test_module_type_t" 0 \ "Verify that the new type is included in the built policy" rlLog "Now remove the module" - rlRun "rm -rf \"\$TEST_MODULE_DIR\"" + rlRun "rm -rf '$TEST_MODULE_DIR'" rlRun "semodule -N --rebuild-if-modules-changed" rlRun "semodule -l | grep test_module" 1 \ "Verify that the module has been removed" - rlRun "seinfo -t test_module_type_t \"\$STORE_POLICY\" | grep test_module_type_t" 1 \ + rlRun "seinfo -t test_module_type_t '$STORE_POLICY' | grep test_module_type_t" 1 \ "Verify that the new type is NOT included in the built policy" # Make sure policy is restored regardless of any previous failures From c3dd00f4bcf4355897a4e726ca12740b88ea5b17 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Tue, 24 May 2022 16:04:37 +0200 Subject: [PATCH 167/626] semodule-rebuild-if-modules-changed: test changing booleans Extend the test to verify correct behavior when a boolean setting override is injected. Also add auto-detection of the --refresh / --rebuild-if-modules-changed command-line option support, which indicates the expected level of functionality. (And we also need to ensure that --refresh is used when supported because the other option may be removed in the future.) Additionally, we need to work around the fact that the exact binary policy content can now be different depending on if the optimized code path has been taken. Do this by toggling a boolean before introducing injected customizations, thus obtaining the expected policy content for the case after `semodule --refresh`. Signed-off-by: Ondrej Mosnacek --- .../runtest.sh | 74 +++++++++++++++---- 1 file changed, 58 insertions(+), 16 deletions(-) diff --git a/policycoreutils/semodule-rebuild-if-modules-changed/runtest.sh b/policycoreutils/semodule-rebuild-if-modules-changed/runtest.sh index 98e84d6..16e3ccf 100755 --- a/policycoreutils/semodule-rebuild-if-modules-changed/runtest.sh +++ b/policycoreutils/semodule-rebuild-if-modules-changed/runtest.sh @@ -11,7 +11,11 @@ STORE_ROOT=/var/lib/selinux STORE_TYPE=targeted MODULES_ROOT="$STORE_ROOT/$STORE_TYPE/active/modules" STORE_POLICY="$STORE_ROOT/$STORE_TYPE/active/policy.kern" +STORE_BOOLS="$STORE_ROOT/$STORE_TYPE/active/booleans.local" TEST_MODULE_DIR="$MODULES_ROOT/400/test_module" +TEST_BOOLEAN="xguest_exec_content" +TEST_BOOLEAN_VALUE="0" +TEST_BOOLEAN_VALUE_TEXT="false" CHECKSUM_CMD=sha256sum @@ -31,27 +35,46 @@ rlJournalStart if [ "$policyvers" -lt "$policyvers_kernel" ]; then policyvers="$policyvers_kernel" fi + + rlRun "semodule -N -B" 0 \ + "Make sure policy store is in a consistent state initially" + + refresh_opt="" + for opt in --refresh --rebuild-if-modules-changed; do + if semodule --help | grep -q -- "$opt"; then + refresh_opt="$opt" + rlLog "$opt command-line option detected for semodule" + break + fi + done rlPhaseEnd - rlPhaseStartTest - if semodule --help | grep -q -- --rebuild-if-modules-changed; then - rlRun "semodule -N -B" 0 \ - "Make sure policy store is in a consistent state initially" + if [ -n "$refresh_opt" ]; then + rlPhaseStartTest "No change behavior" + # The resulting binary policy will be different (albeit + # equivalent) after a full rebuild vs. when only local + # changes are applied to existing policy.linked file, so + # toggle a boolean twice to get the expected binary form. + rlRun "setsebool -P xguest_exec_content $TEST_BOOLEAN_VALUE" + rlRun "setsebool -P xguest_exec_content $(( ! $TEST_BOOLEAN_VALUE ))" checksum_before="$(policy_checksum "$policyvers")" - rlRun "semodule -N --rebuild-if-modules-changed" + rlRun "semodule -N $refresh_opt" checksum_after="$(policy_checksum "$policyvers")" rlAssertEquals "Binary policy must not change after rebuild" \ "$checksum_before" "$checksum_after" + # Make sure policy is restored regardless of any previous failures rlRun "semodule -N -B" 0 \ - "Make sure policy store is in a consistent state initially" + "Force a rebuild to clean things up" + rlPhaseEnd + rlPhaseStartTest "Module injected" rlLog "Inject a new module into the store" rlRun "mkdir -p '$TEST_MODULE_DIR'" rlRun "echo -n cil >'$TEST_MODULE_DIR/lang_ext'" rlRun "echo '(type test_module_type_t)' >'$TEST_MODULE_DIR/cil'" - rlRun "semodule -N --rebuild-if-modules-changed" 0 \ + rlRun "semodule -N $refresh_opt" 0 \ "Do a conditional rebuild" rlRun "semodule -l | grep test_module" 0 \ "Verify that the module has been picked up" @@ -60,7 +83,7 @@ rlJournalStart rlLog "Now remove the module" rlRun "rm -rf '$TEST_MODULE_DIR'" - rlRun "semodule -N --rebuild-if-modules-changed" + rlRun "semodule -N $refresh_opt" rlRun "semodule -l | grep test_module" 1 \ "Verify that the module has been removed" rlRun "seinfo -t test_module_type_t '$STORE_POLICY' | grep test_module_type_t" 1 \ @@ -69,14 +92,33 @@ rlJournalStart # Make sure policy is restored regardless of any previous failures rlRun "semodule -N -B" 0 \ "Force a rebuild to clean things up" - #rlRun "setsebool -NP daemons_use_tty=on" - # TODO test changing booleans (persistently) - else - rlLog "--rebuild-if-modules-changed command-line option not supported; skipping tests..." - fi - rlPhaseEnd + rlPhaseEnd - rlPhaseStartCleanup - rlPhaseEnd + # --refresh option implies fixed boolean/etc. behavior + if [ "$refresh_opt" = "--refresh" ]; then + rlPhaseStartTest "Boolean setting injected" + rlLog "Inject a boolean setting into the store" + rlRun "echo '$TEST_BOOLEAN=$TEST_BOOLEAN_VALUE' >'$STORE_BOOLS'" + rlRun "semodule -N $refresh_opt" 0 \ + "Do a conditional rebuild" + rlRun "seinfo -xb '$TEST_BOOLEAN' '$STORE_POLICY' | grep -F -- '$TEST_BOOLEAN_VALUE_TEXT;'" 0 \ + "Verify that the boolean setting has been picked up" + + rlLog "Now remove the setting" + rlRun "rm -f '$STORE_BOOLS'" + rlRun "semodule -N $refresh_opt" + rlRun "seinfo -xb '$TEST_BOOLEAN' '$STORE_POLICY' | grep -F -- '$TEST_BOOLEAN_VALUE_TEXT;'" 1 \ + "Verify that the boolean setting has been reset back" + + # Make sure policy is restored regardless of any previous failures + rlRun "semodule -N -B" 0 \ + "Force a rebuild to clean things up" + rlPhaseEnd + fi + else + rlPhaseStartTest "Test skipped" + rlLog "--rebuild-if-modules-changed/--refresh command-line option not supported; skipping tests..." + rlPhaseEnd + fi rlJournalPrintText rlJournalEnd From d121114f70414815336f6d304cb086ab8650511a Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Mon, 15 Aug 2022 16:24:32 +0200 Subject: [PATCH 168/626] test if systemd-modules-load can work with /dev/kmsg and systemd-journal Recent RDMA testing revealed that systemd-modules-load processes cannot use openat syscall on /dev/kmsg and cannot use connect syscall on /run/systemd/journal/socket because SELinux denies that. The TC reproduces the situation when executed on a machine equipped with RDMA (Infiniband) HW. Because this scenario should work, I believe that SELinux policy should allow above-mentioned actions. The TC looks for appropriate policy rules and file context patterns. The TC covers BZ#2088257 and BZ#2088258. --- .../systemd-modules-load-and-similar/Makefile | 2 ++ .../systemd-modules-load-and-similar/main.fmf | 2 ++ .../systemd-modules-load-and-similar/runtest.sh | 10 ++++++++++ 3 files changed, 14 insertions(+) diff --git a/selinux-policy/systemd-modules-load-and-similar/Makefile b/selinux-policy/systemd-modules-load-and-similar/Makefile index 8631adb..d53ce0c 100644 --- a/selinux-policy/systemd-modules-load-and-similar/Makefile +++ b/selinux-policy/systemd-modules-load-and-similar/Makefile @@ -82,6 +82,8 @@ $(METADATA): Makefile @echo "Bug: 1838933" >> $(METADATA) # Fedora 32 @echo "Bug: 1942267" >> $(METADATA) # Fedora 32 @echo "Bug: 1972372" >> $(METADATA) # RHEL 9 + @echo "Bug: 2088257" >> $(METADATA) # RHEL-9 + @echo "Bug: 2088258" >> $(METADATA) # RHEL-9 rhts-lint $(METADATA) diff --git a/selinux-policy/systemd-modules-load-and-similar/main.fmf b/selinux-policy/systemd-modules-load-and-similar/main.fmf index 0adedeb..1e18e2e 100644 --- a/selinux-policy/systemd-modules-load-and-similar/main.fmf +++ b/selinux-policy/systemd-modules-load-and-similar/main.fmf @@ -51,6 +51,8 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1942267 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1972372 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1850953 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2088257 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2088258 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7 diff --git a/selinux-policy/systemd-modules-load-and-similar/runtest.sh b/selinux-policy/systemd-modules-load-and-similar/runtest.sh index b7bc865..2e250b4 100755 --- a/selinux-policy/systemd-modules-load-and-similar/runtest.sh +++ b/selinux-policy/systemd-modules-load-and-similar/runtest.sh @@ -130,6 +130,16 @@ rlJournalStart fi rlPhaseEnd + if ! rlIsRHEL 8 ; then + rlPhaseStartTest "bz#2088257 + bz#2088258" + rlSEMatchPathCon "/usr/lib/systemd/systemd-modules-load" "systemd_modules_load_exec_t" + rlSEMatchPathCon "/dev/kmsg" "kmsg_device_t" + rlSEMatchPathCon "/run/systemd/journal/socket" "syslogd_var_run_t" + rlSESearchRule "allow systemd_modules_load_t syslogd_t : unix_dgram_socket { sendto } [ ]" + rlSESearchRule "allow systemd_modules_load_t kmsg_device_t : chr_file { write } [ ]" + rlPhaseEnd + fi + rlPhaseStartCleanup sleep 2 rlSECheckAVC From 75e8d39310ed1590b3e31f7abb35f30bc6437a40 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 26 Jul 2022 11:28:08 +0200 Subject: [PATCH 169/626] ensure that selinux-policy-{minimum,mls,targeted} are installed For unknown reasons, selinux-policy-{minimum,mls,targeted} packages are not installed or their available versions differ from each other. Let's work around the issue. --- checkpolicy/checkpolicy/runtest.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/checkpolicy/checkpolicy/runtest.sh b/checkpolicy/checkpolicy/runtest.sh index fda1e8e..fd0de7d 100755 --- a/checkpolicy/checkpolicy/runtest.sh +++ b/checkpolicy/checkpolicy/runtest.sh @@ -34,7 +34,7 @@ PACKAGE="checkpolicy" rlJournalStart rlPhaseStartSetup rlAssertRpm ${PACKAGE} - rlRun "yum -y install selinux-policy-minimum selinux-policy-mls selinux-policy-targeted" + rlRun "yum -y install selinux-policy-minimum selinux-policy-mls selinux-policy-targeted --enablerepo '*' --nobest" rlAssertRpm selinux-policy-minimum rlAssertRpm selinux-policy-mls rlAssertRpm selinux-policy-targeted From d86b1fb0cecf880a83f0a3dd0cae44631fd47f49 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Thu, 25 Aug 2022 14:16:43 +0200 Subject: [PATCH 170/626] test if stalld can get+set scheduling for all domains TBA later The TC covers BZ#2105038. --- selinux-policy/stalld-and-similar/Makefile | 1 + selinux-policy/stalld-and-similar/main.fmf | 1 + selinux-policy/stalld-and-similar/runtest.sh | 5 +++++ 3 files changed, 7 insertions(+) diff --git a/selinux-policy/stalld-and-similar/Makefile b/selinux-policy/stalld-and-similar/Makefile index b42a334..5eacb61 100644 --- a/selinux-policy/stalld-and-similar/Makefile +++ b/selinux-policy/stalld-and-similar/Makefile @@ -67,6 +67,7 @@ $(METADATA): Makefile @echo "Bug: 2092864" >> $(METADATA) # RHEL-9 @echo "Bug: 2096776" >> $(METADATA) # RHEL-9 @echo "Bug: 2102224" >> $(METADATA) # RHEL-9 + @echo "Bug: 2105038" >> $(METADATA) # RHEL-9 rhts-lint $(METADATA) diff --git a/selinux-policy/stalld-and-similar/main.fmf b/selinux-policy/stalld-and-similar/main.fmf index 1d17a08..8ae96f0 100644 --- a/selinux-policy/stalld-and-similar/main.fmf +++ b/selinux-policy/stalld-and-similar/main.fmf @@ -36,6 +36,7 @@ link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2092864 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2096776 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2102224 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2105038 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 diff --git a/selinux-policy/stalld-and-similar/runtest.sh b/selinux-policy/stalld-and-similar/runtest.sh index 217f598..ea131ad 100755 --- a/selinux-policy/stalld-and-similar/runtest.sh +++ b/selinux-policy/stalld-and-similar/runtest.sh @@ -86,6 +86,11 @@ rlJournalStart rlSESearchRule "allow stalld_t kernel_t : process { setsched } [ ]" rlPhaseEnd + rlPhaseStartTest "bz#2105038" + rlRun "sesearch -s stalld_t -t domain -c process -p getsched -A -ds -dt | grep allow" + rlRun "sesearch -s stalld_t -t domain -c process -p setsched -A -ds -dt | grep allow" + rlPhaseEnd + rlPhaseStartTest "real scenario -- standalone service" if ! rlSEDefined ${PROCESS_CONTEXT} ; then PROCESS_CONTEXT="unconfined_service_t" From 21a2855558bba121400f8f97563aff34269ae659 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Thu, 25 Aug 2022 10:17:10 +0200 Subject: [PATCH 171/626] kernel/selinux-testsuite: bump upstream commit to c592d7f Effective changes: * fix for https://gitlab.com/redhat/centos-stream/tests/kernel/kernel-tests/-/issues/1352 * major testsuite policy refactoring * various minor fixes/tweaks Signed-off-by: Ondrej Mosnacek --- kernel/selinux-testsuite/runtest.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kernel/selinux-testsuite/runtest.sh b/kernel/selinux-testsuite/runtest.sh index 0a534d0..014f4d3 100755 --- a/kernel/selinux-testsuite/runtest.sh +++ b/kernel/selinux-testsuite/runtest.sh @@ -35,13 +35,13 @@ PACKAGE="selinux-policy" # This should be updated as needed after verifying that the new version # doesn't break testing and after applying all necessary tweaks in the TC. # Run with GIT_BRANCH=master to run the latest upstream version. -DEFAULT_COMMIT="3e93ece73da162fe58f9ec7d16b01915a4568c11" +DEFAULT_COMMIT="c592d7f49e5e8ca907d90cb1d6f54bb0d410d442" # Default pull requests to merge before running the test. # If non-empty, then after checking out GIT_BRANCH the listed upstream pull # requests (by number) are merged, creating a new temporary local branch. DEFAULT_PULLS="" # Default SELinux Patchwork series to apply before running the test. -DEFAULT_PATCHES="660627" +DEFAULT_PATCHES="" # Optional test parameter - location of testuite git. GIT_URL=${GIT_URL:-"https://github.com/SELinuxProject/selinux-testsuite"} From 03bf3a0e7098c7417378fb13b48889c7041a08ba Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Tue, 30 Aug 2022 20:37:23 +0200 Subject: [PATCH 172/626] kernel/selinux-testsuite: fail hard when PR/patch application fails Replace the current soft fallback to raw GIT_BRANCH when a required PR or Patchwork patch fails to merge/apply with a hoard failure, similar to what we do when cloning the repo fails. The main motivation is to not have CKI treat this situation as a failure, but it also a good practice to ensure we either run the intended version of the test or no test at all. Signed-off-by: Ondrej Mosnacek --- kernel/selinux-testsuite/runtest.sh | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-) diff --git a/kernel/selinux-testsuite/runtest.sh b/kernel/selinux-testsuite/runtest.sh index 014f4d3..ae535fb 100755 --- a/kernel/selinux-testsuite/runtest.sh +++ b/kernel/selinux-testsuite/runtest.sh @@ -246,24 +246,23 @@ rlJournalStart for pull in $GIT_PULLS; do ref="refs/pull/$pull/head" if ! rlRun "git fetch origin $ref:$ref" 0; then - rlRun "git checkout $GIT_BRANCH" 0 - rlLogWarning "PR merge failed, falling back to GIT_BRANCH" - break + rlLogFatal "PR merge failed!" + rlPhaseEnd + exit 127 fi if ! rlRun "git merge --no-edit $ref" 0; then - rlRun "git merge --abort" 0 - rlRun "git checkout $GIT_BRANCH" 0 - rlLogWarning "PR merge failed, falling back to GIT_BRANCH" - break + rlLogFatal "PR merge failed!" + rlPhaseEnd + exit 127 fi done $PIPEFAIL_ENABLE for pwseries in $GIT_PATCHES; do url="https://patchwork.kernel.org/series/$pwseries/mbox/" if ! rlRun "curl $url | git am -"; then - rlRun "git checkout $GIT_BRANCH" 0 - rlLogWarning "Applying patch failed, falling back to GIT_BRANCH" - break + rlLogFatal "Applying patch failed!" + rlPhaseEnd + exit 127 fi done $PIPEFAIL_DISABLE From 25176f01cef9b5a45eda85edf41178075826c6b6 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Tue, 13 Sep 2022 11:03:47 +0200 Subject: [PATCH 173/626] kernel/genfs_fallback: use vfat instead of ramfs ramfs is now treated as an xattr-supporting filesystem and has the fs_use_trans directive in the base policy. Thus switch to vfat, which is still genfs. Signed-off-by: Ondrej Mosnacek --- kernel/genfs_fallback/main.fmf | 1 + kernel/genfs_fallback/runtest.sh | 26 +++++++++++++++++--------- 2 files changed, 18 insertions(+), 9 deletions(-) diff --git a/kernel/genfs_fallback/main.fmf b/kernel/genfs_fallback/main.fmf index 5b42e80..36161e9 100644 --- a/kernel/genfs_fallback/main.fmf +++ b/kernel/genfs_fallback/main.fmf @@ -12,6 +12,7 @@ component: framework: beakerlib require: - policycoreutils +- dosfstools duration: 5m tier: 2 enabled: true diff --git a/kernel/genfs_fallback/runtest.sh b/kernel/genfs_fallback/runtest.sh index 63d8e1e..3b9372a 100755 --- a/kernel/genfs_fallback/runtest.sh +++ b/kernel/genfs_fallback/runtest.sh @@ -11,21 +11,29 @@ rlJournalStart rlPhaseStartSetup rlRun "uname -r" - rlRun "echo '(fsuse xattr ramfs (system_u object_r fs_t ((s0) (s0))))' >ramfs_xattr.cil" - rlRun "semodule -i ramfs_xattr.cil" - rlRun "mkdir /mnt/test-ramfs" + rlRun "dd if=/dev/zero of=diskfile bs=4M count=1" + rlRun "mkfs.vfat diskfile" + DEVICE="$(losetup -f)" + rlRun "losetup $DEVICE diskfile" + + rlRun "echo '(fsuse xattr vfat (system_u object_r fs_t ((s0) (s0))))' >vfat_xattr.cil" + rlRun "semodule -i vfat_xattr.cil" + rlRun "mkdir /mnt/test-vfat" rlPhaseEnd rlPhaseStartTest - rlRun "mount -t ramfs none /mnt/test-ramfs" - rlRun "[ \"\$(secon -t -f /mnt/test-ramfs)\" = ramfs_t ]" + rlRun "mount -t vfat $DEVICE /mnt/test-vfat" + rlRun "[ \"\$(secon -t -f /mnt/test-vfat)\" = dosfs_t ]" rlPhaseEnd rlPhaseStartCleanup - rlRun "umount /mnt/test-ramfs" 0-1 - rlRun "rmdir /mnt/test-ramfs" - rlRun "semodule -r ramfs_xattr" - rlRun "rm -f ramfs_xattr.cil" + rlRun "umount /mnt/test-vfat" 0-1 + rlRun "rmdir /mnt/test-vfat" + rlRun "semodule -r vfat_xattr" 0-1 + rlRun "rm -f vfat_xattr.cil" + + rlRun "losetup -d $DEVICE" 0-1 + rlRun "rm -f diskfile" rlPhaseEnd rlJournalPrintText rlJournalEnd From ef2646911d5c8c42619129711d79266ab340ad4f Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Tue, 30 Aug 2022 16:36:40 +0200 Subject: [PATCH 174/626] Port kernel tests from downstream Forward-port of downstream kernel tests that haven't been upstreamed yet, manually converted to TMT. Signed-off-by: Ondrej Mosnacek --- kernel/avc_corrupted_context/main.fmf | 18 ++++ kernel/avc_corrupted_context/runtest.sh | 35 ++++++ .../main.fmf | 27 +++++ .../runtest.sh | 101 ++++++++++++++++++ kernel/connect_AF_UNSPEC/main.fmf | 25 +++++ kernel/connect_AF_UNSPEC/reproducer4.c | 46 ++++++++ kernel/connect_AF_UNSPEC/reproducer6.c | 47 ++++++++ kernel/connect_AF_UNSPEC/runtest.sh | 39 +++++++ kernel/getxattr_read_out_of_bounds/main.fmf | 23 ++++ kernel/getxattr_read_out_of_bounds/runtest.sh | 36 +++++++ kernel/journald_performance/main.fmf | 24 +++++ kernel/journald_performance/runtest.sh | 51 +++++++++ kernel/keycreate_empty_value/main.fmf | 20 ++++ kernel/keycreate_empty_value/reproducer.c | 22 ++++ kernel/keycreate_empty_value/runtest.sh | 37 +++++++ .../labeldump-expected.txt | 3 + kernel/labeling_before_policy_load/main.fmf | 27 +++++ .../module-setup.sh | 17 +++ kernel/labeling_before_policy_load/relabel.sh | 15 +++ kernel/labeling_before_policy_load/runtest.sh | 46 ++++++++ .../main.fmf | 17 +++ .../runtest.sh | 36 +++++++ kernel/selinuxfs_dentry_softlockup/main.fmf | 18 ++++ kernel/selinuxfs_dentry_softlockup/runtest.sh | 37 +++++++ 24 files changed, 767 insertions(+) create mode 100644 kernel/avc_corrupted_context/main.fmf create mode 100755 kernel/avc_corrupted_context/runtest.sh create mode 100644 kernel/avc_log_actual_context_if_invalid/main.fmf create mode 100755 kernel/avc_log_actual_context_if_invalid/runtest.sh create mode 100644 kernel/connect_AF_UNSPEC/main.fmf create mode 100644 kernel/connect_AF_UNSPEC/reproducer4.c create mode 100644 kernel/connect_AF_UNSPEC/reproducer6.c create mode 100755 kernel/connect_AF_UNSPEC/runtest.sh create mode 100644 kernel/getxattr_read_out_of_bounds/main.fmf create mode 100755 kernel/getxattr_read_out_of_bounds/runtest.sh create mode 100644 kernel/journald_performance/main.fmf create mode 100755 kernel/journald_performance/runtest.sh create mode 100644 kernel/keycreate_empty_value/main.fmf create mode 100644 kernel/keycreate_empty_value/reproducer.c create mode 100755 kernel/keycreate_empty_value/runtest.sh create mode 100644 kernel/labeling_before_policy_load/labeldump-expected.txt create mode 100644 kernel/labeling_before_policy_load/main.fmf create mode 100644 kernel/labeling_before_policy_load/module-setup.sh create mode 100644 kernel/labeling_before_policy_load/relabel.sh create mode 100755 kernel/labeling_before_policy_load/runtest.sh create mode 100644 kernel/policy_load_enomem_on_new_context/main.fmf create mode 100755 kernel/policy_load_enomem_on_new_context/runtest.sh create mode 100644 kernel/selinuxfs_dentry_softlockup/main.fmf create mode 100755 kernel/selinuxfs_dentry_softlockup/runtest.sh diff --git a/kernel/avc_corrupted_context/main.fmf b/kernel/avc_corrupted_context/main.fmf new file mode 100644 index 0000000..85fdb4e --- /dev/null +++ b/kernel/avc_corrupted_context/main.fmf @@ -0,0 +1,18 @@ +summary: Test SELinux labeling before initial policy load +description: | + Regression test for a bug where SELinux may have printed uninitialized + kernel memory instead of a valid source/target context in AVC denials. +contact: Ondrej Mosnacek +component: + - kernel +framework: beakerlib +require: + - memcached + - policycoreutils +duration: 5m +tier: 2 +enabled: true +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1758086 +environment: + AVC_ERROR: +no_avc_check diff --git a/kernel/avc_corrupted_context/runtest.sh b/kernel/avc_corrupted_context/runtest.sh new file mode 100755 index 0000000..51bf7ee --- /dev/null +++ b/kernel/avc_corrupted_context/runtest.sh @@ -0,0 +1,35 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# SPDX-License-Identifier: GPLv2 +# Copyright (c) 2022 Red Hat, Inc. +# Author: Ondrej Mosnacek + +# Include Beakerlib environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +rlJournalStart + rlPhaseStartSetup + rlRun "uname -r" 0 "Print running kernel version" + rlServiceStart memcached + rlPhaseEnd + + rlPhaseStartTest + rlRun "semodule -d memcached" 0 + rlRun "ps -Zp \$(pidof memcached) | grep unlabeled_t" 0 \ + "The service should be unlabeled now" + rlRun "load_policy" 0 + rlRun "semodule -e memcached" 0 + rlRun "ps -Zp \$(pidof memcached) | grep unlabeled_t" 1 \ + "The service shouldn't stay unlabeled" + rlRun "ps -Zp \$(pidof memcached) | grep system_r:memcached_t:s0" 0 \ + "The service should have the correct label" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "setenforce 0" 0 # service may be unlabeled + rlServiceStop memcached + rlRun "setenforce 1" 0 + rlServiceRestore memcached + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/kernel/avc_log_actual_context_if_invalid/main.fmf b/kernel/avc_log_actual_context_if_invalid/main.fmf new file mode 100644 index 0000000..44160b6 --- /dev/null +++ b/kernel/avc_log_actual_context_if_invalid/main.fmf @@ -0,0 +1,27 @@ +summary: Test logging of actual context in AVCs if it is invalid +description: | + Verify that SELinux logs the actual source/target context in a separate + AVC record field in case it is invalid. +contact: Ondrej Mosnacek +component: + - kernel +framework: beakerlib +require: + - library(selinux-policy/common) + - attr + - audit + - libselinux-utils + - policycoreutils + - selinux-policy +duration: 15m +tier: 2 +enabled: true +adjust: + - enabled: false + when: distro < rhel-8.1 + because: RHEL-8.0 and below is not expected to support this +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1670039 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1719666 +environment: + AVC_ERROR: +no_avc_check diff --git a/kernel/avc_log_actual_context_if_invalid/runtest.sh b/kernel/avc_log_actual_context_if_invalid/runtest.sh new file mode 100755 index 0000000..4ae5531 --- /dev/null +++ b/kernel/avc_log_actual_context_if_invalid/runtest.sh @@ -0,0 +1,101 @@ +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# SPDX-License-Identifier: GPLv2 +# Copyright (c) 2022 Red Hat, Inc. +# Author: Ondrej Mosnacek + +# Include Beakerlib environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +EXE4="reproducer4" +EXE6="reproducer6" +PORT=8000 + +UNLABELED_CONTEXT="system_u:object_r:unlabeled_t:s0" +INVALID_TCONTEXT="system_u:object_r:banana_t:s0" +INVALID_SCONTEXT="system_u:system_r:tor_t:s0" +INVALID_SCONTEXT_MODULE="tor" + +GARBAGE_TCONTEXT="kuřecí řízek" +GARBAGE_TCONTEXT_AUDIT="6B75C5996563C3AD20C599C3AD7A656B" + +rlJournalStart + rlPhaseStartSetup + rlImport "selinux-policy/common" # for audit daemon handling + + rlRun "uname -r" 0 "Print running kernel version" + + rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" + rlRun "pushd $TmpDir" + old_enforce=$(getenforce) + rlLog "Backing up SELinux status: $old_enforce" + rlRun "setenforce 0" 0 "Switching to permissive" + rlPhaseEnd + + # helper function for subtests: + function check_avcs() { + local field_main="$1" + local field_raw="$2" + local invalid_ctx="$3" + + rlRun "LANG=en_US ausearch --input-logs -ts $audit_ts --raw -m AVC | \ + grep -E '^type=AVC .* $field_main=$UNLABELED_CONTEXT' \ + >tmpavcs" 0 "Collect AVCs" + + unlabeled_avcs=$(cat tmpavcs | wc -l) + unlabeled_avcs_with_rawcon=$(cat tmpavcs | \ + grep " $field_raw=$invalid_ctx" | wc -l) + rlAssertEquals "Check that all AVCs with $field_main=unlabeled have $field_raw= with the correct label" \ + $unlabeled_avcs $unlabeled_avcs_with_rawcon + rlRun "cat tmpavcs" 0 "Print checked AVCs" + } + + rlPhaseStartTest "trawcon" + rlRun "touch foo" 0 "Creating the foo test file" + rlRun "setfattr -n security.selinux -v $INVALID_TCONTEXT foo" 0 \ + "Setting SELinux xattr of foo to an invalid value" + + audit_ts="$(date +'%x %T')"; sleep 1.1 + rlRun "runcon system_u:system_r:sshd_t:s0 cat foo" 0 \ + "Generating AVCs with invalid tcontext" + check_avcs tcontext trawcon "\"$INVALID_TCONTEXT\"" + rlPhaseEnd + + rlPhaseStartTest "trawcon-garbage" + rlRun "touch foo" 0 "Creating the foo test file" + rlRun "setfattr -n security.selinux -v '$GARBAGE_TCONTEXT' foo" 0 \ + "Setting SELinux xattr of foo to a garbage value" + + sleep 1.1; audit_ts="$(date +'%x %T')"; sleep 1.1 + rlRun "runcon system_u:system_r:sshd_t:s0 cat foo" 0 \ + "Generating AVCs with invalid tcontext" + check_avcs tcontext trawcon "$GARBAGE_TCONTEXT_AUDIT" + rlPhaseEnd + + rlPhaseStartTest "srawcon" + function gen_scontext_unlabeled_avc() { + local fifo="$1" + + # Start bash with tor label, then make it invalid, + # and try to do something under the invalid label: + runcon "$INVALID_SCONTEXT" \ + bash -c "cat $fifo > /dev/null; /dev/null" & + semodule -d "$INVALID_SCONTEXT_MODULE" + echo go! >$fifo + wait %1 + semodule -e "$INVALID_SCONTEXT_MODULE" + } + + sleep 1.1; audit_ts="$(date +'%x %T')"; sleep 1.1 + rlRun "mkfifo tmpfifo" 0 + rlRun "gen_scontext_unlabeled_avc tmpfifo" 0 \ + "Generating AVCs with invalid scontext" + check_avcs scontext srawcon "\"$INVALID_SCONTEXT\"" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "setenforce $old_enforce" 0 "Restoring SELinux status" + rlRun "popd" + rlRun "rm -r $TmpDir" 0 "Removing tmp directory" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/kernel/connect_AF_UNSPEC/main.fmf b/kernel/connect_AF_UNSPEC/main.fmf new file mode 100644 index 0000000..7afdbc4 --- /dev/null +++ b/kernel/connect_AF_UNSPEC/main.fmf @@ -0,0 +1,25 @@ +summary: Test connect(AF_UNSPEC) behavior +description: | + Ensure that connect(AF_UNSPEC) (should disconnect a connected socket) + works correctly under SELinux. +contact: Ondrej Mosnacek +component: + - kernel +framework: beakerlib +require: + - gcc + - nc + - strace +duration: 5m +tier: 2 +enabled: true +adjust: + - enabled: false + when: distro ~< rhel-8.1 + because: RHEL-8.0 is not expected to have the bug fixed + - enabled: false + when: distro ~< rhel-7.9 + because: RHEL-7.8 and below are not expected to have the bug fixed +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1707828 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1886305 diff --git a/kernel/connect_AF_UNSPEC/reproducer4.c b/kernel/connect_AF_UNSPEC/reproducer4.c new file mode 100644 index 0000000..def3f57 --- /dev/null +++ b/kernel/connect_AF_UNSPEC/reproducer4.c @@ -0,0 +1,46 @@ +#include +#include + +#include + +#include +#include +#include +#include + +int main(int argc, char **argv) +{ + int fd; + struct sockaddr_in addr; + struct sockaddr addr_unspec; + + if (argc < 2) + return 2; + + fd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP); + if (fd < 0) { + perror(argv[0]); + return 1; + } + + addr.sin_family = AF_INET; + addr.sin_port = htons(atoi(argv[1])); + addr.sin_addr.s_addr = htonl(INADDR_LOOPBACK); + + if (connect(fd, (struct sockaddr *)&addr, sizeof(addr)) < 0) { + perror(argv[0]); + close(fd); + return 1; + } + + memset(&addr_unspec, 0, sizeof(addr_unspec)); + addr_unspec.sa_family = AF_UNSPEC; + if (connect(fd, (struct sockaddr *)&addr_unspec, sizeof(addr_unspec)) < 0) { + perror(argv[0]); + close(fd); + return 1; + } + + close(fd); + return 0; +} diff --git a/kernel/connect_AF_UNSPEC/reproducer6.c b/kernel/connect_AF_UNSPEC/reproducer6.c new file mode 100644 index 0000000..169ed52 --- /dev/null +++ b/kernel/connect_AF_UNSPEC/reproducer6.c @@ -0,0 +1,47 @@ +#include +#include + +#include + +#include +#include +#include +#include + +int main(int argc, char **argv) +{ + int fd; + struct sockaddr_in6 addr; + struct sockaddr addr_unspec; + + if (argc < 2) + return 2; + + fd = socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP); + if (fd < 0) { + perror(argv[0]); + return 1; + } + + memset(&addr, 0, sizeof(addr)); + addr.sin6_family = AF_INET6; + addr.sin6_port = htons(atoi(argv[1])); + addr.sin6_addr = (struct in6_addr)IN6ADDR_LOOPBACK_INIT; + + if (connect(fd, (struct sockaddr *)&addr, sizeof(addr)) < 0) { + perror(argv[0]); + close(fd); + return 1; + } + + memset(&addr_unspec, 0, sizeof(addr_unspec)); + addr_unspec.sa_family = AF_UNSPEC; + if (connect(fd, (struct sockaddr *)&addr_unspec, sizeof(addr_unspec)) < 0) { + perror(argv[0]); + close(fd); + return 1; + } + + close(fd); + return 0; +} diff --git a/kernel/connect_AF_UNSPEC/runtest.sh b/kernel/connect_AF_UNSPEC/runtest.sh new file mode 100755 index 0000000..bc63688 --- /dev/null +++ b/kernel/connect_AF_UNSPEC/runtest.sh @@ -0,0 +1,39 @@ +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# SPDX-License-Identifier: GPLv2 +# Copyright (c) 2022 Red Hat, Inc. +# Author: Ondrej Mosnacek + +# Include Beakerlib environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +EXE4="reproducer4" +EXE6="reproducer6" +PORT=8000 + +rlJournalStart + rlPhaseStartSetup + rlRun "uname -r" 0 "Print running kernel version" + + rlRun "gcc -o $EXE4 reproducer4.c" 0 "Compile the IPv4 reproducer" + rlRun "gcc -o $EXE6 reproducer6.c" 0 "Compile the IPv6 reproducer" + rlRun "nc -4lk $PORT &" 0 "Start IPv4 server" + rlRun "nc -6lk $PORT &" 0 "Start IPv6 server" + rlPhaseEnd + + rlPhaseStartTest "IPv4" + rlRun "strace ./$EXE4 $PORT" 0 "Run the IPv4 reproducer" + rlPhaseEnd + + rlPhaseStartTest "IPv6" + rlRun "strace ./$EXE6 $PORT" 0 "Run the IPv6 reproducer" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "rm -f $EXE4" 0 "Removing the IPv4 reproducer binary" + rlRun "rm -f $EXE6" 0 "Removing the IPv6 reproducer binary" + rlRun "kill %1" 0 "Kill the IPv4 server" + rlRun "kill %2" 0 "Kill the IPv6 server" + rlRun "wait $(jobs -p)" 0 "Wait for the servers to terminate" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/kernel/getxattr_read_out_of_bounds/main.fmf b/kernel/getxattr_read_out_of_bounds/main.fmf new file mode 100644 index 0000000..f3360cb --- /dev/null +++ b/kernel/getxattr_read_out_of_bounds/main.fmf @@ -0,0 +1,23 @@ +summary: Reproducer for an out-of-bounds read on getxattr(2) +description: | + Verifies that it is not possible to trigger an out-of-bounds read by + setting the security.selinux xattr to a value containing a null character + and then trying to read back the xattr. + + See also: https://git.kernel.org/torvalds/c/efe3de79e0b5 +contact: Ondrej Mosnacek +component: + - kernel +framework: beakerlib +require: + - coreutils + - policycoreutils + - attr +duration: 5m +tier: 2 +enabled: true +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1584307 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1595706 +environment: + AVC_ERROR: +no_avc_check diff --git a/kernel/getxattr_read_out_of_bounds/runtest.sh b/kernel/getxattr_read_out_of_bounds/runtest.sh new file mode 100755 index 0000000..8ae46c1 --- /dev/null +++ b/kernel/getxattr_read_out_of_bounds/runtest.sh @@ -0,0 +1,36 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# SPDX-License-Identifier: GPLv2 +# Copyright (c) 2018-2022 Red Hat, Inc. +# Author: Ondrej Mosnacek + +# Include Beakerlib environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +rlJournalStart + rlPhaseStartSetup + rlRun "uname -r" 0 "Print running kernel version" + rlRun "touch testfile" + reset_enforcing=0 + if [ "$(getenforce)" = "Enforcing" ]; then + rlRun "setenforce 0" 0 "Switch to permissive" + reset_enforcing=1 + fi + rlPhaseEnd + + rlPhaseStartTest + rlRun "setfattr -n security.selinux -v 'a\\0aaaaaaaaaaaaaaaa' testfile" 0 \ + "Try to set a label with a null char in it" + rlRun "getfattr -e hex -n security.selinux testfile" + rlRun "getfattr -e hex -n security.selinux testfile | grep -E '0x6100[0-9a-f]+'" 1 \ + "Check for junk in the output of getfattr" + rlPhaseEnd + + rlPhaseStartCleanup + if [ "$reset_enforcing" -eq 1 ]; then + rlRun "setenforce 1" 0 "Switch back to enforcing" + fi + rlRun "rm -f testfile" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/kernel/journald_performance/main.fmf b/kernel/journald_performance/main.fmf new file mode 100644 index 0000000..755f41a --- /dev/null +++ b/kernel/journald_performance/main.fmf @@ -0,0 +1,24 @@ +summary: Test journald performance under SELinux +description: | + Regression test for a bug where systemd-journald suffered a terrible + performance overhead due to SELinux. +contact: Ondrej Mosnacek +component: + - kernel +framework: beakerlib +require: + - perf + - util-linux + - coreutils + - perl-interpreter + - perl-open + - git-core +duration: 30m +tier: 2 +enabled: true +adjust: + - enabled: false + when: distro < rhel-8.3 + because: RHEL-8.2 and below are not expected to have the bug fixed +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1733259 diff --git a/kernel/journald_performance/runtest.sh b/kernel/journald_performance/runtest.sh new file mode 100755 index 0000000..bb960db --- /dev/null +++ b/kernel/journald_performance/runtest.sh @@ -0,0 +1,51 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# SPDX-License-Identifier: GPLv2 +# Copyright (c) 2022 Red Hat, Inc. +# Author: Ondrej Mosnacek + +# Include Beakerlib environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +FG_URL="https://github.com/brendangregg/FlameGraph" +FG_DIR="FlameGraph" + +TARGET_SYMBOL="security_secid_to_secctx" +LIMIT="10.00%" + +rlJournalStart + rlPhaseStartSetup + rlRun "uname -r" 0 "Print running kernel version" + + rlRun "git clone $FG_URL $FG_DIR" + rlPhaseEnd + + rlPhaseStartTest + JOURNALD_PID=$(pidof systemd-journald) + rlLog "PID of systemd-journald is $JOURNALD_PID" + + rlRun "cat /dev/urandom | base64 | logger &" 0 \ + "Flood systemd-journald with data" + rlRun "timeout 30s perf record -o perf.data -p $(pidof systemd-journald) -g --call-graph dwarf" 124 \ + "Capture perf data on systemd-journald" + rlRun "kill %1" + + rlRun "perf script -i perf.data | $FG_DIR/stackcollapse-perf.pl | $FG_DIR/flamegraph.pl > flamegraph.svg" + + rlRun "perf report -i perf.data -g none --pretty raw | grep $TARGET_SYMBOL" + PERCENT="$(perf report -g none --pretty raw | grep $TARGET_SYMBOL | \ + grep -Eo '[0-9]+\.[0-9]+%' | head -n 1)" + rlLog "Detected that $TARGET_SYMBOL took up $PERCENT of time (limit $LIMIT)." + rlRun "{ echo \$PERCENT; echo \$LIMIT; } | sort -n | tail -n 1 | grep \$LIMIT" 0 \ + "Check that time usage is within limit" + rlPhaseEnd + + rlPhaseStartCleanup + rlFileSubmit "perf.data" + rlFileSubmit "flamegraph.svg" + + rlRun "rm -rf $FG_DIR" + rlRun "rm -f perf.data flamegraph.svg" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/kernel/keycreate_empty_value/main.fmf b/kernel/keycreate_empty_value/main.fmf new file mode 100644 index 0000000..80cfd80 --- /dev/null +++ b/kernel/keycreate_empty_value/main.fmf @@ -0,0 +1,20 @@ +summary: Test writing empty value into /proc/self/attr/keycreate +description: | + Verifies that writing an empty value into /proc//attr/keycreate + is allowed. +contact: Ondrej Mosnacek +component: + - kernel +framework: beakerlib +require: + - policycoreutils + - gcc +duration: 5m +tier: 2 +enabled: true +adjust: + - enabled: false + when: distro < rhel-8.1 + because: RHEL-8.0 and below are not expected to have the bug fixed +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1719067 diff --git a/kernel/keycreate_empty_value/reproducer.c b/kernel/keycreate_empty_value/reproducer.c new file mode 100644 index 0000000..fa09608 --- /dev/null +++ b/kernel/keycreate_empty_value/reproducer.c @@ -0,0 +1,22 @@ +#include +#include +#include +#include +#include + +int main(void) +{ + int fd, r; + + fd = open("/proc/self/attr/keycreate", O_WRONLY); + if (fd < 0) { + perror("open"); + } + + r = write(fd, "", 0); + if (r < 0) { + perror("write"); + } + + return !!r; +} diff --git a/kernel/keycreate_empty_value/runtest.sh b/kernel/keycreate_empty_value/runtest.sh new file mode 100755 index 0000000..d8a0034 --- /dev/null +++ b/kernel/keycreate_empty_value/runtest.sh @@ -0,0 +1,37 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# SPDX-License-Identifier: GPLv2 +# Copyright (c) 2022 Red Hat, Inc. +# Author: Ondrej Mosnacek + +# Include Beakerlib environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +EXE="reproducer" + +rlJournalStart + rlPhaseStartSetup + rlRun "uname -r" 0 "Print running kernel version" + + enable_container=0 + if semodule -l | grep -q container; then + rlRun "semodule -d container" 0 "Disable the container module" + enable_container=1 + fi + + rlRun "gcc -o $EXE reproducer.c" 0 "Compile the reproducer" + rlPhaseEnd + + rlPhaseStartTest + rlRun "./$EXE" 0 "Run the reproducer" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "rm -f $EXE" 0 "Remove the reproducer binary" + + if [ "$enable_container" -eq 1 ]; then + rlRun "semodule -e container" 0 "Re-enable the container module" + fi + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/kernel/labeling_before_policy_load/labeldump-expected.txt b/kernel/labeling_before_policy_load/labeldump-expected.txt new file mode 100644 index 0000000..da985b5 --- /dev/null +++ b/kernel/labeling_before_policy_load/labeldump-expected.txt @@ -0,0 +1,3 @@ +system_u:object_r:etc_t:s0 + +system_u:object_r:etc_t:s0 diff --git a/kernel/labeling_before_policy_load/main.fmf b/kernel/labeling_before_policy_load/main.fmf new file mode 100644 index 0000000..edddad8 --- /dev/null +++ b/kernel/labeling_before_policy_load/main.fmf @@ -0,0 +1,27 @@ +summary: Test SELinux labeling before initial policy load +description: | + Verifies that reading/writing SELinux labels works before the first policy + load. + + See also: + https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3e3e24b42043eceb97ed834102c2d094dfd7aaa6 + https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c8e222616c7e98305bdc861db3ccac520bc29921 + https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9530a3e00459cd6eabf050133205e0e8fecbdfc7 +contact: Ondrej Mosnacek +component: + - kernel +framework: beakerlib +require: + - dracut + - coreutils + - policycoreutils + - attr +duration: 30m +tier: 2 +enabled: true +adjust: + - enabled: false + when: distro < rhel-8.3 + because: RHEL-8.2 and below are not expected to support this +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1777525 diff --git a/kernel/labeling_before_policy_load/module-setup.sh b/kernel/labeling_before_policy_load/module-setup.sh new file mode 100644 index 0000000..d76aa67 --- /dev/null +++ b/kernel/labeling_before_policy_load/module-setup.sh @@ -0,0 +1,17 @@ +#!/bin/bash + +# called by dracut +check() { + return 0 +} + +# called by dracut +depends() { + return 0 +} + +# called by dracut +install() { + inst_hook pre-pivot 50 "$moddir/relabel.sh" + inst_multiple setfiles getfattr +} diff --git a/kernel/labeling_before_policy_load/relabel.sh b/kernel/labeling_before_policy_load/relabel.sh new file mode 100644 index 0000000..18c0cc6 --- /dev/null +++ b/kernel/labeling_before_policy_load/relabel.sh @@ -0,0 +1,15 @@ +#!/bin/bash + +function dumpcon() { + getfattr --only-values -n security.selinux "$@" | tr -d '\000' + echo +} + +mount -o remount,rw /sysroot +dumpcon /sysroot/etc >/sysroot/etc/labeldump +echo test > /sysroot/etc/testfile +dumpcon /sysroot/etc/testfile >>/sysroot/etc/labeldump +setfiles -vF -r /sysroot \ + /sysroot/etc/selinux/targeted/contexts/files/file_contexts \ + /sysroot/etc +dumpcon /sysroot/etc/testfile >>/sysroot/etc/labeldump diff --git a/kernel/labeling_before_policy_load/runtest.sh b/kernel/labeling_before_policy_load/runtest.sh new file mode 100755 index 0000000..ff92dfd --- /dev/null +++ b/kernel/labeling_before_policy_load/runtest.sh @@ -0,0 +1,46 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# SPDX-License-Identifier: GPLv2 +# Copyright (c) 2022 Red Hat, Inc. +# Author: Ondrej Mosnacek + +# Include Beakerlib environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +rlJournalStart +if [ $TMT_REBOOT_COUNT -lt 1 ]; then + rlPhaseStartSetup "Setup" + rlRun "uname -r" 0 "Kernel version before reboot" + + rlRun "install -d /usr/lib/dracut/modules.d/97bz1777525" + rlRun "install module-setup.sh relabel.sh /usr/lib/dracut/modules.d/97bz1777525" + rlRun "dracut --regenerate-all -f" + if command -v zipl >/dev/null; then + rlRun "zipl" + fi + rlPhaseEnd + + rlPhaseStartSetup "Reboot" + tmt-reboot +fi + rlRun "uname -r" 0 "Kernel version after reboot" + rlPhaseEnd + + rlPhaseStartTest "Test" + # Test writing labels (BZ 1777525) + rlRun "ls -lZ /etc/testfile" + rlRun "ls -lZ /etc/testfile | grep -qF ':etc_t:'" 0 \ + "/etc/testfile is labeled correctly" + + # Test reading labels (BZ 1839819) + rlRun "cat /etc/labeldump" + rlAssertNotDiffer "/etc/labeldump" labeldump-expected.txt + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "rm -f /etc/labeldump /etc/testfile" + rlRun "rm -rf /usr/lib/dracut/modules.d/97bz1777525" + rlRun "dracut -f" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/kernel/policy_load_enomem_on_new_context/main.fmf b/kernel/policy_load_enomem_on_new_context/main.fmf new file mode 100644 index 0000000..0f69dae --- /dev/null +++ b/kernel/policy_load_enomem_on_new_context/main.fmf @@ -0,0 +1,17 @@ +summary: Test that creating a new SELinux context doesn't fail during policy load +description: | + Verifies that there are no ENOMEM errors when the kernel encounters a new + SELinux context during a policy load. +contact: Ondrej Mosnacek +component: + - kernel +framework: beakerlib +require: + - policycoreutils + - diffutils +duration: 10m +tier: 2 +enabled: true +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1335986 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1656787 diff --git a/kernel/policy_load_enomem_on_new_context/runtest.sh b/kernel/policy_load_enomem_on_new_context/runtest.sh new file mode 100755 index 0000000..a6c7196 --- /dev/null +++ b/kernel/policy_load_enomem_on_new_context/runtest.sh @@ -0,0 +1,36 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# SPDX-License-Identifier: GPLv2 +# Copyright (c) 2019-2022 Red Hat, Inc. +# Author: Milos Malik + +# Include Beakerlib environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +rlJournalStart + rlPhaseStartSetup + rlRun "uname -r" 0 "Print running kernel version" + rlPhaseEnd + + rlPhaseStartTest "bz#1335986 + bz#1656787" + rlRun "dmesg > before.txt" + rlRun "while true; do load_policy; sleep 0.1; done &" 0 \ + "Start reloading the policy in a loop" + + function runcon_loop() { + for (( i = 0; i < 1024; i++ )); do + runcon -l s0:c$i true || return 1 + done + return 0 + } + rlRun "runcon_loop" 0 "Run runcon in a loop with varying contexts" + rlRun "dmesg > after.txt" + rlRun "diff before.txt after.txt | grep -e inode_doinit_with_dentry -e context_to_sid" 1 + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "kill \$(jobs -p)" 0 "Terminate background jobs" + rlRun "wait" 0 "Wait for background jobs to terminate" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/kernel/selinuxfs_dentry_softlockup/main.fmf b/kernel/selinuxfs_dentry_softlockup/main.fmf new file mode 100644 index 0000000..5043c2e --- /dev/null +++ b/kernel/selinuxfs_dentry_softlockup/main.fmf @@ -0,0 +1,18 @@ +summary: Test soft lockup on selinuxfs dentry lookup +description: | + Verifies that traversing selinuxfs while policy is being reloaded doesn't + cause a deadlock in the kernel. +contact: Ondrej Mosnacek +component: + - kernel +framework: beakerlib +require: + - policycoreutils + - findutils +duration: 5m +tier: 2 +enabled: true +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1510603 +extra-hardware: | + keyvalue = PROCESSORS >= 2 diff --git a/kernel/selinuxfs_dentry_softlockup/runtest.sh b/kernel/selinuxfs_dentry_softlockup/runtest.sh new file mode 100755 index 0000000..779df6d --- /dev/null +++ b/kernel/selinuxfs_dentry_softlockup/runtest.sh @@ -0,0 +1,37 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# SPDX-License-Identifier: GPLv2 +# Copyright (c) 2022 Red Hat, Inc. +# Author: Ondrej Mosnacek + +# Include Beakerlib environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +rlJournalStart + rlPhaseStartSetup + rlRun "uname -r" 0 "Print running kernel version" + rlPhaseEnd + + rlPhaseStartTest + rlAssertGreaterOrEqual "Ensure the machine has at least two cores" \ + "$(nproc)" 2 + + rlRun "(cd /sys/fs/selinux; while true; do find >/dev/null 2>&1; done) &" + rlRun "while true; do load_policy; sleep 0.1; done &" + + function check_soft_lockup() { + for (( i = 0; i < 60; i++ )); do + dmesg | grep 'BUG: soft lockup' && return 1 + sleep 1 + done + return 0 + } + rlRun "check_soft_lockup" 0 "Wait and see if soft lockup appears in dmesg" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "kill \$(jobs -p)" 0 "Terminate background jobs" + rlRun "wait" 0 "Wait for background jobs to terminate" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd From 269502e64d4642b20804f4b51a4eb3f6cd3a1a6a Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Thu, 15 Sep 2022 15:20:55 +0200 Subject: [PATCH 175/626] kernel/labeling_before_...: use --regenerate-all also during cleanup Otheriwse older kernel entries would still have our injected scripts in the initramfs after test execution. Signed-off-by: Ondrej Mosnacek --- kernel/labeling_before_policy_load/runtest.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/labeling_before_policy_load/runtest.sh b/kernel/labeling_before_policy_load/runtest.sh index ff92dfd..65956bf 100755 --- a/kernel/labeling_before_policy_load/runtest.sh +++ b/kernel/labeling_before_policy_load/runtest.sh @@ -40,7 +40,7 @@ fi rlPhaseStartCleanup rlRun "rm -f /etc/labeldump /etc/testfile" rlRun "rm -rf /usr/lib/dracut/modules.d/97bz1777525" - rlRun "dracut -f" + rlRun "dracut --regenerate-all -f" rlPhaseEnd rlJournalPrintText rlJournalEnd From 8d27520fad8f9f6c662585c23bc9ed5844dcc6e1 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Thu, 22 Sep 2022 20:48:54 +0200 Subject: [PATCH 176/626] add new automated test which covers the caddy service This TC covers the caddy service and its basic scenario with default configuration. Purpose of this TC is to find any SELinux interferences with the caddy service. The TC covers BZ#1706651 and BZ#2122886. --- selinux-policy/caddy-and-similar/Makefile | 69 +++++++++++++++++ selinux-policy/caddy-and-similar/PURPOSE | 5 ++ selinux-policy/caddy-and-similar/main.fmf | 32 ++++++++ selinux-policy/caddy-and-similar/runtest.sh | 85 +++++++++++++++++++++ 4 files changed, 191 insertions(+) create mode 100644 selinux-policy/caddy-and-similar/Makefile create mode 100644 selinux-policy/caddy-and-similar/PURPOSE create mode 100644 selinux-policy/caddy-and-similar/main.fmf create mode 100755 selinux-policy/caddy-and-similar/runtest.sh diff --git a/selinux-policy/caddy-and-similar/Makefile b/selinux-policy/caddy-and-similar/Makefile new file mode 100644 index 0000000..7bd0661 --- /dev/null +++ b/selinux-policy/caddy-and-similar/Makefile @@ -0,0 +1,69 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/caddy-and-similar +# Description: SELinux interferes with caddy services and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2022 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/caddy-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with caddy services and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console caddy /usr/sbin/semanage" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA) + @echo "Bug: 1706651" >> $(METADATA) # Fedora 30 + @echo "Bug: 2122886" >> $(METADATA) # Fedora 36 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/caddy-and-similar/PURPOSE b/selinux-policy/caddy-and-similar/PURPOSE new file mode 100644 index 0000000..b87aa22 --- /dev/null +++ b/selinux-policy/caddy-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/caddy-and-similar +Author: Milos Malik + +Description: SELinux interferes with caddy services and related programs + diff --git a/selinux-policy/caddy-and-similar/main.fmf b/selinux-policy/caddy-and-similar/main.fmf new file mode 100644 index 0000000..f334e91 --- /dev/null +++ b/selinux-policy/caddy-and-similar/main.fmf @@ -0,0 +1,32 @@ +summary: SELinux interferes with caddy services and related programs +description: |+ + SELinux interferes with caddy services and related programs + +contact: Milos Malik +component: + - selinux-policy +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - caddy + - /usr/sbin/semanage +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 + because: the caddy package is not available there +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1706651 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2122886 +extra-summary: /CoreOS/selinux-policy/Regression/caddy-and-similar +extra-task: /CoreOS/selinux-policy/Regression/caddy-and-similar diff --git a/selinux-policy/caddy-and-similar/runtest.sh b/selinux-policy/caddy-and-similar/runtest.sh new file mode 100755 index 0000000..6af5376 --- /dev/null +++ b/selinux-policy/caddy-and-similar/runtest.sh @@ -0,0 +1,85 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/caddy-and-similar +# Description: SELinux interferes with caddy services and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2022 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +SERVICE_PACKAGE="caddy" +PROCESS_NAME="caddy" +PROCESS_CONTEXT="httpd_t" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop caddy caddy-api + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "bz#1706651" + rlSEMatchPathCon "/usr/bin/caddy" "httpd_exec_t" + rlSEMatchPathCon "/var/lib/caddy" "httpd_var_lib_t" + rlSESearchRule "allow init_t httpd_exec_t : file { getattr open read execute } [ ]" + rlSESearchRule "type_transition init_t httpd_exec_t : process httpd_t [ ]" + rlSESearchRule "allow init_t httpd_t : process { transition } [ ]" + rlSESearchRule "allow init_t httpd_var_lib_t : dir { mounton } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#2122886" + rlSEMatchPathCon "/usr/bin/caddy" "httpd_exec_t" + rlRun "ls -Z /proc/sys/net/core/somaxconn | grep :sysctl_net_t" + rlSESearchRule "allow httpd_t sysctl_net_t : file { getattr open read } [ ]" + rlPhaseEnd + + rlPhaseStartTest "real scenario -- standalone service" + rlRun "semanage fcontext -l -C | grep caddy" + for SERVICE_NAME in caddy caddy-api ; do + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /run /var" 0-255 + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + done + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlServiceRestore caddy caddy-api + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + From 7eff6e0a4759874c161623e43bddbbd4b1f88b11 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Fri, 23 Sep 2022 12:38:51 +0200 Subject: [PATCH 177/626] test if blueman-mechanism can read ~/.local/lib/python*/site-packages/ The use of blueman-mechanism service revealed that SELinux prevents the blueman-mechanism process from reading the content of /root/.local/lib/python3.10/site-packages/ directory. The TC reproduces the situation. Because the blueman-mechanism program is written in Python, it makes sense to look for locally installed Python modules. In order to support the basic Python principles, I believe that SELinux policy should allow this access. The TC looks for appropriate policy rules and file context patterns. The TC covers BZ#2027044. --- selinux-policy/blueman-and-similar/Makefile | 1 + selinux-policy/blueman-and-similar/main.fmf | 1 + selinux-policy/blueman-and-similar/runtest.sh | 11 ++++++++++- 3 files changed, 12 insertions(+), 1 deletion(-) diff --git a/selinux-policy/blueman-and-similar/Makefile b/selinux-policy/blueman-and-similar/Makefile index 79f0160..5b1d70a 100644 --- a/selinux-policy/blueman-and-similar/Makefile +++ b/selinux-policy/blueman-and-similar/Makefile @@ -62,6 +62,7 @@ $(METADATA): Makefile @echo "Destructive: no" >> $(METADATA) @echo "Releases: -RHEL4 -RHELClient5 -RHELServer5 -RHEL6 -RHEL7" >> $(METADATA) @echo "Bug: 1470501" >> $(METADATA) # Fedora + @echo "Bug: 2027044" >> $(METADATA) # Fedora 35 rhts-lint $(METADATA) diff --git a/selinux-policy/blueman-and-similar/main.fmf b/selinux-policy/blueman-and-similar/main.fmf index d405840..ced85dd 100644 --- a/selinux-policy/blueman-and-similar/main.fmf +++ b/selinux-policy/blueman-and-similar/main.fmf @@ -32,6 +32,7 @@ tag: - targeted link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1470501 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2027044 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7, rhel-8, rhel-9 diff --git a/selinux-policy/blueman-and-similar/runtest.sh b/selinux-policy/blueman-and-similar/runtest.sh index 5ef0cac..f10bf19 100755 --- a/selinux-policy/blueman-and-similar/runtest.sh +++ b/selinux-policy/blueman-and-similar/runtest.sh @@ -83,13 +83,22 @@ rlJournalStart rlPhaseEnd fi + rlPhaseStartTest "bz#2027044" + rlSEMatchPathCon "/usr/libexec/blueman-mechanism" "blueman_exec_t" + rlSEMatchPathCon "/root/.local/lib/python3.10/site-packages" "gconf_home_t" + rlSESearchRule "allow blueman_t gconf_home_t : dir { read } [ ]" + rlPhaseEnd + rlPhaseStartTest "real scenario -- standalone service" rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" if ! rlSEDefined ${PROCESS_CONTEXT} ; then # for RHELs where the SELinux domain does not exist yet PROCESS_CONTEXT="initrc_t" fi - rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status restart status stop status" 1 + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + PYTHON_VERSION=`python --version | tr -d ' ' | cut -d . -f 1,2 | tr '[:upper:]' '[:lower:]'` + rlRun "mkdir -p ~/.local/lib/${PYTHON_VERSION}/site-packages/" + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd rlPhaseStartCleanup From 31f776e00a01428b7808357eef2347f1fa43028d Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Fri, 21 Oct 2022 13:55:56 +0200 Subject: [PATCH 178/626] Can libsepol handle users declared in modules? https://bugzilla.redhat.com/show_bug.cgi?id=2136212 --- libsepol/user-declaration-in-module/foo.te | 8 ++++++ libsepol/user-declaration-in-module/main.fmf | 12 ++++++++ libsepol/user-declaration-in-module/test.sh | 29 ++++++++++++++++++++ 3 files changed, 49 insertions(+) create mode 100644 libsepol/user-declaration-in-module/foo.te create mode 100644 libsepol/user-declaration-in-module/main.fmf create mode 100755 libsepol/user-declaration-in-module/test.sh diff --git a/libsepol/user-declaration-in-module/foo.te b/libsepol/user-declaration-in-module/foo.te new file mode 100644 index 0000000..74ee9c9 --- /dev/null +++ b/libsepol/user-declaration-in-module/foo.te @@ -0,0 +1,8 @@ +module foo 0.0.1; +require { + role staff_r; + sensitivity s0; + category c0; + category c1023; +} +user foo_u roles staff_r level s0 range s0 - s0:c0.c1023; diff --git a/libsepol/user-declaration-in-module/main.fmf b/libsepol/user-declaration-in-module/main.fmf new file mode 100644 index 0000000..73aad74 --- /dev/null +++ b/libsepol/user-declaration-in-module/main.fmf @@ -0,0 +1,12 @@ +summary: Can libsepol handle users declared in modules? +test: ./test.sh +framework: beakerlib +component: + - libsepol +require: + - libsepol-devel + - selinux-policy-devel +tier: 1 +enabled: true +link: + - https://bugzilla.redhat.com/show_bug.cgi?id=2136212 diff --git a/libsepol/user-declaration-in-module/test.sh b/libsepol/user-declaration-in-module/test.sh new file mode 100755 index 0000000..90ab796 --- /dev/null +++ b/libsepol/user-declaration-in-module/test.sh @@ -0,0 +1,29 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# SPDX-License-Identifier: GPLv2 +# Copyright (c) 2022 Red Hat, Inc. +# Author: Petr Lautrbach + +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +rlJournalStart + rlPhaseStartSetup + rlRun "tmp=\$(mktemp -d)" 0 "Create tmp directory" + rlRun "cp foo.te $tmp" + rlRun "pushd $tmp" + rlRun "set -o pipefail" + rlAssertRpm "libsepol" + rlAssertRpm "selinux-policy-devel" + rlPhaseEnd + + rlPhaseStartTest + rlRun "make -f /usr/share/selinux/devel/Makefile foo.pp" 0 "Build a module with user declaration" + rlRun "semodule -i foo.pp" 0 + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "semodule -r foo" 0 + rlRun "popd" + rlRun "rm -r $tmp" 0 "Remove tmp directory" + rlPhaseEnd +rlJournalEnd From efc6c0b001cc0a48858b9826205080e3d774e6f9 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Wed, 19 Oct 2022 09:19:54 +0200 Subject: [PATCH 179/626] test if systemd can read symlinks under /var/lib/ The use of DynamicUser and StateDirectory features of systemd in customer environments revealed that SELinux prevents the systemd processes from reading the symbolic links under /var/lib directory. The TC reproduces the situation. Detailed information can be found at: * https://www.redhat.com/sysadmin/systemd-secure-services In order to fully support the systemd secure services feature, I believe that SELinux policy should allow this access. The TC looks for appropriate policy rules and file context patterns. The TC covers BZ#2118784. --- selinux-policy/systemd-run-and-similar/Makefile | 1 + selinux-policy/systemd-run-and-similar/main.fmf | 1 + selinux-policy/systemd-run-and-similar/runtest.sh | 9 +++++++++ 3 files changed, 11 insertions(+) diff --git a/selinux-policy/systemd-run-and-similar/Makefile b/selinux-policy/systemd-run-and-similar/Makefile index db39990..9211248 100644 --- a/selinux-policy/systemd-run-and-similar/Makefile +++ b/selinux-policy/systemd-run-and-similar/Makefile @@ -63,6 +63,7 @@ $(METADATA): Makefile @echo "Bug: 1559409" >> $(METADATA) # Fedora 27 @echo "Bug: 1647162" >> $(METADATA) # Fedora 29 @echo "Bug: 1980241" >> $(METADATA) # Fedora 34 + @echo "Bug: 2118784" >> $(METADATA) # RHEL-8 rhts-lint $(METADATA) diff --git a/selinux-policy/systemd-run-and-similar/main.fmf b/selinux-policy/systemd-run-and-similar/main.fmf index 30fce17..0201f70 100644 --- a/selinux-policy/systemd-run-and-similar/main.fmf +++ b/selinux-policy/systemd-run-and-similar/main.fmf @@ -35,6 +35,7 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1559409 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1647162 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1980241 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2118784 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 diff --git a/selinux-policy/systemd-run-and-similar/runtest.sh b/selinux-policy/systemd-run-and-similar/runtest.sh index b594138..6645068 100755 --- a/selinux-policy/systemd-run-and-similar/runtest.sh +++ b/selinux-policy/systemd-run-and-similar/runtest.sh @@ -62,6 +62,15 @@ rlJournalStart fi rlPhaseEnd + rlPhaseStartTest "bz#2118784" + rlSEMatchPathCon "/var/lib" "var_lib_t" + rlSEMatchPathCon "/var/lib/myservice0" "var_lib_t" + rlSESearchRule "allow init_t var_lib_t : lnk_file { getattr read } [ ]" + rlRun "systemd-run -p DynamicUser=yes -p StateDirectory=myservice0 touch /var/lib/myservice0/foo" + rlRun "systemd-run -p DynamicUser=yes -p StateDirectory=myservice0 --pipe wc -c /var/lib/myservice0/foo" + rlRun "ls -alZ /var/lib/myservice0 /var/lib/private/myservice0" + rlPhaseEnd + rlPhaseStartCleanup sleep 2 rlSECheckAVC From 289ec8d0b8dab555da3d2c59380a362083910288 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 1 Nov 2022 10:52:27 +0100 Subject: [PATCH 180/626] use a larger file for mkfs.xfs testing The automated test used to work with 100MB files. Unfortunately, the mkfs.xfs program started to complain recently: Filesystem must be larger than 300MB. In order to use the automated test successfully in the future, the allocated space was increased to 400MB. --- other/mounting/runtest.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/other/mounting/runtest.sh b/other/mounting/runtest.sh index c8532b3..34b6815 100755 --- a/other/mounting/runtest.sh +++ b/other/mounting/runtest.sh @@ -38,7 +38,7 @@ rlJournalStart rlAssertRpm "dosfstools" # create a loopback device - rlRun "fallocate -l 100M loop_file" + rlRun "fallocate -l 400M loop_file" rlRun "losetup -f loop_file" rlRun "losetup -l | grep loop_file" DEV="$(losetup -l | tail -n 1 | cut -f1 -d' ')" From 8f54ba515e28aed3bdf48b0ba5360d717f7d7a2f Mon Sep 17 00:00:00 2001 From: Amith Kumar Date: Wed, 26 Oct 2022 06:26:19 +0530 Subject: [PATCH 181/626] harden tools to block rogue python modules Add test to policycoreutils/Regression suite which verifies bug 2128976 and ensures that irrelevant python scripts are not given precedence over tools like semanage. Signed-off-by: Amith Kumar --- .../python-module-precedence-issue/Makefile | 65 +++++++++++++++++++ .../python-module-precedence-issue/PURPOSE | 4 ++ .../python-module-precedence-issue/main.fmf | 29 +++++++++ .../python-module-precedence-issue/runtest.sh | 59 +++++++++++++++++ 4 files changed, 157 insertions(+) create mode 100644 policycoreutils/python-module-precedence-issue/Makefile create mode 100644 policycoreutils/python-module-precedence-issue/PURPOSE create mode 100644 policycoreutils/python-module-precedence-issue/main.fmf create mode 100755 policycoreutils/python-module-precedence-issue/runtest.sh diff --git a/policycoreutils/python-module-precedence-issue/Makefile b/policycoreutils/python-module-precedence-issue/Makefile new file mode 100644 index 0000000..a5c30d3 --- /dev/null +++ b/policycoreutils/python-module-precedence-issue/Makefile @@ -0,0 +1,65 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/policycoreutils/Regression/python-module-precedence-issue +# Description: Tools like semanage must be hardened to avoid loading +# rogue python modules that could lead to unexpected failures. +# Author: Amith Kumar +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2022 Red Hat, Inc. +# +# This program is free software: you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation, either version 2 of +# the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see http://www.gnu.org/licenses/. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/policycoreutils/Regression/python-module-precedence-issue +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + test -x runtest.sh || chmod a+x runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Amith Kumar " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: Tools must be hardened to block unwanted python modules" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 1m" >> $(METADATA) + @echo "RunFor: policycoreutils" >> $(METADATA) + @echo "Requires: policycoreutils /usr/sbin/semanage" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2+" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Bug: 2128976" >> $(METADATA) + @echo "Releases: -RHEL4 -RHELClient5 -RHELServer5 -RHEL6" >> $(METADATA) + + rhts-lint $(METADATA) + diff --git a/policycoreutils/python-module-precedence-issue/PURPOSE b/policycoreutils/python-module-precedence-issue/PURPOSE new file mode 100644 index 0000000..b392571 --- /dev/null +++ b/policycoreutils/python-module-precedence-issue/PURPOSE @@ -0,0 +1,4 @@ +PURPOSE of /CoreOS/policycoreutils/Regression/python-module-precedence-issue +Description: Tools like semanage must be hardened to avoid loading rogue python modules that + could lead to unexpected failures. +Author: Amith Kumar diff --git a/policycoreutils/python-module-precedence-issue/main.fmf b/policycoreutils/python-module-precedence-issue/main.fmf new file mode 100644 index 0000000..48568bc --- /dev/null +++ b/policycoreutils/python-module-precedence-issue/main.fmf @@ -0,0 +1,29 @@ +summary: Harden tools to avoid loading of unchecked python modules. +description: Tools like semanage must be hardened to avoid loading rogue python modules that could lead to unexpected failures. +contact: Amith Kumar + +component: + - policycoreutils +test: ./runtest.sh +framework: beakerlib +recommend: + - policycoreutils + - /usr/sbin/semanage +duration: 1m +enabled: true +tag: + - CI-Tier-1 + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - TIPpass_Security + - TierCandidatesPASS + - f32friendly + - f33friendly + - targeted +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2128976 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6 + continue: false diff --git a/policycoreutils/python-module-precedence-issue/runtest.sh b/policycoreutils/python-module-precedence-issue/runtest.sh new file mode 100755 index 0000000..7e91592 --- /dev/null +++ b/policycoreutils/python-module-precedence-issue/runtest.sh @@ -0,0 +1,59 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/policycoreutils/Regression/python-module-precedence-issue +# Description: Tools like semanage must be hardened to avoid loading +# rogue python modules that could lead to unexpected failures. +# Author: Amith Kumar +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2022 Red Hat, Inc. +# +# This program is free software: you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation, either version 2 of +# the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see http://www.gnu.org/licenses/. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="policycoreutils" + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm $PACKAGE + rlRun "tmpDir=\$(mktemp -d)" 0 "Creating tmp directory" + rlRun "pushd $tmpDir" + rlPhaseEnd + + rlPhaseStartTest "bz2128976 Tools must be hardened to not load rogue python modules" + # Create a custom python script in /usr/sbin +cat > /usr/sbin/audit.py << EOF +import sys +print("BAD GUY!", file=sys.stderr) +sys.exit(1) +EOF + # List all boolean records + rlRun "semanage boolean -l > /dev/null" 0 + rlPhaseEnd + + rlPhaseStartCleanup + # Remove irrelevant files + rlRun "rm /usr/sbin/audit.py" + rlRun "popd" + rlRun "rm -r $tmpDir" 0 "Removing tmp directory" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd From 61ef9e61853e9b3a3b3713817cd71915e3673c7b Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Mon, 31 Oct 2022 18:38:49 +0100 Subject: [PATCH 182/626] add the Tier test plans Purpose of the Tier1 test plan is to gather all Tier1 tests in this repository. Purpose of the Tier2 test plan is to gather all Tier2 tests in this repository. Purpose of the Tier3 test plan is to gather all Tier3 tests in this repository. --- libsepol/user-declaration-in-module/Makefile | 64 ++++++++++++++++++++ plans/tier1.fmf | 11 ++++ plans/tier2.fmf | 11 ++++ plans/tier3.fmf | 11 ++++ 4 files changed, 97 insertions(+) create mode 100644 libsepol/user-declaration-in-module/Makefile create mode 100644 plans/tier1.fmf create mode 100644 plans/tier2.fmf create mode 100644 plans/tier3.fmf diff --git a/libsepol/user-declaration-in-module/Makefile b/libsepol/user-declaration-in-module/Makefile new file mode 100644 index 0000000..5bb9656 --- /dev/null +++ b/libsepol/user-declaration-in-module/Makefile @@ -0,0 +1,64 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/libsepol/Sanity/user-declaration-in-module +# Description: Can libsepol handle users declared in modules? +# Author: Petr Lautrbach +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2022 Red Hat, Inc. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/libsepol/Sanity/user-declaration-in-module +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) test.sh foo.te Makefile + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + test -x test.sh || chmod a+x test.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Petr Lautrbach " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: Can libsepol handle users declared in modules?" >> $(METADATA) + @echo "Type: Sanity" >> $(METADATA) + @echo "TestTime: 5m" >> $(METADATA) + @echo "RunFor: libsepol" >> $(METADATA) + @echo "Requires: libsepol-devel selinux-policy-devel" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Bug: 2136212" >> $(METADATA) # RHEL-9 + + rhts-lint $(METADATA) + diff --git a/plans/tier1.fmf b/plans/tier1.fmf new file mode 100644 index 0000000..f311437 --- /dev/null +++ b/plans/tier1.fmf @@ -0,0 +1,11 @@ +summary: Tier1 test plan +adjust: +- when: trigger == commit + enabled: false + because: do not run this plan on changes caused by a PR/MR +discover: + how: fmf + filter: tier:1 | tag:CI-Tier-1 +execute: + how: tmt + diff --git a/plans/tier2.fmf b/plans/tier2.fmf new file mode 100644 index 0000000..f424e5c --- /dev/null +++ b/plans/tier2.fmf @@ -0,0 +1,11 @@ +summary: Tier2 test plan +adjust: +- when: trigger == commit + enabled: false + because: do not run this plan on changes caused by a PR/MR +discover: + how: fmf + filter: tier:2 +execute: + how: tmt + diff --git a/plans/tier3.fmf b/plans/tier3.fmf new file mode 100644 index 0000000..8ee071d --- /dev/null +++ b/plans/tier3.fmf @@ -0,0 +1,11 @@ +summary: Tier3 test plan +adjust: +- when: trigger == commit + enabled: false + because: do not run this plan on changes caused by a PR/MR +discover: + how: fmf + filter: tier:3 +execute: + how: tmt + From 7773d77b0be24c27e42aeb93076215ac19124a4a Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Fri, 4 Nov 2022 12:04:33 +0100 Subject: [PATCH 183/626] fix the shell script name executed in the Makefile Now the Makefile runs the test.sh file instead of the runtest.sh file. --- libsepol/user-declaration-in-module/Makefile | 2 +- libsepol/user-declaration-in-module/main.fmf | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/libsepol/user-declaration-in-module/Makefile b/libsepol/user-declaration-in-module/Makefile index 5bb9656..a649d44 100644 --- a/libsepol/user-declaration-in-module/Makefile +++ b/libsepol/user-declaration-in-module/Makefile @@ -34,7 +34,7 @@ FILES=$(METADATA) test.sh foo.te Makefile .PHONY: all install download clean run: $(FILES) build - ./runtest.sh + ./test.sh build: $(BUILT_FILES) test -x test.sh || chmod a+x test.sh diff --git a/libsepol/user-declaration-in-module/main.fmf b/libsepol/user-declaration-in-module/main.fmf index 73aad74..265e20f 100644 --- a/libsepol/user-declaration-in-module/main.fmf +++ b/libsepol/user-declaration-in-module/main.fmf @@ -10,3 +10,4 @@ tier: 1 enabled: true link: - https://bugzilla.redhat.com/show_bug.cgi?id=2136212 +extra-nitrate: TC#0614379 From 09f8be4247dc7711a965c4aea42226a2880a4051 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Mon, 7 Nov 2022 18:28:29 +0100 Subject: [PATCH 184/626] test if stalld can read /sys/kernel/security/lockdown Recent stalld testing identified the following error messages in the systemd journal: stalld[...]: stalld: Permission denied Deeper investigation revealed that SELinux prevents the stalld processes from reading the /sys/kernel/security/lockdown file. The TC reproduces the situation. In order to avoid the error messages, I believe that SELinux policy should allow the access. The TC looks for appropriate policy rules and file context patterns. The TC covers BZ#2140673. --- selinux-policy/stalld-and-similar/Makefile | 1 + selinux-policy/stalld-and-similar/main.fmf | 1 + selinux-policy/stalld-and-similar/runtest.sh | 5 +++++ 3 files changed, 7 insertions(+) diff --git a/selinux-policy/stalld-and-similar/Makefile b/selinux-policy/stalld-and-similar/Makefile index 5eacb61..507e472 100644 --- a/selinux-policy/stalld-and-similar/Makefile +++ b/selinux-policy/stalld-and-similar/Makefile @@ -68,6 +68,7 @@ $(METADATA): Makefile @echo "Bug: 2096776" >> $(METADATA) # RHEL-9 @echo "Bug: 2102224" >> $(METADATA) # RHEL-9 @echo "Bug: 2105038" >> $(METADATA) # RHEL-9 + @echo "Bug: 2140673" >> $(METADATA) # RHEL-9 rhts-lint $(METADATA) diff --git a/selinux-policy/stalld-and-similar/main.fmf b/selinux-policy/stalld-and-similar/main.fmf index 8ae96f0..515ad87 100644 --- a/selinux-policy/stalld-and-similar/main.fmf +++ b/selinux-policy/stalld-and-similar/main.fmf @@ -37,6 +37,7 @@ link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2096776 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2102224 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2105038 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2140673 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 diff --git a/selinux-policy/stalld-and-similar/runtest.sh b/selinux-policy/stalld-and-similar/runtest.sh index ea131ad..909a0b5 100755 --- a/selinux-policy/stalld-and-similar/runtest.sh +++ b/selinux-policy/stalld-and-similar/runtest.sh @@ -91,6 +91,11 @@ rlJournalStart rlRun "sesearch -s stalld_t -t domain -c process -p setsched -A -ds -dt | grep allow" rlPhaseEnd + rlPhaseStartTest "bz#2140673" + rlRun "ls -Z /sys/kernel/security/lockdown | grep :security_t" + rlSESearchRule "allow stalld_t security_t : file { getattr open read } [ ]" + rlPhaseEnd + rlPhaseStartTest "real scenario -- standalone service" if ! rlSEDefined ${PROCESS_CONTEXT} ; then PROCESS_CONTEXT="unconfined_service_t" From 3727a6ade6a29009519cc55508ebed4d1f902d7d Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Thu, 10 Nov 2022 15:34:03 +0100 Subject: [PATCH 185/626] Adjust duration to 20m in linux-system-roles.selinux-tests Fixes: Maximum test time '10m' exceeded. Adjust the test 'duration' attribute if necessary. https://tmt.readthedocs.io/en/stable/spec/tests.html#duration --- policycoreutils/linux-system-roles.selinux-tests/main.fmf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/policycoreutils/linux-system-roles.selinux-tests/main.fmf b/policycoreutils/linux-system-roles.selinux-tests/main.fmf index 6007bf5..b0a8910 100644 --- a/policycoreutils/linux-system-roles.selinux-tests/main.fmf +++ b/policycoreutils/linux-system-roles.selinux-tests/main.fmf @@ -9,6 +9,6 @@ recommend: - policycoreutils - ansible - git -duration: 10m +duration: 20m extra-summary: linux-system-roles.selinux-tests extra-task: linux-system-roles.selinux-tests From 889bc16ec3644649a3f2e350f491df4b00bad053 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Mon, 7 Nov 2022 17:50:27 +0100 Subject: [PATCH 186/626] install required packages from EPEL repository For successful run, some tests require certain EPEL packages to be installed. --- selinux-policy/bgpd-and-similar/runtest.sh | 3 +++ selinux-policy/blueman-and-similar/runtest.sh | 3 +++ selinux-policy/caddy-and-similar/main.fmf | 1 + selinux-policy/caddy-and-similar/runtest.sh | 3 +++ 4 files changed, 10 insertions(+) diff --git a/selinux-policy/bgpd-and-similar/runtest.sh b/selinux-policy/bgpd-and-similar/runtest.sh index c0581ba..7acd85e 100755 --- a/selinux-policy/bgpd-and-similar/runtest.sh +++ b/selinux-policy/bgpd-and-similar/runtest.sh @@ -48,6 +48,9 @@ rlJournalStart rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted + if ! rpm -q ${SERVICE_PACKAGE} ; then + rlRun "yum -y install ${SERVICE_PACKAGE} --enablerepo epel" + fi rlAssertRpm ${SERVICE_PACKAGE} rlServiceStop ${SERVICE_NAME} diff --git a/selinux-policy/blueman-and-similar/runtest.sh b/selinux-policy/blueman-and-similar/runtest.sh index f10bf19..a407ba3 100755 --- a/selinux-policy/blueman-and-similar/runtest.sh +++ b/selinux-policy/blueman-and-similar/runtest.sh @@ -44,6 +44,9 @@ rlJournalStart rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted + if ! rpm -q ${SERVICE_PACKAGE} ; then + rlRun "yum -y install ${SERVICE_PACKAGE} --enablerepo epel" + fi rlAssertRpm ${SERVICE_PACKAGE} rlServiceStop ${SERVICE_NAME} diff --git a/selinux-policy/caddy-and-similar/main.fmf b/selinux-policy/caddy-and-similar/main.fmf index f334e91..17570f3 100644 --- a/selinux-policy/caddy-and-similar/main.fmf +++ b/selinux-policy/caddy-and-similar/main.fmf @@ -30,3 +30,4 @@ link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2122886 extra-summary: /CoreOS/selinux-policy/Regression/caddy-and-similar extra-task: /CoreOS/selinux-policy/Regression/caddy-and-similar +extra-nitrate: TC#0614303 diff --git a/selinux-policy/caddy-and-similar/runtest.sh b/selinux-policy/caddy-and-similar/runtest.sh index 6af5376..7cf9384 100755 --- a/selinux-policy/caddy-and-similar/runtest.sh +++ b/selinux-policy/caddy-and-similar/runtest.sh @@ -40,6 +40,9 @@ rlJournalStart rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted + if ! rpm -q ${SERVICE_PACKAGE} ; then + rlRun "yum -y install ${SERVICE_PACKAGE} --enablerepo epel" + fi rlAssertRpm ${SERVICE_PACKAGE} rlServiceStop caddy caddy-api From b28143f1ccdb0bb8a7acf6cbb87e526d7f02aec6 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Mon, 21 Nov 2022 11:44:04 +0100 Subject: [PATCH 187/626] don't look for watch* permissions where they aren't defined The watch* permissions are not defined by SELinux policy on RHEL-8.x. --- selinux-policy/systemd-run-and-similar/runtest.sh | 2 ++ 1 file changed, 2 insertions(+) diff --git a/selinux-policy/systemd-run-and-similar/runtest.sh b/selinux-policy/systemd-run-and-similar/runtest.sh index 6645068..82990ab 100755 --- a/selinux-policy/systemd-run-and-similar/runtest.sh +++ b/selinux-policy/systemd-run-and-similar/runtest.sh @@ -49,9 +49,11 @@ rlJournalStart rlSESearchRule "allow init_t user_devpts_t : chr_file { setattr open } [ ]" rlPhaseEnd + if seinfo --common file -x | grep -q watch ; then rlPhaseStartTest "bz#1980241" rlSESearchRule "allow init_t user_devpts_t : chr_file { watch watch_reads } [ ]" rlPhaseEnd + fi rlPhaseStartTest "real scenario" rlWatchdog "systemd-run -p IPAddressDeny=127.0.0.1 -t /bin/sh" 10 From d1caaec9e27d67cb82ba0810567300509df716e1 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 22 Nov 2022 12:43:46 +0100 Subject: [PATCH 188/626] add a simplified version of rlSESatisfyRequires() If the framework which runs the automated tests does not install all required packages (listed in Makefile) before the tests are started, then rlSESatisfyRequires() installs the required packages during the run of the tests. --- selinux-policy/Library/common/lib.sh | 30 +++++++++++++++++++ .../cups-lpd-and-similar/runtest.sh | 2 +- 2 files changed, 31 insertions(+), 1 deletion(-) diff --git a/selinux-policy/Library/common/lib.sh b/selinux-policy/Library/common/lib.sh index 22a7b31..4bcb8ee 100644 --- a/selinux-policy/Library/common/lib.sh +++ b/selinux-policy/Library/common/lib.sh @@ -1524,9 +1524,39 @@ function rlSESetEnforce() { } +true <<'=cut' +=pod +=head2 rlSESatisfyRequires +The function attempts to install all packages required in Makefile and all packa +ges given as arguments. +The function will be used to install packages from any repository we want. +=cut + +function rlSESatisfyRequires() { + local FILE_NAME="./Makefile" + local PACKAGE_LIST + local PACKAGE_LIST2 + + if [ "x$COLLECTIONS" != "x" ] ; then + # do not install any packages when running in RHSCL environment + # because that would most likely break the environment or fail + return + fi + if [ $# -gt 0 ] ; then + PACKAGE_LIST2="$*" + fi + PACKAGE_LIST=`grep '"Requires:' ${FILE_NAME} | cut -d : -f 2 | cut -d '"' -f 1 | tr '\n' ' ' | tr -s ' '` + # check if all required packages are really installed + if rpm -q ${PACKAGE_LIST} ${PACKAGE_LIST2} >& /dev/null ; then + rlPass "all required packages are really installed" + return 0 + fi + + rlRun "epelyum -y --nobest --nogpgcheck --skip-broken install ${PACKAGE_LIST} ${PACKAGE_LIST2}" 0,1 +} __INTERNAL_rlSEModuleList() { local semodule_list diff --git a/selinux-policy/cups-lpd-and-similar/runtest.sh b/selinux-policy/cups-lpd-and-similar/runtest.sh index 3d30478..1ada2fc 100755 --- a/selinux-policy/cups-lpd-and-similar/runtest.sh +++ b/selinux-policy/cups-lpd-and-similar/runtest.sh @@ -41,7 +41,7 @@ PROCESS_CONTEXT="cupsd_lpd_t" rlJournalStart rlPhaseStartSetup rlRun "rlImport 'selinux-policy/common'" - # rlSESatisfyRequires + rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted rlAssertRpm ${SERVICE_PACKAGE} From 162cc22a2e2d28aa86166d4545d2ad334b229bc5 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Wed, 23 Nov 2022 09:30:21 +0100 Subject: [PATCH 189/626] enable tests if their required packages are available Some tests were ending prematurely because their required packages were not available. Fortunately, more and more packages are available in the EPEL repository now and the situation has changed. Some tests require packages which are not available on any RHEL and most likely will not be available there at all. --- selinux-policy/blueman-and-similar/runtest.sh | 6 ++++++ selinux-policy/bz733494-amanda-and-similar/runtest.sh | 6 ------ selinux-policy/dhclient-and-similar/main.fmf | 4 ++++ selinux-policy/dhcpcd-and-similar/runtest.sh | 6 ++++++ selinux-policy/fedora-third-party-and-similar/runtest.sh | 8 +++++++- selinux-policy/sslh-and-similar/runtest.sh | 8 +------- selinux-policy/tlp-and-similar/runtest.sh | 6 ------ selinux-policy/usbmuxd-and-similar/runtest.sh | 8 +------- 8 files changed, 25 insertions(+), 27 deletions(-) diff --git a/selinux-policy/blueman-and-similar/runtest.sh b/selinux-policy/blueman-and-similar/runtest.sh index a407ba3..2530481 100755 --- a/selinux-policy/blueman-and-similar/runtest.sh +++ b/selinux-policy/blueman-and-similar/runtest.sh @@ -39,6 +39,12 @@ PROCESS_NAME="blueman-mechanism" PROCESS_CONTEXT="blueman_t" rlJournalStart + if rlIsRHEL ; then + rlLog "Not applicable to this OS version." + rlJournalEnd + exit 0 + fi + rlPhaseStartSetup rlRun "rlImport 'selinux-policy/common'" rlSESatisfyRequires diff --git a/selinux-policy/bz733494-amanda-and-similar/runtest.sh b/selinux-policy/bz733494-amanda-and-similar/runtest.sh index 8e832c8..80214f1 100755 --- a/selinux-policy/bz733494-amanda-and-similar/runtest.sh +++ b/selinux-policy/bz733494-amanda-and-similar/runtest.sh @@ -38,12 +38,6 @@ PROCESS_NAME="amandad" PROCESS_CONTEXT="amanda_t" rlJournalStart - if ! rpm -q amanda amanda-client amanda-server ; then - rlLog "Required packages are not available/installed." - rlJournalEnd - exit 0 - fi - rlPhaseStartSetup rlRun "rlImport 'selinux-policy/common'" rlSESatisfyRequires diff --git a/selinux-policy/dhclient-and-similar/main.fmf b/selinux-policy/dhclient-and-similar/main.fmf index 9c98fb1..e3cdb8f 100644 --- a/selinux-policy/dhclient-and-similar/main.fmf +++ b/selinux-policy/dhclient-and-similar/main.fmf @@ -26,6 +26,10 @@ link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2035117 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2093709 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2094155 +adjust: +- when: trigger == build + enabled: false + because: the test may mess up the IP address extra-summary: /CoreOS/selinux-policy/Regression/dhclient-and-similar extra-task: /CoreOS/selinux-policy/Regression/dhclient-and-similar extra-nitrate: TC#0613884 diff --git a/selinux-policy/dhcpcd-and-similar/runtest.sh b/selinux-policy/dhcpcd-and-similar/runtest.sh index edb8185..79fad7a 100755 --- a/selinux-policy/dhcpcd-and-similar/runtest.sh +++ b/selinux-policy/dhcpcd-and-similar/runtest.sh @@ -40,6 +40,12 @@ PROCESS_CONTEXT="dhcpc_t" rlJournalStart rlPhaseStartSetup + if rlIsRHEL ; then + rlLog "Not applicable to this OS version." + rlJournalEnd + exit 0 + fi + rlRun "rlImport 'selinux-policy/common'" rlSESatisfyRequires rlAssertRpm ${PACKAGE} diff --git a/selinux-policy/fedora-third-party-and-similar/runtest.sh b/selinux-policy/fedora-third-party-and-similar/runtest.sh index 54c4031..0903a5e 100755 --- a/selinux-policy/fedora-third-party-and-similar/runtest.sh +++ b/selinux-policy/fedora-third-party-and-similar/runtest.sh @@ -38,6 +38,12 @@ PROCESS_NAME="fedora-third-party" PROCESS_CONTEXT="fedoratp_t" rlJournalStart + if rlIsRHEL ; then + rlLog "Not applicable to this OS version." + rlJournalEnd + exit 0 + fi + rlPhaseStartSetup rlRun "rlImport 'selinux-policy/common'" rlSESatisfyRequires @@ -71,7 +77,7 @@ rlJournalStart fi rlRun "touch /run/ostree-booted" rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /etc /var /run" + rlRun "restorecon -Rv /etc /var /run -e /var/ARTIFACTS" 0-255 rlRun "fedora-third-party list" rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd diff --git a/selinux-policy/sslh-and-similar/runtest.sh b/selinux-policy/sslh-and-similar/runtest.sh index 0bfdece..7e33840 100755 --- a/selinux-policy/sslh-and-similar/runtest.sh +++ b/selinux-policy/sslh-and-similar/runtest.sh @@ -39,12 +39,6 @@ PROCESS_NAME="sslh" PROCESS_CONTEXT="sslh_t" rlJournalStart - if ! rpm -q ${SERVICE_PACKAGE} ; then - rlLog "Required packages are not available/installed." - rlJournalEnd - exit 0 - fi - rlPhaseStartSetup rlRun "rlImport 'selinux-policy/common'" rlSESatisfyRequires @@ -96,7 +90,7 @@ rlJournalStart PROCESS_CONTEXT="unconfined_service_t" fi rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /run /var" + rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd diff --git a/selinux-policy/tlp-and-similar/runtest.sh b/selinux-policy/tlp-and-similar/runtest.sh index 84e6f4f..469a1db 100755 --- a/selinux-policy/tlp-and-similar/runtest.sh +++ b/selinux-policy/tlp-and-similar/runtest.sh @@ -39,12 +39,6 @@ PROCESS_NAME="tlp" PROCESS_CONTEXT="tlp_t" rlJournalStart - if ! rlIsRHEL 7 8 && ! rlIsFedora ; then - rlLog "Not applicable to this OS version." - rlJournalEnd - exit 0 - fi - rlPhaseStartSetup rlRun "rlImport 'selinux-policy/common'" rlSESatisfyRequires diff --git a/selinux-policy/usbmuxd-and-similar/runtest.sh b/selinux-policy/usbmuxd-and-similar/runtest.sh index f96d253..0b1dc0f 100755 --- a/selinux-policy/usbmuxd-and-similar/runtest.sh +++ b/selinux-policy/usbmuxd-and-similar/runtest.sh @@ -39,12 +39,6 @@ PROCESS_NAME="usbmuxd" PROCESS_CONTEXT="usbmuxd_t" rlJournalStart - if ! rpm -q ${SERVICE_PACKAGE} ; then - rlLog "Required packages are not available/installed." - rlJournalEnd - exit 0 - fi - rlPhaseStartSetup rlRun "rlImport 'selinux-policy/common'" rlSESatisfyRequires @@ -105,7 +99,7 @@ rlJournalStart PROCESS_CONTEXT="unconfined_service_t" fi rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /var /run" + rlRun "restorecon -Rv /var /run -e /var/ARTIFACTS" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd From 8effe6fd87dcce4c7378a66b3813dc797907822c Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Thu, 24 Nov 2022 11:30:48 +0100 Subject: [PATCH 190/626] Use `ausearch --input-logs` CI systems don't necessary attach stdin to terminal and this option make `ausearch` to use audit logs as input for searching. --- policycoreutils/load_policy/runtest.sh | 12 +++++----- .../runtest.sh | 4 ++-- policycoreutils/setsebool/runtest.sh | 6 ++--- .../anon_inode-and-similar/runtest.sh | 2 +- selinux-policy/ladvd/runtest.sh | 4 ++-- selinux-policy/rsyslog-and-similar/runtest.sh | 4 ++-- selinux-policy/systemd-homed/runtest.sh | 24 +++++++++---------- .../runtest.sh | 2 +- 8 files changed, 29 insertions(+), 29 deletions(-) diff --git a/policycoreutils/load_policy/runtest.sh b/policycoreutils/load_policy/runtest.sh index a0402a9..c7809c3 100755 --- a/policycoreutils/load_policy/runtest.sh +++ b/policycoreutils/load_policy/runtest.sh @@ -63,13 +63,13 @@ rlJournalStart rlRun "grep -i selinux /proc/mounts" sleep 1 if rlIsRHEL ; then - rlRun "ausearch -m MAC_POLICY_LOAD -i -ts ${START_DATE_TIME} | grep load_policy" + rlRun "ausearch -m MAC_POLICY_LOAD -i -ts ${START_DATE_TIME} --input-logs | grep load_policy" fi if rlIsRHEL 5 6 7 ; then - rlRun "ausearch -m MAC_POLICY_LOAD -i -ts ${START_DATE_TIME} | grep 'policy loaded'" + rlRun "ausearch -m MAC_POLICY_LOAD -i -ts ${START_DATE_TIME} --input-logs | grep 'policy loaded'" else # we assume that audit message has a different format now (does not contain "policy loaded") - rlRun "ausearch -m MAC_POLICY_LOAD -i -ts ${START_DATE_TIME} | grep 'type=MAC_POLICY_LOAD'" + rlRun "ausearch -m MAC_POLICY_LOAD -i -ts ${START_DATE_TIME} --input-logs | grep 'type=MAC_POLICY_LOAD'" fi rlRun "umount --lazy ${SELINUX_FS_MOUNT}" 0,32 if [ $? -eq 0 ] ; then @@ -80,13 +80,13 @@ rlJournalStart rlRun "grep -i selinux /proc/mounts" sleep 1 if rlIsRHEL ; then - rlRun "ausearch -m MAC_POLICY_LOAD -i -ts ${START_DATE_TIME} | grep load_policy" + rlRun "ausearch -m MAC_POLICY_LOAD -i -ts ${START_DATE_TIME} --input-logs | grep load_policy" fi if rlIsRHEL 5 6 7 ; then - rlRun "ausearch -m MAC_POLICY_LOAD -i -ts ${START_DATE_TIME} | grep 'policy loaded'" + rlRun "ausearch -m MAC_POLICY_LOAD -i -ts ${START_DATE_TIME} --input-logs | grep 'policy loaded'" else # we assume that audit message has a different format now (does not contain "policy loaded") - rlRun "ausearch -m MAC_POLICY_LOAD -i -ts ${START_DATE_TIME} | grep 'type=MAC_POLICY_LOAD'" + rlRun "ausearch -m MAC_POLICY_LOAD -i -ts ${START_DATE_TIME} --input-logs | grep 'type=MAC_POLICY_LOAD'" fi fi rlRun "dmesg | grep -i selinux" diff --git a/policycoreutils/semanage-port-add-delete-problems/runtest.sh b/policycoreutils/semanage-port-add-delete-problems/runtest.sh index 2069299..435fc40 100755 --- a/policycoreutils/semanage-port-add-delete-problems/runtest.sh +++ b/policycoreutils/semanage-port-add-delete-problems/runtest.sh @@ -82,7 +82,7 @@ rlJournalStart sleep 2 # Check for MAC_POLICY_LOAD - rlRun "ausearch -m MAC_POLICY_LOAD -ts ${START_DATE_TIME}" 0 + rlRun "ausearch -m MAC_POLICY_LOAD -ts ${START_DATE_TIME} --input-logs" 0 # deleting a port number from a type START_DATE_TIME=`date "+%m/%d/%Y %T"` @@ -91,7 +91,7 @@ rlJournalStart sleep 2 # Check for MAC_POLICY_LOAD - rlRun "ausearch -m MAC_POLICY_LOAD -ts ${START_DATE_TIME}" 0 + rlRun "ausearch -m MAC_POLICY_LOAD -ts ${START_DATE_TIME} --input-logs" 0 rlPhaseEnd fi diff --git a/policycoreutils/setsebool/runtest.sh b/policycoreutils/setsebool/runtest.sh index 36357f7..8678b1b 100755 --- a/policycoreutils/setsebool/runtest.sh +++ b/policycoreutils/setsebool/runtest.sh @@ -128,10 +128,10 @@ rlJournalStart rlRun "setsebool ${BOOLEAN} off" rlRun "setsebool ${BOOLEAN} on" sleep 1 - rlRun "ausearch -m MAC_CONFIG_CHANGE -i -ts ${START_DATE_TIME} | grep \"type=MAC_CONFIG_CHANGE.*bool=${BOOLEAN} val=1 old_val=0\"" - rlRun "ausearch -m MAC_CONFIG_CHANGE -i -ts ${START_DATE_TIME} | grep \"type=MAC_CONFIG_CHANGE.*bool=${BOOLEAN} val=0 old_val=1\"" + rlRun "ausearch -m MAC_CONFIG_CHANGE -i -ts ${START_DATE_TIME} --input-logs | grep \"type=MAC_CONFIG_CHANGE.*bool=${BOOLEAN} val=1 old_val=0\"" + rlRun "ausearch -m MAC_CONFIG_CHANGE -i -ts ${START_DATE_TIME} --input-logs | grep \"type=MAC_CONFIG_CHANGE.*bool=${BOOLEAN} val=0 old_val=1\"" if rlIsRHEL ; then - rlRun "ausearch -m MAC_CONFIG_CHANGE -i -ts ${START_DATE_TIME} | grep \"type=SYSCALL.*comm=setsebool\"" + rlRun "ausearch -m MAC_CONFIG_CHANGE -i -ts ${START_DATE_TIME} --input-logs | grep \"type=SYSCALL.*comm=setsebool\"" fi rlPhaseEnd diff --git a/selinux-policy/anon_inode-and-similar/runtest.sh b/selinux-policy/anon_inode-and-similar/runtest.sh index e09760a..35b18d6 100755 --- a/selinux-policy/anon_inode-and-similar/runtest.sh +++ b/selinux-policy/anon_inode-and-similar/runtest.sh @@ -55,7 +55,7 @@ rlJournalStart tst_Time="$(date '+%T')" rlRun "./reproducer" sleep 3 - rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time" 1 + rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time --input-logs" 1 rlSESearchRule "allow unconfined_t unconfined_t : anon_inode { write }" rlRun "rm -f reproducer" rlPhaseEnd diff --git a/selinux-policy/ladvd/runtest.sh b/selinux-policy/ladvd/runtest.sh index 211f280..ad3d458 100755 --- a/selinux-policy/ladvd/runtest.sh +++ b/selinux-policy/ladvd/runtest.sh @@ -52,7 +52,7 @@ rlJournalStart rlPhaseStartTest "ladvd service selinux denials, bz#1834325" rlServiceStart ladvd sleep 2 - rlRun "ausearch -m AVC -c ladvd --raw > /tmp/avcfile" 1 + rlRun "ausearch -m AVC -c ladvd --raw --input-logs > /tmp/avcfile" 1 if grep "tclass=process2" /tmp/avcfile; then grep "tclass=process2" /tmp/avcfile > /tmp/avc_class_file rlAssertNotGrep "denied { nnp_transition }" /tmp/avc_class_file @@ -74,7 +74,7 @@ rlJournalStart rlPhaseStartTest "ladvd selinux denials due to libpcap, bz#1855163" rlServiceStart ladvd sleep 2 - rlRun "ausearch -m AVC -c 'ladvd' --raw > /tmp/avcfile" 1 + rlRun "ausearch -m AVC -c ladvd --raw --input-logs > /tmp/avcfile" 1 if grep "tclass=netlink_rdma_socket" /tmp/avcfile; then grep "tclass=netlink_rdma_socket" /tmp/avcfile > /tmp/avc_class_file rlAssertNotGrep "denied { create }" /tmp/avc_class_file diff --git a/selinux-policy/rsyslog-and-similar/runtest.sh b/selinux-policy/rsyslog-and-similar/runtest.sh index a3f33a9..edda98d 100755 --- a/selinux-policy/rsyslog-and-similar/runtest.sh +++ b/selinux-policy/rsyslog-and-similar/runtest.sh @@ -86,7 +86,7 @@ rlJournalStart rlRun "update_rsys" rlRun "systemctl restart rsyslog" sleep 3 - rlRun "ausearch -m AVC --start $tst_Time" 1 + rlRun "ausearch -m AVC --start $tst_Time --input-logs" 1 rlRun "cp -rv /etc/rsyslog.conf-orig /etc/rsyslog.conf" rlRun "systemctl restart rsyslog" rlPhaseEnd @@ -104,7 +104,7 @@ rlJournalStart rlRun "echo ' ' >> /etc/rsyslog.conf" rlRun "systemctl restart rsyslog" sleep 3 - rlRun "ausearch -m AVC --start $tst_Time" 1 + rlRun "ausearch -m AVC --start $tst_Time --input-logs" 1 rlRun 'semanage fcontext -d -t public_content_rw_t "/my/custom(/.*)?"' rlRun "semodule -r rsyslog_imfile_policy" rlRun "cp -rv /etc/rsyslog.conf-orig /etc/rsyslog.conf" diff --git a/selinux-policy/systemd-homed/runtest.sh b/selinux-policy/systemd-homed/runtest.sh index 6a5d196..d95a340 100755 --- a/selinux-policy/systemd-homed/runtest.sh +++ b/selinux-policy/systemd-homed/runtest.sh @@ -129,8 +129,8 @@ rlJournalStart rlPhaseStartTest "homectl create" rlRun "create_u" - rlRun "ausearch -m AVC -m USER_AVC -c systemd-homed -f mail" 1 - rlRun "ausearch -m AVC -m USER_AVC -c systemd-homewor" 1 + rlRun "ausearch -m AVC -m USER_AVC -c systemd-homed -f mail --input-logs" 1 + rlRun "ausearch -m AVC -m USER_AVC -c systemd-homewor --input-logs" 1 rlPhaseEnd rlPhaseStartTest "homectl list" @@ -138,7 +138,7 @@ rlJournalStart tst_Time="$(date '+%T')" rlRun "homectl list" sleep 5 - rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time" 1 + rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time --input-logs" 1 rlPhaseEnd rlPhaseStartTest "homectl activate" @@ -146,7 +146,7 @@ rlJournalStart tst_Time="$(date '+%T')" rlRun "activate_u" sleep 5 - rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time" 1 + rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time --input-logs" 1 rlPhaseEnd rlPhaseStartTest "homectl inspect" @@ -154,7 +154,7 @@ rlJournalStart tst_Time="$(date '+%T')" rlRun "homectl inspect test_u" sleep 5 - rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time" 1 + rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time --input-logs" 1 rlPhaseEnd rlPhaseStartTest "homectl update" @@ -162,7 +162,7 @@ rlJournalStart tst_Time="$(date '+%T')" rlRun "homectl update test_u --email-address=test_u@redhat.com" sleep 5 - rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time" 1 + rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time --input-logs" 1 rlPhaseEnd rlPhaseStartTest "homectl lock" @@ -170,7 +170,7 @@ rlJournalStart tst_Time="$(date '+%T')" rlRun "homectl lock test_u" sleep 5 - rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time" 1 + rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time --input-logs" 1 rlPhaseEnd rlPhaseStartTest "homectl unlock" @@ -178,7 +178,7 @@ rlJournalStart tst_Time="$(date '+%T')" rlRun "unlock_u" sleep 5 - rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time" 1 + rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time --input-logs" 1 rlPhaseEnd rlPhaseStartTest "homectl passwd" @@ -186,7 +186,7 @@ rlJournalStart tst_Time="$(date '+%T')" rlRun "passwd_u" sleep 5 - rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time" 1 + rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time --input-logs" 1 rlPhaseEnd rlPhaseStartTest "homectl authenticate" @@ -194,7 +194,7 @@ rlJournalStart tst_Time="$(date '+%T')" rlRun "auth_u" sleep 5 - rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time" 1 + rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time --input-logs" 1 rlPhaseEnd rlPhaseStartTest "homectl deactivate and resize" @@ -204,7 +204,7 @@ rlJournalStart sleep 60 rlRun "resize_u" sleep 5 - rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time" 1 + rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time --input-logs" 1 rlPhaseEnd rlPhaseStartTest "homectl remove" @@ -212,7 +212,7 @@ rlJournalStart tst_Time="$(date '+%T')" rlRun "homectl remove test_u" sleep 5 - rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time" 1 + rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time --input-logs" 1 rlPhaseEnd rlPhaseStartCleanup diff --git a/selinux-policy/systemd-modules-load-and-similar/runtest.sh b/selinux-policy/systemd-modules-load-and-similar/runtest.sh index 2e250b4..0e951c8 100755 --- a/selinux-policy/systemd-modules-load-and-similar/runtest.sh +++ b/selinux-policy/systemd-modules-load-and-similar/runtest.sh @@ -123,7 +123,7 @@ rlJournalStart rlRun "systemctl start rdma-load-modules@rdma.service" rlRun "systemctl status rdma-load-modules@rdma.service" rlRun "lsmod | grep rdma" - rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time" 1 + rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time --input-logs" 1 rlRun "systemctl stop rdma-load-modules@rdma.service" if seinfo -c | grep -q lockdown ; then rlSESearchRule "allow systemd_modules_load_t systemd_modules_load_t : lockdown { confidentiality } [ ]" From a7d24f429256dc3b7385c2438988af26fd49110d Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Mon, 28 Nov 2022 15:36:03 +0100 Subject: [PATCH 191/626] test if ladvd produces any SELinux denials The test should look for any SELinux denials that appear during its run. No matter which process triggered them. --- selinux-policy/ladvd/runtest.sh | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/selinux-policy/ladvd/runtest.sh b/selinux-policy/ladvd/runtest.sh index ad3d458..7c057b7 100755 --- a/selinux-policy/ladvd/runtest.sh +++ b/selinux-policy/ladvd/runtest.sh @@ -44,6 +44,9 @@ rlJournalStart rlAssertRpm ${PACKAGE}-targeted rlAssertRpm ladvd rlAssertRpm ladvd-selinux + + rlSESetTimestamp + rlRun "setsebool domain_kernel_load_modules on" rlServiceStop ladvd rlSESetEnforce rlSEStatus @@ -52,7 +55,7 @@ rlJournalStart rlPhaseStartTest "ladvd service selinux denials, bz#1834325" rlServiceStart ladvd sleep 2 - rlRun "ausearch -m AVC -c ladvd --raw --input-logs > /tmp/avcfile" 1 + rlRun "ausearch -m AVC -c ladvd --raw --input-logs > /tmp/avcfile" 0,1 if grep "tclass=process2" /tmp/avcfile; then grep "tclass=process2" /tmp/avcfile > /tmp/avc_class_file rlAssertNotGrep "denied { nnp_transition }" /tmp/avc_class_file @@ -74,7 +77,7 @@ rlJournalStart rlPhaseStartTest "ladvd selinux denials due to libpcap, bz#1855163" rlServiceStart ladvd sleep 2 - rlRun "ausearch -m AVC -c ladvd --raw --input-logs > /tmp/avcfile" 1 + rlRun "ausearch -m AVC -c ladvd --raw --input-logs > /tmp/avcfile" 0,1 if grep "tclass=netlink_rdma_socket" /tmp/avcfile; then grep "tclass=netlink_rdma_socket" /tmp/avcfile > /tmp/avc_class_file rlAssertNotGrep "denied { create }" /tmp/avc_class_file @@ -88,6 +91,8 @@ rlJournalStart rlPhaseEnd rlPhaseStartCleanup + rlSECheckAVC + rlRun "setsebool domain_kernel_load_modules off" rlServiceRestore ladvd rlRun "rm -f /tmp/avcfile" rlRun "rm -f /tmp/avc_class_file" From f1b7777fbf2ff6d0e37dc2625b0d4e90644894a2 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Thu, 1 Dec 2022 18:04:04 +0100 Subject: [PATCH 192/626] bring all downstream changes to the upstream tests Downstream and upstream versions of certain automated tests diverged before the duplicates were removed. Now, they should be in sync. --- .../accounts-daemon-and-similar/Makefile | 9 ++++++++- .../accounts-daemon-and-similar/main.fmf | 11 ++++++---- .../accounts-daemon-and-similar/runtest.sh | 8 ++++++++ selinux-policy/acpid-and-similar/Makefile | 1 + selinux-policy/acpid-and-similar/runtest.sh | 10 +++++++++- selinux-policy/boltd-and-similar/runtest.sh | 12 +++++------ selinux-policy/colord-and-similar/runtest.sh | 20 +++++++++++-------- .../cups-pdf-and-similar/runtest.sh | 10 +++++----- .../dmidecode-and-similar/runtest.sh | 10 +++++----- selinux-policy/fwupd-and-similar/runtest.sh | 12 +++++------ selinux-policy/policykit-general/runtest.sh | 12 ++++++----- 11 files changed, 74 insertions(+), 41 deletions(-) diff --git a/selinux-policy/accounts-daemon-and-similar/Makefile b/selinux-policy/accounts-daemon-and-similar/Makefile index 1923789..249d054 100644 --- a/selinux-policy/accounts-daemon-and-similar/Makefile +++ b/selinux-policy/accounts-daemon-and-similar/Makefile @@ -55,7 +55,7 @@ $(METADATA): Makefile @echo "TestTime: 10m" >> $(METADATA) @echo "RunFor: accountsservice" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console accountsservice glib2 procps-ng realmd initscripts" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console accountsservice glib2 procps-ng realmd initscripts gdm" >> $(METADATA) @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @echo "License: GPLv2" >> $(METADATA) @@ -80,6 +80,13 @@ $(METADATA): Makefile @echo "Bug: 1829013" >> $(METADATA) # Fedora 32 @echo "Bug: 1829075" >> $(METADATA) # Fedora 32 @echo "Bug: 1829128" >> $(METADATA) # Fedora 32 + @echo "Bug: 1928546" >> $(METADATA) # Fedora 34 + @echo "Bug: 1928565" >> $(METADATA) # Fedora 34 + @echo "Bug: 1928567" >> $(METADATA) # Fedora 34 + @echo "Bug: 1933687" >> $(METADATA) # Fedora 34 + @echo "Bug: 1933842" >> $(METADATA) # RHEL-9 + @echo "Bug: 1934573" >> $(METADATA) # Fedora 34 + @echo "Bug: 1935232" >> $(METADATA) # RHEL-9 rhts-lint $(METADATA) diff --git a/selinux-policy/accounts-daemon-and-similar/main.fmf b/selinux-policy/accounts-daemon-and-similar/main.fmf index 86dea1b..85c80d0 100644 --- a/selinux-policy/accounts-daemon-and-similar/main.fmf +++ b/selinux-policy/accounts-daemon-and-similar/main.fmf @@ -5,6 +5,8 @@ description: |+ contact: Milos Malik component: - selinux-policy +test: ./runtest.sh +framework: beakerlib require: - library(selinux-policy/common) recommend: @@ -20,6 +22,7 @@ recommend: - procps-ng - realmd - initscripts + - gdm environment: AVC_ERROR: +no_avc_check duration: 10m @@ -54,13 +57,13 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1829013 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1829075 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1829128 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1935232 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1933842 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1933687 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1928546 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1934573 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1928565 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1928567 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1933687 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1933842 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1934573 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1935232 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6 diff --git a/selinux-policy/accounts-daemon-and-similar/runtest.sh b/selinux-policy/accounts-daemon-and-similar/runtest.sh index 0c64eb0..40839e9 100755 --- a/selinux-policy/accounts-daemon-and-similar/runtest.sh +++ b/selinux-policy/accounts-daemon-and-similar/runtest.sh @@ -119,6 +119,14 @@ rlJournalStart rlPhaseEnd fi + if seinfo --common file -x | grep -q watch ; then + rlPhaseStartTest "bz#1928546 + bz#1933842 + bz#1935232" + rlSEMatchPathCon "/usr/libexec/accounts-daemon" "accountsd_exec_t" + rlSEMatchPathCon "/etc/gdm" "xdm_etc_t" + rlSESearchRule "allow accountsd_t xdm_etc_t : dir { watch } [ ]" + rlPhaseEnd + fi + rlPhaseStartTest "real scenario" rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" if ! rlSEDefined ${PROCESS_CONTEXT} ; then diff --git a/selinux-policy/acpid-and-similar/Makefile b/selinux-policy/acpid-and-similar/Makefile index 3803c53..8abefeb 100644 --- a/selinux-policy/acpid-and-similar/Makefile +++ b/selinux-policy/acpid-and-similar/Makefile @@ -69,6 +69,7 @@ $(METADATA): Makefile @echo "Bug: 1468548" >> $(METADATA) # RHEL-7 @echo "Bug: 1622417" >> $(METADATA) # RHEL-7 @echo "Bug: 1623342" >> $(METADATA) # RHEL-7 + @echo "Bug: 1932294" >> $(METADATA) # RHEL-9 rhts-lint $(METADATA) diff --git a/selinux-policy/acpid-and-similar/runtest.sh b/selinux-policy/acpid-and-similar/runtest.sh index 9034f7d..52e751d 100755 --- a/selinux-policy/acpid-and-similar/runtest.sh +++ b/selinux-policy/acpid-and-similar/runtest.sh @@ -98,6 +98,14 @@ rlJournalStart rlPhaseEnd fi + if seinfo --common file -x | grep -q watch ; then + rlPhaseStartTest "bz#1932294" + rlSEMatchPathCon "/usr/sbin/acpid" "apmd_exec_t" + rlSEMatchPathCon "/dev/input" "device_t" + rlSESearchRule "allow apmd_t device_t : dir { watch } [ ]" + rlPhaseEnd + fi + rlPhaseStartTest "real scenario" rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" if ! rlSEDefined ${PROCESS_CONTEXT} ; then @@ -108,7 +116,7 @@ rlJournalStart fi fi rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /var /run" + rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd diff --git a/selinux-policy/boltd-and-similar/runtest.sh b/selinux-policy/boltd-and-similar/runtest.sh index 17359a7..682646f 100755 --- a/selinux-policy/boltd-and-similar/runtest.sh +++ b/selinux-policy/boltd-and-similar/runtest.sh @@ -126,13 +126,12 @@ rlJournalStart fi fi rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /run /var" + rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd rlPhaseStartTest "real scenario -- confined users" - rlSEConfigureSSH - + CREATED_USERS="" rlRun "setsebool ssh_sysadm_login on" rlLog "configuration says not to test SELinux users: ${DENIED_USERS}" for SELINUX_USER in ${ALLOWED_USERS} ; do @@ -143,10 +142,12 @@ rlJournalStart rlRun "restorecon -RvF /home/${USER_NAME}" rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost boltctl list" sleep 2 - rlRun "userdel -rfZ ${USER_NAME}" - sleep 10 + CREATED_USERS="${USER_NAME} ${CREATED_USERS}" done rlRun "setsebool ssh_sysadm_login off" + for USER_NAME in ${CREATED_USERS} ; do + rlRun "userdel -rfZ ${USER_NAME}" + done rlPhaseEnd rlPhaseStartCleanup @@ -154,7 +155,6 @@ rlJournalStart rlSECheckAVC rlFileRestore - rlRun "service sshd restart" rlServiceRestore ${SERVICE_NAME} rlPhaseEnd rlJournalPrintText diff --git a/selinux-policy/colord-and-similar/runtest.sh b/selinux-policy/colord-and-similar/runtest.sh index f082735..badb931 100755 --- a/selinux-policy/colord-and-similar/runtest.sh +++ b/selinux-policy/colord-and-similar/runtest.sh @@ -73,8 +73,7 @@ rlJournalStart if ! rlIsRHEL 5 6 7 ; then rlPhaseStartTest "real scenario -- user session service" - rlSEConfigureSSH - + CREATED_USERS="" rlRun "setsebool ssh_sysadm_login on" rlLog "configuration says not to test SELinux users: ${DENIED_USERS}" for SELINUX_USER in ${ALLOWED_USERS} ; do @@ -86,10 +85,13 @@ rlJournalStart rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost /usr/bin/systemctl --user --no-pager status colord-session" rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost /usr/bin/systemctl --user --no-pager start colord-session" rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost /usr/bin/systemctl --user --no-pager stop colord-session" - rlRun "userdel -rfZ ${USER_NAME}" - sleep 10 + sleep 2 + CREATED_USERS="${USER_NAME} ${CREATED_USERS}" done rlRun "setsebool ssh_sysadm_login off" + for USER_NAME in ${CREATED_USERS} ; do + rlRun "userdel -rfZ ${USER_NAME}" + done rlPhaseEnd rlPhaseStartTest "bz#1772669" @@ -105,6 +107,7 @@ rlJournalStart rlPhaseEnd rlPhaseStartTest "real scenario -- bz#1772669" + CREATED_USERS="" rlRun "setsebool ssh_sysadm_login on" rlLog "configuration says not to test SELinux users: ${DENIED_USERS}" for SELINUX_USER in ${ALLOWED_USERS} ; do @@ -115,10 +118,12 @@ rlJournalStart rlRun "restorecon -RvF /home/${USER_NAME}" rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost colormgr get-devices" sleep 2 - rlRun "userdel -rfZ ${USER_NAME}" - sleep 10 + CREATED_USERS="${USER_NAME} ${CREATED_USERS}" done rlRun "setsebool ssh_sysadm_login off" + for USER_NAME in ${CREATED_USERS} ; do + rlRun "userdel -rfZ ${USER_NAME}" + done rlPhaseEnd fi @@ -132,7 +137,7 @@ rlJournalStart fi fi rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /run /var" + rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd @@ -141,7 +146,6 @@ rlJournalStart rlSECheckAVC rlFileRestore - rlRun "service sshd restart" rlServiceRestore ${SERVICE_NAME} rlPhaseEnd rlJournalPrintText diff --git a/selinux-policy/cups-pdf-and-similar/runtest.sh b/selinux-policy/cups-pdf-and-similar/runtest.sh index 2e20f6e..a8d6c77 100755 --- a/selinux-policy/cups-pdf-and-similar/runtest.sh +++ b/selinux-policy/cups-pdf-and-similar/runtest.sh @@ -107,8 +107,7 @@ rlJournalStart rlPhaseEnd rlPhaseStartTest "real scenario -- confined users" - rlSEConfigureSSH - + CREATED_USERS="" rlRun "lpadmin -x cups-pdf" 0-255 rlRun "lpadmin -p cups-pdf -v cups-pdf:/ -E -P /usr/share/cups/model/CUPS-PDF_opt.ppd" rlRun "setsebool ssh_sysadm_login on" @@ -123,12 +122,14 @@ rlJournalStart rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost lpr -P cups-pdf /usr/share/cups/data/testprint" sleep 5 rlRun "find /home/${USER_NAME} -type f | grep testprint-job" - rlRun "userdel -rfZ ${USER_NAME}" - sleep 10 + CREATED_USERS="${USER_NAME} ${CREATED_USERS}" done rlRun "setsebool selinuxuser_tcp_server off" rlRun "setsebool ssh_sysadm_login off" rlRun "lpadmin -x cups-pdf" + for USER_NAME in ${CREATED_USERS} ; do + rlRun "userdel -rfZ ${USER_NAME}" + done rlPhaseEnd rlPhaseStartCleanup @@ -137,7 +138,6 @@ rlJournalStart rlFileRestore rlServiceRestore ${SERVICE_NAME} - rlRun "service sshd restart" rlPhaseEnd rlJournalPrintText rlJournalEnd diff --git a/selinux-policy/dmidecode-and-similar/runtest.sh b/selinux-policy/dmidecode-and-similar/runtest.sh index 1885ae8..e6189f3 100755 --- a/selinux-policy/dmidecode-and-similar/runtest.sh +++ b/selinux-policy/dmidecode-and-similar/runtest.sh @@ -108,8 +108,7 @@ rlJournalStart rlPhaseEnd rlPhaseStartTest "real scenario -- confined users" - rlSEConfigureSSH - + CREATED_USERS="" rlRun "setsebool ssh_sysadm_login on" rlLog "configuration says not to test SELinux users: ${DENIED_USERS}" for SELINUX_USER in ${ALLOWED_USERS} ; do @@ -131,11 +130,12 @@ rlJournalStart rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost /usr/sbin/ownership" fi sleep 2 - rlRun "userdel -rfZ ${USER_NAME}" + CREATED_USERS="${USER_NAME} ${CREATED_USERS}" done rlRun "setsebool ssh_sysadm_login off" - rlFileRestore - rlRun "service sshd restart" + for USER_NAME in ${CREATED_USERS} ; do + rlRun "userdel -rfZ ${USER_NAME}" + done rlPhaseEnd rlPhaseStartCleanup diff --git a/selinux-policy/fwupd-and-similar/runtest.sh b/selinux-policy/fwupd-and-similar/runtest.sh index 91b2300..e5ce44d 100755 --- a/selinux-policy/fwupd-and-similar/runtest.sh +++ b/selinux-policy/fwupd-and-similar/runtest.sh @@ -95,7 +95,7 @@ rlJournalStart PROCESS_CONTEXT="unconfined_service_t" fi rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /run /var" 0-255 + rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd @@ -154,8 +154,7 @@ rlJournalStart fi rlPhaseStartTest "real scenario -- confined users -- bz#1772619" - rlSEConfigureSSH - + CREATED_USERS="" rlRun "setsebool ssh_sysadm_login on" rlLog "configuration says not to test SELinux users: ${DENIED_USERS}" for SELINUX_USER in ${ALLOWED_USERS} ; do @@ -166,10 +165,12 @@ rlJournalStart rlRun "restorecon -RvF /home/${USER_NAME}" rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost fwupdmgr get-devices" sleep 2 - rlRun "userdel -rfZ ${USER_NAME}" - sleep 10 + CREATED_USERS="${USER_NAME} ${CREATED_USERS}" done rlRun "setsebool ssh_sysadm_login off" + for USER_NAME in ${CREATED_USERS} ; do + rlRun "userdel -rfZ ${USER_NAME}" + done rlPhaseEnd rlPhaseStartCleanup @@ -177,7 +178,6 @@ rlJournalStart rlSECheckAVC rlFileRestore - rlRun "service sshd restart" rlServiceRestore ${SERVICE_NAME} rlPhaseEnd rlJournalPrintText diff --git a/selinux-policy/policykit-general/runtest.sh b/selinux-policy/policykit-general/runtest.sh index 6388404..9775454 100755 --- a/selinux-policy/policykit-general/runtest.sh +++ b/selinux-policy/policykit-general/runtest.sh @@ -143,13 +143,12 @@ rlJournalStart fi fi rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /run /var" + rlRun "restorecon -Rv /var /run -e /var/ARTIFACTS" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd rlPhaseStartTest "real scenario -- confined users" - rlSEConfigureSSH - + CREATED_USERS="" rlRun "setsebool ssh_sysadm_login on" for SELINUX_USER in ${ALLOWED_USERS} ; do USER_NAME="user${RANDOM}" @@ -158,9 +157,13 @@ rlJournalStart rlRun "echo ${USER_SECRET} | passwd --stdin ${USER_NAME}" rlRun "restorecon -Rv /home/${USER_NAME}" rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost pkaction" - rlRun "userdel -rfZ ${USER_NAME}" + sleep 2 + CREATED_USERS="${USER_NAME} ${CREATED_USERS}" done rlRun "setsebool ssh_sysadm_login off" + for USER_NAME in ${CREATED_USERS} ; do + rlRun "userdel -rfZ ${USER_NAME}" + done rlPhaseEnd fi @@ -170,7 +173,6 @@ rlJournalStart rlFileRestore rlServiceRestore ${SERVICE_NAME} - rlRun "service sshd restart" rlPhaseEnd rlJournalPrintText rlJournalEnd From de80db37fed2901ae5fb90db580359d080ed9d09 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Thu, 13 Oct 2022 08:48:48 +0200 Subject: [PATCH 193/626] add new test which covers systemd-machined The use of systemd-machined and systemd-nspawn services revealed that SELinux still prevents various actions they do. The TC reproduces the situation. In order to support the documented functionality of systemd-machine, I believe that SELinux policy should allow these actions. The TC looks for appropriate policy rules and file context patterns. The TC covers BZ#1847545, BZ#1900869, BZ#1900888 and their duplicates. --- .../systemd-machined-and-similar/Makefile | 71 ++++++++++ .../systemd-machined-and-similar/PURPOSE | 5 + .../systemd-machined-and-similar/main.fmf | 41 ++++++ .../systemd-machined-and-similar/runtest.sh | 124 ++++++++++++++++++ .../testpolicy.cil | 11 ++ 5 files changed, 252 insertions(+) create mode 100644 selinux-policy/systemd-machined-and-similar/Makefile create mode 100644 selinux-policy/systemd-machined-and-similar/PURPOSE create mode 100644 selinux-policy/systemd-machined-and-similar/main.fmf create mode 100755 selinux-policy/systemd-machined-and-similar/runtest.sh create mode 100644 selinux-policy/systemd-machined-and-similar/testpolicy.cil diff --git a/selinux-policy/systemd-machined-and-similar/Makefile b/selinux-policy/systemd-machined-and-similar/Makefile new file mode 100644 index 0000000..35c7767 --- /dev/null +++ b/selinux-policy/systemd-machined-and-similar/Makefile @@ -0,0 +1,71 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/systemd-machined-and-similar +# Description: SELinux interferes with systemd-machined and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2022 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/systemd-machined-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE testpolicy.cil + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with systemd-machined and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "RunFor: systemd" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console systemd-container /usr/sbin/service" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) + @echo "Bug: 1847545" >> $(METADATA) # Fedora 32 + @echo "Bug: 1900869" >> $(METADATA) # Fedora 33 + @echo "Bug: 1900888" >> $(METADATA) # Fedora 35 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/systemd-machined-and-similar/PURPOSE b/selinux-policy/systemd-machined-and-similar/PURPOSE new file mode 100644 index 0000000..1734b44 --- /dev/null +++ b/selinux-policy/systemd-machined-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/systemd-machined-and-similar +Author: Milos Malik + +SELinux interferes with systemd-machined and related programs. + diff --git a/selinux-policy/systemd-machined-and-similar/main.fmf b/selinux-policy/systemd-machined-and-similar/main.fmf new file mode 100644 index 0000000..dc0ec37 --- /dev/null +++ b/selinux-policy/systemd-machined-and-similar/main.fmf @@ -0,0 +1,41 @@ +summary: SELinux interferes with systemd-machined and related programs +description: |+ + SELinux interferes with systemd-machined and related programs. + +contact: Milos Malik +component: + - selinux-policy + - systemd +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - systemd-container + - /usr/sbin/service +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - targeted +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1847545 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1900869 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1900888 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7 + because: the systemd-machined program is not available there +extra-summary: /CoreOS/selinux-policy/Regression/systemd-machined-and-similar +extra-task: /CoreOS/selinux-policy/Regression/systemd-machined-and-similar +extra-nitrate: TC#0614355 diff --git a/selinux-policy/systemd-machined-and-similar/runtest.sh b/selinux-policy/systemd-machined-and-similar/runtest.sh new file mode 100755 index 0000000..9063972 --- /dev/null +++ b/selinux-policy/systemd-machined-and-similar/runtest.sh @@ -0,0 +1,124 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/systemd-machined-and-similar +# Description: SELinux interferes with systemd-machined and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2022 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +FILE_PATH="/usr/lib/systemd/systemd-machined" +FILE_CONTEXT="systemd_machined_exec_t" +SERVICE_PACKAGE="systemd-container" +SERVICE_NAME="systemd-machined" +PROCESS_NAME="systemd-machined" +PROCESS_CONTEXT="systemd_machined_t" + +rlJournalStart + if [ ! -f ${FILE_PATH} ] ; then + rlLog "The required program is not installed. Quitting..." + rlJournalEnd + exit 0 + fi + + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "SELinux contexts and rules" + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + SOURCE_TYPE="init_t" # systemd runs the process + rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" + rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" + rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" + rlPhaseEnd + + rlPhaseStartTest "bz#1847545" + rlSESearchRule "allow systemd_machined_t unconfined_service_t : dir { search } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1900869 + bz#1900888" + rlSESearchRule "allow system_dbusd_t devpts_t : chr_file { read write } [ ]" + rlSESearchRule "allow systemd_machined_t devpts_t : chr_file { open read write ioctl } [ ]" + rlSESearchRule "allow systemd_machined_t systemd_machined_t : cap_userns { sys_ptrace sys_admin setgid setuid } [ ]" + rlSESearchRule "allow systemd_machined_t tmpfs_t : lnk_file { getattr read } [ ]" + rlSESearchRule "allow systemd_machined_t tmpfs_t : sock_file { write } [ ]" + rlSESearchRule "allow systemd_machined_t unconfined_service_t : dir { search } [ ]" + rlSESearchRule "allow systemd_machined_t unconfined_service_t : file { getattr open read ioctl } [ ]" + rlSESearchRule "allow systemd_machined_t unconfined_service_t : lnk_file { getattr read } [ ]" + rlSESearchRule "allow systemd_machined_t unconfined_service_t : unix_stream_socket { connectto } [ ]" + rlPhaseEnd + + rlPhaseStartTest "real scenario -- standalone service" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + PROCESS_CONTEXT="unconfined_service_t" + fi + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + + rlPhaseStartTest "real scenario -- bz#1900869 + bz#1900888" + rlRun "mkdir -pZ /var/lib/machines/test" + rlRun "dnf -y --installroot=/var/lib/machines/test/ install dhcp-client dnf filesystem glibc glibc-langpack-en glibc-langpack-de iproute iputils less passwd systemd vim-minimal" + rlRun "du -sh /var/lib/machines/test" + # TODO: remove next 2 lines once the BZs are fixed + rlRun "semodule -i testpolicy.cil" + rlRun "semodule -lfull | grep testpolicy" + rlRun "systemctl start systemd-nspawn@test" + rlRun "systemctl status systemd-nspawn@test" + rlRun "ps -efZ | grep -e ${PROCESS_CONTEXT} -e unconfined_service_t" + rlRun "machinectl list" + rlRun "machinectl status test" + rlWatchdog "machinectl login test" 20 + rlRun "machinectl terminate test" + rlRun "systemctl stop systemd-nspawn@test" + # TODO: remove next 2 lines once the BZs are fixed + rlRun "semodule -r testpolicy" + rlRun "semodule -lfull | grep testpolicy" 1 + rlRun "rm -rf /var/lib/machines/test" + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/systemd-machined-and-similar/testpolicy.cil b/selinux-policy/systemd-machined-and-similar/testpolicy.cil new file mode 100644 index 0000000..9fa2ced --- /dev/null +++ b/selinux-policy/systemd-machined-and-similar/testpolicy.cil @@ -0,0 +1,11 @@ +( allow systemd_machined_t unconfined_service_t ( dir ( search ))) +( allow systemd_machined_t unconfined_service_t ( file ( getattr open read ioctl ))) +( allow systemd_machined_t unconfined_service_t ( lnk_file ( getattr read ))) +( allow systemd_machined_t systemd_machined_t ( cap_userns ( sys_ptrace sys_admin setgid setuid ))) +( allow systemd_machined_t tmpfs_t ( lnk_file ( getattr read ))) +( allow systemd_machined_t devpts_t ( chr_file ( open read write ioctl ))) +( allow systemd_machined_t tmpfs_t ( sock_file ( write ))) +( allow system_dbusd_t devpts_t ( chr_file ( read write ))) +( allow systemd_machined_t unconfined_service_t ( unix_stream_socket ( connectto ))) +( allow systemd_machined_t systemd_unit_file_t ( service ( stop ))) + From 677e8492b98881b2f14532ef3500c2ffbddc3900 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Fri, 2 Dec 2022 19:22:11 +0100 Subject: [PATCH 194/626] test if systemd-rfkill can use the bpf capability Recent RHEL-9.2 instalation testing revealed that SELinux prevents the systemd-rfkill processes from using the bpf capability. The TC does not reproduce the situation unless the right HW is available. In order to support the full functionality of the systemd-rfkill program, I believe that SELinux policy should allow this action. The TC looks for appropriate policy rule. The TC covers BZ#2149390. --- selinux-policy/systemd-rfkill-and-similar/Makefile | 1 + selinux-policy/systemd-rfkill-and-similar/main.fmf | 1 + selinux-policy/systemd-rfkill-and-similar/runtest.sh | 9 ++++++++- 3 files changed, 10 insertions(+), 1 deletion(-) diff --git a/selinux-policy/systemd-rfkill-and-similar/Makefile b/selinux-policy/systemd-rfkill-and-similar/Makefile index 1c92453..05acb33 100644 --- a/selinux-policy/systemd-rfkill-and-similar/Makefile +++ b/selinux-policy/systemd-rfkill-and-similar/Makefile @@ -72,6 +72,7 @@ $(METADATA): Makefile @echo "Bug: 1557595" >> $(METADATA) # Fedora 27 @echo "Bug: 1638981" >> $(METADATA) # Fedora 29 @echo "Bug: 1661724" >> $(METADATA) # Fedora 30 + @echo "Bug: 2149390" >> $(METADATA) # RHEL-9 rhts-lint $(METADATA) diff --git a/selinux-policy/systemd-rfkill-and-similar/main.fmf b/selinux-policy/systemd-rfkill-and-similar/main.fmf index 8fb5e1e..827d38a 100644 --- a/selinux-policy/systemd-rfkill-and-similar/main.fmf +++ b/selinux-policy/systemd-rfkill-and-similar/main.fmf @@ -45,6 +45,7 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1557595 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1638981 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1661724 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2149390 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7 diff --git a/selinux-policy/systemd-rfkill-and-similar/runtest.sh b/selinux-policy/systemd-rfkill-and-similar/runtest.sh index 73addd0..cbebe00 100755 --- a/selinux-policy/systemd-rfkill-and-similar/runtest.sh +++ b/selinux-policy/systemd-rfkill-and-similar/runtest.sh @@ -47,6 +47,7 @@ rlJournalStart rlAssertRpm ${SERVICE_PACKAGE} rlRun "rpm -qa kernel\*" rlRun "uname -r" + rlRun "yum -y install kernel-modules-`uname -r`" rlServiceStop ${SERVICE_NAME} rlFileBackup /etc/shadow @@ -101,6 +102,12 @@ rlJournalStart rlSESearchRule "allow systemd_rfkill_t syslogd_t : unix_dgram_socket { sendto } [ ]" rlPhaseEnd + if [ -f /sys/fs/selinux/class/capability2/perms/bpf ] ; then + rlPhaseStartTest "bz#2149390" + rlSESearchRule "allow systemd_rfkill_t systemd_rfkill_t : capability2 { bpf } [ ]" + rlPhaseEnd + fi + rlPhaseStartTest "real scenario -- standalone service" rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" if ! rlSEDefined ${PROCESS_CONTEXT} ; then @@ -111,7 +118,7 @@ rlJournalStart fi rlRun "modprobe rfkill" rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /run /var" 0-255 + rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd From 202b220c73d0c1d183440cf4864ce63e27f1c5e0 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Fri, 2 Dec 2022 11:50:39 +0100 Subject: [PATCH 195/626] add new test which covers the stacd and stafd services SELinux policy now contains a new policy module which confines the stacd and stafd services, which belong to the nvme-stas package. This TC covers basic scenarios of running the services in default configuration. The TC also looks for appropriate policy rules and file context patterns. The TC covers BZ#2111414. --- selinux-policy/nvme-stas-and-similar/Makefile | 69 ++++++++++ selinux-policy/nvme-stas-and-similar/PURPOSE | 5 + selinux-policy/nvme-stas-and-similar/main.fmf | 41 ++++++ .../nvme-stas-and-similar/runtest.sh | 123 ++++++++++++++++++ 4 files changed, 238 insertions(+) create mode 100644 selinux-policy/nvme-stas-and-similar/Makefile create mode 100644 selinux-policy/nvme-stas-and-similar/PURPOSE create mode 100644 selinux-policy/nvme-stas-and-similar/main.fmf create mode 100755 selinux-policy/nvme-stas-and-similar/runtest.sh diff --git a/selinux-policy/nvme-stas-and-similar/Makefile b/selinux-policy/nvme-stas-and-similar/Makefile new file mode 100644 index 0000000..e528da4 --- /dev/null +++ b/selinux-policy/nvme-stas-and-similar/Makefile @@ -0,0 +1,69 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/nvme-stas-and-similar +# Description: SELinux interferes with NVME sta* services +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2022 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/nvme-stas-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with NVME sta* services" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: nvme-stas" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: avahi audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console /usr/sbin/service nvme-stas" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA) + @echo "Bug: 2111414" >> $(METADATA) # RHEL-9 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/nvme-stas-and-similar/PURPOSE b/selinux-policy/nvme-stas-and-similar/PURPOSE new file mode 100644 index 0000000..5f9b111 --- /dev/null +++ b/selinux-policy/nvme-stas-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/nvme-stas-and-similar +Author: Milos Malik + +SELinux interferes with NVME sta* services + diff --git a/selinux-policy/nvme-stas-and-similar/main.fmf b/selinux-policy/nvme-stas-and-similar/main.fmf new file mode 100644 index 0000000..0e83395 --- /dev/null +++ b/selinux-policy/nvme-stas-and-similar/main.fmf @@ -0,0 +1,41 @@ +summary: SELinux interferes with NVME sta* services +description: |+ + SELinux interferes with NVME sta* services + +contact: Milos Malik +component: + - nvme-stas + - selinux-policy +require: + - library(selinux-policy/common) +recommend: + - avahi + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - /usr/sbin/service + - nvme-stas +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - NoRHEL8 + - targeted +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2111414 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 + because: the nvme-stas package is not available there +extra-summary: /CoreOS/selinux-policy/Regression/nvme-stas-and-similar +extra-task: /CoreOS/selinux-policy/Regression/nvme-stas-and-similar +extra-nitrate: TC#0614621 diff --git a/selinux-policy/nvme-stas-and-similar/runtest.sh b/selinux-policy/nvme-stas-and-similar/runtest.sh new file mode 100755 index 0000000..a86991e --- /dev/null +++ b/selinux-policy/nvme-stas-and-similar/runtest.sh @@ -0,0 +1,123 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/nvme-stas-and-similar +# Description: SELinux interferes with NVME sta* services +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2022 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +FILE_CONTEXT="stas_exec_t" +SERVICE_PACKAGE="nvme-stas" +PROCESS_CONTEXT="stas_t" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStart avahi-daemon + rlServiceStop stacd stafd + rlFileBackup /usr/lib/systemd/system/stacd.service + rlFileBackup /usr/lib/systemd/system/stafd.service + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + if rlSEDefined "${FILE_CONTEXT} ${PROCESS_CONTEXT}" ; then + rlPhaseStartTest "bz#2111414" + rlSEMatchPathCon "/usr/sbin/stacd" "${FILE_CONTEXT}" + rlSEMatchPathCon "/usr/sbin/stafd" "${FILE_CONTEXT}" + rlSEMatchPathCon "/dev/nvme-fabrics" "fixed_disk_device_t" + rlSEMatchPathCon "/run/systemd/journal/socket" "syslogd_var_run_t" + rlSEMatchPathCon "/run/stacd" "stas_var_run_t" + rlSEMatchPathCon "/run/stacd/last-known-config.pickle" "stas_var_run_t" + rlSEMatchPathCon "/run/stafd" "stas_var_run_t" + rlSEMatchPathCon "/run/stafd/last-known-config.pickle" "stas_var_run_t" + rlSEMatchPathCon "/run/udev/" "udev_var_run_t" + rlSEMatchPathCon "/run/udev/rules.d/" "udev_var_run_t" + rlSEMatchPathCon "/run/udev/rules.d/70-nvmf-autoconnect.rules" "udev_var_run_t" + rlSEMatchPathCon "/var/cache/stacd" "stas_cache_t" + rlSEMatchPathCon "/var/cache/stafd" "stas_cache_t" + SOURCE_TYPE="init_t" # systemd runs the process + rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" + rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" + rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" + rlRun "semodule -lfull | grep stas" + rlSESearchRule "allow avahi_t stas_t : dbus { send_msg } [ ]" + rlSESearchRule "allow stas_t avahi_t : dbus { send_msg } [ ]" + rlSESearchRule "allow stas_t fixed_disk_device_t : chr_file { getattr } [ ]" + rlSESearchRule "allow stas_t stas_t : dbus { send_msg } [ ]" + rlSESearchRule "allow stas_t syslogd_var_run_t : sock_file { write } [ ]" + rlSESearchRule "allow stas_t system_dbusd_t : dbus { acquire_svc send_msg } [ ]" + rlSESearchRule "allow stas_t udev_var_run_t : dir { add_name remove_name write } [ ]" + rlSESearchRule "allow stas_t udev_var_run_t : file { create getattr ioctl open unlink write } [ ]" + rlSESearchRule "allow stas_t stas_var_run_t : file { getattr ioctl open read write } [ ]" + rlPhaseEnd + fi + + rlPhaseStartTest "real scenario -- standalone service" + for CUR_FILE in /usr/lib/systemd/system/stacd.service \ + /usr/lib/systemd/system/stafd.service ; do + if grep -q '^ExecStart=.*python' ${CUR_FILE} ; then + rlRun "sed -i 's|^ExecStart=.*python.* /|ExecStart=/|' ${CUR_FILE}" + rlRun "systemctl daemon-reload" + rlRun "grep '^ExecStart=' ${CUR_FILE}" + fi + done + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + # for RHELs where the SELinux domain does not exist yet + PROCESS_CONTEXT="unconfined_service_t" + fi + rlRun "mkdir -p /etc/nvme" + rlRun "touch /etc/nvme/hostid" + rlRun "touch /etc/nvme/hostnqn" + rlSEService - stafd stafd ${PROCESS_CONTEXT} "start status" 1 + rlSEService - stacd stacd ${PROCESS_CONTEXT} "start status" 1 + rlRun "stasadm -v" + rlRun "stasadm hostid" + rlRun "stasadm hostnqn" + rlRun "restorecon -Rv /var /run -e /var/ARTIFACTS" 0-255 + rlSEService - stacd stacd ${PROCESS_CONTEXT} "restart status stop status" 1 + rlSEService - stafd stafd ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlServiceRestore stacd stafd + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + From e70a8df7c857ccc4ca913c932a1e74c5b588f892 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Wed, 23 Nov 2022 11:42:05 +0100 Subject: [PATCH 196/626] Add coverage for the hardening of executing binaries by the kernel See the test description/Bugzilla for more details. Signed-off-by: Ondrej Mosnacek --- selinux-policy/kernel-confined-exec/main.fmf | 25 ++++ .../kernel-confined-exec/runtest.sh | 129 ++++++++++++++++++ .../kernel-confined-exec/trigger_segfault.c | 6 + 3 files changed, 160 insertions(+) create mode 100644 selinux-policy/kernel-confined-exec/main.fmf create mode 100755 selinux-policy/kernel-confined-exec/runtest.sh create mode 100644 selinux-policy/kernel-confined-exec/trigger_segfault.c diff --git a/selinux-policy/kernel-confined-exec/main.fmf b/selinux-policy/kernel-confined-exec/main.fmf new file mode 100644 index 0000000..17584b2 --- /dev/null +++ b/selinux-policy/kernel-confined-exec/main.fmf @@ -0,0 +1,25 @@ +summary: Test that kernel cannot execute arbitrary helper binaries +description: | + Ensures that the kernel is not allowed to execute unauthorized binaries + and that a transition to a confined domain is enforced on those that it + can execute, so that overwriting usermode helper paths doesn't lead to + an exploitable privilege escalation. +contact: Ondrej Mosnacek +component: + - selinux-policy +framework: beakerlib +require: + - library(selinux-policy/common) + - policycoreutils + - gcc +environment: + AVC_ERROR: +no_avc_check +duration: 20m +tier: 2 +enabled: true +adjust: + - enabled: false + when: distro < fedora-38 + because: This hardening applies only to F38+ +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2068579 diff --git a/selinux-policy/kernel-confined-exec/runtest.sh b/selinux-policy/kernel-confined-exec/runtest.sh new file mode 100755 index 0000000..35f0b58 --- /dev/null +++ b/selinux-policy/kernel-confined-exec/runtest.sh @@ -0,0 +1,129 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# SPDX-License-Identifier: GPLv2 +# Copyright (c) 2022 Red Hat, Inc. +# Author: Ondrej Mosnacek + +# Include Beakerlib environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +function trigger_modprobe() { + # ensure gre modules are unloaded + modprobe -r ip_gre gre || return 2 + ip link add mygre type gretap local 127.0.0.1 remote 127.0.0.1 + ret=$? + ip link del mygre 2>/dev/null + if [ $ret -eq 0 ]; then + return 0 + else + return 1 + fi +} + +rlJournalStart + rlPhaseStartSetup + rlImport 'selinux-policy/common' + + rlAssertRpm selinux-policy + rlAssertRpm selinux-policy-targeted + + rlSESetEnforce + rlSEStatus + + original_modprobe="$(sysctl -nb kernel.modprobe)" + original_core_pattern="$(sysctl -nb kernel.core_pattern)" + + rlRun "gcc -o trigger_segfault trigger_segfault.c" + rlPhaseEnd + + rlPhaseStartTest "Policy rules" + rlLog "kernel_t shouldn't be allowed to execute any file without transition" + + rlSESearchRule "allow kernel_t file_type:file { execute_no_trans } []" 1 \ + "kernel_t shouldn't be allowed to execute any file without transition" + rlSESearchRule "allow kernel_t user_home_t:file { execute entrypoint }" 1 \ + "kernel_t shouldn't be allowed to execute files in user home directories" + rlSESearchRule "allow kernel_t user_tmp_t:file { execute entrypoint }" 1 \ + "kernel_t shouldn't be allowed to execute user temporary files" + rlPhaseEnd + + rlPhaseStartTest "Legit modprobe" + rlLog "Should work with no AVCs" + + rlSESetTimestamp + sleep 1 + rlRun "trigger_modprobe" + sleep 1 + rlSECheckAVC + rlPhaseEnd + + rlPhaseStartTest "Modprobe set to /usr/bin/true" + rlLog "Should fail but cause no AVCs" + + rlRun "sysctl kernel.modprobe=/usr/bin/true" 0 \ + "Set kernel.modprobe to /usr/bin/true" + rlSESetTimestamp + sleep 1 + rlRun "trigger_modprobe" 1 + sleep 1 + rlSECheckAVC + rlRun "sysctl kernel.modprobe=\"\$original_modprobe\"" 0 \ + "Reset kernel.modprobe to default" + rlPhaseEnd + + rlPhaseStartTest "Modprobe set to /usr/sbin/load_policy" + rlLog "Should fail with AVCs denying the execution" + + rlRun "sysctl kernel.modprobe=/usr/sbin/load_policy" 0 \ + "Set kernel.modprobe to /usr/sbin/load_policy" + rlSESetTimestamp + sleep 1 + rlRun "trigger_modprobe" 1 + sleep 1 + rlRun "rlSEAVCCheck" 1 + rlRun "sysctl kernel.modprobe=\"\$original_modprobe\"" 0 \ + "Reset kernel.modprobe to default" + rlPhaseEnd + + rlPhaseStartTest "Modprobe relabeled to bin_t" + rlLog "Should fail with AVCs denying operation after transition" + rlRun "chcon -t bin_t \"\$(readlink -f \"\$original_modprobe\")\"" 0 \ + "Set kernel.modprobe to /usr/sbin/load_policy" + rlSESetTimestamp + sleep 1 + rlRun "trigger_modprobe" 1 + sleep 1 + rlRun "rlSEAVCCheck" 1 + rlRun "restorecon \"\$(readlink -f \"\$original_modprobe\")\"" 0 \ + "Reset kernel.modprobe to default" + rlPhaseEnd + + rlPhaseStartTest "Legit coredump helper" + rlLog "Should work with no AVCs" + + rlSESetTimestamp + sleep 1 + rlRun "./trigger_segfault" 139 + sleep 2 + rlSECheckAVC + rlPhaseEnd + + rlPhaseStartTest "Core pattern set to |/usr/sbin/load_policy" + rlLog "Should fail with AVCs denying the execution" + + rlRun "sysctl kernel.core_pattern='|/usr/sbin/load_policy'" 0 \ + "Set kernel.core_pattern to |/usr/sbin/load_policy" + rlSESetTimestamp + sleep 1 + rlRun "./trigger_segfault" 139 + sleep 1 + rlRun "rlSEAVCCheck" 1 + rlRun "sysctl kernel.core_pattern=\"\$original_core_pattern\"" 0 \ + "Reset kernel.core_pattern to default" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "rm -f trigger_segfault" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/selinux-policy/kernel-confined-exec/trigger_segfault.c b/selinux-policy/kernel-confined-exec/trigger_segfault.c new file mode 100644 index 0000000..0ee0ab4 --- /dev/null +++ b/selinux-policy/kernel-confined-exec/trigger_segfault.c @@ -0,0 +1,6 @@ +#include + +int main(void) +{ + return *(int *)NULL; +} From 96c98bb01dc740efdec6cdb91c81d3f5cc14ea8f Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Mon, 12 Dec 2022 16:17:03 +0100 Subject: [PATCH 197/626] kernel/selinux-testsuite: bump upstream commit Effective changes: - fix the policy to allow the new user_namespace::create permission where needed - fix the code to build without warnings with latest SELinux userspace The rest is various cleanups or changes not affecting Fedora/RHEL. Signed-off-by: Ondrej Mosnacek --- kernel/selinux-testsuite/runtest.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/selinux-testsuite/runtest.sh b/kernel/selinux-testsuite/runtest.sh index ae535fb..9114201 100755 --- a/kernel/selinux-testsuite/runtest.sh +++ b/kernel/selinux-testsuite/runtest.sh @@ -35,7 +35,7 @@ PACKAGE="selinux-policy" # This should be updated as needed after verifying that the new version # doesn't break testing and after applying all necessary tweaks in the TC. # Run with GIT_BRANCH=master to run the latest upstream version. -DEFAULT_COMMIT="c592d7f49e5e8ca907d90cb1d6f54bb0d410d442" +DEFAULT_COMMIT="3389abeaa3bb6fdf23a0f2d8b1550fae69f9c52e" # Default pull requests to merge before running the test. # If non-empty, then after checking out GIT_BRANCH the listed upstream pull # requests (by number) are merged, creating a new temporary local branch. From a59d3c04ad3f6a225e12da6ba2dee73ab7ba612d Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Wed, 14 Dec 2022 08:58:52 +0100 Subject: [PATCH 198/626] test if journal-offline can relabel the journal files Recently, the new versions of systemd component revealed that SELinux prevents the journal-offline command from relabeling (syscall=fsetxattr) the systemd journal files. The TC reproduces the situation. Because the relabeling of journal files is an intentional operation, which happens when the systemd journal is rotated, I believe that SELinux policy should allow it. The TC looks for appropriate policy rules. The TC covers BZ#2075527 and BZ#2152823 and their duplicates. --- selinux-policy/journalctl-and-similar/Makefile | 13 +++++++++++++ selinux-policy/journalctl-and-similar/main.fmf | 14 +++++++++++++- selinux-policy/journalctl-and-similar/runtest.sh | 7 +++++++ 3 files changed, 33 insertions(+), 1 deletion(-) diff --git a/selinux-policy/journalctl-and-similar/Makefile b/selinux-policy/journalctl-and-similar/Makefile index 65967a4..16b4c1b 100644 --- a/selinux-policy/journalctl-and-similar/Makefile +++ b/selinux-policy/journalctl-and-similar/Makefile @@ -68,6 +68,19 @@ $(METADATA): Makefile @echo "Bug: 1685689" >> $(METADATA) # RHEL-8 @echo "Bug: 1825894" >> $(METADATA) # RHEL-8 @echo "Bug: 2017838" >> $(METADATA) # RHEL-9 + @echo "Bug: 2075527" >> $(METADATA) # Fedora 37 + @echo "Bug: 2124427" >> $(METADATA) # Fedora 37 + @echo "Bug: 2125762" >> $(METADATA) # Fedora 37 + @echo "Bug: 2137323" >> $(METADATA) # Fedora 37 + @echo "Bug: 2139623" >> $(METADATA) # Fedora 37 + @echo "Bug: 2143157" >> $(METADATA) # Fedora 37 + @echo "Bug: 2143746" >> $(METADATA) # Fedora 37 + @echo "Bug: 2144150" >> $(METADATA) # Fedora 37 + @echo "Bug: 2149093" >> $(METADATA) # Fedora 37 + @echo "Bug: 2149346" >> $(METADATA) # Fedora 37 + @echo "Bug: 2152544" >> $(METADATA) # Fedora 37 + @echo "Bug: 2152588" >> $(METADATA) # Fedora 37 + @echo "Bug: 2152823" >> $(METADATA) # RHEL-9 rhts-lint $(METADATA) diff --git a/selinux-policy/journalctl-and-similar/main.fmf b/selinux-policy/journalctl-and-similar/main.fmf index ae50c2f..4ce701c 100644 --- a/selinux-policy/journalctl-and-similar/main.fmf +++ b/selinux-policy/journalctl-and-similar/main.fmf @@ -41,7 +41,19 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1685689 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1825894 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2017838 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1703241 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2075527 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2124427 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2125762 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2137323 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2139623 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2143157 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2143746 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2144150 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2149093 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2149346 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2152544 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2152588 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2152823 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6 diff --git a/selinux-policy/journalctl-and-similar/runtest.sh b/selinux-policy/journalctl-and-similar/runtest.sh index 7c471e9..527aa23 100755 --- a/selinux-policy/journalctl-and-similar/runtest.sh +++ b/selinux-policy/journalctl-and-similar/runtest.sh @@ -98,6 +98,13 @@ rlJournalStart rlPhaseEnd fi + if ! rlIsRHEL 7 8 ; then + rlPhaseStartTest "bz#2075527 + bz#2152823" + rlSESearchRule "allow syslogd_t syslogd_var_run_t : file { relabelfrom relabelto } [ ]" + rlRun "journalctl --rotate" + rlPhaseEnd + fi + rlPhaseStartTest "real scenario -- confined users" rlSEConfigureSSH From ad7293e725743754796953340664da78fccc805a Mon Sep 17 00:00:00 2001 From: Zdenek Pytela Date: Mon, 5 Dec 2022 13:18:02 +0100 Subject: [PATCH 199/626] selinux-policy: Do not test if rpmdb can access host name services Unlike originally reported in bz#1461313 and in some duplicates, rpmdb does not need access to resolv.conf and sssd any longer. Refer to https://bugzilla.redhat.com/show_bug.cgi?id=1461313#c73 for more information. --- selinux-policy/rpmdb-and-similar/Makefile | 8 ++------ selinux-policy/rpmdb-and-similar/main.fmf | 8 ++------ selinux-policy/rpmdb-and-similar/runtest.sh | 17 ----------------- 3 files changed, 4 insertions(+), 29 deletions(-) diff --git a/selinux-policy/rpmdb-and-similar/Makefile b/selinux-policy/rpmdb-and-similar/Makefile index f7d2876..e26c29e 100644 --- a/selinux-policy/rpmdb-and-similar/Makefile +++ b/selinux-policy/rpmdb-and-similar/Makefile @@ -62,13 +62,9 @@ $(METADATA): Makefile @echo "Confidential: no" >> $(METADATA) @echo "Destructive: no" >> $(METADATA) @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA) - @echo "Bug: 1898298" >> $(METADATA) # Fedora 33 + @echo "Bug: 1461313" >> $(METADATA) # Fedora 32 @echo "Bug: 1899548" >> $(METADATA) # Fedora 33 - @echo "Bug: 1900383" >> $(METADATA) # Fedora 33 - @echo "Bug: 1900386" >> $(METADATA) # Fedora 33 - @echo "Bug: 1900388" >> $(METADATA) # Fedora 33 - @echo "Bug: 1900390" >> $(METADATA) # Fedora 33 - @echo "Bug: 1900391" >> $(METADATA) # Fedora 33 + @echo "Bug: 2023163" >> $(METADATA) # Fedora 35 rhts-lint $(METADATA) diff --git a/selinux-policy/rpmdb-and-similar/main.fmf b/selinux-policy/rpmdb-and-similar/main.fmf index a5fb8b4..1adc4e3 100644 --- a/selinux-policy/rpmdb-and-similar/main.fmf +++ b/selinux-policy/rpmdb-and-similar/main.fmf @@ -29,13 +29,9 @@ tag: - NoRHEL7 - targeted link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1898298 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1461313 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1899548 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1900383 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1900386 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1900388 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1900390 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1900391 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2023163 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 diff --git a/selinux-policy/rpmdb-and-similar/runtest.sh b/selinux-policy/rpmdb-and-similar/runtest.sh index 13c5442..5fa96e0 100755 --- a/selinux-policy/rpmdb-and-similar/runtest.sh +++ b/selinux-policy/rpmdb-and-similar/runtest.sh @@ -62,26 +62,9 @@ rlJournalStart sleep 2 rlPhaseEnd - rlPhaseStartTest "bz#1898298" - rlSEMatchPathCon "/usr/bin/rpmdb" "rpmdb_exec_t" - rlSEMatchPathCon "/etc/resolv.conf" "net_conf_t" - rlSESearchRule "allow rpmdb_t net_conf_t : lnk_file { getattr read } [ ]" - rlPhaseEnd - rlPhaseStartTest "bz#1899548" - # also covers duplicates: 1900383, 1900386, 1900388, 1900389, 1900390, 1900391 rlSEMatchPathCon "/usr/bin/rpmdb" "rpmdb_exec_t" - rlSEMatchPathCon "/var/lib/sss/mc/passwd" "sssd_public_t" - rlSEMatchPathCon "/var/lib/sss/pipes/nss" "sssd_var_lib_t" - rlSEMatchPathCon "/run/dbus/system_bus_socket" "system_dbusd_var_run_t" rlSESearchRule "allow rpmdb_t user_devpts_t : chr_file { read write } [ ]" - rlSESearchRule "dontaudit rpmdb_t sssd_public_t : file { getattr open map } [ ]" - rlSESearchRule "dontaudit rpmdb_t sssd_var_lib_t : sock_file { write } [ ]" - rlSESearchRule "dontaudit rpmdb_t sssd_t : unix_stream_socket { connectto } [ ]" - rlSESearchRule "dontaudit rpmdb_t system_dbusd_var_run_t : sock_file { write } [ ]" - rlSESearchRule "dontaudit rpmdb_t system_dbusd_t : unix_stream_socket { connectto } [ ]" - rlSESearchRule "dontaudit rpmdb_t system_dbusd_t : dbus { send_msg } [ ]" - rlSESearchRule "dontaudit system_dbusd_t rpmdb_t : dbus { send_msg } [ ]" rlPhaseEnd rlPhaseStartTest "real scenario -- standalone service" From b6ec2fee8d1cf35c356fa2bde6820f6f5cfebefd Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Mon, 16 Jan 2023 14:21:00 +0100 Subject: [PATCH 200/626] test if sepolicy manpage can generate manpage in HTML form The sepolicy tool can generate man pages for specific SELinux domains. When the sepolicy tool was instructed to generate man pages in HTML form (--web), the generated HTML files were very incomplete. The TC reproduces the situation. The newly added TC checks if the sepolicy manpage command works correctly. The checks related to the sepolicy manpage command were removed from the sepolicy-generate TC. The TC covers BZ#1989840. --- policycoreutils/sepolicy-generate/runtest.sh | 8 +----- policycoreutils/sepolicy-manpage/main.fmf | 19 ++++++++++++++ policycoreutils/sepolicy-manpage/runtest.sh | 27 ++++++++++++++++++++ 3 files changed, 47 insertions(+), 7 deletions(-) create mode 100644 policycoreutils/sepolicy-manpage/main.fmf create mode 100755 policycoreutils/sepolicy-manpage/runtest.sh diff --git a/policycoreutils/sepolicy-generate/runtest.sh b/policycoreutils/sepolicy-generate/runtest.sh index e51e519..f79213f 100755 --- a/policycoreutils/sepolicy-generate/runtest.sh +++ b/policycoreutils/sepolicy-generate/runtest.sh @@ -106,16 +106,10 @@ rlJournalStart rlRun "rm -rf mypolicy" rlPhaseEnd - rlPhaseStartTest "sepolicy manpage --web, bz1854639" - rlRun "sepolicy manpage --web -d zebra_t" - rlRun "ls /tmp/*release*" 0 "Html file with OS name exists." - rlRun "cat /tmp/*release* > /tmp/testfile" - rlAssertGrep "href=zebra.html" "/tmp/testfile" - rlPhaseEnd - rlPhaseStartCleanup rlRun "popd" rlRun "rm -r $TmpDir" 0 "Removing tmp directory" rlPhaseEnd rlJournalPrintText rlJournalEnd + diff --git a/policycoreutils/sepolicy-manpage/main.fmf b/policycoreutils/sepolicy-manpage/main.fmf new file mode 100644 index 0000000..eae4499 --- /dev/null +++ b/policycoreutils/sepolicy-manpage/main.fmf @@ -0,0 +1,19 @@ +summary: sepolicy manpage sanity test +description: Does the sepolicy manpage command work correctly? +contact: Milos Malik +component: + - policycoreutils +framework: beakerlib +recommend: + - /usr/bin/sepolicy +duration: 10m +enabled: true +tier: 3 +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1854639 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1989840 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6 + because: the sepolicy command is not available there + diff --git a/policycoreutils/sepolicy-manpage/runtest.sh b/policycoreutils/sepolicy-manpage/runtest.sh new file mode 100755 index 0000000..32c12a3 --- /dev/null +++ b/policycoreutils/sepolicy-manpage/runtest.sh @@ -0,0 +1,27 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +rlJournalStart + rlPhaseStartSetup + rlRun "rpm -qa | grep policycoreutils" + rlPhaseEnd + + rlPhaseStartTest "sepolicy manpage --web, bz#1854639 + bz#1989840" + rlRun "sepolicy manpage --web -d zebra_t" + if rlIsRHEL 7 8 ; then + rlRun "ls -l /tmp/*release*" 0 "Html file with OS name exists." + rlRun "cat /tmp/*release* > /tmp/testfile" + else + rlRun "ls -l /tmp/index.html" 0 "HTML file exists" + rlRun "cat /tmp/index.html > /tmp/testfile" + fi + rlAssertGrep "href=zebra.html" "/tmp/testfile" + rlRun "ls -l /tmp/zebra.html" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "rm -f /tmp/zebra* /tmp/index.html /tmp/*release*" + rlPhaseEnd +rlJournalEnd + From afff1ecfd46ae535a44a9037e8c6707b2e9e8b6c Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 17 Jan 2023 15:20:14 +0100 Subject: [PATCH 201/626] test if sepolicy manpage can generate all man pages A new test phase was added. Purpose of the test phase is to find out whether the `sepolicy manpage` command can generate man pages for all SELinux domains without triggering an error or traceback. The TC covers BZ#1416372. --- policycoreutils/sepolicy-manpage/main.fmf | 4 +++- policycoreutils/sepolicy-manpage/runtest.sh | 9 +++++++++ 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/policycoreutils/sepolicy-manpage/main.fmf b/policycoreutils/sepolicy-manpage/main.fmf index eae4499..380ea44 100644 --- a/policycoreutils/sepolicy-manpage/main.fmf +++ b/policycoreutils/sepolicy-manpage/main.fmf @@ -6,14 +6,16 @@ component: framework: beakerlib recommend: - /usr/bin/sepolicy -duration: 10m +duration: 20m enabled: true tier: 3 link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1416372 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1854639 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1989840 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6 because: the sepolicy command is not available there +extra-nitrate: TC#0614751 diff --git a/policycoreutils/sepolicy-manpage/runtest.sh b/policycoreutils/sepolicy-manpage/runtest.sh index 32c12a3..e6c1006 100755 --- a/policycoreutils/sepolicy-manpage/runtest.sh +++ b/policycoreutils/sepolicy-manpage/runtest.sh @@ -7,6 +7,15 @@ rlJournalStart rlRun "rpm -qa | grep policycoreutils" rlPhaseEnd + rlPhaseStartTest "bz#1416372" + rlRun -s "sepolicy manpage -a" + rlRun "grep -i -e invalid -e error -e traceback ${rlRun_LOG}" 1 + rm -f ${rlRun_LOG} + rlRun -s "sepolicy manpage -d crond_t" + rlRun "grep -i -e invalid -e error -e traceback ${rlRun_LOG}" 1 + rm -f ${rlRun_LOG} + rlPhaseEnd + rlPhaseStartTest "sepolicy manpage --web, bz#1854639 + bz#1989840" rlRun "sepolicy manpage --web -d zebra_t" if rlIsRHEL 7 8 ; then From 42c323c8e32bae2770b5c63e9958b0fbb2d10b55 Mon Sep 17 00:00:00 2001 From: Zdenek Pytela Date: Tue, 6 Dec 2022 17:00:44 +0100 Subject: [PATCH 202/626] selinux-policy: update systemd-notify test The systemd-notify binary was not expected to use as a separate service, but rather a helper to notify PID 1 about some particular service state. This includes user services. Calling sd_notify API is also supported from running services. --- .../systemd-notify-and-similar/runtest.sh | 53 +++++++++++++------ .../systemd-notify-and-similar/ssh.exp | 20 +++++++ 2 files changed, 57 insertions(+), 16 deletions(-) create mode 100755 selinux-policy/systemd-notify-and-similar/ssh.exp diff --git a/selinux-policy/systemd-notify-and-similar/runtest.sh b/selinux-policy/systemd-notify-and-similar/runtest.sh index 24d276f..a9a445a 100755 --- a/selinux-policy/systemd-notify-and-similar/runtest.sh +++ b/selinux-policy/systemd-notify-and-similar/runtest.sh @@ -31,6 +31,11 @@ PACKAGE="selinux-policy" SERVICE_PACKAGE="systemd" +#ALLOWED_USERS="guest_u xguest_u user_u staff_u sysadm_u unconfined_u" +ALLOWED_USERS="sysadm_u unconfined_u" +SYSTEMD_SYSTEM_SERVICE="/etc/systemd/system/local-notifier.service" +SYSTEMD_USER_SERVICE="/etc/systemd/user/local-notifier.service" +SYSTEMD_PAGER="" rlJournalStart rlLog "If this test fails, please contact mmalik on IRC #selinux" @@ -49,11 +54,12 @@ rlJournalStart rlPhaseEnd rlPhaseStartTest "bz#1903305" - rlSEMatchPathCon "/usr/bin/systemd-notify" "systemd_notify_exec_t" + if rlIsFedora ">36"; then + rlSEMatchPathCon "/usr/bin/systemd-notify" "bin_t" + else # Fedora up to 36 and RHEL + rlSEMatchPathCon "/usr/bin/systemd-notify" "systemd_notify_exec_t" + fi rlSESearchRule "allow init_t unconfined_t : fifo_file { write } [ ]" - rlSESearchRule "allow systemd_notify_t user_devpts_t : chr_file { read write append } [ ]" - rlSESearchRule "allow systemd_notify_t systemd_notify_t : capability { net_admin } [ ]" - rlSESearchRule "allow systemd_notify_t kernel_t : unix_dgram_socket { sendto } [ ]" rlPhaseEnd rlPhaseStartTest "real scenario -- bz#1903305" @@ -62,21 +68,36 @@ rlJournalStart rlRun "NOTIFY_SOCKET=/run/systemd/notify systemd-notify --ready" rlPhaseEnd - rlPhaseStartTest "real scenario -- runcon under root" - rlRun "NOTIFY_SOCKET=/run/systemd/notify runcon system_u:system_r:initrc_t:s0 bash -c 'systemd-notify --ready'" - sleep 1 - rlRun "NOTIFY_SOCKET=/run/systemd/notify runcon system_u:system_r:initrc_t:s0 bash -c 'systemd-notify --ready'" - rlPhaseEnd - - rlPhaseStartTest "real scenario -- unconfined service uses systemd-notify" + rlPhaseStartTest "real scenario -- unconfined or user services use systemd-notify" rlRun "cp -f notifier.sh /usr/local/bin/" - rlRun "cp -f local-notifier.service /usr/lib/systemd/system/" - rlRun "restorecon -v /usr/local/bin/notifier.sh /usr/lib/systemd/system/local-notifier.service" + rlRun "cp -f local-notifier.service /etc/systemd/system/" + rlRun "cp -f local-notifier.service /etc/systemd/user/" + rlRun "restorecon -v /usr/local/bin/notifier.sh ${SYSTEMD_SYSTEM_SERVICE} ${SYSTEMD_USER_SERVICE}" rlRun "systemctl daemon-reload" - rlRun "service local-notifier start" + # run the local-notifier service as a system service + rlRun "systemctl start local-notifier" sleep 2 - rlRun "service local-notifier status" - rlRun "rm -f /usr/lib/systemd/system/local-notifier.service /usr/local/bin/notifier.sh" + rlRun "systemctl status local-notifier" + # run the same service as a user service + rlRun "setsebool ssh_sysadm_login on" + CREATED_USERS="" + for SELINUX_USER in ${ALLOWED_USERS} ; do + USER_NAME="user${RANDOM}" + USER_SECRET="S3kr3t${RANDOM}" + rlRun "useradd -Z ${SELINUX_USER} ${USER_NAME}" + rlRun "echo ${USER_SECRET} | passwd --stdin ${USER_NAME}" + rlRun "restorecon -Rv /home/${USER_NAME}" + rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost systemctl --no-pager --user start local-notifier" + rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost systemctl --no-pager --user status local-notifier" + rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost journalctl --no-pager --user -u local-notifier" + CREATED_USERS="${USER_NAME} ${CREATED_USERS}" + done + rlRun "setsebool ssh_sysadm_login off" + for USER_NAME in ${CREATED_USERS} ; do + rlRun "userdel -rfZ ${USER_NAME}" + done + # cleanup + rlRun "rm -f /usr/local/bin/notifier.sh ${SYSTEMD_SYSTEM_SERVICE} ${SYSTEMD_USER_SERVICE}" rlRun "systemctl daemon-reload" rlPhaseEnd diff --git a/selinux-policy/systemd-notify-and-similar/ssh.exp b/selinux-policy/systemd-notify-and-similar/ssh.exp new file mode 100755 index 0000000..58c9647 --- /dev/null +++ b/selinux-policy/systemd-notify-and-similar/ssh.exp @@ -0,0 +1,20 @@ +#!/usr/bin/expect -f +# Expect script for SSH logging as $username to $hostname using $password and executing $command. +# Usage: +# ./ssh.exp username password hostname command +set username [lrange $argv 0 0] +set password [lrange $argv 1 1] +set hostname [lrange $argv 2 2] +set command [lrange $argv 3 10] +set timeout 15 +# connect to remote host and execute given command +log_user 1 +spawn ssh -t $username@$hostname $command +expect { + -nocase "yes/no" { send -- "yes\r" ; exp_continue } + -nocase "password" { send -- "$password\r" } +} +log_user 1 +# send -- "\r" +expect eof + From b719355a36eeebb74547bc7770d06974eca11392 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Wed, 18 Jan 2023 17:20:40 +0100 Subject: [PATCH 203/626] add the icecast test into upstream repo The existing icecast test is being moved from the downstream repository to the upstream repository. There are few changes in the test, for example: required packages, relevant architectures, supported distros. --- selinux-policy/icecast-and-similar/Makefile | 69 +++++++++++ selinux-policy/icecast-and-similar/PURPOSE | 5 + selinux-policy/icecast-and-similar/main.fmf | 44 +++++++ selinux-policy/icecast-and-similar/runtest.sh | 116 ++++++++++++++++++ 4 files changed, 234 insertions(+) create mode 100644 selinux-policy/icecast-and-similar/Makefile create mode 100644 selinux-policy/icecast-and-similar/PURPOSE create mode 100644 selinux-policy/icecast-and-similar/main.fmf create mode 100755 selinux-policy/icecast-and-similar/runtest.sh diff --git a/selinux-policy/icecast-and-similar/Makefile b/selinux-policy/icecast-and-similar/Makefile new file mode 100644 index 0000000..0f6b02f --- /dev/null +++ b/selinux-policy/icecast-and-similar/Makefile @@ -0,0 +1,69 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/icecast-and-similar +# Description: SELinux interferes with icecast and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/icecast-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with icecast and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console /usr/sbin/service icecast" >> $(METADATA) # EPEL + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL8 -RHEL9" >> $(METADATA) + @echo "Architectures: aarch64 ppc64le s390x x86_64" >> $(METADATA) + @echo "Bug: 894387" >> $(METADATA) # RHEL-6 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/icecast-and-similar/PURPOSE b/selinux-policy/icecast-and-similar/PURPOSE new file mode 100644 index 0000000..7a60dce --- /dev/null +++ b/selinux-policy/icecast-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/icecast-and-similar +Author: Milos Malik + +SELinux interferes with icecast and related programs. + diff --git a/selinux-policy/icecast-and-similar/main.fmf b/selinux-policy/icecast-and-similar/main.fmf new file mode 100644 index 0000000..10ba3e8 --- /dev/null +++ b/selinux-policy/icecast-and-similar/main.fmf @@ -0,0 +1,44 @@ +summary: SELinux interferes with icecast and related programs +description: |+ + SELinux interferes with icecast and related programs. + +contact: Milos Malik +component: + - selinux-policy +test: ./runtest.sh +framework: beakerlib +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - /usr/sbin/service + - icecast +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - TIPpass_Security + - TierCandidatesPASS + - f31friendly + - f32friendly + - targeted +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=894387 +adjust: + - enabled: false + when: arch == i386, ppc, ppc64, s390 + continue: false + - enabled: false + when: distro == rhel-4, rhel-8, rhel-9 + continue: false +extra-nitrate: TC#0388472 +extra-summary: /CoreOS/selinux-policy/Regression/icecast-and-similar +extra-task: /CoreOS/selinux-policy/Regression/icecast-and-similar diff --git a/selinux-policy/icecast-and-similar/runtest.sh b/selinux-policy/icecast-and-similar/runtest.sh new file mode 100755 index 0000000..9d1e93e --- /dev/null +++ b/selinux-policy/icecast-and-similar/runtest.sh @@ -0,0 +1,116 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/icecast-and-similar +# Description: SELinux interferes with icecast and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +ROOT_PASSWORD="redhat" +FILE_PATH="/usr/bin/icecast" +FILE_CONTEXT="icecast_exec_t" +SERVICE_PACKAGE="icecast" +SERVICE_NAME="icecast" +PROCESS_NAME="icecast" +PROCESS_CONTEXT="icecast_t" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} + rlFileBackup /etc/icecast.xml + + rlRun "setenforce 1" + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + if ! rlIsRHEL 5 ; then + rlPhaseStartTest "SELinux contexts and rules" + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + if rlIsRHEL 5 ; then + SOURCE_TYPE="initrc_t" + BOOLEANS="[ ]" + elif rlIsRHEL 6 ; then + SOURCE_TYPE="initrc_t" + else # RHEL-7 etc. + SOURCE_TYPE="init_t" # systemd runs the process + fi + rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" + rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" + rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" + rlPhaseEnd + + rlPhaseStartTest "bz#894387" + rlSEMatchPathCon "/usr/bin/icecast" "icecast_exec_t" + rlSEMatchPortCon tcp 8080 http_cache_port_t + rlSESearchRule "allow icecast_t http_cache_port_t : tcp_socket { name_bind } [ icecast_use_any_tcp_ports ]" + if rlIsRHEL 6 ; then + rlSESearchRule "dontaudit icecast_t tmp_t : dir { read }" + fi + rlPhaseEnd + fi + + rlPhaseStartTest "real scenario -- bz#894387" + if rlIsRHEL 5 6 ; then + rlRun "setsebool icecast_connect_any on" + else + rlRun "setsebool icecast_use_any_tcp_ports on" + fi + rlRun "sed -i \"s|8000|8080|\" /etc/icecast.xml" + rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + if rlIsRHEL 5 6 ; then + PROCESS_CONTEXT="initrc_t" + else + PROCESS_CONTEXT="unconfined_service_t" + fi + fi + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status restart status stop status" 1 + if rlIsRHEL 5 6 ; then + rlRun "setsebool icecast_connect_any off" + else + rlRun "setsebool icecast_use_any_tcp_ports off" + fi + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + From 1bf5991b55797dcc6abc9097b5aa125a2c9b1343 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Wed, 18 Jan 2023 18:16:45 +0100 Subject: [PATCH 204/626] test if icecast can rotate its log files When the icecast service is running for a long time, its log files become large enough so that they will be rotated. Unfortunately, SELinux prevents the rename of old log files. The TC reproduces the situation. In order to support the functionality of `logsize` and `logarchive` options, I believe that SELinux policy should allow the actions. The TC looks for appropriate policy rules and file context patterns. The TC covers BZ#2156763. --- selinux-policy/icecast-and-similar/Makefile | 1 + selinux-policy/icecast-and-similar/main.fmf | 1 + selinux-policy/icecast-and-similar/runtest.sh | 15 ++++++++++++++- 3 files changed, 16 insertions(+), 1 deletion(-) diff --git a/selinux-policy/icecast-and-similar/Makefile b/selinux-policy/icecast-and-similar/Makefile index 0f6b02f..51ccee4 100644 --- a/selinux-policy/icecast-and-similar/Makefile +++ b/selinux-policy/icecast-and-similar/Makefile @@ -64,6 +64,7 @@ $(METADATA): Makefile @echo "Releases: -RHEL4 -RHEL8 -RHEL9" >> $(METADATA) @echo "Architectures: aarch64 ppc64le s390x x86_64" >> $(METADATA) @echo "Bug: 894387" >> $(METADATA) # RHEL-6 + @echo "Bug: 2156763" >> $(METADATA) # Fedora 36 rhts-lint $(METADATA) diff --git a/selinux-policy/icecast-and-similar/main.fmf b/selinux-policy/icecast-and-similar/main.fmf index 10ba3e8..497bea9 100644 --- a/selinux-policy/icecast-and-similar/main.fmf +++ b/selinux-policy/icecast-and-similar/main.fmf @@ -32,6 +32,7 @@ tag: - targeted link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=894387 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2156763 adjust: - enabled: false when: arch == i386, ppc, ppc64, s390 diff --git a/selinux-policy/icecast-and-similar/runtest.sh b/selinux-policy/icecast-and-similar/runtest.sh index 9d1e93e..62f7de7 100755 --- a/selinux-policy/icecast-and-similar/runtest.sh +++ b/selinux-policy/icecast-and-similar/runtest.sh @@ -79,6 +79,14 @@ rlJournalStart rlSESearchRule "dontaudit icecast_t tmp_t : dir { read }" fi rlPhaseEnd + + rlPhaseStartTest "bz#2156763" + rlSEMatchPathCon "/usr/bin/icecast" "icecast_exec_t" + rlSEMatchPathCon "/var/log/icecast" "icecast_log_t" + rlSEMatchPathCon "/var/log/icecast/error.log" "icecast_log_t" + rlSESearchRule "allow icecast_t icecast_log_t : dir { remove_name } [ ]" + rlSESearchRule "allow icecast_t icecast_log_t : file { rename } [ ]" + rlPhaseEnd fi rlPhaseStartTest "real scenario -- bz#894387" @@ -96,7 +104,12 @@ rlJournalStart PROCESS_CONTEXT="unconfined_service_t" fi fi - rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status restart status stop status" 1 + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "sed -i 's|^\(.*logsize>\).*\(\).*$|\1|' /etc/icecast.xml" + rlRun "grep logarchive /etc/icecast.xml" + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 if rlIsRHEL 5 6 ; then rlRun "setsebool icecast_connect_any off" else From e0866a22fe73ff1c361b88d4bad6f2caa84b913b Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Fri, 20 Jan 2023 15:46:44 +0100 Subject: [PATCH 205/626] fix the failing tests Not all packages required by the tests were installed. The issue should be fixed now. Relevancy of certain tests was set incorrectly. The issue should be fixed now. At least 1 test runs longer than its specified duration. The issue should be fixed now. --- .../python-module-precedence-issue/main.fmf | 2 +- policycoreutils/sepolicy-manpage/main.fmf | 2 +- selinux-policy/Library/common/lib.sh | 0 selinux-policy/hostapd-and-similar/runtest.sh | 3 ++- selinux-policy/kernel-confined-exec/main.fmf | 11 ++++++----- selinux-policy/ladvd/main.fmf | 5 +++++ selinux-policy/nasd-and-similar/Makefile | 4 ++-- selinux-policy/nasd-and-similar/main.fmf | 6 ++++++ selinux-policy/nasd-and-similar/runtest.sh | 2 +- selinux-policy/rpmdb-and-similar/runtest.sh | 4 +--- selinux-policy/systemd-homed/main.fmf | 5 +++++ selinux-policy/systemd-notify-and-similar/Makefile | 2 +- selinux-policy/systemd-notify-and-similar/main.fmf | 1 + selinux-policy/systemd-notify-and-similar/runtest.sh | 4 ++-- 14 files changed, 34 insertions(+), 17 deletions(-) mode change 100644 => 100755 selinux-policy/Library/common/lib.sh diff --git a/policycoreutils/python-module-precedence-issue/main.fmf b/policycoreutils/python-module-precedence-issue/main.fmf index 48568bc..2dc5935 100644 --- a/policycoreutils/python-module-precedence-issue/main.fmf +++ b/policycoreutils/python-module-precedence-issue/main.fmf @@ -1,7 +1,6 @@ summary: Harden tools to avoid loading of unchecked python modules. description: Tools like semanage must be hardened to avoid loading rogue python modules that could lead to unexpected failures. contact: Amith Kumar - component: - policycoreutils test: ./runtest.sh @@ -27,3 +26,4 @@ adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6 continue: false +extra-nitrate: TC#0614726 diff --git a/policycoreutils/sepolicy-manpage/main.fmf b/policycoreutils/sepolicy-manpage/main.fmf index 380ea44..a342f92 100644 --- a/policycoreutils/sepolicy-manpage/main.fmf +++ b/policycoreutils/sepolicy-manpage/main.fmf @@ -6,7 +6,7 @@ component: framework: beakerlib recommend: - /usr/bin/sepolicy -duration: 20m +duration: 1h enabled: true tier: 3 link: diff --git a/selinux-policy/Library/common/lib.sh b/selinux-policy/Library/common/lib.sh old mode 100644 new mode 100755 diff --git a/selinux-policy/hostapd-and-similar/runtest.sh b/selinux-policy/hostapd-and-similar/runtest.sh index c2323e0..9947d64 100755 --- a/selinux-policy/hostapd-and-similar/runtest.sh +++ b/selinux-policy/hostapd-and-similar/runtest.sh @@ -47,6 +47,7 @@ rlJournalStart rlAssertRpm ${SERVICE_PACKAGE} rlRun "rpm -qa kernel\*" rlRun "uname -a" + rlRun "yum -y install kernel-modules-internal-`uname -r` --enablerepo '*'" rlServiceStop ${SERVICE_NAME} rlFileBackup /etc/shadow rlFileBackup /etc/hostapd/hostapd.conf @@ -111,7 +112,7 @@ rlJournalStart PROCESS_CONTEXT="unconfined_service_t" fi rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /run /var" + rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 rlRun "hostapd_cli all_sta" rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd diff --git a/selinux-policy/kernel-confined-exec/main.fmf b/selinux-policy/kernel-confined-exec/main.fmf index 17584b2..33ab76f 100644 --- a/selinux-policy/kernel-confined-exec/main.fmf +++ b/selinux-policy/kernel-confined-exec/main.fmf @@ -1,9 +1,9 @@ summary: Test that kernel cannot execute arbitrary helper binaries description: | - Ensures that the kernel is not allowed to execute unauthorized binaries - and that a transition to a confined domain is enforced on those that it - can execute, so that overwriting usermode helper paths doesn't lead to - an exploitable privilege escalation. + Ensures that the kernel is not allowed to execute unauthorized binaries + and that a transition to a confined domain is enforced on those that it + can execute, so that overwriting usermode helper paths doesn't lead to + an exploitable privilege escalation. contact: Ondrej Mosnacek component: - selinux-policy @@ -13,7 +13,7 @@ require: - policycoreutils - gcc environment: - AVC_ERROR: +no_avc_check + AVC_ERROR: +no_avc_check duration: 20m tier: 2 enabled: true @@ -23,3 +23,4 @@ adjust: because: This hardening applies only to F38+ link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2068579 +extra-nitrate: TC#0614676 diff --git a/selinux-policy/ladvd/main.fmf b/selinux-policy/ladvd/main.fmf index 7fae35a..ad60ea2 100644 --- a/selinux-policy/ladvd/main.fmf +++ b/selinux-policy/ladvd/main.fmf @@ -26,5 +26,10 @@ duration: 1h link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1834325 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1855163 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, rhel-9 + because: the ladvd package is not available there extra-summary: /CoreOS/selinux-policy/Regression/ladvd extra-task: /CoreOS/selinux-policy/Regression/ladvd +extra-nitrate: TC#0614606 diff --git a/selinux-policy/nasd-and-similar/Makefile b/selinux-policy/nasd-and-similar/Makefile index ed1c757..3d9f93c 100644 --- a/selinux-policy/nasd-and-similar/Makefile +++ b/selinux-policy/nasd-and-similar/Makefile @@ -55,14 +55,14 @@ $(METADATA): Makefile @echo "TestTime: 10m" >> $(METADATA) @echo "RunFor: nas" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console nas /usr/sbin/service" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console nas /usr/sbin/service perl-Perl4-CoreLibs" >> $(METADATA) @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @echo "License: GPLv2" >> $(METADATA) @echo "Confidential: no" >> $(METADATA) @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA) rhts-lint $(METADATA) diff --git a/selinux-policy/nasd-and-similar/main.fmf b/selinux-policy/nasd-and-similar/main.fmf index cd0bc98..859c0af 100644 --- a/selinux-policy/nasd-and-similar/main.fmf +++ b/selinux-policy/nasd-and-similar/main.fmf @@ -16,9 +16,15 @@ recommend: - selinux-policy-targeted - setools-console - nas + - perl-Perl4-CoreLibs - /usr/sbin/service environment: AVC_ERROR: +no_avc_check duration: 10m +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 + because: the nas package is not available there extra-summary: /CoreOS/selinux-policy/Regression/nasd-and-similar extra-task: /CoreOS/selinux-policy/Regression/nasd-and-similar +extra-nitrate: TC#0614607 diff --git a/selinux-policy/nasd-and-similar/runtest.sh b/selinux-policy/nasd-and-similar/runtest.sh index b6f8c17..0e0a784 100755 --- a/selinux-policy/nasd-and-similar/runtest.sh +++ b/selinux-policy/nasd-and-similar/runtest.sh @@ -89,7 +89,7 @@ rlJournalStart rlRun "modprobe snd_pcm_oss" rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 rlRun "ls -lZ /dev/dsp*" - rlRun "restorecon -Rv /run /var" 0-255 + rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd diff --git a/selinux-policy/rpmdb-and-similar/runtest.sh b/selinux-policy/rpmdb-and-similar/runtest.sh index 5fa96e0..18919be 100755 --- a/selinux-policy/rpmdb-and-similar/runtest.sh +++ b/selinux-policy/rpmdb-and-similar/runtest.sh @@ -70,13 +70,12 @@ rlJournalStart rlPhaseStartTest "real scenario -- standalone service" rlRun "touch /var/lib/rpm/.rebuilddb" rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} - ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /run /var" + rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 rlRun "touch /var/lib/rpm/.rebuilddb" rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} - ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd rlPhaseStartTest "rpmdb executed by root/unconfined_t" - rlRun "semodule -DB" rlRun "restorecon -Rv /var/lib/rpm" rlRun "ls -Z `which rpmdb`" rlRun "rpmdb --help" @@ -89,7 +88,6 @@ rlJournalStart rlRun "ls -dZ /var/lib/rpm | grep :rpm_var_lib_t" rlRun "ls -Z /var/lib/rpm" rm -f ${OUTPUT_FILE} - rlRun "semodule -B" rlPhaseEnd rlPhaseStartCleanup diff --git a/selinux-policy/systemd-homed/main.fmf b/selinux-policy/systemd-homed/main.fmf index d74f466..3af3331 100644 --- a/selinux-policy/systemd-homed/main.fmf +++ b/selinux-policy/systemd-homed/main.fmf @@ -20,5 +20,10 @@ environment: duration: 1h link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1809878 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, rhel-9 + because: the systemd-homed program is not available there extra-summary: /CoreOS/selinux-policy/Regression/systemd-homed extra-task: /CoreOS/selinux-policy/Regression/systemd-homed +extra-nitrate: TC#0614608 diff --git a/selinux-policy/systemd-notify-and-similar/Makefile b/selinux-policy/systemd-notify-and-similar/Makefile index d355f29..2e2d3d3 100644 --- a/selinux-policy/systemd-notify-and-similar/Makefile +++ b/selinux-policy/systemd-notify-and-similar/Makefile @@ -54,7 +54,7 @@ $(METADATA): Makefile @echo "Type: Regression" >> $(METADATA) @echo "TestTime: 10m" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console systemd /usr/sbin/service" >> $(METADATA) + @echo "Requires: audit expect libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console systemd /usr/sbin/service" >> $(METADATA) @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) diff --git a/selinux-policy/systemd-notify-and-similar/main.fmf b/selinux-policy/systemd-notify-and-similar/main.fmf index 7474823..c587e53 100644 --- a/selinux-policy/systemd-notify-and-similar/main.fmf +++ b/selinux-policy/systemd-notify-and-similar/main.fmf @@ -11,6 +11,7 @@ require: - library(selinux-policy/common) recommend: - audit + - expect - libselinux - libselinux-utils - policycoreutils diff --git a/selinux-policy/systemd-notify-and-similar/runtest.sh b/selinux-policy/systemd-notify-and-similar/runtest.sh index a9a445a..a0dde3d 100755 --- a/selinux-policy/systemd-notify-and-similar/runtest.sh +++ b/selinux-policy/systemd-notify-and-similar/runtest.sh @@ -54,7 +54,7 @@ rlJournalStart rlPhaseEnd rlPhaseStartTest "bz#1903305" - if rlIsFedora ">36"; then + if rlIsFedora "<35"; then rlSEMatchPathCon "/usr/bin/systemd-notify" "bin_t" else # Fedora up to 36 and RHEL rlSEMatchPathCon "/usr/bin/systemd-notify" "systemd_notify_exec_t" @@ -77,7 +77,7 @@ rlJournalStart # run the local-notifier service as a system service rlRun "systemctl start local-notifier" sleep 2 - rlRun "systemctl status local-notifier" + rlRun "systemctl status local-notifier" 3 # run the same service as a user service rlRun "setsebool ssh_sysadm_login on" CREATED_USERS="" From d7ee07804b8803510c4bb2f8e2efc56247e8768e Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Mon, 23 Jan 2023 15:55:29 +0100 Subject: [PATCH 206/626] exclude the /var/ARTIFACTS when running restorecon A lot of running services create various FS objects under the /var or the /run directories. These objects may get SELinux labels which are different than what file context database specifies. To reveal such discrepancies, many automated tests run the "restorecon -Rv /run /var" command. Unfortunately, the command affects SELinux contexts of files and directories stored under /var/ARTIFACTS/. For example: the rlFileBackup function uses this location as storage. To avoid unpleasant effects of the restorecon command on anything stored under /var/ARTIFACTS, the restorecon command intentionally excluded that directory. --- selinux-policy/accounts-daemon-and-similar/runtest.sh | 2 +- selinux-policy/bgpd-and-similar/runtest.sh | 2 +- selinux-policy/bz624405-pcsc-and-similar/runtest.sh | 2 +- selinux-policy/caddy-and-similar/runtest.sh | 2 +- selinux-policy/cups-browsed-and-similar/runtest.sh | 2 +- selinux-policy/fapolicyd-and-similar/runtest.sh | 2 +- selinux-policy/ksm-and-similar/runtest.sh | 2 +- selinux-policy/nfsdcld-and-similar/runtest.sh | 2 +- selinux-policy/numad-and-similar/runtest.sh | 2 +- selinux-policy/rngd-and-similar/runtest.sh | 2 +- selinux-policy/rrdcached-service-and-related/runtest.sh | 2 +- selinux-policy/rtkit-daemon-and-similar/runtest.sh | 2 +- selinux-policy/stalld-and-similar/runtest.sh | 2 +- selinux-policy/systemd-bootchart-and-similar/runtest.sh | 2 +- selinux-policy/systemd-modules-load-and-similar/runtest.sh | 2 +- selinux-policy/systemd-sysctl-and-similar/runtest.sh | 2 +- selinux-policy/systemd-timesyncd-and-similar/runtest.sh | 2 +- selinux-policy/systemd-userdbd-and-similar/runtest.sh | 2 +- selinux-policy/usbguard-daemon-and-similar/runtest.sh | 2 +- 19 files changed, 19 insertions(+), 19 deletions(-) diff --git a/selinux-policy/accounts-daemon-and-similar/runtest.sh b/selinux-policy/accounts-daemon-and-similar/runtest.sh index 40839e9..38ea62c 100755 --- a/selinux-policy/accounts-daemon-and-similar/runtest.sh +++ b/selinux-policy/accounts-daemon-and-similar/runtest.sh @@ -140,7 +140,7 @@ rlJournalStart rlRun "restorecon -Rv /etc" rlRun "service realmd start" # helps to reproduce BZ#1792895 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /run /var" 0-255 + rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd diff --git a/selinux-policy/bgpd-and-similar/runtest.sh b/selinux-policy/bgpd-and-similar/runtest.sh index 7acd85e..6dd2698 100755 --- a/selinux-policy/bgpd-and-similar/runtest.sh +++ b/selinux-policy/bgpd-and-similar/runtest.sh @@ -80,7 +80,7 @@ rlJournalStart rlPhaseStartTest "real scenario -- standalone service" rlRun "sed -i 's/^\(include.*\)$/# \1/' /etc/bgpd.conf" rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /run /var" 0-255 + rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd diff --git a/selinux-policy/bz624405-pcsc-and-similar/runtest.sh b/selinux-policy/bz624405-pcsc-and-similar/runtest.sh index 5a2838f..29d27e5 100755 --- a/selinux-policy/bz624405-pcsc-and-similar/runtest.sh +++ b/selinux-policy/bz624405-pcsc-and-similar/runtest.sh @@ -101,7 +101,7 @@ rlJournalStart fi fi rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /run /var" 0-255 + rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd diff --git a/selinux-policy/caddy-and-similar/runtest.sh b/selinux-policy/caddy-and-similar/runtest.sh index 7cf9384..69ff27c 100755 --- a/selinux-policy/caddy-and-similar/runtest.sh +++ b/selinux-policy/caddy-and-similar/runtest.sh @@ -72,7 +72,7 @@ rlJournalStart rlRun "semanage fcontext -l -C | grep caddy" for SERVICE_NAME in caddy caddy-api ; do rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /run /var" 0-255 + rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 done rlPhaseEnd diff --git a/selinux-policy/cups-browsed-and-similar/runtest.sh b/selinux-policy/cups-browsed-and-similar/runtest.sh index 3b7c056..3db7b5c 100755 --- a/selinux-policy/cups-browsed-and-similar/runtest.sh +++ b/selinux-policy/cups-browsed-and-similar/runtest.sh @@ -80,7 +80,7 @@ rlJournalStart fi fi rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /run /var" + rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd diff --git a/selinux-policy/fapolicyd-and-similar/runtest.sh b/selinux-policy/fapolicyd-and-similar/runtest.sh index 49ccb65..1d532eb 100755 --- a/selinux-policy/fapolicyd-and-similar/runtest.sh +++ b/selinux-policy/fapolicyd-and-similar/runtest.sh @@ -109,7 +109,7 @@ rlJournalStart PROCESS_CONTEXT="unconfined_service_t" fi rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /run /var" + rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd diff --git a/selinux-policy/ksm-and-similar/runtest.sh b/selinux-policy/ksm-and-similar/runtest.sh index 21d276f..2d26a1f 100755 --- a/selinux-policy/ksm-and-similar/runtest.sh +++ b/selinux-policy/ksm-and-similar/runtest.sh @@ -86,7 +86,7 @@ rlJournalStart rlRun "sed -i 's/^ConditionVirtualization=.*$//' /usr/lib/systemd/system/ksm.service" rlRun "systemctl daemon-reload" rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /etc /run /var" 0-255 + rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd diff --git a/selinux-policy/nfsdcld-and-similar/runtest.sh b/selinux-policy/nfsdcld-and-similar/runtest.sh index bf4b321..a97e694 100755 --- a/selinux-policy/nfsdcld-and-similar/runtest.sh +++ b/selinux-policy/nfsdcld-and-similar/runtest.sh @@ -69,7 +69,7 @@ rlJournalStart PROCESS_CONTEXT="unconfined_service_t" fi rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /run /var" + rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd diff --git a/selinux-policy/numad-and-similar/runtest.sh b/selinux-policy/numad-and-similar/runtest.sh index 3d2efe1..27d5b96 100755 --- a/selinux-policy/numad-and-similar/runtest.sh +++ b/selinux-policy/numad-and-similar/runtest.sh @@ -108,7 +108,7 @@ rlJournalStart rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 rlRun "numad -S 0" rlRun "numad -S 1" - rlRun "restorecon -Rv /run /var" + rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd diff --git a/selinux-policy/rngd-and-similar/runtest.sh b/selinux-policy/rngd-and-similar/runtest.sh index 9007917..4401f0d 100755 --- a/selinux-policy/rngd-and-similar/runtest.sh +++ b/selinux-policy/rngd-and-similar/runtest.sh @@ -169,7 +169,7 @@ rlJournalStart rlRun "setsebool daemons_use_tty on" rlRun "runcon system_u:system_r:initrc_t:s0 bash -c 'rngd -l'" 0-255 rlRun "setsebool daemons_use_tty off" - rlRun "restorecon -Rv /run /var" 0-255 + rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status" 1 if ${DROP_PRIV} ; then rlLog "modifying the /etc/sysconfig/rngd file" diff --git a/selinux-policy/rrdcached-service-and-related/runtest.sh b/selinux-policy/rrdcached-service-and-related/runtest.sh index d26e456..bd201e4 100755 --- a/selinux-policy/rrdcached-service-and-related/runtest.sh +++ b/selinux-policy/rrdcached-service-and-related/runtest.sh @@ -86,7 +86,7 @@ rlJournalStart rlPhaseStartTest "real scenario" rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 2 - rlRun "restorecon -Rv /run /var" + rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 2 rlPhaseEnd diff --git a/selinux-policy/rtkit-daemon-and-similar/runtest.sh b/selinux-policy/rtkit-daemon-and-similar/runtest.sh index f7e2613..6cf0153 100755 --- a/selinux-policy/rtkit-daemon-and-similar/runtest.sh +++ b/selinux-policy/rtkit-daemon-and-similar/runtest.sh @@ -108,7 +108,7 @@ rlJournalStart fi fi rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /run /var" + rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd fi diff --git a/selinux-policy/stalld-and-similar/runtest.sh b/selinux-policy/stalld-and-similar/runtest.sh index 909a0b5..90f86ef 100755 --- a/selinux-policy/stalld-and-similar/runtest.sh +++ b/selinux-policy/stalld-and-similar/runtest.sh @@ -108,7 +108,7 @@ rlJournalStart rlRun "journalctl -u ${SERVICE_NAME} > after.txt" rlRun "setsebool domain_can_write_kmsg on" rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status" 1 - rlRun "restorecon -Rv /run /var" 0-255 + rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "stop status" 1 rlRun "setsebool domain_can_write_kmsg off" rlRun "diff before.txt after.txt | grep -i -e 'operation not permitted' -e 'permission denied'" 1 diff --git a/selinux-policy/systemd-bootchart-and-similar/runtest.sh b/selinux-policy/systemd-bootchart-and-similar/runtest.sh index c8bbacd..362b6a2 100755 --- a/selinux-policy/systemd-bootchart-and-similar/runtest.sh +++ b/selinux-policy/systemd-bootchart-and-similar/runtest.sh @@ -81,7 +81,7 @@ rlJournalStart PROCESS_CONTEXT="unconfined_service_t" fi rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /run /var" 0-255 + rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd diff --git a/selinux-policy/systemd-modules-load-and-similar/runtest.sh b/selinux-policy/systemd-modules-load-and-similar/runtest.sh index 0e951c8..920c3e0 100755 --- a/selinux-policy/systemd-modules-load-and-similar/runtest.sh +++ b/selinux-policy/systemd-modules-load-and-similar/runtest.sh @@ -110,7 +110,7 @@ rlJournalStart rlRun "lsmod" rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} - ${PROCESS_CONTEXT} "start status" 1 rlRun "lsmod | grep ${KERNEL_MODULE}" - rlRun "restorecon -Rv /run /var" 0-255 + rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} - ${PROCESS_CONTEXT} "stop status" 1 rlRun "lsmod" rlRun "rm -f /etc/modules-load.d/${KERNEL_MODULE}.conf" diff --git a/selinux-policy/systemd-sysctl-and-similar/runtest.sh b/selinux-policy/systemd-sysctl-and-similar/runtest.sh index d7f0d06..f7ad2d3 100755 --- a/selinux-policy/systemd-sysctl-and-similar/runtest.sh +++ b/selinux-policy/systemd-sysctl-and-similar/runtest.sh @@ -63,7 +63,7 @@ rlJournalStart rlPhaseStartTest "real scenario" rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /run /var" 0-255 + rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd diff --git a/selinux-policy/systemd-timesyncd-and-similar/runtest.sh b/selinux-policy/systemd-timesyncd-and-similar/runtest.sh index 886546a..37f186c 100755 --- a/selinux-policy/systemd-timesyncd-and-similar/runtest.sh +++ b/selinux-policy/systemd-timesyncd-and-similar/runtest.sh @@ -118,7 +118,7 @@ rlJournalStart PROCESS_CONTEXT="unconfined_service_t" fi rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /run /var" 0-255 + rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd fi diff --git a/selinux-policy/systemd-userdbd-and-similar/runtest.sh b/selinux-policy/systemd-userdbd-and-similar/runtest.sh index 38bf5c6..f7cf06f 100755 --- a/selinux-policy/systemd-userdbd-and-similar/runtest.sh +++ b/selinux-policy/systemd-userdbd-and-similar/runtest.sh @@ -107,7 +107,7 @@ rlJournalStart PROCESS_CONTEXT="unconfined_service_t" fi rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /run /var" 0-255 + rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd diff --git a/selinux-policy/usbguard-daemon-and-similar/runtest.sh b/selinux-policy/usbguard-daemon-and-similar/runtest.sh index a23c68f..6c00b0c 100755 --- a/selinux-policy/usbguard-daemon-and-similar/runtest.sh +++ b/selinux-policy/usbguard-daemon-and-similar/runtest.sh @@ -85,7 +85,7 @@ rlJournalStart PROCESS_CONTEXT="unconfined_service_t" fi rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /run /var" + rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd From a79a74c223d53af181565d9937829ca8d58d73d6 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Thu, 26 Jan 2023 10:41:24 +0100 Subject: [PATCH 207/626] do not use ramfs_t for /dev/shm/.#cred* files The TC needs to adapt to changes introduced by the following commit: https://github.com/fedora-selinux/selinux-policy/commit/8e908b8d98cbaf8e5df3aadad28b654b6e50c1da --- selinux-policy/systemd-creds/main.fmf | 1 + selinux-policy/systemd-creds/runtest.sh | 4 ++-- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/selinux-policy/systemd-creds/main.fmf b/selinux-policy/systemd-creds/main.fmf index 11d0693..65b74a2 100644 --- a/selinux-policy/systemd-creds/main.fmf +++ b/selinux-policy/systemd-creds/main.fmf @@ -23,6 +23,7 @@ enabled: true tag: - Tier2 - Tier2se + - targeted tier: '2' adjust: - enabled: false diff --git a/selinux-policy/systemd-creds/runtest.sh b/selinux-policy/systemd-creds/runtest.sh index 643f9df..212b1a5 100755 --- a/selinux-policy/systemd-creds/runtest.sh +++ b/selinux-policy/systemd-creds/runtest.sh @@ -51,8 +51,8 @@ rlJournalStart rlPhaseStartTest "bz#2096857 + bz#2097681" rlSEMatchPathCon "/usr/bin/systemd-creds" "bin_t" - rlRun "seinfo --genfscon | grep :ramfs_t" - rlSESearchRule "allow init_t ramfs_t : file { read write open setattr rename create } [ ]" + rlSEMatchPathCon "/dev/shm" "tmpfs_t" + rlSESearchRule "allow init_t tmpfs_t : file { read write open setattr rename create } [ ]" rlPhaseEnd rlPhaseStartTest "a systemd service loading credentials" From ca2936720a77621e477b7223fb4efc3cf433097f Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Thu, 26 Jan 2023 10:30:15 +0100 Subject: [PATCH 208/626] kernel-confined-exec: refine policy expectations Don't be strict about the 'execute' permission and instead check for [the lack of] transitions. Also drop entrypoint checking as it's not really relevant. Signed-off-by: Ondrej Mosnacek --- selinux-policy/kernel-confined-exec/runtest.sh | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/selinux-policy/kernel-confined-exec/runtest.sh b/selinux-policy/kernel-confined-exec/runtest.sh index 35f0b58..1f59a75 100755 --- a/selinux-policy/kernel-confined-exec/runtest.sh +++ b/selinux-policy/kernel-confined-exec/runtest.sh @@ -39,12 +39,16 @@ rlJournalStart rlPhaseStartTest "Policy rules" rlLog "kernel_t shouldn't be allowed to execute any file without transition" + # Only check execute_no_trans and a couple of unexpected type + # transitions. Plain 'execute' has to be allowed broadly due to + # overlayfs mounter checks. (Think overlayfs mounted before policy + # is loaded.) rlSESearchRule "allow kernel_t file_type:file { execute_no_trans } []" 1 \ "kernel_t shouldn't be allowed to execute any file without transition" - rlSESearchRule "allow kernel_t user_home_t:file { execute entrypoint }" 1 \ - "kernel_t shouldn't be allowed to execute files in user home directories" - rlSESearchRule "allow kernel_t user_tmp_t:file { execute entrypoint }" 1 \ - "kernel_t shouldn't be allowed to execute user temporary files" + rlSESearchRule "type_transition kernel_t user_home_t:process domain;" 1 \ + "kernel_t shouldn't have any transition defined over files in user home directories" + rlSESearchRule "type_transition kernel_t user_tmp_t:process domain;" 1 \ + "kernel_t shouldn't have any transition defined over user temporary files" rlPhaseEnd rlPhaseStartTest "Legit modprobe" From 9b3bfcded4184e718aadd00c9decdc55858d3cfb Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Thu, 26 Jan 2023 11:04:12 +0100 Subject: [PATCH 209/626] enable the systemd-homed service before using it The systemd-homed service is disabled by default. If the TC should succeed, the service needs to be enabled. --- selinux-policy/systemd-homed/runtest.sh | 2 ++ 1 file changed, 2 insertions(+) diff --git a/selinux-policy/systemd-homed/runtest.sh b/selinux-policy/systemd-homed/runtest.sh index d95a340..5534668 100755 --- a/selinux-policy/systemd-homed/runtest.sh +++ b/selinux-policy/systemd-homed/runtest.sh @@ -125,6 +125,7 @@ rlJournalStart rlSEStatus rlSESetTimestamp sleep 2 + rlRun "systemctl enable systemd-homed" rlPhaseEnd rlPhaseStartTest "homectl create" @@ -216,6 +217,7 @@ rlJournalStart rlPhaseEnd rlPhaseStartCleanup + rlRun "systemctl disable systemd-homed" sleep 2 rlSECheckAVC rlRun "rm -f /tmp/avcfile" From 3e70b4f33b2ca0d7975d143910a2feb16fc59226 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Wed, 1 Feb 2023 08:55:12 +0100 Subject: [PATCH 210/626] test if rpmdb-migrate service works successfully The upgrade procedure from Fedora 36 to Fedora 37 revealed that SELinux prevents the rpmdb-migrate service from executing the bash, rpm and rm programs. The TC reproduces the situation without performing the upgrade. In order to support the functionality of the rpmdb-migrate service, I believe that SELinux policy should allow these actions. The TC looks for appropriate policy rules and file context patterns. The TC covers BZ#2164752. --- selinux-policy/rpmdb-and-similar/Makefile | 3 ++- selinux-policy/rpmdb-and-similar/main.fmf | 3 ++- selinux-policy/rpmdb-and-similar/runtest.sh | 24 ++++++++++++++++++--- 3 files changed, 25 insertions(+), 5 deletions(-) diff --git a/selinux-policy/rpmdb-and-similar/Makefile b/selinux-policy/rpmdb-and-similar/Makefile index e26c29e..89d9191 100644 --- a/selinux-policy/rpmdb-and-similar/Makefile +++ b/selinux-policy/rpmdb-and-similar/Makefile @@ -54,7 +54,7 @@ $(METADATA): Makefile @echo "Type: Regression" >> $(METADATA) @echo "TestTime: 10m" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console initscripts sssd" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console /usr/sbin/service sssd" >> $(METADATA) @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @@ -65,6 +65,7 @@ $(METADATA): Makefile @echo "Bug: 1461313" >> $(METADATA) # Fedora 32 @echo "Bug: 1899548" >> $(METADATA) # Fedora 33 @echo "Bug: 2023163" >> $(METADATA) # Fedora 35 + @echo "Bug: 2164752" >> $(METADATA) # Fedora 37 rhts-lint $(METADATA) diff --git a/selinux-policy/rpmdb-and-similar/main.fmf b/selinux-policy/rpmdb-and-similar/main.fmf index 1adc4e3..713ea2d 100644 --- a/selinux-policy/rpmdb-and-similar/main.fmf +++ b/selinux-policy/rpmdb-and-similar/main.fmf @@ -16,7 +16,7 @@ recommend: - selinux-policy - selinux-policy-targeted - setools-console - - initscripts + - /usr/sbin/service - sssd environment: AVC_ERROR: +no_avc_check @@ -32,6 +32,7 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1461313 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1899548 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2023163 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2164752 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 diff --git a/selinux-policy/rpmdb-and-similar/runtest.sh b/selinux-policy/rpmdb-and-similar/runtest.sh index 18919be..b026c92 100755 --- a/selinux-policy/rpmdb-and-similar/runtest.sh +++ b/selinux-policy/rpmdb-and-similar/runtest.sh @@ -30,7 +30,6 @@ . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" -ROOT_PASSWORD="redhat" SERVICE_PACKAGE="rpm" SERVICE_NAME="rpmdb-rebuild" PROCESS_NAME="rpmdb" @@ -69,10 +68,10 @@ rlJournalStart rlPhaseStartTest "real scenario -- standalone service" rlRun "touch /var/lib/rpm/.rebuilddb" - rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} - ${PROCESS_CONTEXT} "start status" 1 + rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "start status" 1 rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 rlRun "touch /var/lib/rpm/.rebuilddb" - rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} - ${PROCESS_CONTEXT} "restart status stop status" 1 + rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd rlPhaseStartTest "rpmdb executed by root/unconfined_t" @@ -90,6 +89,25 @@ rlJournalStart rm -f ${OUTPUT_FILE} rlPhaseEnd + rlPhaseStartTest "bz#2164752" + rlSEMatchPathCon "/usr/bin/rpm" "rpm_exec_t" + rlSEMatchPathCon "/usr/lib/rpm/rpmdb_migrate" "rpmdb_exec_t" + rlSEMatchPathCon "/var/lib/rpm" "rpm_var_lib_t" + rlSEMatchPathCon "/var/lib/rpm/.migratedb" "rpm_var_lib_t" + rlSESearchRule "allow rpmdb_t shell_exec_t : file { map execute } [ ]" + rlSESearchRule "allow rpmdb_t rpm_exec_t : file { getattr open read map execute } [ ]" + rlSESearchRule "allow rpmdb_t bin_t : file { getattr open read execute execute_no_trans } [ ]" + rlSESearchRule "allow rpmdb_t rpm_var_lib_t : lnk_file { getattr read } [ ]" + rlPhaseEnd + + rlPhaseStartTest "real scenario -- rpmdb-migrate service" + rlRun "touch /var/lib/rpm/.migratedb" + rlSEService - rpmdb-migrate - rpmdb_t "start status" 1 + rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 + rlRun "touch /var/lib/rpm/.migratedb" + rlSEService - rpmdb-migrate - rpmdb_t "restart status stop status" 1 + rlPhaseEnd + rlPhaseStartCleanup sleep 2 rlSECheckAVC From c202ed9d6ee0497db4335091e88e16f65ede99ce Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Wed, 1 Feb 2023 10:20:55 +0100 Subject: [PATCH 211/626] add new test which covers the nfs-idmapd service This TC covers the nfs-idmapd service and its basic scenario with default configuration. Purpose of this TC is to find any SELinux interferences with the nfs-idmapd service. --- .../rpc.idmapd-and-similar/Makefile | 67 +++++++++++++ selinux-policy/rpc.idmapd-and-similar/PURPOSE | 4 + .../rpc.idmapd-and-similar/main.fmf | 39 ++++++++ .../rpc.idmapd-and-similar/runtest.sh | 93 +++++++++++++++++++ 4 files changed, 203 insertions(+) create mode 100644 selinux-policy/rpc.idmapd-and-similar/Makefile create mode 100644 selinux-policy/rpc.idmapd-and-similar/PURPOSE create mode 100644 selinux-policy/rpc.idmapd-and-similar/main.fmf create mode 100755 selinux-policy/rpc.idmapd-and-similar/runtest.sh diff --git a/selinux-policy/rpc.idmapd-and-similar/Makefile b/selinux-policy/rpc.idmapd-and-similar/Makefile new file mode 100644 index 0000000..4ed9dbb --- /dev/null +++ b/selinux-policy/rpc.idmapd-and-similar/Makefile @@ -0,0 +1,67 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/rpc.idmapd-and-similar +# Description: SELinux interferes with rpc.idmapd and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2023 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/rpc.idmapd-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with rpc.idmapd and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console /usr/sbin/service nfs-utils" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) + + rhts-lint $(METADATA) + diff --git a/selinux-policy/rpc.idmapd-and-similar/PURPOSE b/selinux-policy/rpc.idmapd-and-similar/PURPOSE new file mode 100644 index 0000000..f64abec --- /dev/null +++ b/selinux-policy/rpc.idmapd-and-similar/PURPOSE @@ -0,0 +1,4 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/rpc.idmapd-and-similar +Description: SELinux interferes with rpc.idmapd and related programs +Author: Milos Malik + diff --git a/selinux-policy/rpc.idmapd-and-similar/main.fmf b/selinux-policy/rpc.idmapd-and-similar/main.fmf new file mode 100644 index 0000000..ee69fa1 --- /dev/null +++ b/selinux-policy/rpc.idmapd-and-similar/main.fmf @@ -0,0 +1,39 @@ +summary: SELinux interferes with rpc.idmapd and related programs +description: |+ + SELinux interferes with rpc.idmapd and related programs. + +contact: Milos Malik +component: + - selinux-policy +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - nfs-utils + - /usr/sbin/service +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - Tier3 + - Tier3se + - targeted +tier: '3' +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + continue: false +extra-summary: /CoreOS/selinux-policy/Regression/rpc.idmapd-and-similar +extra-task: /CoreOS/selinux-policy/Regression/rpc.idmapd-and-similar +extra-nitrate: TC#0614824 diff --git a/selinux-policy/rpc.idmapd-and-similar/runtest.sh b/selinux-policy/rpc.idmapd-and-similar/runtest.sh new file mode 100755 index 0000000..b4d7218 --- /dev/null +++ b/selinux-policy/rpc.idmapd-and-similar/runtest.sh @@ -0,0 +1,93 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/rpc.idmapd-and-similar +# Description: SELinux interferes with rpc.idmapd and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2023 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +ROOT_PASSWORD="redhat" +FILE_PATH="/usr/sbin/rpc.idmapd" +FILE_CONTEXT="rpcd_exec_t" +SERVICE_PACKAGE="nfs-utils" +SERVICE_NAME="nfs-idmapd" +PROCESS_NAME="rpc.idmapd" +PROCESS_CONTEXT="rpcd_t" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} + rlFileBackup /etc/shadow + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "SELinux contexts and rules" + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + if rlIsRHEL 5 ; then + SOURCE_TYPE="initrc_t" + BOOLEANS="[ ]" + elif rlIsRHEL 6 ; then + SOURCE_TYPE="initrc_t" + else # RHEL-7 etc. + SOURCE_TYPE="init_t" # systemd runs the process + fi + rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" + rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" + rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" + rlPhaseEnd + + rlPhaseStartTest "real scenario -- standalone service" + rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + # for RHELs where the SELinux domain does not exist yet + PROCESS_CONTEXT="unconfined_service_t" + fi + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /var /run -e /var/ARTIFACTS" 0-255 + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + From 6feeb9872ef4d689bb0de68a84f943de83cd7e6c Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Fri, 3 Feb 2023 15:39:14 +0100 Subject: [PATCH 212/626] test if ModemManager can create /sys/class/net/*/qmi/pass_through file Recently, various modem users reported that SELinux prevents the ModemManager service from working with netlink route sockets and from creating the /sys/class/net/*/qmi/pass_through file. The TC does not reproduce the situation. In order to support the full functionality of ModemManager service, I believe that SELinux policy should allow these actions. The TC looks for appropriate policy rules. The TC covers BZ#2145005, BZ#2149560 and BZ#2149954. --- selinux-policy/ModemManager-and-similar/Makefile | 3 +++ selinux-policy/ModemManager-and-similar/main.fmf | 3 +++ selinux-policy/ModemManager-and-similar/runtest.sh | 6 ++++++ 3 files changed, 12 insertions(+) diff --git a/selinux-policy/ModemManager-and-similar/Makefile b/selinux-policy/ModemManager-and-similar/Makefile index 46dacc6..e1470f1 100644 --- a/selinux-policy/ModemManager-and-similar/Makefile +++ b/selinux-policy/ModemManager-and-similar/Makefile @@ -77,6 +77,9 @@ $(METADATA): Makefile @echo "Bug: 2001144" >> $(METADATA) # Fedora 35 @echo "Bug: 2001145" >> $(METADATA) # Fedora 35 @echo "Bug: 2036582" >> $(METADATA) # RHEL-9 + @echo "Bug: 2145005" >> $(METADATA) # Fedora 36 + @echo "Bug: 2149560" >> $(METADATA) # RHEL-9 + @echo "Bug: 2149954" >> $(METADATA) # Fedora 37 rhts-lint $(METADATA) diff --git a/selinux-policy/ModemManager-and-similar/main.fmf b/selinux-policy/ModemManager-and-similar/main.fmf index c3539d8..557b9d5 100644 --- a/selinux-policy/ModemManager-and-similar/main.fmf +++ b/selinux-policy/ModemManager-and-similar/main.fmf @@ -49,6 +49,9 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2001144 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2001145 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2036582 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2145005 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2149560 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2149954 adjust: - enabled: false when: distro == rhel-4, rhel-5 diff --git a/selinux-policy/ModemManager-and-similar/runtest.sh b/selinux-policy/ModemManager-and-similar/runtest.sh index b41d316..c72292a 100755 --- a/selinux-policy/ModemManager-and-similar/runtest.sh +++ b/selinux-policy/ModemManager-and-similar/runtest.sh @@ -134,6 +134,12 @@ rlJournalStart rlSESearchRule "allow modemmanager_t modem_device_t : chr_file { getattr open read write ioctl } [ ]" rlSESearchRule "allow modemmanager_t unconfined_t : unix_stream_socket { connectto } [ ]" rlPhaseEnd + + rlPhaseStartTest "bz#2145005 + bz#2149560 + bz#2149954" + rlSESearchRule "allow modemmanager_t modemmanager_t : netlink_route_socket { create getopt getattr nlmsg_write } [ ]" + rlSESearchRule "allow modemmanager_t sysfs_t : dir { write add_name } [ ]" + rlSESearchRule "allow modemmanager_t sysfs_t : file { create } [ ]" + rlPhaseEnd fi rlPhaseStartCleanup From 43db7fa18ab610c0605a82190ef4397385be6f29 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Thu, 2 Feb 2023 18:19:30 +0100 Subject: [PATCH 213/626] test if journalctl's pager can use the prctl syscall TBA later The TC covers BZ#2136189 and BZ#2153782. --- selinux-policy/journalctl-and-similar/Makefile | 2 ++ selinux-policy/journalctl-and-similar/main.fmf | 2 ++ .../journalctl-and-similar/runtest.sh | 17 +++++++++++++---- 3 files changed, 17 insertions(+), 4 deletions(-) diff --git a/selinux-policy/journalctl-and-similar/Makefile b/selinux-policy/journalctl-and-similar/Makefile index 16b4c1b..bbc6bec 100644 --- a/selinux-policy/journalctl-and-similar/Makefile +++ b/selinux-policy/journalctl-and-similar/Makefile @@ -71,6 +71,7 @@ $(METADATA): Makefile @echo "Bug: 2075527" >> $(METADATA) # Fedora 37 @echo "Bug: 2124427" >> $(METADATA) # Fedora 37 @echo "Bug: 2125762" >> $(METADATA) # Fedora 37 + @echo "Bug: 2136189" >> $(METADATA) # RHEL-8 @echo "Bug: 2137323" >> $(METADATA) # Fedora 37 @echo "Bug: 2139623" >> $(METADATA) # Fedora 37 @echo "Bug: 2143157" >> $(METADATA) # Fedora 37 @@ -81,6 +82,7 @@ $(METADATA): Makefile @echo "Bug: 2152544" >> $(METADATA) # Fedora 37 @echo "Bug: 2152588" >> $(METADATA) # Fedora 37 @echo "Bug: 2152823" >> $(METADATA) # RHEL-9 + @echo "Bug: 2153782" >> $(METADATA) # RHEL-9 rhts-lint $(METADATA) diff --git a/selinux-policy/journalctl-and-similar/main.fmf b/selinux-policy/journalctl-and-similar/main.fmf index 4ce701c..3a1cdcb 100644 --- a/selinux-policy/journalctl-and-similar/main.fmf +++ b/selinux-policy/journalctl-and-similar/main.fmf @@ -44,6 +44,7 @@ link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2075527 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2124427 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2125762 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2136189 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2137323 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2139623 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2143157 @@ -54,6 +55,7 @@ link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2152544 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2152588 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2152823 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2153782 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6 diff --git a/selinux-policy/journalctl-and-similar/runtest.sh b/selinux-policy/journalctl-and-similar/runtest.sh index 527aa23..c60084c 100755 --- a/selinux-policy/journalctl-and-similar/runtest.sh +++ b/selinux-policy/journalctl-and-similar/runtest.sh @@ -106,8 +106,6 @@ rlJournalStart fi rlPhaseStartTest "real scenario -- confined users" - rlSEConfigureSSH - rlRun "setsebool ssh_sysadm_login on" rlLog "configuration says not to test SELinux users: ${DENIED_USERS}" for SELINUX_USER in ${ALLOWED_USERS} ; do @@ -124,9 +122,20 @@ rlJournalStart sleep 10 done rlRun "setsebool ssh_sysadm_login off" + rlPhaseEnd - rlFileRestore - rlRun "service sshd restart" + rlPhaseStartTest "bz#2136189 + bz#2153782" + rlSESearchRule "allow journalctl_t journalctl_t : capability { sys_resource } [ ]" + rlSESearchRule "allow journalctl_t journalctl_t : process { setrlimit } [ ]" + + rlRun "setsebool ssh_sysadm_login on" + USER_NAME="toor" + USER_SECRET="S3kr3t${RANDOM}" + rlRun "useradd -o -u 0 -g 0 -Z sysadm_u ${USER_NAME}" + rlRun "echo ${USER_SECRET} | passwd --stdin ${USER_NAME}" + rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost journalctl -l --pager" + rlRun "userdel -rfZ ${USER_NAME}" + rlRun "setsebool ssh_sysadm_login off" rlPhaseEnd rlPhaseStartCleanup From a9d77b420c466ed8034efeec804cab102fb0a111 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Thu, 2 Feb 2023 10:05:12 +0100 Subject: [PATCH 214/626] add new test which covers the synce4l service This TC covers the synce4l service and its basic scenario with default configuration. Purpose of this TC is to find any SELinux interferences with the synce4l service. The TC covers BZ#2158402. --- selinux-policy/synce4l-and-similar/Makefile | 68 ++++++++++++++ selinux-policy/synce4l-and-similar/PURPOSE | 4 + selinux-policy/synce4l-and-similar/main.fmf | 41 +++++++++ selinux-policy/synce4l-and-similar/runtest.sh | 88 +++++++++++++++++++ 4 files changed, 201 insertions(+) create mode 100644 selinux-policy/synce4l-and-similar/Makefile create mode 100644 selinux-policy/synce4l-and-similar/PURPOSE create mode 100644 selinux-policy/synce4l-and-similar/main.fmf create mode 100755 selinux-policy/synce4l-and-similar/runtest.sh diff --git a/selinux-policy/synce4l-and-similar/Makefile b/selinux-policy/synce4l-and-similar/Makefile new file mode 100644 index 0000000..a84a939 --- /dev/null +++ b/selinux-policy/synce4l-and-similar/Makefile @@ -0,0 +1,68 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/synce4l-and-similar +# Description: SELinux interferes with synce4l service and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2023 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/synce4l-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with synce4l service and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console /usr/sbin/service synce4l" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) + @echo "Bug: 2158402" >> $(METADATA) # RHEL-9 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/synce4l-and-similar/PURPOSE b/selinux-policy/synce4l-and-similar/PURPOSE new file mode 100644 index 0000000..ac65ec7 --- /dev/null +++ b/selinux-policy/synce4l-and-similar/PURPOSE @@ -0,0 +1,4 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/synce4l-and-similar +Description: SELinux interferes with synce4l service and related programs +Author: Milos Malik + diff --git a/selinux-policy/synce4l-and-similar/main.fmf b/selinux-policy/synce4l-and-similar/main.fmf new file mode 100644 index 0000000..f1b2b69 --- /dev/null +++ b/selinux-policy/synce4l-and-similar/main.fmf @@ -0,0 +1,41 @@ +summary: SELinux interferes with synce4l service and related programs +description: |+ + SELinux interferes with synce4l service and related programs. + +contact: Milos Malik +component: + - selinux-policy +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - /usr/sbin/service + - synce4l +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - Tier3 + - Tier3se + - targeted +tier: '3' +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2158402 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + because: the synce4l package is not available there +extra-summary: /CoreOS/selinux-policy/Regression/synce4l-and-similar +extra-task: /CoreOS/selinux-policy/Regression/synce4l-and-similar +extra-nitrate: TC#0614832 diff --git a/selinux-policy/synce4l-and-similar/runtest.sh b/selinux-policy/synce4l-and-similar/runtest.sh new file mode 100755 index 0000000..583c41f --- /dev/null +++ b/selinux-policy/synce4l-and-similar/runtest.sh @@ -0,0 +1,88 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/synce4l-and-similar +# Description: SELinux interferes with synce4l service and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2023 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +FILE_PATH="/usr/sbin/synce4l" +FILE_CONTEXT="bin_t" +SERVICE_PACKAGE="synce4l" +SERVICE_NAME="synce4l" +PROCESS_NAME="synce4l" +PROCESS_CONTEXT="unconfined_service_t" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} + rlFileBackup /etc/synce4l.conf + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "bz#2158402" + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + BOOLEANS="[ ]" + SOURCE_TYPE="init_t" # systemd runs the process + rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" + rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" + rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" + rlPhaseEnd + + rlPhaseStartTest "real scenario -- standalone service" + rlRun "grep _cmd /etc/synce4l.conf" + rlRun "sed -i 's/^\(.*_cmd\) .*$/\1 echo 0/' /etc/synce4l.conf" + rlRun "grep _cmd /etc/synce4l.conf" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + # for RHELs where the SELinux domain does not exist yet + PROCESS_CONTEXT="unconfined_service_t" + fi + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /var /run -e /var/ARTIFACTS" 0-255 + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + From 1250828d11b5ef99a5dd28013d95aae3780e44e9 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Thu, 2 Feb 2023 13:18:38 +0100 Subject: [PATCH 215/626] add new test which covers the bootupd service This TC covers the bootupd service and its basic scenario with default configuration. Purpose of this TC is to find any SELinux interferences with the bootupd service. The TC covers BZ#2029478 and BZ#2044508. --- selinux-policy/bootupd-and-similar/Makefile | 69 ++++++++++++++ selinux-policy/bootupd-and-similar/PURPOSE | 6 ++ selinux-policy/bootupd-and-similar/main.fmf | 45 +++++++++ selinux-policy/bootupd-and-similar/runtest.sh | 95 +++++++++++++++++++ 4 files changed, 215 insertions(+) create mode 100644 selinux-policy/bootupd-and-similar/Makefile create mode 100644 selinux-policy/bootupd-and-similar/PURPOSE create mode 100644 selinux-policy/bootupd-and-similar/main.fmf create mode 100755 selinux-policy/bootupd-and-similar/runtest.sh diff --git a/selinux-policy/bootupd-and-similar/Makefile b/selinux-policy/bootupd-and-similar/Makefile new file mode 100644 index 0000000..77a2f71 --- /dev/null +++ b/selinux-policy/bootupd-and-similar/Makefile @@ -0,0 +1,69 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/bootupd-and-similar +# Description: SELinux interferes with the bootupd service and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2023 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/bootupd-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console /usr/sbin/service bootupd" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) + @echo "Bug: 2029478" >> $(METADATA) # RHEL-9 + @echo "Bug: 2044508" >> $(METADATA) # RHEL-9 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/bootupd-and-similar/PURPOSE b/selinux-policy/bootupd-and-similar/PURPOSE new file mode 100644 index 0000000..2fbf806 --- /dev/null +++ b/selinux-policy/bootupd-and-similar/PURPOSE @@ -0,0 +1,6 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/bootupd-and-similar +Description: SELinux interferes with the bootupd service and related programs +Author: Milos Malik + +The TC needs a machine with EFI for successful run. + diff --git a/selinux-policy/bootupd-and-similar/main.fmf b/selinux-policy/bootupd-and-similar/main.fmf new file mode 100644 index 0000000..2b38dc4 --- /dev/null +++ b/selinux-policy/bootupd-and-similar/main.fmf @@ -0,0 +1,45 @@ +summary: SELinux interferes with the bootupd service and related programs +description: |+ + SELinux interferes with the bootupd service and related programs. + +contact: Milos Malik +component: + - selinux-policy +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - /usr/sbin/service + - bootupd +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - Tier3 + - Tier3se + - targeted +tier: '3' +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2029478 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2044508 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + because: the package is not available there + - enabled: false + when: arch == ppc64, ppc64le, s390x + because: the package is not built for all architectures +extra-summary: /CoreOS/selinux-policy/Regression/bootupd-and-similar +extra-task: /CoreOS/selinux-policy/Regression/bootupd-and-similar +extra-nitrate: TC#0614833 diff --git a/selinux-policy/bootupd-and-similar/runtest.sh b/selinux-policy/bootupd-and-similar/runtest.sh new file mode 100755 index 0000000..5ac7488 --- /dev/null +++ b/selinux-policy/bootupd-and-similar/runtest.sh @@ -0,0 +1,95 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/bootupd-and-similar +# Description: SELinux interferes with the bootupd service and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2023 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +FILE_PATH="/usr/libexec/bootupd" +FILE_CONTEXT="bin_t" +SERVICE_PACKAGE="bootupd" +SERVICE_NAME="bootupd" +PROCESS_NAME="bootupd" +PROCESS_CONTEXT="unconfined_service_t" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "bz#2029478 + bz#2044508" + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + BOOLEANS="[ ]" + SOURCE_TYPE="init_t" # systemd runs the process + rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" + rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" + rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" + rlPhaseEnd + + rlPhaseStartTest "real scenario -- standalone service" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + # for RHELs where the SELinux domain does not exist yet + PROCESS_CONTEXT="unconfined_service_t" + fi + rlRun "systemctl start ${SERVICE_NAME}.socket" + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /var /run -e /var/ARTIFACTS" 0-255 + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlRun "systemctl stop ${SERVICE_NAME}.socket" + rlPhaseEnd + + rlPhaseStartTest "real scenario -- ${SERVICE_NAME}.socket" + rlRun "systemctl enable ${SERVICE_NAME}.socket" + rlRun "systemctl start ${SERVICE_NAME}.socket" + sleep 1 + rlRun "bootupctl status" 0,1 + rlRun "bootupctl validate" 0,1 + rlRun "lsblk -O" + rlRun "systemctl stop ${SERVICE_NAME}.socket" + rlRun "systemctl disable ${SERVICE_NAME}.socket" + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + From c020488428db50fa0795791dabd5041a0bb439b6 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Mon, 27 Feb 2023 12:38:28 +0100 Subject: [PATCH 216/626] require full program locations instead of package names When a program is moved from one package to another package, automated tests which require the first package may fail. In order to improve the situation, it's safer to require the full program location instead of a package name, that may change over time. --- selinux-policy/cups-browsed-and-similar/Makefile | 2 +- selinux-policy/cups-browsed-and-similar/main.fmf | 4 ++-- selinux-policy/cups-browsed-and-similar/runtest.sh | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/selinux-policy/cups-browsed-and-similar/Makefile b/selinux-policy/cups-browsed-and-similar/Makefile index 3986103..951aa63 100644 --- a/selinux-policy/cups-browsed-and-similar/Makefile +++ b/selinux-policy/cups-browsed-and-similar/Makefile @@ -55,7 +55,7 @@ $(METADATA): Makefile @echo "TestTime: 15m" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) @echo "RunFor: cups" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console cups-filters cups initscripts" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console /usr/sbin/cups-browsed cups /usr/sbin/service" >> $(METADATA) @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @echo "License: GPLv2" >> $(METADATA) diff --git a/selinux-policy/cups-browsed-and-similar/main.fmf b/selinux-policy/cups-browsed-and-similar/main.fmf index 7e59ea2..d034c54 100644 --- a/selinux-policy/cups-browsed-and-similar/main.fmf +++ b/selinux-policy/cups-browsed-and-similar/main.fmf @@ -16,9 +16,9 @@ recommend: - selinux-policy - selinux-policy-targeted - setools-console - - cups-filters + - /usr/sbin/cups-browsed - cups - - initscripts + - /usr/sbin/service environment: AVC_ERROR: +no_avc_check duration: 15m diff --git a/selinux-policy/cups-browsed-and-similar/runtest.sh b/selinux-policy/cups-browsed-and-similar/runtest.sh index 3db7b5c..bba6a10 100755 --- a/selinux-policy/cups-browsed-and-similar/runtest.sh +++ b/selinux-policy/cups-browsed-and-similar/runtest.sh @@ -33,7 +33,7 @@ PACKAGE="selinux-policy" ROOT_PASSWORD="redhat" FILE_PATH="/usr/sbin/cups-browsed" FILE_CONTEXT="cupsd_exec_t" -SERVICE_PACKAGE="cups-filters" +SERVICE_PACKAGE=`rpm -qf /usr/sbin/cups-browsed` SERVICE_NAME="cups-browsed" PROCESS_NAME="cups-browsed" PROCESS_CONTEXT="cupsd_t" From a4390a7a1e87eb9600d504d1badda216eaf6af31 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Mon, 6 Mar 2023 14:27:55 +0100 Subject: [PATCH 217/626] kernel/selinux-testsuite: bump upstream commit Notable changes: - fixed DH prime format in 'keys' test - native quota support now used for ext4 when available - needs special exception on RHEL-7 where it is broken - fixed stderr noise from 'yes' command - fixed SIGIO tests to work under CONFIG_LEGACY_TIOCSTI=n Signed-off-by: Ondrej Mosnacek --- kernel/selinux-testsuite/runtest.sh | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/kernel/selinux-testsuite/runtest.sh b/kernel/selinux-testsuite/runtest.sh index 9114201..8e785ab 100755 --- a/kernel/selinux-testsuite/runtest.sh +++ b/kernel/selinux-testsuite/runtest.sh @@ -35,7 +35,7 @@ PACKAGE="selinux-policy" # This should be updated as needed after verifying that the new version # doesn't break testing and after applying all necessary tweaks in the TC. # Run with GIT_BRANCH=master to run the latest upstream version. -DEFAULT_COMMIT="3389abeaa3bb6fdf23a0f2d8b1550fae69f9c52e" +DEFAULT_COMMIT="5fc5dc9f5964aae3a6dce57178b25ddc49d21415" # Default pull requests to merge before running the test. # If non-empty, then after checking out GIT_BRANCH the listed upstream pull # requests (by number) are merged, creating a new temporary local branch. @@ -347,6 +347,12 @@ rlJournalStart rlRun "cat >>policy/test_mmap.te <<<'allow_map(test_no_execmem_t, tmpfs_t, file)'" fi + # work around non-functional ext4 native quota support on + # RHEL-7 + if kver_lt 4.18; then + rlRun "sed -i 's/3.6/4.18/g' tests/{fs_,}filesystem/test" + fi + if kver_ge 4.18; then force_tests+=" sctp" fi From b6e50398b54d34e694e60635d66ff649e67ac133 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Fri, 3 Mar 2023 14:30:05 +0100 Subject: [PATCH 218/626] test if systemd-timesyncd can watch the /run/systemd/ directory The use of the systemd-timesyncd service revealed that SELinux prevents the systemd-timesyncd processes from watching (syscall = inotify_add_watch) the /run/systemd/ directory. The TC reproduces the situation. In order to successfully start the systemd-timesyncd service in enforcing mode, I believe that this access should be allowed in SELinux policy. The TC looks for appropriate policy rules and file context patterns. The TC covers BZ#2175137. --- selinux-policy/systemd-timesyncd-and-similar/Makefile | 4 ++-- selinux-policy/systemd-timesyncd-and-similar/main.fmf | 9 ++++++--- .../systemd-timesyncd-and-similar/runtest.sh | 10 ++++++++-- 3 files changed, 16 insertions(+), 7 deletions(-) diff --git a/selinux-policy/systemd-timesyncd-and-similar/Makefile b/selinux-policy/systemd-timesyncd-and-similar/Makefile index e47a5c9..a5fdcf0 100644 --- a/selinux-policy/systemd-timesyncd-and-similar/Makefile +++ b/selinux-policy/systemd-timesyncd-and-similar/Makefile @@ -55,8 +55,7 @@ $(METADATA): Makefile @echo "TestTime: 10m" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) @echo "RunFor: systemd" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console systemd-udev initscripts" >> $(METADATA) - @echo "Requires: systemd-timesyncd" >> $(METADATA) # EPEL + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console /usr/sbin/service /usr/lib/systemd/systemd-timesyncd" >> $(METADATA) # EPEL @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @@ -74,6 +73,7 @@ $(METADATA): Makefile @echo "Bug: 1822131" >> $(METADATA) # Fedora 32 @echo "Bug: 1869979" >> $(METADATA) # RHEL-8 @echo "Bug: 1949315" >> $(METADATA) # Fedora 34 + @echo "Bug: 2175137" >> $(METADATA) # RHEL-9 rhts-lint $(METADATA) diff --git a/selinux-policy/systemd-timesyncd-and-similar/main.fmf b/selinux-policy/systemd-timesyncd-and-similar/main.fmf index 4c90d39..9f69db6 100644 --- a/selinux-policy/systemd-timesyncd-and-similar/main.fmf +++ b/selinux-policy/systemd-timesyncd-and-similar/main.fmf @@ -16,9 +16,8 @@ recommend: - selinux-policy - selinux-policy-targeted - setools-console - - systemd-udev - - initscripts - - systemd-timesyncd + - /usr/sbin/service + - /usr/lib/systemd/systemd-timesyncd environment: AVC_ERROR: +no_avc_check duration: 10m @@ -49,9 +48,13 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1869979 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1949315 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1970865 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2175137 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7 + because: the systemd-timesyncd service is not available there + - enabled: false + when: arch == i386, ppc64, s390 continue: false extra-nitrate: TC#0606395 extra-summary: /CoreOS/selinux-policy/Regression/systemd-timesyncd-and-similar diff --git a/selinux-policy/systemd-timesyncd-and-similar/runtest.sh b/selinux-policy/systemd-timesyncd-and-similar/runtest.sh index 37f186c..46d6731 100755 --- a/selinux-policy/systemd-timesyncd-and-similar/runtest.sh +++ b/selinux-policy/systemd-timesyncd-and-similar/runtest.sh @@ -33,7 +33,7 @@ PACKAGE="selinux-policy" ROOT_PASSWORD="redhat" FILE_PATH="/usr/lib/systemd/systemd-timesyncd" FILE_CONTEXT="systemd_timedated_exec_t" -SERVICE_PACKAGE="systemd-udev" +SERVICE_PACKAGE=`rpm -qf ${FILE_PATH}` SERVICE_NAME="systemd-timesyncd" PROCESS_NAME="systemd-timesyncd" PROCESS_CONTEXT="systemd_timedated_t" @@ -109,9 +109,15 @@ rlJournalStart rlSESearchRule "allow systemd_timedated_t root_t : dir { watch } [ ]" rlSESearchRule "allow systemd_timedated_t var_run_t : dir { watch } [ ]" rlPhaseEnd + + rlPhaseStartTest "bz#2175137" + rlSEMatchPathCon "/usr/lib/systemd/systemd-timesyncd" "systemd_timedated_exec_t" + rlSEMatchPathCon "/run/systemd/" "init_var_run_t" + rlSESearchRule "allow systemd_timedated_t init_var_run_t : dir { watch } [ ]" + rlPhaseEnd fi - if systemctl list-units | grep -q ${SERVICE_NAME} ; then + if systemctl list-unit-files | grep -q ${SERVICE_NAME} ; then rlPhaseStartTest "real scenario -- standalone service" rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" if ! rlSEDefined ${PROCESS_CONTEXT} ; then From 179cfabade66988358f09703be95bcedd6707e2a Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Mon, 6 Mar 2023 13:59:40 +0100 Subject: [PATCH 219/626] complete the list of required packages Some of the automated tests call programs which are not required in any form (package name or program location). The problem should be fixed now. --- .../selinux_restorecon-functions/Makefile | 2 +- .../selinux_restorecon-functions/main.fmf | 1 + .../selinux_sestatus-functions/Makefile | 4 +-- .../selinux_sestatus-functions/main.fmf | 1 + libselinux/selinux_set_callback/main.fmf | 31 ++++++++++++++++++- .../verify-options-in-semanage-conf/Makefile | 2 +- .../verify-options-in-semanage-conf/main.fmf | 2 +- 7 files changed, 37 insertions(+), 6 deletions(-) diff --git a/libselinux/selinux_restorecon-functions/Makefile b/libselinux/selinux_restorecon-functions/Makefile index 631f5a8..f826c98 100644 --- a/libselinux/selinux_restorecon-functions/Makefile +++ b/libselinux/selinux_restorecon-functions/Makefile @@ -53,7 +53,7 @@ $(METADATA): Makefile @echo "Type: Sanity" >> $(METADATA) @echo "TestTime: 5m" >> $(METADATA) @echo "RunFor: libselinux" >> $(METADATA) - @echo "Requires: libselinux libselinux-devel glibc strace" >> $(METADATA) + @echo "Requires: libselinux libselinux-devel glibc strace gcc" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @echo "License: GPLv2+" >> $(METADATA) @echo "Confidential: no" >> $(METADATA) diff --git a/libselinux/selinux_restorecon-functions/main.fmf b/libselinux/selinux_restorecon-functions/main.fmf index e3dd75c..528527d 100644 --- a/libselinux/selinux_restorecon-functions/main.fmf +++ b/libselinux/selinux_restorecon-functions/main.fmf @@ -8,6 +8,7 @@ recommend: - libselinux-devel - glibc - strace + - gcc enabled: true tag: - CI-Tier-1 diff --git a/libselinux/selinux_sestatus-functions/Makefile b/libselinux/selinux_sestatus-functions/Makefile index d3ad9e8..0693800 100644 --- a/libselinux/selinux_sestatus-functions/Makefile +++ b/libselinux/selinux_sestatus-functions/Makefile @@ -41,7 +41,6 @@ build: $(BUILT_FILES) clean: rm -f *~ $(BUILT_FILES) - include /usr/share/rhts/lib/rhts-make.include $(METADATA): Makefile @@ -53,7 +52,7 @@ $(METADATA): Makefile @echo "Type: Sanity" >> $(METADATA) @echo "TestTime: 5m" >> $(METADATA) @echo "RunFor: libselinux" >> $(METADATA) - @echo "Requires: libselinux libselinux-devel glibc" >> $(METADATA) + @echo "Requires: libselinux libselinux-devel glibc gcc" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @echo "License: GPLv2+" >> $(METADATA) @echo "Confidential: no" >> $(METADATA) @@ -61,3 +60,4 @@ $(METADATA): Makefile @echo "Releases: -RHEL4 -RHELClient5 -RHELServer5 -RHEL6" >> $(METADATA) rhts-lint $(METADATA) + diff --git a/libselinux/selinux_sestatus-functions/main.fmf b/libselinux/selinux_sestatus-functions/main.fmf index 18c1a60..24abbb1 100644 --- a/libselinux/selinux_sestatus-functions/main.fmf +++ b/libselinux/selinux_sestatus-functions/main.fmf @@ -7,6 +7,7 @@ recommend: - libselinux - libselinux-devel - glibc + - gcc enabled: true tag: - CI-Tier-1 diff --git a/libselinux/selinux_set_callback/main.fmf b/libselinux/selinux_set_callback/main.fmf index 3d61e91..22cbd2b 100644 --- a/libselinux/selinux_set_callback/main.fmf +++ b/libselinux/selinux_set_callback/main.fmf @@ -1 +1,30 @@ -path: /libselinux/selinux_set_callback +summary: Test selinux_set_callback function +description: '' +contact: Milos Malik +component: + - libselinux +test: ./runtest.sh +framework: beakerlib +recommend: + - libselinux + - gcc + - glibc + - libselinux-devel +duration: 5m +enabled: true +tag: + - CI-Tier-1 + - NoRHEL4 + - NoRHEL5 + - TIPpass_Security + - TierCandidatesPASS + - f32friendly + - f33friendly + - targeted +adjust: + - enabled: false + when: distro == rhel-4, rhel-5 + continue: false +extra-nitrate: TC#0540241 +extra-summary: /CoreOS/libselinux/Sanity/selinux_set_callback +extra-task: /CoreOS/libselinux/Sanity/selinux_set_callback diff --git a/libsemanage/verify-options-in-semanage-conf/Makefile b/libsemanage/verify-options-in-semanage-conf/Makefile index 3f94665..83b6c9a 100644 --- a/libsemanage/verify-options-in-semanage-conf/Makefile +++ b/libsemanage/verify-options-in-semanage-conf/Makefile @@ -53,7 +53,7 @@ $(METADATA): Makefile @echo "Type: Sanity" >> $(METADATA) @echo "TestTime: 10m" >> $(METADATA) @echo "RunFor: libsemanage" >> $(METADATA) - @echo "Requires: libselinux libselinux-utils libsemanage policycoreutils policycoreutils-python selinux-policy selinux-policy-devel" >> $(METADATA) + @echo "Requires: libselinux libselinux-utils libsemanage policycoreutils policycoreutils-python-utils selinux-policy selinux-policy-devel" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @echo "License: GPLv2" >> $(METADATA) @echo "Confidential: no" >> $(METADATA) diff --git a/libsemanage/verify-options-in-semanage-conf/main.fmf b/libsemanage/verify-options-in-semanage-conf/main.fmf index 5f2c7e8..380bfad 100644 --- a/libsemanage/verify-options-in-semanage-conf/main.fmf +++ b/libsemanage/verify-options-in-semanage-conf/main.fmf @@ -14,7 +14,7 @@ recommend: - libselinux-utils - libsemanage - policycoreutils - - policycoreutils-python + - policycoreutils-python-utils - selinux-policy - selinux-policy-devel duration: 10m From 92d69db177b8e058cf7bbb3437864c48b6181d4a Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 21 Mar 2023 10:50:21 +0100 Subject: [PATCH 220/626] modify daemons_use_tty in tests which use systemd-run In order to allow a running systemd service to print an output onto console, the daemons_use_tty boolean needs to be enabled. Otherwise the following error message appears: Failed to start transient service unit: Connection reset by peer The daemons_use_tty boolean is disabled by default. --- selinux-policy/systemd-creds/runtest.sh | 2 ++ selinux-policy/systemd-run-and-similar/runtest.sh | 2 ++ 2 files changed, 4 insertions(+) diff --git a/selinux-policy/systemd-creds/runtest.sh b/selinux-policy/systemd-creds/runtest.sh index 212b1a5..227e890 100755 --- a/selinux-policy/systemd-creds/runtest.sh +++ b/selinux-policy/systemd-creds/runtest.sh @@ -56,6 +56,7 @@ rlJournalStart rlPhaseEnd rlPhaseStartTest "a systemd service loading credentials" + rlRun "setsebool daemons_use_tty on" rlRun "echo hello > /foo" rlRun "ls -alZ /foo" rlRun "systemd-creds encrypt /foo /bar" @@ -66,6 +67,7 @@ rlJournalStart rlRun "systemctl status dmesg.service" 0-255 rlRun "rm -f /foo /bar" rlRun "systemd-run -P --wait -p LoadCredential=abc:/etc/hosts systemd-creds cat abc" + rlRun "setsebool daemons_use_tty off" rlPhaseEnd rlPhaseStartCleanup diff --git a/selinux-policy/systemd-run-and-similar/runtest.sh b/selinux-policy/systemd-run-and-similar/runtest.sh index 82990ab..0b0fbd2 100755 --- a/selinux-policy/systemd-run-and-similar/runtest.sh +++ b/selinux-policy/systemd-run-and-similar/runtest.sh @@ -37,6 +37,7 @@ rlJournalStart rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted rlAssertRpm systemd + rlRun "setsebool daemons_use_tty on" rlSESetEnforce rlSEStatus @@ -76,6 +77,7 @@ rlJournalStart rlPhaseStartCleanup sleep 2 rlSECheckAVC + rlRun "setsebool daemons_use_tty off" rlPhaseEnd rlJournalPrintText rlJournalEnd From 93eca7b0a958b64e2801a18a7c0bc1450834396f Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Thu, 9 Mar 2023 15:46:25 +0100 Subject: [PATCH 221/626] policycoreutils/semodule-rebuild-...: add coverage for dontaudit Test that semodule --refresh works correctly with the disable_dontaudit flag. This currently requires the following patch to pass: https://lore.kernel.org/selinux/20230309143741.346749-1-omosnace@redhat.com/ Signed-off-by: Ondrej Mosnacek --- .../main.fmf | 1 + .../runtest.sh | 25 +++++++++++++++++++ 2 files changed, 26 insertions(+) diff --git a/policycoreutils/semodule-rebuild-if-modules-changed/main.fmf b/policycoreutils/semodule-rebuild-if-modules-changed/main.fmf index 1a8db10..a3191eb 100644 --- a/policycoreutils/semodule-rebuild-if-modules-changed/main.fmf +++ b/policycoreutils/semodule-rebuild-if-modules-changed/main.fmf @@ -26,3 +26,4 @@ link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2049189 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2049191 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2049193 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2173959 diff --git a/policycoreutils/semodule-rebuild-if-modules-changed/runtest.sh b/policycoreutils/semodule-rebuild-if-modules-changed/runtest.sh index 16e3ccf..d3c8f63 100755 --- a/policycoreutils/semodule-rebuild-if-modules-changed/runtest.sh +++ b/policycoreutils/semodule-rebuild-if-modules-changed/runtest.sh @@ -12,6 +12,7 @@ STORE_TYPE=targeted MODULES_ROOT="$STORE_ROOT/$STORE_TYPE/active/modules" STORE_POLICY="$STORE_ROOT/$STORE_TYPE/active/policy.kern" STORE_BOOLS="$STORE_ROOT/$STORE_TYPE/active/booleans.local" +STORE_DISABLE_DONTAUDIT="$STORE_ROOT/$STORE_TYPE/active/disable_dontaudit" TEST_MODULE_DIR="$MODULES_ROOT/400/test_module" TEST_BOOLEAN="xguest_exec_content" TEST_BOOLEAN_VALUE="0" @@ -29,6 +30,7 @@ rlJournalStart rlPhaseStartSetup rlAssertRpm "libsemanage" rlAssertRpm "policycoreutils" + rlAssertRpm "selinux-policy" policyvers="$(checkpolicy -V | cut -f 1 -d ' ')" policyvers_kernel="$(cat /sys/fs/selinux/policyvers)" @@ -114,6 +116,29 @@ rlJournalStart rlRun "semodule -N -B" 0 \ "Force a rebuild to clean things up" rlPhaseEnd + + if { rlIsRHEL 9 && rlIsRHEL '<9.3'; } || \ + { rlIsRHEL 8 && rlIsRHEL '<8.9'; } + then + rlPhaseStartTest "Disable dontaudit injected" + rlLog "Inject disable_dontaudit flag into the store" + rlRun "touch '$STORE_DISABLE_DONTAUDIT'" + rlRun "semodule -N $refresh_opt" 0 \ + "Do a conditional rebuild" + rlRun "test \$(sesearch --dontaudit '$STORE_POLICY' | wc -l) -eq 0" 0 \ + "Verify that the flag has been picked up" + + rlLog "Now remove the flag" + rlRun "rm -f '$STORE_DISABLE_DONTAUDIT'" + rlRun "semodule -N $refresh_opt" + rlRun "test \$(sesearch --dontaudit '$STORE_POLICY' | wc -l) -gt 0" 0 \ + "Verify that the dontaudit rules are back" + + # Make sure policy is restored regardless of any previous failures + rlRun "semodule -N -B" 0 \ + "Force a rebuild to clean things up" + rlPhaseEnd + fi fi else rlPhaseStartTest "Test skipped" From 067f66fc4af36e62e7561e82f47d3ea05d1bb4db Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Wed, 22 Mar 2023 09:06:46 +0100 Subject: [PATCH 222/626] quickly end tests which require unavailable packages Some packages are only available for Fedora or for older RHELs. It makes no sense to run certain tests in environments where their required packages are not unavailable. --- selinux-policy/bz733494-amanda-and-similar/main.fmf | 4 ++-- selinux-policy/bz733494-amanda-and-similar/runtest.sh | 6 ++++++ selinux-policy/icecast-and-similar/main.fmf | 6 +++--- selinux-policy/icecast-and-similar/runtest.sh | 6 ++++++ selinux-policy/sslh-and-similar/main.fmf | 8 ++++---- selinux-policy/sslh-and-similar/runtest.sh | 6 ++++++ selinux-policy/usbmuxd-and-similar/main.fmf | 4 ++-- selinux-policy/usbmuxd-and-similar/runtest.sh | 6 ++++++ 8 files changed, 35 insertions(+), 11 deletions(-) diff --git a/selinux-policy/bz733494-amanda-and-similar/main.fmf b/selinux-policy/bz733494-amanda-and-similar/main.fmf index f062952..2a38b85 100644 --- a/selinux-policy/bz733494-amanda-and-similar/main.fmf +++ b/selinux-policy/bz733494-amanda-and-similar/main.fmf @@ -59,8 +59,8 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1572696 adjust: - enabled: false - when: distro == rhel-4, rhel-9 - continue: false + when: distro >= rhel-9 + because: the amanda package is not available there extra-nitrate: TC#0114575 extra-summary: /CoreOS/selinux-policy/Regression/bz733494-amanda-and-similar extra-task: /CoreOS/selinux-policy/Regression/bz733494-amanda-and-similar diff --git a/selinux-policy/bz733494-amanda-and-similar/runtest.sh b/selinux-policy/bz733494-amanda-and-similar/runtest.sh index 80214f1..6c42aa5 100755 --- a/selinux-policy/bz733494-amanda-and-similar/runtest.sh +++ b/selinux-policy/bz733494-amanda-and-similar/runtest.sh @@ -38,6 +38,12 @@ PROCESS_NAME="amandad" PROCESS_CONTEXT="amanda_t" rlJournalStart + if rlIsRHEL && ! rlIsRHEL 7 8 ; then + rlLog "Not applicable to this OS version." + rlJournalEnd + exit 0 + fi + rlPhaseStartSetup rlRun "rlImport 'selinux-policy/common'" rlSESatisfyRequires diff --git a/selinux-policy/icecast-and-similar/main.fmf b/selinux-policy/icecast-and-similar/main.fmf index 497bea9..f2a6060 100644 --- a/selinux-policy/icecast-and-similar/main.fmf +++ b/selinux-policy/icecast-and-similar/main.fmf @@ -36,10 +36,10 @@ link: adjust: - enabled: false when: arch == i386, ppc, ppc64, s390 - continue: false + because: the icecast package is not available for all architectures - enabled: false - when: distro == rhel-4, rhel-8, rhel-9 - continue: false + when: distro >= rhel-8 + because: the icecast package is not available there extra-nitrate: TC#0388472 extra-summary: /CoreOS/selinux-policy/Regression/icecast-and-similar extra-task: /CoreOS/selinux-policy/Regression/icecast-and-similar diff --git a/selinux-policy/icecast-and-similar/runtest.sh b/selinux-policy/icecast-and-similar/runtest.sh index 62f7de7..36b3ded 100755 --- a/selinux-policy/icecast-and-similar/runtest.sh +++ b/selinux-policy/icecast-and-similar/runtest.sh @@ -39,6 +39,12 @@ PROCESS_NAME="icecast" PROCESS_CONTEXT="icecast_t" rlJournalStart + if rlIsRHEL ; then + rlLog "Not applicable to this OS version." + rlJournalEnd + exit 0 + fi + rlPhaseStartSetup rlRun "rlImport 'selinux-policy/common'" rlSESatisfyRequires diff --git a/selinux-policy/sslh-and-similar/main.fmf b/selinux-policy/sslh-and-similar/main.fmf index b2ebcd6..82f44cc 100644 --- a/selinux-policy/sslh-and-similar/main.fmf +++ b/selinux-policy/sslh-and-similar/main.fmf @@ -35,11 +35,11 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1534624 adjust: - enabled: false - when: distro == rhel-4, rhel-5, rhel-6 - continue: false + when: distro >= rhel-9 + because: the sslh package is not available there - enabled: false - when: arch == s390x - continue: false + when: arch == i386, ppc, s390, s390x + because: the sslh package is not available for all architectures extra-nitrate: TC#0563428 extra-summary: /CoreOS/selinux-policy/Regression/sslh-and-similar extra-task: /CoreOS/selinux-policy/Regression/sslh-and-similar diff --git a/selinux-policy/sslh-and-similar/runtest.sh b/selinux-policy/sslh-and-similar/runtest.sh index 7e33840..6803188 100755 --- a/selinux-policy/sslh-and-similar/runtest.sh +++ b/selinux-policy/sslh-and-similar/runtest.sh @@ -39,6 +39,12 @@ PROCESS_NAME="sslh" PROCESS_CONTEXT="sslh_t" rlJournalStart + if rlIsRHEL && ! rlIsRHEL 7 8 ; then + rlLog "Not applicable to this OS version." + rlJournalEnd + exit 0 + fi + rlPhaseStartSetup rlRun "rlImport 'selinux-policy/common'" rlSESatisfyRequires diff --git a/selinux-policy/usbmuxd-and-similar/main.fmf b/selinux-policy/usbmuxd-and-similar/main.fmf index ef0e7e3..6374d4c 100644 --- a/selinux-policy/usbmuxd-and-similar/main.fmf +++ b/selinux-policy/usbmuxd-and-similar/main.fmf @@ -43,8 +43,8 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1973886 adjust: - enabled: false - when: distro == rhel-4, rhel-5, rhel-6 - continue: false + when: distro >= rhel-9 + because: the usbmuxd package is not available there - enabled: false when: arch == aarch64, s390x continue: false diff --git a/selinux-policy/usbmuxd-and-similar/runtest.sh b/selinux-policy/usbmuxd-and-similar/runtest.sh index 0b1dc0f..6fddd17 100755 --- a/selinux-policy/usbmuxd-and-similar/runtest.sh +++ b/selinux-policy/usbmuxd-and-similar/runtest.sh @@ -39,6 +39,12 @@ PROCESS_NAME="usbmuxd" PROCESS_CONTEXT="usbmuxd_t" rlJournalStart + if rlIsRHEL && ! rlIsRHEL 7 8 ; then + rlLog "Not applicable to this OS version." + rlJournalEnd + exit 0 + fi + rlPhaseStartSetup rlRun "rlImport 'selinux-policy/common'" rlSESatisfyRequires From cdc801666e6310ad4c00c24820f69ed5f916071f Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Thu, 23 Mar 2023 16:22:05 +0100 Subject: [PATCH 223/626] semodule-rebuild-if-modules-changed: fix RHEL version check The comparisons were inverted by accident - fix them. Signed-off-by: Ondrej Mosnacek --- .../semodule-rebuild-if-modules-changed/runtest.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/policycoreutils/semodule-rebuild-if-modules-changed/runtest.sh b/policycoreutils/semodule-rebuild-if-modules-changed/runtest.sh index d3c8f63..5e6063d 100755 --- a/policycoreutils/semodule-rebuild-if-modules-changed/runtest.sh +++ b/policycoreutils/semodule-rebuild-if-modules-changed/runtest.sh @@ -117,8 +117,8 @@ rlJournalStart "Force a rebuild to clean things up" rlPhaseEnd - if { rlIsRHEL 9 && rlIsRHEL '<9.3'; } || \ - { rlIsRHEL 8 && rlIsRHEL '<8.9'; } + if { rlIsRHEL 9 && rlIsRHEL '>=9.3'; } || \ + { rlIsRHEL 8 && rlIsRHEL '>=8.9'; } then rlPhaseStartTest "Disable dontaudit injected" rlLog "Inject disable_dontaudit flag into the store" From 85268e7d6add4dc3e36bf5110725663893612915 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Thu, 23 Mar 2023 16:23:59 +0100 Subject: [PATCH 224/626] semodule-rebuild-if-modules-changed: add libsemanage as component in metatada The bulk of the logic is implemented inside libsemanage, so add to the component list, so that the test is run also on changes in libsemanage. Signed-off-by: Ondrej Mosnacek --- policycoreutils/semodule-rebuild-if-modules-changed/main.fmf | 1 + 1 file changed, 1 insertion(+) diff --git a/policycoreutils/semodule-rebuild-if-modules-changed/main.fmf b/policycoreutils/semodule-rebuild-if-modules-changed/main.fmf index a3191eb..c2dc056 100644 --- a/policycoreutils/semodule-rebuild-if-modules-changed/main.fmf +++ b/policycoreutils/semodule-rebuild-if-modules-changed/main.fmf @@ -5,6 +5,7 @@ description: | contact: Ondrej Mosnacek component: - policycoreutils + - libsemanage framework: beakerlib require: - policycoreutils From 2c82db3d51bda397b24c27f75e2e15038eb15dc0 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Fri, 24 Mar 2023 09:30:36 +0100 Subject: [PATCH 225/626] semodule-rebuild-if-modules-changed: fix RHEL version check (take 2) Rework the conditional so that the new part of the test runs everywhere except specified old version cases. Before this it wouldn't be run on Fedora, CentOS, or RHEL>=10. Signed-off-by: Ondrej Mosnacek --- .../semodule-rebuild-if-modules-changed/runtest.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/policycoreutils/semodule-rebuild-if-modules-changed/runtest.sh b/policycoreutils/semodule-rebuild-if-modules-changed/runtest.sh index 5e6063d..5347206 100755 --- a/policycoreutils/semodule-rebuild-if-modules-changed/runtest.sh +++ b/policycoreutils/semodule-rebuild-if-modules-changed/runtest.sh @@ -117,8 +117,8 @@ rlJournalStart "Force a rebuild to clean things up" rlPhaseEnd - if { rlIsRHEL 9 && rlIsRHEL '>=9.3'; } || \ - { rlIsRHEL 8 && rlIsRHEL '>=8.9'; } + if ! { rlIsRHEL 9 && rlIsRHEL '<9.3'; } && \ + ! { rlIsRHEL 8 && rlIsRHEL '<8.9'; } then rlPhaseStartTest "Disable dontaudit injected" rlLog "Inject disable_dontaudit flag into the store" From f76b1f779435213e3a55b0636e31d3fb368c7c75 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Fri, 24 Mar 2023 13:21:58 +0100 Subject: [PATCH 226/626] skip the rpmdb-migrate phases if the service is missing The rpmdb-migrate service is not available on all RHELs or Fedoras. To avoid unnecessary failures, the rpmdb-migrate test phases will be skipped if the service is not installed. --- selinux-policy/rpmdb-and-similar/runtest.sh | 2 ++ 1 file changed, 2 insertions(+) diff --git a/selinux-policy/rpmdb-and-similar/runtest.sh b/selinux-policy/rpmdb-and-similar/runtest.sh index b026c92..b1357f1 100755 --- a/selinux-policy/rpmdb-and-similar/runtest.sh +++ b/selinux-policy/rpmdb-and-similar/runtest.sh @@ -89,6 +89,7 @@ rlJournalStart rm -f ${OUTPUT_FILE} rlPhaseEnd + if [ -f /usr/lib/systemd/system/rpmdb-migrate.service ] ; then rlPhaseStartTest "bz#2164752" rlSEMatchPathCon "/usr/bin/rpm" "rpm_exec_t" rlSEMatchPathCon "/usr/lib/rpm/rpmdb_migrate" "rpmdb_exec_t" @@ -107,6 +108,7 @@ rlJournalStart rlRun "touch /var/lib/rpm/.migratedb" rlSEService - rpmdb-migrate - rpmdb_t "restart status stop status" 1 rlPhaseEnd + fi rlPhaseStartCleanup sleep 2 From e17c855d2ae3277d9c1422e6bfca0ef91d34136d Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 11 Apr 2023 16:54:40 +0200 Subject: [PATCH 227/626] move reliable downstream tests to upstream repo --- .../Makefile | 76 ++++++++ .../PURPOSE | 5 + .../main.fmf | 45 +++++ .../runtest.sh | 85 ++++++++ mcstrans/internal-examples-testsuite/Makefile | 65 +++++++ mcstrans/internal-examples-testsuite/PURPOSE | 5 + mcstrans/internal-examples-testsuite/main.fmf | 37 ++++ .../internal-examples-testsuite/runtest.sh | 181 ++++++++++++++++++ .../Makefile | 67 +++++++ .../PURPOSE | 5 + .../main.fmf | 38 ++++ .../runtest.sh | 87 +++++++++ .../secolor.conf | 24 +++ 13 files changed, 720 insertions(+) create mode 100644 mcstrans/bz442327-setfscreatecon-with-invalid-context/Makefile create mode 100644 mcstrans/bz442327-setfscreatecon-with-invalid-context/PURPOSE create mode 100644 mcstrans/bz442327-setfscreatecon-with-invalid-context/main.fmf create mode 100755 mcstrans/bz442327-setfscreatecon-with-invalid-context/runtest.sh create mode 100644 mcstrans/internal-examples-testsuite/Makefile create mode 100644 mcstrans/internal-examples-testsuite/PURPOSE create mode 100644 mcstrans/internal-examples-testsuite/main.fmf create mode 100755 mcstrans/internal-examples-testsuite/runtest.sh create mode 100644 mcstrans/mcstrans-daemon-segfaults-when-using-secon-C/Makefile create mode 100644 mcstrans/mcstrans-daemon-segfaults-when-using-secon-C/PURPOSE create mode 100644 mcstrans/mcstrans-daemon-segfaults-when-using-secon-C/main.fmf create mode 100755 mcstrans/mcstrans-daemon-segfaults-when-using-secon-C/runtest.sh create mode 100644 mcstrans/mcstrans-daemon-segfaults-when-using-secon-C/secolor.conf diff --git a/mcstrans/bz442327-setfscreatecon-with-invalid-context/Makefile b/mcstrans/bz442327-setfscreatecon-with-invalid-context/Makefile new file mode 100644 index 0000000..ae8a25f --- /dev/null +++ b/mcstrans/bz442327-setfscreatecon-with-invalid-context/Makefile @@ -0,0 +1,76 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/mcstrans/Regression/bz442327-setfscreatecon-with-invalid-context +# Description: setfscreatecon with invalid context can mistakenly succeed +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2009 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/mcstrans/Regression/bz442327-setfscreatecon-with-invalid-context +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: setfscreatecon with invalid context can mistakenly succeed" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 5m" >> $(METADATA) + @echo "RunFor: mcstrans" >> $(METADATA) + @echo "Requires: mcstrans" >> $(METADATA) + @echo "Requires: /usr/sbin/service" >> $(METADATA) + @echo "Requires: selinux-policy" >> $(METADATA) + @echo "Requires: selinux-policy-targeted" >> $(METADATA) + @echo "Requires: libselinux" >> $(METADATA) + @echo "Requires: libselinux-utils" >> $(METADATA) + @echo "Requires: mktemp" >> $(METADATA) + @echo "Requires: grep" >> $(METADATA) + @echo "Requires: audit" >> $(METADATA) + @echo "Requires: policycoreutils" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Releases: -RHEL4" >> $(METADATA) + @echo "Bug: 442327" >> $(METADATA) # Fedora 9 + + rhts-lint $(METADATA) + diff --git a/mcstrans/bz442327-setfscreatecon-with-invalid-context/PURPOSE b/mcstrans/bz442327-setfscreatecon-with-invalid-context/PURPOSE new file mode 100644 index 0000000..4ecdd5e --- /dev/null +++ b/mcstrans/bz442327-setfscreatecon-with-invalid-context/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/mcstrans/Regression/bz442327-setfscreatecon-with-invalid-context +Author: Milos Malik + +Description: setfscreatecon with invalid context can mistakenly succeed + diff --git a/mcstrans/bz442327-setfscreatecon-with-invalid-context/main.fmf b/mcstrans/bz442327-setfscreatecon-with-invalid-context/main.fmf new file mode 100644 index 0000000..ce3a355 --- /dev/null +++ b/mcstrans/bz442327-setfscreatecon-with-invalid-context/main.fmf @@ -0,0 +1,45 @@ +summary: setfscreatecon with invalid context can mistakenly succeed +description: |+ + Description: setfscreatecon with invalid context can mistakenly succeed + +contact: Milos Malik +component: + - mcstrans +test: ./runtest.sh +framework: beakerlib +recommend: + - mcstrans + - /usr/sbin/service + - selinux-policy + - selinux-policy-targeted + - libselinux + - libselinux-utils + - mktemp + - grep + - audit + - policycoreutils +environment: + AVC_ERROR: +no_avc_check +duration: 5m +enabled: true +tag: + - CI-Tier-1 + - NoRHEL4 + - TIPpass_Security + - Tier3 + - Tier3se + - f31friendly + - f32friendly + - failinrhel8ci + - targeted +tier: '3' +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=442327 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=800470 +adjust: + - enabled: false + when: distro == rhel-4 + continue: false +extra-nitrate: TC#0062266 +extra-summary: /CoreOS/mcstrans/Regression/bz442327-setfscreatecon-with-invalid-context +extra-task: /CoreOS/mcstrans/Regression/bz442327-setfscreatecon-with-invalid-context diff --git a/mcstrans/bz442327-setfscreatecon-with-invalid-context/runtest.sh b/mcstrans/bz442327-setfscreatecon-with-invalid-context/runtest.sh new file mode 100755 index 0000000..6a9cbc3 --- /dev/null +++ b/mcstrans/bz442327-setfscreatecon-with-invalid-context/runtest.sh @@ -0,0 +1,85 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/mcstrans/Regression/bz442327-setfscreatecon-with-invalid-context +# Description: setfscreatecon with invalid context can mistakenly succeed +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2009 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include rhts environment +. /usr/share/beakerlib/beakerlib.sh + +PACKAGE="mcstrans" + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm ${PACKAGE} + rlAssertRpm selinux-policy + rlAssertRpm libselinux + OUTPUT_FILE=`mktemp` + if rlIsRHEL 5 6 ; then + rlServiceStop mcstrans + else + rlServiceStop mcstransd + fi + + rlRun "setenforce 1" + rlRun "sestatus" + START_DATE_TIME=`date "+%m/%d/%Y %T"` + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "bz#442327" + if rlIsRHEL 5 6 ; then + rlRun "service mcstrans start" + else + rlRun "service mcstransd start" + fi + sleep 1 + rlRun "for I in \`seq 1 1 5000\` ; do mkdir d --context=xyz 2>/dev/null && { t=X ; rmdir d ; } || t=. ; printf \$t ; done >& ${OUTPUT_FILE}" + rlRun "grep -ci x ${OUTPUT_FILE}" 1 + sleep 1 + if rlIsRHEL 5 6 ; then + rlRun "service mcstrans stop" + else + rlRun "service mcstransd stop" + fi + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlRun "ausearch -m AVC -m USER_AVC -ts ${START_DATE_TIME} > ${OUTPUT_FILE}" 0,1 + LINE_COUNT=`grep 'type=AVC' ${OUTPUT_FILE} | grep -v 'type=AVC.*denied.*mac_admin.*mkdir' | wc -l` + rlAssert0 "number of unexpected AVCs in ${OUTPUT_FILE} should be 0" ${LINE_COUNT} + + if rlIsRHEL 5 6 ; then + rlServiceRestore mcstrans + else + rlServiceRestore mcstransd + fi + + rm -f ${OUTPUT_FILE} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/mcstrans/internal-examples-testsuite/Makefile b/mcstrans/internal-examples-testsuite/Makefile new file mode 100644 index 0000000..b6fc4e1 --- /dev/null +++ b/mcstrans/internal-examples-testsuite/Makefile @@ -0,0 +1,65 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/mcstrans/Sanity/internal-examples-testsuite +# Description: Wrapper for internal examples used as testsuite +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2016 Red Hat, Inc. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/mcstrans/Sanity/internal-examples-testsuite +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + test -x runtest.sh || chmod a+x runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: Wrapper for internal examples used as testsuite" >> $(METADATA) + @echo "Type: Sanity" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: mcstrans" >> $(METADATA) + @echo "Requires: mcstrans selinux-policy-targeted libselinux-python sed platform-python-devel python3-libselinux /usr/sbin/service" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5" >> $(METADATA) + @echo "Bug: 1656304" >> $(METADATA) # RHEL-8 + + rhts-lint $(METADATA) + diff --git a/mcstrans/internal-examples-testsuite/PURPOSE b/mcstrans/internal-examples-testsuite/PURPOSE new file mode 100644 index 0000000..85fecad --- /dev/null +++ b/mcstrans/internal-examples-testsuite/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/mcstrans/Sanity/internal-examples-testsuite +Author: Milos Malik + +Internal examples and scripts are used as mcstrans testsuite. + diff --git a/mcstrans/internal-examples-testsuite/main.fmf b/mcstrans/internal-examples-testsuite/main.fmf new file mode 100644 index 0000000..85aea97 --- /dev/null +++ b/mcstrans/internal-examples-testsuite/main.fmf @@ -0,0 +1,37 @@ +summary: Wrapper for internal examples used as testsuite +description: |+ + Internal examples and scripts are used as mcstrans testsuite. + +contact: Milos Malik +component: + - mcstrans +test: ./runtest.sh +framework: beakerlib +recommend: + - mcstrans + - selinux-policy-targeted + - libselinux-python + - sed + - platform-python-devel + - python3-libselinux + - /usr/sbin/service +duration: 10m +enabled: true +tier: 1 +tag: + - CI-Tier-1 + - NoRHEL4 + - NoRHEL5 + - TIPpass_Security + - f32friendly + - f33friendly + - targeted +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1656304 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5 + continue: false +extra-nitrate: TC#0520362 +extra-summary: /CoreOS/mcstrans/Sanity/internal-examples-testsuite +extra-task: /CoreOS/mcstrans/Sanity/internal-examples-testsuite diff --git a/mcstrans/internal-examples-testsuite/runtest.sh b/mcstrans/internal-examples-testsuite/runtest.sh new file mode 100755 index 0000000..01ae3e3 --- /dev/null +++ b/mcstrans/internal-examples-testsuite/runtest.sh @@ -0,0 +1,181 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/mcstrans/Sanity/internal-examples-testsuite +# Description: Wrapper for internal examples used as testsuite +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2016 Red Hat, Inc. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="mcstrans" +if rlIsRHEL 5 6 ; then + SERVICE_NAME="mcstrans" +else + SERVICE_NAME="mcstransd" +fi + +if rlIsRHEL 5 6 7 ; then + PYTHON="python2" + SERVICE_START_LIMIT="[Service] +StartLimitIntervalSec=0 +StartLimitBurst=50 +" +else + PYTHON="python3" + SERVICE_START_LIMIT="[Unit] +StartLimitIntervalSec=0 +" +fi + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm ${PACKAGE} + rlAssertRpm selinux-policy-targeted + rlRun "mkdir -p /etc/systemd/system/mcstrans.service.d/" + rlRun "mkdir -p /etc/systemd/system/mcstransd.service.d/" + echo "${SERVICE_START_LIMIT}" > /etc/systemd/system/mcstrans.service.d/limit.conf + rlRun "cp /etc/systemd/system/mcstrans.service.d/limit.conf /etc/systemd/system/mcstransd.service.d/limit.conf" + rlRun "systemctl daemon-reload" + rlServiceStop ${SERVICE_NAME} + rlRun "mkdir -p /etc/selinux/targeted/setrans.d" + rlFileBackup /etc/selinux/targeted/secolor.conf + rlFileBackup /etc/selinux/targeted/setrans.conf + rlFileBackup /usr/share/mcstrans/util/mlscolor-test + rlFileBackup /usr/share/mcstrans/util/mlstrans-test + rlRun "sed -i 's/^verbose.*$/verbose=1/' /usr/share/mcstrans/util/mlscolor-test" + rlRun "sed -i 's/^verbose.*$/verbose=1/' /usr/share/mcstrans/util/mlstrans-test" + if ! rlIsRHEL 5 6 7 && ! rlIsFedora ; then + # convert the python2 scripts to python3 syntax + rlRun "2to3 -w --no-diffs /usr/share/mcstrans/util/mlscolor-test" + rlRun "2to3 -w --no-diffs /usr/share/mcstrans/util/mlstrans-test" + fi + rlPhaseEnd + + rlPhaseStartTest "default" + rlRun "pushd /usr/share/mcstrans/examples/default" + rlRun "rm -f /etc/selinux/targeted/secolor.conf" + rlRun "cp -f setrans.conf /etc/selinux/targeted/setrans.conf" + rlRun "service ${SERVICE_NAME} restart" + sleep 1 + rlRun "service ${SERVICE_NAME} status" + rlRun "${PYTHON} /usr/share/mcstrans/util/mlstrans-test default.test" + rlRun "popd" + rlPhaseEnd + + rlPhaseStartTest "include" + rlRun "pushd /usr/share/mcstrans/examples/include" + rlRun "rm -f /etc/selinux/targeted/secolor.conf" + rlRun "cp -f setrans.conf /etc/selinux/targeted/setrans.conf" + rlRun "sed -i 's/mls/targeted/' /etc/selinux/targeted/setrans.conf" + rlRun "cp -f setrans.d/* /etc/selinux/targeted/setrans.d" + rlRun "service ${SERVICE_NAME} restart" + sleep 1 + rlRun "service ${SERVICE_NAME} status" + rlRun "${PYTHON} /usr/share/mcstrans/util/mlstrans-test default.test" + rlRun "popd" + rlPhaseEnd + + rlPhaseStartTest "non-mls-color" + rlRun "pushd /usr/share/mcstrans/examples/non-mls-color" + rlRun "cp -f secolor.conf /etc/selinux/targeted/secolor.conf" + rlRun "rm -f /etc/selinux/targeted/setrans.conf" + rlRun "touch /etc/selinux/targeted/setrans.conf" + rlRun "service ${SERVICE_NAME} restart" + sleep 1 + rlRun "service ${SERVICE_NAME} status" + rlRun "${PYTHON} /usr/share/mcstrans/util/mlscolor-test non-mls.color" + rlRun "popd" + rlPhaseEnd + + rlPhaseStartTest "urcsts" + rlRun "pushd /usr/share/mcstrans/examples/urcsts" + rlRun "cp -f secolor.conf /etc/selinux/targeted/secolor.conf" + rlRun "cp -f setrans.conf /etc/selinux/targeted/setrans.conf" + rlRun "service ${SERVICE_NAME} restart" + sleep 1 + rlRun "service ${SERVICE_NAME} status" + #rlRun "${PYTHON} /usr/share/mcstrans/util/mlscolor-test urcsts.color" + rlRun "${PYTHON} /usr/share/mcstrans/util/mlstrans-test urcsts.test" + rlRun "popd" + rlPhaseEnd + + rlPhaseStartTest "urcsts-via-include" + rlRun "pushd /usr/share/mcstrans/examples/urcsts-via-include" + rlRun "cp -f secolor.conf /etc/selinux/targeted/secolor.conf" + rlRun "cp -f setrans.conf /etc/selinux/targeted/setrans.conf" + rlRun "sed -i 's/mls/targeted/' /etc/selinux/targeted/setrans.conf" + rlRun "rm -f /etc/selinux/targeted/setrans.d/*" + rlRun "cp setrans.d/* /etc/selinux/targeted/setrans.d" + rlRun "service ${SERVICE_NAME} restart" + sleep 1 + rlRun "service ${SERVICE_NAME} status" + #rlRun "${PYTHON} /usr/share/mcstrans/util/mlscolor-test urcsts.color" + rlRun "${PYTHON} /usr/share/mcstrans/util/mlstrans-test urcsts.test" + rlRun "popd" + rlPhaseEnd + + if ! rlIsRHEL 5 6 ; then + rlPhaseStartTest "nato" + rlRun "pushd /usr/share/mcstrans/examples/nato" + rlRun "rm -f /etc/selinux/targeted/secolor.conf" + rlRun "cp -f setrans.conf /etc/selinux/targeted/setrans.conf" + rlRun "sed -i 's/mls/targeted/' /etc/selinux/targeted/setrans.conf" + rlRun "rm -f /etc/selinux/targeted/setrans.d/*" + rlRun "cp setrans.d/* /etc/selinux/targeted/setrans.d" + rlRun "service ${SERVICE_NAME} restart" + sleep 1 + rlRun "service ${SERVICE_NAME} status" + ${PYTHON} /usr/share/mcstrans/util/mlstrans-test nato.test + rlRun "${PYTHON} /usr/share/mcstrans/util/mlstrans-test nato.test" + rlRun "popd" + rlPhaseEnd + + rlPhaseStartTest "pipes" + rlRun "pushd /usr/share/mcstrans/examples/pipes" + rlRun "rm -f /etc/selinux/targeted/secolor.conf" + rlRun "cp -f setrans.conf /etc/selinux/targeted/setrans.conf" + rlRun "sed -i 's/mls/targeted/' /etc/selinux/targeted/setrans.conf" + rlRun "rm -f /etc/selinux/targeted/setrans.d/*" + rlRun "cp setrans.d/* /etc/selinux/targeted/setrans.d" + rlRun "service ${SERVICE_NAME} restart" + sleep 1 + rlRun "service ${SERVICE_NAME} status" + ${PYTHON} /usr/share/mcstrans/util/mlstrans-test pipes.test + rlRun "${PYTHON} /usr/share/mcstrans/util/mlstrans-test pipes.test" + rlRun "popd" + rlPhaseEnd + fi + + rlPhaseStartCleanup + rlRun "rm -rf /etc/systemd/system/mcstrans.service.d/" + rlRun "rm -rf /etc/systemd/system/mcstransd.service.d/" + rlRun "rm -f /etc/selinux/targeted/secolor.conf /etc/selinux/targeted/setrans.conf" + rlRun "rm -rf /etc/selinux/targeted/setrans.d" + rlFileRestore + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/mcstrans/mcstrans-daemon-segfaults-when-using-secon-C/Makefile b/mcstrans/mcstrans-daemon-segfaults-when-using-secon-C/Makefile new file mode 100644 index 0000000..dc15dc2 --- /dev/null +++ b/mcstrans/mcstrans-daemon-segfaults-when-using-secon-C/Makefile @@ -0,0 +1,67 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/mcstrans/Regression/mcstrans-daemon-segfaults-when-using-secon-C +# Description: mcstrans daemon segfaults when secon -C asks for incomplete context +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2016 Red Hat, Inc. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/mcstrans/Regression/mcstrans-daemon-segfaults-when-using-secon-C +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE secolor.conf + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + test -x runtest.sh || chmod a+x runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: mcstrans daemon segfaults when secon -C asks for incomplete context" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: mcstrans" >> $(METADATA) + @echo "Requires: mcstrans selinux-policy-targeted policycoreutils libselinux-python python3-libselinux /usr/sbin/service" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5" >> $(METADATA) + @echo "Bug: 1315996" >> $(METADATA) # RHEL-7 + @echo "Bug: 1316680" >> $(METADATA) # RHEL-6 + @echo "Bug: 1699784" >> $(METADATA) # RHEL-8 + + rhts-lint $(METADATA) + diff --git a/mcstrans/mcstrans-daemon-segfaults-when-using-secon-C/PURPOSE b/mcstrans/mcstrans-daemon-segfaults-when-using-secon-C/PURPOSE new file mode 100644 index 0000000..49f8afd --- /dev/null +++ b/mcstrans/mcstrans-daemon-segfaults-when-using-secon-C/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/mcstrans/Regression/mcstrans-daemon-segfaults-when-using-secon-C +Author: Milos Malik + +Description: mcstrans daemon segfaults when secon -C asks for incomplete context + diff --git a/mcstrans/mcstrans-daemon-segfaults-when-using-secon-C/main.fmf b/mcstrans/mcstrans-daemon-segfaults-when-using-secon-C/main.fmf new file mode 100644 index 0000000..149799d --- /dev/null +++ b/mcstrans/mcstrans-daemon-segfaults-when-using-secon-C/main.fmf @@ -0,0 +1,38 @@ +summary: mcstrans daemon segfaults when secon -C asks for incomplete context +description: |+ + Description: mcstrans daemon segfaults when secon -C asks for incomplete context + +contact: Milos Malik +component: + - mcstrans +test: ./runtest.sh +framework: beakerlib +recommend: + - mcstrans + - selinux-policy-targeted + - policycoreutils + - libselinux-python + - python3-libselinux + - /usr/sbin/service +duration: 10m +enabled: true +tier: 1 +tag: + - CI-Tier-1 + - NoRHEL4 + - NoRHEL5 + - TIPpass_Security + - f32friendly + - f33friendly + - targeted +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1315996 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1316680 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1699784 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5 + continue: false +extra-nitrate: TC#0520380 +extra-summary: /CoreOS/mcstrans/Regression/mcstrans-daemon-segfaults-when-using-secon-C +extra-task: /CoreOS/mcstrans/Regression/mcstrans-daemon-segfaults-when-using-secon-C diff --git a/mcstrans/mcstrans-daemon-segfaults-when-using-secon-C/runtest.sh b/mcstrans/mcstrans-daemon-segfaults-when-using-secon-C/runtest.sh new file mode 100755 index 0000000..5b089dc --- /dev/null +++ b/mcstrans/mcstrans-daemon-segfaults-when-using-secon-C/runtest.sh @@ -0,0 +1,87 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/mcstrans/Regression/mcstrans-daemon-segfaults-when-using-secon-C +# Description: mcstrans daemon segfaults when secon -C asks for incomplete context +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2016 Red Hat, Inc. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="mcstrans" +if rlIsRHEL 6 ; then + SERVICE_NAME="mcstrans" +else # RHEL-7 and above + SERVICE_NAME="mcstransd" +fi +if rlIsRHEL 6 7 ; then + if which python3 >& /dev/null ; then + PYTHON="python3" + else + PYTHON="python2" + fi +else # RHEL-8 + if which python3 >& /dev/null ; then + PYTHON="python3" + else + PYTHON="/usr/libexec/platform-python" + fi +fi + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm ${PACKAGE} + rlAssertRpm policycoreutils + rlAssertRpm selinux-policy-targeted + rlServiceStop ${SERVICE_NAME} + rlFileBackup /etc/selinux/targeted/secolor.conf + rlPhaseEnd + + rlPhaseStartTest "bz#1315996 + bz#1316680 + bz#1699784" + rlRun "dmesg > before-secon-C.txt" + rlRun "cp -f secolor.conf /etc/selinux/targeted/" + for CONTEXT in ":::" "xyz_u:xyz_r:xyz_t:" "user_u:" "user_u:user_r:" "user_u:user_r:user_t:" ; do + rlRun "service ${SERVICE_NAME} restart" + sleep 1 + rlRun "service ${SERVICE_NAME} status" + set -x + echo -en "import selinux\nselinux.selinux_raw_context_to_color(\"${CONTEXT}\")\n" | ${PYTHON} + set +x + # rlRun "secon -C ${CONTEXT}" 0,1 + sleep 1 + rlRun "service ${SERVICE_NAME} status" + done + rlRun "dmesg > after-secon-C.txt" + rlRun "diff before-secon-C.txt after-secon-C.txt | grep \"mcstransd.*segfault\"" 1 + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "rm -f before-secon-C.txt after-secon-C.txt" + rlRun "rm -f /etc/selinux/targeted/secolor.conf" + rlFileRestore + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/mcstrans/mcstrans-daemon-segfaults-when-using-secon-C/secolor.conf b/mcstrans/mcstrans-daemon-segfaults-when-using-secon-C/secolor.conf new file mode 100644 index 0000000..17abaaf --- /dev/null +++ b/mcstrans/mcstrans-daemon-segfaults-when-using-secon-C/secolor.conf @@ -0,0 +1,24 @@ +color black = #000000 +color green = #008000 +color yellow = #ffff00 +color blue = #0000ff +color white = #ffffff +color red = #ff0000 +color orange = #ffa500 +color tan = #d2b48c + +user unconfined_u = #ff0000 green +role unconfined_r = red #ffffff +type unconfined_t = red orange +user user_u = black green +role user_r = white black +type user_t = tan red +user xguest_u = black yellow +role xguest_r = black red +type xguest_t = black green +user sysadm_u = white black +range s0:c0.c1023 = black white +user * = black white +role * = black white +type * = black white + From e3b384c85feb269e00923f29fd0792635933fba3 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Wed, 19 Apr 2023 13:58:25 +0200 Subject: [PATCH 228/626] enable the SSH login via password for common users Some of the automated tests require the SSH password authentication to be enabled in order to succeed. The following file is added into /etc/ssh/sshd_config.d/ directory to enable it: * /etc/ssh/sshd_config.d/001-enable-password.conf --- selinux-policy/Library/common/lib.sh | 1 + selinux-policy/boltd-and-similar/runtest.sh | 1 + selinux-policy/bz481628-send-msg-to-dbus/runtest.sh | 4 ++-- selinux-policy/colord-and-similar/runtest.sh | 1 + selinux-policy/cups-lpd-and-similar/runtest.sh | 1 - selinux-policy/cups-pdf-and-similar/runtest.sh | 2 +- selinux-policy/dmidecode-and-similar/runtest.sh | 2 ++ selinux-policy/fwupd-and-similar/runtest.sh | 1 + selinux-policy/journalctl-and-similar/runtest.sh | 3 ++- selinux-policy/pam_console-and-related/runtest.sh | 4 +--- selinux-policy/pam_limits-and-related/runtest.sh | 1 + selinux-policy/pam_timestamp-and-related/runtest.sh | 4 +--- selinux-policy/ping-and-similar/runtest.sh | 4 +--- selinux-policy/policykit-general/runtest.sh | 1 + selinux-policy/systemd-notify-and-similar/runtest.sh | 2 ++ selinux-policy/systemd-userdbd-and-similar/runtest.sh | 3 +-- 16 files changed, 19 insertions(+), 16 deletions(-) diff --git a/selinux-policy/Library/common/lib.sh b/selinux-policy/Library/common/lib.sh index 4bcb8ee..af691e0 100755 --- a/selinux-policy/Library/common/lib.sh +++ b/selinux-policy/Library/common/lib.sh @@ -1289,6 +1289,7 @@ function rlSEConfigureSSH () { rlFileBackup /etc/ssh/sshd_config rlRun "sed -i 's/^.*PermitRootLogin.*$/PermitRootLogin yes/' /etc/ssh/sshd_config" rlRun "sed -i 's/^.*PasswordAuthentication.*$/PasswordAuthentication yes/' /etc/ssh/sshd_config" + rlRun "echo 'PasswordAuthentication yes' > /etc/ssh/sshd_config.d/001-enable-password.conf" rlRun "service sshd restart" } diff --git a/selinux-policy/boltd-and-similar/runtest.sh b/selinux-policy/boltd-and-similar/runtest.sh index 682646f..f3c9a37 100755 --- a/selinux-policy/boltd-and-similar/runtest.sh +++ b/selinux-policy/boltd-and-similar/runtest.sh @@ -50,6 +50,7 @@ rlJournalStart rlServiceStop ${SERVICE_NAME} rlFileBackup /etc/shadow + rlSEConfigureSSH rlSESetEnforce rlSEStatus diff --git a/selinux-policy/bz481628-send-msg-to-dbus/runtest.sh b/selinux-policy/bz481628-send-msg-to-dbus/runtest.sh index bf6648e..c0e7719 100755 --- a/selinux-policy/bz481628-send-msg-to-dbus/runtest.sh +++ b/selinux-policy/bz481628-send-msg-to-dbus/runtest.sh @@ -50,6 +50,8 @@ rlJournalStart rlAssertRpm ${PACKAGE}-targeted rlAssertRpm ${SERVICE_PACKAGE} + rlSEConfigureSSH + rlSESetEnforce rlSEStatus rlSESetTimestamp @@ -129,8 +131,6 @@ rlJournalStart rlPhaseEnd rlPhaseStartTest "real scenario -- user session service" - rlSEConfigureSSH - rlRun "setsebool ssh_sysadm_login on" rlRun "setsebool selinuxuser_tcp_server on" CREATED_USERS="" diff --git a/selinux-policy/colord-and-similar/runtest.sh b/selinux-policy/colord-and-similar/runtest.sh index badb931..4d7aece 100755 --- a/selinux-policy/colord-and-similar/runtest.sh +++ b/selinux-policy/colord-and-similar/runtest.sh @@ -48,6 +48,7 @@ rlJournalStart rlServiceStop ${SERVICE_NAME} rlFileBackup /etc/shadow + rlSEConfigureSSH rlSESetEnforce rlSEStatus diff --git a/selinux-policy/cups-lpd-and-similar/runtest.sh b/selinux-policy/cups-lpd-and-similar/runtest.sh index 1ada2fc..6b3952d 100755 --- a/selinux-policy/cups-lpd-and-similar/runtest.sh +++ b/selinux-policy/cups-lpd-and-similar/runtest.sh @@ -30,7 +30,6 @@ . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" -ROOT_PASSWORD="redhat" FILE_PATH="/usr/lib/cups/daemon/cups-lpd" FILE_CONTEXT="cupsd_lpd_exec_t" SERVICE_PACKAGE="cups-lpd" diff --git a/selinux-policy/cups-pdf-and-similar/runtest.sh b/selinux-policy/cups-pdf-and-similar/runtest.sh index a8d6c77..149bc38 100755 --- a/selinux-policy/cups-pdf-and-similar/runtest.sh +++ b/selinux-policy/cups-pdf-and-similar/runtest.sh @@ -30,7 +30,6 @@ . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" -ROOT_PASSWORD="redhat" FILE_PATH="/usr/lib/cups/backend/cups-pdf" FILE_CONTEXT="cups_pdf_exec_t" SERVICE_PACKAGE="cups-pdf" @@ -56,6 +55,7 @@ rlJournalStart rlServiceStart ${SERVICE_NAME} rlFileBackup /etc/shadow + rlSEConfigureSSH rlSESetEnforce rlSEStatus diff --git a/selinux-policy/dmidecode-and-similar/runtest.sh b/selinux-policy/dmidecode-and-similar/runtest.sh index e6189f3..0c18c3b 100755 --- a/selinux-policy/dmidecode-and-similar/runtest.sh +++ b/selinux-policy/dmidecode-and-similar/runtest.sh @@ -41,6 +41,8 @@ rlJournalStart rlAssertRpm ${PACKAGE}-targeted rlAssertRpm dmidecode + rlSEConfigureSSH + rlSESetEnforce rlSEStatus rlSESetTimestamp diff --git a/selinux-policy/fwupd-and-similar/runtest.sh b/selinux-policy/fwupd-and-similar/runtest.sh index e5ce44d..ae0fac8 100755 --- a/selinux-policy/fwupd-and-similar/runtest.sh +++ b/selinux-policy/fwupd-and-similar/runtest.sh @@ -50,6 +50,7 @@ rlJournalStart rlServiceStop ${SERVICE_NAME} rlFileBackup /etc/shadow + rlSEConfigureSSH rlSESetEnforce rlSEStatus diff --git a/selinux-policy/journalctl-and-similar/runtest.sh b/selinux-policy/journalctl-and-similar/runtest.sh index c60084c..ac96c64 100755 --- a/selinux-policy/journalctl-and-similar/runtest.sh +++ b/selinux-policy/journalctl-and-similar/runtest.sh @@ -33,7 +33,6 @@ PACKAGE="selinux-policy" FILE_PATH="/usr/bin/journalctl" FILE_CONTEXT="journalctl_exec_t" SERVICE_PACKAGE="systemd" -SERVICE_NAME="" PROCESS_NAME="journalctl" PROCESS_CONTEXT="journalctl_t" ALLOWED_USERS=${ALLOWED_USERS:-"staff_u user_u sysadm_u unconfined_u"} @@ -47,6 +46,8 @@ rlJournalStart rlAssertRpm ${PACKAGE}-targeted rlAssertRpm ${SERVICE_PACKAGE} + rlSEConfigureSSH + rlSESetEnforce rlSEStatus rlSESetTimestamp diff --git a/selinux-policy/pam_console-and-related/runtest.sh b/selinux-policy/pam_console-and-related/runtest.sh index 812c07c..05c8796 100755 --- a/selinux-policy/pam_console-and-related/runtest.sh +++ b/selinux-policy/pam_console-and-related/runtest.sh @@ -30,7 +30,6 @@ . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" -ROOT_PASSWORD="redhat" SERVICE_PACKAGE="pam" if rlIsRHEL 7 ; then DENIED_USERS=${DENIED_USERS:-"staff_u"} @@ -49,6 +48,7 @@ rlJournalStart rlAssertRpm ${SERVICE_PACKAGE} rlFileBackup /etc/shadow + rlSEConfigureSSH rlSESetEnforce rlSEStatus @@ -76,8 +76,6 @@ rlJournalStart fi rlPhaseStartTest "real scenario -- confined users" - rlSEConfigureSSH - rlRun "setsebool ssh_sysadm_login on" rlLog "configuration says not to test SELinux users: ${DENIED_USERS}" for SELINUX_USER in ${ALLOWED_USERS} ; do diff --git a/selinux-policy/pam_limits-and-related/runtest.sh b/selinux-policy/pam_limits-and-related/runtest.sh index b7a03ff..da513df 100755 --- a/selinux-policy/pam_limits-and-related/runtest.sh +++ b/selinux-policy/pam_limits-and-related/runtest.sh @@ -44,6 +44,7 @@ rlJournalStart rlFileBackup /etc/shadow rlFileBackup /etc/security/limits.conf + rlSEConfigureSSH rlSESetEnforce rlSEStatus diff --git a/selinux-policy/pam_timestamp-and-related/runtest.sh b/selinux-policy/pam_timestamp-and-related/runtest.sh index f1a7b86..22521a0 100755 --- a/selinux-policy/pam_timestamp-and-related/runtest.sh +++ b/selinux-policy/pam_timestamp-and-related/runtest.sh @@ -30,7 +30,6 @@ . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" -ROOT_PASSWORD="redhat" SERVICE_PACKAGE="pam" DENIED_USERS=${DENIED_USERS:-"guest_u xguest_u"} ALLOWED_USERS=${ALLOWED_USERS:-"staff_u user_u sysadm_u unconfined_u"} @@ -46,6 +45,7 @@ rlJournalStart rlFileBackup /etc/shadow rlFileBackup ${TIMESTAMP_DIR}/_pam_timestamp_key + rlSEConfigureSSH rlSESetEnforce rlSEStatus @@ -69,8 +69,6 @@ rlJournalStart fi rlPhaseStartTest "real scenario -- confined users" - rlSEConfigureSSH - rlRun "setsebool ssh_sysadm_login on" rlRun "mkdir -p ${TIMESTAMP_DIR}" rlRun "touch ${TIMESTAMP_DIR}/_pam_timestamp_key" diff --git a/selinux-policy/ping-and-similar/runtest.sh b/selinux-policy/ping-and-similar/runtest.sh index 6262122..004b259 100755 --- a/selinux-policy/ping-and-similar/runtest.sh +++ b/selinux-policy/ping-and-similar/runtest.sh @@ -30,7 +30,6 @@ . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" -ROOT_PASSWORD="redhat" FILE_PATH="/bin/ping" FILE_CONTEXT="ping_exec_t" SERVICE_PACKAGE="iputils" @@ -46,6 +45,7 @@ rlJournalStart rlAssertRpm ${SERVICE_PACKAGE} rlFileBackup /etc/shadow + rlSEConfigureSSH rlSESetEnforce rlSEStatus @@ -89,8 +89,6 @@ rlJournalStart # this phase is useful if you want to run some commands under confined users rlPhaseStartTest "real scenario -- confined users" - rlSEConfigureSSH - rlRun "setsebool ssh_sysadm_login on" rlRun "setsebool user_ping on" for SELINUX_USER in staff_u user_u sysadm_u unconfined_u ; do diff --git a/selinux-policy/policykit-general/runtest.sh b/selinux-policy/policykit-general/runtest.sh index 9775454..e89eefc 100755 --- a/selinux-policy/policykit-general/runtest.sh +++ b/selinux-policy/policykit-general/runtest.sh @@ -51,6 +51,7 @@ rlJournalStart rlServiceStop ${SERVICE_NAME} rlFileBackup /etc/shadow + rlSEConfigureSSH rlSESetEnforce rlSEStatus diff --git a/selinux-policy/systemd-notify-and-similar/runtest.sh b/selinux-policy/systemd-notify-and-similar/runtest.sh index a0dde3d..59a2908 100755 --- a/selinux-policy/systemd-notify-and-similar/runtest.sh +++ b/selinux-policy/systemd-notify-and-similar/runtest.sh @@ -47,6 +47,8 @@ rlJournalStart rlAssertRpm ${PACKAGE}-targeted rlAssertRpm ${SERVICE_PACKAGE} + rlSEConfigureSSH + rlSESetEnforce rlSEStatus rlSESetTimestamp diff --git a/selinux-policy/systemd-userdbd-and-similar/runtest.sh b/selinux-policy/systemd-userdbd-and-similar/runtest.sh index f7cf06f..5df13af 100755 --- a/selinux-policy/systemd-userdbd-and-similar/runtest.sh +++ b/selinux-policy/systemd-userdbd-and-similar/runtest.sh @@ -56,6 +56,7 @@ rlJournalStart rlServiceStop ${SERVICE_NAME} rlFileBackup /etc/shadow + rlSEConfigureSSH rlSESetEnforce rlSEStatus @@ -80,8 +81,6 @@ rlJournalStart fi rlPhaseStartTest "real scenario -- confined users" - rlSEConfigureSSH - rlRun "setsebool ssh_sysadm_login on" rlRun "setsebool selinuxuser_tcp_server on" rlLog "configuration says not to test SELinux users: ${DENIED_USERS}" From d25c4ccdfca94f69b453cfba7b14c44ddbfa2941 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Fri, 9 Oct 2020 10:22:01 +0200 Subject: [PATCH 229/626] add new test which covers various virtualization daemons Recently, the libvirt daemon was restructured into several smaller daemons. Each of them will be confined by SELinux. This test case should test if these smaller daemons cooperate with SELinux policy and looks for any SELinux denials. This TC runs only basic scenarios like start, restart, stop on various virtualization services. It also tests SELinux contexts of those virtualization processes and their file context patterns. --- .../virtualization-daemons/Makefile | 68 ++++++++++ selinux-policy/virtualization-daemons/PURPOSE | 6 + .../virtualization-daemons/main.fmf | 48 +++++++ .../virtualization-daemons/runtest.sh | 120 ++++++++++++++++++ 4 files changed, 242 insertions(+) create mode 100644 selinux-policy/virtualization-daemons/Makefile create mode 100644 selinux-policy/virtualization-daemons/PURPOSE create mode 100644 selinux-policy/virtualization-daemons/main.fmf create mode 100755 selinux-policy/virtualization-daemons/runtest.sh diff --git a/selinux-policy/virtualization-daemons/Makefile b/selinux-policy/virtualization-daemons/Makefile new file mode 100644 index 0000000..48867c8 --- /dev/null +++ b/selinux-policy/virtualization-daemons/Makefile @@ -0,0 +1,68 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/virtualization-daemons +# Description: Various virtualization daemons are confined by SELinux +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2020 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/virtualization-daemons +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: Various virtualization daemons are confined by SELinux" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 15m" >> $(METADATA) + @echo "RunFor: libvirt" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console initscripts libvirt-daemon libvirt-client libvirt-daemon-driver-interface libvirt-daemon-driver-libxl libvirt-daemon-driver-lxc libvirt-daemon-driver-network libvirt-daemon-driver-nodedev libvirt-daemon-driver-nwfilter libvirt-daemon-driver-qemu libvirt-daemon-driver-secret libvirt-daemon-driver-storage-core libvirt-daemon-driver-vbox">> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) + + rhts-lint $(METADATA) + diff --git a/selinux-policy/virtualization-daemons/PURPOSE b/selinux-policy/virtualization-daemons/PURPOSE new file mode 100644 index 0000000..e3776a9 --- /dev/null +++ b/selinux-policy/virtualization-daemons/PURPOSE @@ -0,0 +1,6 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/virtualization-daemons +Author: Milos Malik + +Various virtualization daemons are confined by SELinux. Do they work +as expected? + diff --git a/selinux-policy/virtualization-daemons/main.fmf b/selinux-policy/virtualization-daemons/main.fmf new file mode 100644 index 0000000..acad013 --- /dev/null +++ b/selinux-policy/virtualization-daemons/main.fmf @@ -0,0 +1,48 @@ +summary: SELinux interferes with various virtualization daemons. +description: |+ + SELinux interferes with various virtualization daemons. + +contact: Milos Malik +component: + - selinux-policy +test: ./runtest.sh +framework: beakerlib +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - /usr/sbin/service + - libvirt-client + - libvirt-daemon + - libvirt-daemon-driver-interface + - libvirt-daemon-driver-libxl + - libvirt-daemon-driver-lxc + - libvirt-daemon-driver-network + - libvirt-daemon-driver-nodedev + - libvirt-daemon-driver-nwfilter + - libvirt-daemon-driver-qemu + - libvirt-daemon-driver-secret + - libvirt-daemon-driver-storage-core + - libvirt-daemon-driver-vbox +environment: + AVC_ERROR: +no_avc_check +duration: 15m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - NoRHEL8 + - targeted +adjust: +- enabled: false + when: distro < rhel-9 + because: the virtualization daemons are not available there + diff --git a/selinux-policy/virtualization-daemons/runtest.sh b/selinux-policy/virtualization-daemons/runtest.sh new file mode 100755 index 0000000..9df58e5 --- /dev/null +++ b/selinux-policy/virtualization-daemons/runtest.sh @@ -0,0 +1,120 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/virtualization-daemons +# Description: Various virtualization daemons are confined by SELinux +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2020 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +ROOT_PASSWORD="redhat" +SERVICE_NAMES="libvirtd virtinterfaced virtlockd virtlogd virtlxcd virtnetworkd virtnodedevd virtnwfilterd virtproxyd virtqemud virtsecretd virtstoraged virtvboxd virtxend" +ALL_TUPLES="libvirtd:libvirtd:virtd_t \ + virtinterfaced:virtinterfaced:virtd_t \ + virtlockd:virtlockd:virtlogd_t \ + virtlogd:virtlogd:virtlogd_t \ + virtlxcd:virtlxcd:virtd_t \ + virtnetworkd:virtnetworkd:virtd_t \ + virtnodedevd:virtnodedevd:virtd_t \ + virtnwfilterd:virtnwfilterd:virtd_t \ + virtproxyd:virtproxyd:virtd_t \ + virtqemud:virtqemud:virtd_t \ + virtsecretd:virtsecretd:virtd_t \ + virtstoraged:virtstoraged:virtd_t \ + virtvboxd:virtvboxd:virtd_t" +# virtxend:virtxend:virtd_t + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlRun "rpm -qa libvirt\*" + + rlRun "sed -i 's/^.*task.*never.*$//' /etc/audit/rules.d/audit.rules" + rlRun "echo '-w /etc/shadow -p w' >> /etc/audit/rules.d/audit.rules" + rlRun "service auditd restart" + + rlServiceStop ${SERVICE_NAMES} + rlFileBackup /etc/shadow + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "SELinux contexts and rules" + rlSEMatchPathCon "/usr/sbin/virtinterfaced" "virtd_exec_t" + rlSEMatchPathCon "/usr/sbin/virtlxcd" "virtd_exec_t" + rlSEMatchPathCon "/usr/sbin/virtnetworkd" "virtd_exec_t" + rlSEMatchPathCon "/usr/sbin/virtnodedevd" "virtd_exec_t" + rlSEMatchPathCon "/usr/sbin/virtnwfilterd" "virtd_exec_t" + rlSEMatchPathCon "/usr/sbin/virtproxyd" "virtd_exec_t" + rlSEMatchPathCon "/usr/sbin/virtqemud" "virtd_exec_t" + rlSEMatchPathCon "/usr/sbin/virtsecretd" "virtd_exec_t" + rlSEMatchPathCon "/usr/sbin/virtstoraged" "virtd_exec_t" + rlSEMatchPathCon "/usr/sbin/virtvboxd" "virtd_exec_t" + rlSEMatchPathCon "/usr/sbin/virtxend" "virtd_exec_t" + rlPhaseEnd + + rlPhaseStartTest "real scenario -- standalone service" + rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" + # start all the services + for TUPLE in ${ALL_TUPLES} ; do + SERVICE_NAME=`echo ${TUPLE} | cut -d : -f 1` + PROCESS_NAME=`echo ${TUPLE} | cut -d : -f 2` + PROCESS_CONTEXT=`echo ${TUPLE} | cut -d : -f 3` + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + done + rlRun "restorecon -Rv /etc /run /var" + # restart all the services + for TUPLE in ${ALL_TUPLES} ; do + SERVICE_NAME=`echo ${TUPLE} | cut -d : -f 1` + PROCESS_NAME=`echo ${TUPLE} | cut -d : -f 2` + PROCESS_CONTEXT=`echo ${TUPLE} | cut -d : -f 3` + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status" 1 + done + # stop all the services + for TUPLE in ${ALL_TUPLES} ; do + SERVICE_NAME=`echo ${TUPLE} | cut -d : -f 1` + PROCESS_NAME=`echo ${TUPLE} | cut -d : -f 2` + PROCESS_CONTEXT=`echo ${TUPLE} | cut -d : -f 3` + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "stop status" 1 + done + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlServiceRestore ${SERVICE_NAMES} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + From 7f42d251573fb7772f6ad6fa144a1da553670368 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Fri, 21 Apr 2023 16:39:45 +0200 Subject: [PATCH 230/626] detect the package after the program is installed Packages which belong to non-usual repositories may be installed during the Setup phase, but not sooner because the framework running the tests does not know the repositories. It makes no sense to run the following command before the program is installed: * rpm -qf /path/to/program All the required packages should be installed after finish of the rlSESatisfyRequires function. --- selinux-policy/cups-browsed-and-similar/runtest.sh | 2 +- selinux-policy/systemd-timesyncd-and-similar/runtest.sh | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/selinux-policy/cups-browsed-and-similar/runtest.sh b/selinux-policy/cups-browsed-and-similar/runtest.sh index bba6a10..261eec8 100755 --- a/selinux-policy/cups-browsed-and-similar/runtest.sh +++ b/selinux-policy/cups-browsed-and-similar/runtest.sh @@ -33,7 +33,6 @@ PACKAGE="selinux-policy" ROOT_PASSWORD="redhat" FILE_PATH="/usr/sbin/cups-browsed" FILE_CONTEXT="cupsd_exec_t" -SERVICE_PACKAGE=`rpm -qf /usr/sbin/cups-browsed` SERVICE_NAME="cups-browsed" PROCESS_NAME="cups-browsed" PROCESS_CONTEXT="cupsd_t" @@ -42,6 +41,7 @@ rlJournalStart rlPhaseStartSetup rlRun "rlImport 'selinux-policy/common'" rlSESatisfyRequires + SERVICE_PACKAGE=`rpm -qf ${FILE_PATH}` rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted rlAssertRpm ${SERVICE_PACKAGE} diff --git a/selinux-policy/systemd-timesyncd-and-similar/runtest.sh b/selinux-policy/systemd-timesyncd-and-similar/runtest.sh index 46d6731..4e26325 100755 --- a/selinux-policy/systemd-timesyncd-and-similar/runtest.sh +++ b/selinux-policy/systemd-timesyncd-and-similar/runtest.sh @@ -33,7 +33,6 @@ PACKAGE="selinux-policy" ROOT_PASSWORD="redhat" FILE_PATH="/usr/lib/systemd/systemd-timesyncd" FILE_CONTEXT="systemd_timedated_exec_t" -SERVICE_PACKAGE=`rpm -qf ${FILE_PATH}` SERVICE_NAME="systemd-timesyncd" PROCESS_NAME="systemd-timesyncd" PROCESS_CONTEXT="systemd_timedated_t" @@ -42,6 +41,7 @@ rlJournalStart rlPhaseStartSetup rlRun "rlImport 'selinux-policy/common'" rlSESatisfyRequires + SERVICE_PACKAGE=`rpm -qf ${FILE_PATH}` rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted rlAssertRpm ${SERVICE_PACKAGE} From cfcc5231747913631e3b2515fdb706f1f5ad0c7f Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 25 Apr 2023 11:40:52 +0200 Subject: [PATCH 231/626] create drop-in file only if /etc/ssh/sshd_config.d/ exists The rlSEConfigureSSH function produced the following error message: /usr/share/beakerlib/testing.sh: line 896: /etc/ssh/sshd_config.d/001-enable-password.conf: No such file or directory when the /etc/ssh/sshd_config.d directory did not exist. To avoid such situations in the future, the 001-enable-password.conf file will be created only if the /etc/ssh/sshd_config.d/ directory exists. --- selinux-policy/Library/common/lib.sh | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/selinux-policy/Library/common/lib.sh b/selinux-policy/Library/common/lib.sh index af691e0..658d42e 100755 --- a/selinux-policy/Library/common/lib.sh +++ b/selinux-policy/Library/common/lib.sh @@ -1289,7 +1289,9 @@ function rlSEConfigureSSH () { rlFileBackup /etc/ssh/sshd_config rlRun "sed -i 's/^.*PermitRootLogin.*$/PermitRootLogin yes/' /etc/ssh/sshd_config" rlRun "sed -i 's/^.*PasswordAuthentication.*$/PasswordAuthentication yes/' /etc/ssh/sshd_config" - rlRun "echo 'PasswordAuthentication yes' > /etc/ssh/sshd_config.d/001-enable-password.conf" + if [ -d /etc/ssh/sshd_config.d ] ; then + rlRun "echo 'PasswordAuthentication yes' > /etc/ssh/sshd_config.d/001-enable-password.conf" + fi rlRun "service sshd restart" } From 6fc4e1ae72e950f542daa9374d03d4e12699d6f1 Mon Sep 17 00:00:00 2001 From: Zdenek Pytela Date: Thu, 27 Apr 2023 10:21:57 +0200 Subject: [PATCH 232/626] Run systemd-homed test only if systemd_homed_t exists The systemd-homed service is not confined yet so no particular type is assigned to the executable and the process, neither there are rules in place to make the service run successfully. --- selinux-policy/systemd-homed/runtest.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/selinux-policy/systemd-homed/runtest.sh b/selinux-policy/systemd-homed/runtest.sh index 5534668..c408608 100755 --- a/selinux-policy/systemd-homed/runtest.sh +++ b/selinux-policy/systemd-homed/runtest.sh @@ -109,7 +109,7 @@ expect -f - <<<' } rlJournalStart - if [ ! -f /usr/lib/systemd/systemd-homed ] ; then + if ! seinfo -t systemd_homed_t | grep -q systemd_homed_t ; then rlLog "Not applicable to this OS version." rlJournalEnd exit 0 From a54b9e0d6b2e500328996e75bcd7c433aded557a Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Fri, 14 Apr 2023 11:01:13 +0200 Subject: [PATCH 233/626] kernel-confined-exec: add test for coredump disabled via /usr/bin/false Systemd may disable coredumps by setting kernel.core_pattern to "|/usr/bin/false", so this needs to work. Signed-off-by: Ondrej Mosnacek --- selinux-policy/kernel-confined-exec/runtest.sh | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/selinux-policy/kernel-confined-exec/runtest.sh b/selinux-policy/kernel-confined-exec/runtest.sh index 1f59a75..2694fb1 100755 --- a/selinux-policy/kernel-confined-exec/runtest.sh +++ b/selinux-policy/kernel-confined-exec/runtest.sh @@ -126,6 +126,20 @@ rlJournalStart "Reset kernel.core_pattern to default" rlPhaseEnd + rlPhaseStartTest "Core pattern set to |/usr/bin/false" + rlLog "Should work with no AVCs" + + rlRun "sysctl kernel.core_pattern='|/usr/bin/false'" 0 \ + "Set kernel.core_pattern to |/usr/bin/false" + rlSESetTimestamp + sleep 1 + rlRun "./trigger_segfault" 139 + sleep 2 + rlSECheckAVC + rlRun "sysctl kernel.core_pattern=\"\$original_core_pattern\"" 0 \ + "Reset kernel.core_pattern to default" + rlPhaseEnd + rlPhaseStartCleanup rlRun "rm -f trigger_segfault" rlPhaseEnd From 7ce3757ef627376006115f0c6fdb972fcf86af4a Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Thu, 11 May 2023 15:31:17 +0200 Subject: [PATCH 234/626] Add a test for memory leak when SELinux mount options are used Such memory leak was fixed upstream in the past. This test verifies that it remains fixed. Signed-off-by: Ondrej Mosnacek --- kernel/mount-options-memleak/main.fmf | 17 ++++ kernel/mount-options-memleak/runtest.sh | 106 ++++++++++++++++++++++++ 2 files changed, 123 insertions(+) create mode 100644 kernel/mount-options-memleak/main.fmf create mode 100755 kernel/mount-options-memleak/runtest.sh diff --git a/kernel/mount-options-memleak/main.fmf b/kernel/mount-options-memleak/main.fmf new file mode 100644 index 0000000..e54f7b6 --- /dev/null +++ b/kernel/mount-options-memleak/main.fmf @@ -0,0 +1,17 @@ +summary: Mount options memory leak test +description: | + Test that mounting with SELinux mount options doesn't leave behind + memory leaks. +contact: Ondrej Mosnacek +component: +- kernel +framework: beakerlib +duration: 1h +tier: 2 +enabled: true +adjust: + enabled: false + when: distro < rhel-7 + because: RHEL-6 and below are not worth supporting by this test +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2187402 diff --git a/kernel/mount-options-memleak/runtest.sh b/kernel/mount-options-memleak/runtest.sh new file mode 100755 index 0000000..c5e86e2 --- /dev/null +++ b/kernel/mount-options-memleak/runtest.sh @@ -0,0 +1,106 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# SPDX-License-Identifier: GPLv2 +# Copyright (c) 2023 Red Hat, Inc. +# Author: Ondrej Mosnacek + +# Include Beakerlib environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +# Beaker compat +if [ -n "$JOBID" ] && [ -n "$TESTID" ]; then + function tmt-reboot() { rstrnt-reboot; } + TMT_REBOOT_COUNT="$REBOOT_COUNT" +fi + +function installDepsYum() { + local yum="$1"; shift + + if "$yum" --help | grep -q -- --skip-broken; then + "$yum" install -y --skip-broken $* + else + for req in $*; do + if ! rpm -q --quiet --whatprovides "$req"; then + "$yum" install -y "$req" || true + fi + done + fi +} + +function installDeps() { + if type yum >/dev/null; then + installDepsYum yum "$@" + elif type dnf >/dev/null; then + installDepsYum dnf "$@" + fi +} + +rlJournalStart +if [ $TMT_REBOOT_COUNT -lt 1 ]; then + rlPhaseStartSetup + rlRun "uname -r" 0 "Print initial running kernel version" + + uname="$(uname -r)" + raw_uname="${uname%+*}" + debug_uname="${raw_uname}+debug" + echo "$uname" >"$BEAKERLIB_DIR/orig_uname" + echo "$debug_uname" >"$BEAKERLIB_DIR/debug_uname" + if [ "$uname" = "$debug_uname" ]; then + rlLog "Already running the debug kernel, nice!" + else + rlLog "Install and boot the debug kernel" + + rlRun "installDeps kernel-debug-$raw_uname" + rlRun "grubby --set-default /boot/vmlinuz-$debug_uname" + fi + + rlRun "grubby --update-kernel /boot/vmlinuz-$debug_uname --args kmemleak=on" 0 \ + "Enable kmemleak on the debug kernel" + tmt-reboot +fi +if [ $TMT_REBOOT_COUNT -lt 2 ]; then + rlRun "uname -r" 0 "Print running kernel version after reboot" + + rlRun "mkdir -p /mnt/test_mount" 0 \ + "Create a directory for the test mount" + rlPhaseEnd + + rlPhaseStartTest + rlRun "echo clear > /sys/kernel/debug/kmemleak" 0 \ + "Clear the kmemleak buffer" + + rlRun "mount -t tmpfs -o context=system_u:object_r:user_tmp_t:s0 tmpfs /mnt/test_mount" 0 \ + "Do a context mount" + rlRun "umount /mnt/test_mount" 0 \ + "Unmount the context mount" + + # For whatever reason this needs to be run twice... + rlRun "echo scan > /sys/kernel/debug/kmemleak" 0 \ + "Trigger a kmemleak scan" + rlRun "cat /sys/kernel/debug/kmemleak >/dev/null" 0 \ + "Dump the kmemleak buffer once" + rlRun "echo scan > /sys/kernel/debug/kmemleak" 0 \ + "Trigger a second kmemleak scan" + + rlLog "Check that /sys/kernel/debug/kmemleak is empty" + rlAssertNotDiffer /sys/kernel/debug/kmemleak /dev/null + rlRun "cat /sys/kernel/debug/kmemleak" 0 \ + "Dump the kmemleak buffer" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "rmdir /mnt/test_mount" 0 \ + "Remove the directory for the test mount" + uname="$(cat "$BEAKERLIB_DIR/orig_uname")" + debug_uname="$(cat "$BEAKERLIB_DIR/debug_uname")" + rlRun "grubby --update-kernel /boot/vmlinuz-$debug_uname --remove-args kmemleak=on" 0 \ + "Undo kmemleak enabling" + rlRun "grubby --set-default /boot/vmlinuz-$uname" 0 \ + "Switch the default back to the initial kernel version" + tmt-reboot +fi + rlRun "uname -r" 0 \ + "Print running kernel version after cleanup reboot" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd From 2dfd5cafcbdac84b927f52e13b19a3dd1080a81b Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Wed, 17 May 2023 10:02:45 +0200 Subject: [PATCH 235/626] kernel/mount-options-memleak: fix REBOOTCOUNT variable name Signed-off-by: Ondrej Mosnacek --- kernel/mount-options-memleak/runtest.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/mount-options-memleak/runtest.sh b/kernel/mount-options-memleak/runtest.sh index c5e86e2..e708427 100755 --- a/kernel/mount-options-memleak/runtest.sh +++ b/kernel/mount-options-memleak/runtest.sh @@ -10,7 +10,7 @@ # Beaker compat if [ -n "$JOBID" ] && [ -n "$TESTID" ]; then function tmt-reboot() { rstrnt-reboot; } - TMT_REBOOT_COUNT="$REBOOT_COUNT" + TMT_REBOOT_COUNT="$REBOOTCOUNT" fi function installDepsYum() { From a7e47a4b19a3f501bf7fb9a9a3d5a98476eb2e61 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Wed, 17 May 2023 10:51:52 +0200 Subject: [PATCH 236/626] kernel/mount-options-memleak: print kernel cmdline after reboot This may help diagnose unexpected issues with the test. Signed-off-by: Ondrej Mosnacek --- kernel/mount-options-memleak/runtest.sh | 1 + 1 file changed, 1 insertion(+) diff --git a/kernel/mount-options-memleak/runtest.sh b/kernel/mount-options-memleak/runtest.sh index e708427..7575ee0 100755 --- a/kernel/mount-options-memleak/runtest.sh +++ b/kernel/mount-options-memleak/runtest.sh @@ -60,6 +60,7 @@ if [ $TMT_REBOOT_COUNT -lt 1 ]; then fi if [ $TMT_REBOOT_COUNT -lt 2 ]; then rlRun "uname -r" 0 "Print running kernel version after reboot" + rlRun "cat /proc/cmdline" 0 "Print kernel cmdline after reboot" rlRun "mkdir -p /mnt/test_mount" 0 \ "Create a directory for the test mount" From f6cb99446a0d129341e1d7efb4621571a782b2c6 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Wed, 17 May 2023 10:57:22 +0200 Subject: [PATCH 237/626] kernel/mount-options-memleak: run zipl if it's installed On s390x zipl needs to be run after grubby for the settings to be applied correctly. Signed-off-by: Ondrej Mosnacek --- kernel/mount-options-memleak/runtest.sh | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/kernel/mount-options-memleak/runtest.sh b/kernel/mount-options-memleak/runtest.sh index 7575ee0..f7fc666 100755 --- a/kernel/mount-options-memleak/runtest.sh +++ b/kernel/mount-options-memleak/runtest.sh @@ -56,6 +56,9 @@ if [ $TMT_REBOOT_COUNT -lt 1 ]; then rlRun "grubby --update-kernel /boot/vmlinuz-$debug_uname --args kmemleak=on" 0 \ "Enable kmemleak on the debug kernel" + if command -v zipl >/dev/null; then + rlRun "zipl" 0 "Run zipl" + fi tmt-reboot fi if [ $TMT_REBOOT_COUNT -lt 2 ]; then @@ -98,6 +101,9 @@ if [ $TMT_REBOOT_COUNT -lt 2 ]; then "Undo kmemleak enabling" rlRun "grubby --set-default /boot/vmlinuz-$uname" 0 \ "Switch the default back to the initial kernel version" + if command -v zipl >/dev/null; then + rlRun "zipl" 0 "Run zipl" + fi tmt-reboot fi rlRun "uname -r" 0 \ From bdffd24e923f39618189a6d99db72f03405df1a7 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Thu, 18 May 2023 15:48:56 +0200 Subject: [PATCH 238/626] kernel/labeling_before_policy_load: misc tweaks - ensure the current booted kernel is set as default (fixes the case where a newer kernel package has been installed since boot) - add Beaker compat workaround - add descriptions to most rlRun asserts - run zipl also after the cleanup `dracut -f` invocation Signed-off-by: Ondrej Mosnacek --- kernel/labeling_before_policy_load/runtest.sh | 34 +++++++++++++------ 1 file changed, 24 insertions(+), 10 deletions(-) diff --git a/kernel/labeling_before_policy_load/runtest.sh b/kernel/labeling_before_policy_load/runtest.sh index 65956bf..a9ec1a5 100755 --- a/kernel/labeling_before_policy_load/runtest.sh +++ b/kernel/labeling_before_policy_load/runtest.sh @@ -7,16 +7,26 @@ # Include Beakerlib environment . /usr/share/beakerlib/beakerlib.sh || exit 1 +# Beaker compat +if [ -n "$JOBID" ] && [ -n "$TESTID" ]; then + function tmt-reboot() { rstrnt-reboot; } + TMT_REBOOT_COUNT="$REBOOTCOUNT" +fi + rlJournalStart if [ $TMT_REBOOT_COUNT -lt 1 ]; then rlPhaseStartSetup "Setup" rlRun "uname -r" 0 "Kernel version before reboot" - rlRun "install -d /usr/lib/dracut/modules.d/97bz1777525" - rlRun "install module-setup.sh relabel.sh /usr/lib/dracut/modules.d/97bz1777525" - rlRun "dracut --regenerate-all -f" + rlRun "install -d /usr/lib/dracut/modules.d/97bz1777525" 0 \ + "Install dracut plugin directory for testing" + rlRun "install module-setup.sh relabel.sh /usr/lib/dracut/modules.d/97bz1777525" 0 \ + "Install dracut plugin for testing" + rlRun "dracut -f" 0 "Rebuild the initramfs" + rlRun "grubby --set-default /boot/vmlinuz-$(uname -r)" 0 \ + "Ensure the current booted kernel is the default" if command -v zipl >/dev/null; then - rlRun "zipl" + rlRun "zipl" 0 "Run zipl" fi rlPhaseEnd @@ -27,20 +37,24 @@ fi rlPhaseEnd rlPhaseStartTest "Test" - # Test writing labels (BZ 1777525) + rlLog "Test writing labels (BZ 1777525)" rlRun "ls -lZ /etc/testfile" rlRun "ls -lZ /etc/testfile | grep -qF ':etc_t:'" 0 \ - "/etc/testfile is labeled correctly" + "Test that /etc/testfile is labeled correctly" - # Test reading labels (BZ 1839819) + rlLog "Test reading labels (BZ 1839819)" rlRun "cat /etc/labeldump" rlAssertNotDiffer "/etc/labeldump" labeldump-expected.txt rlPhaseEnd rlPhaseStartCleanup - rlRun "rm -f /etc/labeldump /etc/testfile" - rlRun "rm -rf /usr/lib/dracut/modules.d/97bz1777525" - rlRun "dracut --regenerate-all -f" + rlRun "rm -f /etc/labeldump /etc/testfile" 0 "Remove test files" + rlRun "rm -rf /usr/lib/dracut/modules.d/97bz1777525" 0 \ + "Remove the dracut plugin" + rlRun "dracut -f" 0 "Rebuild the initramfs again" + if command -v zipl >/dev/null; then + rlRun "zipl" 0 "Run zipl" + fi rlPhaseEnd rlJournalPrintText rlJournalEnd From 79eea844d1ffee28e90815c81ec1786e9062e781 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 16 May 2023 16:54:10 +0200 Subject: [PATCH 239/626] test if various processes can use mmap syscall on io_uring As many reported BZs confirm, various QEMU related programs use the io_uring interface, but SELinux prevents them from using the mmap syscall on it. The TC reproduces a similar situation. In order to support the io_uring interface fully, I believe that SELinux policy should allow the map permission on the anon_inode class. The TC looks for appropriate policy rules. The TC covers BZ#2025714, BZ#2187745 and their duplicates. --- selinux-policy/anon_inode-and-similar/Makefile | 5 ++++- selinux-policy/anon_inode-and-similar/main.fmf | 3 +++ selinux-policy/anon_inode-and-similar/runtest.sh | 9 +++++++++ 3 files changed, 16 insertions(+), 1 deletion(-) diff --git a/selinux-policy/anon_inode-and-similar/Makefile b/selinux-policy/anon_inode-and-similar/Makefile index f7866fa..0a053b2 100644 --- a/selinux-policy/anon_inode-and-similar/Makefile +++ b/selinux-policy/anon_inode-and-similar/Makefile @@ -54,7 +54,7 @@ $(METADATA): Makefile @echo "Type: Regression" >> $(METADATA) @echo "TestTime: 30m" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: libselinux policycoreutils selinux-policy selinux-policy-targeted gcc glibc-headers setools-console audit" >> $(METADATA) + @echo "Requires: libselinux policycoreutils selinux-policy selinux-policy-targeted gcc glibc-headers setools-console audit fio" >> $(METADATA) @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @echo "License: GPLv2" >> $(METADATA) @@ -63,6 +63,9 @@ $(METADATA): Makefile @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) @echo "Releases: -RHEL4" >> $(METADATA) @echo "Bug: 1974559" >> $(METADATA) + @echo "Bug: 2027660" >> $(METADATA) # RHEL-9 + @echo "Bug: 2025714" >> $(METADATA) # Fedora 35 + @echo "Bug: 2187745" >> $(METADATA) # RHEL-9 rhts-lint $(METADATA) diff --git a/selinux-policy/anon_inode-and-similar/main.fmf b/selinux-policy/anon_inode-and-similar/main.fmf index e490f04..e9ed5d7 100644 --- a/selinux-policy/anon_inode-and-similar/main.fmf +++ b/selinux-policy/anon_inode-and-similar/main.fmf @@ -15,6 +15,7 @@ recommend: - glibc-headers - setools-console - audit + - fio environment: AVC_ERROR: +no_avc_check duration: 30m @@ -28,6 +29,8 @@ tag: link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1974559 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2027660 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2025714 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2187745 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 diff --git a/selinux-policy/anon_inode-and-similar/runtest.sh b/selinux-policy/anon_inode-and-similar/runtest.sh index 35b18d6..d7ddd4f 100755 --- a/selinux-policy/anon_inode-and-similar/runtest.sh +++ b/selinux-policy/anon_inode-and-similar/runtest.sh @@ -60,9 +60,18 @@ rlJournalStart rlRun "rm -f reproducer" rlPhaseEnd + rlPhaseStartTest "mmap on io_uring - bz#2025714 + bz#2187745" + rlSESearchRule "allow unconfined_t unconfined_t : anon_inode { map } [ ]" + rlSESearchRule "allow svirt_t svirt_t : anon_inode { map } [ ]" + rlSESearchRule "allow virtd_t virtd_t : anon_inode { map } [ ]" + + rlRun "fio --filename=/root/pokus --iodepth=16 --rw=write --ioengine=io_uring --bs=16k --size=2G --numjobs=30 --runtime=100s --group_reporting=1 --name=mytest" + rlPhaseEnd + rlPhaseStartCleanup sleep 2 rlSECheckAVC rlPhaseEnd rlJournalPrintText rlJournalEnd + From 215a9d1ffbff3323d5bab0e1505ca9c68d1426c3 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Wed, 31 May 2023 09:09:06 +0200 Subject: [PATCH 240/626] improve the tests which end with a timeout Certain tests end up with a timeout because they run the ncat program in the background and they do not stop it. The framework which runs the tests apparently cannot cope with this fact. --- selinux-policy/bz733494-amanda-and-similar/main.fmf | 6 ------ selinux-policy/bz733494-amanda-and-similar/runtest.sh | 2 ++ selinux-policy/cockpit-ws-and-similar/main.fmf | 1 - selinux-policy/cockpit-ws-and-similar/runtest.sh | 1 + selinux-policy/cups-lpd-and-similar/main.fmf | 4 ---- selinux-policy/cups-lpd-and-similar/runtest.sh | 1 + 6 files changed, 4 insertions(+), 11 deletions(-) diff --git a/selinux-policy/bz733494-amanda-and-similar/main.fmf b/selinux-policy/bz733494-amanda-and-similar/main.fmf index 2a38b85..0563a0c 100644 --- a/selinux-policy/bz733494-amanda-and-similar/main.fmf +++ b/selinux-policy/bz733494-amanda-and-similar/main.fmf @@ -24,7 +24,6 @@ recommend: - krb5-workstation - selinux-policy - selinux-policy-targeted - - setools - setools-console - xinetd environment: @@ -33,11 +32,6 @@ duration: 15m enabled: true tag: - NoRHEL4 - - TIP_fedora_fail - - TIPfail_Apps - - TIPfail_Security - - TIPfail_fedora - - TIPpass - TierCandidatesFAIL - f32friendly - failinfedora diff --git a/selinux-policy/bz733494-amanda-and-similar/runtest.sh b/selinux-policy/bz733494-amanda-and-similar/runtest.sh index 6c42aa5..1e0451a 100755 --- a/selinux-policy/bz733494-amanda-and-similar/runtest.sh +++ b/selinux-policy/bz733494-amanda-and-similar/runtest.sh @@ -218,6 +218,7 @@ rlJournalStart rlRun "ps -o pid,user,context,args -C ${PROCESS_NAME}" rlRun "ps -o pid,user,context,args -C ${PROCESS_NAME} | grep :${PROCESS_CONTEXT}" rlRun "kill ${PROVOCATEUR_PID}" + rlRun "killall ncat" 0,1 rlRun "systemctl stop kamanda.socket" rlRun "systemctl disable kamanda.socket" rlPhaseEnd @@ -246,6 +247,7 @@ rlJournalStart rlRun "ps -o pid,user,context,args -C ${PROCESS_NAME}" rlRun "ps -o pid,user,context,args -C ${PROCESS_NAME} | grep :${PROCESS_CONTEXT}" rlRun "kill ${PROVOCATEUR_PID}" + rlRun "killall ncat" 0,1 if rlIsRHEL 5 6 ; then rlRun "chkconfig ${SERVICE_NAME} off" rlRun "service xinetd stop" diff --git a/selinux-policy/cockpit-ws-and-similar/main.fmf b/selinux-policy/cockpit-ws-and-similar/main.fmf index 1180f0a..db8d927 100644 --- a/selinux-policy/cockpit-ws-and-similar/main.fmf +++ b/selinux-policy/cockpit-ws-and-similar/main.fmf @@ -31,7 +31,6 @@ tag: - NoRHEL4 - NoRHEL5 - NoRHEL6 - - TIPfail_Security - TierCandidatesPASS - failinfedora - targeted diff --git a/selinux-policy/cockpit-ws-and-similar/runtest.sh b/selinux-policy/cockpit-ws-and-similar/runtest.sh index a2807c9..3a17767 100755 --- a/selinux-policy/cockpit-ws-and-similar/runtest.sh +++ b/selinux-policy/cockpit-ws-and-similar/runtest.sh @@ -210,6 +210,7 @@ rlJournalStart rlRun "ps -o pid,user,context,args -C ${PROCESS_NAME}" rlRun "ps -o pid,user,context,args -C ${PROCESS_NAME} | grep :${PROCESS_CONTEXT}" rlRun "kill ${PROVOCATEUR_PID}" + rlRun "killall ncat" 0,1 if rlIsRHEL 5 6 ; then rlRun "chkconfig ${SERVICE_NAME} off" rlRun "service xinetd stop" diff --git a/selinux-policy/cups-lpd-and-similar/main.fmf b/selinux-policy/cups-lpd-and-similar/main.fmf index b2ad36f..ef5985d 100644 --- a/selinux-policy/cups-lpd-and-similar/main.fmf +++ b/selinux-policy/cups-lpd-and-similar/main.fmf @@ -18,7 +18,6 @@ recommend: - policycoreutils - selinux-policy - selinux-policy-targeted - - setools - setools-console - xinetd - nmap-ncat @@ -34,9 +33,6 @@ enabled: true tag: - NoRHEL4 - RHEL8 - - TIPfail - - TIPfail_infra - - TIPpass_Security - Tier2 - Tier2se - TierCandidatesFAIL diff --git a/selinux-policy/cups-lpd-and-similar/runtest.sh b/selinux-policy/cups-lpd-and-similar/runtest.sh index 6b3952d..2191da5 100755 --- a/selinux-policy/cups-lpd-and-similar/runtest.sh +++ b/selinux-policy/cups-lpd-and-similar/runtest.sh @@ -138,6 +138,7 @@ rlJournalStart rlRun "ps -o pid,user,context,args -C ${PROCESS_NAME}" rlRun "ps -o pid,user,context,args -C ${PROCESS_NAME} | grep :${PROCESS_CONTEXT}" rlRun "kill ${PROVOCATEUR_PID}" + rlRun "killall ncat" 0,1 if rlIsRHEL 5 6 ; then rlRun "chkconfig ${SERVICE_NAME} off" rlRun "service xinetd stop" From b1ff618211156c65c4360e8a3083dba99a50d15e Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Wed, 31 May 2023 18:27:36 +0200 Subject: [PATCH 241/626] do not test virt* services which are not present The automated test fails during its execution because not all virt* services are always present. --- selinux-policy/virtualization-daemons/Makefile | 2 +- selinux-policy/virtualization-daemons/runtest.sh | 14 ++++++++++---- 2 files changed, 11 insertions(+), 5 deletions(-) diff --git a/selinux-policy/virtualization-daemons/Makefile b/selinux-policy/virtualization-daemons/Makefile index 48867c8..ffe4846 100644 --- a/selinux-policy/virtualization-daemons/Makefile +++ b/selinux-policy/virtualization-daemons/Makefile @@ -55,7 +55,7 @@ $(METADATA): Makefile @echo "TestTime: 15m" >> $(METADATA) @echo "RunFor: libvirt" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console initscripts libvirt-daemon libvirt-client libvirt-daemon-driver-interface libvirt-daemon-driver-libxl libvirt-daemon-driver-lxc libvirt-daemon-driver-network libvirt-daemon-driver-nodedev libvirt-daemon-driver-nwfilter libvirt-daemon-driver-qemu libvirt-daemon-driver-secret libvirt-daemon-driver-storage-core libvirt-daemon-driver-vbox">> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console /usr/sbin/service libvirt-daemon libvirt-client libvirt-daemon-driver-interface libvirt-daemon-driver-libxl libvirt-daemon-driver-lxc libvirt-daemon-driver-network libvirt-daemon-driver-nodedev libvirt-daemon-driver-nwfilter libvirt-daemon-driver-qemu libvirt-daemon-driver-secret libvirt-daemon-driver-storage-core libvirt-daemon-driver-vbox">> $(METADATA) @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) diff --git a/selinux-policy/virtualization-daemons/runtest.sh b/selinux-policy/virtualization-daemons/runtest.sh index 9df58e5..3ac205f 100755 --- a/selinux-policy/virtualization-daemons/runtest.sh +++ b/selinux-policy/virtualization-daemons/runtest.sh @@ -89,22 +89,28 @@ rlJournalStart SERVICE_NAME=`echo ${TUPLE} | cut -d : -f 1` PROCESS_NAME=`echo ${TUPLE} | cut -d : -f 2` PROCESS_CONTEXT=`echo ${TUPLE} | cut -d : -f 3` - rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + fi done - rlRun "restorecon -Rv /etc /run /var" + rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 # restart all the services for TUPLE in ${ALL_TUPLES} ; do SERVICE_NAME=`echo ${TUPLE} | cut -d : -f 1` PROCESS_NAME=`echo ${TUPLE} | cut -d : -f 2` PROCESS_CONTEXT=`echo ${TUPLE} | cut -d : -f 3` - rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status" 1 + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status" 1 + fi done # stop all the services for TUPLE in ${ALL_TUPLES} ; do SERVICE_NAME=`echo ${TUPLE} | cut -d : -f 1` PROCESS_NAME=`echo ${TUPLE} | cut -d : -f 2` PROCESS_CONTEXT=`echo ${TUPLE} | cut -d : -f 3` - rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "stop status" 1 + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "stop status" 1 + fi done rlPhaseEnd From f5c43be61e7dd99f303415e63e3392244331e098 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Mon, 5 Jun 2023 15:19:35 +0200 Subject: [PATCH 242/626] improve the test to clean-up after itself Restore the restorecond service to its original state. The restorecond service should not stay running if it was not running before execution of the test. --- policycoreutils/restorecond_pointer_abuse/Makefile | 1 + policycoreutils/restorecond_pointer_abuse/main.fmf | 1 + policycoreutils/restorecond_pointer_abuse/runtest.sh | 5 ++++- 3 files changed, 6 insertions(+), 1 deletion(-) diff --git a/policycoreutils/restorecond_pointer_abuse/Makefile b/policycoreutils/restorecond_pointer_abuse/Makefile index 253e7f3..bb3ac2c 100644 --- a/policycoreutils/restorecond_pointer_abuse/Makefile +++ b/policycoreutils/restorecond_pointer_abuse/Makefile @@ -55,6 +55,7 @@ $(METADATA): Makefile @echo "Requires: /usr/sbin/sestatus" >> $(METADATA) @echo "Requires: /usr/bin/systemctl" >> $(METADATA) @echo "Requires: /usr/bin/journalctl" >> $(METADATA) + @echo "Requires: /usr/sbin/setenforce" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @echo "License: GPLv2+" >> $(METADATA) @echo "Confidential: no" >> $(METADATA) diff --git a/policycoreutils/restorecond_pointer_abuse/main.fmf b/policycoreutils/restorecond_pointer_abuse/main.fmf index 00a4fea..8225183 100644 --- a/policycoreutils/restorecond_pointer_abuse/main.fmf +++ b/policycoreutils/restorecond_pointer_abuse/main.fmf @@ -18,6 +18,7 @@ recommend: - coreutils - systemd - policycoreutils + - libselinux-utils adjust: - enabled: false when: distro < rhel-7 diff --git a/policycoreutils/restorecond_pointer_abuse/runtest.sh b/policycoreutils/restorecond_pointer_abuse/runtest.sh index 98671dd..2056c98 100755 --- a/policycoreutils/restorecond_pointer_abuse/runtest.sh +++ b/policycoreutils/restorecond_pointer_abuse/runtest.sh @@ -44,6 +44,7 @@ PACKAGE="policycoreutils" rlJournalStart rlPhaseStartSetup rlAssertRpm $PACKAGE + rlServiceStart restorecond # backup restorecond configuration file rlRun "rlFileBackup /etc/selinux/restorecond.conf" 0 rlRun "echo '/usr/*' > /etc/selinux/restorecond.conf" 0-255 @@ -58,7 +59,7 @@ rlJournalStart for i in {1..15} do # create misslabeled files - for folder in share games tmp + for folder in share games tmp do rlRun "touch /usr/$folder/$i" rlRun "chcon -t unlabeled_t /usr/$folder/$i" @@ -79,6 +80,8 @@ rlJournalStart rlPhaseStartCleanup rlRun "rlFileRestore" 0 + rlServiceRestore restorecond + rm -f ${OUTPUT_FILE} rlPhaseEnd rlJournalPrintText rlJournalEnd From 35c64114c2bde618f2621072c6c68105790dee32 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Wed, 31 May 2023 19:39:24 +0200 Subject: [PATCH 243/626] add new automated test which covers the opensmtpd service A recently filed BZ revealed that SELinux prevents the opensmptd service from starting. The TC reproduces the situation. Here is a short of summary of smptd actions that were denied: * chroot syscall on /var/empty/smtpd (sys_chroot permission) * chmod syscall on /var/spool/smtpd/temporary (fowner permission) * bind syscall on /var/run/smtpd.sock (create permission) * chmod syscall on /var/run/smtpd.sock (setattr permission) In order to enable the expected functionality of the opensmtpd service, I believe that SELinux policy should allow these actions. The TC looks for appropriate policy rules and file context patterns. The TC covers BZ#2208696. --- selinux-policy/opensmtpd-and-similar/Makefile | 68 +++++++++++++++ selinux-policy/opensmtpd-and-similar/PURPOSE | 5 ++ selinux-policy/opensmtpd-and-similar/main.fmf | 38 +++++++++ .../opensmtpd-and-similar/runtest.sh | 84 +++++++++++++++++++ 4 files changed, 195 insertions(+) create mode 100644 selinux-policy/opensmtpd-and-similar/Makefile create mode 100644 selinux-policy/opensmtpd-and-similar/PURPOSE create mode 100644 selinux-policy/opensmtpd-and-similar/main.fmf create mode 100755 selinux-policy/opensmtpd-and-similar/runtest.sh diff --git a/selinux-policy/opensmtpd-and-similar/Makefile b/selinux-policy/opensmtpd-and-similar/Makefile new file mode 100644 index 0000000..8d7690f --- /dev/null +++ b/selinux-policy/opensmtpd-and-similar/Makefile @@ -0,0 +1,68 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/opensmtpd-and-similar +# Description: SELinux interferes with the opensmtpd service and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2023 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/opensmtpd-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with the opensmtpd service and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console opensmtpd /usr/sbin/service" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA) + @echo "Bug: 2208696" >> $(METADATA) # Fedora 38 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/opensmtpd-and-similar/PURPOSE b/selinux-policy/opensmtpd-and-similar/PURPOSE new file mode 100644 index 0000000..7f8a9ff --- /dev/null +++ b/selinux-policy/opensmtpd-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/opensmtpd-and-similar +Author: Milos Malik + +SELinux interferes with the opensmtpd service and related programs + diff --git a/selinux-policy/opensmtpd-and-similar/main.fmf b/selinux-policy/opensmtpd-and-similar/main.fmf new file mode 100644 index 0000000..2d8fe9e --- /dev/null +++ b/selinux-policy/opensmtpd-and-similar/main.fmf @@ -0,0 +1,38 @@ +summary: SELinux interferes with the opensmtpd service and related programs +description: |+ + SELinux interferes with the opensmtpd service and related programs. + +contact: Milos Malik +component: + - selinux-policy +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - opensmtpd + - /usr/sbin/service +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - targeted +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2208696 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + because: the opensmtpd package is not available there +extra-summary: /CoreOS/selinux-policy/Regression/opensmtpd-and-similar +extra-task: /CoreOS/selinux-policy/Regression/opensmtpd-and-similar +extra-nitrate: TC#0615352 diff --git a/selinux-policy/opensmtpd-and-similar/runtest.sh b/selinux-policy/opensmtpd-and-similar/runtest.sh new file mode 100755 index 0000000..6ce1a6e --- /dev/null +++ b/selinux-policy/opensmtpd-and-similar/runtest.sh @@ -0,0 +1,84 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/opensmtpd-and-similar +# Description: SELinux interferes with the opensmtpd service and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2023 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +FILE_PATH="/usr/sbin/smtpd" +FILE_CONTEXT="sendmail_exec_t" +SERVICE_PACKAGE="opensmtpd" +SERVICE_NAME="opensmtpd" +PROCESS_NAME="smtpd" +PROCESS_CONTEXT="sendmail_t" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} postfix sendmail + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "bz#2208696" + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + rlSEMatchPathCon "/var/run" "var_run_t" + rlSEMatchPathCon "/var/run/smtpd.sock" "sendmail_var_run_t" + rlSESearchRule "allow sendmail_t sendmail_t : capability { sys_chroot fowner } [ ]" + rlSESearchRule "type_transition sendmail_t var_run_t : sock_file sendmail_var_run_t" + rlSESearchRule "allow sendmail_t sendmail_var_run_t : sock_file { create setattr unlink write } [ ]" + rlPhaseEnd + + rlPhaseStartTest "real scenario -- standalone service" + if ! ls -Z ${FILE_PATH} | grep -q ${FILE_CONTEXT} ; then + # for environments where the service is not yet confined + PROCESS_CONTEXT="unconfined_service_t" + fi + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /etc /var /run -e /var/ARTIFACTS" 0-255 + rlRun "smtpctl show status" + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlServiceRestore ${SERVICE_NAME} postfix sendmail + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + From 733f960966dac447cd21c8861726ae12abcaa1e2 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Tue, 6 Jun 2023 10:39:30 +0200 Subject: [PATCH 244/626] Narrow down relevancy in some tests Make it reflect the current status in RHEL to avoid running the test where it doesn't make sense. Signed-off-by: Ondrej Mosnacek --- .../semodule-rebuild-if-modules-changed/runtest.sh | 5 ++--- selinux-policy/kernel-confined-exec/main.fmf | 3 +++ 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/policycoreutils/semodule-rebuild-if-modules-changed/runtest.sh b/policycoreutils/semodule-rebuild-if-modules-changed/runtest.sh index 5347206..b87505c 100755 --- a/policycoreutils/semodule-rebuild-if-modules-changed/runtest.sh +++ b/policycoreutils/semodule-rebuild-if-modules-changed/runtest.sh @@ -117,9 +117,8 @@ rlJournalStart "Force a rebuild to clean things up" rlPhaseEnd - if ! { rlIsRHEL 9 && rlIsRHEL '<9.3'; } && \ - ! { rlIsRHEL 8 && rlIsRHEL '<8.9'; } - then + # https://bugzilla.redhat.com/show_bug.cgi?id=2173959 + if ! { rlIsRHEL && rlIsRHEL '<9.3'; }; then rlPhaseStartTest "Disable dontaudit injected" rlLog "Inject disable_dontaudit flag into the store" rlRun "touch '$STORE_DISABLE_DONTAUDIT'" diff --git a/selinux-policy/kernel-confined-exec/main.fmf b/selinux-policy/kernel-confined-exec/main.fmf index 33ab76f..fb7cd8e 100644 --- a/selinux-policy/kernel-confined-exec/main.fmf +++ b/selinux-policy/kernel-confined-exec/main.fmf @@ -21,6 +21,9 @@ adjust: - enabled: false when: distro < fedora-38 because: This hardening applies only to F38+ + - enabled: false + when: distro < rhel-10 + because: Not yet backported to RHEL link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2068579 extra-nitrate: TC#0614676 From 506cb9f2d98f2c4ad073c73e7a4d044c2da9802b Mon Sep 17 00:00:00 2001 From: Zdenek Pytela Date: Fri, 16 Jun 2023 16:41:12 +0200 Subject: [PATCH 245/626] Replace all /var/run matchpathcon checks with /var/run/pcp New versions of pcp use only the /run/pcp directory for storing all runtime files. The old default file context rules were removed from the policy. --- selinux-policy/pcp-daemons-and-similar/runtest.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/selinux-policy/pcp-daemons-and-similar/runtest.sh b/selinux-policy/pcp-daemons-and-similar/runtest.sh index c22a7e8..94b5693 100755 --- a/selinux-policy/pcp-daemons-and-similar/runtest.sh +++ b/selinux-policy/pcp-daemons-and-similar/runtest.sh @@ -106,7 +106,7 @@ rlJournalStart rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT}" done rlSEMatchPathCon "/var/run/pcp" "pcp_var_run_t" - rlSEMatchPathCon "/var/run/pmcd.socket" "pcp_var_run_t" + rlSEMatchPathCon "/var/run/pcp/pmcd.socket" "pcp_var_run_t" rlSEMatchPathCon "/dev/log" "devlog_t" rlSEMatchPathCon "/dev/mapper/control" "lvm_control_t" rlSEMatchPortCon tcp 4330 dey_sapi_port_t @@ -216,7 +216,7 @@ rlJournalStart rlPhaseStartTest "bz#1286234" rlSEMatchPathCon "/usr/bin/pmlogger" "pcp_pmlogger_exec_t" rlSEMatchPathCon "/var/run" "var_run_t" - rlSEMatchPathCon "/var/run/pmlogger.primary.socket" "pcp_var_run_t" + rlSEMatchPathCon "/var/run/pcp/pmlogger.primary.socket" "pcp_var_run_t" rlSESearchRule "allow pcp_pmlogger_t var_run_t : dir { write add_name } [ ]" rlSESearchRule "type_transition pcp_pmlogger_t var_run_t : lnk_file pcp_var_run_t [ ]" rlSESearchRule "allow pcp_pmlogger_t pcp_var_run_t : lnk_file { create } [ ]" From d3052eecb144fd59f68adaf109aaaa4ae7a0b9f9 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 19 Jan 2021 14:50:22 +0100 Subject: [PATCH 246/626] add test which covers new records in capability2 class In comparison to kernel, which recognizes capabilities like perfmon, bpf and checkpoint_restore, SELinux policy does not recognize them yet. But that situation should change soon. Purpose of the TC is to find out if these capabilities recognized by kernel are also recognized by SELinux policy. The TC covers BZ#1915264. --- selinux-policy/capability2-class/Makefile | 68 +++++++++++++++++++++ selinux-policy/capability2-class/PURPOSE | 5 ++ selinux-policy/capability2-class/main.fmf | 28 +++++++++ selinux-policy/capability2-class/runtest.sh | 60 ++++++++++++++++++ 4 files changed, 161 insertions(+) create mode 100644 selinux-policy/capability2-class/Makefile create mode 100644 selinux-policy/capability2-class/PURPOSE create mode 100644 selinux-policy/capability2-class/main.fmf create mode 100755 selinux-policy/capability2-class/runtest.sh diff --git a/selinux-policy/capability2-class/Makefile b/selinux-policy/capability2-class/Makefile new file mode 100644 index 0000000..aa75e64 --- /dev/null +++ b/selinux-policy/capability2-class/Makefile @@ -0,0 +1,68 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Sanity/capability2-class +# Description: Does SELinux policy define new capabilities in capability2 class? +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2020 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Sanity/capability2-class +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: Does SELinux policy define new capabilities in capability2 class?" >> $(METADATA) + @echo "Type: Sanity" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit git libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA) + @echo "Bug: 1915264" >> $(METADATA) # Fedora rawhide + + rhts-lint $(METADATA) + diff --git a/selinux-policy/capability2-class/PURPOSE b/selinux-policy/capability2-class/PURPOSE new file mode 100644 index 0000000..c18e355 --- /dev/null +++ b/selinux-policy/capability2-class/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Sanity/capability2-class +Author: Milos Malik + +Description: Does SELinux policy define new capabilities in capability2 class? + diff --git a/selinux-policy/capability2-class/main.fmf b/selinux-policy/capability2-class/main.fmf new file mode 100644 index 0000000..83ff051 --- /dev/null +++ b/selinux-policy/capability2-class/main.fmf @@ -0,0 +1,28 @@ +path: /selinux-policy/capability2-class +contact: Milos Malik +test: ./runtest.sh +framework: beakerlib +component: + - selinux-policy +require: + - library(selinux-policy/common) +recommend: + - audit + - git + - libselinux + - libselinux-utils + - policycoreutils + - setools-console + - selinux-policy + - selinux-policy-targeted +environment: + AVC_ERROR: +no_avc_check +duration: 15m +enabled: true +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1915264 +adjust: + - enabled: false + when: distro = rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 + continue: false + diff --git a/selinux-policy/capability2-class/runtest.sh b/selinux-policy/capability2-class/runtest.sh new file mode 100755 index 0000000..e81eec7 --- /dev/null +++ b/selinux-policy/capability2-class/runtest.sh @@ -0,0 +1,60 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Sanity/capability2-class +# Description: Does SELinux policy define new capabilities in capability2 class? +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2020 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "bz#1915264" + rlRun "seinfo --common cap2 -x" + for CAPABILITY in perfmon bpf checkpoint_restore ; do + rlRun "seinfo --common cap2 -x | grep -w ${CAPABILITY}" + done + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + From 12ec984e076b621579b6b6422543e2a173570ba2 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 19 Jan 2021 10:47:53 +0100 Subject: [PATCH 247/626] add new test which covers watch* permissions In comparison to kernel, which recognizes various watch permissions, SELinux policy does not recognize them yet. But that situation should change soon. Purpose of the TC is to find out if the same watch* permissions recognized by kernel are also recognized by SELinux policy. The TC covers BZ#1915034. --- selinux-policy/watch-permissions/Makefile | 68 +++++++++++++++++++++ selinux-policy/watch-permissions/PURPOSE | 5 ++ selinux-policy/watch-permissions/main.fmf | 28 +++++++++ selinux-policy/watch-permissions/runtest.sh | 60 ++++++++++++++++++ 4 files changed, 161 insertions(+) create mode 100644 selinux-policy/watch-permissions/Makefile create mode 100644 selinux-policy/watch-permissions/PURPOSE create mode 100644 selinux-policy/watch-permissions/main.fmf create mode 100755 selinux-policy/watch-permissions/runtest.sh diff --git a/selinux-policy/watch-permissions/Makefile b/selinux-policy/watch-permissions/Makefile new file mode 100644 index 0000000..52ffa08 --- /dev/null +++ b/selinux-policy/watch-permissions/Makefile @@ -0,0 +1,68 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Sanity/watch-permissions +# Description: Are various watch permissions defined in SELinux policy? +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2020 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Sanity/watch-permissions +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: Are various watch permissions defined in SELinux policy?" >> $(METADATA) + @echo "Type: Sanity" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit git libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA) + @echo "Bug: 1915034" >> $(METADATA) # Fedora rawhide + + rhts-lint $(METADATA) + diff --git a/selinux-policy/watch-permissions/PURPOSE b/selinux-policy/watch-permissions/PURPOSE new file mode 100644 index 0000000..6cdb8e4 --- /dev/null +++ b/selinux-policy/watch-permissions/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Sanity/watch-permissions +Author: Milos Malik + +Description: Are various watch permissions defined in SELinux policy? + diff --git a/selinux-policy/watch-permissions/main.fmf b/selinux-policy/watch-permissions/main.fmf new file mode 100644 index 0000000..9d37a3d --- /dev/null +++ b/selinux-policy/watch-permissions/main.fmf @@ -0,0 +1,28 @@ +path: /selinux-policy/watch-permissions +contact: Milos Malik +test: ./runtest.sh +framework: beakerlib +component: + - selinux-policy +require: + - library(selinux-policy/common) +recommend: + - audit + - git + - libselinux + - libselinux-utils + - policycoreutils + - setools-console + - selinux-policy + - selinux-policy-targeted +environment: + AVC_ERROR: +no_avc_check +duration: 15m +enabled: true +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1915034 +adjust: + - enabled: false + when: distro = rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 + continue: false + diff --git a/selinux-policy/watch-permissions/runtest.sh b/selinux-policy/watch-permissions/runtest.sh new file mode 100755 index 0000000..c8183ab --- /dev/null +++ b/selinux-policy/watch-permissions/runtest.sh @@ -0,0 +1,60 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Sanity/watch-permissions +# Description: Are various watch permissions defined in SELinux policy? +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2020 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "bz#1915034" + for PERM in watch watch_mount watch_sb watch_with_perm watch_reads ; do + rlRun "seinfo --common file -x | grep -w ${PERM}" + done + rlRun "seinfo -c filesystem -x | grep -w watch" + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + From d0f436fbbc38a85aa42b0bc927d411ae39b73dc1 Mon Sep 17 00:00:00 2001 From: Zdenek Dohnal Date: Tue, 20 Jun 2023 15:28:06 +0200 Subject: [PATCH 248/626] selinux-policy: Stop cupsd after cups-browsed test CUPS service is a dependency of cups-browsed service, so it has to be stopped once we're done with cups-browsed testing manually. --- selinux-policy/cups-browsed-and-similar/runtest.sh | 1 + 1 file changed, 1 insertion(+) diff --git a/selinux-policy/cups-browsed-and-similar/runtest.sh b/selinux-policy/cups-browsed-and-similar/runtest.sh index 261eec8..8db13de 100755 --- a/selinux-policy/cups-browsed-and-similar/runtest.sh +++ b/selinux-policy/cups-browsed-and-similar/runtest.sh @@ -90,6 +90,7 @@ rlJournalStart rlFileRestore rlServiceRestore ${SERVICE_NAME} + rlServiceStop cups rlPhaseEnd rlJournalPrintText rlJournalEnd From a32b536cd25b4847d5807bc2e9022e0c538db3f5 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 24 May 2022 10:28:26 +0200 Subject: [PATCH 249/626] adapt to [gs]etxattr() which replace l[gs]etxattr() New version of SELinux user-space (3.4) brought a change that affects this automated test. Functions like lgetxattr and lsetxattr were replaced by functions getxattr and setxattr. TBA --- .../selinux_restorecon-functions/main.fmf | 1 + .../selinux_restorecon-functions/runtest.sh | 52 +++++++++---------- 2 files changed, 27 insertions(+), 26 deletions(-) diff --git a/libselinux/selinux_restorecon-functions/main.fmf b/libselinux/selinux_restorecon-functions/main.fmf index 528527d..728942e 100644 --- a/libselinux/selinux_restorecon-functions/main.fmf +++ b/libselinux/selinux_restorecon-functions/main.fmf @@ -7,6 +7,7 @@ recommend: - libselinux - libselinux-devel - glibc + - gcc - strace - gcc enabled: true diff --git a/libselinux/selinux_restorecon-functions/runtest.sh b/libselinux/selinux_restorecon-functions/runtest.sh index d5d37ad..b09e6f4 100755 --- a/libselinux/selinux_restorecon-functions/runtest.sh +++ b/libselinux/selinux_restorecon-functions/runtest.sh @@ -111,8 +111,8 @@ rlJournalStart rlRun "strace -ostrace.out -s 64 ./test_restorecon $TmpDir" 0 "Calling selinux_restorecon" - rlLogInfo "Checking lgetxattr calls" - rlRun "grep lgetxattr strace.out | grep security.selinux > strace_xattr.out" + rlLogInfo "Checking getxattr calls" + rlRun "grep getxattr strace.out | grep security.selinux > strace_xattr.out" rlRun "grep \"\\\"$TmpDir\\\"\" strace_xattr.out | grep var_log_t" rlRun "grep \"\\\"$TmpDir/a\\\"\" strace_xattr.out | grep var_log_t" 1 @@ -121,8 +121,8 @@ rlJournalStart rlRun "grep \"\\\"$TmpDir/a/bfile\\\"\" strace_xattr.out | grep var_log_t" 1 rlRun "grep \"\\\"$TmpDir/a/b/cfile\\\"\" strace_xattr.out | grep var_log_t" 1 - rlLogInfo "Checking lsetxattr calls" - rlRun "grep lsetxattr strace.out | grep security.selinux > strace_xattr.out" + rlLogInfo "Checking setxattr calls" + rlRun "grep setxattr strace.out | grep security.selinux > strace_xattr.out" rlRun "grep \"\\\"$TmpDir\\\"\" strace_xattr.out | grep user_home_t" rlRun "grep \"\\\"$TmpDir/a\\\"\" strace_xattr.out | grep user_home_t" 1 @@ -143,8 +143,8 @@ rlJournalStart rlRun "strace -ostrace.out -s 64 ./test_restorecon $TmpDir RECURSE" 0 "Calling selinux_restorecon with RECURSE flag" - rlLogInfo "Checking lgetxattr calls" - rlRun "grep lgetxattr strace.out | grep security.selinux > strace_xattr.out" + rlLogInfo "Checking getxattr calls" + rlRun "grep getxattr strace.out | grep security.selinux > strace_xattr.out" rlRun "grep \"\\\"$TmpDir\\\"\" strace_xattr.out | grep var_log_t" rlRun "grep \"\\\"$TmpDir/a\\\"\" strace_xattr.out | grep var_log_t" @@ -153,8 +153,8 @@ rlJournalStart rlRun "grep \"\\\"$TmpDir/a/bfile\\\"\" strace_xattr.out | grep var_log_t" rlRun "grep \"\\\"$TmpDir/a/b/cfile\\\"\" strace_xattr.out | grep var_log_t" - rlLogInfo "Checking lsetxattr calls" - rlRun "grep lsetxattr strace.out | grep security.selinux > strace_xattr.out" + rlLogInfo "Checking setxattr calls" + rlRun "grep setxattr strace.out | grep security.selinux > strace_xattr.out" rlRun "grep \"\\\"$TmpDir\\\"\" strace_xattr.out | grep user_home_t" rlRun "grep \"\\\"$TmpDir/a\\\"\" strace_xattr.out | grep user_home_t" @@ -175,8 +175,8 @@ rlJournalStart rlRun "strace -ostrace.out -s 64 ./test_restorecon $TmpDir RECURSE NOCHANGE" 0 "Calling selinux_restorecon with NOCHANGE flag" - rlLogInfo "Checking lsetxattr calls" - rlRun "grep lsetxattr strace.out" 1 + rlLogInfo "Checking setxattr calls" + rlRun "grep setxattr strace.out" 1 rlRun "rm -f strace.out" @@ -203,8 +203,8 @@ rlJournalStart # run restorecon first time rlRun "strace -ostrace.out -s 64 ./test_restorecon $TmpDir RECURSE" 0 "Calling selinux_restorecon for the first time" - rlLogInfo "Checking lgetxattr calls" - rlRun "grep lgetxattr strace.out | grep security.selinux > strace_xattr.out" + rlLogInfo "Checking getxattr calls" + rlRun "grep getxattr strace.out | grep security.selinux > strace_xattr.out" rlRun "grep \"\\\"$TmpDir\\\"\" strace_xattr.out" rlRun "grep \"\\\"$TmpDir/a\\\"\" strace_xattr.out" @@ -216,8 +216,8 @@ rlJournalStart # run restorecon second time rlRun "strace -ostrace.out -s 64 ./test_restorecon $TmpDir RECURSE" 0 "Calling selinux_restorecon for the second time" - rlLogInfo "Checking lgetxattr calls" - rlRun "grep lgetxattr strace.out | grep security.selinux" 1 + rlLogInfo "Checking getxattr calls" + rlRun "grep getxattr strace.out | grep security.selinux" 1 rlRun "rm -f strace.out" rlRun "rm -f strace_xattr.out" @@ -231,8 +231,8 @@ rlJournalStart # run restorecon first time rlRun "strace -ostrace.out -s 64 ./test_restorecon $TmpDir RECURSE" 0 "Calling selinux_restorecon for the first time" - rlLogInfo "Checking lgetxattr calls" - rlRun "grep lgetxattr strace.out | grep security.selinux > strace_xattr.out" + rlLogInfo "Checking getxattr calls" + rlRun "grep getxattr strace.out | grep security.selinux > strace_xattr.out" rlRun "grep \"\\\"$TmpDir\\\"\" strace_xattr.out" rlRun "grep \"\\\"$TmpDir/a\\\"\" strace_xattr.out" @@ -244,8 +244,8 @@ rlJournalStart # run restorecon second time rlRun "strace -ostrace.out -s 64 ./test_restorecon $TmpDir RECURSE IGNORE_DIGEST" 0 "Calling selinux_restorecon for the second time" - rlLogInfo "Checking lgetxattr calls" - rlRun "grep lgetxattr strace.out | grep security.selinux > strace_xattr.out" + rlLogInfo "Checking getxattr calls" + rlRun "grep getxattr strace.out | grep security.selinux > strace_xattr.out" rlRun "grep \"\\\"$TmpDir\\\"\" strace_xattr.out" rlRun "grep \"\\\"$TmpDir/a\\\"\" strace_xattr.out" @@ -266,8 +266,8 @@ rlJournalStart # empty exclude list rlRun "strace -ostrace.out -s 64 ./test_exclude_list EMPTY $TmpDir" 0 "Calling selinux_restorecon_set_exclude_list with empty list" - rlLogInfo "Checking lgetxattr calls" - rlRun "grep lgetxattr strace.out | grep security.selinux > strace_xattr.out" + rlLogInfo "Checking getxattr calls" + rlRun "grep getxattr strace.out | grep security.selinux > strace_xattr.out" rlRun "grep \"\\\"$TmpDir\\\"\" strace_xattr.out" rlRun "grep \"\\\"$TmpDir/a\\\"\" strace_xattr.out" @@ -279,8 +279,8 @@ rlJournalStart # exclude $TmpDir/a rlRun "strace -ostrace.out -s 64 ./test_exclude_list $TmpDir/a $TmpDir" 0 "Calling selinux_restorecon_set_exclude_list" - rlLogInfo "Checking lgetxattr calls" - rlRun "grep lgetxattr strace.out | grep security.selinux > strace_xattr.out" + rlLogInfo "Checking getxattr calls" + rlRun "grep getxattr strace.out | grep security.selinux > strace_xattr.out" rlRun "grep \"\\\"$TmpDir\\\"\" strace_xattr.out" rlRun "grep \"\\\"$TmpDir/a\\\"\" strace_xattr.out" 1 @@ -301,8 +301,8 @@ rlJournalStart # default sehandle rlRun "strace -ostrace.out -s 64 ./test_sehandle DEFAULT $TmpDir" 0 "Calling selinux_restorecon_set_sehandle with default handle" - rlLogInfo "Checking lgetxattr calls" - rlRun "grep lgetxattr strace.out | grep security.selinux > strace_xattr.out" + rlLogInfo "Checking getxattr calls" + rlRun "grep getxattr strace.out | grep security.selinux > strace_xattr.out" rlRun "grep \"\\\"$TmpDir\\\"\" strace_xattr.out" rlRun "grep \"\\\"$TmpDir/a\\\"\" strace_xattr.out" @@ -314,8 +314,8 @@ rlJournalStart # custom sehandle rlRun "strace -ostrace.out -s 64 ./test_sehandle CUSTOM $TmpDir" 0 "Calling selinux_restorecon_set_sehandle with custom handle" - rlLogInfo "Checking lgetxattr calls" - rlRun "grep lgetxattr strace.out | grep security.selinux > strace_xattr.out" + rlLogInfo "Checking getxattr calls" + rlRun "grep getxattr strace.out | grep security.selinux > strace_xattr.out" rlRun "grep \"\\\"$TmpDir\\\"\" strace_xattr.out" rlRun "grep \"\\\"$TmpDir/a\\\"\" strace_xattr.out" From 7a375ff479cd3d5583844aa64f29695598690fe6 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 20 Jun 2023 16:12:23 +0200 Subject: [PATCH 250/626] add the exim test to upstream repo The exim component is frequently used by various users on Fedora and RHEL, so it makes sense to run this TC in upstream testing too. There are no changes in the TC functionality. Moving the downstream TC to upstream repo. --- selinux-policy/exim-and-similar/Makefile | 69 +++++++++++++ selinux-policy/exim-and-similar/PURPOSE | 5 + selinux-policy/exim-and-similar/main.fmf | 49 ++++++++++ selinux-policy/exim-and-similar/runtest.sh | 107 +++++++++++++++++++++ 4 files changed, 230 insertions(+) create mode 100644 selinux-policy/exim-and-similar/Makefile create mode 100644 selinux-policy/exim-and-similar/PURPOSE create mode 100644 selinux-policy/exim-and-similar/main.fmf create mode 100755 selinux-policy/exim-and-similar/runtest.sh diff --git a/selinux-policy/exim-and-similar/Makefile b/selinux-policy/exim-and-similar/Makefile new file mode 100644 index 0000000..fe0c535 --- /dev/null +++ b/selinux-policy/exim-and-similar/Makefile @@ -0,0 +1,69 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/exim-and-similar +# Description: the service was running as initrc_t or init_t, now it is confined by SELinux +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/exim-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: the service was running as initrc_t or init_t, now it is confined by SELinux" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 5m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted /usr/sbin/service setools-console glib2 exim" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Releases: -RHEL4" >> $(METADATA) + @echo "Bug: 1025315" >> $(METADATA) # RHEL-6 + @echo "Bug: 1444441" >> $(METADATA) # RHEL-7 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/exim-and-similar/PURPOSE b/selinux-policy/exim-and-similar/PURPOSE new file mode 100644 index 0000000..8501e39 --- /dev/null +++ b/selinux-policy/exim-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/exim-and-similar +Author: Milos Malik + +SELinux interferes with exim and related programs. + diff --git a/selinux-policy/exim-and-similar/main.fmf b/selinux-policy/exim-and-similar/main.fmf new file mode 100644 index 0000000..a1e0788 --- /dev/null +++ b/selinux-policy/exim-and-similar/main.fmf @@ -0,0 +1,49 @@ +summary: the service was running as initrc_t or init_t, now it is confined by SELinux +description: |+ + SELinux interferes with exim and related programs. + +contact: Milos Malik +component: + - selinux-policy +test: ./runtest.sh +framework: beakerlib +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - /usr/sbin/service + - setools-console + - glib2 + - exim +environment: + AVC_ERROR: +no_avc_check +duration: 5m +enabled: true +tag: + - NoRHEL4 + - TIPpass_Security + - TierCandidatesPASS + - f31friendly + - f32friendly + - targeted + - epel + - rhel8-epel + - rhel9-epel +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1025315 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1444441 +adjust: + - enabled: false + when: distro == rhel-4, rhel-alt-7 + continue: false + - enabled: false + when: arch == i386, ppc64, s390 + continue: false +extra-nitrate: TC#0057402 +extra-summary: /CoreOS/selinux-policy/Regression/exim-and-similar +extra-task: /CoreOS/selinux-policy/Regression/exim-and-similar diff --git a/selinux-policy/exim-and-similar/runtest.sh b/selinux-policy/exim-and-similar/runtest.sh new file mode 100755 index 0000000..7d080a5 --- /dev/null +++ b/selinux-policy/exim-and-similar/runtest.sh @@ -0,0 +1,107 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/exim-and-similar +# Description: the service was running as initrc_t or init_t, now it is confined by SELinux +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +ROOT_PASSWORD="redhat" +FILE_PATH="/usr/sbin/exim" +FILE_CONTEXT="exim_exec_t" +SERVICE_PACKAGE="exim" +SERVICE_NAME="exim" +PROCESS_NAME="exim" +PROCESS_CONTEXT="exim_t" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} + rlFileBackup /etc/shadow + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + if ! rlIsRHEL 5 ; then + rlPhaseStartTest "bz#1025315" + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + if rlIsRHEL 6 ; then + SOURCE_TYPE="initrc_t" + rlSEMatchPathCon "/sys/devices/system/cpu" "sysfs_t" + rlSEMatchPathCon "/sys/devices/system/cpu/online" "sysfs_t" + rlSESearchRule "allow exim_t sysfs_t : file { getattr open read }" + else # RHEL-7 etc. + SOURCE_TYPE="init_t" # systemd runs the process + rlSEMatchPathCon "/sys/devices/system/cpu" "sysfs_t" + rlSEMatchPathCon "/sys/devices/system/cpu/online" "cpu_online_t" + rlSESearchRule "allow exim_t cpu_online_t : file { getattr open read }" + fi + rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" + rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" + rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" + rlSESearchRule "allow exim_t sysfs_t : dir { search }" + rlPhaseEnd + fi + + if rlIsRHEL 7 ; then + rlPhaseStartTest "bz#1444441" + rlSEMatchPathCon "/usr/sbin/exim" "exim_exec_t" + rlSESearchRule "allow exim_t sysctl_net_t : dir { getattr open search } [ ]" + rlSESearchRule "allow exim_t sysctl_net_t : file { getattr open read } [ ]" + rlPhaseEnd + fi + + rlPhaseStartTest "real scenario -- standalone service" + rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + # for RHELs where the SELinux domain does not exist yet + PROCESS_CONTEXT="sendmail_t" + fi + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + From 67fe54314a6a997f346871e284192afeba598f88 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Wed, 21 Jun 2023 08:20:41 +0200 Subject: [PATCH 251/626] add the thttpd test to upstream repo The thttpd component is frequently used by various users on Fedora and RHEL, so it makes sense to run this TC in upstream testing too. There are no changes in the TC functionality. Moving the downstream TC to upstream repo. --- selinux-policy/thttpd-and-similar/Makefile | 71 ++++++++++++ selinux-policy/thttpd-and-similar/PURPOSE | 5 + selinux-policy/thttpd-and-similar/main.fmf | 48 ++++++++ selinux-policy/thttpd-and-similar/runtest.sh | 110 +++++++++++++++++++ 4 files changed, 234 insertions(+) create mode 100644 selinux-policy/thttpd-and-similar/Makefile create mode 100644 selinux-policy/thttpd-and-similar/PURPOSE create mode 100644 selinux-policy/thttpd-and-similar/main.fmf create mode 100755 selinux-policy/thttpd-and-similar/runtest.sh diff --git a/selinux-policy/thttpd-and-similar/Makefile b/selinux-policy/thttpd-and-similar/Makefile new file mode 100644 index 0000000..550c373 --- /dev/null +++ b/selinux-policy/thttpd-and-similar/Makefile @@ -0,0 +1,71 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/thttpd-and-similar +# Description: SELinux interferes with thhtpd and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/thttpd-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with thttpd and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 5m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted /usr/sbin/service setools-console thttpd" >> $(METADATA) # EPEL + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Releases: -RHEL4" >> $(METADATA) + @echo "Architectures: i386 x86_64" >> $(METADATA) + @echo "Bug: 1069843" >> $(METADATA) # RHEL-6 + @echo "Bug: 1087384" >> $(METADATA) # RHEL-7 + @echo "Bug: 1111581" >> $(METADATA) # RHEL-6 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/thttpd-and-similar/PURPOSE b/selinux-policy/thttpd-and-similar/PURPOSE new file mode 100644 index 0000000..4d669c4 --- /dev/null +++ b/selinux-policy/thttpd-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/thttpd-and-similar +Author: Milos Malik + +SELinux interferes with thttpd and related programs. + diff --git a/selinux-policy/thttpd-and-similar/main.fmf b/selinux-policy/thttpd-and-similar/main.fmf new file mode 100644 index 0000000..bbc4973 --- /dev/null +++ b/selinux-policy/thttpd-and-similar/main.fmf @@ -0,0 +1,48 @@ +summary: SELinux interferes with the thttpd and related programs +description: |+ + SELinux interferes with thttpd and related programs. + +contact: Milos Malik +component: + - selinux-policy +test: ./runtest.sh +framework: beakerlib +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - /usr/sbin/service + - setools-console + - thttpd +environment: + AVC_ERROR: +no_avc_check +duration: 5m +enabled: true +tag: + - NoRHEL4 + - Tier2 + - Tier2se + - TierCandidatesPASS + - f31friendly + - f32friendly + - targeted +tier: '2' +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1069843 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1087384 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1111581 +adjust: + - enabled: false + when: distro == rhel-4, rhel-alt-7, rhel-9 + continue: false + - enabled: false + when: arch == i386, ppc64, s390 + continue: false +extra-nitrate: TC#0340646 +extra-summary: /CoreOS/selinux-policy/Regression/thttpd-and-similar +extra-task: /CoreOS/selinux-policy/Regression/thttpd-and-similar diff --git a/selinux-policy/thttpd-and-similar/runtest.sh b/selinux-policy/thttpd-and-similar/runtest.sh new file mode 100755 index 0000000..4570319 --- /dev/null +++ b/selinux-policy/thttpd-and-similar/runtest.sh @@ -0,0 +1,110 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/thttpd-and-similar +# Description: SELinux interferes with thttpd and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +ROOT_PASSWORD="redhat" +FILE_PATH="/usr/sbin/thttpd" +FILE_CONTEXT="httpd_exec_t" +SERVICE_PACKAGE="thttpd" +SERVICE_NAME="thttpd" +PROCESS_NAME="thttpd" +PROCESS_CONTEXT="httpd_t" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop `rlSEListServices 80` + rlFileBackup /etc/shadow + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + if ! rlIsRHEL 5 ; then + rlPhaseStartTest "bz#1069843" + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + if rlIsRHEL 6 ; then + SOURCE_TYPE="initrc_t" + else # RHEL-7 etc. + SOURCE_TYPE="init_t" # systemd runs the process + fi + rlSEMatchPathCon "/etc/thttpd.conf" "httpd_config_t" + rlSEMatchPathCon "/var/log/thttpd.log" "httpd_log_t" + rlSEMatchPathCon "/var/run/thttpd.pid" "httpd_var_run_t" + rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" + rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" + rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" + rlPhaseEnd + + rlPhaseStartTest "bz#1087384 + bz#1111581" + if rlIsRHEL 6 ; then + rlSEMatchPathCon "/etc/rc.d/init.d/thttpd" "httpd_initrc_exec_t" + else # RHEL-7 etc. + rlSEMatchPathCon "/lib/systemd/system/thttpd.service" "httpd_unit_file_t" + fi + rlSEMatchPathCon "/usr/sbin/thttpd" "httpd_exec_t" + rlSEMatchPathCon "/var/log/thttpd.log" "httpd_log_t" + rlSESearchRule "allow httpd_t httpd_t : capability { sys_chroot }" + rlSESearchRule "allow httpd_t httpd_log_t : file { setattr }" + rlPhaseEnd + fi + + rlPhaseStartTest "real scenario -- standalone service" + # because of the fowner capability + rlRun "setsebool httpd_run_stickshift on" + rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" + if rlIsRHEL 5 ; then + # for RHELs where the SELinux domain does not exist yet + PROCESS_CONTEXT="initrc_t" + fi + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /etc /var /run -e /var/ARTIFACTS" 0-255 + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlRun "setsebool httpd_run_stickshift off" + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlServiceRestore `rlSEListServices 80` + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + From 8b0f575ac2fce291879cb70772e31c7739aecdec Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Wed, 21 Jun 2023 11:49:19 +0200 Subject: [PATCH 252/626] add the boinc test to upstream repo The boinc-client component is also used by various users on Fedora and RHEL, so it makes sense to run this TC in upstream testing too. There are no changes in the TC functionality. Moving the downstream TC to upstream repo. --- selinux-policy/boinc-and-similar/Makefile | 71 +++++++++++++ selinux-policy/boinc-and-similar/PURPOSE | 5 + selinux-policy/boinc-and-similar/main.fmf | 47 +++++++++ selinux-policy/boinc-and-similar/runtest.sh | 107 ++++++++++++++++++++ 4 files changed, 230 insertions(+) create mode 100644 selinux-policy/boinc-and-similar/Makefile create mode 100644 selinux-policy/boinc-and-similar/PURPOSE create mode 100644 selinux-policy/boinc-and-similar/main.fmf create mode 100755 selinux-policy/boinc-and-similar/runtest.sh diff --git a/selinux-policy/boinc-and-similar/Makefile b/selinux-policy/boinc-and-similar/Makefile new file mode 100644 index 0000000..467133b --- /dev/null +++ b/selinux-policy/boinc-and-similar/Makefile @@ -0,0 +1,71 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/boinc-and-similar +# Description: SELinux interferes with boinc and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/boinc-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with boinc and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: boinc-client" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console boinc-client /usr/sbin/service" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6" >> $(METADATA) + @echo "Bug: 1618683" >> $(METADATA) # RHEL-7 + @echo "Bug: 1711682" >> $(METADATA) # Fedora 30 + @echo "Bug: 1779070" >> $(METADATA) # RHEL-8 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/boinc-and-similar/PURPOSE b/selinux-policy/boinc-and-similar/PURPOSE new file mode 100644 index 0000000..5f8f3b6 --- /dev/null +++ b/selinux-policy/boinc-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/boinc-and-similar +Author: Milos Malik + +SELinux interferes with BOINC client (Berkeley Open Infrastructure Network Computing) and related programs. + diff --git a/selinux-policy/boinc-and-similar/main.fmf b/selinux-policy/boinc-and-similar/main.fmf new file mode 100644 index 0000000..f778d87 --- /dev/null +++ b/selinux-policy/boinc-and-similar/main.fmf @@ -0,0 +1,47 @@ +summary: SELinux interferes with boinc and related programs +description: |+ + SELinux interferes with BOINC client (Berkeley Open Infrastructure Network Computing) and related programs. + +contact: Milos Malik +component: + - selinux-policy +test: ./runtest.sh +framework: beakerlib +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - boinc-client + - /usr/sbin/service +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - TierCandidatesPASS + - f32friendly + - f33friendly + - targeted +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1618683 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1711682 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1779070 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6 + continue: false + - enabled: false + when: arch == aarch64, s390x + continue: false +extra-nitrate: TC#0563640 +extra-summary: /CoreOS/selinux-policy/Regression/boinc-and-similar +extra-task: /CoreOS/selinux-policy/Regression/boinc-and-similar diff --git a/selinux-policy/boinc-and-similar/runtest.sh b/selinux-policy/boinc-and-similar/runtest.sh new file mode 100755 index 0000000..d58f467 --- /dev/null +++ b/selinux-policy/boinc-and-similar/runtest.sh @@ -0,0 +1,107 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/boinc-and-similar +# Description: SELinux interferes with boinc and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +ROOT_PASSWORD="redhat" +FILE_PATH="/usr/bin/boinc_client" +FILE_CONTEXT="boinc_exec_t" +SERVICE_PACKAGE="boinc-client" +SERVICE_NAME="boinc-client" +PROCESS_NAME="boinc" +PROCESS_CONTEXT="boinc_t" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} + rlFileBackup /etc/shadow + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "bz#1618683" + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + if rlIsRHEL 5 ; then + SOURCE_TYPE="initrc_t" + BOOLEANS="[ ]" + elif rlIsRHEL 6 ; then + SOURCE_TYPE="initrc_t" + else # RHEL-7 etc. + SOURCE_TYPE="init_t" # systemd runs the process + fi + rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" + rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" + rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" + rlSESearchRule "allow boinc_t boinc_exec_t : file { execute_no_trans }" + rlPhaseEnd + + rlPhaseStartTest "bz#1711682 + bz#1779070" + # /usr/bin/boinc and /usr/bin/boinc_client are hardlinks, share the same inode + rlSEMatchPathCon "/usr/bin/boinc_client" "boinc_exec_t" + rlSEMatchPathCon "/var/lib/boinc" "boinc_var_lib_t" + rlSEMatchPathCon "/run/systemd/unit-root/var/lib/boinc" "init_var_run_t" + rlSESearchRule "allow init_t boinc_var_lib_t : dir { mounton } [ ]" + # SELinux denials appear if the following line is in boinc-client system unit file + # ReadWritePaths=/var/lib/boinc + rlPhaseEnd + + rlPhaseStartTest "real scenario -- standalone service" + rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + if rlIsRHEL 5 6 ; then + PROCESS_CONTEXT="initrc_t" + else + PROCESS_CONTEXT="unconfined_service_t" + fi + fi + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + From db5f56d258e7a2fe49b4fe4483e780e6eb06be6f Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Fri, 23 Jun 2023 10:41:42 +0200 Subject: [PATCH 253/626] work around the dnf5 issue when --skip-broken is not recognized The SELinux beaker library calls the yum/dnf command and the "--skip-broken" option is placed before the "install" word on the command line. Such command line executed on Fedora rawhide leads to the following error message: Unknown argument "--skip-broken" for command "dnf5". Add "--help" for more information about the arguments. In order to work around this issue, the "install" word was moved before the rest of options. Manual testing revealed that this approach works on Fedora rawhide. --- checkpolicy/sedispol/main.fmf | 1 - libsemanage/sanity-tests/main.fmf | 1 - selinux-policy/Library/common/lib.sh | 6 +++--- selinux-policy/cups-browsed-and-similar/main.fmf | 5 ----- 4 files changed, 3 insertions(+), 10 deletions(-) diff --git a/checkpolicy/sedispol/main.fmf b/checkpolicy/sedispol/main.fmf index b141118..f6506f7 100644 --- a/checkpolicy/sedispol/main.fmf +++ b/checkpolicy/sedispol/main.fmf @@ -15,7 +15,6 @@ tag: - CI-Tier-1 - NoRHEL4 - NoRHEL5 - - TIPfail_Security - Tier2 - Tier2se - f31friendly diff --git a/libsemanage/sanity-tests/main.fmf b/libsemanage/sanity-tests/main.fmf index 1dc5b00..e44669e 100644 --- a/libsemanage/sanity-tests/main.fmf +++ b/libsemanage/sanity-tests/main.fmf @@ -17,7 +17,6 @@ tag: - CI-Tier-1 - NoRHEL4 - NoRHEL5 - - TIPfail_Security - Tier1 - Tier1se - f31friendly diff --git a/selinux-policy/Library/common/lib.sh b/selinux-policy/Library/common/lib.sh index 658d42e..7858110 100755 --- a/selinux-policy/Library/common/lib.sh +++ b/selinux-policy/Library/common/lib.sh @@ -1558,7 +1558,7 @@ function rlSESatisfyRequires() { return 0 fi - rlRun "epelyum -y --nobest --nogpgcheck --skip-broken install ${PACKAGE_LIST} ${PACKAGE_LIST2}" 0,1 + rlRun "epelyum install -y --nobest --nogpgcheck --skip-broken ${PACKAGE_LIST} ${PACKAGE_LIST2}" 0,1 } __INTERNAL_rlSEModuleList() { @@ -2024,9 +2024,9 @@ rlSELibraryLoaded() { fi if rlIsRHEL; then - rlRun "yum -y --skip-broken install $rlSE_REQUIRES" + rlRun "yum install -y --skip-broken $rlSE_REQUIRES" else - rlRun "dnf -y --skip-broken install $rlSE_REQUIRES" + rlRun "dnf install -y --skip-broken $rlSE_REQUIRES" fi # make sure that restorecon does not change SELinux contexts under /var/ARTIFACTS diff --git a/selinux-policy/cups-browsed-and-similar/main.fmf b/selinux-policy/cups-browsed-and-similar/main.fmf index d034c54..97d6169 100644 --- a/selinux-policy/cups-browsed-and-similar/main.fmf +++ b/selinux-policy/cups-browsed-and-similar/main.fmf @@ -28,11 +28,6 @@ tag: - NoRHEL5 - NoRHEL6 - RHEL8 - - TIP_fedora_pass - - TIPfail_infra - - TIPpass - - TIPpass_FIPS - - TIPpass_Security - Tier1 - Tier1security - Tier2se From a1c679b5e7066ca44e2f170309c64bc2059a4549 Mon Sep 17 00:00:00 2001 From: Zdenek Pytela Date: Wed, 28 Jun 2023 08:14:29 +0200 Subject: [PATCH 254/626] Change file and process context for bootupd The service has been confined in the latest policy, so the /usr/libexec/bootupd executable is labeled bootupd_exec_t and the process bootupd_t. --- selinux-policy/bootupd-and-similar/runtest.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/selinux-policy/bootupd-and-similar/runtest.sh b/selinux-policy/bootupd-and-similar/runtest.sh index 5ac7488..86594fa 100755 --- a/selinux-policy/bootupd-and-similar/runtest.sh +++ b/selinux-policy/bootupd-and-similar/runtest.sh @@ -31,11 +31,11 @@ PACKAGE="selinux-policy" FILE_PATH="/usr/libexec/bootupd" -FILE_CONTEXT="bin_t" +FILE_CONTEXT="bootupd_exec_t" SERVICE_PACKAGE="bootupd" SERVICE_NAME="bootupd" PROCESS_NAME="bootupd" -PROCESS_CONTEXT="unconfined_service_t" +PROCESS_CONTEXT="bootupd_t" rlJournalStart rlPhaseStartSetup From 4b66a7926655ad17f617336eee04275390f70ad7 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Wed, 28 Jun 2023 18:03:42 +0200 Subject: [PATCH 255/626] test if bootupd can search under /boot/efi/EFI Recent bootupd testing revealed SELinux denials which were triggered because the bootupd process wanted to use the following access: * getattr (syscall=statx) on /boot/efi directory (dosfs_t) * search (syscall=openat) on /boot/efi/EFI directory (dosfs_t) The TC reproduces the situation on machines where /boot/efi/EFI is mounted accordingly. In order to enable the expected functionality of the bootupd service, I believe that SELinux policy should allow the accesses mentioned above. The TC looks for appropriate policy rules. The TC covers BZ#2218106. --- selinux-policy/bootupd-and-similar/Makefile | 1 + selinux-policy/bootupd-and-similar/main.fmf | 1 + selinux-policy/bootupd-and-similar/runtest.sh | 8 +++++++- 3 files changed, 9 insertions(+), 1 deletion(-) diff --git a/selinux-policy/bootupd-and-similar/Makefile b/selinux-policy/bootupd-and-similar/Makefile index 77a2f71..d83b326 100644 --- a/selinux-policy/bootupd-and-similar/Makefile +++ b/selinux-policy/bootupd-and-similar/Makefile @@ -64,6 +64,7 @@ $(METADATA): Makefile @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) @echo "Bug: 2029478" >> $(METADATA) # RHEL-9 @echo "Bug: 2044508" >> $(METADATA) # RHEL-9 + @echo "Bug: 2218106" >> $(METADATA) # Fedora rawhide rhts-lint $(METADATA) diff --git a/selinux-policy/bootupd-and-similar/main.fmf b/selinux-policy/bootupd-and-similar/main.fmf index 2b38dc4..d7b2163 100644 --- a/selinux-policy/bootupd-and-similar/main.fmf +++ b/selinux-policy/bootupd-and-similar/main.fmf @@ -33,6 +33,7 @@ tier: '3' link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2029478 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2044508 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2218106 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 diff --git a/selinux-policy/bootupd-and-similar/runtest.sh b/selinux-policy/bootupd-and-similar/runtest.sh index 86594fa..5064abc 100755 --- a/selinux-policy/bootupd-and-similar/runtest.sh +++ b/selinux-policy/bootupd-and-similar/runtest.sh @@ -62,6 +62,12 @@ rlJournalStart rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" rlPhaseEnd + rlPhaseStartTest "bz#2218106" + rlSEMatchPathCon "/usr/libexec/bootupd" "bootupd_exec_t" + rlRun "ls -RlZ /boot/efi" + rlSESearchRule "allow bootupd_t dosfs_t : dir { getattr search } [ ]" + rlPhaseEnd + rlPhaseStartTest "real scenario -- standalone service" if ! rlSEDefined ${PROCESS_CONTEXT} ; then # for RHELs where the SELinux domain does not exist yet @@ -80,7 +86,7 @@ rlJournalStart sleep 1 rlRun "bootupctl status" 0,1 rlRun "bootupctl validate" 0,1 - rlRun "lsblk -O" + rlRun "lsblk" rlRun "systemctl stop ${SERVICE_NAME}.socket" rlRun "systemctl disable ${SERVICE_NAME}.socket" rlPhaseEnd From 9bcbe2e024a9ba877e37bf3d142593cec80fb997 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Tue, 4 Jul 2023 13:09:11 +0200 Subject: [PATCH 256/626] kernel/selinux-testsuite: bump ustream commit ref This mainly pulls in the new inet_socket/mptcp subtest that provides coverage for the MPTCP protocol. Signed-off-by: Ondrej Mosnacek --- kernel/selinux-testsuite/runtest.sh | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/kernel/selinux-testsuite/runtest.sh b/kernel/selinux-testsuite/runtest.sh index 8e785ab..4170bdd 100755 --- a/kernel/selinux-testsuite/runtest.sh +++ b/kernel/selinux-testsuite/runtest.sh @@ -35,7 +35,7 @@ PACKAGE="selinux-policy" # This should be updated as needed after verifying that the new version # doesn't break testing and after applying all necessary tweaks in the TC. # Run with GIT_BRANCH=master to run the latest upstream version. -DEFAULT_COMMIT="5fc5dc9f5964aae3a6dce57178b25ddc49d21415" +DEFAULT_COMMIT="514e324abc099057782ec569b720eaf9b6d9d99f" # Default pull requests to merge before running the test. # If non-empty, then after checking out GIT_BRANCH the listed upstream pull # requests (by number) are merged, creating a new temporary local branch. @@ -328,7 +328,7 @@ rlJournalStart if kver_lt "3.10.0-693"; then # I don't know when exactly these tests start passing, so I'm just # disabling them for anything below the RHEL-7.4 kernel... - exclude_tests+=" inet_socket" + exclude_tests+=" inet_socket/tcp inet_socket/udp" exclude_tests+=" filesystem/ext4 filesystem/xfs filesystem/jfs filesystem/vfat" fi @@ -395,6 +395,12 @@ rlJournalStart rlRun "sed -i 's/5\.18/4.18/g' tests/sctp/test" 0 \ "Fix up kernel version in sctp test" fi + + # TODO: wait for 786fc12457268cc9b555dde6c22ae7300d4b40e1 + # to be backported + #if kver_ge 5.14.0-326; then + # force_tests+=" inet_socket/mptcp" + #fi fi # CKI mainline kernels don't ship with module build infrastructure From bf25ac6f26854ee8ecee31bd77151d1464d4e03e Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Wed, 21 Jun 2023 13:01:40 +0200 Subject: [PATCH 257/626] add the targetd test to upstream repo The targetd component is also used by various users on Fedora and RHEL, so it makes sense to run this TC in upstream testing too. There are no changes in the TC functionality. Moving the downstream TC to upstream repo. --- selinux-policy/targetd-and-similar/Makefile | 77 +++++++ selinux-policy/targetd-and-similar/PURPOSE | 5 + selinux-policy/targetd-and-similar/main.fmf | 54 +++++ selinux-policy/targetd-and-similar/runtest.sh | 194 ++++++++++++++++++ 4 files changed, 330 insertions(+) create mode 100644 selinux-policy/targetd-and-similar/Makefile create mode 100644 selinux-policy/targetd-and-similar/PURPOSE create mode 100644 selinux-policy/targetd-and-similar/main.fmf create mode 100755 selinux-policy/targetd-and-similar/runtest.sh diff --git a/selinux-policy/targetd-and-similar/Makefile b/selinux-policy/targetd-and-similar/Makefile new file mode 100644 index 0000000..3303609 --- /dev/null +++ b/selinux-policy/targetd-and-similar/Makefile @@ -0,0 +1,77 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/targetd-and-similar +# Description: SELinux interferes with targetd and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/targetd-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with targetd and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 15m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "RunFor: targetd" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console targetd targetcli lvm2 /usr/sbin/service httpd" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6" >> $(METADATA) + @echo "Bug: 1063714" >> $(METADATA) # RHEL-7 + @echo "Bug: 1373860" >> $(METADATA) # RHEL-7 + @echo "Bug: 1424621" >> $(METADATA) # RHEL-7 + @echo "Bug: 1486252" >> $(METADATA) # RHEL-7 + @echo "Bug: 1486259" >> $(METADATA) # RHEL-7 + @echo "Bug: 1546671" >> $(METADATA) # RHEL-7 + @echo "Bug: 1569663" >> $(METADATA) # RHEL-8 + @echo "Bug: 2062183" >> $(METADATA) # RHEL-8 + @echo "Bug: 2203720" >> $(METADATA) # RHEL-8 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/targetd-and-similar/PURPOSE b/selinux-policy/targetd-and-similar/PURPOSE new file mode 100644 index 0000000..f057996 --- /dev/null +++ b/selinux-policy/targetd-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/targetd-and-similar +Author: Milos Malik + +SELinux interferes with targetd and related programs. Possible interactions: targetd + btrfs. + diff --git a/selinux-policy/targetd-and-similar/main.fmf b/selinux-policy/targetd-and-similar/main.fmf new file mode 100644 index 0000000..90a3e75 --- /dev/null +++ b/selinux-policy/targetd-and-similar/main.fmf @@ -0,0 +1,54 @@ +summary: SELinux interferes with targetd and related programs +description: |+ + SELinux interferes with targetd and related programs. Possible interactions: targetd + btrfs. + +contact: Milos Malik +component: + - selinux-policy + - targetd +test: ./runtest.sh +framework: beakerlib +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - targetd + - targetcli + - lvm2 + - /usr/sbin/service + - httpd +environment: + AVC_ERROR: +no_avc_check +duration: 15m +enabled: false +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - TierCandidatesPASS + - epel + - rhel8-epel + - targeted +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1063714 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1373860 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1424621 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1486252 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1486259 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1546671 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1569663 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2062183 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2203720 +adjust: + - enabled: true + when: distro == rhel-7, rhel-8, fedora + because: the targetd package is not available elsewhere +extra-nitrate: TC#0337221 +extra-summary: /CoreOS/selinux-policy/Regression/targetd-and-similar +extra-task: /CoreOS/selinux-policy/Regression/targetd-and-similar diff --git a/selinux-policy/targetd-and-similar/runtest.sh b/selinux-policy/targetd-and-similar/runtest.sh new file mode 100755 index 0000000..605daf6 --- /dev/null +++ b/selinux-policy/targetd-and-similar/runtest.sh @@ -0,0 +1,194 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/targetd-and-similar +# Description: SELinux interferes with targetd and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +ROOT_PASSWORD="redhat" +FILE_PATH="/usr/bin/targetd" +FILE_CONTEXT="targetd_exec_t" +SERVICE_PACKAGE="targetd" +SERVICE_NAME="targetd" +PROCESS_NAME="targetd" +PROCESS_CONTEXT="targetd_t" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} + rlFileBackup --clean /etc/target/saveconfig.json + rlFileBackup --clean /etc/target/targetd.yaml + rlFileBackup /etc/lvm/lvm.conf + rlFileBackup /etc/shadow + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "bz#1063714" + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + if rlIsRHEL 5 ; then + SOURCE_TYPE="initrc_t" + BOOLEANS="[ ]" + elif rlIsRHEL 6 ; then + SOURCE_TYPE="initrc_t" + else # RHEL-7 etc. + SOURCE_TYPE="init_t" # systemd runs the process + fi + rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" + rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" + rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" + rlSESearchRule "allow targetd_t lvm_control_t : chr_file { getattr open read write ioctl } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1373860 + bz#1486252" + rlSEMatchPathCon "/usr/bin/targetd" "targetd_exec_t" + rlSESearchRule "allow targetd_t targetd_t : unix_dgram_socket { create getopt setopt ioctl }" + rlSESearchRule "allow targetd_t proc_net_t : file { getattr open read }" + rlSESearchRule "dontaudit targetd_t targetd_t : capability { net_admin }" + rlSESearchRule "allow targetd_t kernel_t : unix_dgram_socket { sendto }" + rlSESearchRule "dontaudit targetd_t rpm_exec_t : file { getattr }" + rlSESearchRule "allow targetd_t tmp_t : dir { getattr open read }" + rlSESearchRule "dontaudit targetd_t rpm_var_lib_t : file { getattr open }" + rlSESearchRule "dontaudit targetd_t semanage_store_t : dir { getattr }" + rlSESearchRule "allow targetd_t bin_t : file { getattr open read execute_no_trans }" + rlPhaseEnd + + rlPhaseStartTest "bz#1424621 + bz#1486259" + rlSEMatchPathCon "/var/run/dmeventd-client" "lvm_var_run_t" + rlSESearchRule "allow targetd_t bin_t : file { getattr open read execute_no_trans }" + rlSESearchRule "allow targetd_t targetd_t : tcp_socket { accept }" + if rlIsRHEL 5 6 7 ; then + rlSESearchRule "dontaudit targetd_t insmod_exec_t : file { getattr }" + fi + rlSESearchRule "allow targetd_t configfs_t : dir { add_name create getattr open read remove_name rmdir search write }" + rlSESearchRule "allow targetd_t configfs_t : file { getattr open read write }" + rlSESearchRule "allow targetd_t configfs_t : lnk_file { create getattr read unlink }" + # following 2 rules seem to needed by btrfs tool + # rlSESearchRule "allow targetd_t default_t : dir { ioctl read write }" + # rlSESearchRule "allow targetd_t unlabeled_t : dir { ioctl read write }" + # rlSESearchRule "allow targetd_t mnt_t : dir { ioctl read write }" + rlSESearchRule "allow targetd_t exports_t : file { getattr open read }" + rlSESearchRule "allow targetd_t fixed_disk_device_t : blk_file { write }" + rlSESearchRule "allow targetd_t fs_t : filesystem { getattr }" + rlSESearchRule "allow targetd_t kernel_t : system { ipc_info module_request }" + if rlIsRHEL 7 ; then + rlSESearchRule "allow targetd_t lvm_metadata_t : dir { add_name read remove_name write }" + rlSESearchRule "allow targetd_t lvm_metadata_t : file { create link rename unlink append }" + rlSESearchRule "allow targetd_t lvm_var_run_t : fifo_file { getattr open lock read write }" + fi + rlSESearchRule "allow targetd_t modules_conf_t : dir { getattr open read }" + rlSESearchRule "allow targetd_t modules_conf_t : file { getattr open read }" + rlSESearchRule "allow targetd_t modules_object_t : dir { search }" + rlSESearchRule "allow targetd_t modules_object_t : file { getattr open read }" + rlSESearchRule "allow targetd_t nfsd_fs_t : file { getattr open read }" + rlSESearchRule "allow targetd_t targetd_t : capability { ipc_lock sys_admin sys_nice }" + rlSESearchRule "allow targetd_t targetd_t : process { setsched }" + rlSESearchRule "allow targetd_t sysctl_rpc_t : dir { search }" + rlSESearchRule "allow targetd_t sysctl_rpc_t : file { getattr open read write }" + rlSESearchRule "allow targetd_t sysfs_t : file { write }" + rlSESearchRule "allow targetd_t var_lib_nfs_t : dir { add_name remove_name write }" + rlSESearchRule "allow targetd_t var_lib_nfs_t : file { create getattr lock open read rename unlink write }" + rlPhaseEnd + + if ! rlIsRHEL 5 6 7 ; then + rlPhaseStartTest "bz#1569663" + rlSEMatchPathCon "/etc/lvm/lvm.conf" "lvm_etc_t" + rlSESearchRule "allow targetd_t lvm_etc_t : file { map }" + rlPhaseEnd + + rlPhaseStartTest "bz#2062183" + rlSEMatchPathCon "/usr/sbin/lvm" "lvm_exec_t" + rlSESearchRule "allow targetd_t lvm_exec_t : file { getattr open read execute map } [ ]" + rlSESearchRule "type_transition targetd_t lvm_exec_t : process lvm_t" + rlSESearchRule "allow targetd_t lvm_t : process { transition } [ ]" + rlPhaseEnd + fi + + rlPhaseStartTest "bz#1546671" + rlSEMatchPathCon "/usr/bin/targetd" "targetd_exec_t" + rlSEMatchPathCon "/root/.local" "gconf_home_t" + rlSEMatchPathCon "/home/user/.local" "gconf_home_t" + rlSEMatchPathCon "/etc/lvm/lvm.conf" "lvm_etc_t" + rlSESearchRule "allow targetd_t gconf_home_t : dir { search }" + rlSESearchRule "allow targetd_t lvm_etc_t : file { map }" + rlPhaseEnd + + rlPhaseStartTest "bz#2203720" + rlSEMatchPathCon "/usr/bin/targetd" "targetd_exec_t" + rlSEMatchPathCon "/etc/httpd" "httpd_config_t" + rlSEMatchPathCon "/etc/httpd/conf" "httpd_config_t" + rlSESearchRule "dontaudit targetd_t httpd_config_t : dir { search } [ ]" + rlPhaseEnd + + rlPhaseStartTest "real scenario -- standalone service" + rlRun "rm -f /etc/target/saveconfig.json" + rlRun "rm -f /etc/target/targetd.yaml" + rlRun "targetctl clear" + rlRun "targetctl save" + rlRun "echo \"password: Str0nGp4ssw0rD\" > /etc/target/targetd.yaml" + rlRun "sed -i \"s/use_lvmetad = 1/use_lvmetad = 0/\" /etc/lvm/lvm.conf" + rlRun "ls -Z /etc/target" + LOOP_FILE="vg-targetd.img" + LOOP_DEVICE=`losetup -f` + rlRun "dd if=/dev/zero of=${LOOP_FILE} bs=1MB count=128" + rlRun "losetup ${LOOP_DEVICE} ${LOOP_FILE}" + rlRun "vgcreate vg-targetd ${LOOP_DEVICE}" + rlRun "vgdisplay" + rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + # for RHELs where the SELinux domain does not exist yet + PROCESS_CONTEXT="initrc_t" + fi + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "targetcli ls" + rlRun "targetcli version" + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlRun "vgremove vg-targetd" + rlRun "losetup -d ${LOOP_DEVICE}" + rlRun "rm -f ${LOOP_FILE}" + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + From 38125be1724e058d54023f0c23831c7b53d030bb Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Thu, 13 Jul 2023 09:34:54 +0200 Subject: [PATCH 258/626] test if targetd can search under /proc/sys/net/ Recent targetd testing revealed that SELinux prevents the targetd process from searching under the /proc/sys/net/ directory and reading the /proc/sys/net/ipv6/conf/all/disable_ipv6 file. The TC reproduces the situation. In order to support the expected functionality of the targetd service, I believe that SELinux policy should allow above-mentioned actions. The TC looks for appropriate policy rules and file context patterns. The TC covers BZ#2222199. --- selinux-policy/targetd-and-similar/Makefile | 1 + selinux-policy/targetd-and-similar/main.fmf | 1 + selinux-policy/targetd-and-similar/runtest.sh | 21 +++++++++++++++---- 3 files changed, 19 insertions(+), 4 deletions(-) diff --git a/selinux-policy/targetd-and-similar/Makefile b/selinux-policy/targetd-and-similar/Makefile index 3303609..85311e7 100644 --- a/selinux-policy/targetd-and-similar/Makefile +++ b/selinux-policy/targetd-and-similar/Makefile @@ -72,6 +72,7 @@ $(METADATA): Makefile @echo "Bug: 1569663" >> $(METADATA) # RHEL-8 @echo "Bug: 2062183" >> $(METADATA) # RHEL-8 @echo "Bug: 2203720" >> $(METADATA) # RHEL-8 + @echo "Bug: 2222199" >> $(METADATA) # Fedora rawhide rhts-lint $(METADATA) diff --git a/selinux-policy/targetd-and-similar/main.fmf b/selinux-policy/targetd-and-similar/main.fmf index 90a3e75..b4f15f5 100644 --- a/selinux-policy/targetd-and-similar/main.fmf +++ b/selinux-policy/targetd-and-similar/main.fmf @@ -45,6 +45,7 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1569663 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2062183 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2203720 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2222199 adjust: - enabled: true when: distro == rhel-7, rhel-8, fedora diff --git a/selinux-policy/targetd-and-similar/runtest.sh b/selinux-policy/targetd-and-similar/runtest.sh index 605daf6..35fb247 100755 --- a/selinux-policy/targetd-and-similar/runtest.sh +++ b/selinux-policy/targetd-and-similar/runtest.sh @@ -30,7 +30,6 @@ . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" -ROOT_PASSWORD="redhat" FILE_PATH="/usr/bin/targetd" FILE_CONTEXT="targetd_exec_t" SERVICE_PACKAGE="targetd" @@ -154,6 +153,19 @@ rlJournalStart rlSESearchRule "dontaudit targetd_t httpd_config_t : dir { search } [ ]" rlPhaseEnd + rlPhaseStartTest "bz#2222199" + rlSEMatchPathCon "/usr/bin/targetd" "targetd_exec_t" + if [ -f /proc/sys/net/ipv6/conf/all/disable_ipv6 ] ; then + rlRun "ls -dZ /proc/sys/net | grep :sysctl_net_t" + rlRun "ls -dZ /proc/sys/net/ipv6 | grep :sysctl_net_t" + rlRun "ls -dZ /proc/sys/net/ipv6/conf | grep :sysctl_net_t" + rlRun "ls -dZ /proc/sys/net/ipv6/conf/all | grep :sysctl_net_t" + rlRun "ls -Z /proc/sys/net/ipv6/conf/all/disable_ipv6 | grep :sysctl_net_t" + fi + rlSESearchRule "allow targetd_t sysctl_net_t : dir { search } [ ]" + rlSESearchRule "allow targetd_t sysctl_net_t : file { getattr open read } [ ]" + rlPhaseEnd + rlPhaseStartTest "real scenario -- standalone service" rlRun "rm -f /etc/target/saveconfig.json" rlRun "rm -f /etc/target/targetd.yaml" @@ -168,15 +180,16 @@ rlJournalStart rlRun "losetup ${LOOP_DEVICE} ${LOOP_FILE}" rlRun "vgcreate vg-targetd ${LOOP_DEVICE}" rlRun "vgdisplay" - rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" if ! rlSEDefined ${PROCESS_CONTEXT} ; then # for RHELs where the SELinux domain does not exist yet PROCESS_CONTEXT="initrc_t" fi - rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 rlRun "targetcli ls" rlRun "targetcli version" - rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status" 1 + rlRun "restorecon -Rv /etc /var /run -e /var/ARTIFACTS" 0-255 + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "stop status" 1 rlRun "vgremove vg-targetd" rlRun "losetup -d ${LOOP_DEVICE}" rlRun "rm -f ${LOOP_FILE}" From 769c99ed4810f40ec028a94ac311c2caecd9b1f4 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Mon, 17 Jul 2023 11:42:22 +0200 Subject: [PATCH 259/626] do not call epelyum when dnf or yum is missing There are environments where neither dnf nor yum are present. In such environments, it makes no sense to call the epelyum function. --- selinux-policy/Library/common/lib.sh | 7 +++++++ selinux-policy/systemd-timesyncd-and-similar/runtest.sh | 2 +- 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/selinux-policy/Library/common/lib.sh b/selinux-policy/Library/common/lib.sh index 7858110..683ecc7 100755 --- a/selinux-policy/Library/common/lib.sh +++ b/selinux-policy/Library/common/lib.sh @@ -1548,6 +1548,13 @@ function rlSESatisfyRequires() { # because that would most likely break the environment or fail return fi + + which dnf yum >& /dev/null + if [ $? -eq 2 ] ; then + rlLog "Neither dnf nor yum is present. Don't know how to install required packages." + return + fi + if [ $# -gt 0 ] ; then PACKAGE_LIST2="$*" fi diff --git a/selinux-policy/systemd-timesyncd-and-similar/runtest.sh b/selinux-policy/systemd-timesyncd-and-similar/runtest.sh index 4e26325..98aeb41 100755 --- a/selinux-policy/systemd-timesyncd-and-similar/runtest.sh +++ b/selinux-policy/systemd-timesyncd-and-similar/runtest.sh @@ -41,7 +41,7 @@ rlJournalStart rlPhaseStartSetup rlRun "rlImport 'selinux-policy/common'" rlSESatisfyRequires - SERVICE_PACKAGE=`rpm -qf ${FILE_PATH}` + SERVICE_PACKAGE=`rpm -qf ${FILE_PATH} | head -n 1` rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted rlAssertRpm ${SERVICE_PACKAGE} From 0443a95a9b73f49d82380e7f48e0645029cd1802 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 18 Jul 2023 11:06:19 +0200 Subject: [PATCH 260/626] test if policy defines the anon_inode class The BZ which introduced the anon_inode class into SELinux policy was missing an automated test coverage until now. The TC covers BZ#1954145. --- selinux-policy/anon_inode-and-similar/Makefile | 1 + selinux-policy/anon_inode-and-similar/main.fmf | 4 +++- selinux-policy/anon_inode-and-similar/runtest.sh | 8 +++++++- 3 files changed, 11 insertions(+), 2 deletions(-) diff --git a/selinux-policy/anon_inode-and-similar/Makefile b/selinux-policy/anon_inode-and-similar/Makefile index 0a053b2..416a2b6 100644 --- a/selinux-policy/anon_inode-and-similar/Makefile +++ b/selinux-policy/anon_inode-and-similar/Makefile @@ -62,6 +62,7 @@ $(METADATA): Makefile @echo "Destructive: no" >> $(METADATA) @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) @echo "Releases: -RHEL4" >> $(METADATA) + @echo "Bug: 1954145" >> $(METADATA) # RHEL-9 @echo "Bug: 1974559" >> $(METADATA) @echo "Bug: 2027660" >> $(METADATA) # RHEL-9 @echo "Bug: 2025714" >> $(METADATA) # Fedora 35 diff --git a/selinux-policy/anon_inode-and-similar/main.fmf b/selinux-policy/anon_inode-and-similar/main.fmf index e9ed5d7..b40664b 100644 --- a/selinux-policy/anon_inode-and-similar/main.fmf +++ b/selinux-policy/anon_inode-and-similar/main.fmf @@ -25,8 +25,10 @@ tag: - NoRHEL5 - NoRHEL6 - NoRHEL7 + - NoRHEL8 - targeted link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1954145 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1974559 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2027660 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2025714 @@ -34,7 +36,7 @@ link: adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 - continue: false + because: the anon_inode class is not defined there extra-nitrate: TC#0612643 extra-summary: /CoreOS/selinux-policy/Regression/anon_inode-and-similar extra-task: /CoreOS/selinux-policy/Regression/anon_inode-and-similar diff --git a/selinux-policy/anon_inode-and-similar/runtest.sh b/selinux-policy/anon_inode-and-similar/runtest.sh index d7ddd4f..a58a606 100755 --- a/selinux-policy/anon_inode-and-similar/runtest.sh +++ b/selinux-policy/anon_inode-and-similar/runtest.sh @@ -50,6 +50,12 @@ rlJournalStart sleep 2 rlPhaseEnd + rlPhaseStartTest "bz#1954145" + rlRun "seinfo -c | grep anon_inode" + rlRun "seinfo -c anon_inode -x" + rlRun "sesearch -s domain -t domain -c anon_inode -A -ds -dt" + rlPhaseEnd + rlPhaseStartTest "SELinux policy prevents userfaultfds bz1974559" rlRun "gcc -o reproducer reproducer.c" tst_Time="$(date '+%T')" @@ -65,7 +71,7 @@ rlJournalStart rlSESearchRule "allow svirt_t svirt_t : anon_inode { map } [ ]" rlSESearchRule "allow virtd_t virtd_t : anon_inode { map } [ ]" - rlRun "fio --filename=/root/pokus --iodepth=16 --rw=write --ioengine=io_uring --bs=16k --size=2G --numjobs=30 --runtime=100s --group_reporting=1 --name=mytest" + rlRun "fio --filename=/root/pokus --iodepth=16 --rw=write --ioengine=io_uring --bs=16k --size=2G --numjobs=30 --runtime=100s --group_reporting=1 --name=mytest" 0-255 rlPhaseEnd rlPhaseStartCleanup From bd2e475cd97def515f6efa7a01886a6560312814 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 18 Jul 2023 13:39:19 +0200 Subject: [PATCH 261/626] do not fail when /run/chrony-dhcp/ is missing The /run/chrony-dhcp/ directory is not created on RHEL-8.x during the test scenario. The TC should not fail because of this fact. --- selinux-policy/dhclient-and-similar/runtest.sh | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/selinux-policy/dhclient-and-similar/runtest.sh b/selinux-policy/dhclient-and-similar/runtest.sh index 8b988d6..f9824d0 100755 --- a/selinux-policy/dhclient-and-similar/runtest.sh +++ b/selinux-policy/dhclient-and-similar/runtest.sh @@ -44,7 +44,7 @@ rlJournalStart rlAssertRpm ${SERVICE_PACKAGE} rlServiceStart ${SERVICE_NAME} - rlFileBackup /run/chrony-dhcp + rlFileBackup --missing-ok /run/chrony-dhcp rlSESetEnforce rlSEStatus @@ -73,11 +73,14 @@ rlJournalStart rlPhaseStartTest "real scenario" rlRun "rm -rf /run/chrony-dhcp" + rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 rlRun "dhclient" DHCLIENT_PID=`pgrep dhclient` rlRun "ps -efZ | grep dhclient" rlRun "ps -efZ | grep ':dhcpc_t:.*dhclient'" - rlRun "ls -alZ /run/chrony-dhcp" + if ! rlIsRHEL 8 ; then + rlRun "ls -alZ /run/chrony-dhcp" + fi rlPhaseEnd rlPhaseStartCleanup From 2b3d26150106089e2927bb754e16ca8df0dc052b Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Fri, 21 Jul 2023 12:55:10 +0200 Subject: [PATCH 262/626] kernel/selinux-testsuite: enable SCTP peeloff tests on RHEL-9 as appropriate Signed-off-by: Ondrej Mosnacek --- kernel/selinux-testsuite/runtest.sh | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/kernel/selinux-testsuite/runtest.sh b/kernel/selinux-testsuite/runtest.sh index 4170bdd..9a27392 100755 --- a/kernel/selinux-testsuite/runtest.sh +++ b/kernel/selinux-testsuite/runtest.sh @@ -391,6 +391,12 @@ rlJournalStart if kver_ge 4.18.0-372.1.1 && kver_lt 5.14; then sctp_client_peeloff=1 fi + if kver_ge 5.14.0-70.15.1 && kver_lt 5.14.0-71; then + sctp_client_peeloff=1 + fi + if kver_ge 5.14.0-84; then + sctp_client_peeloff=1 + fi if [ "$sctp_client_peeloff" -eq 1 ]; then rlRun "sed -i 's/5\.18/4.18/g' tests/sctp/test" 0 \ "Fix up kernel version in sctp test" From 5ab7ce1a0ced2d528e08bb8e1c91315fd7eeb62e Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Fri, 21 Jul 2023 13:03:18 +0200 Subject: [PATCH 263/626] kernel/selinux-testsuite: improve kernel package detection Instead of relying on the existing kernel package naming and versioning conventions, which are subject to change in RHEL, determine the main kernel package name via `rpm -qf "/lib/modules/$(uname -r)/vmlinuz"` and derive the rest from that. Signed-off-by: Ondrej Mosnacek --- kernel/selinux-testsuite/runtest.sh | 33 ++++++++++++++++++----------- 1 file changed, 21 insertions(+), 12 deletions(-) diff --git a/kernel/selinux-testsuite/runtest.sh b/kernel/selinux-testsuite/runtest.sh index 9a27392..d5733ad 100755 --- a/kernel/selinux-testsuite/runtest.sh +++ b/kernel/selinux-testsuite/runtest.sh @@ -113,25 +113,34 @@ function boolSet() { rlJournalStart rlPhaseStartSetup "Install" + # Determine the base kernel package name and version corresponding + # to the currently running kernel. Use this information to derive + # the correct kernel subpackages to install. + if KERNEL_CORE_NVRA="$(rpm -qf "/lib/modules/$(uname -r)/vmlinuz")"; then + KERNEL_CORE_NV="${KERNEL_CORE_NVRA%-*}" + KERNEL_CORE_N="${KERNEL_CORE_NV%-*}" + + KERNEL_PKG_VRA="${KERNEL_CORE_NVRA#$KERNEL_CORE_N-}" + KERNEL_PKG_BASE="${KERNEL_CORE_N%-core}" + + rlLog "Detected kernel package base name '$KERNEL_PKG_BASE' and version-release.arch '$KERNEL_PKG_VRA'" + KERNEL_PKGS=" + $KERNEL_PKG_BASE-modules-extra-$KERNEL_PKG_VRA + $KERNEL_PKG_BASE-devel-$KERNEL_PKG_VRA + " + else + rlLog "Detected non-RPM running kernel - no extra kernel packages will be installed" + KERNEL_PKGS="" + fi + # We need to install the kernel-* packages by ourselves, since we need # the same versions as the running kernel. And since we already need a # reliable package install function, let's just install all the # dependencies here. Thus we don't need to maintain duplicate lists of # package requirements in many places (RH repo, Fedora kernel dist-git, # CKI). - PKG_SUFFIX="" - KERNEL_VERSION="$(uname -r)" - PKG_VERSION="${KERNEL_VERSION%+debug}" - if [ "$PKG_VERSION" != "$KERNEL_VERSION" ]; then - rlLog "Detected debug kernel running." - PKG_SUFFIX="-debug" - fi - REQUIRES=" - kernel$PKG_SUFFIX-modules-extra-$PKG_VERSION - kernel-rt$PKG_SUFFIX-modules-extra-$PKG_VERSION - kernel$PKG_SUFFIX-devel-$PKG_VERSION - kernel-rt$PKG_SUFFIX-devel-$PKG_VERSION + $KERNEL_PKGS /usr/bin/unbuffer attr audit From f52d187782c5466b8f312886fd39349e216d9dd0 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Thu, 20 Jul 2023 19:22:44 +0200 Subject: [PATCH 264/626] do not call epelyum when yum is missing There are environments where yum is not present. The epelyum function is based on the yum command and if the yum command is not present, it makes no sense to call the epelyum function. --- selinux-policy/Library/common/lib.sh | 6 +++--- selinux-policy/getrlimit-permission/main.fmf | 1 - 2 files changed, 3 insertions(+), 4 deletions(-) diff --git a/selinux-policy/Library/common/lib.sh b/selinux-policy/Library/common/lib.sh index 683ecc7..48bde49 100755 --- a/selinux-policy/Library/common/lib.sh +++ b/selinux-policy/Library/common/lib.sh @@ -1549,9 +1549,9 @@ function rlSESatisfyRequires() { return fi - which dnf yum >& /dev/null - if [ $? -eq 2 ] ; then - rlLog "Neither dnf nor yum is present. Don't know how to install required packages." + which yum >& /dev/null + if [ $? -ne 0 ] ; then + rlLog "The yum is not present. Don't know how to install required packages." return fi diff --git a/selinux-policy/getrlimit-permission/main.fmf b/selinux-policy/getrlimit-permission/main.fmf index b092bb7..a21832a 100644 --- a/selinux-policy/getrlimit-permission/main.fmf +++ b/selinux-policy/getrlimit-permission/main.fmf @@ -25,7 +25,6 @@ tag: - NoRHEL4 - NoRHEL5 - NoRHEL6 - - TIPfail_Security - Tier1 - Tier1se - f33friendly From a6959174784a67e18d52f889c772df4cd7b4ee46 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Thu, 3 Aug 2023 17:52:30 +0200 Subject: [PATCH 265/626] kernel/selinux-testsuite: fix kernel package detection There is no /lib/modules/.../vmlinuz file on RHEL-7 kernels, so just use the parent directory, which should be owned by the same package. Signed-off-by: Ondrej Mosnacek --- kernel/selinux-testsuite/runtest.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/selinux-testsuite/runtest.sh b/kernel/selinux-testsuite/runtest.sh index d5733ad..a940018 100755 --- a/kernel/selinux-testsuite/runtest.sh +++ b/kernel/selinux-testsuite/runtest.sh @@ -116,7 +116,7 @@ rlJournalStart # Determine the base kernel package name and version corresponding # to the currently running kernel. Use this information to derive # the correct kernel subpackages to install. - if KERNEL_CORE_NVRA="$(rpm -qf "/lib/modules/$(uname -r)/vmlinuz")"; then + if KERNEL_CORE_NVRA="$(rpm -qf "/lib/modules/$(uname -r)")"; then KERNEL_CORE_NV="${KERNEL_CORE_NVRA%-*}" KERNEL_CORE_N="${KERNEL_CORE_NV%-*}" From 91109dac9f6185d0e3968db2812b8708a44a35d2 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Wed, 12 Jul 2023 11:17:34 +0200 Subject: [PATCH 266/626] Does `sepolicy generate --application` detect writeable locations? Signed-off-by: Petr Lautrbach --- .../sepolicy-generate-application/main.fmf | 11 ++++++ .../sepolicy-generate-application/test.sh | 36 +++++++++++++++++++ 2 files changed, 47 insertions(+) create mode 100644 policycoreutils/sepolicy-generate-application/main.fmf create mode 100755 policycoreutils/sepolicy-generate-application/test.sh diff --git a/policycoreutils/sepolicy-generate-application/main.fmf b/policycoreutils/sepolicy-generate-application/main.fmf new file mode 100644 index 0000000..5e1cb37 --- /dev/null +++ b/policycoreutils/sepolicy-generate-application/main.fmf @@ -0,0 +1,11 @@ +summary: Does `sepolicy generate --application ...` detect writeable locations? +test: ./test.sh +framework: beakerlib +component: + - policycoreutils +require: + - policycoreutils + - policycoreutils-devel + - mariadb-server + - abrt +tier: '3' diff --git a/policycoreutils/sepolicy-generate-application/test.sh b/policycoreutils/sepolicy-generate-application/test.sh new file mode 100755 index 0000000..4e8c868 --- /dev/null +++ b/policycoreutils/sepolicy-generate-application/test.sh @@ -0,0 +1,36 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +rlJournalStart + rlPhaseStartSetup + rlRun "tmp=\$(mktemp -d)" 0 "Create tmp directory" + rlRun "pushd $tmp" + rlRun "set -o pipefail" + rlPhaseEnd + + rlPhaseStartTest "/usr/bin/mysqld_safe" + rlRun "mkdir policy" + rlRun "sepolicy generate -p policy --application /usr/bin/mysqld_safe" + rlRun "cat policy/*fc" + for dir in `rpm -ql --dump mariadb-server | sed -n -E '\%\/var\/(log|run|lib)[[:graph:]]* [[:alnum:]]* [[:alnum:]]* [[:alnum:]]* 04.*%s%^([^ ]*).*%\1%p'`; do + rlRun "grep $dir policy/*.fc" + done + rlRun "rm -rf policy" + rlPhaseEnd + + rlPhaseStartTest "/usr/sbin/abrtd" + rlRun "mkdir policy" + rlRun "sepolicy generate -p policy --application /usr/sbin/abrtd" + rlRun "cat policy/*fc" + for dir in `rpm -ql --dump abrt | sed -n -E '\%\/var\/(log|run|lib)[[:graph:]]* [[:alnum:]]* [[:alnum:]]* [[:alnum:]]* 04.*%s%^([^ ]*).*%\1%p'`; do + rlRun "grep $dir policy/*.fc" + done + rlRun "rm -rf policy" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "popd" + rlRun "rm -r $tmp" 0 "Remove tmp directory" + rlPhaseEnd +rlJournalEnd From 57b58b0d590140adcf48cbc3320468b5dd40ce05 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 8 Aug 2023 11:11:03 +0200 Subject: [PATCH 267/626] test if perf (running as sysadm_t) can use the bpf syscall A recent perf + perf_event testing revealed that SELinux prevents the sysadm_u user from using the bpf syscall (permission: prog_run, class: bpf) when running the perf program. The TC reproduces the situation. In order to enable the sysadm_u user to use all perf features, I believe that SELinux policy should allow this action. The TC looks for appropriate policy rules. The TC covers BZ#2229936. --- selinux-policy/perf_event-and-related/Makefile | 3 ++- selinux-policy/perf_event-and-related/main.fmf | 3 ++- selinux-policy/perf_event-and-related/runtest.sh | 4 ++++ 3 files changed, 8 insertions(+), 2 deletions(-) diff --git a/selinux-policy/perf_event-and-related/Makefile b/selinux-policy/perf_event-and-related/Makefile index 4aaea9a..5b736d9 100644 --- a/selinux-policy/perf_event-and-related/Makefile +++ b/selinux-policy/perf_event-and-related/Makefile @@ -54,7 +54,7 @@ $(METADATA): Makefile @echo "Type: Regression" >> $(METADATA) @echo "TestTime: 10m" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console perf expect openssh-clients initscripts" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console perf expect openssh-clients /usr/sbin/service" >> $(METADATA) @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @@ -64,6 +64,7 @@ $(METADATA): Makefile @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) @echo "Bug: 1901957" >> $(METADATA) # Fedora 34 @echo "Bug: 1901958" >> $(METADATA) # RHEL-8 + @echo "Bug: 2229936" >> $(METADATA) # RHEL-9 rhts-lint $(METADATA) diff --git a/selinux-policy/perf_event-and-related/main.fmf b/selinux-policy/perf_event-and-related/main.fmf index 4e794c4..2241095 100644 --- a/selinux-policy/perf_event-and-related/main.fmf +++ b/selinux-policy/perf_event-and-related/main.fmf @@ -18,7 +18,7 @@ recommend: - perf - expect - openssh-clients - - initscripts + - /usr/sbin/service environment: AVC_ERROR: +no_avc_check duration: 10m @@ -34,6 +34,7 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1901958 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2019929 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2070982 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2229936 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 diff --git a/selinux-policy/perf_event-and-related/runtest.sh b/selinux-policy/perf_event-and-related/runtest.sh index 987d2a5..944ee91 100755 --- a/selinux-policy/perf_event-and-related/runtest.sh +++ b/selinux-policy/perf_event-and-related/runtest.sh @@ -64,6 +64,10 @@ rlJournalStart rlSESearchRule "allow sysadm_t sysadm_t : perf_event { open cpu kernel read write } [ ]" rlPhaseEnd + rlPhaseStartTest "bz#2229936" + rlSESearchRule "allow sysadm_t kernel_t : bpf { prog_run } [ ]" + rlPhaseEnd + rlPhaseStartTest "real scenario -- perf tool under root" rlRun "perf record -o /dev/null echo test" rlRun "seinfo -c perf_event -x" From d3c91b68fd98e935a1f2aaf3a3c8c889bba8d456 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Thu, 20 Jul 2023 13:57:59 +0200 Subject: [PATCH 268/626] add the bind test to upstream repo The bind component is frequently used by various users on Fedora and RHEL, so it makes sense to run this TC in upstream testing too. There are no changes in the TC functionality. Moving the downstream TC to upstream repo. --- .../Makefile | 99 +++++++ .../PURPOSE | 5 + .../main.fmf | 62 +++++ .../runtest.sh | 241 ++++++++++++++++++ 4 files changed, 407 insertions(+) create mode 100644 selinux-policy/bz562833-chrooted-named-file-contexts/Makefile create mode 100644 selinux-policy/bz562833-chrooted-named-file-contexts/PURPOSE create mode 100644 selinux-policy/bz562833-chrooted-named-file-contexts/main.fmf create mode 100755 selinux-policy/bz562833-chrooted-named-file-contexts/runtest.sh diff --git a/selinux-policy/bz562833-chrooted-named-file-contexts/Makefile b/selinux-policy/bz562833-chrooted-named-file-contexts/Makefile new file mode 100644 index 0000000..53e5491 --- /dev/null +++ b/selinux-policy/bz562833-chrooted-named-file-contexts/Makefile @@ -0,0 +1,99 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/bz562833-chrooted-named-file-contexts +# Description: some named files in chroot-ed environment have wrong SELinux labels +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2010 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/bz562833-chrooted-named-file-contexts +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: some named files in chroot-ed environment have wrong SELinux labels" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 2h" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit" >> $(METADATA) + @echo "Requires: bind" >> $(METADATA) + @echo "Requires: bind-chroot" >> $(METADATA) + @echo "Requires: caching-nameserver" >> $(METADATA) + @echo "Requires: grep" >> $(METADATA) + @echo "Requires: /usr/sbin/service" >> $(METADATA) + @echo "Requires: libselinux" >> $(METADATA) + @echo "Requires: libselinux-utils" >> $(METADATA) + @echo "Requires: policycoreutils" >> $(METADATA) + @echo "Requires: procps" >> $(METADATA) + @echo "Requires: selinux-policy" >> $(METADATA) + @echo "Requires: selinux-policy-targeted" >> $(METADATA) + @echo "Requires: setools-console" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Releases: -RHEL4" >> $(METADATA) + @echo "Bug: 451970" >> $(METADATA) # RHEL-5 + @echo "Bug: 562833" >> $(METADATA) # RHEL-5 + @echo "Bug: 578187" >> $(METADATA) # RHEL-5 + @echo "Bug: 698257" >> $(METADATA) # RHEL-5 + @echo "Bug: 739886" >> $(METADATA) # RHEL-6 + @echo "Bug: 843732" >> $(METADATA) # RHEL-6 + @echo "Bug: 859231" >> $(METADATA) # RHEL-6 + @echo "Bug: 916173" >> $(METADATA) # RHEL-7 + @echo "Bug: 1012051" >> $(METADATA) # RHEL-7 + @echo "Bug: 1103439" >> $(METADATA) # RHEL-6 + @echo "Bug: 1110397" >> $(METADATA) # RHEL-6 + @echo "Bug: 1166281" >> $(METADATA) # RHEL-7 + @echo "Bug: 1199473" >> $(METADATA) # RHEL-7 + @echo "Bug: 1312972" >> $(METADATA) # RHEL-7 + @echo "Bug: 1683754" >> $(METADATA) # RHEL-7 + @echo "Bug: 1759505" >> $(METADATA) # RHEL-8 + @echo "Bug: 1827591" >> $(METADATA) # Fedora 30 + @echo "Bug: 1923929" >> $(METADATA) # RHEL-9 + @echo "Bug: 2223725" >> $(METADATA) # Fedora 39 + @echo "Bug: 2224352" >> $(METADATA) # Fedora 38 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/bz562833-chrooted-named-file-contexts/PURPOSE b/selinux-policy/bz562833-chrooted-named-file-contexts/PURPOSE new file mode 100644 index 0000000..5c1c31b --- /dev/null +++ b/selinux-policy/bz562833-chrooted-named-file-contexts/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/bz562833-chrooted-named-file-contexts +Author: Milos Malik + +SELinux interferes with named and related programs. + diff --git a/selinux-policy/bz562833-chrooted-named-file-contexts/main.fmf b/selinux-policy/bz562833-chrooted-named-file-contexts/main.fmf new file mode 100644 index 0000000..2b62072 --- /dev/null +++ b/selinux-policy/bz562833-chrooted-named-file-contexts/main.fmf @@ -0,0 +1,62 @@ +summary: some named files in chroot-ed environment have wrong SELinux labels +description: |+ + SELinux interferes with named and related programs. + +contact: Milos Malik +component: + - selinux-policy +test: ./runtest.sh +framework: beakerlib +require: + - library(selinux-policy/common) +recommend: + - audit + - bind + - bind-chroot + - caching-nameserver + - grep + - /usr/sbin/service + - libselinux + - libselinux-utils + - policycoreutils + - procps + - selinux-policy + - selinux-policy-targeted + - setools-console +environment: + AVC_ERROR: +no_avc_check +duration: 2h +enabled: true +tag: + - NoRHEL4 + - TierCandidatesPASS + - f32friendly + - targeted +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=451970 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=562833 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=578187 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=698257 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=739886 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=843732 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=859231 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=916173 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1012051 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1103439 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1110397 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1166281 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1199473 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1312972 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1683754 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1759505 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1827591 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1923929 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2223725 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2224352 +adjust: + - enabled: false + when: distro == rhel-4 + continue: false +extra-nitrate: TC#0057489 +extra-summary: /CoreOS/selinux-policy/Regression/bz562833-chrooted-named-file-contexts +extra-task: /CoreOS/selinux-policy/Regression/bz562833-chrooted-named-file-contexts diff --git a/selinux-policy/bz562833-chrooted-named-file-contexts/runtest.sh b/selinux-policy/bz562833-chrooted-named-file-contexts/runtest.sh new file mode 100755 index 0000000..b60c482 --- /dev/null +++ b/selinux-policy/bz562833-chrooted-named-file-contexts/runtest.sh @@ -0,0 +1,241 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/bz562833-chrooted-named-file-contexts +# Description: some named files in chroot-ed environment have wrong SELinux labels +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2010 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include rhts environment +. /usr/share/beakerlib/beakerlib.sh + +PACKAGE="selinux-policy" +ROOT_PASSWORD="redhat" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm bind + + rlServiceStop ` rlSEListServices 53 ` + rlFileBackup /etc/shadow + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "bz#451970" + rlSEMatchPathCon "/usr/sbin/named" "named_exec_t" + rlSESearchRule "allow named_t port_t : udp_socket { name_bind }" + rlPhaseEnd + + rlPhaseStartTest "bz#562833" + for PREFIX in "" "/var/named/chroot" ; do + rlSEMatchPathCon "${PREFIX}/dev/null" "null_device_t" + rlSEMatchPathCon "${PREFIX}/dev/random" "random_device_t" + rlSEMatchPathCon "${PREFIX}/dev/zero" "zero_device_t" + rlSEMatchPathCon "${PREFIX}/etc/named.conf" "named_conf_t" + rlSEMatchPathCon "${PREFIX}/var/log" "var_log_t" + rlSEMatchPathCon "${PREFIX}/var/log/named.log" "named_log_t" + rlSEMatchPathCon "${PREFIX}/var/named/data" "named_cache_t" + rlSEMatchPathCon "${PREFIX}/var/named/slaves" "named_cache_t" + rlSEMatchPathCon "${PREFIX}/var/named" "named_zone_t" + rlSEMatchPathCon "${PREFIX}/var/run/named" "named_var_run_t" + done + rlPhaseEnd + + rlPhaseStartTest "bz#578187" + rlSEMatchPathCon "/usr/sbin/named" "named_exec_t" + for PREFIX in "" "/var/named/chroot" ; do + rlSEMatchPathCon "${PREFIX}/var/named/dynamic" "named_cache_t" + done + rlSESearchRule "allow named_t named_t : process { getcap setcap getsched setsched setrlimit }" + rlPhaseEnd + + rlPhaseStartTest "bz#698257" + rlSEMatchPathCon "/usr/sbin/named" "named_exec_t" + if rlIsRHEL 5 ; then + rlSEMatchPathCon "/var/named/chroot/var/log/update-debug.log" "named_log_t" + fi + rlSESearchRule "allow named_t named_log_t : file { append }" + rlPhaseEnd + + if ! rlIsRHEL 5 ; then + rlPhaseStartTest "bz#739886" + rlSEMatchPathCon "/usr/sbin/rndc" "ndc_exec_t" + rlRun "ls -Z /proc/loadavg | grep :proc_t" + rlSESearchRule "allow ndc_t proc_t : file { getattr open read }" + rlPhaseEnd + + rlPhaseStartTest "bz#843732 + bz#916173" + for PREFIX in "" "/var/named/chroot" ; do + rlSEMatchPathCon "${PREFIX}/lib" "lib_t" + rlSEMatchPathCon "${PREFIX}/lib64" "lib_t" + rlSEMatchPathCon "${PREFIX}/usr/lib" "lib_t" + rlSEMatchPathCon "${PREFIX}/usr/lib64" "lib_t" + done + rlSEMatchPathCon "/var/named/chroot/etc/localtime" "locale_t" + rlPhaseEnd + + rlPhaseStartTest "bz#1110397 + bz#1166281" + rlSEMatchPathCon "/usr/sbin/rndc" "ndc_exec_t" + rlSEMatchPathCon "/dev/random" "random_device_t" + rlSEMatchPathCon "/dev/urandom" "urandom_device_t" + rlSESearchRule "allow ndc_t random_device_t : chr_file { getattr open read }" + rlSESearchRule "allow ndc_t urandom_device_t : chr_file { getattr open read }" + rlPhaseEnd + fi + + if rlIsRHEL 6 ; then + rlPhaseStartTest "bz#859231" + rlSEMatchPathCon "/var/tmp/DNS_25" "named_tmp_t" + rlPhaseEnd + + rlPhaseStartTest "bz#1103439 + bz#1199473" + rlSEMatchPathCon "/usr/sbin/named" "named_exec_t" + rlSEMatchPortCon udp 1935 flash_port_t + rlSEMatchPortCon udp 2605 bgp_port_t + rlSEMatchPortCon udp 4321 whois_port_t + rlSEMatchPortCon udp 6514 syslogd_port_t + rlSEMatchPortCon udp 8610 ipp_port_t + rlSEMatchPortCon udp 8611 ipp_port_t + rlSEMatchPortCon udp 8612 ipp_port_t + rlSEMatchPortCon udp 8613 ipp_port_t + rlSEMatchPortCon udp 8614 ipp_port_t + rlSESearchRule "dontaudit named_t flash_port_t : udp_socket { name_bind } [ ]" + rlSESearchRule "dontaudit named_t ipp_port_t : udp_socket { name_bind } [ ]" + rlSESearchRule "dontaudit named_t syslogd_port_t : udp_socket { name_bind } [ ]" + rlSESearchRule "dontaudit named_t whois_port_t : udp_socket { name_bind } [ ]" + rlSESearchRule "dontaudit named_t bgp_port_t : udp_socket { name_bind } [ ]" + rlSESearchRule "allow named_t reserved_port_t : udp_socket { name_bind } [ ]" 1 + rlSESearchRule "allow named_t hi_reserved_port_t : udp_socket { name_bind } [ ]" 1 + rlSESearchRule "dontaudit named_t reserved_port_t : udp_socket { name_bind } [ ]" + rlSESearchRule "dontaudit named_t hi_reserved_port_t : udp_socket { name_bind } [ ]" + rlPhaseEnd + fi + + if ! rlIsRHEL 5 6 ; then + rlPhaseStartTest "bz#1012051" + rlSEMatchPathCon "/usr/sbin/named" "named_exec_t" + rlSESearchRule "allow named_t named_t : key { read write }" + rlPhaseEnd + + rlPhaseStartTest "bz#1312972" + rlSEMatchPortCon udp 1935 flash_port_t + rlSEMatchPortCon udp 2605 bgp_port_t + rlSEMatchPortCon udp 4321 whois_port_t + rlSEMatchPortCon udp 4444 kerberos_port_t + rlSEMatchPortCon udp 5546 dhcpc_port_t + if rlIsRHEL 7 ; then + rlSEMatchPortCon udp 61000 ephemeral_port_t + else # RHEL-8 and Fedora + rlSEMatchPortCon udp 60999 ephemeral_port_t + fi + rlSEMatchPortCon udp 8554 rtsp_port_t + rlSEMatchPortCon udp 8610 ipp_port_t + rlSEMatchPortCon udp 8611 ipp_port_t + rlSEMatchPortCon udp 8612 ipp_port_t + rlSEMatchPortCon udp 8613 ipp_port_t + rlSEMatchPortCon udp 8614 ipp_port_t + rlSESearchRule "allow named_t bgp_port_t : udp_socket { name_bind } [ ]" + rlSESearchRule "allow named_t dhcpc_port_t : udp_socket { name_bind } [ ]" + rlSESearchRule "allow named_t ephemeral_port_t : udp_socket { name_bind } [ ]" + rlSESearchRule "allow named_t flash_port_t : udp_socket { name_bind } [ ]" + rlSESearchRule "allow named_t ipp_port_t : udp_socket { name_bind } [ ]" + rlSESearchRule "allow named_t kerberos_port_t : udp_socket { name_bind } [ ]" + rlSESearchRule "allow named_t rtsp_port_t : udp_socket { name_bind } [ ]" + rlSESearchRule "allow named_t whois_port_t : udp_socket { name_bind } [ ]" + COUNT=`seinfo --portcon | cut -d : -f 3 | sort | uniq | wc -l` + rlLog "Number of defined SELinux ports which have at least 1 port number assigned is $COUNT" + for PORT_TYPE in `seinfo --portcon | cut -d : -f 3 | sort | uniq` ; do + if rlIsRHEL 5 6 7 ; then + sesearch -s named_t -t ${PORT_TYPE} -c udp_socket -p name_bind -A -C -D | grep -v '\]' | grep -q -e allow -e dontaudit + else + sesearch -s named_t -t ${PORT_TYPE} -c udp_socket -p name_bind -A --dontaudit | grep -v '\]' | grep -q -e allow -e dontaudit + fi + if [ $? -eq 1 ] ; then + rlFail "named_t access to ${PORT_TYPE}:udp_socket via name_bind operation is neither allowed nor dontaudited" + fi + done + rlLog "all $COUNT defined SELinux ports tested" + rlPhaseEnd + + rlPhaseStartTest "bz#1683754" + rlRun "ls -dZ /proc/sys/net | grep :sysctl_net_t" + rlRun "ls -dZ /proc/sys/net/ipv4 | grep :sysctl_net_t" + rlRun "ls -Z /proc/sys/net/ipv4/ip_local_port_range | grep :sysctl_net_t" + rlSESearchRule "allow named_t sysctl_net_t : dir { getattr open search } [ ]" + rlSESearchRule "allow named_t sysctl_net_t : file { getattr open read } [ ]" + rlPhaseEnd + fi + + if ! rlIsRHEL 5 6 7 ; then + rlPhaseStartTest "bz#1759505" + rlSEMatchPathCon "/etc/named" "named_conf_t" + rlSEMatchPathCon "/etc/named/test.conf" "named_conf_t" + rlPhaseEnd + fi + + if ! rlIsRHEL 5 6 7 8 ; then + rlPhaseStartTest "bz#1827591 + bz#1923929" + rlSEMatchPathCon "/usr/sbin/rndc" "ndc_exec_t" + rlSESearchRule "dontaudit ndc_t ndc_t : process { setsched } [ ]" + rlPhaseEnd + fi + + if seinfo -c io_uring | grep -q io_uring ; then + rlPhaseStartTest "bz#2223725 + bz#2224352" + rlSESearchRule "allow named_t named_t : io_uring { sqpoll } [ ]" + rlSESearchRule "allow ndc_t ndc_t : io_uring { sqpoll } [ ]" + rlPhaseEnd + fi + + rlPhaseStartTest "real scenario" + if ! rlIsRHEL 5 ; then + rlRun "semodule -l | grep bind" + fi + rlRun "getsebool -a | grep named" + rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" + rlSEService ${ROOT_PASSWORD} named named named_t "start status" 1 + rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 + rlRun "runcon system_u:system_r:initrc_t:s0 bash -c 'rndc querylog'" + rlRun "runcon system_u:system_r:initrc_t:s0 bash -c 'rndc dumpdb'" + rlRun "runcon system_u:system_r:initrc_t:s0 bash -c 'rndc tsig-list'" + rlSEService ${ROOT_PASSWORD} named named named_t "restart status stop status" 1 + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlServiceRestore ` rlSEListServices 53 ` + rlPhaseEnd + rlJournalPrintText +rlJournalEnd + From 23f0ff97146a85fc2c469559a0470c0929532b25 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Thu, 17 Aug 2023 11:29:26 +0200 Subject: [PATCH 269/626] disable the pager when running journalctl under root The journalctl command usually runs the less command as a pager. The less command usually saves the performed actions in a history file called ~/.lesshs*. This sequence of commands can produce SELinux denials when executed under the root user, because the less' history file is located in the /root directory. We believe that the number of programs (SELinux domains) which have write access to the /root directory should be kept limited. In order to avoid SELinux denials related to /root/.lesshs* files, the journalctl command will be executed with the --no-pager option. --- selinux-policy/journalctl-and-similar/main.fmf | 3 --- selinux-policy/journalctl-and-similar/runtest.sh | 2 +- 2 files changed, 1 insertion(+), 4 deletions(-) diff --git a/selinux-policy/journalctl-and-similar/main.fmf b/selinux-policy/journalctl-and-similar/main.fmf index 3a1cdcb..a5e9de2 100644 --- a/selinux-policy/journalctl-and-similar/main.fmf +++ b/selinux-policy/journalctl-and-similar/main.fmf @@ -30,9 +30,6 @@ tag: - NoRHEL4 - NoRHEL5 - NoRHEL6 - - TIPfail - - TIPfail_Security - - TIPfail_systemd - failinfedora - targeted link: diff --git a/selinux-policy/journalctl-and-similar/runtest.sh b/selinux-policy/journalctl-and-similar/runtest.sh index ac96c64..39fde79 100755 --- a/selinux-policy/journalctl-and-similar/runtest.sh +++ b/selinux-policy/journalctl-and-similar/runtest.sh @@ -134,7 +134,7 @@ rlJournalStart USER_SECRET="S3kr3t${RANDOM}" rlRun "useradd -o -u 0 -g 0 -Z sysadm_u ${USER_NAME}" rlRun "echo ${USER_SECRET} | passwd --stdin ${USER_NAME}" - rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost journalctl -l --pager" + rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost journalctl -l --no-pager" rlRun "userdel -rfZ ${USER_NAME}" rlRun "setsebool ssh_sysadm_login off" rlPhaseEnd From fc767823c17f7e0907f6c2922f812c656bb7610a Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Wed, 23 Aug 2023 12:41:46 +0200 Subject: [PATCH 270/626] do not require abrt, use recommend instead The abrt* packages are not available on RHEL-9, which means that one of the test phases would fail if this change was not done. The test phase dedicated to /usr/sbin/abrtd will be executed only if the file is present. --- policycoreutils/sepolicy-generate-application/main.fmf | 2 ++ policycoreutils/sepolicy-generate-application/test.sh | 2 ++ 2 files changed, 4 insertions(+) diff --git a/policycoreutils/sepolicy-generate-application/main.fmf b/policycoreutils/sepolicy-generate-application/main.fmf index 5e1cb37..6c587d8 100644 --- a/policycoreutils/sepolicy-generate-application/main.fmf +++ b/policycoreutils/sepolicy-generate-application/main.fmf @@ -7,5 +7,7 @@ require: - policycoreutils - policycoreutils-devel - mariadb-server +recommend: - abrt tier: '3' +enabled: true diff --git a/policycoreutils/sepolicy-generate-application/test.sh b/policycoreutils/sepolicy-generate-application/test.sh index 4e8c868..50ac0cc 100755 --- a/policycoreutils/sepolicy-generate-application/test.sh +++ b/policycoreutils/sepolicy-generate-application/test.sh @@ -19,6 +19,7 @@ rlJournalStart rlRun "rm -rf policy" rlPhaseEnd + if [ -x /usr/sbin/abrtd ] ; then rlPhaseStartTest "/usr/sbin/abrtd" rlRun "mkdir policy" rlRun "sepolicy generate -p policy --application /usr/sbin/abrtd" @@ -28,6 +29,7 @@ rlJournalStart done rlRun "rm -rf policy" rlPhaseEnd + fi rlPhaseStartCleanup rlRun "popd" From 1423878d559948dfe54cd745cb6537ac332c9446 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Wed, 30 Aug 2023 10:24:05 +0200 Subject: [PATCH 271/626] do not finish prematurely when cups-pdf package is present The cups-pdf package is available in the EPEL repository for RHEL-8 and RHEL-9. The test should NOT finish prematurely if the cups-pdf package is installed. The test should fail if the cups-pdf package cannot be installed even if the test tried to install it from EPEL. --- selinux-policy/cups-pdf-and-similar/main.fmf | 4 +--- selinux-policy/cups-pdf-and-similar/runtest.sh | 7 ++++++- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/selinux-policy/cups-pdf-and-similar/main.fmf b/selinux-policy/cups-pdf-and-similar/main.fmf index eee7981..45a71bd 100644 --- a/selinux-policy/cups-pdf-and-similar/main.fmf +++ b/selinux-policy/cups-pdf-and-similar/main.fmf @@ -32,8 +32,6 @@ tag: - NoRHEL5 - NoRHEL6 - NoRHEL7 - - TIPfail_infra - - failinfedora - targeted link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=560220 @@ -47,7 +45,7 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1832521 adjust: - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-alt-7, rhel-8 + when: distro == rhel-4, rhel-5, rhel-6, rhel-alt-7 continue: false extra-nitrate: TC#0607292 extra-summary: /CoreOS/selinux-policy/Regression/cups-pdf-and-similar diff --git a/selinux-policy/cups-pdf-and-similar/runtest.sh b/selinux-policy/cups-pdf-and-similar/runtest.sh index 149bc38..9820e7d 100755 --- a/selinux-policy/cups-pdf-and-similar/runtest.sh +++ b/selinux-policy/cups-pdf-and-similar/runtest.sh @@ -40,7 +40,7 @@ ALLOWED_USERS=${ALLOWED_USERS:-"staff_u user_u sysadm_u unconfined_u"} DENIED_USERS=${DENIED_USERS:-"guest_u xguest_u"} rlJournalStart - if rlIsRHEL || rlIsFedora "<32"; then + if rlIsFedora "<32"; then rlLog "Not applicable to this OS version." rlJournalEnd exit 0 @@ -51,6 +51,9 @@ rlJournalStart rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted + if ! rpm -q cups-pdf >& /dev/null ; then + rlRun "yum -y install cups-pdf --enablerepo epel" + fi rlAssertRpm ${SERVICE_PACKAGE} rlServiceStart ${SERVICE_NAME} @@ -102,9 +105,11 @@ rlJournalStart rlSESearchRule "type_transition cups_pdf_t var_log_t : file cupsd_log_t" rlPhaseEnd + if ! rlIsRHEL 8 ; then rlPhaseStartTest "bz#1832521" rlSESearchRule "allow cups_pdf_t cups_pdf_t : unix_dgram_socket { create connect } [ ]" rlPhaseEnd + fi rlPhaseStartTest "real scenario -- confined users" CREATED_USERS="" From 23c3caa982fb1c8262d9bd4f05b98995057c1bf3 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Wed, 30 Aug 2023 15:02:03 +0200 Subject: [PATCH 272/626] test if cups-pdf can connect to /run/systemd/userdb/io.systemd.DynamicUser A recent samba and cups-pdf testing revealed that SELinux prevents the cups-pdf processes from connecting to UNIX stream socket: * /run/systemd/userdb/io.systemd.DynamicUser (kernel_t) The TC reproduces the situation. In order to support the whole cups-pdf functionality, I believe that SELinux policy should allow the action. The TC looks for appropriate policy rules. The TC covers BZ#2234765. --- selinux-policy/cups-pdf-and-similar/Makefile | 1 + selinux-policy/cups-pdf-and-similar/main.fmf | 1 + selinux-policy/cups-pdf-and-similar/runtest.sh | 4 ++++ 3 files changed, 6 insertions(+) diff --git a/selinux-policy/cups-pdf-and-similar/Makefile b/selinux-policy/cups-pdf-and-similar/Makefile index b3668ab..c5b6428 100644 --- a/selinux-policy/cups-pdf-and-similar/Makefile +++ b/selinux-policy/cups-pdf-and-similar/Makefile @@ -72,6 +72,7 @@ $(METADATA): Makefile @echo "Bug: 1594271" >> $(METADATA) # Fedora 28 @echo "Bug: 1700442" >> $(METADATA) # Fedora 28 @echo "Bug: 1832521" >> $(METADATA) # Fedora 32 + @echo "Bug: 2234765" >> $(METADATA) # RHEL-9 rhts-lint $(METADATA) diff --git a/selinux-policy/cups-pdf-and-similar/main.fmf b/selinux-policy/cups-pdf-and-similar/main.fmf index 45a71bd..b037121 100644 --- a/selinux-policy/cups-pdf-and-similar/main.fmf +++ b/selinux-policy/cups-pdf-and-similar/main.fmf @@ -43,6 +43,7 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1594271 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1700442 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1832521 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2234765 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-alt-7 diff --git a/selinux-policy/cups-pdf-and-similar/runtest.sh b/selinux-policy/cups-pdf-and-similar/runtest.sh index 9820e7d..86c5aab 100755 --- a/selinux-policy/cups-pdf-and-similar/runtest.sh +++ b/selinux-policy/cups-pdf-and-similar/runtest.sh @@ -109,6 +109,10 @@ rlJournalStart rlPhaseStartTest "bz#1832521" rlSESearchRule "allow cups_pdf_t cups_pdf_t : unix_dgram_socket { create connect } [ ]" rlPhaseEnd + + rlPhaseStartTest "bz#2234765" + rlSESearchRule "allow cups_pdf_t kernel_t : unix_stream_socket { connectto } [ ]" + rlPhaseEnd fi rlPhaseStartTest "real scenario -- confined users" From 475669fa18b28b7e544d0253f4b6e3e558c92621 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Thu, 31 Aug 2023 16:48:54 +0200 Subject: [PATCH 273/626] update relevancy of 3 tests The following tests were failing on RHEL-9 because some of their test phases were executed even if they were not relevant: * selinux-policy/bootupd-and-similar * selinux-policy/bz562833-chrooted-named-file-contexts * selinux-policy/systemd-machined-and-similar The issues should be fixed now. --- selinux-policy/bootupd-and-similar/Makefile | 2 +- selinux-policy/bootupd-and-similar/main.fmf | 3 ++- selinux-policy/bootupd-and-similar/runtest.sh | 14 ++++++++++---- .../bz562833-chrooted-named-file-contexts/Makefile | 1 + .../bz562833-chrooted-named-file-contexts/main.fmf | 1 + .../runtest.sh | 4 ++-- .../systemd-machined-and-similar/runtest.sh | 2 ++ 7 files changed, 19 insertions(+), 8 deletions(-) diff --git a/selinux-policy/bootupd-and-similar/Makefile b/selinux-policy/bootupd-and-similar/Makefile index d83b326..f23235f 100644 --- a/selinux-policy/bootupd-and-similar/Makefile +++ b/selinux-policy/bootupd-and-similar/Makefile @@ -61,7 +61,7 @@ $(METADATA): Makefile @echo "License: GPLv2" >> $(METADATA) @echo "Confidential: no" >> $(METADATA) @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA) @echo "Bug: 2029478" >> $(METADATA) # RHEL-9 @echo "Bug: 2044508" >> $(METADATA) # RHEL-9 @echo "Bug: 2218106" >> $(METADATA) # Fedora rawhide diff --git a/selinux-policy/bootupd-and-similar/main.fmf b/selinux-policy/bootupd-and-similar/main.fmf index d7b2163..57e85bf 100644 --- a/selinux-policy/bootupd-and-similar/main.fmf +++ b/selinux-policy/bootupd-and-similar/main.fmf @@ -26,6 +26,7 @@ tag: - NoRHEL5 - NoRHEL6 - NoRHEL7 + - NoRHEL8 - Tier3 - Tier3se - targeted @@ -36,7 +37,7 @@ link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2218106 adjust: - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 because: the package is not available there - enabled: false when: arch == ppc64, ppc64le, s390x diff --git a/selinux-policy/bootupd-and-similar/runtest.sh b/selinux-policy/bootupd-and-similar/runtest.sh index 5064abc..8a4bf07 100755 --- a/selinux-policy/bootupd-and-similar/runtest.sh +++ b/selinux-policy/bootupd-and-similar/runtest.sh @@ -31,11 +31,16 @@ PACKAGE="selinux-policy" FILE_PATH="/usr/libexec/bootupd" -FILE_CONTEXT="bootupd_exec_t" SERVICE_PACKAGE="bootupd" SERVICE_NAME="bootupd" PROCESS_NAME="bootupd" -PROCESS_CONTEXT="bootupd_t" +if rlIsRHEL 9 ; then + FILE_CONTEXT="bin_t" + PROCESS_CONTEXT="unconfined_service_t" +else + FILE_CONTEXT="bootupd_exec_t" + PROCESS_CONTEXT="bootupd_t" +fi rlJournalStart rlPhaseStartSetup @@ -54,6 +59,7 @@ rlJournalStart rlPhaseEnd rlPhaseStartTest "bz#2029478 + bz#2044508" + # both BZs were closed as WONTFIX, but the test is flexible enough rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" BOOLEANS="[ ]" SOURCE_TYPE="init_t" # systemd runs the process @@ -63,9 +69,9 @@ rlJournalStart rlPhaseEnd rlPhaseStartTest "bz#2218106" - rlSEMatchPathCon "/usr/libexec/bootupd" "bootupd_exec_t" + rlSEMatchPathCon "/usr/libexec/bootupd" "${FILE_CONTEXT}" rlRun "ls -RlZ /boot/efi" - rlSESearchRule "allow bootupd_t dosfs_t : dir { getattr search } [ ]" + rlSESearchRule "allow ${PROCESS_CONTEXT} dosfs_t : dir { getattr search } [ ]" rlPhaseEnd rlPhaseStartTest "real scenario -- standalone service" diff --git a/selinux-policy/bz562833-chrooted-named-file-contexts/Makefile b/selinux-policy/bz562833-chrooted-named-file-contexts/Makefile index 53e5491..d0987e4 100644 --- a/selinux-policy/bz562833-chrooted-named-file-contexts/Makefile +++ b/selinux-policy/bz562833-chrooted-named-file-contexts/Makefile @@ -94,6 +94,7 @@ $(METADATA): Makefile @echo "Bug: 1923929" >> $(METADATA) # RHEL-9 @echo "Bug: 2223725" >> $(METADATA) # Fedora 39 @echo "Bug: 2224352" >> $(METADATA) # Fedora 38 + @echo "Bug: 2226703" >> $(METADATA) # Fedora 38 rhts-lint $(METADATA) diff --git a/selinux-policy/bz562833-chrooted-named-file-contexts/main.fmf b/selinux-policy/bz562833-chrooted-named-file-contexts/main.fmf index 2b62072..d689936 100644 --- a/selinux-policy/bz562833-chrooted-named-file-contexts/main.fmf +++ b/selinux-policy/bz562833-chrooted-named-file-contexts/main.fmf @@ -53,6 +53,7 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1923929 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2223725 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2224352 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2226703 adjust: - enabled: false when: distro == rhel-4 diff --git a/selinux-policy/bz562833-chrooted-named-file-contexts/runtest.sh b/selinux-policy/bz562833-chrooted-named-file-contexts/runtest.sh index b60c482..2ecc660 100755 --- a/selinux-policy/bz562833-chrooted-named-file-contexts/runtest.sh +++ b/selinux-policy/bz562833-chrooted-named-file-contexts/runtest.sh @@ -208,8 +208,8 @@ rlJournalStart rlPhaseEnd fi - if seinfo -c io_uring | grep -q io_uring ; then - rlPhaseStartTest "bz#2223725 + bz#2224352" + if rlIsFedora '>=38' ; then + rlPhaseStartTest "bz#2223725 + bz#2224352 + bz#2226703" rlSESearchRule "allow named_t named_t : io_uring { sqpoll } [ ]" rlSESearchRule "allow ndc_t ndc_t : io_uring { sqpoll } [ ]" rlPhaseEnd diff --git a/selinux-policy/systemd-machined-and-similar/runtest.sh b/selinux-policy/systemd-machined-and-similar/runtest.sh index 9063972..42416a7 100755 --- a/selinux-policy/systemd-machined-and-similar/runtest.sh +++ b/selinux-policy/systemd-machined-and-similar/runtest.sh @@ -67,6 +67,7 @@ rlJournalStart rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" rlPhaseEnd + if rlIsFedora ; then rlPhaseStartTest "bz#1847545" rlSESearchRule "allow systemd_machined_t unconfined_service_t : dir { search } [ ]" rlPhaseEnd @@ -82,6 +83,7 @@ rlJournalStart rlSESearchRule "allow systemd_machined_t unconfined_service_t : lnk_file { getattr read } [ ]" rlSESearchRule "allow systemd_machined_t unconfined_service_t : unix_stream_socket { connectto } [ ]" rlPhaseEnd + fi rlPhaseStartTest "real scenario -- standalone service" if ! rlSEDefined ${PROCESS_CONTEXT} ; then From 4f7fc855e6c55b6894ea08ed0b4c4ebc9dea01f3 Mon Sep 17 00:00:00 2001 From: Zdenek Pytela Date: Fri, 1 Sep 2023 09:45:57 +0200 Subject: [PATCH 274/626] Do not run pam_console test on Fedora 39 and newer The pam_console module was removed from pam in favor of a more complex solution in systemd-logind in Fedora 39 [1], therefore the test is not applicable there and will not be in the future releases. [1] https://fedoraproject.org/wiki/Changes/RemovePamConsole /home/zpytela/devel/tests-fedora/selinux --- selinux-policy/pam_console-and-related/main.fmf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/selinux-policy/pam_console-and-related/main.fmf b/selinux-policy/pam_console-and-related/main.fmf index 6cc4b25..24e1f45 100644 --- a/selinux-policy/pam_console-and-related/main.fmf +++ b/selinux-policy/pam_console-and-related/main.fmf @@ -45,7 +45,7 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1817690 adjust: - enabled: false - when: distro == rhel-4, rhel-5, rhel-6 + when: distro == rhel-4, rhel-5, rhel-6 or distro > fedora-38 continue: false extra-nitrate: TC#0606229 extra-summary: /CoreOS/selinux-policy/Regression/pam_console-and-related From 62997812149e7c367c24811ba6e78b931073d696 Mon Sep 17 00:00:00 2001 From: Petr Sklenar Date: Wed, 30 Aug 2023 07:40:52 +0000 Subject: [PATCH 275/626] Update selinux-policy/cups-pdf-and-similar/main.fmf test is testing cups-pdf --- selinux-policy/cups-pdf-and-similar/main.fmf | 1 - 1 file changed, 1 deletion(-) diff --git a/selinux-policy/cups-pdf-and-similar/main.fmf b/selinux-policy/cups-pdf-and-similar/main.fmf index b037121..a9b31e7 100644 --- a/selinux-policy/cups-pdf-and-similar/main.fmf +++ b/selinux-policy/cups-pdf-and-similar/main.fmf @@ -4,7 +4,6 @@ description: |+ contact: Milos Malik component: - - cups - selinux-policy require: - library(selinux-policy/common) From 482173eb71edd644250d4e4b288c8c864097aa41 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 12 Sep 2023 12:55:41 +0200 Subject: [PATCH 276/626] fix test relevancy and add test IDs Certain test phases are not relevant for RHEL-8 and they fail because of that fact. Certain tests still require the setools package, which is not really needed for their successful run. Many tests lack the FMF (generated) ID. Several tests still contain the TIPfail tags (related to the Test Improvement Project which was discontinued a long time ago). These issues should be fixed now. --- selinux-policy/acpid-and-similar/Makefile | 2 +- selinux-policy/acpid-and-similar/main.fmf | 5 ++--- selinux-policy/bgpd-and-similar/main.fmf | 1 + selinux-policy/bgpd-and-similar/runtest.sh | 9 +++++++++ selinux-policy/boltd-and-similar/main.fmf | 4 ++-- selinux-policy/bootupd-and-similar/main.fmf | 1 + selinux-policy/bz481628-send-msg-to-dbus/Makefile | 2 +- selinux-policy/bz481628-send-msg-to-dbus/main.fmf | 4 ++-- .../bz562833-chrooted-named-file-contexts/main.fmf | 1 + selinux-policy/bz624405-pcsc-and-similar/main.fmf | 4 ++-- selinux-policy/capability2-class/main.fmf | 3 ++- selinux-policy/cups-lpd-and-similar/Makefile | 2 +- selinux-policy/cups-lpd-and-similar/main.fmf | 2 +- selinux-policy/dhcpcd-and-similar/main.fmf | 2 +- selinux-policy/dmidecode-and-similar/Makefile | 2 +- selinux-policy/dmidecode-and-similar/main.fmf | 3 +-- selinux-policy/firewalld-and-similar/Makefile | 2 +- selinux-policy/firewalld-and-similar/main.fmf | 3 ++- selinux-policy/fwupd-and-similar/Makefile | 2 +- selinux-policy/fwupd-and-similar/main.fmf | 5 ++--- selinux-policy/numad-and-similar/main.fmf | 4 ++-- selinux-policy/pam_console-and-related/main.fmf | 2 +- selinux-policy/pcp-daemons-and-similar/Makefile | 2 +- selinux-policy/pcp-daemons-and-similar/main.fmf | 4 ++-- selinux-policy/perf_event-and-related/main.fmf | 1 + selinux-policy/perf_event-and-related/runtest.sh | 2 ++ selinux-policy/rsyslog-and-similar/main.fmf | 4 ++-- selinux-policy/rtkit-daemon-and-similar/main.fmf | 5 ++--- selinux-policy/sslh-and-similar/Makefile | 2 +- selinux-policy/sslh-and-similar/main.fmf | 4 ++-- selinux-policy/systemd-machined-and-similar/main.fmf | 1 + selinux-policy/watch-permissions/main.fmf | 3 ++- 32 files changed, 54 insertions(+), 39 deletions(-) diff --git a/selinux-policy/acpid-and-similar/Makefile b/selinux-policy/acpid-and-similar/Makefile index 8abefeb..b7df294 100644 --- a/selinux-policy/acpid-and-similar/Makefile +++ b/selinux-policy/acpid-and-similar/Makefile @@ -55,7 +55,7 @@ $(METADATA): Makefile @echo "TestTime: 30m" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) @echo "RunFor: acpid" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools setools-console acpid initscripts" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console acpid /usr/sbin/service" >> $(METADATA) @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @echo "License: GPLv2" >> $(METADATA) diff --git a/selinux-policy/acpid-and-similar/main.fmf b/selinux-policy/acpid-and-similar/main.fmf index cb45cc1..0f177b6 100644 --- a/selinux-policy/acpid-and-similar/main.fmf +++ b/selinux-policy/acpid-and-similar/main.fmf @@ -15,17 +15,15 @@ recommend: - policycoreutils - selinux-policy - selinux-policy-targeted - - setools - setools-console - acpid - - initscripts + - /usr/sbin/service environment: AVC_ERROR: +no_avc_check duration: 30m enabled: true tag: - NoRHEL4 - - TIPfail_infra - TIPpass - TIPpass_Security - Tier2 @@ -52,3 +50,4 @@ adjust: extra-nitrate: TC#0075209 extra-summary: /CoreOS/selinux-policy/Regression/acpid-and-similar extra-task: /CoreOS/selinux-policy/Regression/acpid-and-similar +id: beec2e51-5acf-4d66-aa05-dc183fbb7b46 diff --git a/selinux-policy/bgpd-and-similar/main.fmf b/selinux-policy/bgpd-and-similar/main.fmf index 9fe25a1..43c39f5 100644 --- a/selinux-policy/bgpd-and-similar/main.fmf +++ b/selinux-policy/bgpd-and-similar/main.fmf @@ -43,3 +43,4 @@ adjust: extra-nitrate: TC#0613221 extra-summary: /CoreOS/selinux-policy/Regression/bgpd-and-similar extra-task: /CoreOS/selinux-policy/Regression/bgpd-and-similar +id: b6f956b3-645b-440b-ac06-f8cdb1f8fe80 diff --git a/selinux-policy/bgpd-and-similar/runtest.sh b/selinux-policy/bgpd-and-similar/runtest.sh index 6dd2698..b277dda 100755 --- a/selinux-policy/bgpd-and-similar/runtest.sh +++ b/selinux-policy/bgpd-and-similar/runtest.sh @@ -79,9 +79,18 @@ rlJournalStart rlPhaseStartTest "real scenario -- standalone service" rlRun "sed -i 's/^\(include.*\)$/# \1/' /etc/bgpd.conf" + if rlIsRHEL 8 ; then + # work around BZ#1830170 that was closed as WONTFIX + rlRun "chcon -t bin_t /usr/sbin/bgpd" + PROCESS_CONTEXT="unconfined_service_t" + fi rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + if rlIsRHEL 8 ; then + # work around BZ#1830170 that was closed as WONTFIX + rlRun "restorecon -v /usr/sbin/bgpd" + fi rlPhaseEnd rlPhaseStartCleanup diff --git a/selinux-policy/boltd-and-similar/main.fmf b/selinux-policy/boltd-and-similar/main.fmf index 0b236f2..fc69914 100644 --- a/selinux-policy/boltd-and-similar/main.fmf +++ b/selinux-policy/boltd-and-similar/main.fmf @@ -9,7 +9,7 @@ require: - library(selinux-policy/common) recommend: - audit - - initscripts + - /usr/sbin/service - libselinux - libselinux-utils - policycoreutils @@ -28,7 +28,6 @@ tag: - NoRHEL4 - NoRHEL5 - NoRHEL6 - - TIPfail_Security - Tier2 - Tier2se - TierCandidatesPASS @@ -52,3 +51,4 @@ adjust: extra-nitrate: TC#0575292 extra-summary: /CoreOS/selinux-policy/Regression/boltd-and-similar extra-task: /CoreOS/selinux-policy/Regression/boltd-and-similar +id: 008316f1-35ab-4eb6-9e70-92df795f9254 diff --git a/selinux-policy/bootupd-and-similar/main.fmf b/selinux-policy/bootupd-and-similar/main.fmf index 57e85bf..9a9b2bf 100644 --- a/selinux-policy/bootupd-and-similar/main.fmf +++ b/selinux-policy/bootupd-and-similar/main.fmf @@ -45,3 +45,4 @@ adjust: extra-summary: /CoreOS/selinux-policy/Regression/bootupd-and-similar extra-task: /CoreOS/selinux-policy/Regression/bootupd-and-similar extra-nitrate: TC#0614833 +id: f6f4f1bc-b585-4199-8cde-d72424cadd52 diff --git a/selinux-policy/bz481628-send-msg-to-dbus/Makefile b/selinux-policy/bz481628-send-msg-to-dbus/Makefile index 06e84fa..3afb08d 100644 --- a/selinux-policy/bz481628-send-msg-to-dbus/Makefile +++ b/selinux-policy/bz481628-send-msg-to-dbus/Makefile @@ -54,7 +54,7 @@ $(METADATA): Makefile @echo "TestTime: 10m" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) @echo "RunFor: dbus" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools setools-console expect openssh-clients dbus-daemon shadow-utils" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted /usr/sbin/service setools-console expect openssh-clients dbus-daemon shadow-utils" >> $(METADATA) @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @echo "License: GPLv2" >> $(METADATA) diff --git a/selinux-policy/bz481628-send-msg-to-dbus/main.fmf b/selinux-policy/bz481628-send-msg-to-dbus/main.fmf index efb8889..78afc50 100644 --- a/selinux-policy/bz481628-send-msg-to-dbus/main.fmf +++ b/selinux-policy/bz481628-send-msg-to-dbus/main.fmf @@ -15,7 +15,7 @@ recommend: - policycoreutils - selinux-policy - selinux-policy-targeted - - setools + - /usr/sbin/service - setools-console - expect - openssh-clients @@ -28,7 +28,6 @@ enabled: true tag: - CI-Tier-1 - NoRHEL4 - - TIPfail_Security - TIPpass - TierCandidatesPASS - failinfedora @@ -48,3 +47,4 @@ adjust: extra-nitrate: TC#0057414 extra-summary: /CoreOS/selinux-policy/Regression/bz481628-send-msg-to-dbus extra-task: /CoreOS/selinux-policy/Regression/bz481628-send-msg-to-dbus +id: 3d861eff-500e-48d9-bef7-0906a55f5000 diff --git a/selinux-policy/bz562833-chrooted-named-file-contexts/main.fmf b/selinux-policy/bz562833-chrooted-named-file-contexts/main.fmf index d689936..f3985b3 100644 --- a/selinux-policy/bz562833-chrooted-named-file-contexts/main.fmf +++ b/selinux-policy/bz562833-chrooted-named-file-contexts/main.fmf @@ -61,3 +61,4 @@ adjust: extra-nitrate: TC#0057489 extra-summary: /CoreOS/selinux-policy/Regression/bz562833-chrooted-named-file-contexts extra-task: /CoreOS/selinux-policy/Regression/bz562833-chrooted-named-file-contexts +id: dc594e14-f692-4537-9553-ce6aeab1a0cc diff --git a/selinux-policy/bz624405-pcsc-and-similar/main.fmf b/selinux-policy/bz624405-pcsc-and-similar/main.fmf index 685536f..5ab5e8d 100644 --- a/selinux-policy/bz624405-pcsc-and-similar/main.fmf +++ b/selinux-policy/bz624405-pcsc-and-similar/main.fmf @@ -12,7 +12,7 @@ recommend: - audit - expect - grep - - initscripts + - /usr/sbin/service - libselinux - libselinux-utils - pcsc-lite @@ -21,7 +21,6 @@ recommend: - selinux-policy - selinux-policy-mls - selinux-policy-targeted - - setools - setools-console environment: AVC_ERROR: +no_avc_check @@ -59,3 +58,4 @@ adjust: extra-nitrate: TC#0057525 extra-summary: /CoreOS/selinux-policy/Regression/bz624405-pcsc-and-similar extra-task: /CoreOS/selinux-policy/Regression/bz624405-pcsc-and-similar +id: 43cb4c7e-4e58-4b9b-82ea-8c9438ee0030 diff --git a/selinux-policy/capability2-class/main.fmf b/selinux-policy/capability2-class/main.fmf index 83ff051..5440b4f 100644 --- a/selinux-policy/capability2-class/main.fmf +++ b/selinux-policy/capability2-class/main.fmf @@ -25,4 +25,5 @@ adjust: - enabled: false when: distro = rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 continue: false - +extra-nitrate: TC#0615396 +id: 251fd08a-0f65-4592-8d4d-2b79e9479460 diff --git a/selinux-policy/cups-lpd-and-similar/Makefile b/selinux-policy/cups-lpd-and-similar/Makefile index c3a0bdd..83fe356 100644 --- a/selinux-policy/cups-lpd-and-similar/Makefile +++ b/selinux-policy/cups-lpd-and-similar/Makefile @@ -55,7 +55,7 @@ $(METADATA): Makefile @echo "TestTime: 20m" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) @echo "RunFor: cups" >> $(METADATA) - @echo "Requires: audit expect policycoreutils-python-utils selinux-policy-devel libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools setools-console xinetd nmap-ncat nc net-tools cups-lpd chkconfig /usr/sbin/service" >> $(METADATA) + @echo "Requires: audit expect policycoreutils-python-utils selinux-policy-devel libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console xinetd nmap-ncat nc net-tools cups-lpd chkconfig /usr/sbin/service" >> $(METADATA) @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @echo "License: GPLv2" >> $(METADATA) diff --git a/selinux-policy/cups-lpd-and-similar/main.fmf b/selinux-policy/cups-lpd-and-similar/main.fmf index ef5985d..a9173d2 100644 --- a/selinux-policy/cups-lpd-and-similar/main.fmf +++ b/selinux-policy/cups-lpd-and-similar/main.fmf @@ -35,7 +35,6 @@ tag: - RHEL8 - Tier2 - Tier2se - - TierCandidatesFAIL - customer_scenario - f32friendly - rhel9-buildroot @@ -58,3 +57,4 @@ adjust: extra-nitrate: TC#0305784 extra-summary: /CoreOS/selinux-policy/Regression/cups-lpd-and-similar extra-task: /CoreOS/selinux-policy/Regression/cups-lpd-and-similar +id: 544f74d0-54a4-4174-a4a0-4fe85190a5c6 diff --git a/selinux-policy/dhcpcd-and-similar/main.fmf b/selinux-policy/dhcpcd-and-similar/main.fmf index 428d042..bc95e8b 100644 --- a/selinux-policy/dhcpcd-and-similar/main.fmf +++ b/selinux-policy/dhcpcd-and-similar/main.fmf @@ -25,7 +25,6 @@ tag: - NoRHEL4 - NoRHEL5 - NoRHEL6 - - TIPfail_Security - failinfedora - targeted link: @@ -38,3 +37,4 @@ adjust: extra-nitrate: TC#0574611 extra-summary: /CoreOS/selinux-policy/Regression/dhcpcd-and-similar extra-task: /CoreOS/selinux-policy/Regression/dhcpcd-and-similar +id: 16f95682-f375-4789-86a5-a59b9d70ff3a diff --git a/selinux-policy/dmidecode-and-similar/Makefile b/selinux-policy/dmidecode-and-similar/Makefile index 386e4f3..6de3c03 100644 --- a/selinux-policy/dmidecode-and-similar/Makefile +++ b/selinux-policy/dmidecode-and-similar/Makefile @@ -55,7 +55,7 @@ $(METADATA): Makefile @echo "TestTime: 15m" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) @echo "RunFor: dmidecode" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools setools-console dmidecode selinux-policy-devel shadow-utils openssh-clients expect" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console dmidecode selinux-policy-devel shadow-utils openssh-clients expect" >> $(METADATA) @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) diff --git a/selinux-policy/dmidecode-and-similar/main.fmf b/selinux-policy/dmidecode-and-similar/main.fmf index 659e4f9..3c7d84d 100644 --- a/selinux-policy/dmidecode-and-similar/main.fmf +++ b/selinux-policy/dmidecode-and-similar/main.fmf @@ -15,7 +15,6 @@ recommend: - policycoreutils - selinux-policy - selinux-policy-targeted - - setools - setools-console - dmidecode - selinux-policy-devel @@ -32,7 +31,6 @@ tag: - TIPpass_Security - Tier2 - Tier2se - - TierCandidatesFAIL - f31friendly - f32friendly - targeted @@ -53,3 +51,4 @@ adjust: extra-nitrate: TC#0550595 extra-summary: /CoreOS/selinux-policy/Regression/dmidecode-and-similar extra-task: /CoreOS/selinux-policy/Regression/dmidecode-and-similar +id: 8b3954c3-5475-4a03-aad9-0a31a68bcdce diff --git a/selinux-policy/firewalld-and-similar/Makefile b/selinux-policy/firewalld-and-similar/Makefile index 9938f8f..1912dab 100644 --- a/selinux-policy/firewalld-and-similar/Makefile +++ b/selinux-policy/firewalld-and-similar/Makefile @@ -55,7 +55,7 @@ $(METADATA): Makefile @echo "TestTime: 30m" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) @echo "RunFor: firewalld" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console firewalld glib2 nftables procps-ng" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console firewalld glib2 nftables procps-ng /usr/sbin/service" >> $(METADATA) @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @echo "License: GPLv2" >> $(METADATA) diff --git a/selinux-policy/firewalld-and-similar/main.fmf b/selinux-policy/firewalld-and-similar/main.fmf index 3134d71..2eccb4a 100644 --- a/selinux-policy/firewalld-and-similar/main.fmf +++ b/selinux-policy/firewalld-and-similar/main.fmf @@ -20,6 +20,7 @@ recommend: - glib2 - nftables - procps-ng + - /usr/sbin/service environment: AVC_ERROR: +no_avc_check duration: 30m @@ -29,7 +30,6 @@ tag: - NoRHEL5 - NoRHEL6 - TIP_fedora_pass - - TIPfail_fedora - TIPpass - TIPpass_FIPS - TIPpass_Security @@ -68,3 +68,4 @@ adjust: extra-nitrate: TC#0175059 extra-summary: /CoreOS/selinux-policy/Regression/firewalld-and-similar extra-task: /CoreOS/selinux-policy/Regression/firewalld-and-similar +id: e856e8cc-0893-457b-a1ef-a71c09b6fef9 diff --git a/selinux-policy/fwupd-and-similar/Makefile b/selinux-policy/fwupd-and-similar/Makefile index 6f28850..be34447 100644 --- a/selinux-policy/fwupd-and-similar/Makefile +++ b/selinux-policy/fwupd-and-similar/Makefile @@ -55,7 +55,7 @@ $(METADATA): Makefile @echo "TestTime: 10m" >> $(METADATA) @echo "RunFor: fwupd" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console glib2 fwupd initscripts expect" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console glib2 fwupd /usr/sbin/service expect" >> $(METADATA) @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) diff --git a/selinux-policy/fwupd-and-similar/main.fmf b/selinux-policy/fwupd-and-similar/main.fmf index 1017ddb..26be6e8 100644 --- a/selinux-policy/fwupd-and-similar/main.fmf +++ b/selinux-policy/fwupd-and-similar/main.fmf @@ -18,7 +18,7 @@ recommend: - setools-console - glib2 - fwupd - - initscripts + - /usr/sbin/service - expect environment: AVC_ERROR: +no_avc_check @@ -30,8 +30,6 @@ tag: - NoRHEL4 - NoRHEL5 - NoRHEL6 - - TIPfail - - TIPfail_Security - Tier3 - Tier3se - TierCandidatesPASS @@ -53,3 +51,4 @@ adjust: extra-nitrate: TC#0563429 extra-summary: /CoreOS/selinux-policy/Regression/fwupd-and-similar extra-task: /CoreOS/selinux-policy/Regression/fwupd-and-similar +id: 12996742-5ad6-4dd2-b04d-b4c781fcce79 diff --git a/selinux-policy/numad-and-similar/main.fmf b/selinux-policy/numad-and-similar/main.fmf index fd55273..8b20c53 100644 --- a/selinux-policy/numad-and-similar/main.fmf +++ b/selinux-policy/numad-and-similar/main.fmf @@ -11,14 +11,13 @@ recommend: - audit - expect - grep - - initscripts + - /usr/sbin/service - libselinux - libselinux-utils - numad - policycoreutils - procps - selinux-policy - - setools - setools-console environment: AVC_ERROR: +no_avc_check @@ -51,3 +50,4 @@ adjust: extra-nitrate: TC#0202428 extra-summary: /CoreOS/selinux-policy/Regression/numad-and-similar extra-task: /CoreOS/selinux-policy/Regression/numad-and-similar +id: f97f6046-ee73-48ec-b3fc-7aa08648890c diff --git a/selinux-policy/pam_console-and-related/main.fmf b/selinux-policy/pam_console-and-related/main.fmf index 24e1f45..dad130b 100644 --- a/selinux-policy/pam_console-and-related/main.fmf +++ b/selinux-policy/pam_console-and-related/main.fmf @@ -35,7 +35,6 @@ tag: - NoRHEL4 - NoRHEL5 - NoRHEL6 - - TIPfail - TIPpass_Security - failinfedora - targeted @@ -50,3 +49,4 @@ adjust: extra-nitrate: TC#0606229 extra-summary: /CoreOS/selinux-policy/Regression/pam_console-and-related extra-task: /CoreOS/selinux-policy/Regression/pam_console-and-related +id: 622adb1b-d20a-4418-8646-3aaecd35a1e2 diff --git a/selinux-policy/pcp-daemons-and-similar/Makefile b/selinux-policy/pcp-daemons-and-similar/Makefile index 7367625..a7216d7 100644 --- a/selinux-policy/pcp-daemons-and-similar/Makefile +++ b/selinux-policy/pcp-daemons-and-similar/Makefile @@ -55,7 +55,7 @@ $(METADATA): Makefile @echo "TestTime: 90m" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) @echo "RunFor: pcp" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools setools-console glib2 pcp pcp-manager pcp-pmda-dm pcp-webapi" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted /usr/sbin/service setools-console glib2 pcp pcp-manager pcp-pmda-dm pcp-webapi" >> $(METADATA) @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @echo "License: GPLv2" >> $(METADATA) diff --git a/selinux-policy/pcp-daemons-and-similar/main.fmf b/selinux-policy/pcp-daemons-and-similar/main.fmf index fa32730..26a4295 100644 --- a/selinux-policy/pcp-daemons-and-similar/main.fmf +++ b/selinux-policy/pcp-daemons-and-similar/main.fmf @@ -15,7 +15,7 @@ recommend: - policycoreutils - selinux-policy - selinux-policy-targeted - - setools + - /usr/sbin/service - setools-console - glib2 - pcp @@ -28,7 +28,6 @@ duration: 90m enabled: true tag: - NoRHEL4 - - TIPfail_FIPS - TIPpass - TIPpass_Security - TipWaived7 @@ -66,3 +65,4 @@ adjust: extra-nitrate: TC#0075517 extra-summary: /CoreOS/selinux-policy/Regression/pcp-daemons-and-similar extra-task: /CoreOS/selinux-policy/Regression/pcp-daemons-and-similar +id: e59269a3-9556-4441-b60b-2339499689b7 diff --git a/selinux-policy/perf_event-and-related/main.fmf b/selinux-policy/perf_event-and-related/main.fmf index 2241095..0382ccc 100644 --- a/selinux-policy/perf_event-and-related/main.fmf +++ b/selinux-policy/perf_event-and-related/main.fmf @@ -42,3 +42,4 @@ adjust: extra-nitrate: TC#0609306 extra-summary: /CoreOS/selinux-policy/Regression/perf_event-and-related extra-task: /CoreOS/selinux-policy/Regression/perf_event-and-related +id: 3efbd0b9-bc20-4b7a-a253-3bec809d323a diff --git a/selinux-policy/perf_event-and-related/runtest.sh b/selinux-policy/perf_event-and-related/runtest.sh index 944ee91..61f8021 100755 --- a/selinux-policy/perf_event-and-related/runtest.sh +++ b/selinux-policy/perf_event-and-related/runtest.sh @@ -64,9 +64,11 @@ rlJournalStart rlSESearchRule "allow sysadm_t sysadm_t : perf_event { open cpu kernel read write } [ ]" rlPhaseEnd + if ! rlIsRHEL 8 ; then rlPhaseStartTest "bz#2229936" rlSESearchRule "allow sysadm_t kernel_t : bpf { prog_run } [ ]" rlPhaseEnd + fi rlPhaseStartTest "real scenario -- perf tool under root" rlRun "perf record -o /dev/null echo test" diff --git a/selinux-policy/rsyslog-and-similar/main.fmf b/selinux-policy/rsyslog-and-similar/main.fmf index 0603f76..17a3970 100644 --- a/selinux-policy/rsyslog-and-similar/main.fmf +++ b/selinux-policy/rsyslog-and-similar/main.fmf @@ -10,7 +10,7 @@ require: - library(selinux-policy/common) recommend: - audit - - initscripts + - /usr/sbin/service - libselinux - libselinux-utils - logwatch @@ -20,7 +20,6 @@ recommend: - rsyslog-gnutls - selinux-policy - selinux-policy-targeted - - setools - setools-console - shadow-utils - /usr/sbin/semanage @@ -41,3 +40,4 @@ adjust: extra-nitrate: TC#0609007 extra-summary: /CoreOS/selinux-policy/Regression/rsyslog-and-similar extra-task: /CoreOS/selinux-policy/Regression/rsyslog-and-similar +id: 42688797-d2d6-4acc-acd2-dc54f18150c4 diff --git a/selinux-policy/rtkit-daemon-and-similar/main.fmf b/selinux-policy/rtkit-daemon-and-similar/main.fmf index 1cba664..9e25d45 100644 --- a/selinux-policy/rtkit-daemon-and-similar/main.fmf +++ b/selinux-policy/rtkit-daemon-and-similar/main.fmf @@ -9,7 +9,7 @@ require: - library(selinux-policy/common) recommend: - audit - - initscripts + - /usr/sbin/service - libselinux - libselinux-utils - policycoreutils @@ -26,8 +26,6 @@ tag: - CI-Tier-1 - NoRHEL4 - NoRHEL5 - - TIP_fedora_fail - - TIPfail - TIPpass_FIPS - TIPpass_Security - Tier2 @@ -57,3 +55,4 @@ adjust: extra-nitrate: TC#0300678 extra-summary: /CoreOS/selinux-policy/Regression/rtkit-daemon-and-similar extra-task: /CoreOS/selinux-policy/Regression/rtkit-daemon-and-similar +id: 9c4bfed2-36f7-4f37-ac14-629721ab5934 diff --git a/selinux-policy/sslh-and-similar/Makefile b/selinux-policy/sslh-and-similar/Makefile index 7a8ea3d..7740655 100644 --- a/selinux-policy/sslh-and-similar/Makefile +++ b/selinux-policy/sslh-and-similar/Makefile @@ -54,7 +54,7 @@ $(METADATA): Makefile @echo "Type: Regression" >> $(METADATA) @echo "TestTime: 10m" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools setools-console sslh initscripts" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console sslh /usr/sbin/service" >> $(METADATA) @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) diff --git a/selinux-policy/sslh-and-similar/main.fmf b/selinux-policy/sslh-and-similar/main.fmf index 82f44cc..b718239 100644 --- a/selinux-policy/sslh-and-similar/main.fmf +++ b/selinux-policy/sslh-and-similar/main.fmf @@ -14,10 +14,9 @@ recommend: - policycoreutils - selinux-policy - selinux-policy-targeted - - setools - setools-console - sslh - - initscripts + - /usr/sbin/service environment: AVC_ERROR: +no_avc_check duration: 10m @@ -43,3 +42,4 @@ adjust: extra-nitrate: TC#0563428 extra-summary: /CoreOS/selinux-policy/Regression/sslh-and-similar extra-task: /CoreOS/selinux-policy/Regression/sslh-and-similar +id: da6c2b1a-6db2-4c2b-b258-311438d26aef diff --git a/selinux-policy/systemd-machined-and-similar/main.fmf b/selinux-policy/systemd-machined-and-similar/main.fmf index dc0ec37..b757c0d 100644 --- a/selinux-policy/systemd-machined-and-similar/main.fmf +++ b/selinux-policy/systemd-machined-and-similar/main.fmf @@ -39,3 +39,4 @@ adjust: extra-summary: /CoreOS/selinux-policy/Regression/systemd-machined-and-similar extra-task: /CoreOS/selinux-policy/Regression/systemd-machined-and-similar extra-nitrate: TC#0614355 +id: 3aff16de-7ca9-41eb-9676-9c2236fc92f1 diff --git a/selinux-policy/watch-permissions/main.fmf b/selinux-policy/watch-permissions/main.fmf index 9d37a3d..5969989 100644 --- a/selinux-policy/watch-permissions/main.fmf +++ b/selinux-policy/watch-permissions/main.fmf @@ -25,4 +25,5 @@ adjust: - enabled: false when: distro = rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 continue: false - +extra-nitrate: TC#0615395 +id: c4421242-0b97-4a1e-abbb-1dbe5dd21355 From ac2bb3d8e0a52009799fe17376219387e0c0c252 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Wed, 20 Sep 2023 09:44:32 +0200 Subject: [PATCH 277/626] test if stacctl and stafctl work as expected A recent testing of new policy for the stacd and stafd services revealed that SELinux prevents the stacctl and stafctl programs from communicating with the daemons via D-bus (send_msg permission). The TC reproduces the situation. In order to support the D-bus communication in both directions (unconfined -> stas_t, stas_t -> unconfined_t), I believe that SELinux policy should allow the action. The TC looks for appropriate policy rules. The TC covers RHEL-1557. --- selinux-policy/nvme-stas-and-similar/Makefile | 1 + selinux-policy/nvme-stas-and-similar/PURPOSE | 3 ++- selinux-policy/nvme-stas-and-similar/main.fmf | 1 + selinux-policy/nvme-stas-and-similar/runtest.sh | 10 ++++++++-- 4 files changed, 12 insertions(+), 3 deletions(-) diff --git a/selinux-policy/nvme-stas-and-similar/Makefile b/selinux-policy/nvme-stas-and-similar/Makefile index e528da4..b2e07cb 100644 --- a/selinux-policy/nvme-stas-and-similar/Makefile +++ b/selinux-policy/nvme-stas-and-similar/Makefile @@ -64,6 +64,7 @@ $(METADATA): Makefile @echo "Destructive: no" >> $(METADATA) @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA) @echo "Bug: 2111414" >> $(METADATA) # RHEL-9 + @echo "Bug: RHEL-1557" >> $(METADATA) # RHEL-9 rhts-lint $(METADATA) diff --git a/selinux-policy/nvme-stas-and-similar/PURPOSE b/selinux-policy/nvme-stas-and-similar/PURPOSE index 5f9b111..a0cc42a 100644 --- a/selinux-policy/nvme-stas-and-similar/PURPOSE +++ b/selinux-policy/nvme-stas-and-similar/PURPOSE @@ -1,5 +1,6 @@ PURPOSE of /CoreOS/selinux-policy/Regression/nvme-stas-and-similar Author: Milos Malik -SELinux interferes with NVME sta* services +SELinux interferes with stacd, stafd services. +SELinux also affects the stacctl and stafctl programs. diff --git a/selinux-policy/nvme-stas-and-similar/main.fmf b/selinux-policy/nvme-stas-and-similar/main.fmf index 0e83395..76b2ef4 100644 --- a/selinux-policy/nvme-stas-and-similar/main.fmf +++ b/selinux-policy/nvme-stas-and-similar/main.fmf @@ -32,6 +32,7 @@ tag: - targeted link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2111414 + - verifies: https://issues.redhat.com/browse/RHEL-1557 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 diff --git a/selinux-policy/nvme-stas-and-similar/runtest.sh b/selinux-policy/nvme-stas-and-similar/runtest.sh index a86991e..725e2e9 100755 --- a/selinux-policy/nvme-stas-and-similar/runtest.sh +++ b/selinux-policy/nvme-stas-and-similar/runtest.sh @@ -54,7 +54,7 @@ rlJournalStart rlPhaseEnd if rlSEDefined "${FILE_CONTEXT} ${PROCESS_CONTEXT}" ; then - rlPhaseStartTest "bz#2111414" + rlPhaseStartTest "bz#2111414 + RHEL-1557" rlSEMatchPathCon "/usr/sbin/stacd" "${FILE_CONTEXT}" rlSEMatchPathCon "/usr/sbin/stafd" "${FILE_CONTEXT}" rlSEMatchPathCon "/dev/nvme-fabrics" "fixed_disk_device_t" @@ -82,6 +82,8 @@ rlJournalStart rlSESearchRule "allow stas_t udev_var_run_t : dir { add_name remove_name write } [ ]" rlSESearchRule "allow stas_t udev_var_run_t : file { create getattr ioctl open unlink write } [ ]" rlSESearchRule "allow stas_t stas_var_run_t : file { getattr ioctl open read write } [ ]" + rlSESearchRule "allow unconfined_t nvme_stas_t : dbus { send_msg } [ ]" + rlSESearchRule "allow nvme_stas_t unconfined_t : dbus { send_msg } [ ]" rlPhaseEnd fi @@ -95,14 +97,18 @@ rlJournalStart fi done if ! rlSEDefined ${PROCESS_CONTEXT} ; then - # for RHELs where the SELinux domain does not exist yet + # for environments where the SELinux domain does not exist yet PROCESS_CONTEXT="unconfined_service_t" fi rlRun "mkdir -p /etc/nvme" rlRun "touch /etc/nvme/hostid" rlRun "touch /etc/nvme/hostnqn" rlSEService - stafd stafd ${PROCESS_CONTEXT} "start status" 1 + rlRun "stafctl status" + rlRun "stafctl ls" rlSEService - stacd stacd ${PROCESS_CONTEXT} "start status" 1 + rlRun "stacctl status" + rlRun "stacctl ls" rlRun "stasadm -v" rlRun "stasadm hostid" rlRun "stasadm hostnqn" From 58842891ba001a36b23d75b1287bd30946bfa017 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Wed, 13 Sep 2023 13:29:33 +0200 Subject: [PATCH 278/626] add the kdump test to upstream repo The kexec-tools component is frequently used by various users on Fedora and RHEL, so it makes sense to run this TC in upstream testing too. There are no changes in the TC functionality. Moving the downstream TC to upstream repo. The TC covers BZ#2236876. --- .../Makefile | 113 ++++++++ .../PURPOSE | 5 + .../id_rsa | 27 ++ .../id_rsa.pub | 1 + .../main.fmf | 81 ++++++ .../run.exp | 17 ++ .../runtest.sh | 257 ++++++++++++++++++ .../testpolicy.te | 15 + 8 files changed, 516 insertions(+) create mode 100644 selinux-policy/bz533007-unable-to-start-kdump-service/Makefile create mode 100644 selinux-policy/bz533007-unable-to-start-kdump-service/PURPOSE create mode 100644 selinux-policy/bz533007-unable-to-start-kdump-service/id_rsa create mode 100644 selinux-policy/bz533007-unable-to-start-kdump-service/id_rsa.pub create mode 100644 selinux-policy/bz533007-unable-to-start-kdump-service/main.fmf create mode 100755 selinux-policy/bz533007-unable-to-start-kdump-service/run.exp create mode 100755 selinux-policy/bz533007-unable-to-start-kdump-service/runtest.sh create mode 100644 selinux-policy/bz533007-unable-to-start-kdump-service/testpolicy.te diff --git a/selinux-policy/bz533007-unable-to-start-kdump-service/Makefile b/selinux-policy/bz533007-unable-to-start-kdump-service/Makefile new file mode 100644 index 0000000..20c69e7 --- /dev/null +++ b/selinux-policy/bz533007-unable-to-start-kdump-service/Makefile @@ -0,0 +1,113 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/bz533007-unable-to-start-kdump-service +# Description: kdump service cannot be started because of SELinux +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2009 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/bz533007-unable-to-start-kdump-service +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE testpolicy.te run.exp id_rsa id_rsa.pub + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh run.exp + chcon -t bin_t runtest.sh run.exp + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: kdump service cannot be started because of SELinux" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 15m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit" >> $(METADATA) + @echo "Requires: expect" >> $(METADATA) + @echo "Requires: /usr/sbin/service" >> $(METADATA) + @echo "Requires: kexec-tools" >> $(METADATA) + @echo "Requires: grubby" >> $(METADATA) + @echo "Requires: libselinux" >> $(METADATA) + @echo "Requires: libselinux-utils" >> $(METADATA) + @echo "Requires: policycoreutils" >> $(METADATA) + @echo "Requires: sed" >> $(METADATA) + @echo "Requires: selinux-policy" >> $(METADATA) + @echo "Requires: selinux-policy-mls" >> $(METADATA) + @echo "Requires: selinux-policy-targeted" >> $(METADATA) + @echo "Requires: setools-console" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Releases: -RHEL4" >> $(METADATA) + @echo "Bug: 533007" >> $(METADATA) # RHEL-6 + @echo "Bug: 533366" >> $(METADATA) # RHEL-6 + @echo "Bug: 537088" >> $(METADATA) # RHEL-6 + @echo "Bug: 540758" >> $(METADATA) # RHEL-6 + @echo "Bug: 549503" >> $(METADATA) # RHEL-6 + @echo "Bug: 618329" >> $(METADATA) # RHEL-6 + @echo "Bug: 621061" >> $(METADATA) # RHEL-6 + @echo "Bug: 753039" >> $(METADATA) # RHEL-5 + @echo "Bug: 966203" >> $(METADATA) # RHEL-6 + @echo "Bug: 1055634" >> $(METADATA) # RHEL-7 + @echo "Bug: 1117368" >> $(METADATA) # RHEL-7 + @echo "Bug: 1117710" >> $(METADATA) # RHEL-7 + @echo "Bug: 1146491" >> $(METADATA) # RHEL-7 + @echo "Bug: 1288565" >> $(METADATA) # RHEL-6 + @echo "Bug: 1363977" >> $(METADATA) # RHEL-7 + @echo "Bug: 1375963" >> $(METADATA) # RHEL-7 + @echo "Bug: 1390669" >> $(METADATA) # RHEL-7 + @echo "Bug: 1418441" >> $(METADATA) # RHEL-7 + @echo "Bug: 1431236" >> $(METADATA) # RHEL-6 + @echo "Bug: 1536690" >> $(METADATA) # RHEL-7 + @echo "Bug: 1540004" >> $(METADATA) # RHEL-7 + @echo "Bug: 1542283" >> $(METADATA) # RHEL-7 + @echo "Bug: 1576730" >> $(METADATA) # RHEL-8 + @echo "Bug: 1588884" >> $(METADATA) # RHEL-7 + @echo "Bug: 1842897" >> $(METADATA) # RHEL-8 + @echo "Bug: 1896424" >> $(METADATA) # RHEL-8 + @echo "Bug: 1896595" >> $(METADATA) # RHEL-8 + @echo "Bug: 1899141" >> $(METADATA) # RHEL-8 + @echo "Bug: 1932752" >> $(METADATA) # RHEL-9 + @echo "Bug: 1951323" >> $(METADATA) # Fedora 33 + @echo "Bug: 1961728" >> $(METADATA) # RHEL-8 + @echo "Bug: 1965985" >> $(METADATA) # RHEL-8 + @echo "Bug: 1965989" >> $(METADATA) # RHEL-9 + @echo "Bug: 1965989" >> $(METADATA) # Fedora rawhide + + rhts-lint $(METADATA) + diff --git a/selinux-policy/bz533007-unable-to-start-kdump-service/PURPOSE b/selinux-policy/bz533007-unable-to-start-kdump-service/PURPOSE new file mode 100644 index 0000000..dd2a012 --- /dev/null +++ b/selinux-policy/bz533007-unable-to-start-kdump-service/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/bz533007-unable-to-start-kdump-service +Author: Milos Malik + +SELinux interferes with kdump and related programs. + diff --git a/selinux-policy/bz533007-unable-to-start-kdump-service/id_rsa b/selinux-policy/bz533007-unable-to-start-kdump-service/id_rsa new file mode 100644 index 0000000..a38bb9b --- /dev/null +++ b/selinux-policy/bz533007-unable-to-start-kdump-service/id_rsa @@ -0,0 +1,27 @@ +-----BEGIN RSA PRIVATE KEY----- +MIIEowIBAAKCAQEA724nX9GdCr5+gJTSgdn6QK+AhSdqlN0D++qqs6fGBn5YA1w1 +dGNtuMsL81HjKPIjK+tecFO9HRUSM1nsxg6z8zNzlVxvQYB8uTw3cZXKgorDI280 +6ESdU4oXDQqrUyZVRJmh2I58qMVn9TdeTwbnYFEbrnItq7NKQ9VobcF4T3w2aj61 +vSTLLx8IT9cfyTfQI9ELJ3RFTVzlyfMJ6x9PSyWPzeclsL9pR39rp5ZuZpOXY2Nm +1t3UiQcOurPS/1Y3lxUgZHadFnQyW/oIeQddIfKOollFqnKx/71YPq1RUcPcO/ba +y1IpM8tgpxXfkIWk7jB4N9zmVRI7QwDe+5NKBwIDAQABAoIBAQDAnqnmmEfzANXc +s922wZpmt8p5VQCVykkOPfgemHbjenlsGp6Wh/cZl6CBm/tYUZSiHLTZQUT/RJhj +35BwthtnKJlwK/EFjUzJ6Pvh0VQeOWxL8Ydq5Oh88LcistaqCkjG66IdCmSXkljU +Gjsw8Kjr/9R5PzomzBKPB/z/b4pOxlzAxUev2m7Gfb8UcCwnlMTq3udn6sexZ50V +bTX//tgpsUAMMzARKYk2v472qtmQuTa7rP9EIjKR8qVpv27tX0i80MFUSsOpL1E3 +kPSqqkKEXkCf1zCw14dF2d2JeiyW7ADka71m51ZMfn1POMdwWgpreeWUQphwC798 +KyrJ3RNhAoGBAPy1yUlE1Hs7+/6G3ndpf5lI5lU6aiaT12TVYi0cMWpFDjX0qA93 +Ew7HMFfkZpFwV54YYW1ZuoGG0l93voKsP8LWnSDLEoX+gBbkKHeyMHkzCTiVTlYN +rB7EtAxEe6kYlTbcYhpICA561ujxf+kn/uLhYZQ8iq70Z0kpiDGYwN19AoGBAPKM +HAq7xmxq8rCC65CBbneIJD8luK+XenDKkIj/OjjOp33odR4DAyNwUigu+DzZjdb4 +Xm2Mb3HofDzsRjPjEidQ9dx/rQoA4qKmXMLZI9qFMcFsqFkNwHToBYgrQU0XK+2G +DYIs1spu5TtqWspflcvos4oWM0EiTZs5y8TrnGzTAoGASWEn36Si5l3WoGPdOWNi +78mhSGI77JPFWbw0U9D58Fe49qXiHwt+dy4TtZHWzqiGaJu/vpbtdysE7z/ADAWk +Rhk3awxMhqgN3ZfGwGr3dFoDdXC1XHt/3TdU6LMCDWnb+iAoRGViIYI94Uou0C8S +7iJvyTGDO6YwT6hFqdEnP6kCgYB9LSA/zd8/DwcHX9nxL0tytzl1uaMSREw1r+Ve +PtKuhMDecz0WaxmQjaRpBqyowuK4ImChiwvtLr4Hty0YFEXHMrpgvSfx9LkClndj +PCuL2JfwKoLLyxQbga9xMlm2TpImOLv6Begoe4kk2+PVc/VcUlFun7x+DhUdWnu2 +up51bwKBgAfnx94dIgA8Z7P4Za8Cpp9FCMfUa4R+gNI+/0XLFAGR9Bd+c/61jMRd +OQjErru9Fq47kvE91GHfyS069gI+g7tsTcnPgAXiNhmhILe5O+blNuPPclQ9NMLG +4WII0I6nrbKMnvwCRw6Ikc2OiijPkmbI9VXwIMfbGxI77A4UGBp5 +-----END RSA PRIVATE KEY----- diff --git a/selinux-policy/bz533007-unable-to-start-kdump-service/id_rsa.pub b/selinux-policy/bz533007-unable-to-start-kdump-service/id_rsa.pub new file mode 100644 index 0000000..7b2871f --- /dev/null +++ b/selinux-policy/bz533007-unable-to-start-kdump-service/id_rsa.pub @@ -0,0 +1 @@ +ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDvbidf0Z0Kvn6AlNKB2fpAr4CFJ2qU3QP76qqzp8YGflgDXDV0Y224ywvzUeMo8iMr615wU70dFRIzWezGDrPzM3OVXG9BgHy5PDdxlcqCisMjbzToRJ1TihcNCqtTJlVEmaHYjnyoxWf1N15PBudgURuuci2rs0pD1WhtwXhPfDZqPrW9JMsvHwhP1x/JN9Aj0QsndEVNXOXJ8wnrH09LJY/N5yWwv2lHf2unlm5mk5djY2bW3dSJBw66s9L/VjeXFSBkdp0WdDJb+gh5B10h8o6iWUWqcrH/vVg+rVFRw9w79trLUikzy2CnFd+QhaTuMHg33OZVEjtDAN77k0oH diff --git a/selinux-policy/bz533007-unable-to-start-kdump-service/main.fmf b/selinux-policy/bz533007-unable-to-start-kdump-service/main.fmf new file mode 100644 index 0000000..c604c09 --- /dev/null +++ b/selinux-policy/bz533007-unable-to-start-kdump-service/main.fmf @@ -0,0 +1,81 @@ +summary: kdump service cannot be started because of SELinux +description: |+ + SELinux interferes with kdump and related programs. + +contact: Milos Malik +component: + - selinux-policy +test: ./runtest.sh +framework: beakerlib +require: + - library(selinux-policy/common) +recommend: + - audit + - expect + - /usr/sbin/service + - kexec-tools + - grubby + - libselinux + - libselinux-utils + - policycoreutils + - sed + - selinux-policy + - selinux-policy-mls + - selinux-policy-targeted + - setools-console +environment: + AVC_ERROR: +no_avc_check +duration: 15m +enabled: true +tag: + - MLS + - NoRHEL4 + - TIPpass_Security + - TierCandidatesPASS + - TipWaived7 + - failinfedora + - targeted +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=533007 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=533366 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=537088 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=540758 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=549503 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=618329 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=621061 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=753039 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=966203 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1055634 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1117368 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1117710 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1146491 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1288565 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1363977 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1375963 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1390669 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1418441 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1431236 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1536690 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1540004 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1542283 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1576730 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1588884 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1842897 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1896424 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1896595 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1899141 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1932752 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1951323 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1961728 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1965985 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1965989 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1934347 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=830822 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2236876 +adjust: + - enabled: false + when: distro == rhel-4 + continue: false +extra-nitrate: TC#0057470 +extra-summary: /CoreOS/selinux-policy/Regression/bz533007-unable-to-start-kdump-service +extra-task: /CoreOS/selinux-policy/Regression/bz533007-unable-to-start-kdump-service diff --git a/selinux-policy/bz533007-unable-to-start-kdump-service/run.exp b/selinux-policy/bz533007-unable-to-start-kdump-service/run.exp new file mode 100755 index 0000000..939b3a3 --- /dev/null +++ b/selinux-policy/bz533007-unable-to-start-kdump-service/run.exp @@ -0,0 +1,17 @@ +#!/usr/bin/expect -f +# ./run.exp password param1 param2 param3 +set password [lrange $argv 0 0] +set param1 [lrange $argv 1 1] +set param2 [lrange $argv 2 2] +set param3 [lrange $argv 3 3] +set timeout 15 +spawn $param1 $param2 $param3 +expect { + "yes/no" { send -- "yes\r" } + eof +} +expect { + "assword" { send -- "$password\r" } + eof +} + diff --git a/selinux-policy/bz533007-unable-to-start-kdump-service/runtest.sh b/selinux-policy/bz533007-unable-to-start-kdump-service/runtest.sh new file mode 100755 index 0000000..ba14f7e --- /dev/null +++ b/selinux-policy/bz533007-unable-to-start-kdump-service/runtest.sh @@ -0,0 +1,257 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/bz533007-unable-to-start-kdump-service +# Description: kdump service cannot be started because of SELinux +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2009 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include rhts environment +. /usr/share/beakerlib/beakerlib.sh + +if ! grep crashkernel= /proc/cmdline ; then + grubby --update-kernel ALL --args crashkernel=512M + sync + rhts-reboot +fi + +PACKAGE="selinux-policy" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-mls + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm kexec-tools + rlRun "uname -a" + rlRun "cat /proc/cmdline" + + rlFileBackup --clean /root/.ssh + rlFileBackup /etc/kdump.conf + rlFileBackup /etc/shadow + OUTPUT_FILE=`mktemp` + + if rlIsRHEL 6 ; then + rlRun "ls -l testpolicy.te" + rlRun "make -f /usr/share/selinux/devel/Makefile" + rlRun "ls -l testpolicy.pp" + rlRun "semodule -i testpolicy.pp" + fi + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + if ! rlIsRHEL 5 ; then + rlPhaseStartTest "bz#533007 + bz#533366 + bz#540758 + bz#549503 + bz#966203" + rlSEMatchPathCon "/sbin/kexec" "kdump_exec_t" + rlRun "ls -Z /proc/kcore | grep :proc_kcore_t" + if rlIsRHEL 6 ; then + rlRun "seinfo -tkdump_t -x | grep mlsfileread" + fi + rlSESearchRule "allow kdump_t proc_kcore_t : file { getattr open read }" + rlPhaseEnd + + rlPhaseStartTest "bz#537088" + rlSEMatchPathCon "/sbin/kexec" "kdump_exec_t" + rlSESearchRule "allow kdump_t kdump_t : capability { sys_rawio }" + rlPhaseEnd + + rlPhaseStartTest "bz#618329" + rlSEMatchPathCon "/sbin/kexec" "kdump_exec_t" + [ -e /sys/kernel/debug/boot_params/data ] && rlRun "ls -Z /sys/kernel/debug/boot_params/data | grep :debugfs_t" + rlSESearchRule "allow kdump_t user_devpts_t : chr_file { read write } [ allow_daemons_use_tty ]" + rlSESearchRule "allow kdump_t sysfs_t : dir { getattr read search }" + rlSESearchRule "allow kdump_t sysfs_t : file { getattr open read }" + rlSESearchRule "allow kdump_t debugfs_t : dir { getattr search }" + rlSESearchRule "allow kdump_t debugfs_t : file { getattr open read }" + rlPhaseEnd + + rlPhaseStartTest "bz#621061" + rlSEMatchPathCon "/sbin/kexec" "kdump_exec_t" + rlSESearchRule "allow kdump_t kernel_t : system { module_request }" + rlPhaseEnd + fi + + if rlIsRHEL 6 ; then + rlPhaseStartTest "bz#1288565 + bz#1431236" + rlSEMatchPathCon "/usr/sbin/bmc-watchdog" "freeipmi_bmc_watchdog_exec_t" + rlSEMatchPathCon "/var/lock/kdump" "kdump_lock_t" + # even though the context of /var/lock/kdump was corrected via restorecon before reboot + # after reboot the file was mislabeled (var_lock_t) again + rlSESearchRule "dontaudit freeipmi_bmc_watchdog_t var_lock_t : file { write }" + rlPhaseEnd + fi + + if ! rlIsRHEL 5 6 ; then + rlPhaseStartTest "bz#1055634" # MLS + targeted + rlSEMatchPathCon "/usr/bin/kdumpctl" "kdumpctl_exec_t" + rlSEMatchPathCon "/var/lock" "var_lock_t" + rlSEMatchPathCon "/var/lock/kdump" "kdump_lock_t" + rlSESearchRule "allow kdumpctl_t var_lock_t : lnk_file { getattr read }" + rlSESearchRule "allow kdumpctl_t var_lock_t : dir { getattr open search read write add_name remove_name }" + rlRun "sesearch -s kdumpctl_t -t var_lock_t -c file -T | grep \"kdump_lock_t.*kdump\"" + rlSESearchRule "allow kdumpctl_t kdump_lock_t : file { getattr open create unlink }" + rlPhaseEnd + + rlPhaseStartTest "bz#1117368 + bz#1117710 + bz#1146491" + rlSEMatchPathCon "/sbin/kexec" "kdump_exec_t" + rlRun "ls -Z /proc/kallsyms | grep :system_map_t" + rlSESearchRule "allow kdump_t system_map_t : file { getattr open read }" + rlPhaseEnd + + rlPhaseStartTest "bz#1363977" + rlSESearchRule "allow NetworkManager_t kdumpctl_t : dbus { send_msg }" + rlSESearchRule "allow kdumpctl_t NetworkManager_t : dbus { send_msg }" + rlPhaseEnd + + rlPhaseStartTest "bz#1375963 + bz#1418441" + rlSEMatchPathCon "/sbin/kexec" "kdump_exec_t" + rlSESearchRule "allow kdump_t kdump_t : capability { sys_admin }" + rlPhaseEnd + + rlPhaseStartTest "bz#1390669" + rlSEMatchPathCon "/usr/bin/kdumpctl" "kdumpctl_exec_t" + if [ -f /sys/kernel/security/securelevel ] ; then + # the file is present on RHEL-7.5: kernel 3.10 + # the file is not present on RHEL-ALT-7.5: kernel 4.14 + rlRun "ls -Z /sys/kernel/security/securelevel | grep :security_t" + fi + rlSESearchRule "allow kdumpctl_t security_t : file { getattr open read } mls" + rlSESearchRule "allow kdumpctl_t security_t : file { getattr open read } targeted" + rlPhaseEnd + + rlPhaseStartTest "bz#1540004 + bz#1542283" + rlSEMatchPathCon "/sbin/kexec" "kdump_exec_t" + rlSESearchRule "allow kdump_t kdump_t : capability2 { syslog }" + rlPhaseEnd + + rlPhaseStartTest "bz#1536690" + rlSESearchRule "allow kdump_t modules_object_t : file { getattr open read } [ ]" + rlPhaseEnd + fi + + if ! rlIsRHEL 5 6 ; then + rlPhaseStartTest "bz#1576730 + bz#1588884" + rlSEMatchPathCon "/sbin/kexec" "kdump_exec_t" + rlSEMatchPathCon "/boot/initramfs-4.16.0-8.el8+5.s390xkdump.img" "boot_t" + rlSESearchRule "allow kdump_t boot_t : file { map }" + rlPhaseEnd + fi + + if ! rlIsRHEL 5 6 7 ; then + rlPhaseStartTest "bz#1842897" + # relevant SELinux denials appear during the real scenario phases + rlSESearchRule "dontaudit NetworkManager_t kdumpctl_tmp_t : fifo_file { write } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1896424 + bz#1896595 + bz#1899141" + rlSEMatchPathCon "/sbin/kexec" "kdump_exec_t" + rlSESearchRule "allow kdump_t tmp_t : dir { write add_name remove_name } [ ]" + rlSESearchRule "allow kdump_t tmp_t : file { create unlink } [ ]" + rlPhaseEnd + fi + + if seinfo -c | grep -q lockdown ; then + rlPhaseStartTest "bz#1932752" + rlSEMatchPathCon "/sbin/kexec" "kdump_exec_t" + rlSESearchRule "allow kdump_t kdump_t : lockdown { confidentiality integrity } [ ]" + rlPhaseEnd + fi + + if ! rlIsRHEL 5 6 7 ; then + rlPhaseStartTest "bz#1951323 + bz#1961728 + bz#1965985 + bz#1965989" + # the directory belongs to the kexec-tools package + rlSEMatchPathCon "/var/lib/kdump" "kdump_var_lib_t" + rlSEMatchPathCon "/var/lib/kdump/initramfs-kernel-version.kdump.img" "kdump_var_lib_t" + rlSESearchRule "allow kdump_t kdump_var_lib_t : dir { getattr open search add_name remove_name read write } [ ]" + rlSESearchRule "allow kdump_t kdump_var_lib_t : file { getattr open read } [ ]" + rlSESearchRule "allow rpm_script_t kdump_var_lib_t : dir { getattr open search add_name remove_name read write } [ ]" + rlSESearchRule "allow rpm_script_t kdump_var_lib_t : file { getattr open read } [ ]" + rlPhaseEnd + fi + + if rlIsFedora ; then + rlPhaseStartTest "bz#2236876" + rlSESearchRule "allow kdump_t tmpfs_t : dir { write add_name } [ ]" + rlSESearchRule "type_transition kdump_t tmpfs_t : file kdump_tmpfs_t" + rlSESearchRule "allow kdump_t kdump_tmpfs_t : file { read write } [ ]" + rlPhaseEnd + fi + + rlPhaseStartTest "real scenario" + rlRun "sed -i \"s/^\(net.*\)$/# \1/\" /etc/kdump.conf" + rlRun "service kdump start 2>&1 | tee ${OUTPUT_FILE}" + rlRun "grep -i \"unable to gather efi data\" ${OUTPUT_FILE}" 1 + sleep 1 + rlRun "service kdump restart 2>&1 | tee ${OUTPUT_FILE}" + rlRun "grep -i \"unable to gather efi data\" ${OUTPUT_FILE}" 1 + sleep 1 + rlRun "service kdump stop" + sleep 1 + rlRun "grep \"kdump.*kexec.*loaded.*kernel\" /var/log/messages | tail -n 2" + rlPhaseEnd + + rlPhaseStartTest "real scenario -- bz#753039" + USER_NAME="root" + USER_SECRET="redhat" + rlRun "echo ${USER_SECRET} | passwd --stdin ${USER_NAME}" + rlRun "mkdir -p /root/.ssh" + rlRun "restorecon -Rv /root/.ssh" + rlRun "cp id_rsa /root/.ssh/" + rlRun "chmod 600 /root/.ssh/id_rsa" + rlRun "cat id_rsa.pub >> /root/.ssh/authorized_keys" + + if rlIsRHEL 5 6 ; then + rlRun "echo \"net ${USER_NAME}@${HOSTNAME}\" >> /etc/kdump.conf" + rlRun "./run.exp ${USER_SECRET} service kdump propagate" + else + rlRun "sed -i \"s/makedumpfile/makedumpfile -F/\" /etc/kdump.conf" + rlRun "echo \"ssh ${USER_NAME}@${HOSTNAME}\" >> /etc/kdump.conf" + rlRun "./run.exp ${USER_SECRET} kdumpctl propagate" + rlRun "runcon system_u:system_r:initrc_t:s0 bash -c \"kdumpctl showmem\"" + fi + rlRun "service kdump restart" + sleep 1 + rlRun "grep \"kdump.*propagated ssh key\" /var/log/messages | tail -n 1" + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + if rlIsRHEL 6 ; then + rlRun "semodule -r testpolicy" + rlRun "rm -f testpolicy.pp" + fi + + rm -f ${OUTPUT_FILE} + rlFileRestore + rlPhaseEnd + rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/bz533007-unable-to-start-kdump-service/testpolicy.te b/selinux-policy/bz533007-unable-to-start-kdump-service/testpolicy.te new file mode 100644 index 0000000..d90b338 --- /dev/null +++ b/selinux-policy/bz533007-unable-to-start-kdump-service/testpolicy.te @@ -0,0 +1,15 @@ +module testpolicy 1.0; + +require { + type user_tmp_t; + type setfiles_t; + type kdump_t; + class file write; +} + +#============= kdump_t ============== +allow kdump_t user_tmp_t:file write; + +#============= setfiles_t ============== +allow setfiles_t user_tmp_t:file write; + From 8698c26ae9aaa8661d7403974139f2a18a61d6ad Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Fri, 22 Sep 2023 08:04:51 +0200 Subject: [PATCH 279/626] fix the type differences: stas_t vs. nvme_stas_t Even though the new policy for nvme-stas component was tested multiple times (as can be seen in BZ#2111414 and RHEL-1557), a SELinux type naming problem was introduced by various selinux-policy builds. For example: * stas_t vs. nvme_stas_t * stas_exec_t vs. nvme_stas_exec_t * stas_var_run_t vs. nvme_stas_var_run_t * stas_cache_t vs. nvme_stas_cache_t In order to make the automated test correct and reliable, the SELinux policy checks executed by the test will use the nvme_* prefixed types, because they are present in the latest selinux-policy builds. --- selinux-policy/nvme-stas-and-similar/Makefile | 4 +-- selinux-policy/nvme-stas-and-similar/PURPOSE | 2 +- selinux-policy/nvme-stas-and-similar/main.fmf | 4 +-- .../nvme-stas-and-similar/runtest.sh | 36 +++++++++---------- 4 files changed, 23 insertions(+), 23 deletions(-) diff --git a/selinux-policy/nvme-stas-and-similar/Makefile b/selinux-policy/nvme-stas-and-similar/Makefile index b2e07cb..fadaa75 100644 --- a/selinux-policy/nvme-stas-and-similar/Makefile +++ b/selinux-policy/nvme-stas-and-similar/Makefile @@ -1,7 +1,7 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # # Makefile of /CoreOS/selinux-policy/Regression/nvme-stas-and-similar -# Description: SELinux interferes with NVME sta* services +# Description: SELinux interferes with stacd and stafd services # Author: Milos Malik # # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ @@ -50,7 +50,7 @@ $(METADATA): Makefile @echo "Name: $(TEST)" >> $(METADATA) @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: SELinux interferes with NVME sta* services" >> $(METADATA) + @echo "Description: SELinux interferes with stacd and stafd services" >> $(METADATA) @echo "Type: Regression" >> $(METADATA) @echo "TestTime: 10m" >> $(METADATA) @echo "RunFor: nvme-stas" >> $(METADATA) diff --git a/selinux-policy/nvme-stas-and-similar/PURPOSE b/selinux-policy/nvme-stas-and-similar/PURPOSE index a0cc42a..0f6ef81 100644 --- a/selinux-policy/nvme-stas-and-similar/PURPOSE +++ b/selinux-policy/nvme-stas-and-similar/PURPOSE @@ -1,6 +1,6 @@ PURPOSE of /CoreOS/selinux-policy/Regression/nvme-stas-and-similar Author: Milos Malik -SELinux interferes with stacd, stafd services. +SELinux interferes with stacd and stafd services. SELinux also affects the stacctl and stafctl programs. diff --git a/selinux-policy/nvme-stas-and-similar/main.fmf b/selinux-policy/nvme-stas-and-similar/main.fmf index 76b2ef4..decc044 100644 --- a/selinux-policy/nvme-stas-and-similar/main.fmf +++ b/selinux-policy/nvme-stas-and-similar/main.fmf @@ -1,6 +1,6 @@ -summary: SELinux interferes with NVME sta* services +summary: SELinux interferes with stacd and stafd services description: |+ - SELinux interferes with NVME sta* services + SELinux interferes with stacd and stafd services contact: Milos Malik component: diff --git a/selinux-policy/nvme-stas-and-similar/runtest.sh b/selinux-policy/nvme-stas-and-similar/runtest.sh index 725e2e9..ac5dd29 100755 --- a/selinux-policy/nvme-stas-and-similar/runtest.sh +++ b/selinux-policy/nvme-stas-and-similar/runtest.sh @@ -3,7 +3,7 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # # runtest.sh of /CoreOS/selinux-policy/Regression/nvme-stas-and-similar -# Description: SELinux interferes with NVME sta* services +# Description: SELinux interferes with stacd and stafd services # Author: Milos Malik # # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ @@ -30,9 +30,9 @@ . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" -FILE_CONTEXT="stas_exec_t" +FILE_CONTEXT="nvme_stas_exec_t" SERVICE_PACKAGE="nvme-stas" -PROCESS_CONTEXT="stas_t" +PROCESS_CONTEXT="nvme_stas_t" rlJournalStart rlPhaseStartSetup @@ -59,29 +59,29 @@ rlJournalStart rlSEMatchPathCon "/usr/sbin/stafd" "${FILE_CONTEXT}" rlSEMatchPathCon "/dev/nvme-fabrics" "fixed_disk_device_t" rlSEMatchPathCon "/run/systemd/journal/socket" "syslogd_var_run_t" - rlSEMatchPathCon "/run/stacd" "stas_var_run_t" - rlSEMatchPathCon "/run/stacd/last-known-config.pickle" "stas_var_run_t" - rlSEMatchPathCon "/run/stafd" "stas_var_run_t" - rlSEMatchPathCon "/run/stafd/last-known-config.pickle" "stas_var_run_t" + rlSEMatchPathCon "/run/stacd" "nvme_stas_var_run_t" + rlSEMatchPathCon "/run/stacd/last-known-config.pickle" "nvme_stas_var_run_t" + rlSEMatchPathCon "/run/stafd" "nvme_stas_var_run_t" + rlSEMatchPathCon "/run/stafd/last-known-config.pickle" "nvme_stas_var_run_t" rlSEMatchPathCon "/run/udev/" "udev_var_run_t" rlSEMatchPathCon "/run/udev/rules.d/" "udev_var_run_t" rlSEMatchPathCon "/run/udev/rules.d/70-nvmf-autoconnect.rules" "udev_var_run_t" - rlSEMatchPathCon "/var/cache/stacd" "stas_cache_t" - rlSEMatchPathCon "/var/cache/stafd" "stas_cache_t" + rlSEMatchPathCon "/var/cache/stacd" "nvme_stas_cache_t" + rlSEMatchPathCon "/var/cache/stafd" "nvme_stas_cache_t" SOURCE_TYPE="init_t" # systemd runs the process rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" rlRun "semodule -lfull | grep stas" - rlSESearchRule "allow avahi_t stas_t : dbus { send_msg } [ ]" - rlSESearchRule "allow stas_t avahi_t : dbus { send_msg } [ ]" - rlSESearchRule "allow stas_t fixed_disk_device_t : chr_file { getattr } [ ]" - rlSESearchRule "allow stas_t stas_t : dbus { send_msg } [ ]" - rlSESearchRule "allow stas_t syslogd_var_run_t : sock_file { write } [ ]" - rlSESearchRule "allow stas_t system_dbusd_t : dbus { acquire_svc send_msg } [ ]" - rlSESearchRule "allow stas_t udev_var_run_t : dir { add_name remove_name write } [ ]" - rlSESearchRule "allow stas_t udev_var_run_t : file { create getattr ioctl open unlink write } [ ]" - rlSESearchRule "allow stas_t stas_var_run_t : file { getattr ioctl open read write } [ ]" + rlSESearchRule "allow avahi_t nvme_stas_t : dbus { send_msg } [ ]" + rlSESearchRule "allow nvme_stas_t avahi_t : dbus { send_msg } [ ]" + rlSESearchRule "allow nvme_stas_t fixed_disk_device_t : chr_file { getattr } [ ]" + rlSESearchRule "allow nvme_stas_t nvme_stas_t : dbus { send_msg } [ ]" + rlSESearchRule "allow nvme_stas_t syslogd_var_run_t : sock_file { write } [ ]" + rlSESearchRule "allow nvme_stas_t system_dbusd_t : dbus { acquire_svc send_msg } [ ]" + rlSESearchRule "allow nvme_stas_t udev_var_run_t : dir { add_name remove_name write } [ ]" + rlSESearchRule "allow nvme_stas_t udev_var_run_t : file { create getattr ioctl open unlink write } [ ]" + rlSESearchRule "allow nvme_stas_t nvme_stas_var_run_t : file { getattr ioctl open read write } [ ]" rlSESearchRule "allow unconfined_t nvme_stas_t : dbus { send_msg } [ ]" rlSESearchRule "allow nvme_stas_t unconfined_t : dbus { send_msg } [ ]" rlPhaseEnd From 1e53ae882349cf40ce883d5ef93377cc641411f5 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Fri, 22 Sep 2023 12:56:32 +0200 Subject: [PATCH 280/626] test if systemd-localed can create /etc/X11/xorg.conf.d/ A recently filed bug report revealed that SELinux prevents the systemd-localed processes from creating the /etc/X11/xorg.conf.d directory if it does not exist. The TC reproduces the situation. In order to enable the legacy systemd-localed functionality, I believe that SELinux policy should allow the action. The TC looks for appropriate policy rules and file context patterns. The TC covers BZ#2240159. --- selinux-policy/systemd-localed/main.fmf | 35 +++++++++++++++++ selinux-policy/systemd-localed/test.sh | 51 +++++++++++++++++++++++++ 2 files changed, 86 insertions(+) create mode 100644 selinux-policy/systemd-localed/main.fmf create mode 100755 selinux-policy/systemd-localed/test.sh diff --git a/selinux-policy/systemd-localed/main.fmf b/selinux-policy/systemd-localed/main.fmf new file mode 100644 index 0000000..7049593 --- /dev/null +++ b/selinux-policy/systemd-localed/main.fmf @@ -0,0 +1,35 @@ +summary: SELinux interferes with systemd-localed and localectl +test: ./test.sh +framework: beakerlib +contact: Milos Malik +component: + - selinux-policy +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - /usr/sbin/service + - systemd +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - targeted +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2240159 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + continue: false + diff --git a/selinux-policy/systemd-localed/test.sh b/selinux-policy/systemd-localed/test.sh new file mode 100755 index 0000000..84ba7d2 --- /dev/null +++ b/selinux-policy/systemd-localed/test.sh @@ -0,0 +1,51 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +SERVICE_PACKAGE="systemd" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop systemd-localed + rlFileBackup --clean --missing-ok /etc/X11/xorg.conf.d + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "bz#2240159" + rlSEMatchPathCon "/usr/lib/systemd/systemd-localed" "systemd_localed_exec_t" + rlSEMatchPathCon "/etc/X11/xorg.conf.d" "xserver_etc_t" + rlSESearchRule "allow systemd_localed_t xserver_etc_t : dir { create } [ ]" + rlPhaseEnd + + rlPhaseStartTest "real scenario -- bz#2240159" + if [ -d /etc/X11/xorg.conf.d ] ; then + rlRun "rpm -qf /etc/X11/xorg.conf.d" 0,1 + rlRun "rm -rf /etc/X11/xorg.conf.d" + fi + rlRun "service systemd-localed start" + rlRun "service systemd-localed status" + rlRun "localectl set-x11-keymap us" + rlRun "ls -lZ /etc/X11/xorg.conf.d" + rlRun "service systemd-localed stop" + rlRun "service systemd-localed status" 3 + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlServiceRestore systemd-localed + rlPhaseEnd +rlJournalEnd + From 46ea4b4457213da9dfba93fd1ac18fa5f3e60093 Mon Sep 17 00:00:00 2001 From: Zdenek Pytela Date: Wed, 4 Oct 2023 16:55:38 +0200 Subject: [PATCH 281/626] Update anon_inode test for F40 Previously, selinux-policy allowed all operations on anonymous inodes for all domains. Since F40, individual types for each anon inode type (userfaultfd and io_uring for the moment) were defined and common userfaultfd/io_uring usage was allowed to individual domains. This test was adjusted to align with the new F40 state. --- selinux-policy/anon_inode-and-similar/runtest.sh | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/selinux-policy/anon_inode-and-similar/runtest.sh b/selinux-policy/anon_inode-and-similar/runtest.sh index a58a606..f3fdcaa 100755 --- a/selinux-policy/anon_inode-and-similar/runtest.sh +++ b/selinux-policy/anon_inode-and-similar/runtest.sh @@ -62,14 +62,22 @@ rlJournalStart rlRun "./reproducer" sleep 3 rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time --input-logs" 1 + if rlIsFedora '<=39'; then rlSESearchRule "allow unconfined_t unconfined_t : anon_inode { write }" + fi rlRun "rm -f reproducer" rlPhaseEnd rlPhaseStartTest "mmap on io_uring - bz#2025714 + bz#2187745" + if rlIsFedora '<=39'; then rlSESearchRule "allow unconfined_t unconfined_t : anon_inode { map } [ ]" rlSESearchRule "allow svirt_t svirt_t : anon_inode { map } [ ]" rlSESearchRule "allow virtd_t virtd_t : anon_inode { map } [ ]" + else + rlSESearchRule "allow unconfined_t io_uring_t : anon_inode { create getattr map read write } [ ]" + rlSESearchRule "allow svirt_t io_uring_t : anon_inode { create getattr map read write } [ ]" + rlSESearchRule "allow virtd_t io_uring_t : anon_inode { create getattr map read write } [ ]" + fi rlRun "fio --filename=/root/pokus --iodepth=16 --rw=write --ioengine=io_uring --bs=16k --size=2G --numjobs=30 --runtime=100s --group_reporting=1 --name=mytest" 0-255 rlPhaseEnd From 037f2d7d1dc632004a65e7e98434b32ef5804709 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Wed, 11 Oct 2023 13:34:56 +0200 Subject: [PATCH 282/626] mark tests which fail in Fedora rawhide Tag the automated tests which fail in Fedora rawhide: failinfedora. --- libsemanage/sanity-tests/main.fmf | 2 +- selinux-policy/caddy-and-similar/main.fmf | 2 ++ selinux-policy/ladvd/main.fmf | 2 ++ selinux-policy/rpc.idmapd-and-similar/main.fmf | 1 + selinux-policy/sslh-and-similar/main.fmf | 1 + selinux-policy/stalld-and-similar/main.fmf | 1 + selinux-policy/systemd-machined-and-similar/main.fmf | 1 + selinux-policy/systemd-modules-load-and-similar/main.fmf | 1 + selinux-policy/virtualization-daemons/main.fmf | 1 + 9 files changed, 11 insertions(+), 1 deletion(-) diff --git a/libsemanage/sanity-tests/main.fmf b/libsemanage/sanity-tests/main.fmf index e44669e..0f8b6c8 100644 --- a/libsemanage/sanity-tests/main.fmf +++ b/libsemanage/sanity-tests/main.fmf @@ -21,7 +21,7 @@ tag: - Tier1se - f31friendly - f32friendly - - notip + - failinfedora - rhel8-buildroot - rhel8-crb - rhel9-buildroot diff --git a/selinux-policy/caddy-and-similar/main.fmf b/selinux-policy/caddy-and-similar/main.fmf index 17570f3..9a19fbb 100644 --- a/selinux-policy/caddy-and-similar/main.fmf +++ b/selinux-policy/caddy-and-similar/main.fmf @@ -21,6 +21,8 @@ environment: AVC_ERROR: +no_avc_check duration: 10m enabled: true +tag: + - failinfedora adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 diff --git a/selinux-policy/ladvd/main.fmf b/selinux-policy/ladvd/main.fmf index ad60ea2..e1c83a9 100644 --- a/selinux-policy/ladvd/main.fmf +++ b/selinux-policy/ladvd/main.fmf @@ -23,6 +23,8 @@ recommend: environment: AVC_ERROR: +no_avc_check duration: 1h +tag: + - failinfedora link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1834325 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1855163 diff --git a/selinux-policy/rpc.idmapd-and-similar/main.fmf b/selinux-policy/rpc.idmapd-and-similar/main.fmf index ee69fa1..fd31a86 100644 --- a/selinux-policy/rpc.idmapd-and-similar/main.fmf +++ b/selinux-policy/rpc.idmapd-and-similar/main.fmf @@ -29,6 +29,7 @@ tag: - Tier3 - Tier3se - targeted + - failinfedora tier: '3' adjust: - enabled: false diff --git a/selinux-policy/sslh-and-similar/main.fmf b/selinux-policy/sslh-and-similar/main.fmf index b718239..1196043 100644 --- a/selinux-policy/sslh-and-similar/main.fmf +++ b/selinux-policy/sslh-and-similar/main.fmf @@ -30,6 +30,7 @@ tag: - f32friendly - f33friendly - targeted + - failinfedora link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1534624 adjust: diff --git a/selinux-policy/stalld-and-similar/main.fmf b/selinux-policy/stalld-and-similar/main.fmf index 515ad87..e641a86 100644 --- a/selinux-policy/stalld-and-similar/main.fmf +++ b/selinux-policy/stalld-and-similar/main.fmf @@ -30,6 +30,7 @@ tag: - Tier2 - Tier2se - targeted + - failinfedora tier: '2' link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2042614 diff --git a/selinux-policy/systemd-machined-and-similar/main.fmf b/selinux-policy/systemd-machined-and-similar/main.fmf index b757c0d..7ba022c 100644 --- a/selinux-policy/systemd-machined-and-similar/main.fmf +++ b/selinux-policy/systemd-machined-and-similar/main.fmf @@ -28,6 +28,7 @@ tag: - NoRHEL6 - NoRHEL7 - targeted + - failinfedora link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1847545 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1900869 diff --git a/selinux-policy/systemd-modules-load-and-similar/main.fmf b/selinux-policy/systemd-modules-load-and-similar/main.fmf index 1e18e2e..8205301 100644 --- a/selinux-policy/systemd-modules-load-and-similar/main.fmf +++ b/selinux-policy/systemd-modules-load-and-similar/main.fmf @@ -30,6 +30,7 @@ tag: - NoRHEL7 - f33friendly - targeted + - failinfedora link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1358526 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1358960 diff --git a/selinux-policy/virtualization-daemons/main.fmf b/selinux-policy/virtualization-daemons/main.fmf index acad013..5f1b0a2 100644 --- a/selinux-policy/virtualization-daemons/main.fmf +++ b/selinux-policy/virtualization-daemons/main.fmf @@ -41,6 +41,7 @@ tag: - NoRHEL7 - NoRHEL8 - targeted + - failinfedora adjust: - enabled: false when: distro < rhel-9 From 16b6e607cbc0b118dfb02a68401146889d4bb7e4 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Wed, 11 Oct 2023 16:01:04 +0200 Subject: [PATCH 283/626] unmark tests which pass in Fedora rawhide Remove the failinfedora tag from the automated tests which pass in Fedora rawhide. --- selinux-policy/accounts-daemon-and-similar/main.fmf | 1 - selinux-policy/blueman-and-similar/main.fmf | 1 - selinux-policy/boltd-and-similar/main.fmf | 1 - selinux-policy/bz481628-send-msg-to-dbus/main.fmf | 1 - selinux-policy/bz733494-amanda-and-similar/main.fmf | 1 - selinux-policy/dhcpcd-and-similar/main.fmf | 1 - selinux-policy/fwupd-and-similar/main.fmf | 1 - selinux-policy/journalctl-and-similar/main.fmf | 1 - selinux-policy/numad-and-similar/main.fmf | 1 - selinux-policy/ping-and-similar/main.fmf | 1 - 10 files changed, 10 deletions(-) diff --git a/selinux-policy/accounts-daemon-and-similar/main.fmf b/selinux-policy/accounts-daemon-and-similar/main.fmf index 85c80d0..1590624 100644 --- a/selinux-policy/accounts-daemon-and-similar/main.fmf +++ b/selinux-policy/accounts-daemon-and-similar/main.fmf @@ -36,7 +36,6 @@ tag: - Tier3 - Tier3se - TierCandidatesPASS - - failinfedora - targeted tier: '3' link: diff --git a/selinux-policy/blueman-and-similar/main.fmf b/selinux-policy/blueman-and-similar/main.fmf index ced85dd..722f8cc 100644 --- a/selinux-policy/blueman-and-similar/main.fmf +++ b/selinux-policy/blueman-and-similar/main.fmf @@ -28,7 +28,6 @@ tag: - NoRHEL5 - NoRHEL6 - NoRHEL7 - - failinfedora - targeted link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1470501 diff --git a/selinux-policy/boltd-and-similar/main.fmf b/selinux-policy/boltd-and-similar/main.fmf index fc69914..b4b8a85 100644 --- a/selinux-policy/boltd-and-similar/main.fmf +++ b/selinux-policy/boltd-and-similar/main.fmf @@ -33,7 +33,6 @@ tag: - TierCandidatesPASS - f31friendly - f32friendly - - failinfedora - targeted tier: '2' link: diff --git a/selinux-policy/bz481628-send-msg-to-dbus/main.fmf b/selinux-policy/bz481628-send-msg-to-dbus/main.fmf index 78afc50..27d6716 100644 --- a/selinux-policy/bz481628-send-msg-to-dbus/main.fmf +++ b/selinux-policy/bz481628-send-msg-to-dbus/main.fmf @@ -30,7 +30,6 @@ tag: - NoRHEL4 - TIPpass - TierCandidatesPASS - - failinfedora - targeted link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=463267 diff --git a/selinux-policy/bz733494-amanda-and-similar/main.fmf b/selinux-policy/bz733494-amanda-and-similar/main.fmf index 0563a0c..65e0a2e 100644 --- a/selinux-policy/bz733494-amanda-and-similar/main.fmf +++ b/selinux-policy/bz733494-amanda-and-similar/main.fmf @@ -34,7 +34,6 @@ tag: - NoRHEL4 - TierCandidatesFAIL - f32friendly - - failinfedora - rhel9-buildroot - targeted link: diff --git a/selinux-policy/dhcpcd-and-similar/main.fmf b/selinux-policy/dhcpcd-and-similar/main.fmf index bc95e8b..97f512c 100644 --- a/selinux-policy/dhcpcd-and-similar/main.fmf +++ b/selinux-policy/dhcpcd-and-similar/main.fmf @@ -25,7 +25,6 @@ tag: - NoRHEL4 - NoRHEL5 - NoRHEL6 - - failinfedora - targeted link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1585971 diff --git a/selinux-policy/fwupd-and-similar/main.fmf b/selinux-policy/fwupd-and-similar/main.fmf index 26be6e8..6360f0d 100644 --- a/selinux-policy/fwupd-and-similar/main.fmf +++ b/selinux-policy/fwupd-and-similar/main.fmf @@ -33,7 +33,6 @@ tag: - Tier3 - Tier3se - TierCandidatesPASS - - failinfedora - targeted tier: '3' link: diff --git a/selinux-policy/journalctl-and-similar/main.fmf b/selinux-policy/journalctl-and-similar/main.fmf index a5e9de2..f15cc43 100644 --- a/selinux-policy/journalctl-and-similar/main.fmf +++ b/selinux-policy/journalctl-and-similar/main.fmf @@ -30,7 +30,6 @@ tag: - NoRHEL4 - NoRHEL5 - NoRHEL6 - - failinfedora - targeted link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1176713 diff --git a/selinux-policy/numad-and-similar/main.fmf b/selinux-policy/numad-and-similar/main.fmf index 8b20c53..1164ae8 100644 --- a/selinux-policy/numad-and-similar/main.fmf +++ b/selinux-policy/numad-and-similar/main.fmf @@ -32,7 +32,6 @@ tag: - Tier3 - Tier3se - TipWaived7 - - failinfedora - targeted tier: '3' link: diff --git a/selinux-policy/ping-and-similar/main.fmf b/selinux-policy/ping-and-similar/main.fmf index f07662d..85bc61f 100644 --- a/selinux-policy/ping-and-similar/main.fmf +++ b/selinux-policy/ping-and-similar/main.fmf @@ -28,7 +28,6 @@ tag: - TIPpass - TIPpass_Security - TierCandidatesPASS - - failinfedora - targeted link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1552128 From e1f30f13fb3c8518f5e13e4713a47faf9bf54e26 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Mon, 9 Oct 2023 11:15:11 +0200 Subject: [PATCH 284/626] test if numad can use the ipc_owner capability A scenario which combines the numad service, a libvirt VM and the following libvirt configuration option revealed that SELinux prevents the numad processes from using the ipc_owner capability: In order to support the whole numad functionality, I believe that SELinux policy should allow the action. The TC looks for appropriate policy rule. The TC covers BZ#2026968 and RHEL-2415. --- selinux-policy/numad-and-similar/Makefile | 6 ++++-- selinux-policy/numad-and-similar/main.fmf | 4 +++- selinux-policy/numad-and-similar/runtest.sh | 6 ++++++ 3 files changed, 13 insertions(+), 3 deletions(-) diff --git a/selinux-policy/numad-and-similar/Makefile b/selinux-policy/numad-and-similar/Makefile index cff1beb..10f6781 100644 --- a/selinux-policy/numad-and-similar/Makefile +++ b/selinux-policy/numad-and-similar/Makefile @@ -73,12 +73,14 @@ $(METADATA): Makefile @echo "Confidential: no" >> $(METADATA) @echo "Destructive: no" >> $(METADATA) @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Architectures: i386 ppc64 x86_64" >> $(METADATA) - @echo "Releases: -RHEL4 -RHELServer5 -RHELClient5" >> $(METADATA) + @echo "Architectures: aarch64 ppc64le x86_64" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5" >> $(METADATA) @echo "Bug: 807157" >> $(METADATA) # RHEL-6 @echo "Bug: 857086" >> $(METADATA) # RHEL-7 @echo "Bug: 1074449" >> $(METADATA) # RHEL-7 @echo "Bug: 1118515" >> $(METADATA) # RHEL-7 + @echo "Bug: 2026968" >> $(METADATA) # Fedora 35 + @echo "Bug: RHEL-2415" >> $(METADATA) # RHEL-8 rhts-lint $(METADATA) diff --git a/selinux-policy/numad-and-similar/main.fmf b/selinux-policy/numad-and-similar/main.fmf index 1164ae8..ec35de1 100644 --- a/selinux-policy/numad-and-similar/main.fmf +++ b/selinux-policy/numad-and-similar/main.fmf @@ -39,12 +39,14 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=857086 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1074449 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1118515 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2026968 + - verifies: https://issues.redhat.com/browse/RHEL-2415 adjust: - enabled: false when: distro == rhel-4, rhel-5 continue: false - enabled: false - when: arch != x86_64 and arch != ppc64 and arch != ppc64le + when: arch != x86_64 and arch != aarch64 and arch != ppc64le continue: false extra-nitrate: TC#0202428 extra-summary: /CoreOS/selinux-policy/Regression/numad-and-similar diff --git a/selinux-policy/numad-and-similar/runtest.sh b/selinux-policy/numad-and-similar/runtest.sh index 27d5b96..d6996f0 100755 --- a/selinux-policy/numad-and-similar/runtest.sh +++ b/selinux-policy/numad-and-similar/runtest.sh @@ -98,6 +98,12 @@ rlJournalStart rlPhaseEnd fi + if ! rlIsRHEL 5 6 7 ; then + rlPhaseStartTest "bz#2026968 + RHEL-2415" + rlSESearchRule "allow numad_t numad_t : capability { ipc_owner } [ ]" + rlPhaseEnd + fi + rlPhaseStartTest "real scenario" rlRun "mkdir -p ${MOUNT_POINT}" if ! mount | grep -q "cgroup.*cpuset" ; then From ba723f4941c118f25bf2299b311f5fd3ce42b5b9 Mon Sep 17 00:00:00 2001 From: Zdenek Pytela Date: Mon, 16 Oct 2023 12:25:46 +0200 Subject: [PATCH 285/626] Update test for virtualization daemons Since Fedora 40, virt policy has been split into 2 modules. There are new types for hypervisor drivers in the main policy module and also new types for secondary drivers in the virt_supplementary module. --- .../virtualization-daemons/runtest.sh | 31 +++++++++++++++++++ 1 file changed, 31 insertions(+) diff --git a/selinux-policy/virtualization-daemons/runtest.sh b/selinux-policy/virtualization-daemons/runtest.sh index 3ac205f..f41928a 100755 --- a/selinux-policy/virtualization-daemons/runtest.sh +++ b/selinux-policy/virtualization-daemons/runtest.sh @@ -32,6 +32,22 @@ PACKAGE="selinux-policy" ROOT_PASSWORD="redhat" SERVICE_NAMES="libvirtd virtinterfaced virtlockd virtlogd virtlxcd virtnetworkd virtnodedevd virtnwfilterd virtproxyd virtqemud virtsecretd virtstoraged virtvboxd virtxend" +if rlIsFedora > "39"; then +ALL_TUPLES="libvirtd:libvirtd:virtd_t \ + virtinterfaced:virtinterfaced:virtinterfaced_t \ + virtlockd:virtlockd:virtlogd_t \ + virtlogd:virtlogd:virtlogd_t \ + virtlxcd:virtlxcd:virtd_lxc_t \ + virtnetworkd:virtnetworkd:virtnetworkd_t \ + virtnodedevd:virtnodedevd:virtnodedevd_t \ + virtnwfilterd:virtnwfilterd:virtnwfilterd_t \ + virtproxyd:virtproxyd:virtproxyd_t \ + virtqemud:virtqemud:virtqemud_t \ + virtsecretd:virtsecretd:virtsecretd_t \ + virtstoraged:virtstoraged:virtstoraged_t \ + virtvboxd:virtvboxd:virtvboxd_t" +# virtxend:virtxend:virtxend_t" +else ALL_TUPLES="libvirtd:libvirtd:virtd_t \ virtinterfaced:virtinterfaced:virtd_t \ virtlockd:virtlockd:virtlogd_t \ @@ -46,6 +62,7 @@ ALL_TUPLES="libvirtd:libvirtd:virtd_t \ virtstoraged:virtstoraged:virtd_t \ virtvboxd:virtvboxd:virtd_t" # virtxend:virtxend:virtd_t +fi rlJournalStart rlPhaseStartSetup @@ -69,6 +86,19 @@ rlJournalStart rlPhaseEnd rlPhaseStartTest "SELinux contexts and rules" + if rlIsFedora > "39"; then + rlSEMatchPathCon "/usr/sbin/virtinterfaced" "virtinterfaced_exec_t" + rlSEMatchPathCon "/usr/sbin/virtlxcd" "virtd_lxc_exec_t" + rlSEMatchPathCon "/usr/sbin/virtnetworkd" "virtnetworkd_exec_t" + rlSEMatchPathCon "/usr/sbin/virtnodedevd" "virtnodedevd_exec_t" + rlSEMatchPathCon "/usr/sbin/virtnwfilterd" "virtnwfilterd_exec_t" + rlSEMatchPathCon "/usr/sbin/virtproxyd" "virtproxyd_exec_t" + rlSEMatchPathCon "/usr/sbin/virtqemud" "virtqemud_exec_t" + rlSEMatchPathCon "/usr/sbin/virtsecretd" "virtsecretd_exec_t" + rlSEMatchPathCon "/usr/sbin/virtstoraged" "virtstoraged_exec_t" + rlSEMatchPathCon "/usr/sbin/virtvboxd" "virtvboxd_exec_t" + rlSEMatchPathCon "/usr/sbin/virtxend" "virtxend_exec_t" + else rlSEMatchPathCon "/usr/sbin/virtinterfaced" "virtd_exec_t" rlSEMatchPathCon "/usr/sbin/virtlxcd" "virtd_exec_t" rlSEMatchPathCon "/usr/sbin/virtnetworkd" "virtd_exec_t" @@ -80,6 +110,7 @@ rlJournalStart rlSEMatchPathCon "/usr/sbin/virtstoraged" "virtd_exec_t" rlSEMatchPathCon "/usr/sbin/virtvboxd" "virtd_exec_t" rlSEMatchPathCon "/usr/sbin/virtxend" "virtd_exec_t" + fi rlPhaseEnd rlPhaseStartTest "real scenario -- standalone service" From 5f44de3a2137d1ff22f1beed67808712938c7bf2 Mon Sep 17 00:00:00 2001 From: Zdenek Pytela Date: Wed, 18 Oct 2023 13:24:40 +0200 Subject: [PATCH 286/626] Fix incorrect rlIsFedora usage Since the ba723f4941c (Update test for virtualization daemons) commit, the virtualization daemons test branches based on Fedora version, but rlIsFedora was used incorrectly, making the condition always succeed. --- selinux-policy/virtualization-daemons/runtest.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/selinux-policy/virtualization-daemons/runtest.sh b/selinux-policy/virtualization-daemons/runtest.sh index f41928a..825382b 100755 --- a/selinux-policy/virtualization-daemons/runtest.sh +++ b/selinux-policy/virtualization-daemons/runtest.sh @@ -32,7 +32,7 @@ PACKAGE="selinux-policy" ROOT_PASSWORD="redhat" SERVICE_NAMES="libvirtd virtinterfaced virtlockd virtlogd virtlxcd virtnetworkd virtnodedevd virtnwfilterd virtproxyd virtqemud virtsecretd virtstoraged virtvboxd virtxend" -if rlIsFedora > "39"; then +if rlIsFedora ">39"; then ALL_TUPLES="libvirtd:libvirtd:virtd_t \ virtinterfaced:virtinterfaced:virtinterfaced_t \ virtlockd:virtlockd:virtlogd_t \ @@ -86,7 +86,7 @@ rlJournalStart rlPhaseEnd rlPhaseStartTest "SELinux contexts and rules" - if rlIsFedora > "39"; then + if rlIsFedora ">39"; then rlSEMatchPathCon "/usr/sbin/virtinterfaced" "virtinterfaced_exec_t" rlSEMatchPathCon "/usr/sbin/virtlxcd" "virtd_lxc_exec_t" rlSEMatchPathCon "/usr/sbin/virtnetworkd" "virtnetworkd_exec_t" From 956f6ef06e55d6cb92006b216b388e5159e53022 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Mon, 16 Oct 2023 16:33:03 +0200 Subject: [PATCH 287/626] test copy-from,copy-to,reboot commands in systemd-machined test As pointed out in BZ#1900869, some of the machinectl commands still do not work as expected. As a result of manual testing, I added more policy rules to the testpolicy module which, hopefully, improves the situation. --- selinux-policy/systemd-machined-and-similar/runtest.sh | 7 +++++++ selinux-policy/systemd-machined-and-similar/testpolicy.cil | 5 ++++- 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/selinux-policy/systemd-machined-and-similar/runtest.sh b/selinux-policy/systemd-machined-and-similar/runtest.sh index 42416a7..9a4fa7b 100755 --- a/selinux-policy/systemd-machined-and-similar/runtest.sh +++ b/selinux-policy/systemd-machined-and-similar/runtest.sh @@ -107,6 +107,13 @@ rlJournalStart rlRun "machinectl list" rlRun "machinectl status test" rlWatchdog "machinectl login test" 20 + rlRun "rm -f /tmp/id" + rlRun "machinectl copy-to test /usr/bin/id /tmp/id" + rlRun "machinectl copy-from test /usr/bin/id /tmp/id" + rlRun "machinectl reboot test" + sleep 15 + rlRun "machinectl status test" + rlRun "machinectl kill test" rlRun "machinectl terminate test" rlRun "systemctl stop systemd-nspawn@test" # TODO: remove next 2 lines once the BZs are fixed diff --git a/selinux-policy/systemd-machined-and-similar/testpolicy.cil b/selinux-policy/systemd-machined-and-similar/testpolicy.cil index 9fa2ced..72b42c7 100644 --- a/selinux-policy/systemd-machined-and-similar/testpolicy.cil +++ b/selinux-policy/systemd-machined-and-similar/testpolicy.cil @@ -1,11 +1,14 @@ ( allow systemd_machined_t unconfined_service_t ( dir ( search ))) ( allow systemd_machined_t unconfined_service_t ( file ( getattr open read ioctl ))) ( allow systemd_machined_t unconfined_service_t ( lnk_file ( getattr read ))) -( allow systemd_machined_t systemd_machined_t ( cap_userns ( sys_ptrace sys_admin setgid setuid ))) +( allow systemd_machined_t systemd_machined_t ( cap_userns ( sys_ptrace sys_admin setgid setuid kill ))) ( allow systemd_machined_t tmpfs_t ( lnk_file ( getattr read ))) ( allow systemd_machined_t devpts_t ( chr_file ( open read write ioctl ))) ( allow systemd_machined_t tmpfs_t ( sock_file ( write ))) ( allow system_dbusd_t devpts_t ( chr_file ( read write ))) ( allow systemd_machined_t unconfined_service_t ( unix_stream_socket ( connectto ))) ( allow systemd_machined_t systemd_unit_file_t ( service ( stop ))) +( allow systemd_machined_t tmp_t ( file ( create getattr open write append ioctl setattr ))) +( allow systemd_machined_t tmpfs_t ( file ( create getattr open write append ioctl setattr ))) +( allow systemd_machined_t systemd_machined_t ( capability ( chown fowner fsetid ))) From af206491b2a6ceae9d8c7e593b2a3917b3629d5d Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 17 Oct 2023 11:34:41 +0200 Subject: [PATCH 288/626] test if fio utility can use io_uring:cmd on NVME devices A recent fio testing performed on machines which have NVME devices revealed that SELinux prevents the fio processes from using the cmd permission of the io_uring class. The TC reproduces the situation on such machines. In order to support the io_uring functionality of the fio utility, I believe that SELinux policy should allow this action. The TC looks for appropriate policy rules and file context patterns. The TC covers RHEL-11792. --- selinux-policy/anon_inode-and-similar/Makefile | 1 + selinux-policy/anon_inode-and-similar/PURPOSE | 2 +- selinux-policy/anon_inode-and-similar/main.fmf | 1 + selinux-policy/anon_inode-and-similar/runtest.sh | 7 ++++++- 4 files changed, 9 insertions(+), 2 deletions(-) diff --git a/selinux-policy/anon_inode-and-similar/Makefile b/selinux-policy/anon_inode-and-similar/Makefile index 416a2b6..d9db08b 100644 --- a/selinux-policy/anon_inode-and-similar/Makefile +++ b/selinux-policy/anon_inode-and-similar/Makefile @@ -67,6 +67,7 @@ $(METADATA): Makefile @echo "Bug: 2027660" >> $(METADATA) # RHEL-9 @echo "Bug: 2025714" >> $(METADATA) # Fedora 35 @echo "Bug: 2187745" >> $(METADATA) # RHEL-9 + @echo "Bug: RHEL-11792" >> $(METADATA) # RHEL-9 rhts-lint $(METADATA) diff --git a/selinux-policy/anon_inode-and-similar/PURPOSE b/selinux-policy/anon_inode-and-similar/PURPOSE index 7799186..3267a57 100644 --- a/selinux-policy/anon_inode-and-similar/PURPOSE +++ b/selinux-policy/anon_inode-and-similar/PURPOSE @@ -1,4 +1,4 @@ PURPOSE of /CoreOS/selinux-policy/Regression/anon_inode-and-similar Author: Amith Kumar -SELinux denials affect processes that deals with anon_inode tclass. +SELinux denials affect processes that deals with anon_inode and io_uring classes. diff --git a/selinux-policy/anon_inode-and-similar/main.fmf b/selinux-policy/anon_inode-and-similar/main.fmf index b40664b..c0f4965 100644 --- a/selinux-policy/anon_inode-and-similar/main.fmf +++ b/selinux-policy/anon_inode-and-similar/main.fmf @@ -33,6 +33,7 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2027660 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2025714 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2187745 + - verifies: https://issues.redhat.com/browse/RHEL-11792 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 diff --git a/selinux-policy/anon_inode-and-similar/runtest.sh b/selinux-policy/anon_inode-and-similar/runtest.sh index f3fdcaa..8d83518 100755 --- a/selinux-policy/anon_inode-and-similar/runtest.sh +++ b/selinux-policy/anon_inode-and-similar/runtest.sh @@ -69,7 +69,7 @@ rlJournalStart rlPhaseEnd rlPhaseStartTest "mmap on io_uring - bz#2025714 + bz#2187745" - if rlIsFedora '<=39'; then + if rlIsFedora '<=39' || rlIsRHEL 9 ; then rlSESearchRule "allow unconfined_t unconfined_t : anon_inode { map } [ ]" rlSESearchRule "allow svirt_t svirt_t : anon_inode { map } [ ]" rlSESearchRule "allow virtd_t virtd_t : anon_inode { map } [ ]" @@ -82,6 +82,11 @@ rlJournalStart rlRun "fio --filename=/root/pokus --iodepth=16 --rw=write --ioengine=io_uring --bs=16k --size=2G --numjobs=30 --runtime=100s --group_reporting=1 --name=mytest" 0-255 rlPhaseEnd + rlPhaseStartTest "RHEL-11792" + rlSEMatchPathCon "/dev/ng0n1" "fixed_disk_device_t" + rlSESearchRule "allow unconfined_t fixed_disk_device_t : io_uring { cmd } [ ]" + rlPhaseEnd + rlPhaseStartCleanup sleep 2 rlSECheckAVC From cb9ae062ac02b0bca42a21146255c7f2c9fc686b Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Wed, 18 Oct 2023 22:58:47 +0200 Subject: [PATCH 289/626] test if exim can create dirs under /var/spool/exim/input/ A recently filed customer report revealed that SELinux prevents the exim's sendmail program from creating new directories under the /var/spool/exim/input/ directory. The TC reproduces the situation. In order to support the whole functionality of exim (especially the split_spool_directory configuration option), I believe that SELinux policy should allow the action. The TC looks for appropriate policy rules and file context patterns. The TC covers RHEL-14110 and RHEL-14186. --- selinux-policy/exim-and-similar/Makefile | 8 +++++--- selinux-policy/exim-and-similar/main.fmf | 6 ++++-- selinux-policy/exim-and-similar/runtest.sh | 16 +++++++++++++++- 3 files changed, 24 insertions(+), 6 deletions(-) diff --git a/selinux-policy/exim-and-similar/Makefile b/selinux-policy/exim-and-similar/Makefile index fe0c535..2bbf5b0 100644 --- a/selinux-policy/exim-and-similar/Makefile +++ b/selinux-policy/exim-and-similar/Makefile @@ -1,7 +1,7 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # # Makefile of /CoreOS/selinux-policy/Regression/exim-and-similar -# Description: the service was running as initrc_t or init_t, now it is confined by SELinux +# Description: SELinux interferes with exim and related programs # Author: Milos Malik # # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ @@ -50,11 +50,11 @@ $(METADATA): Makefile @echo "Name: $(TEST)" >> $(METADATA) @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: the service was running as initrc_t or init_t, now it is confined by SELinux" >> $(METADATA) + @echo "Description: SELinux interferes with exim and related programs" >> $(METADATA) @echo "Type: Regression" >> $(METADATA) @echo "TestTime: 5m" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted /usr/sbin/service setools-console glib2 exim" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted /usr/sbin/service setools-console at exim" >> $(METADATA) @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @echo "License: GPLv2" >> $(METADATA) @@ -64,6 +64,8 @@ $(METADATA): Makefile @echo "Releases: -RHEL4" >> $(METADATA) @echo "Bug: 1025315" >> $(METADATA) # RHEL-6 @echo "Bug: 1444441" >> $(METADATA) # RHEL-7 + @echo "Bug: RHEL-14110" >> $(METADATA) # RHEL-9 + @echo "Bug: RHEL-14186" >> $(METADATA) # RHEL-8 rhts-lint $(METADATA) diff --git a/selinux-policy/exim-and-similar/main.fmf b/selinux-policy/exim-and-similar/main.fmf index a1e0788..f6a3948 100644 --- a/selinux-policy/exim-and-similar/main.fmf +++ b/selinux-policy/exim-and-similar/main.fmf @@ -1,4 +1,4 @@ -summary: the service was running as initrc_t or init_t, now it is confined by SELinux +summary: SELinux interferes with exim and related programs description: |+ SELinux interferes with exim and related programs. @@ -18,7 +18,7 @@ recommend: - selinux-policy-targeted - /usr/sbin/service - setools-console - - glib2 + - at - exim environment: AVC_ERROR: +no_avc_check @@ -37,6 +37,8 @@ tag: link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1025315 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1444441 + - verifies: https://issues.redhat.com/browse/RHEL-14110 + - verifies: https://issues.redhat.com/browse/RHEL-14186 adjust: - enabled: false when: distro == rhel-4, rhel-alt-7 diff --git a/selinux-policy/exim-and-similar/runtest.sh b/selinux-policy/exim-and-similar/runtest.sh index 7d080a5..a1067ac 100755 --- a/selinux-policy/exim-and-similar/runtest.sh +++ b/selinux-policy/exim-and-similar/runtest.sh @@ -3,7 +3,7 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # # runtest.sh of /CoreOS/selinux-policy/Regression/exim-and-similar -# Description: the service was running as initrc_t or init_t, now it is confined by SELinux +# Description: SELinux interferes with exim and related programs # Author: Milos Malik # # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ @@ -48,6 +48,7 @@ rlJournalStart rlServiceStop ${SERVICE_NAME} rlFileBackup /etc/shadow + rlFileBackup /etc/exim/exim.conf rlSESetEnforce rlSEStatus @@ -95,6 +96,19 @@ rlJournalStart rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd + rlPhaseStartTest "real scenario -- RHEL-14110 + RHEL-14186" + rlSEMatchPathCon "/var/spool/exim/input" "exim_spool_t" + rlSESearchRule "allow system_mail_t exim_spool_t : dir { create } [ ]" + rlRun "sed -i 's/^.*\(split_spool_directory\).*=.*$/\1 = true/' /etc/exim/exim.conf" + rlRun "service exim start" + rlRun "service atd start" + rlRun "echo '/usr/bin/id -Z' | at now" + sleep 15s + rlRun "ls -lZ /var/spool/exim/input" + rlRun "service atd stop" + rlRun "service exim stop" + rlPhaseEnd + rlPhaseStartCleanup sleep 2 rlSECheckAVC From c6da0b98189471c8dd911950a02edd95d529935e Mon Sep 17 00:00:00 2001 From: Amith Kumar Date: Wed, 25 Oct 2023 14:19:43 +0530 Subject: [PATCH 290/626] Identify conflicts during installation of dsp packages Add testcode to selinux-policy/install-uninstall-dsp-packages test suite to discover conflicts during third-party or dsp selinux package installations. The code installs-uninstalls relevant packages collected from all the available repos and checks for failures / AVC errors. Signed-off-by: Amith Kumar --- .../install-uninstall-dsp-packages/Makefile | 67 ++++++++ .../install-uninstall-dsp-packages/PURPOSE | 5 + .../install-uninstall-dsp-packages/main.fmf | 36 +++++ .../install-uninstall-dsp-packages/runtest.sh | 152 ++++++++++++++++++ 4 files changed, 260 insertions(+) create mode 100644 selinux-policy/install-uninstall-dsp-packages/Makefile create mode 100644 selinux-policy/install-uninstall-dsp-packages/PURPOSE create mode 100644 selinux-policy/install-uninstall-dsp-packages/main.fmf create mode 100755 selinux-policy/install-uninstall-dsp-packages/runtest.sh diff --git a/selinux-policy/install-uninstall-dsp-packages/Makefile b/selinux-policy/install-uninstall-dsp-packages/Makefile new file mode 100644 index 0000000..2ad8c5e --- /dev/null +++ b/selinux-policy/install-uninstall-dsp-packages/Makefile @@ -0,0 +1,67 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Sanity/install-uninstall-dsp-packages +# Description: Test and discover conflicts if any, during installation of +# third-party or DSP packages. +# Author: Amith Kumar +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2023 Red Hat, Inc. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Sanity/install-uninstall-dsp-packages +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + test -x runtest.sh || chmod a+x runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Amith Kumar " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: Install-uninstall dsp packages to discover conflicts" >> $(METADATA) + @echo "Type: Sanity" >> $(METADATA) + @echo "TestTime: 40m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL6 -RHELClient5 -RHELServer5 -RHEL7" >> $(METADATA) + + + rhts-lint $(METADATA) + diff --git a/selinux-policy/install-uninstall-dsp-packages/PURPOSE b/selinux-policy/install-uninstall-dsp-packages/PURPOSE new file mode 100644 index 0000000..f065acb --- /dev/null +++ b/selinux-policy/install-uninstall-dsp-packages/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Sanity/install-uninstall-dsp-packages +Author: Amith Kumar + +Test and discover conflicts if any, during installation of third-party or +DSP packages. diff --git a/selinux-policy/install-uninstall-dsp-packages/main.fmf b/selinux-policy/install-uninstall-dsp-packages/main.fmf new file mode 100644 index 0000000..6da6f00 --- /dev/null +++ b/selinux-policy/install-uninstall-dsp-packages/main.fmf @@ -0,0 +1,36 @@ +summary: Install-Uninstall third-party or dsp packages to discover conflicts. +description: |+ + Test and discover rpm package installaton conflicts if any, during installation + of third-party or DSP selinux packages. + +contact: Amith Kumar +component: + - selinux-policy +test: ./runtest.sh +framework: beakerlib +require: + - library(selinux-policy/common) +recommend: + - selinux-policy + - selinux-policy-targeted + - dnf +environment: + AVC_ERROR: +no_avc_check +duration: 40m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - TIPfail_Security + - rhel9_broken + - targeted +link: +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + continue: false +extra-nitrate: +extra-summary: /CoreOS/selinux-policy/Sanity/install-uninstall-dsp-packages +extra-task: /CoreOS/selinux-policy/Sanity/install-uninstall-dsp-packages diff --git a/selinux-policy/install-uninstall-dsp-packages/runtest.sh b/selinux-policy/install-uninstall-dsp-packages/runtest.sh new file mode 100755 index 0000000..dc763ae --- /dev/null +++ b/selinux-policy/install-uninstall-dsp-packages/runtest.sh @@ -0,0 +1,152 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Sanity/install-uninstall-dsp-packages +# Description: Test and discover conflicts if any, during installation of +# third-party or DSP packages. +# Author: Amith Kumar +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2023 Red Hat, Inc. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +SKIP_REMOVAL=${SKIP_REMOVAL:-""} +SKIP_INSTALL=${SKIP_INSTALL:-""} +INSTALL_ONLY=${INSTALL_ONLY:-""} + +# Function to create a report template for install test +function install_report() { +echo "" > pkglist.report +echo '@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@' >> pkglist.report +echo '@ LIST OF PACKAGES TO BE INSTALLED @' >> pkglist.report +echo '~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~' >> pkglist.report +cat install-pkgs >> pkglist.report +echo '~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~' >> pkglist.report +echo "" >> pkglist.report +echo '@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@' >> pkglist.report +echo '@ INSTALLATION : Test Report @' >> pkglist.report +echo '~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~' >> pkglist.report +} + +# Function to create a report template for uninstall test +function uninstall_report() { +echo '@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@' >> pkglist.report +echo '@ UNINSTALLATION : Test Report @' >> pkglist.report +echo '~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~' >> pkglist.report +} + +# Function to summarize the test report +function summary_report() { +echo '@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@' >> pkglist.report +echo '@ TEST SUMMARY @' >> pkglist.report +echo '~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~' >> pkglist.report +SEL=`cat install-pkgs | wc -l` +PASS1=`grep "installation : PASS" pkglist.report | wc -l` +FAIL1=`grep "installation : FAIL" pkglist.report | wc -l` +PASS2=`grep "removal : PASS" pkglist.report | wc -l` +FAIL2=`grep "removal : FAIL" pkglist.report | wc -l` +echo "Total no. of packages selected for installation : $SEL" >> pkglist.report +echo "Total no. of successful package installation : $PASS1" >> pkglist.report +echo "Total no. of failed package installation : $FAIL1" >> pkglist.report +echo "Total no. of successful package removal : $PASS2" >> pkglist.report +echo "Total no. of failed package removal : $FAIL2" >> pkglist.report +echo "" >> pkglist.report +if [ -f "Err_file" ]; then + echo "DETAILED ERROR LOG (IF ANY)" >> pkglist.report + echo '~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~' >> pkglist.report + cat Err_file >> pkglist.report +fi +} + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "Install and Uninstall test for dsp packages" + rlRun "dnf list *selinux* --enablerepo=\"*\" > install-list" + rlRun "sed -i '1,/Available Packages/d' install-list" + rlRun "sed -i '/beaker-tasks/d' install-list" + rlRun "awk '{print \$1}' install-list > pkgonlylist" + rlRun "grep -vE '(.src)' pkgonlylist | sort -u > install-pkgs" + rlRun "cp -f install-pkgs uninstall-pkgs" + rlRun "install_report" + # Following loop will read each package from file install-pkgs + # and will attempt to install it using dnf utility. Both + # successful and failed attempts will be reported and the + # report will be published in the end. + cat install-pkgs | while read line + do + if dnf -q -y install --enablerepo="*" $line + then + rlLog "$line installation : PASS" + echo "$line installation : PASS" >> pkglist.report + else + rlLog "$line installation : FAIL" + echo "$line installation : FAIL" >> pkglist.report + sed -i "/$line/d" uninstall-pkgs + echo "Installation Failed for : $line" >> Err_file + dnf -q -y install --enablerepo="*" $line 2>> Err_file + echo "" >> Err_file + fi + done + echo "" >> pkglist.report + rlRun "uninstall_report" + # Following loop will read each package from file install-pkgs + # and will attempt to un-install it using dnf utility. + cat uninstall-pkgs | while read line + do + if dnf -q -y remove $line + then + rlLog "$line removal : PASS" + echo "$line removal : PASS" >> pkglist.report + else + rlLog "$line removal : FAIL" + echo "$line removal : FAIL" >> pkglist.report + echo "Removal Failed for : $line" >> Err_file + dnf -q -y remove $line 2>> Err_file + echo "" >> Err_file + fi + done + echo "" >> pkglist.report + rlRun "summary_report" + rlAssertNotGrep "FAIL" pkglist.report + rlRun "cat pkglist.report" + rlPhaseEnd + + rlPhaseStartCleanup + if [ -f "Err_file" ]; then + rlRun "rm -f Err_file" + fi + rlRun "rm -f install-list pkgonlylist install-pkgs uninstall-pkgs pkglist.report" + rlSECheckAVC --ignore 'type=USER_AVC.*denied.* send_msg .*scontext=.*:unconfined_t:.*tcontext=.*:system_dbusd_t:.*tclass=dbus' \ + --ignore 'type=USER_AVC.* start .*:unconfined_t:.*:init_t:.*tclass=system' \ + --ignore 'type=USER_AVC.* start .*:unconfined_t:.*:init_var_run_t:.*tclass=service' + rlPhaseEnd +rlJournalPrintText +rlJournalEnd From d12a67259d3f94c219c890cf495da2222f5936a5 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 24 Oct 2023 15:30:32 +0200 Subject: [PATCH 291/626] add missing ids into tests When the `tmt test export` command is used on a test, a unique id is generated for the test and the id is added into the main.fmf file of the test. More information about these ids can be found at: * https://tmt.readthedocs.io/en/stable/spec/core.html#spec-core-id From now on, all tests in the selinux-policy directory will have their ids present. --- selinux-policy/ModemManager-and-similar/main.fmf | 1 + .../accounts-daemon-and-similar/main.fmf | 1 + selinux-policy/anon_inode-and-similar/main.fmf | 1 + selinux-policy/blueman-and-similar/main.fmf | 1 + selinux-policy/boinc-and-similar/main.fmf | 1 + .../main.fmf | 1 + .../bz733494-amanda-and-similar/main.fmf | 1 + selinux-policy/caddy-and-similar/main.fmf | 1 + selinux-policy/cockpit-ws-and-similar/main.fmf | 1 + selinux-policy/colord-and-similar/main.fmf | 1 + selinux-policy/cups-browsed-and-similar/main.fmf | 1 + selinux-policy/cups-pdf-and-similar/main.fmf | 1 + selinux-policy/dhclient-and-similar/main.fmf | 7 ++++--- selinux-policy/exim-and-similar/main.fmf | 1 + selinux-policy/fapolicyd-and-similar/main.fmf | 1 + .../fedora-third-party-and-similar/main.fmf | 3 ++- selinux-policy/getrlimit-permission/main.fmf | 1 + selinux-policy/hostapd-and-similar/main.fmf | 1 + selinux-policy/icecast-and-similar/main.fmf | 1 + selinux-policy/journalctl-and-similar/main.fmf | 1 + selinux-policy/kerberos-and-similar/main.fmf | 1 + selinux-policy/kernel-confined-exec/main.fmf | 1 + selinux-policy/ksm-and-similar/main.fmf | 1 + selinux-policy/ladvd/main.fmf | 1 + selinux-policy/lockdown-class/Makefile | 2 +- selinux-policy/lockdown-class/main.fmf | 14 ++++++++++++++ selinux-policy/nasd-and-similar/main.fmf | 1 + selinux-policy/nfsdcld-and-similar/main.fmf | 1 + selinux-policy/nvme-stas-and-similar/main.fmf | 1 + selinux-policy/opensmtpd-and-similar/main.fmf | 1 + selinux-policy/pam_limits-and-related/main.fmf | 1 + selinux-policy/pam_timestamp-and-related/main.fmf | 1 + selinux-policy/ping-and-similar/main.fmf | 1 + selinux-policy/policy-rpm-macros/main.fmf | 1 + selinux-policy/policykit-general/main.fmf | 1 + selinux-policy/rngd-and-similar/main.fmf | 1 + selinux-policy/rpc.idmapd-and-similar/main.fmf | 1 + selinux-policy/rpmdb-and-similar/main.fmf | 1 + .../rrdcached-service-and-related/main.fmf | 1 + selinux-policy/smbcontrol-and-similar/main.fmf | 1 + selinux-policy/stalld-and-similar/main.fmf | 1 + .../swap-file-and-systemd-access/main.fmf | 1 + selinux-policy/synce4l-and-similar/main.fmf | 1 + .../systemd-bootchart-and-similar/main.fmf | 1 + selinux-policy/systemd-creds/main.fmf | 1 + selinux-policy/systemd-homed/main.fmf | 1 + selinux-policy/systemd-localed/main.fmf | 3 ++- .../systemd-modules-load-and-similar/main.fmf | 1 + selinux-policy/systemd-notify-and-similar/main.fmf | 1 + selinux-policy/systemd-rfkill-and-similar/main.fmf | 1 + selinux-policy/systemd-run-and-similar/main.fmf | 1 + selinux-policy/systemd-sysctl-and-similar/main.fmf | 1 + .../systemd-timesyncd-and-similar/main.fmf | 1 + .../systemd-userdbd-and-similar/main.fmf | 1 + selinux-policy/targetd-and-similar/main.fmf | 1 + selinux-policy/thttpd-and-similar/main.fmf | 1 + selinux-policy/tlp-and-similar/main.fmf | 1 + .../usbguard-daemon-and-similar/main.fmf | 1 + selinux-policy/usbmuxd-and-similar/main.fmf | 1 + 59 files changed, 77 insertions(+), 6 deletions(-) diff --git a/selinux-policy/ModemManager-and-similar/main.fmf b/selinux-policy/ModemManager-and-similar/main.fmf index 557b9d5..45a18df 100644 --- a/selinux-policy/ModemManager-and-similar/main.fmf +++ b/selinux-policy/ModemManager-and-similar/main.fmf @@ -59,3 +59,4 @@ adjust: extra-nitrate: TC#0075515 extra-summary: /CoreOS/selinux-policy/Regression/ModemManager-and-similar extra-task: /CoreOS/selinux-policy/Regression/ModemManager-and-similar +id: 7caff9dc-87ff-4e55-ad78-32312f7f1c99 diff --git a/selinux-policy/accounts-daemon-and-similar/main.fmf b/selinux-policy/accounts-daemon-and-similar/main.fmf index 1590624..06ce98d 100644 --- a/selinux-policy/accounts-daemon-and-similar/main.fmf +++ b/selinux-policy/accounts-daemon-and-similar/main.fmf @@ -73,3 +73,4 @@ adjust: extra-nitrate: TC#0075208 extra-summary: /CoreOS/selinux-policy/Regression/accounts-daemon-and-similar extra-task: /CoreOS/selinux-policy/Regression/accounts-daemon-and-similar +id: 553e648e-a295-4739-8e36-12a4f67a903c diff --git a/selinux-policy/anon_inode-and-similar/main.fmf b/selinux-policy/anon_inode-and-similar/main.fmf index c0f4965..dcefdd9 100644 --- a/selinux-policy/anon_inode-and-similar/main.fmf +++ b/selinux-policy/anon_inode-and-similar/main.fmf @@ -41,3 +41,4 @@ adjust: extra-nitrate: TC#0612643 extra-summary: /CoreOS/selinux-policy/Regression/anon_inode-and-similar extra-task: /CoreOS/selinux-policy/Regression/anon_inode-and-similar +id: 4e70e1ec-d3ae-40df-aad6-dfc4a23bc081 diff --git a/selinux-policy/blueman-and-similar/main.fmf b/selinux-policy/blueman-and-similar/main.fmf index 722f8cc..85dd3bd 100644 --- a/selinux-policy/blueman-and-similar/main.fmf +++ b/selinux-policy/blueman-and-similar/main.fmf @@ -39,3 +39,4 @@ adjust: extra-nitrate: TC#0563638 extra-summary: /CoreOS/selinux-policy/Regression/blueman-and-similar extra-task: /CoreOS/selinux-policy/Regression/blueman-and-similar +id: 9466ffdd-be04-4b35-8e65-f866e23fcfad diff --git a/selinux-policy/boinc-and-similar/main.fmf b/selinux-policy/boinc-and-similar/main.fmf index f778d87..24cb118 100644 --- a/selinux-policy/boinc-and-similar/main.fmf +++ b/selinux-policy/boinc-and-similar/main.fmf @@ -45,3 +45,4 @@ adjust: extra-nitrate: TC#0563640 extra-summary: /CoreOS/selinux-policy/Regression/boinc-and-similar extra-task: /CoreOS/selinux-policy/Regression/boinc-and-similar +id: 024cde06-0e81-40fe-8901-e552f47f5ca4 diff --git a/selinux-policy/bz533007-unable-to-start-kdump-service/main.fmf b/selinux-policy/bz533007-unable-to-start-kdump-service/main.fmf index c604c09..eb81cce 100644 --- a/selinux-policy/bz533007-unable-to-start-kdump-service/main.fmf +++ b/selinux-policy/bz533007-unable-to-start-kdump-service/main.fmf @@ -79,3 +79,4 @@ adjust: extra-nitrate: TC#0057470 extra-summary: /CoreOS/selinux-policy/Regression/bz533007-unable-to-start-kdump-service extra-task: /CoreOS/selinux-policy/Regression/bz533007-unable-to-start-kdump-service +id: 99e91f23-6d4d-4f52-b867-8420eaa39e03 diff --git a/selinux-policy/bz733494-amanda-and-similar/main.fmf b/selinux-policy/bz733494-amanda-and-similar/main.fmf index 65e0a2e..e9f9505 100644 --- a/selinux-policy/bz733494-amanda-and-similar/main.fmf +++ b/selinux-policy/bz733494-amanda-and-similar/main.fmf @@ -57,3 +57,4 @@ adjust: extra-nitrate: TC#0114575 extra-summary: /CoreOS/selinux-policy/Regression/bz733494-amanda-and-similar extra-task: /CoreOS/selinux-policy/Regression/bz733494-amanda-and-similar +id: d3191af0-4b52-47b8-90bf-fa6fbf3edc47 diff --git a/selinux-policy/caddy-and-similar/main.fmf b/selinux-policy/caddy-and-similar/main.fmf index 9a19fbb..f942d28 100644 --- a/selinux-policy/caddy-and-similar/main.fmf +++ b/selinux-policy/caddy-and-similar/main.fmf @@ -33,3 +33,4 @@ link: extra-summary: /CoreOS/selinux-policy/Regression/caddy-and-similar extra-task: /CoreOS/selinux-policy/Regression/caddy-and-similar extra-nitrate: TC#0614303 +id: 31fd828a-6d5a-4977-af70-b751ec50366e diff --git a/selinux-policy/cockpit-ws-and-similar/main.fmf b/selinux-policy/cockpit-ws-and-similar/main.fmf index db8d927..056b8fa 100644 --- a/selinux-policy/cockpit-ws-and-similar/main.fmf +++ b/selinux-policy/cockpit-ws-and-similar/main.fmf @@ -62,3 +62,4 @@ adjust: extra-nitrate: TC#0419451 extra-summary: /CoreOS/selinux-policy/Regression/cockpit-ws-and-similar extra-task: /CoreOS/selinux-policy/Regression/cockpit-ws-and-similar +id: 80693544-1e8a-4200-9edd-c3e766d1e433 diff --git a/selinux-policy/colord-and-similar/main.fmf b/selinux-policy/colord-and-similar/main.fmf index 36914c4..559be9e 100644 --- a/selinux-policy/colord-and-similar/main.fmf +++ b/selinux-policy/colord-and-similar/main.fmf @@ -55,3 +55,4 @@ adjust: extra-nitrate: TC#0276310 extra-summary: /CoreOS/selinux-policy/Regression/colord-and-similar extra-task: /CoreOS/selinux-policy/Regression/colord-and-similar +id: c0168fe1-5628-4c40-ba49-f6939ce96d1b diff --git a/selinux-policy/cups-browsed-and-similar/main.fmf b/selinux-policy/cups-browsed-and-similar/main.fmf index 97d6169..f913a2a 100644 --- a/selinux-policy/cups-browsed-and-similar/main.fmf +++ b/selinux-policy/cups-browsed-and-similar/main.fmf @@ -46,3 +46,4 @@ adjust: extra-nitrate: TC#0300676 extra-summary: /CoreOS/selinux-policy/Regression/cups-browsed-and-similar extra-task: /CoreOS/selinux-policy/Regression/cups-browsed-and-similar +id: 089ae8a5-999e-415e-bf84-eaa8a77b551d diff --git a/selinux-policy/cups-pdf-and-similar/main.fmf b/selinux-policy/cups-pdf-and-similar/main.fmf index a9b31e7..bf6cf21 100644 --- a/selinux-policy/cups-pdf-and-similar/main.fmf +++ b/selinux-policy/cups-pdf-and-similar/main.fmf @@ -50,3 +50,4 @@ adjust: extra-nitrate: TC#0607292 extra-summary: /CoreOS/selinux-policy/Regression/cups-pdf-and-similar extra-task: /CoreOS/selinux-policy/Regression/cups-pdf-and-similar +id: aa317943-d9be-4434-9731-a43601d39c00 diff --git a/selinux-policy/dhclient-and-similar/main.fmf b/selinux-policy/dhclient-and-similar/main.fmf index e3cdb8f..a956d9f 100644 --- a/selinux-policy/dhclient-and-similar/main.fmf +++ b/selinux-policy/dhclient-and-similar/main.fmf @@ -27,9 +27,10 @@ link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2093709 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2094155 adjust: -- when: trigger == build - enabled: false - because: the test may mess up the IP address + - when: trigger == build + enabled: false + because: the test may mess up the IP address extra-summary: /CoreOS/selinux-policy/Regression/dhclient-and-similar extra-task: /CoreOS/selinux-policy/Regression/dhclient-and-similar extra-nitrate: TC#0613884 +id: bce71943-38b6-428b-af69-20b9e6a60708 diff --git a/selinux-policy/exim-and-similar/main.fmf b/selinux-policy/exim-and-similar/main.fmf index f6a3948..6a63f6d 100644 --- a/selinux-policy/exim-and-similar/main.fmf +++ b/selinux-policy/exim-and-similar/main.fmf @@ -49,3 +49,4 @@ adjust: extra-nitrate: TC#0057402 extra-summary: /CoreOS/selinux-policy/Regression/exim-and-similar extra-task: /CoreOS/selinux-policy/Regression/exim-and-similar +id: 4b7d4e3b-8ab3-4cab-b984-13be2a78252f diff --git a/selinux-policy/fapolicyd-and-similar/main.fmf b/selinux-policy/fapolicyd-and-similar/main.fmf index 64bc4d9..39a2406 100644 --- a/selinux-policy/fapolicyd-and-similar/main.fmf +++ b/selinux-policy/fapolicyd-and-similar/main.fmf @@ -42,3 +42,4 @@ adjust: extra-nitrate: TC#0608224 extra-summary: /CoreOS/selinux-policy/Regression/fapolicyd-and-similar extra-task: /CoreOS/selinux-policy/Regression/fapolicyd-and-similar +id: b489ccc7-3f8e-452d-b46f-37dcc6d1a64d diff --git a/selinux-policy/fedora-third-party-and-similar/main.fmf b/selinux-policy/fedora-third-party-and-similar/main.fmf index f44e863..580deeb 100644 --- a/selinux-policy/fedora-third-party-and-similar/main.fmf +++ b/selinux-policy/fedora-third-party-and-similar/main.fmf @@ -42,4 +42,5 @@ adjust: continue: false extra-summary: /CoreOS/selinux-policy/Regression/fedora-third-party-and-similar extra-task: /CoreOS/selinux-policy/Regression/fedora-third-party-and-similar - +extra-nitrate: TC#0614304 +id: 98743019-2a5a-48c2-9be6-7b8caa3add4d diff --git a/selinux-policy/getrlimit-permission/main.fmf b/selinux-policy/getrlimit-permission/main.fmf index a21832a..ac1ebc2 100644 --- a/selinux-policy/getrlimit-permission/main.fmf +++ b/selinux-policy/getrlimit-permission/main.fmf @@ -41,3 +41,4 @@ adjust: extra-nitrate: TC#0574397 extra-summary: /CoreOS/selinux-policy/Sanity/getrlimit-permission extra-task: /CoreOS/selinux-policy/Sanity/getrlimit-permission +id: d266c52f-08b3-4ab6-80bb-c41370e9e8b2 diff --git a/selinux-policy/hostapd-and-similar/main.fmf b/selinux-policy/hostapd-and-similar/main.fmf index 6701f36..c36293c 100644 --- a/selinux-policy/hostapd-and-similar/main.fmf +++ b/selinux-policy/hostapd-and-similar/main.fmf @@ -55,3 +55,4 @@ adjust: extra-nitrate: TC#0602539 extra-summary: /CoreOS/selinux-policy/Regression/hostapd-and-similar extra-task: /CoreOS/selinux-policy/Regression/hostapd-and-similar +id: 83fb3ff1-3bd6-4400-a677-fe38f712d966 diff --git a/selinux-policy/icecast-and-similar/main.fmf b/selinux-policy/icecast-and-similar/main.fmf index f2a6060..d00767c 100644 --- a/selinux-policy/icecast-and-similar/main.fmf +++ b/selinux-policy/icecast-and-similar/main.fmf @@ -43,3 +43,4 @@ adjust: extra-nitrate: TC#0388472 extra-summary: /CoreOS/selinux-policy/Regression/icecast-and-similar extra-task: /CoreOS/selinux-policy/Regression/icecast-and-similar +id: 59e31ab5-6779-410c-8acb-97380a6843cd diff --git a/selinux-policy/journalctl-and-similar/main.fmf b/selinux-policy/journalctl-and-similar/main.fmf index f15cc43..589c483 100644 --- a/selinux-policy/journalctl-and-similar/main.fmf +++ b/selinux-policy/journalctl-and-similar/main.fmf @@ -59,3 +59,4 @@ adjust: extra-nitrate: TC#0597884 extra-summary: /CoreOS/selinux-policy/Regression/journalctl-and-similar extra-task: /CoreOS/selinux-policy/Regression/journalctl-and-similar +id: f56e6a4a-9f30-47ad-bf6c-cc6a388d82d9 diff --git a/selinux-policy/kerberos-and-similar/main.fmf b/selinux-policy/kerberos-and-similar/main.fmf index d51db70..dcecfda 100644 --- a/selinux-policy/kerberos-and-similar/main.fmf +++ b/selinux-policy/kerberos-and-similar/main.fmf @@ -59,3 +59,4 @@ adjust: extra-nitrate: TC#0230498 extra-summary: /CoreOS/selinux-policy/Regression/kerberos-and-similar extra-task: /CoreOS/selinux-policy/Regression/kerberos-and-similar +id: 74c9284d-5001-4270-838b-8af50422631c diff --git a/selinux-policy/kernel-confined-exec/main.fmf b/selinux-policy/kernel-confined-exec/main.fmf index fb7cd8e..a14cf01 100644 --- a/selinux-policy/kernel-confined-exec/main.fmf +++ b/selinux-policy/kernel-confined-exec/main.fmf @@ -27,3 +27,4 @@ adjust: link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2068579 extra-nitrate: TC#0614676 +id: 4400999a-aa60-4522-b0f7-d7b0656110a3 diff --git a/selinux-policy/ksm-and-similar/main.fmf b/selinux-policy/ksm-and-similar/main.fmf index 64fcdfe..5c6e492 100644 --- a/selinux-policy/ksm-and-similar/main.fmf +++ b/selinux-policy/ksm-and-similar/main.fmf @@ -42,3 +42,4 @@ adjust: extra-nitrate: TC#0613684 extra-summary: /CoreOS/selinux-policy/Regression/ksm-and-similar extra-task: /CoreOS/selinux-policy/Regression/ksm-and-similar +id: 712ce354-8733-4938-bfba-3801432e5278 diff --git a/selinux-policy/ladvd/main.fmf b/selinux-policy/ladvd/main.fmf index e1c83a9..b691e9b 100644 --- a/selinux-policy/ladvd/main.fmf +++ b/selinux-policy/ladvd/main.fmf @@ -35,3 +35,4 @@ adjust: extra-summary: /CoreOS/selinux-policy/Regression/ladvd extra-task: /CoreOS/selinux-policy/Regression/ladvd extra-nitrate: TC#0614606 +id: db945166-3e6e-41cc-a76d-9e4f6e4b641c diff --git a/selinux-policy/lockdown-class/Makefile b/selinux-policy/lockdown-class/Makefile index 135635d..549137c 100644 --- a/selinux-policy/lockdown-class/Makefile +++ b/selinux-policy/lockdown-class/Makefile @@ -61,7 +61,7 @@ $(METADATA): Makefile @echo "License: GPLv2" >> $(METADATA) @echo "Confidential: no" >> $(METADATA) @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA) @echo "Bug: 1915184" >> $(METADATA) # Fedora rawhide @echo "Bug: 1929332" >> $(METADATA) # RHEL-9 @echo "Bug: 1933134" >> $(METADATA) # RHEL-9 diff --git a/selinux-policy/lockdown-class/main.fmf b/selinux-policy/lockdown-class/main.fmf index 2ea12ab..dbec951 100644 --- a/selinux-policy/lockdown-class/main.fmf +++ b/selinux-policy/lockdown-class/main.fmf @@ -18,9 +18,23 @@ recommend: environment: AVC_ERROR: +no_avc_check duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - NoRHEL8 + - targeted link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1915184 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1929332 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1933134 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7, rhel-8 + because: the lockdown class is not defined there extra-summary: /CoreOS/selinux-policy/Sanity/lockdown-class extra-task: /CoreOS/selinux-policy/Sanity/lockdown-class +extra-nitrate: TC#0615920 +id: 5ef38ca9-81bf-4051-9c9d-201ffccd351f diff --git a/selinux-policy/nasd-and-similar/main.fmf b/selinux-policy/nasd-and-similar/main.fmf index 859c0af..9fe11ba 100644 --- a/selinux-policy/nasd-and-similar/main.fmf +++ b/selinux-policy/nasd-and-similar/main.fmf @@ -28,3 +28,4 @@ adjust: extra-summary: /CoreOS/selinux-policy/Regression/nasd-and-similar extra-task: /CoreOS/selinux-policy/Regression/nasd-and-similar extra-nitrate: TC#0614607 +id: ad784a9d-5cf4-4aac-b583-68458860acd9 diff --git a/selinux-policy/nfsdcld-and-similar/main.fmf b/selinux-policy/nfsdcld-and-similar/main.fmf index bdad94b..edb715c 100644 --- a/selinux-policy/nfsdcld-and-similar/main.fmf +++ b/selinux-policy/nfsdcld-and-similar/main.fmf @@ -37,3 +37,4 @@ adjust: extra-nitrate: TC#0608104 extra-summary: /CoreOS/selinux-policy/Regression/nfsdcld-and-similar extra-task: /CoreOS/selinux-policy/Regression/nfsdcld-and-similar +id: c92c4cfe-bb32-411b-a623-fe5c7feee13b diff --git a/selinux-policy/nvme-stas-and-similar/main.fmf b/selinux-policy/nvme-stas-and-similar/main.fmf index decc044..fc7fff1 100644 --- a/selinux-policy/nvme-stas-and-similar/main.fmf +++ b/selinux-policy/nvme-stas-and-similar/main.fmf @@ -40,3 +40,4 @@ adjust: extra-summary: /CoreOS/selinux-policy/Regression/nvme-stas-and-similar extra-task: /CoreOS/selinux-policy/Regression/nvme-stas-and-similar extra-nitrate: TC#0614621 +id: 6a439688-11aa-4fbe-be69-666d5245e4e0 diff --git a/selinux-policy/opensmtpd-and-similar/main.fmf b/selinux-policy/opensmtpd-and-similar/main.fmf index 2d8fe9e..064e88a 100644 --- a/selinux-policy/opensmtpd-and-similar/main.fmf +++ b/selinux-policy/opensmtpd-and-similar/main.fmf @@ -36,3 +36,4 @@ adjust: extra-summary: /CoreOS/selinux-policy/Regression/opensmtpd-and-similar extra-task: /CoreOS/selinux-policy/Regression/opensmtpd-and-similar extra-nitrate: TC#0615352 +id: cb0ae69e-3193-450f-901f-4159048d1180 diff --git a/selinux-policy/pam_limits-and-related/main.fmf b/selinux-policy/pam_limits-and-related/main.fmf index 9e10d36..aa244d1 100644 --- a/selinux-policy/pam_limits-and-related/main.fmf +++ b/selinux-policy/pam_limits-and-related/main.fmf @@ -45,3 +45,4 @@ adjust: extra-nitrate: TC#0612789 extra-summary: /CoreOS/selinux-policy/Regression/pam_limits-and-related extra-task: /CoreOS/selinux-policy/Regression/pam_limits-and-related +id: 4702e6e7-8340-475d-9b97-af2779bf2a8a diff --git a/selinux-policy/pam_timestamp-and-related/main.fmf b/selinux-policy/pam_timestamp-and-related/main.fmf index 12696ae..28e8dfe 100644 --- a/selinux-policy/pam_timestamp-and-related/main.fmf +++ b/selinux-policy/pam_timestamp-and-related/main.fmf @@ -57,3 +57,4 @@ adjust: extra-nitrate: TC#0606210 extra-summary: /CoreOS/selinux-policy/Regression/pam_timestamp-and-related extra-task: /CoreOS/selinux-policy/Regression/pam_timestamp-and-related +id: 8d9cd03c-0cce-4527-89ec-dab84f651e26 diff --git a/selinux-policy/ping-and-similar/main.fmf b/selinux-policy/ping-and-similar/main.fmf index 85bc61f..ba31ab4 100644 --- a/selinux-policy/ping-and-similar/main.fmf +++ b/selinux-policy/ping-and-similar/main.fmf @@ -43,3 +43,4 @@ adjust: extra-nitrate: TC#0564077 extra-summary: /CoreOS/selinux-policy/Regression/ping-and-similar extra-task: /CoreOS/selinux-policy/Regression/ping-and-similar +id: 993738bc-3b9a-4f3d-9617-fb07484db1cb diff --git a/selinux-policy/policy-rpm-macros/main.fmf b/selinux-policy/policy-rpm-macros/main.fmf index 19fdd8e..44f35ba 100644 --- a/selinux-policy/policy-rpm-macros/main.fmf +++ b/selinux-policy/policy-rpm-macros/main.fmf @@ -40,3 +40,4 @@ adjust: extra-nitrate: TC#0546229 extra-summary: /CoreOS/selinux-policy/Sanity/policy-rpm-macros extra-task: /CoreOS/selinux-policy/Sanity/policy-rpm-macros +id: c88dfda5-0d87-4538-94d3-45691e3bda33 diff --git a/selinux-policy/policykit-general/main.fmf b/selinux-policy/policykit-general/main.fmf index 4b69496..655a4ab 100644 --- a/selinux-policy/policykit-general/main.fmf +++ b/selinux-policy/policykit-general/main.fmf @@ -58,3 +58,4 @@ adjust: extra-nitrate: TC#0267065 extra-summary: /CoreOS/selinux-policy/Regression/policykit-general extra-task: /CoreOS/selinux-policy/Regression/policykit-general +id: f021b6cd-fc34-4335-b7e0-ed0254ed333e diff --git a/selinux-policy/rngd-and-similar/main.fmf b/selinux-policy/rngd-and-similar/main.fmf index b599860..bb3b859 100644 --- a/selinux-policy/rngd-and-similar/main.fmf +++ b/selinux-policy/rngd-and-similar/main.fmf @@ -73,3 +73,4 @@ adjust: extra-nitrate: TC#0300433 extra-summary: /CoreOS/selinux-policy/Regression/rngd-and-similar extra-task: /CoreOS/selinux-policy/Regression/rngd-and-similar +id: 604042eb-81de-4ede-808c-8e6cc38cdd15 diff --git a/selinux-policy/rpc.idmapd-and-similar/main.fmf b/selinux-policy/rpc.idmapd-and-similar/main.fmf index fd31a86..287ab2a 100644 --- a/selinux-policy/rpc.idmapd-and-similar/main.fmf +++ b/selinux-policy/rpc.idmapd-and-similar/main.fmf @@ -38,3 +38,4 @@ adjust: extra-summary: /CoreOS/selinux-policy/Regression/rpc.idmapd-and-similar extra-task: /CoreOS/selinux-policy/Regression/rpc.idmapd-and-similar extra-nitrate: TC#0614824 +id: d96b0115-5a88-4aaf-b26b-1572a9c816b6 diff --git a/selinux-policy/rpmdb-and-similar/main.fmf b/selinux-policy/rpmdb-and-similar/main.fmf index 713ea2d..401682a 100644 --- a/selinux-policy/rpmdb-and-similar/main.fmf +++ b/selinux-policy/rpmdb-and-similar/main.fmf @@ -40,3 +40,4 @@ adjust: extra-nitrate: TC#0609732 extra-summary: /CoreOS/selinux-policy/Regression/rpmdb-and-similar extra-task: /CoreOS/selinux-policy/Regression/rpmdb-and-similar +id: 7444ab1f-9138-4ac1-b92c-825adc7a5436 diff --git a/selinux-policy/rrdcached-service-and-related/main.fmf b/selinux-policy/rrdcached-service-and-related/main.fmf index d46b6a1..d5d9fff 100644 --- a/selinux-policy/rrdcached-service-and-related/main.fmf +++ b/selinux-policy/rrdcached-service-and-related/main.fmf @@ -38,3 +38,4 @@ adjust: extra-nitrate: TC#0604406 extra-summary: /CoreOS/selinux-policy/Regression/rrdcached-service-and-related extra-task: /CoreOS/selinux-policy/Regression/rrdcached-service-and-related +id: da5dd8fd-2a99-4a50-97bc-2c3b3ac16747 diff --git a/selinux-policy/smbcontrol-and-similar/main.fmf b/selinux-policy/smbcontrol-and-similar/main.fmf index 9be8abc..fa5fb41 100644 --- a/selinux-policy/smbcontrol-and-similar/main.fmf +++ b/selinux-policy/smbcontrol-and-similar/main.fmf @@ -48,3 +48,4 @@ adjust: extra-nitrate: TC#0522115 extra-summary: /CoreOS/selinux-policy/Regression/smbcontrol-and-similar extra-task: /CoreOS/selinux-policy/Regression/smbcontrol-and-similar +id: c0f43867-cee7-47ae-869f-9247d2ba9dfb diff --git a/selinux-policy/stalld-and-similar/main.fmf b/selinux-policy/stalld-and-similar/main.fmf index e641a86..863d8aa 100644 --- a/selinux-policy/stalld-and-similar/main.fmf +++ b/selinux-policy/stalld-and-similar/main.fmf @@ -46,3 +46,4 @@ adjust: extra-nitrate: TC#0613202 extra-summary: /CoreOS/selinux-policy/Regression/stalld-and-similar extra-task: /CoreOS/selinux-policy/Regression/stalld-and-similar +id: 19ce8a2d-bea8-45d8-a9d1-f46612e94f34 diff --git a/selinux-policy/swap-file-and-systemd-access/main.fmf b/selinux-policy/swap-file-and-systemd-access/main.fmf index 266f814..63fe4f2 100644 --- a/selinux-policy/swap-file-and-systemd-access/main.fmf +++ b/selinux-policy/swap-file-and-systemd-access/main.fmf @@ -47,3 +47,4 @@ adjust: extra-nitrate: TC#0605834 extra-summary: /CoreOS/selinux-policy/Regression/swap-file-and-systemd-access extra-task: /CoreOS/selinux-policy/Regression/swap-file-and-systemd-access +id: 00f29f1a-3bbb-4775-84b9-c7d524ea1b6b diff --git a/selinux-policy/synce4l-and-similar/main.fmf b/selinux-policy/synce4l-and-similar/main.fmf index f1b2b69..440ca48 100644 --- a/selinux-policy/synce4l-and-similar/main.fmf +++ b/selinux-policy/synce4l-and-similar/main.fmf @@ -39,3 +39,4 @@ adjust: extra-summary: /CoreOS/selinux-policy/Regression/synce4l-and-similar extra-task: /CoreOS/selinux-policy/Regression/synce4l-and-similar extra-nitrate: TC#0614832 +id: f8bc6347-fce8-458d-b0e3-376cf0c718da diff --git a/selinux-policy/systemd-bootchart-and-similar/main.fmf b/selinux-policy/systemd-bootchart-and-similar/main.fmf index ca151c8..868c1da 100644 --- a/selinux-policy/systemd-bootchart-and-similar/main.fmf +++ b/selinux-policy/systemd-bootchart-and-similar/main.fmf @@ -36,3 +36,4 @@ adjust: extra-nitrate: TC#0608092 extra-summary: /CoreOS/selinux-policy/Regression/systemd-bootchart-and-similar extra-task: /CoreOS/selinux-policy/Regression/systemd-bootchart-and-similar +id: 63b5a536-231a-44f8-931a-24d737c86359 diff --git a/selinux-policy/systemd-creds/main.fmf b/selinux-policy/systemd-creds/main.fmf index 65b74a2..ef77498 100644 --- a/selinux-policy/systemd-creds/main.fmf +++ b/selinux-policy/systemd-creds/main.fmf @@ -35,3 +35,4 @@ link: extra-nitrate: TC#0613921 extra-summary: /CoreOS/selinux-policy/Regression/systemd-creds extra-task: /CoreOS/selinux-policy/Regression/systemd-creds +id: 01fe9246-a9bf-4424-8c76-db4f214ca5a7 diff --git a/selinux-policy/systemd-homed/main.fmf b/selinux-policy/systemd-homed/main.fmf index 3af3331..1df6fe0 100644 --- a/selinux-policy/systemd-homed/main.fmf +++ b/selinux-policy/systemd-homed/main.fmf @@ -27,3 +27,4 @@ adjust: extra-summary: /CoreOS/selinux-policy/Regression/systemd-homed extra-task: /CoreOS/selinux-policy/Regression/systemd-homed extra-nitrate: TC#0614608 +id: 880ecade-0976-4303-a521-aead43e7f8c7 diff --git a/selinux-policy/systemd-localed/main.fmf b/selinux-policy/systemd-localed/main.fmf index 7049593..151a009 100644 --- a/selinux-policy/systemd-localed/main.fmf +++ b/selinux-policy/systemd-localed/main.fmf @@ -32,4 +32,5 @@ adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 continue: false - +extra-nitrate: TC#0615919 +id: c61c5a74-f9d6-4d1f-b1cc-a7a25b0f3ec7 diff --git a/selinux-policy/systemd-modules-load-and-similar/main.fmf b/selinux-policy/systemd-modules-load-and-similar/main.fmf index 8205301..feb4149 100644 --- a/selinux-policy/systemd-modules-load-and-similar/main.fmf +++ b/selinux-policy/systemd-modules-load-and-similar/main.fmf @@ -61,3 +61,4 @@ adjust: extra-nitrate: TC#0607299 extra-summary: /CoreOS/selinux-policy/Regression/systemd-modules-load-and-similar extra-task: /CoreOS/selinux-policy/Regression/systemd-modules-load-and-similar +id: d8407e18-66fb-417e-843e-72fb040fb03e diff --git a/selinux-policy/systemd-notify-and-similar/main.fmf b/selinux-policy/systemd-notify-and-similar/main.fmf index c587e53..70183bc 100644 --- a/selinux-policy/systemd-notify-and-similar/main.fmf +++ b/selinux-policy/systemd-notify-and-similar/main.fmf @@ -40,3 +40,4 @@ adjust: extra-summary: /CoreOS/selinux-policy/Regression/systemd-notify-and-similar extra-task: /CoreOS/selinux-policy/Regression/systemd-notify-and-similar extra-nitrate: TC#0613581 +id: df53f93f-8f04-4575-940e-30c243d47d2d diff --git a/selinux-policy/systemd-rfkill-and-similar/main.fmf b/selinux-policy/systemd-rfkill-and-similar/main.fmf index 827d38a..8e84dc9 100644 --- a/selinux-policy/systemd-rfkill-and-similar/main.fmf +++ b/selinux-policy/systemd-rfkill-and-similar/main.fmf @@ -53,3 +53,4 @@ adjust: extra-nitrate: TC#0606118 extra-summary: /CoreOS/selinux-policy/Regression/systemd-rfkill-and-similar extra-task: /CoreOS/selinux-policy/Regression/systemd-rfkill-and-similar +id: e01aaa07-2437-45d9-b224-5c1d162caec3 diff --git a/selinux-policy/systemd-run-and-similar/main.fmf b/selinux-policy/systemd-run-and-similar/main.fmf index 0201f70..6754cf4 100644 --- a/selinux-policy/systemd-run-and-similar/main.fmf +++ b/selinux-policy/systemd-run-and-similar/main.fmf @@ -43,3 +43,4 @@ adjust: extra-summary: /CoreOS/selinux-policy/Regression/systemd-run-and-similar extra-task: /CoreOS/selinux-policy/Regression/systemd-run-and-similar extra-nitrate: TC#0613618 +id: db391b34-07e9-4514-8b8d-aa8ada185e26 diff --git a/selinux-policy/systemd-sysctl-and-similar/main.fmf b/selinux-policy/systemd-sysctl-and-similar/main.fmf index 1f04ab9..6ae3010 100644 --- a/selinux-policy/systemd-sysctl-and-similar/main.fmf +++ b/selinux-policy/systemd-sysctl-and-similar/main.fmf @@ -36,3 +36,4 @@ adjust: extra-nitrate: TC#0613033 extra-summary: /CoreOS/selinux-policy/Regression/systemd-sysctl-and-similar extra-task: /CoreOS/selinux-policy/Regression/systemd-sysctl-and-similar +id: 11114547-d1b5-47c1-a3ac-2a3729a87b1c diff --git a/selinux-policy/systemd-timesyncd-and-similar/main.fmf b/selinux-policy/systemd-timesyncd-and-similar/main.fmf index 9f69db6..c2976f2 100644 --- a/selinux-policy/systemd-timesyncd-and-similar/main.fmf +++ b/selinux-policy/systemd-timesyncd-and-similar/main.fmf @@ -59,3 +59,4 @@ adjust: extra-nitrate: TC#0606395 extra-summary: /CoreOS/selinux-policy/Regression/systemd-timesyncd-and-similar extra-task: /CoreOS/selinux-policy/Regression/systemd-timesyncd-and-similar +id: 2cca4aec-eac2-4547-91d0-979541b04f5b diff --git a/selinux-policy/systemd-userdbd-and-similar/main.fmf b/selinux-policy/systemd-userdbd-and-similar/main.fmf index 7c41ff7..0764213 100644 --- a/selinux-policy/systemd-userdbd-and-similar/main.fmf +++ b/selinux-policy/systemd-userdbd-and-similar/main.fmf @@ -45,3 +45,4 @@ adjust: extra-nitrate: TC#0606124 extra-summary: /CoreOS/selinux-policy/Regression/systemd-userdbd-and-similar extra-task: /CoreOS/selinux-policy/Regression/systemd-userdbd-and-similar +id: 0e50b61f-a399-47d9-b9f3-dd602e8cd88a diff --git a/selinux-policy/targetd-and-similar/main.fmf b/selinux-policy/targetd-and-similar/main.fmf index b4f15f5..e4b319d 100644 --- a/selinux-policy/targetd-and-similar/main.fmf +++ b/selinux-policy/targetd-and-similar/main.fmf @@ -53,3 +53,4 @@ adjust: extra-nitrate: TC#0337221 extra-summary: /CoreOS/selinux-policy/Regression/targetd-and-similar extra-task: /CoreOS/selinux-policy/Regression/targetd-and-similar +id: 5fcb6b1a-15d3-4627-95a5-62a49ba2d7e5 diff --git a/selinux-policy/thttpd-and-similar/main.fmf b/selinux-policy/thttpd-and-similar/main.fmf index bbc4973..375dba5 100644 --- a/selinux-policy/thttpd-and-similar/main.fmf +++ b/selinux-policy/thttpd-and-similar/main.fmf @@ -46,3 +46,4 @@ adjust: extra-nitrate: TC#0340646 extra-summary: /CoreOS/selinux-policy/Regression/thttpd-and-similar extra-task: /CoreOS/selinux-policy/Regression/thttpd-and-similar +id: dc6bfb6d-cfe5-4f75-87a4-984aa6c8591b diff --git a/selinux-policy/tlp-and-similar/main.fmf b/selinux-policy/tlp-and-similar/main.fmf index cb335dd..4dca1a4 100644 --- a/selinux-policy/tlp-and-similar/main.fmf +++ b/selinux-policy/tlp-and-similar/main.fmf @@ -42,3 +42,4 @@ adjust: extra-nitrate: TC#0569976 extra-summary: /CoreOS/selinux-policy/Regression/tlp-and-similar extra-task: /CoreOS/selinux-policy/Regression/tlp-and-similar +id: a467ae20-527e-49c7-a726-fa3a32887a54 diff --git a/selinux-policy/usbguard-daemon-and-similar/main.fmf b/selinux-policy/usbguard-daemon-and-similar/main.fmf index 05ea354..4334a5f 100644 --- a/selinux-policy/usbguard-daemon-and-similar/main.fmf +++ b/selinux-policy/usbguard-daemon-and-similar/main.fmf @@ -45,3 +45,4 @@ adjust: extra-nitrate: TC#0606079 extra-summary: /CoreOS/selinux-policy/Regression/usbguard-daemon-and-similar extra-task: /CoreOS/selinux-policy/Regression/usbguard-daemon-and-similar +id: a551a723-5ba8-43c9-939b-1d18d4cc2153 diff --git a/selinux-policy/usbmuxd-and-similar/main.fmf b/selinux-policy/usbmuxd-and-similar/main.fmf index 6374d4c..d32863b 100644 --- a/selinux-policy/usbmuxd-and-similar/main.fmf +++ b/selinux-policy/usbmuxd-and-similar/main.fmf @@ -51,3 +51,4 @@ adjust: extra-nitrate: TC#0300434 extra-summary: /CoreOS/selinux-policy/Regression/usbmuxd-and-similar extra-task: /CoreOS/selinux-policy/Regression/usbmuxd-and-similar +id: 2e39eebe-4456-4b06-90c0-1d2fd4e931a7 From 8ddb24101cdc6e08eb4b945927c72152e968d610 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 10 Oct 2023 13:35:39 +0200 Subject: [PATCH 292/626] test if spamd can search the /var/lib/snapd directory A recently filed BZ report revealed that SELinux prevents the spamd processes from searching (syscall = newfstatat) the /var/lib/snapd directory when the snapd package is installed. The TC reproduces the situation. Because the spamassassin service logs indicate that the spamd functions are not affected by the denied access, I believe that SELinux policy should dontaudit the action. The TC looks for appropriate policy rules and file context patterns. The TC covers BZ#2207725. --- selinux-policy/snapd-and-similar/Makefile | 68 ++++++++++++++++ selinux-policy/snapd-and-similar/PURPOSE | 5 ++ selinux-policy/snapd-and-similar/main.fmf | 41 ++++++++++ selinux-policy/snapd-and-similar/runtest.sh | 90 +++++++++++++++++++++ 4 files changed, 204 insertions(+) create mode 100644 selinux-policy/snapd-and-similar/Makefile create mode 100644 selinux-policy/snapd-and-similar/PURPOSE create mode 100644 selinux-policy/snapd-and-similar/main.fmf create mode 100755 selinux-policy/snapd-and-similar/runtest.sh diff --git a/selinux-policy/snapd-and-similar/Makefile b/selinux-policy/snapd-and-similar/Makefile new file mode 100644 index 0000000..e44655c --- /dev/null +++ b/selinux-policy/snapd-and-similar/Makefile @@ -0,0 +1,68 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/snapd-and-similar +# Description: SELinux interferes with the snapd service and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2023 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/snapd-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with the snapd service and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console snapd snapd-selinux /usr/sbin/service spamassassin" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) + @echo "Bug: 2207725" >> $(METADATA) # Fedora 38 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/snapd-and-similar/PURPOSE b/selinux-policy/snapd-and-similar/PURPOSE new file mode 100644 index 0000000..6788078 --- /dev/null +++ b/selinux-policy/snapd-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/snapd-and-similar +Author: Milos Malik + +SELinux interferes with the snapd service and related programs + diff --git a/selinux-policy/snapd-and-similar/main.fmf b/selinux-policy/snapd-and-similar/main.fmf new file mode 100644 index 0000000..34efcfa --- /dev/null +++ b/selinux-policy/snapd-and-similar/main.fmf @@ -0,0 +1,41 @@ +summary: SELinux interferes with the snapd service and related programs +description: |+ + SELinux interferes with the snapd service and related programs. + +contact: Milos Malik +component: + - selinux-policy +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - snapd + - snapd-selinux + - /usr/sbin/service + - spamassassin +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - failinfedora + - targeted +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2207725 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6 + because: the snapd package is not available there +extra-summary: /CoreOS/selinux-policy/Regression/snapd-and-similar +extra-task: /CoreOS/selinux-policy/Regression/snapd-and-similar +extra-nitrate: TC#0615881 +id: 7483a2b6-5a30-4538-b728-85e75d0542ef diff --git a/selinux-policy/snapd-and-similar/runtest.sh b/selinux-policy/snapd-and-similar/runtest.sh new file mode 100755 index 0000000..a644221 --- /dev/null +++ b/selinux-policy/snapd-and-similar/runtest.sh @@ -0,0 +1,90 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/snapd-and-similar +# Description: SELinux interferes with the snapd service and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2023 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +FILE_PATH="/usr/libexec/snapd/snapd" +FILE_CONTEXT="snappy_exec_t" +SERVICE_PACKAGE="snapd" +SERVICE_NAME="snapd" +PROCESS_NAME="snapd" +PROCESS_CONTEXT="snappy_t" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + rlAssertRpm spamassassin + + # rlServiceStop ${SERVICE_NAME} + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "bz#2207725" + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + rlSEMatchPathCon "/var/lib/snapd" "snappy_var_lib_t" + rlSESearchRule "allow init_t ${FILE_CONTEXT} : file { getattr open read execute } [ ]" + rlSESearchRule "allow init_t ${PROCESS_CONTEXT} : process { transition } [ ]" + rlSESearchRule "type_transition init_t ${FILE_CONTEXT} : process ${PROCESS_CONTEXT}" + rlSESearchRule "allow spamd_t snappy_var_lib_t : dir { search } [ ]" + rlPhaseEnd + + rlPhaseStartTest "real scenario -- standalone service" + rlRun "ls -alRZ /var/lib/snapd" + rlRun "semodule -lfull | grep snap" + rlRun "service spamassassin start" + rlRun "service spamassassin status" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + # for environments where the SELinux domain does not exist yet + PROCESS_CONTEXT="unconfined_service_t" + fi + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /var /run -e /var/ARTIFACTS" 0-255 + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlRun "service spamassassin stop" + rlRun "service spamassassin status" 3 + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + # rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + From d5c1f98be6527d07064a12161c000af2bc951a70 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Fri, 27 Oct 2023 14:20:36 +0200 Subject: [PATCH 293/626] test if `sudo dnf` works for confined administrators A recently filed customer report revealed that SELinux prevents the confined administrator (derived from sysadm_u, having sysadm_r role) from running the "sudo dnf update" command. The TC reproduces the situation. Because BZ#1910077 was not fixed on the sudo side, various commands end up triggering SELinux denials and consequently, they need to be fixed on the selinux-policy side. It is an unfortunate solution, but a necessary one if we want to achieve a successful run of such commands. The TC covers BZ#2233065 and RHEL-1679. --- selinux-policy/sudo-and-dnf/Makefile | 69 ++++++++++++++++++++++ selinux-policy/sudo-and-dnf/PURPOSE | 5 ++ selinux-policy/sudo-and-dnf/main.fmf | 45 +++++++++++++++ selinux-policy/sudo-and-dnf/runtest.sh | 79 ++++++++++++++++++++++++++ selinux-policy/sudo-and-dnf/ssh.exp | 20 +++++++ 5 files changed, 218 insertions(+) create mode 100644 selinux-policy/sudo-and-dnf/Makefile create mode 100644 selinux-policy/sudo-and-dnf/PURPOSE create mode 100644 selinux-policy/sudo-and-dnf/main.fmf create mode 100755 selinux-policy/sudo-and-dnf/runtest.sh create mode 100755 selinux-policy/sudo-and-dnf/ssh.exp diff --git a/selinux-policy/sudo-and-dnf/Makefile b/selinux-policy/sudo-and-dnf/Makefile new file mode 100644 index 0000000..d1cc3ca --- /dev/null +++ b/selinux-policy/sudo-and-dnf/Makefile @@ -0,0 +1,69 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/sudo-and-dnf +# Description: SELinux interferes with the dnf command executed via sudo +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2023 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/sudo-and-dnf +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE ssh.exp + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh ssh.exp + chcon -t bin_t runtest.sh ssh.exp + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with the dnf command executed via sudo" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console expect openssh-clients shadow-utils sudo dnf" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) + @echo "Bug: 2233065" >> $(METADATA) # RHEL-8 + @echo "Bug: RHEL-9947" >> $(METADATA) # RHEL-8 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/sudo-and-dnf/PURPOSE b/selinux-policy/sudo-and-dnf/PURPOSE new file mode 100644 index 0000000..a3b1b5c --- /dev/null +++ b/selinux-policy/sudo-and-dnf/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/sudo-and-dnf +Author: Milos Malik + +SELinux interferes with the dnf command executed via sudo + diff --git a/selinux-policy/sudo-and-dnf/main.fmf b/selinux-policy/sudo-and-dnf/main.fmf new file mode 100644 index 0000000..c46b178 --- /dev/null +++ b/selinux-policy/sudo-and-dnf/main.fmf @@ -0,0 +1,45 @@ +summary: SELinux interferes with the dnf command executed via sudo +description: |+ + SELinux interferes with the dnf command executed via sudo. + +contact: Milos Malik +component: + - selinux-policy +test: ./runtest.sh +framework: beakerlib +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - expect + - openssh-clients + - shadow-utils + - sudo + - dnf +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - targeted +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2233065 + - verifies: https://issues.redhat.com/browse/RHEL-1679 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + continue: false +extra-summary: /CoreOS/selinux-policy/Regression/sudo-and-dnf +extra-task: /CoreOS/selinux-policy/Regression/sudo-and-dnf +extra-nitrate: TC#0615928 +id: 5d15cec5-e128-4e5c-9f60-80e852df3936 diff --git a/selinux-policy/sudo-and-dnf/runtest.sh b/selinux-policy/sudo-and-dnf/runtest.sh new file mode 100755 index 0000000..716001d --- /dev/null +++ b/selinux-policy/sudo-and-dnf/runtest.sh @@ -0,0 +1,79 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/sudo-and-dnf +# Description: SELinux interferes with the dnf command executed via sudo +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2023 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm dnf + rlAssertRpm sudo + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "real scenario -- bz#2233065 + RHEL-9947" + rlSEConfigureSSH + rlRun "setsebool ssh_sysadm_login on" + USER_NAME="sysadm${RANDOM}" + USER_SECRET="S3kr3t${RANDOM}" + rlRun "useradd -Z sysadm_u ${USER_NAME}" + rlRun "echo ${USER_SECRET} | passwd --stdin ${USER_NAME}" + rlRun "echo \"${USER_NAME} ALL=(ALL) NOPASSWD: ALL\" > /etc/sudoers.d/dnf-test" + rlRun "ls -dlZ /var/lib/rpm" + + rlRun -s "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost sudo dnf clean all" + rlRun "grep -i 'rpmdb open failed' $rlRun_LOG" 1 + rm -f $rlRun_LOG + rlRun -s "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost sudo dnf update -y" + rlRun "grep -i 'rpmdb open failed' $rlRun_LOG" 1 + rm -f $rlRun_LOG + + rlRun "rm -f /etc/sudoers.d/dnf-test" + rlRun "userdel -rfZ ${USER_NAME}" + rlRun "setsebool ssh_sysadm_login off" + rlFileRestore + rlRun "service sshd restart" + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/sudo-and-dnf/ssh.exp b/selinux-policy/sudo-and-dnf/ssh.exp new file mode 100755 index 0000000..096b9b8 --- /dev/null +++ b/selinux-policy/sudo-and-dnf/ssh.exp @@ -0,0 +1,20 @@ +#!/usr/bin/expect -f +# Expect script for SSH logging as $username to $hostname using $password and executing $command. +# Usage: +# ./ssh.exp username password hostname command +set username [lrange $argv 0 0] +set password [lrange $argv 1 1] +set hostname [lrange $argv 2 2] +set command [lrange $argv 3 10] +set timeout 15 +# connect to remote host and execute given command +log_user 1 +spawn ssh -t $username@$hostname "id -Z ; $command" +expect { + -nocase "yes/no" { send -- "yes\r" ; exp_continue } + -nocase "password" { send -- "$password\r" } +} +log_user 1 +# send -- "\r" +expect eof + From b720e4136743418d7f8aec56c0982c47fb048d28 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Thu, 2 Nov 2023 09:36:12 +0100 Subject: [PATCH 294/626] adjust the relevancy of tests failing on centos stream Certain tests should not be executed on centos-stream 8 or 9 at all, because packages required by those tests are not available there. Certain tests need to reflect the fact that SELinux policies which confine the tested programs are not present on all versions of RHEL, CentOS or Fedora. --- other/mounting/Makefile | 4 ++-- other/mounting/main.fmf | 3 +-- selinux-policy/anon_inode-and-similar/main.fmf | 2 +- selinux-policy/anon_inode-and-similar/runtest.sh | 2 +- selinux-policy/bgpd-and-similar/runtest.sh | 2 +- selinux-policy/blueman-and-similar/main.fmf | 4 ++-- selinux-policy/bootupd-and-similar/runtest.sh | 8 ++++---- selinux-policy/fedora-third-party-and-similar/main.fmf | 4 ++-- selinux-policy/icecast-and-similar/main.fmf | 3 +++ selinux-policy/ladvd/main.fmf | 2 +- selinux-policy/sslh-and-similar/main.fmf | 3 +++ selinux-policy/systemd-userdbd-and-similar/main.fmf | 5 +++-- selinux-policy/thttpd-and-similar/main.fmf | 5 ++++- selinux-policy/usbmuxd-and-similar/main.fmf | 3 +++ 14 files changed, 31 insertions(+), 19 deletions(-) diff --git a/other/mounting/Makefile b/other/mounting/Makefile index d2bedf4..541f560 100644 --- a/other/mounting/Makefile +++ b/other/mounting/Makefile @@ -41,7 +41,6 @@ build: $(BUILT_FILES) clean: rm -f *~ $(BUILT_FILES) - include /usr/share/rhts/lib/rhts-make.include $(METADATA): Makefile @@ -61,6 +60,7 @@ $(METADATA): Makefile @echo "License: GPLv2+" >> $(METADATA) @echo "Confidential: no" >> $(METADATA) @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4 -RHELClient5 -RHELServer5 -RHEL6" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6" >> $(METADATA) rhts-lint $(METADATA) + diff --git a/other/mounting/main.fmf b/other/mounting/main.fmf index a521085..05fb64f 100644 --- a/other/mounting/main.fmf +++ b/other/mounting/main.fmf @@ -9,12 +9,11 @@ recommend: - e2fsprogs - dosfstools enabled: true +duration: 5m tag: - NoRHEL4 - NoRHEL5 - NoRHEL6 - - TIPfail_Security - - failinfedora - targeted adjust: - enabled: false diff --git a/selinux-policy/anon_inode-and-similar/main.fmf b/selinux-policy/anon_inode-and-similar/main.fmf index dcefdd9..56e34d1 100644 --- a/selinux-policy/anon_inode-and-similar/main.fmf +++ b/selinux-policy/anon_inode-and-similar/main.fmf @@ -36,7 +36,7 @@ link: - verifies: https://issues.redhat.com/browse/RHEL-11792 adjust: - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8 because: the anon_inode class is not defined there extra-nitrate: TC#0612643 extra-summary: /CoreOS/selinux-policy/Regression/anon_inode-and-similar diff --git a/selinux-policy/anon_inode-and-similar/runtest.sh b/selinux-policy/anon_inode-and-similar/runtest.sh index 8d83518..583c1ec 100755 --- a/selinux-policy/anon_inode-and-similar/runtest.sh +++ b/selinux-policy/anon_inode-and-similar/runtest.sh @@ -69,7 +69,7 @@ rlJournalStart rlPhaseEnd rlPhaseStartTest "mmap on io_uring - bz#2025714 + bz#2187745" - if rlIsFedora '<=39' || rlIsRHEL 9 ; then + if rlIsFedora '<=39' || rlIsCentOS 9 || rlIsRHEL 9 ; then rlSESearchRule "allow unconfined_t unconfined_t : anon_inode { map } [ ]" rlSESearchRule "allow svirt_t svirt_t : anon_inode { map } [ ]" rlSESearchRule "allow virtd_t virtd_t : anon_inode { map } [ ]" diff --git a/selinux-policy/bgpd-and-similar/runtest.sh b/selinux-policy/bgpd-and-similar/runtest.sh index b277dda..9e34785 100755 --- a/selinux-policy/bgpd-and-similar/runtest.sh +++ b/selinux-policy/bgpd-and-similar/runtest.sh @@ -34,7 +34,7 @@ FILE_PATH="/usr/sbin/bgpd" SERVICE_PACKAGE="openbgpd" SERVICE_NAME="bgpd" PROCESS_NAME="bgpd" -if rlIsRHEL 9 ; then +if rlIsRHEL 9 || rlIsCentOS 9 ; then FILE_CONTEXT="bin_t" PROCESS_CONTEXT="unconfined_service_t" else diff --git a/selinux-policy/blueman-and-similar/main.fmf b/selinux-policy/blueman-and-similar/main.fmf index 85dd3bd..54cce32 100644 --- a/selinux-policy/blueman-and-similar/main.fmf +++ b/selinux-policy/blueman-and-similar/main.fmf @@ -34,8 +34,8 @@ link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2027044 adjust: - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7, rhel-8, rhel-9 - continue: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7, rhel-8, rhel-9, centos-stream-8, centos-stream-9 + because: the blueman package is not available there extra-nitrate: TC#0563638 extra-summary: /CoreOS/selinux-policy/Regression/blueman-and-similar extra-task: /CoreOS/selinux-policy/Regression/blueman-and-similar diff --git a/selinux-policy/bootupd-and-similar/runtest.sh b/selinux-policy/bootupd-and-similar/runtest.sh index 8a4bf07..f639e12 100755 --- a/selinux-policy/bootupd-and-similar/runtest.sh +++ b/selinux-policy/bootupd-and-similar/runtest.sh @@ -34,12 +34,12 @@ FILE_PATH="/usr/libexec/bootupd" SERVICE_PACKAGE="bootupd" SERVICE_NAME="bootupd" PROCESS_NAME="bootupd" -if rlIsRHEL 9 ; then - FILE_CONTEXT="bin_t" - PROCESS_CONTEXT="unconfined_service_t" -else +if rlIsFedora ; then FILE_CONTEXT="bootupd_exec_t" PROCESS_CONTEXT="bootupd_t" +else + FILE_CONTEXT="bin_t" + PROCESS_CONTEXT="unconfined_service_t" fi rlJournalStart diff --git a/selinux-policy/fedora-third-party-and-similar/main.fmf b/selinux-policy/fedora-third-party-and-similar/main.fmf index 580deeb..0c79aa7 100644 --- a/selinux-policy/fedora-third-party-and-similar/main.fmf +++ b/selinux-policy/fedora-third-party-and-similar/main.fmf @@ -38,8 +38,8 @@ link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2093453 adjust: - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, rhel-9 - continue: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, rhel-9, centos-stream-8, centos-stream-9 + because: the fedora-third-party package is not available there extra-summary: /CoreOS/selinux-policy/Regression/fedora-third-party-and-similar extra-task: /CoreOS/selinux-policy/Regression/fedora-third-party-and-similar extra-nitrate: TC#0614304 diff --git a/selinux-policy/icecast-and-similar/main.fmf b/selinux-policy/icecast-and-similar/main.fmf index d00767c..9802ffb 100644 --- a/selinux-policy/icecast-and-similar/main.fmf +++ b/selinux-policy/icecast-and-similar/main.fmf @@ -40,6 +40,9 @@ adjust: - enabled: false when: distro >= rhel-8 because: the icecast package is not available there + - enabled: false + when: distro == centos-stream-8, centos-stream-9 + because: the icecast package is not available there extra-nitrate: TC#0388472 extra-summary: /CoreOS/selinux-policy/Regression/icecast-and-similar extra-task: /CoreOS/selinux-policy/Regression/icecast-and-similar diff --git a/selinux-policy/ladvd/main.fmf b/selinux-policy/ladvd/main.fmf index b691e9b..891c560 100644 --- a/selinux-policy/ladvd/main.fmf +++ b/selinux-policy/ladvd/main.fmf @@ -30,7 +30,7 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1855163 adjust: - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, rhel-9 + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, rhel-9, centos-stream-8, centos-stream-9 because: the ladvd package is not available there extra-summary: /CoreOS/selinux-policy/Regression/ladvd extra-task: /CoreOS/selinux-policy/Regression/ladvd diff --git a/selinux-policy/sslh-and-similar/main.fmf b/selinux-policy/sslh-and-similar/main.fmf index 1196043..4b3bd3e 100644 --- a/selinux-policy/sslh-and-similar/main.fmf +++ b/selinux-policy/sslh-and-similar/main.fmf @@ -37,6 +37,9 @@ adjust: - enabled: false when: distro >= rhel-9 because: the sslh package is not available there + - enabled: false + when: distro == centos-stream-9 + because: the sslh package is not available there - enabled: false when: arch == i386, ppc, s390, s390x because: the sslh package is not available for all architectures diff --git a/selinux-policy/systemd-userdbd-and-similar/main.fmf b/selinux-policy/systemd-userdbd-and-similar/main.fmf index 0764213..c8d9998 100644 --- a/selinux-policy/systemd-userdbd-and-similar/main.fmf +++ b/selinux-policy/systemd-userdbd-and-similar/main.fmf @@ -31,14 +31,15 @@ tag: - NoRHEL6 - NoRHEL7 - NoRHEL8 + - NoRHEL9 - failinfedora - targeted link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1835630 adjust: - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7, rhel-8, rhel-9 - continue: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7, rhel-8, rhel-9, centos-stream-8, centos-stream-9 + because: the systemd-userdbd program is not available there - enabled: false when: distro == fedora-30, fedora-31 continue: false diff --git a/selinux-policy/thttpd-and-similar/main.fmf b/selinux-policy/thttpd-and-similar/main.fmf index 375dba5..28f74b1 100644 --- a/selinux-policy/thttpd-and-similar/main.fmf +++ b/selinux-policy/thttpd-and-similar/main.fmf @@ -39,7 +39,10 @@ link: adjust: - enabled: false when: distro == rhel-4, rhel-alt-7, rhel-9 - continue: false + because: the thttpd package is not available there + - enabled: false + when: distro == centos-stream-9 + because: the thttpd package is not available there - enabled: false when: arch == i386, ppc64, s390 continue: false diff --git a/selinux-policy/usbmuxd-and-similar/main.fmf b/selinux-policy/usbmuxd-and-similar/main.fmf index d32863b..2301b51 100644 --- a/selinux-policy/usbmuxd-and-similar/main.fmf +++ b/selinux-policy/usbmuxd-and-similar/main.fmf @@ -45,6 +45,9 @@ adjust: - enabled: false when: distro >= rhel-9 because: the usbmuxd package is not available there + - enabled: false + when: distro == centos-stream-9 + because: the usbmuxd package is not available there - enabled: false when: arch == aarch64, s390x continue: false From 3ef0170d87ed14ae44cd4fbd5120699d7c5734e0 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Wed, 25 Oct 2023 18:53:39 +0200 Subject: [PATCH 295/626] test if smtpctl can connect to /run/smtpd.sock A recent opensmtpd testing revealed that SELinux prevents the smtpctl processes from connecting to the /run/smtpd.sock socket. The TC reproduces the situation. In order to support the basic function of sending emails via opensmtpd means, I believe that SELinux policy should allow the above-mentioned action. The TC looks for appropriate policy rules and file context patterns. The TC covers BZ#2246115. --- selinux-policy/opensmtpd-and-similar/Makefile | 3 ++- selinux-policy/opensmtpd-and-similar/main.fmf | 2 ++ selinux-policy/opensmtpd-and-similar/runtest.sh | 6 ++++++ 3 files changed, 10 insertions(+), 1 deletion(-) diff --git a/selinux-policy/opensmtpd-and-similar/Makefile b/selinux-policy/opensmtpd-and-similar/Makefile index 8d7690f..a59edb8 100644 --- a/selinux-policy/opensmtpd-and-similar/Makefile +++ b/selinux-policy/opensmtpd-and-similar/Makefile @@ -54,7 +54,7 @@ $(METADATA): Makefile @echo "Type: Regression" >> $(METADATA) @echo "TestTime: 10m" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console opensmtpd /usr/sbin/service" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console opensmtpd /usr/sbin/service mailx" >> $(METADATA) @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @@ -63,6 +63,7 @@ $(METADATA): Makefile @echo "Destructive: no" >> $(METADATA) @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA) @echo "Bug: 2208696" >> $(METADATA) # Fedora 38 + @echo "Bug: 2246115" >> $(METADATA) # Fedora rawhide rhts-lint $(METADATA) diff --git a/selinux-policy/opensmtpd-and-similar/main.fmf b/selinux-policy/opensmtpd-and-similar/main.fmf index 064e88a..b014b17 100644 --- a/selinux-policy/opensmtpd-and-similar/main.fmf +++ b/selinux-policy/opensmtpd-and-similar/main.fmf @@ -17,6 +17,7 @@ recommend: - setools-console - opensmtpd - /usr/sbin/service + - mailx environment: AVC_ERROR: +no_avc_check duration: 10m @@ -29,6 +30,7 @@ tag: - targeted link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2208696 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2246115 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 diff --git a/selinux-policy/opensmtpd-and-similar/runtest.sh b/selinux-policy/opensmtpd-and-similar/runtest.sh index 6ce1a6e..27df5cd 100755 --- a/selinux-policy/opensmtpd-and-similar/runtest.sh +++ b/selinux-policy/opensmtpd-and-similar/runtest.sh @@ -62,7 +62,13 @@ rlJournalStart rlSESearchRule "allow sendmail_t sendmail_var_run_t : sock_file { create setattr unlink write } [ ]" rlPhaseEnd + rlPhaseStartTest "bz#2246115" + rlSEMatchPathCon "/run/smtpd.sock" "sendmail_var_run_t" + rlSESearchRule "allow sendmail_t sendmail_t : unix_stream_socket { connectto } [ ]" + rlPhaseEnd + rlPhaseStartTest "real scenario -- standalone service" + rlRun "sestatus | mailx -s test-email root@localhost" if ! ls -Z ${FILE_PATH} | grep -q ${FILE_CONTEXT} ; then # for environments where the service is not yet confined PROCESS_CONTEXT="unconfined_service_t" From b7da677d1035b62dd0bb5e5d5423c516e70895af Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Mon, 30 Oct 2023 11:25:43 +0100 Subject: [PATCH 296/626] test if ntpd can connect to 4460/tcp port A recently filed BZ report revealed that SELinux prevents the ntpd service (which belongs to the ntpsec package) from connecting to the 4460/tcp port when it is configured to use the NTS servers. The TC reproduces the situation. In order to support the NTS standart for the ntpd service, I believe that SELinux policy should allow the action. The TC looks for appropriate policy rules, port context and file context patterns. The TC covers BZ#2246805 and RHEL-15085. --- selinux-policy/ntpsec-and-similar/Makefile | 69 ++++++++++++++++ selinux-policy/ntpsec-and-similar/PURPOSE | 5 ++ selinux-policy/ntpsec-and-similar/main.fmf | 44 +++++++++++ selinux-policy/ntpsec-and-similar/runtest.sh | 83 ++++++++++++++++++++ 4 files changed, 201 insertions(+) create mode 100644 selinux-policy/ntpsec-and-similar/Makefile create mode 100644 selinux-policy/ntpsec-and-similar/PURPOSE create mode 100644 selinux-policy/ntpsec-and-similar/main.fmf create mode 100755 selinux-policy/ntpsec-and-similar/runtest.sh diff --git a/selinux-policy/ntpsec-and-similar/Makefile b/selinux-policy/ntpsec-and-similar/Makefile new file mode 100644 index 0000000..e0800fe --- /dev/null +++ b/selinux-policy/ntpsec-and-similar/Makefile @@ -0,0 +1,69 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/ntpsec-and-similar +# Description: SELinux interferes with the ntpsec ntpd service and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2023 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/ntpsec-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with the ntpsec ntpd service and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console ntpsec /usr/sbin/service" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8 -RHEL9" >> $(METADATA) + @echo "Bug: 2246805" >> $(METADATA) # Fedora 38 + @echo "Bug: RHEL-15085" >> $(METADATA) # RHEL-9 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/ntpsec-and-similar/PURPOSE b/selinux-policy/ntpsec-and-similar/PURPOSE new file mode 100644 index 0000000..d39d82d --- /dev/null +++ b/selinux-policy/ntpsec-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/ntpsec-and-similar +Author: Milos Malik + +SELinux interferes with the ntpsec ntpd service and related program + diff --git a/selinux-policy/ntpsec-and-similar/main.fmf b/selinux-policy/ntpsec-and-similar/main.fmf new file mode 100644 index 0000000..979ea0e --- /dev/null +++ b/selinux-policy/ntpsec-and-similar/main.fmf @@ -0,0 +1,44 @@ +summary: SELinux interferes with the ntpsec ntpd service and related programs +description: |+ + SELinux interferes with the ntpsec ntpd service and related programs. + +contact: Milos Malik +component: + - selinux-policy +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - ntpsec + - /usr/sbin/service +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - NoRHEL8 + - epel + - rhel9-epel + - targeted +tier: '3' +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2246805 + - verifies: https://issues.redhat.com/browse/RHEL-15085 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 + because: the ntpsec package is not available there +extra-summary: /CoreOS/selinux-policy/Regression/ntpsec-and-similar +extra-task: /CoreOS/selinux-policy/Regression/ntpsec-and-similar +extra-nitrate: TC#0615926 +id: 258f0e8c-141f-473c-b418-d19049c464b2 diff --git a/selinux-policy/ntpsec-and-similar/runtest.sh b/selinux-policy/ntpsec-and-similar/runtest.sh new file mode 100755 index 0000000..78a64a6 --- /dev/null +++ b/selinux-policy/ntpsec-and-similar/runtest.sh @@ -0,0 +1,83 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/ntpsec-and-similar +# Description: SELinux interferes with the ntpsec ntpd service and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2023 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +FILE_PATH="/usr/sbin/ntpd" +FILE_CONTEXT="ntpd_exec_t" +SERVICE_PACKAGE="ntpsec" +SERVICE_NAME="ntpd" +PROCESS_NAME="ntpd" +PROCESS_CONTEXT="ntpd_t" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} + rlFileBackup /etc/ntp.conf + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "bz#2246805 + RHEL-15085" + rlSEMatchPathCon "/usr/sbin/ntpd" "ntpd_exec_t" + rlSESearchRule "allow ntpd_t ntske_port_t : tcp_socket { name_connect } [ ]" + rlSEMatchPortCon tcp 4460 ntske_port_t + rlPhaseEnd + + rlPhaseStartTest "real scenario -- standalone service" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + # for environments where the SELinux domain does not exist yet + PROCESS_CONTEXT="unconfined_service_t" + fi + rlRun "echo -en '\nserver nts.netnod.se:4460 nts iburst\n' >> /etc/ntp.conf" + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /etc /var /run -e /var/ARTIFACTS" 0-255 + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + From 7582d85628fc6a392ba13b8ec804c362bfa1a462 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Fri, 3 Nov 2023 16:37:43 +0100 Subject: [PATCH 297/626] fix the relevancy of tests failing on centos stream Apparently, the first attempt to adjust the relevancy was not complete. So here is another one. Certain tests should not be executed on centos-stream 8 or 9 at all, because packages required by those tests are not available there. Certain tests need to reflect the fact that SELinux policies which confine the tested programs are not present on all versions of RHEL, CentOS or Fedora. --- libselinux/validatetrans/main.fmf | 4 ++-- policycoreutils/sepolicy-manpage/runtest.sh | 2 +- selinux-policy/ModemManager-and-similar/runtest.sh | 2 +- selinux-policy/bgpd-and-similar/runtest.sh | 4 ++-- selinux-policy/bootupd-and-similar/main.fmf | 2 +- .../bz562833-chrooted-named-file-contexts/runtest.sh | 2 +- selinux-policy/bz733494-amanda-and-similar/runtest.sh | 2 +- selinux-policy/caddy-and-similar/main.fmf | 3 ++- selinux-policy/capability2-class/main.fmf | 2 +- selinux-policy/cups-lpd-and-similar/runtest.sh | 2 +- selinux-policy/cups-pdf-and-similar/runtest.sh | 2 +- selinux-policy/dhclient-and-similar/runtest.sh | 4 ++-- selinux-policy/firewalld-and-similar/runtest.sh | 2 +- selinux-policy/journalctl-and-similar/runtest.sh | 2 +- selinux-policy/lockdown-class/main.fmf | 2 +- selinux-policy/nasd-and-similar/main.fmf | 2 +- selinux-policy/ntpsec-and-similar/main.fmf | 2 +- selinux-policy/nvme-stas-and-similar/main.fmf | 2 +- selinux-policy/opensmtpd-and-similar/runtest.sh | 2 ++ selinux-policy/pam_limits-and-related/runtest.sh | 2 +- selinux-policy/perf_event-and-related/runtest.sh | 2 +- selinux-policy/policy-rpm-macros/main.fmf | 2 +- selinux-policy/rpmdb-and-similar/main.fmf | 3 ++- selinux-policy/rpmdb-and-similar/runtest.sh | 2 +- selinux-policy/stalld-and-similar/main.fmf | 2 +- selinux-policy/systemd-bootchart-and-similar/main.fmf | 4 ++-- selinux-policy/systemd-creds/main.fmf | 2 +- selinux-policy/systemd-homed/main.fmf | 2 +- selinux-policy/systemd-modules-load-and-similar/runtest.sh | 2 +- selinux-policy/systemd-sysctl-and-similar/runtest.sh | 2 +- selinux-policy/systemd-timesyncd-and-similar/runtest.sh | 2 +- selinux-policy/targetd-and-similar/main.fmf | 2 +- selinux-policy/usbmuxd-and-similar/runtest.sh | 2 +- selinux-policy/watch-permissions/main.fmf | 4 ++-- 34 files changed, 42 insertions(+), 38 deletions(-) diff --git a/libselinux/validatetrans/main.fmf b/libselinux/validatetrans/main.fmf index 624cfec..cf9a0e9 100644 --- a/libselinux/validatetrans/main.fmf +++ b/libselinux/validatetrans/main.fmf @@ -32,8 +32,8 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2008965 adjust: - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 - continue: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8 + because: the validatetrans program is not available there - enabled: false when: distro < Fedora-32 continue: false diff --git a/policycoreutils/sepolicy-manpage/runtest.sh b/policycoreutils/sepolicy-manpage/runtest.sh index e6c1006..6fe835a 100755 --- a/policycoreutils/sepolicy-manpage/runtest.sh +++ b/policycoreutils/sepolicy-manpage/runtest.sh @@ -18,7 +18,7 @@ rlJournalStart rlPhaseStartTest "sepolicy manpage --web, bz#1854639 + bz#1989840" rlRun "sepolicy manpage --web -d zebra_t" - if rlIsRHEL 7 8 ; then + if rlIsRHEL 7 8 || rlIsCentOS 7 8 ; then rlRun "ls -l /tmp/*release*" 0 "Html file with OS name exists." rlRun "cat /tmp/*release* > /tmp/testfile" else diff --git a/selinux-policy/ModemManager-and-similar/runtest.sh b/selinux-policy/ModemManager-and-similar/runtest.sh index c72292a..a3d0348 100755 --- a/selinux-policy/ModemManager-and-similar/runtest.sh +++ b/selinux-policy/ModemManager-and-similar/runtest.sh @@ -119,7 +119,7 @@ rlJournalStart rlPhaseEnd fi - if ! rlIsRHEL 6 7 8 ; then + if ! rlIsRHEL 6 7 8 && ! rlIsCentOS 6 7 8 ; then rlPhaseStartTest "bz#1996903 + bz#1996905 + bz#2001141 + bz#2001143 + bz#2001144 + bz#2001145 + bz#2036582" rlSEMatchPathCon "/usr/sbin/ModemManager" "modemmanager_exec_t" rlSESearchRule "allow modemmanager_t modemmanager_t : qipcrtr_socket { create getattr getopt } [ ]" diff --git a/selinux-policy/bgpd-and-similar/runtest.sh b/selinux-policy/bgpd-and-similar/runtest.sh index 9e34785..c248b5e 100755 --- a/selinux-policy/bgpd-and-similar/runtest.sh +++ b/selinux-policy/bgpd-and-similar/runtest.sh @@ -79,7 +79,7 @@ rlJournalStart rlPhaseStartTest "real scenario -- standalone service" rlRun "sed -i 's/^\(include.*\)$/# \1/' /etc/bgpd.conf" - if rlIsRHEL 8 ; then + if rlIsRHEL 8 || rlIsCentOS 8 ; then # work around BZ#1830170 that was closed as WONTFIX rlRun "chcon -t bin_t /usr/sbin/bgpd" PROCESS_CONTEXT="unconfined_service_t" @@ -87,7 +87,7 @@ rlJournalStart rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 - if rlIsRHEL 8 ; then + if rlIsRHEL 8 || rlIsCentOS 8 ; then # work around BZ#1830170 that was closed as WONTFIX rlRun "restorecon -v /usr/sbin/bgpd" fi diff --git a/selinux-policy/bootupd-and-similar/main.fmf b/selinux-policy/bootupd-and-similar/main.fmf index 9a9b2bf..758cad7 100644 --- a/selinux-policy/bootupd-and-similar/main.fmf +++ b/selinux-policy/bootupd-and-similar/main.fmf @@ -37,7 +37,7 @@ link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2218106 adjust: - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8 because: the package is not available there - enabled: false when: arch == ppc64, ppc64le, s390x diff --git a/selinux-policy/bz562833-chrooted-named-file-contexts/runtest.sh b/selinux-policy/bz562833-chrooted-named-file-contexts/runtest.sh index 2ecc660..69a2743 100755 --- a/selinux-policy/bz562833-chrooted-named-file-contexts/runtest.sh +++ b/selinux-policy/bz562833-chrooted-named-file-contexts/runtest.sh @@ -201,7 +201,7 @@ rlJournalStart rlPhaseEnd fi - if ! rlIsRHEL 5 6 7 8 ; then + if ! rlIsRHEL 5 6 7 8 && ! rlIsCentOS 5 6 7 8 ; then rlPhaseStartTest "bz#1827591 + bz#1923929" rlSEMatchPathCon "/usr/sbin/rndc" "ndc_exec_t" rlSESearchRule "dontaudit ndc_t ndc_t : process { setsched } [ ]" diff --git a/selinux-policy/bz733494-amanda-and-similar/runtest.sh b/selinux-policy/bz733494-amanda-and-similar/runtest.sh index 1e0451a..a5db0a8 100755 --- a/selinux-policy/bz733494-amanda-and-similar/runtest.sh +++ b/selinux-policy/bz733494-amanda-and-similar/runtest.sh @@ -177,7 +177,7 @@ rlJournalStart rlPhaseEnd fi - if ! rlIsRHEL 5 6 7 8 ; then + if ! rlIsRHEL 5 6 7 8 && ! rlIsCentOS 5 6 7 8 ; then rlPhaseStartTest "bz#1960513" rlRun "ls -l /usr/sbin/amandad" rlSEMatchPathCon "/usr/lib64/amanda/amandad" "amanda_inetd_exec_t" diff --git a/selinux-policy/caddy-and-similar/main.fmf b/selinux-policy/caddy-and-similar/main.fmf index f942d28..b1f10a9 100644 --- a/selinux-policy/caddy-and-similar/main.fmf +++ b/selinux-policy/caddy-and-similar/main.fmf @@ -23,9 +23,10 @@ duration: 10m enabled: true tag: - failinfedora + - targeted adjust: - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 because: the caddy package is not available there link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1706651 diff --git a/selinux-policy/capability2-class/main.fmf b/selinux-policy/capability2-class/main.fmf index 5440b4f..aac92c5 100644 --- a/selinux-policy/capability2-class/main.fmf +++ b/selinux-policy/capability2-class/main.fmf @@ -23,7 +23,7 @@ link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1915264 adjust: - enabled: false - when: distro = rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8 continue: false extra-nitrate: TC#0615396 id: 251fd08a-0f65-4592-8d4d-2b79e9479460 diff --git a/selinux-policy/cups-lpd-and-similar/runtest.sh b/selinux-policy/cups-lpd-and-similar/runtest.sh index 2191da5..7669790 100755 --- a/selinux-policy/cups-lpd-and-similar/runtest.sh +++ b/selinux-policy/cups-lpd-and-similar/runtest.sh @@ -94,7 +94,7 @@ rlJournalStart rlSESearchRule "allow cupsd_lpd_t cupsd_var_run_t : sock_file { read } [ ]" rlPhaseEnd - if ! rlIsRHEL 5 6 7 8 ; then + if ! rlIsRHEL 5 6 7 8 && ! rlIsCentOS 5 6 7 8 ; then rlPhaseStartTest "bz#2020531" rlSEMatchPathCon "/usr/lib/cups/daemon/cups-lpd" "cupsd_lpd_exec_t" rlRun "ls -Z /proc/1/environ | grep :init_t" diff --git a/selinux-policy/cups-pdf-and-similar/runtest.sh b/selinux-policy/cups-pdf-and-similar/runtest.sh index 86c5aab..cfbd105 100755 --- a/selinux-policy/cups-pdf-and-similar/runtest.sh +++ b/selinux-policy/cups-pdf-and-similar/runtest.sh @@ -105,7 +105,7 @@ rlJournalStart rlSESearchRule "type_transition cups_pdf_t var_log_t : file cupsd_log_t" rlPhaseEnd - if ! rlIsRHEL 8 ; then + if ! rlIsRHEL 8 && ! rlIsCentOS 8 ; then rlPhaseStartTest "bz#1832521" rlSESearchRule "allow cups_pdf_t cups_pdf_t : unix_dgram_socket { create connect } [ ]" rlPhaseEnd diff --git a/selinux-policy/dhclient-and-similar/runtest.sh b/selinux-policy/dhclient-and-similar/runtest.sh index f9824d0..1b448e4 100755 --- a/selinux-policy/dhclient-and-similar/runtest.sh +++ b/selinux-policy/dhclient-and-similar/runtest.sh @@ -52,7 +52,7 @@ rlJournalStart sleep 2 rlPhaseEnd - if ! rlIsRHEL 8 ; then + if ! rlIsRHEL 8 && ! rlIsCentOS 8 ; then rlPhaseStartTest "bz#1897388" rlSEMatchPathCon "/usr/sbin/dhclient-script" "dhcpc_exec_t" rlSEMatchPathCon "/usr/bin/chronyc" "chronyc_exec_t" @@ -78,7 +78,7 @@ rlJournalStart DHCLIENT_PID=`pgrep dhclient` rlRun "ps -efZ | grep dhclient" rlRun "ps -efZ | grep ':dhcpc_t:.*dhclient'" - if ! rlIsRHEL 8 ; then + if ! rlIsRHEL 8 && ! rlIsCentOS 8 ; then rlRun "ls -alZ /run/chrony-dhcp" fi rlPhaseEnd diff --git a/selinux-policy/firewalld-and-similar/runtest.sh b/selinux-policy/firewalld-and-similar/runtest.sh index f81a5ab..be3e640 100755 --- a/selinux-policy/firewalld-and-similar/runtest.sh +++ b/selinux-policy/firewalld-and-similar/runtest.sh @@ -168,7 +168,7 @@ rlJournalStart rlPhaseEnd fi - if ! rlIsRHEL 5 6 7 8 ; then + if ! rlIsRHEL 5 6 7 8 && ! rlIsCentOS 5 6 7 8 ; then rlPhaseStartTest "bz#1989641" rlSESearchRule "allow firewalld_t firewalld_t : capability { setpcap } [ ]" rlSESearchRule "allow firewalld_t firewalld_t : process { setcap } [ ]" diff --git a/selinux-policy/journalctl-and-similar/runtest.sh b/selinux-policy/journalctl-and-similar/runtest.sh index 39fde79..8a85859 100755 --- a/selinux-policy/journalctl-and-similar/runtest.sh +++ b/selinux-policy/journalctl-and-similar/runtest.sh @@ -99,7 +99,7 @@ rlJournalStart rlPhaseEnd fi - if ! rlIsRHEL 7 8 ; then + if ! rlIsRHEL 7 8 && ! rlIsCentOS 7 8 ; then rlPhaseStartTest "bz#2075527 + bz#2152823" rlSESearchRule "allow syslogd_t syslogd_var_run_t : file { relabelfrom relabelto } [ ]" rlRun "journalctl --rotate" diff --git a/selinux-policy/lockdown-class/main.fmf b/selinux-policy/lockdown-class/main.fmf index dbec951..c780d92 100644 --- a/selinux-policy/lockdown-class/main.fmf +++ b/selinux-policy/lockdown-class/main.fmf @@ -32,7 +32,7 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1933134 adjust: - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7, rhel-8 + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7, rhel-8, centos-stream-8 because: the lockdown class is not defined there extra-summary: /CoreOS/selinux-policy/Sanity/lockdown-class extra-task: /CoreOS/selinux-policy/Sanity/lockdown-class diff --git a/selinux-policy/nasd-and-similar/main.fmf b/selinux-policy/nasd-and-similar/main.fmf index 9fe11ba..58b27f3 100644 --- a/selinux-policy/nasd-and-similar/main.fmf +++ b/selinux-policy/nasd-and-similar/main.fmf @@ -23,7 +23,7 @@ environment: duration: 10m adjust: - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8 because: the nas package is not available there extra-summary: /CoreOS/selinux-policy/Regression/nasd-and-similar extra-task: /CoreOS/selinux-policy/Regression/nasd-and-similar diff --git a/selinux-policy/ntpsec-and-similar/main.fmf b/selinux-policy/ntpsec-and-similar/main.fmf index 979ea0e..08273c8 100644 --- a/selinux-policy/ntpsec-and-similar/main.fmf +++ b/selinux-policy/ntpsec-and-similar/main.fmf @@ -36,7 +36,7 @@ link: - verifies: https://issues.redhat.com/browse/RHEL-15085 adjust: - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8 because: the ntpsec package is not available there extra-summary: /CoreOS/selinux-policy/Regression/ntpsec-and-similar extra-task: /CoreOS/selinux-policy/Regression/ntpsec-and-similar diff --git a/selinux-policy/nvme-stas-and-similar/main.fmf b/selinux-policy/nvme-stas-and-similar/main.fmf index fc7fff1..a83654b 100644 --- a/selinux-policy/nvme-stas-and-similar/main.fmf +++ b/selinux-policy/nvme-stas-and-similar/main.fmf @@ -35,7 +35,7 @@ link: - verifies: https://issues.redhat.com/browse/RHEL-1557 adjust: - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8 because: the nvme-stas package is not available there extra-summary: /CoreOS/selinux-policy/Regression/nvme-stas-and-similar extra-task: /CoreOS/selinux-policy/Regression/nvme-stas-and-similar diff --git a/selinux-policy/opensmtpd-and-similar/runtest.sh b/selinux-policy/opensmtpd-and-similar/runtest.sh index 27df5cd..bb1b4d6 100755 --- a/selinux-policy/opensmtpd-and-similar/runtest.sh +++ b/selinux-policy/opensmtpd-and-similar/runtest.sh @@ -53,6 +53,7 @@ rlJournalStart sleep 2 rlPhaseEnd + if ! rlIsRHEL 8 && ! rlIsCentOS 8 ; then rlPhaseStartTest "bz#2208696" rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" rlSEMatchPathCon "/var/run" "var_run_t" @@ -66,6 +67,7 @@ rlJournalStart rlSEMatchPathCon "/run/smtpd.sock" "sendmail_var_run_t" rlSESearchRule "allow sendmail_t sendmail_t : unix_stream_socket { connectto } [ ]" rlPhaseEnd + fi rlPhaseStartTest "real scenario -- standalone service" rlRun "sestatus | mailx -s test-email root@localhost" diff --git a/selinux-policy/pam_limits-and-related/runtest.sh b/selinux-policy/pam_limits-and-related/runtest.sh index da513df..3eeb144 100755 --- a/selinux-policy/pam_limits-and-related/runtest.sh +++ b/selinux-policy/pam_limits-and-related/runtest.sh @@ -52,7 +52,7 @@ rlJournalStart sleep 2 rlPhaseEnd - if ! rlIsRHEL 8 ; then + if ! rlIsRHEL 8 && ! rlIsCentOS 8 ; then rlPhaseStartTest "bz#1958819" rlSESearchRule "allow init_t guest_t : process2 { nnp_transition } [ ]" rlSESearchRule "allow init_t staff_t : process2 { nnp_transition } [ ]" diff --git a/selinux-policy/perf_event-and-related/runtest.sh b/selinux-policy/perf_event-and-related/runtest.sh index 61f8021..84b4c1e 100755 --- a/selinux-policy/perf_event-and-related/runtest.sh +++ b/selinux-policy/perf_event-and-related/runtest.sh @@ -64,7 +64,7 @@ rlJournalStart rlSESearchRule "allow sysadm_t sysadm_t : perf_event { open cpu kernel read write } [ ]" rlPhaseEnd - if ! rlIsRHEL 8 ; then + if ! rlIsRHEL 8 && ! rlIsCentOS 8 ; then rlPhaseStartTest "bz#2229936" rlSESearchRule "allow sysadm_t kernel_t : bpf { prog_run } [ ]" rlPhaseEnd diff --git a/selinux-policy/policy-rpm-macros/main.fmf b/selinux-policy/policy-rpm-macros/main.fmf index 44f35ba..379dc76 100644 --- a/selinux-policy/policy-rpm-macros/main.fmf +++ b/selinux-policy/policy-rpm-macros/main.fmf @@ -35,7 +35,7 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1465824 adjust: - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-8 + when: distro == rhel-4, rhel-5, rhel-6 continue: false extra-nitrate: TC#0546229 extra-summary: /CoreOS/selinux-policy/Sanity/policy-rpm-macros diff --git a/selinux-policy/rpmdb-and-similar/main.fmf b/selinux-policy/rpmdb-and-similar/main.fmf index 401682a..5d67459 100644 --- a/selinux-policy/rpmdb-and-similar/main.fmf +++ b/selinux-policy/rpmdb-and-similar/main.fmf @@ -27,6 +27,7 @@ tag: - NoRHEL5 - NoRHEL6 - NoRHEL7 + - NoRHEL8 - targeted link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1461313 @@ -35,7 +36,7 @@ link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2164752 adjust: - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8 continue: false extra-nitrate: TC#0609732 extra-summary: /CoreOS/selinux-policy/Regression/rpmdb-and-similar diff --git a/selinux-policy/rpmdb-and-similar/runtest.sh b/selinux-policy/rpmdb-and-similar/runtest.sh index b1357f1..5c33f74 100755 --- a/selinux-policy/rpmdb-and-similar/runtest.sh +++ b/selinux-policy/rpmdb-and-similar/runtest.sh @@ -36,7 +36,7 @@ PROCESS_NAME="rpmdb" PROCESS_CONTEXT="rpmdb_t" rlJournalStart - if rlIsRHEL '<9' ; then + if rlIsRHEL '<9' || rlIsCentOS '<9' ; then rlLog "Not applicable to this OS version." rlJournalEnd exit 0 diff --git a/selinux-policy/stalld-and-similar/main.fmf b/selinux-policy/stalld-and-similar/main.fmf index 863d8aa..e80d301 100644 --- a/selinux-policy/stalld-and-similar/main.fmf +++ b/selinux-policy/stalld-and-similar/main.fmf @@ -41,7 +41,7 @@ link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2140673 adjust: - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8 continue: false extra-nitrate: TC#0613202 extra-summary: /CoreOS/selinux-policy/Regression/stalld-and-similar diff --git a/selinux-policy/systemd-bootchart-and-similar/main.fmf b/selinux-policy/systemd-bootchart-and-similar/main.fmf index 868c1da..0f723d1 100644 --- a/selinux-policy/systemd-bootchart-and-similar/main.fmf +++ b/selinux-policy/systemd-bootchart-and-similar/main.fmf @@ -31,8 +31,8 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1838163 adjust: - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-8, rhel-9 - continue: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-8, rhel-9, centos-stream-8, centos-stream-9 + because: the systemd-bootchart package is not available there extra-nitrate: TC#0608092 extra-summary: /CoreOS/selinux-policy/Regression/systemd-bootchart-and-similar extra-task: /CoreOS/selinux-policy/Regression/systemd-bootchart-and-similar diff --git a/selinux-policy/systemd-creds/main.fmf b/selinux-policy/systemd-creds/main.fmf index ef77498..41e08eb 100644 --- a/selinux-policy/systemd-creds/main.fmf +++ b/selinux-policy/systemd-creds/main.fmf @@ -27,7 +27,7 @@ tag: tier: '2' adjust: - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8 because: the systemd-creds program is not available there link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2096857 diff --git a/selinux-policy/systemd-homed/main.fmf b/selinux-policy/systemd-homed/main.fmf index 1df6fe0..c131f4c 100644 --- a/selinux-policy/systemd-homed/main.fmf +++ b/selinux-policy/systemd-homed/main.fmf @@ -22,7 +22,7 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1809878 adjust: - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, rhel-9 + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, rhel-9, centos-stream-8, centos-stream-9 because: the systemd-homed program is not available there extra-summary: /CoreOS/selinux-policy/Regression/systemd-homed extra-task: /CoreOS/selinux-policy/Regression/systemd-homed diff --git a/selinux-policy/systemd-modules-load-and-similar/runtest.sh b/selinux-policy/systemd-modules-load-and-similar/runtest.sh index 920c3e0..7f89ee6 100755 --- a/selinux-policy/systemd-modules-load-and-similar/runtest.sh +++ b/selinux-policy/systemd-modules-load-and-similar/runtest.sh @@ -130,7 +130,7 @@ rlJournalStart fi rlPhaseEnd - if ! rlIsRHEL 8 ; then + if ! rlIsRHEL 8 && ! rlIsCentOS 8 ; then rlPhaseStartTest "bz#2088257 + bz#2088258" rlSEMatchPathCon "/usr/lib/systemd/systemd-modules-load" "systemd_modules_load_exec_t" rlSEMatchPathCon "/dev/kmsg" "kmsg_device_t" diff --git a/selinux-policy/systemd-sysctl-and-similar/runtest.sh b/selinux-policy/systemd-sysctl-and-similar/runtest.sh index f7ad2d3..1e18554 100755 --- a/selinux-policy/systemd-sysctl-and-similar/runtest.sh +++ b/selinux-policy/systemd-sysctl-and-similar/runtest.sh @@ -50,7 +50,7 @@ rlJournalStart sleep 2 rlPhaseEnd - if ! rlIsRHEL 8 ; then + if ! rlIsRHEL 8 && ! rlIsCentOS 8 ; then rlPhaseStartTest "bz#2056207 + bz#2056999" rlSEMatchPathCon "/usr/lib/systemd/systemd-sysctl" "systemd_sysctl_exec_t" rlRun "ls -Z /proc/sys/fs/suid_dumpable | grep :proc_security_t" diff --git a/selinux-policy/systemd-timesyncd-and-similar/runtest.sh b/selinux-policy/systemd-timesyncd-and-similar/runtest.sh index 98aeb41..a9d5e81 100755 --- a/selinux-policy/systemd-timesyncd-and-similar/runtest.sh +++ b/selinux-policy/systemd-timesyncd-and-similar/runtest.sh @@ -102,7 +102,7 @@ rlJournalStart rlSESearchRule "allow systemd_timedated_t efivarfs_t : file { getattr open read } [ ]" rlPhaseEnd - if ! rlIsRHEL '<9' ; then + if ! rlIsRHEL '<9' && ! rlIsCentOS '<9' ; then rlPhaseStartTest "bz#1949315" rlSEMatchPathCon "/" "root_t" rlSEMatchPathCon "/run" "var_run_t" diff --git a/selinux-policy/targetd-and-similar/main.fmf b/selinux-policy/targetd-and-similar/main.fmf index e4b319d..1d97e2f 100644 --- a/selinux-policy/targetd-and-similar/main.fmf +++ b/selinux-policy/targetd-and-similar/main.fmf @@ -48,7 +48,7 @@ link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2222199 adjust: - enabled: true - when: distro == rhel-7, rhel-8, fedora + when: distro == rhel-7, rhel-8, centos-stream-8, fedora because: the targetd package is not available elsewhere extra-nitrate: TC#0337221 extra-summary: /CoreOS/selinux-policy/Regression/targetd-and-similar diff --git a/selinux-policy/usbmuxd-and-similar/runtest.sh b/selinux-policy/usbmuxd-and-similar/runtest.sh index 6fddd17..e205d5c 100755 --- a/selinux-policy/usbmuxd-and-similar/runtest.sh +++ b/selinux-policy/usbmuxd-and-similar/runtest.sh @@ -80,7 +80,7 @@ rlJournalStart rlSESearchRule "allow usbmuxd_t udev_var_run_t : file { getattr open read } [ ]" rlPhaseEnd - if ! rlIsRHEL 8 ; then + if ! rlIsRHEL 8 && ! rlIsCentOS 8 ; then rlPhaseStartTest "bz#1930992" rlSEMatchPathCon "/sys" "sysfs_t" rlSESearchRule "allow usbmuxd_t sysfs_t : filesystem { getattr } [ ]" diff --git a/selinux-policy/watch-permissions/main.fmf b/selinux-policy/watch-permissions/main.fmf index 5969989..d465382 100644 --- a/selinux-policy/watch-permissions/main.fmf +++ b/selinux-policy/watch-permissions/main.fmf @@ -23,7 +23,7 @@ link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1915034 adjust: - enabled: false - when: distro = rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 - continue: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8 + because: the watch permission is not defined there extra-nitrate: TC#0615395 id: c4421242-0b97-4a1e-abbb-1dbe5dd21355 From da27245fd7ab0df3f69ad58ce8c3b62b1f5367a9 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Mon, 9 Oct 2023 16:04:18 +0200 Subject: [PATCH 298/626] test if tlp can search /var/lib/snapd/ A lot of reported BZs revealed that SELinux prevents the tlp processes from searching (syscall = newfstatat) under the /var/lib/snapd directory when the snapd package is installed. The TC reproduces the situation. Based on the last comment in BZ#1888699, I believe that SELinux policy should dontaudit the access. The TC looks for appropriate policy rules. The TC covers BZ#2221019 and its duplicates. --- selinux-policy/tlp-and-similar/Makefile | 3 ++- selinux-policy/tlp-and-similar/main.fmf | 7 +++++-- selinux-policy/tlp-and-similar/runtest.sh | 9 +++++++++ 3 files changed, 16 insertions(+), 3 deletions(-) diff --git a/selinux-policy/tlp-and-similar/Makefile b/selinux-policy/tlp-and-similar/Makefile index 386b5bd..ed881d4 100644 --- a/selinux-policy/tlp-and-similar/Makefile +++ b/selinux-policy/tlp-and-similar/Makefile @@ -55,7 +55,7 @@ $(METADATA): Makefile @echo "TestTime: 10m" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) @echo "RunFor: tlp" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console expect openssh-clients tlp rfkill" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console expect openssh-clients tlp rfkill snapd /usr/sbin/service" >> $(METADATA) @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @@ -64,6 +64,7 @@ $(METADATA): Makefile @echo "Destructive: no" >> $(METADATA) @echo "Releases: -RHEL4 -RHEL5" >> $(METADATA) @echo "Bug: 1460481" >> $(METADATA) # RHEL-7 + @echo "Bug: 2221019" >> $(METADATA) # Fedora 38 rhts-lint $(METADATA) diff --git a/selinux-policy/tlp-and-similar/main.fmf b/selinux-policy/tlp-and-similar/main.fmf index 4dca1a4..cc29570 100644 --- a/selinux-policy/tlp-and-similar/main.fmf +++ b/selinux-policy/tlp-and-similar/main.fmf @@ -19,6 +19,8 @@ recommend: - openssh-clients - tlp - rfkill + - snapd + - /usr/sbin/service environment: AVC_ERROR: +no_avc_check duration: 10m @@ -27,17 +29,18 @@ tag: - NoRHEL4 - NoRHEL5 - TIPpass_Security - - TierCandidatesFAIL + - failinfedora - f33friendly - targeted link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1460481 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2221019 adjust: - enabled: false when: arch == s390x continue: false - enabled: false - when: distro == rhel-4, rhel-5, rhel-9 + when: distro == rhel-4, rhel-5 continue: false extra-nitrate: TC#0569976 extra-summary: /CoreOS/selinux-policy/Regression/tlp-and-similar diff --git a/selinux-policy/tlp-and-similar/runtest.sh b/selinux-policy/tlp-and-similar/runtest.sh index 469a1db..9e39d97 100755 --- a/selinux-policy/tlp-and-similar/runtest.sh +++ b/selinux-policy/tlp-and-similar/runtest.sh @@ -81,7 +81,16 @@ rlJournalStart rlPhaseEnd fi + if rlSEDefined "snappy_var_lib_t" ; then + rlPhaseStartTest "bz#2221019" + rlSESearchRule "dontaudit tlp_t snappy_var_lib_t : dir { search } [ ]" + rlPhaseEnd + fi + rlPhaseStartTest "real scenario -- standalone service" + if rpm -q snapd >& /dev/null ; then + rlRun "ls -alRZ /var/lib/snapd" + fi rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" if ! rlSEDefined ${PROCESS_CONTEXT} ; then if rlIsRHEL 5 6 ; then From 5fc4b5a48e47c310506c9dd8fd0e94f5071f590a Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Thu, 21 Sep 2023 15:57:51 +0200 Subject: [PATCH 299/626] test fcontext equivalences via the restorecond service A recent bug report revealed that the restorecond service (after its start) mislabels files in the /usr/bin/ directory when its configuration file (/etc/selinux/restorecond.conf) contains the following line: /bin/* Further investigation revealed that the problem is caused by the selinux-policy component which does not define a file context equivalency between /bin and /usr/bin (/bin is a symlink to /usr/bin). The TC reproduces the situation and it also tests other symlinks which are present in /. The restorecond service behaved correctly the whole time. The TC covers RHEL-5032. --- .../main.fmf | 31 +++++++++++++++++++ .../restorecond-fcontext-equivalences/test.sh | 29 +++++++++++++++++ 2 files changed, 60 insertions(+) create mode 100644 selinux-policy/restorecond-fcontext-equivalences/main.fmf create mode 100755 selinux-policy/restorecond-fcontext-equivalences/test.sh diff --git a/selinux-policy/restorecond-fcontext-equivalences/main.fmf b/selinux-policy/restorecond-fcontext-equivalences/main.fmf new file mode 100644 index 0000000..30bd38d --- /dev/null +++ b/selinux-policy/restorecond-fcontext-equivalences/main.fmf @@ -0,0 +1,31 @@ +summary: the restorecond service honors fcontext equivalences +description: | + The restorecond service mislabels files when fcontext equivalences + (shipped by the selinux-policy component) are not configured properly. +test: ./test.sh +framework: beakerlib +contact: Milos Malik +component: + - selinux-policy +recommend: + - selinux-policy + - policycoreutils + - policycoreutils-restorecond + - /usr/sbin/service +duration: 15m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - failinfedora + - targeted +link: + - verifies: https://issues.redhat.com/browse/RHEL-5032 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + continue: false +extra-nitrate: TC#0615936 +id: 14b57b44-c644-48fb-a3a1-b4c57da675a6 diff --git a/selinux-policy/restorecond-fcontext-equivalences/test.sh b/selinux-policy/restorecond-fcontext-equivalences/test.sh new file mode 100755 index 0000000..a820705 --- /dev/null +++ b/selinux-policy/restorecond-fcontext-equivalences/test.sh @@ -0,0 +1,29 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm selinux-policy + rlAssertRpm policycoreutils-restorecond + rlServiceStop restorecond + rlFileBackup /etc/selinux/restorecond.conf + # add locations which are in fact symlinks + rlRun "echo -en '\n/bin/*\n/sbin/*\n/lib/*\n/lib64/*\n' >> /etc/selinux/restorecond.conf" + rlPhaseEnd + + rlPhaseStartTest "RHEL-5032" + rlRun "service restorecond start" + rlRun "service restorecond status" + rlRun -s "restorecon -Rv /usr/bin /usr/sbin /usr/lib /usr/lib64" + rlRun "grep -i 'relabeled.*from.*to' $rlRun_LOG" 1 + rm -f $rlRun_LOG + rlRun "service restorecond stop" + rlPhaseEnd + + rlPhaseStartCleanup + rlFileRestore + rlServiceRestore restorecond + rlPhaseEnd +rlJournalEnd + From f477da1bf52d3f657b7005a86b65e59766213f53 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Thu, 2 Nov 2023 16:32:48 +0100 Subject: [PATCH 300/626] test if dhcpcd can use the bpf capability A recent dhcpcd testing revealed that SELinux denials appear when the dhcpcd service (in default configuration) is started on RHEL-9. The TC reproduces the situation. In order to avoid such SELinux denials, I believe that SELinux policy should either allow or dontaudit them. The TC looks for appropriate policy rules. The TC covers RHEL-15326. --- selinux-policy/dhcpcd-and-similar/Makefile | 1 + selinux-policy/dhcpcd-and-similar/main.fmf | 5 +++-- selinux-policy/dhcpcd-and-similar/runtest.sh | 12 ++++++++++-- 3 files changed, 14 insertions(+), 4 deletions(-) diff --git a/selinux-policy/dhcpcd-and-similar/Makefile b/selinux-policy/dhcpcd-and-similar/Makefile index 4259442..c714f6f 100644 --- a/selinux-policy/dhcpcd-and-similar/Makefile +++ b/selinux-policy/dhcpcd-and-similar/Makefile @@ -64,6 +64,7 @@ $(METADATA): Makefile @echo "Releases: -RHEL4 -RHEL5 -RHEL6" >> $(METADATA) @echo "Bug: 1585971" >> $(METADATA) # Fedora 28 @echo "Bug: 1602343" >> $(METADATA) # Fedora 28 + @echo "Bug: RHEL-15326" >> $(METADATA) # RHEL-9 rhts-lint $(METADATA) diff --git a/selinux-policy/dhcpcd-and-similar/main.fmf b/selinux-policy/dhcpcd-and-similar/main.fmf index 97f512c..0f9dc46 100644 --- a/selinux-policy/dhcpcd-and-similar/main.fmf +++ b/selinux-policy/dhcpcd-and-similar/main.fmf @@ -29,10 +29,11 @@ tag: link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1585971 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1602343 + - verifies: https://issues.redhat.com/browse/RHEL-15326 adjust: - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7, rhel-8, rhel-9 - continue: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7 + because: the dhcpcd package is not available there extra-nitrate: TC#0574611 extra-summary: /CoreOS/selinux-policy/Regression/dhcpcd-and-similar extra-task: /CoreOS/selinux-policy/Regression/dhcpcd-and-similar diff --git a/selinux-policy/dhcpcd-and-similar/runtest.sh b/selinux-policy/dhcpcd-and-similar/runtest.sh index 79fad7a..9b9e133 100755 --- a/selinux-policy/dhcpcd-and-similar/runtest.sh +++ b/selinux-policy/dhcpcd-and-similar/runtest.sh @@ -40,7 +40,7 @@ PROCESS_CONTEXT="dhcpc_t" rlJournalStart rlPhaseStartSetup - if rlIsRHEL ; then + if rlIsRHEL 4 5 6 ; then rlLog "Not applicable to this OS version." rlJournalEnd exit 0 @@ -85,6 +85,12 @@ rlJournalStart rlSESearchRule "allow dhcpc_t dhcpc_var_run_t : sock_file { create unlink }" rlPhaseEnd + if rlIsRHEL 9 || rlIsCentOS 9 ; then + rlPhaseStartTest "RHEL-15326" + rlSESearchRule "allow dhcpc_t dhcpc_t : capability2 { bpf } [ ]" + rlPhaseEnd + fi + rlPhaseStartTest "real scenario -- standalone service" rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" if ! rlSEDefined ${PROCESS_CONTEXT} ; then @@ -94,7 +100,9 @@ rlJournalStart PROCESS_CONTEXT="unconfined_service_t" fi fi - rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status restart status stop status" 1 + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /etc /var /run -e /var/ARTIFACTS" 0-255 + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd rlPhaseStartCleanup From 8d1a0ebb57f66075bd94cb4fe239c9921a6da5bc Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Thu, 9 Nov 2023 15:44:34 +0100 Subject: [PATCH 301/626] test if definitions of policy interfaces are correct A recent testing of the sepolgen-ifgen tool revealed that certain policy interface definitions are not correct. The TC reproduces the situation. Even though the problem exists (unnoticed) for some time already, I believe that we should ship valid and correctly defined policy interfaces. The TC covers RHEL-2616. --- selinux-policy/interface-definitions/main.fmf | 26 +++++++++++++++++++ .../interface-definitions/runtest.sh | 20 ++++++++++++++ 2 files changed, 46 insertions(+) create mode 100644 selinux-policy/interface-definitions/main.fmf create mode 100755 selinux-policy/interface-definitions/runtest.sh diff --git a/selinux-policy/interface-definitions/main.fmf b/selinux-policy/interface-definitions/main.fmf new file mode 100644 index 0000000..0c2b9a3 --- /dev/null +++ b/selinux-policy/interface-definitions/main.fmf @@ -0,0 +1,26 @@ +summary: Are all policy interfaces defined correctly? +contact: Milos Malik +component: + - selinux-policy + - policycoreutils +recommend: + - /usr/bin/sepolgen-ifgen + - selinux-policy + - selinux-policy-targeted +test: ./runtest.sh +framework: beakerlib +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - targeted +link: + - verifies: https://issues.redhat.com/browse/RHEL-2616 + - verifies: https://issues.redhat.com/browse/RHEL-16185 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5 + because: decision was made not to fix the problem there +extra-nitrate: TC#0615941 +id: a6785475-8446-47cc-9167-f2d6ad52d58e diff --git a/selinux-policy/interface-definitions/runtest.sh b/selinux-policy/interface-definitions/runtest.sh new file mode 100755 index 0000000..6d80041 --- /dev/null +++ b/selinux-policy/interface-definitions/runtest.sh @@ -0,0 +1,20 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm selinux-policy + rlAssertRpm policycoreutils + rlPhaseEnd + + rlPhaseStartTest "RHEL-2616 + RHEL-16185" + rlRun "sepolgen-ifgen -v -d 2>/dev/null | sort | uniq > output.txt" + rlRun "grep -i missing output.txt" 1 + rlPhaseEnd + + rlPhaseStartCleanup + rm -f output.txt + rlPhaseEnd +rlJournalEnd + From fec8a047876d68cade5edc3b30b18fd4cb45eb6d Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Wed, 1 Nov 2023 09:07:47 +0100 Subject: [PATCH 302/626] add Makefiles to tests executed via STI Certain automated tests do not have Makefiles, which prevents them from being executed by STI means. The situation leads to error messages like this one: FAIL test selinux/selinux-policy/... do not know how to run test In order to successfully execute them, appropriate Makefiles will be added. --- selinux-policy/systemd-localed/Makefile | 71 +++++++++++++++++++ selinux-policy/systemd-localed/main.fmf | 4 +- .../systemd-localed/{test.sh => runtest.sh} | 2 +- 3 files changed, 75 insertions(+), 2 deletions(-) create mode 100644 selinux-policy/systemd-localed/Makefile rename selinux-policy/systemd-localed/{test.sh => runtest.sh} (96%) diff --git a/selinux-policy/systemd-localed/Makefile b/selinux-policy/systemd-localed/Makefile new file mode 100644 index 0000000..8727c1e --- /dev/null +++ b/selinux-policy/systemd-localed/Makefile @@ -0,0 +1,71 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/systemd-localed +# Description: SELinux interferes with systemd-localed and localectl +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2023 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/systemd-localed +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + test -x runtest.sh || chmod a+x runtest.sh + test -x runtest.sh || chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with systemd-localed and localectl" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "RunFor: systemd" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console /usr/sbin/service systemd" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) + @echo "Bug: 2240159" >> $(METADATA) # Fedora 38 + @echo "Bug: RHEL-16715" >> $(METADATA) # RHEL-8 + @echo "Bug: RHEL-16716" >> $(METADATA) # RHEL-9 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/systemd-localed/main.fmf b/selinux-policy/systemd-localed/main.fmf index 151a009..02d31cc 100644 --- a/selinux-policy/systemd-localed/main.fmf +++ b/selinux-policy/systemd-localed/main.fmf @@ -1,5 +1,5 @@ summary: SELinux interferes with systemd-localed and localectl -test: ./test.sh +test: ./runtest.sh framework: beakerlib contact: Milos Malik component: @@ -28,6 +28,8 @@ tag: - targeted link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2240159 + - verifies: https://issues.redhat.com/browse/RHEL-16715 + - verifies: https://issues.redhat.com/browse/RHEL-16716 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 diff --git a/selinux-policy/systemd-localed/test.sh b/selinux-policy/systemd-localed/runtest.sh similarity index 96% rename from selinux-policy/systemd-localed/test.sh rename to selinux-policy/systemd-localed/runtest.sh index 84ba7d2..e104b55 100755 --- a/selinux-policy/systemd-localed/test.sh +++ b/selinux-policy/systemd-localed/runtest.sh @@ -21,7 +21,7 @@ rlJournalStart sleep 2 rlPhaseEnd - rlPhaseStartTest "bz#2240159" + rlPhaseStartTest "bz#2240159 + RHEL-16715 + RHEL-16716" rlSEMatchPathCon "/usr/lib/systemd/systemd-localed" "systemd_localed_exec_t" rlSEMatchPathCon "/etc/X11/xorg.conf.d" "xserver_etc_t" rlSESearchRule "allow systemd_localed_t xserver_etc_t : dir { create } [ ]" From bc9e323cd44129e3693a8c2fa6616b912bd8aaaa Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Mon, 20 Nov 2023 18:32:07 +0100 Subject: [PATCH 303/626] add a basic test of the getpolicyload program SELinux user-space version 3.6 introduced a new program called getpolicyload. Unfortunately, there is no man page which would describe the program. Purpose of this automated test is to test the basic function of the getpolicyload program that is obvious from its behavior. --- libselinux/getpolicyload/main.fmf | 21 +++++++++++++++++++++ libselinux/getpolicyload/runtest.sh | 27 +++++++++++++++++++++++++++ 2 files changed, 48 insertions(+) create mode 100644 libselinux/getpolicyload/main.fmf create mode 100755 libselinux/getpolicyload/runtest.sh diff --git a/libselinux/getpolicyload/main.fmf b/libselinux/getpolicyload/main.fmf new file mode 100644 index 0000000..4fb2496 --- /dev/null +++ b/libselinux/getpolicyload/main.fmf @@ -0,0 +1,21 @@ +summary: basic test for the getpolicyload program +test: ./runtest.sh +framework: beakerlib +component: + - libselinux +recommends: + - libselinux + - libselinux-utils + - policycoreutils +duration: 5m +enabled: true +link: + - relates: https://issues.redhat.com/browse/RHEL-16233 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 + because: the getpolicyload program is not available there + - enabled: false + when: distro < fedora-40 + because: the getpolicyload program is not available there + diff --git a/libselinux/getpolicyload/runtest.sh b/libselinux/getpolicyload/runtest.sh new file mode 100755 index 0000000..1954763 --- /dev/null +++ b/libselinux/getpolicyload/runtest.sh @@ -0,0 +1,27 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm libselinux + rlAssertRpm libselinux-utils + rlAssertRpm policycoreutils + rlRun "sestatus" + rlPhaseEnd + + rlPhaseStartTest + for CMD in "semodule -R" "semodule -B" "semodule --refresh" "load_policy" "load_policy -i" ; do + BEFORE=`getpolicyload` + rlRun "getpolicyload" + rlRun "${CMD}" + AFTER=`getpolicyload` + rlRun "getpolicyload" + rlAssertGreater "the number of policy loads increased" ${AFTER} ${BEFORE} + done + rlPhaseEnd + + rlPhaseStartCleanup + rlPhaseEnd +rlJournalEnd + From ef67d0deea003d009673bd22fe0b8f7a7999f53a Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 21 Nov 2023 12:38:36 +0100 Subject: [PATCH 304/626] test the actions recognized by sedismod and sedispol Since SELinux user-space 3.6 was introduced, the sedismod and sedispol programs are able to perform various actions non-interactively when the following options are supplied: -a, --actions. In previous versions, these actions were only usable in the interactive mode. From now on, the automated test also covers these options. --- checkpolicy/sedismod/runtest.sh | 12 ++++++++++++ checkpolicy/sedispol/runtest.sh | 12 ++++++++++++ 2 files changed, 24 insertions(+) diff --git a/checkpolicy/sedismod/runtest.sh b/checkpolicy/sedismod/runtest.sh index c15b882..8227ccb 100755 --- a/checkpolicy/sedismod/runtest.sh +++ b/checkpolicy/sedismod/runtest.sh @@ -74,6 +74,18 @@ rlJournalStart done rlPhaseEnd + if sedismod --help | grep -q actions ; then + rlPhaseStartTest "test the non-interactive actions" + rlLog "introduced in version 3.6" + for ACTION in 1 2 3 4 5 6 7 8 9 0 a b c u F v ; do + rlRun "sedismod -a ${ACTION} ${POLICY_FILE} > ${ACTION}.txt" + rlRun "ls -l ${ACTION}.txt" + rlRun "test -s ${ACTION}.txt" + rlRun "rm -f ${ACTION}.txt" + done + rlPhaseEnd + fi + rlPhaseStartCleanup rlRun "rm -f ${OUTPUT_FILE} ${POLICY_FILE}" rlPhaseEnd diff --git a/checkpolicy/sedispol/runtest.sh b/checkpolicy/sedispol/runtest.sh index 3a182e1..ac198ff 100755 --- a/checkpolicy/sedispol/runtest.sh +++ b/checkpolicy/sedispol/runtest.sh @@ -68,6 +68,18 @@ rlJournalStart rlRun "grep permisions ${OUTPUT_FILE}" 1 rlPhaseEnd + if sedispol --help | grep -q actions ; then + rlPhaseStartTest "test the non-interactive actions" + rlLog "introduced in version 3.6" + for ACTION in 1 2 3 4 5 6 8 c b C r t a p u F ; do + rlRun "sedispol -a ${ACTION} ${POLICY_FILE} > ${ACTION}.txt" + rlRun "ls -l ${ACTION}.txt" + rlRun "test -s ${ACTION}.txt" + rlRun "rm -f ${ACTION}.txt" + done + rlPhaseEnd + fi + rlPhaseStartCleanup rlRun "rm -f ${OUTPUT_FILE}" rlPhaseEnd From ef0547613f3527b4c44042e7dfd0d37d0238e99b Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 5 Dec 2023 11:07:41 +0100 Subject: [PATCH 305/626] test if setools can be built with userspace packages A recent rebuild testing in COPR revealed that the setools package cannot be built with the latest SELinux userspace (version 3.6). The TC reproduces the situation. In order to have a well-functioning set of tools for SELinux policy analysis which works together with the new version of SELinux userspace, I believe that the problem needs to be fixed. The TC covers BZ#2251915 and RHEL-18067. --- setools/rebuild-from-srpm/main.fmf | 32 ++++++++++++++++++++++++++++ setools/rebuild-from-srpm/runtest.sh | 32 ++++++++++++++++++++++++++++ 2 files changed, 64 insertions(+) create mode 100644 setools/rebuild-from-srpm/main.fmf create mode 100755 setools/rebuild-from-srpm/runtest.sh diff --git a/setools/rebuild-from-srpm/main.fmf b/setools/rebuild-from-srpm/main.fmf new file mode 100644 index 0000000..01286da --- /dev/null +++ b/setools/rebuild-from-srpm/main.fmf @@ -0,0 +1,32 @@ +summary: Can setools be built from its source RPM? +contact: Milos Malik +component: + - setools +test: ./runtest.sh +framework: beakerlib +recommend: + - dnf-utils + - rpm-build + - libsepol + - libsemanage + - libselinux + - policycoreutils +duration: 10m +enabled: true +tier: 1 +tag: + - CI-Tier-1 + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - targeted +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2251915 + - verifies: https://issues.redhat.com/browse/RHEL-18067 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + continue: false +extra-nitrate: TC#0616295 +id: 37430912-7a9e-40e7-a569-cbef9529b9e3 diff --git a/setools/rebuild-from-srpm/runtest.sh b/setools/rebuild-from-srpm/runtest.sh new file mode 100755 index 0000000..b52fc95 --- /dev/null +++ b/setools/rebuild-from-srpm/runtest.sh @@ -0,0 +1,32 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm libsepol + rlAssertRpm libsemanage + rlAssertRpm libselinux + rlAssertRpm policycoreutils + rlRun "rm -f setools*.src.rpm" + rlRun "yumdownloader --source setools" + rlRun "ls -l setools*src.rpm" + rlPhaseEnd + + rlPhaseStartTest "bz#2251915 + RHEL-18067" + if rlIsRHEL ; then + rlRun "yum-builddep -y setools --enablerepo rhel-CRB" + elif rlIsCentOS ; then + rlRun "yum-builddep -y setools --enablerepo crb" + else # Fedora + rlRun "yum-builddep -y setools" + fi + rlRun "rpmbuild --rebuild setools*.src.rpm" + rlRun "ls -lR ~/rpmbuild/RPMS | grep setools" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "rm -f setools*.src.rpm" + rlPhaseEnd +rlJournalEnd + From ea51c052195a1702b1b2013a0c77a3c6efc40e2a Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Thu, 30 Nov 2023 21:15:27 +0100 Subject: [PATCH 306/626] test if smtpd can manipulate the /run/smtpd.pid file A recent opensmtpd testing revealed that SELinux prevents the smtpd process from creating and manipulating the /run/smtpd.pid file. The TC reproduces the situation. In order to successfully start and run the opensmtpd service, I believe that SELinux policy should allow these actions. The TC looks for appropriate policy rules. The TC covers RHEL-15175. --- selinux-policy/opensmtpd-and-similar/Makefile | 3 ++- selinux-policy/opensmtpd-and-similar/main.fmf | 3 ++- selinux-policy/opensmtpd-and-similar/runtest.sh | 5 +++++ 3 files changed, 9 insertions(+), 2 deletions(-) diff --git a/selinux-policy/opensmtpd-and-similar/Makefile b/selinux-policy/opensmtpd-and-similar/Makefile index a59edb8..a053a8f 100644 --- a/selinux-policy/opensmtpd-and-similar/Makefile +++ b/selinux-policy/opensmtpd-and-similar/Makefile @@ -54,7 +54,7 @@ $(METADATA): Makefile @echo "Type: Regression" >> $(METADATA) @echo "TestTime: 10m" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console opensmtpd /usr/sbin/service mailx" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console opensmtpd /usr/sbin/service /usr/bin/mailx" >> $(METADATA) @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @@ -64,6 +64,7 @@ $(METADATA): Makefile @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA) @echo "Bug: 2208696" >> $(METADATA) # Fedora 38 @echo "Bug: 2246115" >> $(METADATA) # Fedora rawhide + @echo "Bug: RHEL-15175" >> $(METADATA) # RHEL-9 rhts-lint $(METADATA) diff --git a/selinux-policy/opensmtpd-and-similar/main.fmf b/selinux-policy/opensmtpd-and-similar/main.fmf index b014b17..1e8c31e 100644 --- a/selinux-policy/opensmtpd-and-similar/main.fmf +++ b/selinux-policy/opensmtpd-and-similar/main.fmf @@ -17,7 +17,7 @@ recommend: - setools-console - opensmtpd - /usr/sbin/service - - mailx + - /usr/bin/mailx environment: AVC_ERROR: +no_avc_check duration: 10m @@ -31,6 +31,7 @@ tag: link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2208696 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2246115 + - verifies: https://issues.redhat.com/browse/RHEL-15175 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 diff --git a/selinux-policy/opensmtpd-and-similar/runtest.sh b/selinux-policy/opensmtpd-and-similar/runtest.sh index bb1b4d6..ea750ad 100755 --- a/selinux-policy/opensmtpd-and-similar/runtest.sh +++ b/selinux-policy/opensmtpd-and-similar/runtest.sh @@ -67,6 +67,11 @@ rlJournalStart rlSEMatchPathCon "/run/smtpd.sock" "sendmail_var_run_t" rlSESearchRule "allow sendmail_t sendmail_t : unix_stream_socket { connectto } [ ]" rlPhaseEnd + + rlPhaseStartTest "RHEL-15175" + # actions on the /var/run/smtpd.pid file + rlSESearchRule "allow sendmail_t sendmail_var_run_t : file { create getattr open unlink write } [ ]" + rlPhaseEnd fi rlPhaseStartTest "real scenario -- standalone service" From b7731c9f6387dadcb3939b7b28c6667bdb00d2cc Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Wed, 6 Dec 2023 20:27:40 +0100 Subject: [PATCH 307/626] test if deny rules are implemented/recognized The version 3.6 of SELinux userspace brings a new policy feature called deny rules. Purpose of this basic test is to find out if the deny rules function as expected. The automated test covers the following scenarios: * file read prevention * file execution prevention * file removal prevention * directory search prevention * process ptrace prevention * kernel module load prevention --- selinux-policy/deny-rules/main.fmf | 30 ++++++++++ selinux-policy/deny-rules/runtest.sh | 90 ++++++++++++++++++++++++++++ 2 files changed, 120 insertions(+) create mode 100644 selinux-policy/deny-rules/main.fmf create mode 100755 selinux-policy/deny-rules/runtest.sh diff --git a/selinux-policy/deny-rules/main.fmf b/selinux-policy/deny-rules/main.fmf new file mode 100644 index 0000000..eb66a3a --- /dev/null +++ b/selinux-policy/deny-rules/main.fmf @@ -0,0 +1,30 @@ +summary: Basic functional test of the deny rules in SELinux policy +contact: Milos Malik +test: ./runtest.sh +framework: beakerlib +component: + - selinux-policy +recommend: + - libsepol + - libsemanage + - libselinux + - policycoreutils + - selinux-policy + - strace +duration: 10m +enabled: true +tier: 1 +tag: + - CI-Tier-1 + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - NoRHEL8 + - targeted +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-8 + because: deny rules are not recognized/implemented there +extra-nitrate: TC#0616661 +id: 3221e55d-6039-40f6-b9ff-6a02e85948e7 diff --git a/selinux-policy/deny-rules/runtest.sh b/selinux-policy/deny-rules/runtest.sh new file mode 100755 index 0000000..19f77e2 --- /dev/null +++ b/selinux-policy/deny-rules/runtest.sh @@ -0,0 +1,90 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm libsepol + rlAssertRpm libsemanage + rlAssertRpm libselinux + rlAssertRpm policycoreutils + rlAssertRpm selinux-policy + rlRun "setenforce 1" + rlRun "sestatus" + rlPhaseEnd + + rlPhaseStartTest "prevent the reading of a file" + rlRun "stat /etc/shadow" 0 + rlRun "grep ^bin /etc/shadow" 0 + rlRun "echo -e '( deny unconfined_t shadow_t ( file ( getattr read )))' > testpolicy.cil" + rlRun "semodule -i testpolicy.cil" + rlRun "semodule -lfull | grep testpolicy" + rlRun "stat /etc/shadow" 1 + rlRun "grep ^bin /etc/shadow" 2 + rlRun "semodule -r testpolicy" + rlPhaseEnd + + rlPhaseStartTest "prevent the execution of a file" + rlRun "dmesg >& /dev/null" + rlRun "echo -e '( deny unconfined_t dmesg_exec_t ( file ( execute execute_no_trans )))' > testpolicy.cil" + rlRun "semodule -i testpolicy.cil" + rlRun "semodule -lfull | grep testpolicy" + rlRun "dmesg" 126 + rlRun "semodule -r testpolicy" + rlPhaseEnd + + rlPhaseStartTest "prevent removal of a file" + if [ -f /etc/machine-id ] ; then + rlRun "cp -a /etc/machine-id ." + else + rlRun "cp -a /run/machine-id ." + fi + rlRun "ls -Z ./machine-id" + rlRun "echo -e '( deny unconfined_t machineid_t ( file ( unlink )))' > testpolicy.cil" + rlRun "semodule -i testpolicy.cil" + rlRun "semodule -lfull | grep testpolicy" + rlRun "rm -f ./machine-id" 1,2 + rlRun "semodule -r testpolicy" + rlRun "rm -f ./machine-id" + rlPhaseEnd + + rlPhaseStartTest "prevent the search in a directory" + rlRun "ls -lZR /etc/pki >& /dev/null" + rlRun "echo -e '( deny unconfined_t cert_t ( dir ( search )))' > testpolicy.cil" + rlRun "semodule -i testpolicy.cil" + rlRun "semodule -lfull | grep testpolicy" + rlRun "ls -lZR /etc/pki" 1 + rlRun "semodule -r testpolicy" + rlPhaseEnd + + rlPhaseStartTest "prevent ptracing of processes" + rlWatchdog "strace -p $$" 5 + rlRun "echo -e '( deny unconfined_t unconfined_t ( process ( ptrace )))' > testpolicy.cil" + rlRun "semodule -i testpolicy.cil" + rlRun "semodule -lfull | grep testpolicy" + rlRun -s "strace -p $$" 1 + rlRun "grep -i 'permission denied' $rlRun_LOG" + rm -f $rlRun_LOG + rlRun "semodule -r testpolicy" + rlPhaseEnd + + rlPhaseStartTest "prevent loading of kernel modules" + if lsmod | grep -q dummy ; then + rlRun "modprobe -r dummy" + fi + rlRun "echo -e '( deny unconfined_t unconfined_t ( system ( module_load module_request )))' > testpolicy.cil" + rlRun "semodule -i testpolicy.cil" + rlRun "semodule -lfull | grep testpolicy" + rlRun -s "modprobe dummy" 1 + rlRun "grep -i 'permission denied' $rlRun_LOG" + rm -f $rlRun_LOG + rlRun "lsmod | grep dummy" 1 + rlRun "semodule -r testpolicy" + rlRun "modprobe dummy" + rlRun "lsmod | grep dummy" + rlPhaseEnd + + rlPhaseStartCleanup + rlPhaseEnd +rlJournalEnd + From 3b016979c577f7f914f59efdb7a1580e4c684958 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 12 Dec 2023 16:47:29 +0100 Subject: [PATCH 308/626] enable more repos for rebuild purposes If the rebuild (src -> bin) of setools component should be successful, additional repositories (rhel-CRB, beaker-CRB) need to be enabled. --- setools/rebuild-from-srpm/runtest.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/setools/rebuild-from-srpm/runtest.sh b/setools/rebuild-from-srpm/runtest.sh index b52fc95..698c4ef 100755 --- a/setools/rebuild-from-srpm/runtest.sh +++ b/setools/rebuild-from-srpm/runtest.sh @@ -15,7 +15,7 @@ rlJournalStart rlPhaseStartTest "bz#2251915 + RHEL-18067" if rlIsRHEL ; then - rlRun "yum-builddep -y setools --enablerepo rhel-CRB" + rlRun "yum-builddep -y setools --enablerepo '*CRB'" elif rlIsCentOS ; then rlRun "yum-builddep -y setools --enablerepo crb" else # Fedora From 26edd450042ceb9e15be6f2b571066eda0f46132 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Fri, 15 Dec 2023 13:52:05 +0100 Subject: [PATCH 309/626] adapt to modified sedispol commands The sedispol tool recognizes several commands. Before the checkpolicy version 3.6 was introduced, one of the commands was 'u' which displayed unknown handling setting. With the new version, the 'u' command prints SELinux users which are defined and the 'U' command displays the unknown handling setting. --- checkpolicy/sedispol/main.fmf | 1 + checkpolicy/sedispol/runtest.sh | 5 +++-- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/checkpolicy/sedispol/main.fmf b/checkpolicy/sedispol/main.fmf index f6506f7..0888f3f 100644 --- a/checkpolicy/sedispol/main.fmf +++ b/checkpolicy/sedispol/main.fmf @@ -31,3 +31,4 @@ adjust: extra-nitrate: TC#0518626 extra-summary: /CoreOS/checkpolicy/Sanity/sedispol extra-task: /CoreOS/checkpolicy/Sanity/sedispol +id: bbeea40d-d503-4862-91ee-3bb1b71b7baa diff --git a/checkpolicy/sedispol/runtest.sh b/checkpolicy/sedispol/runtest.sh index ac198ff..e785220 100755 --- a/checkpolicy/sedispol/runtest.sh +++ b/checkpolicy/sedispol/runtest.sh @@ -64,14 +64,15 @@ rlJournalStart rlRun "grep AVTAB ${OUTPUT_FILE}" rlRun "grep AVTAG ${OUTPUT_FILE}" 1 rlRun "echo -en 'u\nq\n' | sedispol ${POLICY_FILE} >& ${OUTPUT_FILE}" - rlRun "grep permissions ${OUTPUT_FILE}" + rlRun "grep permisions ${OUTPUT_FILE}" 1 + rlRun "echo -en 'U\nq\n' | sedispol ${POLICY_FILE} >& ${OUTPUT_FILE}" rlRun "grep permisions ${OUTPUT_FILE}" 1 rlPhaseEnd if sedispol --help | grep -q actions ; then rlPhaseStartTest "test the non-interactive actions" rlLog "introduced in version 3.6" - for ACTION in 1 2 3 4 5 6 8 c b C r t a p u F ; do + for ACTION in 1 2 3 4 5 6 8 c b C r t a p u U F ; do rlRun "sedispol -a ${ACTION} ${POLICY_FILE} > ${ACTION}.txt" rlRun "ls -l ${ACTION}.txt" rlRun "test -s ${ACTION}.txt" From f80d8f1fead645e9ce1caa3fbf4d7e6e20e7aee7 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Mon, 11 Dec 2023 15:32:04 +0100 Subject: [PATCH 310/626] adapt to testing under confined users too The root user on a system is usually not confined by SELinux (context: unconfined_u:unconfined_r:unconfined_t), but there are security standarts which require the root user to be confined by SELinux (context: sysadm_u:sysadm_r:sysadm_t). In order to use this automated test on such systems, certain code changes were necessary. --- selinux-policy/deny-rules/main.fmf | 1 + selinux-policy/deny-rules/runtest.sh | 79 ++++++++++++++++++++++------ selinux-policy/deny-rules/ssh.exp | 20 +++++++ 3 files changed, 83 insertions(+), 17 deletions(-) create mode 100755 selinux-policy/deny-rules/ssh.exp diff --git a/selinux-policy/deny-rules/main.fmf b/selinux-policy/deny-rules/main.fmf index eb66a3a..6f2625a 100644 --- a/selinux-policy/deny-rules/main.fmf +++ b/selinux-policy/deny-rules/main.fmf @@ -11,6 +11,7 @@ recommend: - policycoreutils - selinux-policy - strace + - expect duration: 10m enabled: true tier: 1 diff --git a/selinux-policy/deny-rules/runtest.sh b/selinux-policy/deny-rules/runtest.sh index 19f77e2..73f96af 100755 --- a/selinux-policy/deny-rules/runtest.sh +++ b/selinux-policy/deny-rules/runtest.sh @@ -2,67 +2,104 @@ # vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k . /usr/share/beakerlib/beakerlib.sh || exit 1 +USER_CONTEXT=${USER_CONTEXT:-"sysadm_u:sysadm_r:sysadm_t"} +SELINUX_USER=`echo ${USER_CONTEXT} | cut -d : -f 1` +USER_ROLE=`echo ${USER_CONTEXT} | cut -d : -f 2` +USER_TYPE=`echo ${USER_CONTEXT} | cut -d : -f 3` +USER_NAME="user${RANDOM}" +USER_SECRET="S3krET${RANDOM}" + rlJournalStart + CUR_VERSION=`rpm -q --qf "%{version}" policycoreutils | head -n 1` + if rlTestVersion ${CUR_VERSION} '<' 3.6 ; then + rlLog "The installed SELinux userspace does NOT support deny rules." + rlLog "The automated test is NOT relevant for this environment." + rlJournalEnd + exit 0 + fi + rlPhaseStartSetup rlAssertRpm libsepol rlAssertRpm libsemanage rlAssertRpm libselinux rlAssertRpm policycoreutils rlAssertRpm selinux-policy + rlRun "setenforce 1" rlRun "sestatus" + rlRun "useradd -o -u 0 -g 0 -Z ${SELINUX_USER} ${USER_NAME}" + rlRun "echo ${USER_SECRET} | passwd --stdin ${USER_NAME}" + rlRun "setsebool ssh_sysadm_login on" + + rlFileBackup /etc/ssh/sshd_config + rlRun "sed -i 's/^.*PermitRootLogin.*$/PermitRootLogin yes/' /etc/ssh/sshd_config" + rlRun "sed -i 's/^.*PasswordAuthentication.*$/PasswordAuthentication yes/' /etc/ssh/sshd_config" + if [ -d /etc/ssh/sshd_config.d ] ; then + rlRun "echo 'PasswordAuthentication yes' > /etc/ssh/sshd_config.d/001-enable-password.conf" + fi + rlRun "service sshd restart" rlPhaseEnd rlPhaseStartTest "prevent the reading of a file" rlRun "stat /etc/shadow" 0 rlRun "grep ^bin /etc/shadow" 0 - rlRun "echo -e '( deny unconfined_t shadow_t ( file ( getattr read )))' > testpolicy.cil" + rlRun "echo -e '( deny ${USER_TYPE} shadow_t ( file ( getattr read )))' > testpolicy.cil" rlRun "semodule -i testpolicy.cil" rlRun "semodule -lfull | grep testpolicy" - rlRun "stat /etc/shadow" 1 - rlRun "grep ^bin /etc/shadow" 2 + rlRun -s "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost stat /etc/shadow" + rlRun "grep -i 'permission denied' $rlRun_LOG" + rm -f $rlRun_LOG + rlRun -s "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost grep ^bin /etc/shadow" + rlRun "grep -i 'permission denied' $rlRun_LOG" + rm -f $rlRun_LOG rlRun "semodule -r testpolicy" rlPhaseEnd rlPhaseStartTest "prevent the execution of a file" rlRun "dmesg >& /dev/null" - rlRun "echo -e '( deny unconfined_t dmesg_exec_t ( file ( execute execute_no_trans )))' > testpolicy.cil" + rlRun "echo -e '( deny ${USER_TYPE} dmesg_exec_t ( file ( execute execute_no_trans )))' > testpolicy.cil" rlRun "semodule -i testpolicy.cil" rlRun "semodule -lfull | grep testpolicy" - rlRun "dmesg" 126 + rlRun -s "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost dmesg" + rlRun "grep -i 'permission denied' $rlRun_LOG" + rm -f $rlRun_LOG rlRun "semodule -r testpolicy" rlPhaseEnd rlPhaseStartTest "prevent removal of a file" if [ -f /etc/machine-id ] ; then - rlRun "cp -a /etc/machine-id ." + rlRun "cp -a /etc/machine-id /home/${USER_NAME}/" else - rlRun "cp -a /run/machine-id ." + rlRun "cp -a /run/machine-id /home/${USER_NAME}/" fi - rlRun "ls -Z ./machine-id" - rlRun "echo -e '( deny unconfined_t machineid_t ( file ( unlink )))' > testpolicy.cil" + rlRun "ls -Z /home/${USER_NAME}/machine-id" + rlRun "echo -e '( deny ${USER_TYPE} machineid_t ( file ( unlink )))' > testpolicy.cil" rlRun "semodule -i testpolicy.cil" rlRun "semodule -lfull | grep testpolicy" - rlRun "rm -f ./machine-id" 1,2 + rlRun -s "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost rm -f /home/${USER_NAME}/machine-id" + rlRun "grep -i 'permission denied' $rlRun_LOG" + rm -f $rlRun_LOG rlRun "semodule -r testpolicy" - rlRun "rm -f ./machine-id" + rlRun "rm -f /home/${USER_NAME}/machine-id" rlPhaseEnd rlPhaseStartTest "prevent the search in a directory" rlRun "ls -lZR /etc/pki >& /dev/null" - rlRun "echo -e '( deny unconfined_t cert_t ( dir ( search )))' > testpolicy.cil" + rlRun "echo -e '( deny ${USER_TYPE} cert_t ( dir ( search )))' > testpolicy.cil" rlRun "semodule -i testpolicy.cil" rlRun "semodule -lfull | grep testpolicy" - rlRun "ls -lZR /etc/pki" 1 + rlRun -s "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost ls -lZR /etc/pki" + rlRun "grep -i 'permission denied' $rlRun_LOG" + rm -f $rlRun_LOG rlRun "semodule -r testpolicy" rlPhaseEnd rlPhaseStartTest "prevent ptracing of processes" rlWatchdog "strace -p $$" 5 - rlRun "echo -e '( deny unconfined_t unconfined_t ( process ( ptrace )))' > testpolicy.cil" + rlRun "echo -e '( deny ${USER_TYPE} ${USER_TYPE} ( process ( ptrace )))' > testpolicy.cil" rlRun "semodule -i testpolicy.cil" rlRun "semodule -lfull | grep testpolicy" - rlRun -s "strace -p $$" 1 + rlRun -s "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost strace -p $$" rlRun "grep -i 'permission denied' $rlRun_LOG" rm -f $rlRun_LOG rlRun "semodule -r testpolicy" @@ -72,10 +109,11 @@ rlJournalStart if lsmod | grep -q dummy ; then rlRun "modprobe -r dummy" fi - rlRun "echo -e '( deny unconfined_t unconfined_t ( system ( module_load module_request )))' > testpolicy.cil" + rlRun "echo -e '( deny ${USER_TYPE} ${USER_TYPE} ( system ( module_load module_request )))' > testpolicy.cil" + rlRun "echo -e '( deny kmod_t kmod_t ( system ( module_load module_request )))' >> testpolicy.cil" rlRun "semodule -i testpolicy.cil" rlRun "semodule -lfull | grep testpolicy" - rlRun -s "modprobe dummy" 1 + rlRun -s "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost modprobe dummy" rlRun "grep -i 'permission denied' $rlRun_LOG" rm -f $rlRun_LOG rlRun "lsmod | grep dummy" 1 @@ -85,6 +123,13 @@ rlJournalStart rlPhaseEnd rlPhaseStartCleanup + rlRun "setsebool ssh_sysadm_login off" + rlRun "userdel -rfZ ${USER_NAME}" + rlFileRestore + if [ -d /etc/ssh/sshd_config.d ] ; then + rlRun "rm -f /etc/ssh/sshd_config.d/001-enable-password.conf" + fi + rlRun "service sshd restart" rlPhaseEnd rlJournalEnd diff --git a/selinux-policy/deny-rules/ssh.exp b/selinux-policy/deny-rules/ssh.exp new file mode 100755 index 0000000..58c9647 --- /dev/null +++ b/selinux-policy/deny-rules/ssh.exp @@ -0,0 +1,20 @@ +#!/usr/bin/expect -f +# Expect script for SSH logging as $username to $hostname using $password and executing $command. +# Usage: +# ./ssh.exp username password hostname command +set username [lrange $argv 0 0] +set password [lrange $argv 1 1] +set hostname [lrange $argv 2 2] +set command [lrange $argv 3 10] +set timeout 15 +# connect to remote host and execute given command +log_user 1 +spawn ssh -t $username@$hostname $command +expect { + -nocase "yes/no" { send -- "yes\r" ; exp_continue } + -nocase "password" { send -- "$password\r" } +} +log_user 1 +# send -- "\r" +expect eof + From 29d2c154d9f02fc3e468bad10360e90212883911 Mon Sep 17 00:00:00 2001 From: Zdenek Pytela Date: Thu, 4 Jan 2024 22:09:17 +0100 Subject: [PATCH 311/626] Remove all check against the lockdown class The lockdown SELinux class was removed from kernel and no check is now performed in the SELinux lockdown hook as a comprehensive fix for all the SELinux lockdown-class related problems class was rejected, so no test checks using the lockdown class are now pertinent. The lockdown-class checks are now not in any supported systems kernels. Related: https://bugzilla.redhat.com/show_bug.cgi?id=2017848 --- .../runtest.sh | 7 -- .../dmidecode-and-similar/runtest.sh | 8 --- selinux-policy/lockdown-class/Makefile | 70 ------------------- selinux-policy/lockdown-class/PURPOSE | 5 -- selinux-policy/lockdown-class/main.fmf | 40 ----------- selinux-policy/lockdown-class/runtest.sh | 67 ------------------ .../runtest.sh | 3 - 7 files changed, 200 deletions(-) delete mode 100644 selinux-policy/lockdown-class/Makefile delete mode 100644 selinux-policy/lockdown-class/PURPOSE delete mode 100644 selinux-policy/lockdown-class/main.fmf delete mode 100755 selinux-policy/lockdown-class/runtest.sh diff --git a/selinux-policy/bz533007-unable-to-start-kdump-service/runtest.sh b/selinux-policy/bz533007-unable-to-start-kdump-service/runtest.sh index ba14f7e..fd3ec10 100755 --- a/selinux-policy/bz533007-unable-to-start-kdump-service/runtest.sh +++ b/selinux-policy/bz533007-unable-to-start-kdump-service/runtest.sh @@ -176,13 +176,6 @@ rlJournalStart rlPhaseEnd fi - if seinfo -c | grep -q lockdown ; then - rlPhaseStartTest "bz#1932752" - rlSEMatchPathCon "/sbin/kexec" "kdump_exec_t" - rlSESearchRule "allow kdump_t kdump_t : lockdown { confidentiality integrity } [ ]" - rlPhaseEnd - fi - if ! rlIsRHEL 5 6 7 ; then rlPhaseStartTest "bz#1951323 + bz#1961728 + bz#1965985 + bz#1965989" # the directory belongs to the kexec-tools package diff --git a/selinux-policy/dmidecode-and-similar/runtest.sh b/selinux-policy/dmidecode-and-similar/runtest.sh index 0c18c3b..51caa22 100755 --- a/selinux-policy/dmidecode-and-similar/runtest.sh +++ b/selinux-policy/dmidecode-and-similar/runtest.sh @@ -78,14 +78,6 @@ rlJournalStart rlPhaseEnd fi - if seinfo -c | grep -q lockdown ; then - rlPhaseStartTest "bz#1926696" - rlSEMatchPathCon "/usr/sbin/biosdecode" "dmidecode_exec_t" - rlSEMatchPathCon "/usr/sbin/vpddecode" "dmidecode_exec_t" - rlSESearchRule "allow dmidecode_t dmidecode_t : lockdown { integrity } [ ]" - rlPhaseEnd - fi - rlPhaseStartTest "real scenario -- runcon" # this TC does not belong to the small set of SELinux domains which can run dmidecode in the system_u:system_r:dmidecode_t:s0 context, therefore we need some help # TODO: use sysadm_t user instead of initrc_t to run dmidecode, because sysadm_t is allowed to transition to dmidecode_t diff --git a/selinux-policy/lockdown-class/Makefile b/selinux-policy/lockdown-class/Makefile deleted file mode 100644 index 549137c..0000000 --- a/selinux-policy/lockdown-class/Makefile +++ /dev/null @@ -1,70 +0,0 @@ -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Makefile of /CoreOS/selinux-policy/Sanity/lockdown-class -# Description: Is the lockdown class + its permissions defined in SELinux policy? -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2020 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -export TEST=/CoreOS/selinux-policy/Sanity/lockdown-class -export TESTVERSION=1.0 - -BUILT_FILES= - -FILES=$(METADATA) runtest.sh Makefile PURPOSE - -.PHONY: all install download clean - -run: $(FILES) build - ./runtest.sh - -build: $(BUILT_FILES) - chmod a+x runtest.sh - chcon -t bin_t runtest.sh - -clean: - rm -f *~ $(BUILT_FILES) - -include /usr/share/rhts/lib/rhts-make.include - -$(METADATA): Makefile - @echo "Owner: Milos Malik " > $(METADATA) - @echo "Name: $(TEST)" >> $(METADATA) - @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) - @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: Is the lockdown class + its permissions defined in SELinux policy?" >> $(METADATA) - @echo "Type: Sanity" >> $(METADATA) - @echo "TestTime: 10m" >> $(METADATA) - @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) - @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Priority: Normal" >> $(METADATA) - @echo "License: GPLv2" >> $(METADATA) - @echo "Confidential: no" >> $(METADATA) - @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA) - @echo "Bug: 1915184" >> $(METADATA) # Fedora rawhide - @echo "Bug: 1929332" >> $(METADATA) # RHEL-9 - @echo "Bug: 1933134" >> $(METADATA) # RHEL-9 - - rhts-lint $(METADATA) - diff --git a/selinux-policy/lockdown-class/PURPOSE b/selinux-policy/lockdown-class/PURPOSE deleted file mode 100644 index 17dd1ab..0000000 --- a/selinux-policy/lockdown-class/PURPOSE +++ /dev/null @@ -1,5 +0,0 @@ -PURPOSE of /CoreOS/selinux-policy/Sanity/lockdown-class -Author: Milos Malik - -Description: Is the lockdown class + its permissions defined in SELinux policy? - diff --git a/selinux-policy/lockdown-class/main.fmf b/selinux-policy/lockdown-class/main.fmf deleted file mode 100644 index c780d92..0000000 --- a/selinux-policy/lockdown-class/main.fmf +++ /dev/null @@ -1,40 +0,0 @@ -summary: Is the lockdown class + its permissions defined in SELinux policy? -description: |+ - Description: Is the lockdown class + its permissions defined in SELinux policy? - -contact: Milos Malik -component: - - selinux-policy -require: - - library(selinux-policy/common) -recommend: - - audit - - libselinux - - libselinux-utils - - policycoreutils - - selinux-policy - - selinux-policy-targeted - - setools-console -environment: - AVC_ERROR: +no_avc_check -duration: 10m -enabled: true -tag: - - NoRHEL4 - - NoRHEL5 - - NoRHEL6 - - NoRHEL7 - - NoRHEL8 - - targeted -link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1915184 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1929332 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1933134 -adjust: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7, rhel-8, centos-stream-8 - because: the lockdown class is not defined there -extra-summary: /CoreOS/selinux-policy/Sanity/lockdown-class -extra-task: /CoreOS/selinux-policy/Sanity/lockdown-class -extra-nitrate: TC#0615920 -id: 5ef38ca9-81bf-4051-9c9d-201ffccd351f diff --git a/selinux-policy/lockdown-class/runtest.sh b/selinux-policy/lockdown-class/runtest.sh deleted file mode 100755 index 02e7682..0000000 --- a/selinux-policy/lockdown-class/runtest.sh +++ /dev/null @@ -1,67 +0,0 @@ -#!/bin/bash -# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# runtest.sh of /CoreOS/selinux-policy/Sanity/lockdown-class -# Description: Is the lockdown class + its permissions defined in SELinux policy? -# Author: Milos Malik -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -# -# Copyright (c) 2020 Red Hat, Inc. All rights reserved. -# -# This copyrighted material is made available to anyone wishing -# to use, modify, copy, or redistribute it subject to the terms -# and conditions of the GNU General Public License version 2. -# -# This program is distributed in the hope that it will be -# useful, but WITHOUT ANY WARRANTY; without even the implied -# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR -# PURPOSE. See the GNU General Public License for more details. -# -# You should have received a copy of the GNU General Public -# License along with this program; if not, write to the Free -# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, -# Boston, MA 02110-1301, USA. -# -# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -# Include Beaker environment -. /usr/share/beakerlib/beakerlib.sh || exit 1 - -PACKAGE="selinux-policy" - -rlJournalStart - if ! seinfo -c | grep -q lockdown ; then - rlLog "Not applicable to this OS version." - rlJournalEnd - exit 0 - fi - rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" - rlSESatisfyRequires - rlAssertRpm ${PACKAGE} - rlAssertRpm ${PACKAGE}-targeted - - rlSESetEnforce - rlSEStatus - rlSESetTimestamp - sleep 2 - rlPhaseEnd - - rlPhaseStartTest "bz#1915184" - rlRun "seinfo -c lockdown" - rlRun "seinfo -c lockdown -x | grep confidentiality" - rlRun "seinfo -c lockdown -x | grep integrity" - rlPhaseEnd - - rlPhaseStartTest "bz#1929332 + bz#1933134" - rlSESearchRule "allow unconfined_t unconfined_t : lockdown { integrity } [ ]" - rlPhaseEnd - - rlPhaseStartCleanup - sleep 2 - rlSECheckAVC - rlPhaseEnd -rlJournalPrintText -rlJournalEnd diff --git a/selinux-policy/systemd-modules-load-and-similar/runtest.sh b/selinux-policy/systemd-modules-load-and-similar/runtest.sh index 7f89ee6..1589c14 100755 --- a/selinux-policy/systemd-modules-load-and-similar/runtest.sh +++ b/selinux-policy/systemd-modules-load-and-similar/runtest.sh @@ -125,9 +125,6 @@ rlJournalStart rlRun "lsmod | grep rdma" rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time --input-logs" 1 rlRun "systemctl stop rdma-load-modules@rdma.service" - if seinfo -c | grep -q lockdown ; then - rlSESearchRule "allow systemd_modules_load_t systemd_modules_load_t : lockdown { confidentiality } [ ]" - fi rlPhaseEnd if ! rlIsRHEL 8 && ! rlIsCentOS 8 ; then From b25abf5f67a1ca1232dcd9250b28ee39c8819235 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 16 Jan 2024 13:17:17 +0100 Subject: [PATCH 312/626] fix known issues in 3 automated tests 1) opensmtpd-and-similar test: The opensmtpd service needs to be started before an email can be sent via the mailx command. The original order led to the following error: /root/dead.letter 17/564 s-nail: ... message not sent 2) deny-rules test: The deny-rules test intentionally triggers SELinux denials. These SELinux denials should not be reported as errors or warnings. 3) systemd-modules-load-and-similar test: Not all kernel modules required by the RDMA services are available on all machines. To avoid unnecessary failures, the test phase devoted to bz#1942267 will be skipped on such machines. The automated tests should be fixed now. --- selinux-policy/deny-rules/main.fmf | 2 ++ selinux-policy/opensmtpd-and-similar/Makefile | 4 ++-- selinux-policy/opensmtpd-and-similar/main.fmf | 3 +++ selinux-policy/opensmtpd-and-similar/runtest.sh | 2 +- selinux-policy/systemd-modules-load-and-similar/runtest.sh | 2 ++ 5 files changed, 10 insertions(+), 3 deletions(-) diff --git a/selinux-policy/deny-rules/main.fmf b/selinux-policy/deny-rules/main.fmf index 6f2625a..77ef7a5 100644 --- a/selinux-policy/deny-rules/main.fmf +++ b/selinux-policy/deny-rules/main.fmf @@ -12,6 +12,8 @@ recommend: - selinux-policy - strace - expect +environment: + AVC_ERROR: +no_avc_check duration: 10m enabled: true tier: 1 diff --git a/selinux-policy/opensmtpd-and-similar/Makefile b/selinux-policy/opensmtpd-and-similar/Makefile index a053a8f..1e21b4b 100644 --- a/selinux-policy/opensmtpd-and-similar/Makefile +++ b/selinux-policy/opensmtpd-and-similar/Makefile @@ -54,14 +54,14 @@ $(METADATA): Makefile @echo "Type: Regression" >> $(METADATA) @echo "TestTime: 10m" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console opensmtpd /usr/sbin/service /usr/bin/mailx" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console opensmtpd /usr/sbin/service /usr/bin/mailx" >> $(METADATA) # EPEL @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @echo "License: GPLv2" >> $(METADATA) @echo "Confidential: no" >> $(METADATA) @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) @echo "Bug: 2208696" >> $(METADATA) # Fedora 38 @echo "Bug: 2246115" >> $(METADATA) # Fedora rawhide @echo "Bug: RHEL-15175" >> $(METADATA) # RHEL-9 diff --git a/selinux-policy/opensmtpd-and-similar/main.fmf b/selinux-policy/opensmtpd-and-similar/main.fmf index 1e8c31e..9621bae 100644 --- a/selinux-policy/opensmtpd-and-similar/main.fmf +++ b/selinux-policy/opensmtpd-and-similar/main.fmf @@ -28,6 +28,9 @@ tag: - NoRHEL6 - NoRHEL7 - targeted + - epel + - rhel8-epel + - rhel9-epel link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2208696 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2246115 diff --git a/selinux-policy/opensmtpd-and-similar/runtest.sh b/selinux-policy/opensmtpd-and-similar/runtest.sh index ea750ad..e397a87 100755 --- a/selinux-policy/opensmtpd-and-similar/runtest.sh +++ b/selinux-policy/opensmtpd-and-similar/runtest.sh @@ -75,12 +75,12 @@ rlJournalStart fi rlPhaseStartTest "real scenario -- standalone service" - rlRun "sestatus | mailx -s test-email root@localhost" if ! ls -Z ${FILE_PATH} | grep -q ${FILE_CONTEXT} ; then # for environments where the service is not yet confined PROCESS_CONTEXT="unconfined_service_t" fi rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "sestatus | mailx -s test-email root@localhost" rlRun "restorecon -Rv /etc /var /run -e /var/ARTIFACTS" 0-255 rlRun "smtpctl show status" rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 diff --git a/selinux-policy/systemd-modules-load-and-similar/runtest.sh b/selinux-policy/systemd-modules-load-and-similar/runtest.sh index 1589c14..8ffe27e 100755 --- a/selinux-policy/systemd-modules-load-and-similar/runtest.sh +++ b/selinux-policy/systemd-modules-load-and-similar/runtest.sh @@ -116,6 +116,7 @@ rlJournalStart rlRun "rm -f /etc/modules-load.d/${KERNEL_MODULE}.conf" rlPhaseEnd + if modinfo `grep ^ib /etc/rdma/modules/rdma.conf` >& /dev/null ; then rlPhaseStartTest "bz#1942267" tst_Time="$(date '+%T')" # Install kernel-module matching the running kernel version @@ -126,6 +127,7 @@ rlJournalStart rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time --input-logs" 1 rlRun "systemctl stop rdma-load-modules@rdma.service" rlPhaseEnd + fi if ! rlIsRHEL 8 && ! rlIsCentOS 8 ; then rlPhaseStartTest "bz#2088257 + bz#2088258" From dd611e50af455e3d9ac619fcdc26cafd8803cd29 Mon Sep 17 00:00:00 2001 From: Zdenek Pytela Date: Tue, 5 Sep 2023 21:22:12 +0200 Subject: [PATCH 313/626] Test systemd-generators Display some basic system information and list generators which are confined and which are not, then run particular tests with some adjustments for: - systemd-network-generator - systemd-fstab-generator - systemd-rc-local-generator - systemd-sysv-generator - selinux-autorelabel-generator and finally run again all generators with default settings as an effect of "systemctl daemon-reload". --- .../systemd-generators/71-default-off.network | 14 ++ .../systemd-generators/71-default.network | 13 + selinux-policy/systemd-generators/Makefile | 74 ++++++ selinux-policy/systemd-generators/PURPOSE | 5 + selinux-policy/systemd-generators/main.fmf | 32 +++ .../systemd-generators/mnt-loop.mount | 12 + selinux-policy/systemd-generators/runtest.sh | 229 ++++++++++++++++++ selinux-policy/systemd-generators/tty.conf | 2 + 8 files changed, 381 insertions(+) create mode 100644 selinux-policy/systemd-generators/71-default-off.network create mode 100644 selinux-policy/systemd-generators/71-default.network create mode 100644 selinux-policy/systemd-generators/Makefile create mode 100644 selinux-policy/systemd-generators/PURPOSE create mode 100644 selinux-policy/systemd-generators/main.fmf create mode 100644 selinux-policy/systemd-generators/mnt-loop.mount create mode 100755 selinux-policy/systemd-generators/runtest.sh create mode 100644 selinux-policy/systemd-generators/tty.conf diff --git a/selinux-policy/systemd-generators/71-default-off.network b/selinux-policy/systemd-generators/71-default-off.network new file mode 100644 index 0000000..bb9ad91 --- /dev/null +++ b/selinux-policy/systemd-generators/71-default-off.network @@ -0,0 +1,14 @@ +# Automatically generated by systemd-network-generator + +[Match] +Kind=!* +Type=!loopback + +[Link] + +[Network] +DHCP=no +LinkLocalAddressing=no +IPv6AcceptRA=no + +[DHCP] diff --git a/selinux-policy/systemd-generators/71-default.network b/selinux-policy/systemd-generators/71-default.network new file mode 100644 index 0000000..c94c3cb --- /dev/null +++ b/selinux-policy/systemd-generators/71-default.network @@ -0,0 +1,13 @@ +# Automatically generated by systemd-network-generator + +[Match] +Kind=!* +Type=!loopback + +[Link] + +[Network] +DHCP=ipv4 +DNS=8.8.8.8 + +[DHCP] diff --git a/selinux-policy/systemd-generators/Makefile b/selinux-policy/systemd-generators/Makefile new file mode 100644 index 0000000..dcaae62 --- /dev/null +++ b/selinux-policy/systemd-generators/Makefile @@ -0,0 +1,74 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Sanity/systemd-generators +# Description: Testing systemd system generators which are SELinux confined +# Author: Zdenek Pytela +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2010 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Sanity/systemd-generators +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE 71-default.network 71-default-off.network mnt-loop.mount tty.conf + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Zdenek Pytela " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: Testing SELinux confined systemd system generators" >> $(METADATA) + @echo "Type: Sanity" >> $(METADATA) + @echo "TestTime: 15m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: policycoreutils" >> $(METADATA) + @echo "Requires: selinux-policy" >> $(METADATA) + @echo "Requires: selinux-policy-targeted" >> $(METADATA) + @echo "Requires: zram-generator" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + #@echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Environment: SYSTEMD_PAGER=\"\"" >> $(METADATA) + @echo "Releases: -RHEL4" >> $(METADATA) + @echo "Releases: -RHEL5" >> $(METADATA) + @echo "Releases: -RHEL6" >> $(METADATA) + @echo "Bug: 2230226" >> $(METADATA) + + rhts-lint $(METADATA) + diff --git a/selinux-policy/systemd-generators/PURPOSE b/selinux-policy/systemd-generators/PURPOSE new file mode 100644 index 0000000..7300302 --- /dev/null +++ b/selinux-policy/systemd-generators/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Sanity/systemd-generators +Author: Zdenek Pytela + +Test systemd system generators which are SELinux confined and show all installed generators. + diff --git a/selinux-policy/systemd-generators/main.fmf b/selinux-policy/systemd-generators/main.fmf new file mode 100644 index 0000000..6bb603a --- /dev/null +++ b/selinux-policy/systemd-generators/main.fmf @@ -0,0 +1,32 @@ +summary: Systemd system generators +description: |+ + Testing systemd system generators which are SELinux confined + +contact: Zdenek Pytela +component: + - selinux-policy + - systemd +test: ./runtest.sh +framework: beakerlib +require: + - library(selinux-policy/common) + - selinux-policy +recommend: + - selinux-policy-targeted +environment: + AVC_ERROR: +no_avc_check +duration: 15m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - TierCandidatesPASS + - f32friendly + - targeted +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2230226 +adjust: + - enabled: false + when: distro == rhel-7 + continue: false diff --git a/selinux-policy/systemd-generators/mnt-loop.mount b/selinux-policy/systemd-generators/mnt-loop.mount new file mode 100644 index 0000000..3f0b925 --- /dev/null +++ b/selinux-policy/systemd-generators/mnt-loop.mount @@ -0,0 +1,12 @@ +# Automatically generated by systemd-fstab-generator + +[Unit] +Documentation=man:fstab(5) man:systemd-fstab-generator(8) +SourcePath=/tmp/fstab +Before=local-fs.target +After=blockdev@dev-loop42.target + +[Mount] +What=/dev/loop42 +Where=/mnt/loop +Type=ext4 diff --git a/selinux-policy/systemd-generators/runtest.sh b/selinux-policy/systemd-generators/runtest.sh new file mode 100755 index 0000000..411a238 --- /dev/null +++ b/selinux-policy/systemd-generators/runtest.sh @@ -0,0 +1,229 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Sanity/systemd-generators +# Description: Testing systemd system generators which are SELinux confined +# Author: Zdenek Pytela +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2010 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include rhts environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +SD_SYSTEM_GENERATOR_PATH="/usr/lib/systemd/system-generators /usr/local/lib/systemd/system-generators /etc/systemd/system-generators /run/systemd/system-generators" +SD_SYSTEM_GENERATORS="" + +# To make testing easier, systemd implements various tweaks into its services: +# - variables like SYSTEMD_FSTAB or SYSTEMD_PROC_CMDLINE can be used to point to files +# which will be taken into account instead of the original ones +# - SYSTEMD_IN_INITRD=1 forges being executed in initial ramdisk +# - network generator accepts position arguments as proc-command-line entries +# systemd-network-generator [OPTIONS...] [-- KERNEL_CMDLINE] + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + ### Information about the system (release, systemd and policy versions) + rlPhaseStartTest "Display basic system information" + rlRun "cat /etc/system-release" + rlRun "uname -a" + rlRun "rpm -qa \"systemd*\"|sort" + rlRun "rpm -qa \"selinux-*\" \"*-selinux\" | sort" + rlPhaseEnd + + ### Look for executables in the directories for systemd-system-generators + rlPhaseStartTest "Find all generators" + for dir in ${SD_SYSTEM_GENERATOR_PATH}; do + [ -d "${dir}" ] || continue + for file in ${dir}/*; do + FILEPATH=$(realpath "${file}") + [ "$?" = 0 ] || continue + [ -x "$FILEPATH" ] || continue + CONTEXT=$(stat -c"%C" "${FILEPATH}") + [ "$?" = 0 ] || continue + if [[ ${CONTEXT} =~ ":init_exec_t:" ]] || [[ ${CONTEXT} =~ ":lib_t:" ]] || [[ ${CONTEXT} =~ ":usr_t:" ]] + then + SD_SYSTEM_GENERATORS_NOTCONFINED="${SD_SYSTEM_GENERATORS_NOTCONFINED} $FILEPATH" + else + SD_SYSTEM_GENERATORS="${SD_SYSTEM_GENERATORS} $FILEPATH" + fi + done + done + echo "List of confined generators:" + echo "${SD_SYSTEM_GENERATORS}" + echo "List of non-confined generators:" + echo "${SD_SYSTEM_GENERATORS_NOTCONFINED}" + rlPhaseEnd + + + ### network-generator actually is a service, not a generator + # systemd-network-generator.service is a system service that translates ip= and the + # related settings on the kernel command line (see below) into systemd.network(5), + # systemd.netdev(5), and systemd.link(5) configuration files + rlPhaseStartTest "systemd-network-generator" + rlRun "systemd-run -u sdng-manual.service /usr/lib/systemd/systemd-network-generator -- nameserver=8.8.8.8 ip=dhcp" + rlRun "journalctl -u sdng-manual.service" + rlRun "systemctl restart systemd-networkd" + rlRun "systemctl status systemd-networkd" + rlRun "networkctl" + rlRun "diff /run/systemd/network/71-default.network 71-default.network" + rlPhaseEnd + + rlPhaseStartTest "systemd-network-generator: ip=off" + rlRun "systemd-run -u sdng-manual-off.service /usr/lib/systemd/systemd-network-generator -- ip=off" + rlRun "journalctl -u sdng-manual-off.service" + rlRun "systemctl restart systemd-networkd" + rlRun "systemctl status systemd-networkd" + rlRun "networkctl" + rlRun "diff /run/systemd/network/71-default.network 71-default-off.network" + rlPhaseEnd + + ### fstab-generator + # systemd-fstab-generator is a generator that translates /etc/fstab (see fstab(5) + # for details) into native systemd units early at boot and when configuration of + # the system manager is reloaded. This will instantiate mount and swap + # units as necessary. + + # fstab-generator 1 - use /etc/fstab + rlPhaseStartTest "systemd-fstab-generator /etc" + rlFileBackup "/etc/fstab" + rlRun "mkdir -p /newproc" + echo "/proc /newproc none bind 0 0" >> /etc/fstab + rlRun "SYSTEMD_LOG_LEVEL=debug systemd-run -u sdfg-manual.service /usr/lib/systemd/system-generators/systemd-fstab-generator /run/systemd/generator" + rlRun "journalctl -u sdfg-manual.service" + rlRun "systemctl daemon-reload" + rlRun "systemctl start newproc.mount" + rlRun "systemctl status newproc.mount" + rlRun "ls -lZd /newproc/1" + rlRun "systemctl stop newproc.mount" + rlPhaseEnd + + # fstab-generator 2 - use a local fstab-like file + rlPhaseStartTest "systemd-fstab-generator /tmp" + echo "/dev/loop42 /mnt/loop ext4 defaults 0 0" >> /tmp/fstab + rlRun "mkdir -p /mnt/loop" + rlRun "chcon --reference /etc/fstab /tmp/fstab" + rlRun "dd if=/dev/zero of=/tmp/loopfile bs=16M count=1" + rlRun "chcon -t user_tmp_t /tmp/loopfile" + rlRun "losetup /dev/loop42 /tmp/loopfile" + rlRun "losetup -j /tmp/loopfile" + rlRun "mkfs.ext4 /dev/loop42" + rlRun "systemd-run -E SYSTEMD_FSTAB=/tmp/fstab -u sdfg-tmpfstab.service /usr/lib/systemd/system-generators/systemd-fstab-generator /run/systemd/generator" + rlRun "diff /run/systemd/generator/mnt-loop.mount mnt-loop.mount" + rlRun "ls -lZa /mnt/loop" + rlPhaseEnd + + # fstab-generator 3: nfs + + ### gpt-generator + #rlPhaseStartTest "systemd-gpt-generator" + #rlPhaseEnd + + ### nfs-generator + # 7a76dc1c4eba7a6cd3b59cdd40b6b4bd90312e07 needs to be reverted + #rlPhaseStartTest "systemd-nfs-generator" + #rlPhaseEnd + + ### systemd-rc-local-generator + # systemd-rc-local-generator is a generator that checks whether /etc/rc.d/rc.local + # exists and is executable, and if it is, pulls the rc-local.service unit into the + # boot process. + # the service unit file already exists: /usr/lib/systemd/system/rc-local.service + rlPhaseStartTest "systemd-rc-local-generator" + cat > /etc/rc.d/rc.local << EOF +#!/bin/bash +echo "This is a script to check rc-local generator." +EOF + rlRun "chmod +x /etc/rc.d/rc.local" + rlRun "restorecon -v /etc/rc.d/rc.local" + rlRun "systemd-run -u sdrg-manual.service /usr/lib/systemd/system-generators/systemd-rc-local-generator /run/systemd/generator" + rlRun "journalctl -u sdrg-manual.service" + rlRun "systemctl daemon-reload" + rlRun "systemctl start rc-local.service" + rlRun "systemctl status rc-local.service" + rlRun "systemctl stop rc-local.service" + rlPhaseEnd + + ### sysv-generator + # systemd-sysv-generator is a generator that creates wrapper .service units + # for SysV init[1] scripts in /etc/init.d/* at boot and when configuration + # of the system manager is reloaded. + rlPhaseStartTest "systemd-sysv-generator" + cat > /etc/rc.d/init.d/sysv-generator-test.sh << EOF +#!/bin/bash +echo "This is a script to check sysv generator." +EOF + rlRun "chmod +x /etc/rc.d/init.d/sysv-generator-test.sh" + rlRun "restorecon -Fv /etc/rc.d/init.d/sysv-generator-test.sh" + rlRun "systemd-run -u sdsg-manual.service /usr/lib/systemd/system-generators/systemd-sysv-generator /run/systemd/generator /run/systemd/generator.early /run/systemd/generator.late" + rlRun "journalctl -u sdsg-manual.service" + rlRun "systemctl daemon-reload" + rlRun "systemctl start sysv-generator-test.service" + rlRun "systemctl status sysv-generator-test.service" + rlRun "systemctl stop sysv-generator-test.service" + rlPhaseEnd + + + ### generators from other packages: install them all? + # dnf install "/usr/lib/systemd/system-generators/*" + # cloud-init-generator nfs-server-generator rpc-pipefs-generator selinux-autorelabel-generator.sh zram-generator + # cloud-init nfs-utils policycoreutils zram-generator + + ### selinux-autorelabel-generator + # This systemd.generator(7) detects if SELinux is running and if the + # user requested an autorelabel, and if so sets the default target to + # selinux-autorelabel.target. + rlPhaseStartTest "selinux-autorelabel-generator" + rlFileBackup "/etc/selinux/config" + rlRun "echo AUTORELABEL=0 >> /etc/selinux/config" + rlRun "touch /.autorelabel" + rlRun "SYSTEMD_LOG_LEVEL=debug systemd-run -u sdsa-manual.service /usr/lib/systemd/system-generators/selinux-autorelabel-generator.sh /run/systemd/generator /run/systemd/generator.early /run/systemd/generator.late" + rlRun "journalctl -u sdsa-manual.service" + rlRun "test \"$(readlink /run/systemd/generator.early/default.target)\" = \"/usr/lib/systemd/system/selinux-autorelabel.target\"" + rlRun "diff /run/systemd/generator.early/selinux-autorelabel.service.d/tty.conf tty.conf" + rlPhaseEnd + + ### cleanup, restoring the previous content + # re-run again all generators as an effect of daemon-reload; + # changes which used special systemd variables will go away + rlPhaseStartCleanup + sleep 2 + rlRun "rmdir /mnt/loop" + rlRun "losetup -d /dev/loop42" + rlRun "/bin/rm /tmp/loopfile" + rlFileRestore + # fixme: remove non-natural generators + rlRun "systemctl daemon-reload" + rlSECheckAVC + rlPhaseEnd + rlJournalPrintText +rlJournalEnd diff --git a/selinux-policy/systemd-generators/tty.conf b/selinux-policy/systemd-generators/tty.conf new file mode 100644 index 0000000..f0d8106 --- /dev/null +++ b/selinux-policy/systemd-generators/tty.conf @@ -0,0 +1,2 @@ +[Service] +StandardInput=tty From 71a582c833a22754240a4f43396c93da318e9b85 Mon Sep 17 00:00:00 2001 From: Zdenek Pytela Date: Mon, 15 Jan 2024 17:57:43 +0100 Subject: [PATCH 314/626] Split the "Install and Uninstall" phase test into two --- selinux-policy/install-uninstall-dsp-packages/runtest.sh | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/selinux-policy/install-uninstall-dsp-packages/runtest.sh b/selinux-policy/install-uninstall-dsp-packages/runtest.sh index dc763ae..734bd02 100755 --- a/selinux-policy/install-uninstall-dsp-packages/runtest.sh +++ b/selinux-policy/install-uninstall-dsp-packages/runtest.sh @@ -88,7 +88,7 @@ rlJournalStart sleep 2 rlPhaseEnd - rlPhaseStartTest "Install and Uninstall test for dsp packages" + rlPhaseStartTest "Install test for dsp packages" rlRun "dnf list *selinux* --enablerepo=\"*\" > install-list" rlRun "sed -i '1,/Available Packages/d' install-list" rlRun "sed -i '/beaker-tasks/d' install-list" @@ -116,6 +116,9 @@ rlJournalStart fi done echo "" >> pkglist.report + rlPhaseEnd + + rlPhaseStartTest "Uninstall test for dsp packages" rlRun "uninstall_report" # Following loop will read each package from file install-pkgs # and will attempt to un-install it using dnf utility. From 97bec02b0ab674b55d209b91bc854355a4ae3595 Mon Sep 17 00:00:00 2001 From: Zdenek Pytela Date: Mon, 15 Jan 2024 18:00:58 +0100 Subject: [PATCH 315/626] Make a few small changes and add comments to the Install phase --- .../install-uninstall-dsp-packages/runtest.sh | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/selinux-policy/install-uninstall-dsp-packages/runtest.sh b/selinux-policy/install-uninstall-dsp-packages/runtest.sh index 734bd02..0ebf0d9 100755 --- a/selinux-policy/install-uninstall-dsp-packages/runtest.sh +++ b/selinux-policy/install-uninstall-dsp-packages/runtest.sh @@ -89,11 +89,20 @@ rlJournalStart rlPhaseEnd rlPhaseStartTest "Install test for dsp packages" - rlRun "dnf list *selinux* --enablerepo=\"*\" > install-list" + rlRun "dnf list \"*-selinux*\" --enablerepo=\"*\" --disablerepo=\"beaker-tasks\" --disablerepo=\"*-source\" --disablerepo=\"*-debuginfo\" > install-list" + # limit the list to not installed packages rlRun "sed -i '1,/Available Packages/d' install-list" + # exclude packages from the beaker-tasks repo rlRun "sed -i '/beaker-tasks/d' install-list" + # exclude debuginfo packages + rlRun "sed -i '/-debuginfo/d' install-list" + # tmp: omit failing vfrnav + rlRun "sed -i '/vfrnav-selinux/d' install-list" + # packages names only rlRun "awk '{print \$1}' install-list > pkgonlylist" + # exclude updates-source rlRun "grep -vE '(.src)' pkgonlylist | sort -u > install-pkgs" + # use the same list for checks of the subsequent uninstallation rlRun "cp -f install-pkgs uninstall-pkgs" rlRun "install_report" # Following loop will read each package from file install-pkgs From 5994b16d675642ede640ca0a6b8839dcb1a0be52 Mon Sep 17 00:00:00 2001 From: Zdenek Pytela Date: Mon, 15 Jan 2024 18:04:18 +0100 Subject: [PATCH 316/626] Add a test phase for "/run equivalency status" check Check which equivalency is in place and if there are incompatible entries. --- .../install-uninstall-dsp-packages/runtest.sh | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/selinux-policy/install-uninstall-dsp-packages/runtest.sh b/selinux-policy/install-uninstall-dsp-packages/runtest.sh index 0ebf0d9..b251ff3 100755 --- a/selinux-policy/install-uninstall-dsp-packages/runtest.sh +++ b/selinux-policy/install-uninstall-dsp-packages/runtest.sh @@ -34,6 +34,8 @@ PACKAGE="selinux-policy" SKIP_REMOVAL=${SKIP_REMOVAL:-""} SKIP_INSTALL=${SKIP_INSTALL:-""} INSTALL_ONLY=${INSTALL_ONLY:-""} +FCONTEXT_LIST="/tmp/semanage-fcontext" +FCONTEXT_LIST_VARRUN="/tmp/semanage-fcontext-varrun" # Function to create a report template for install test function install_report() { @@ -127,6 +129,23 @@ rlJournalStart echo "" >> pkglist.report rlPhaseEnd + ### Checks performed with all dsp packages installed + ### Status of /run and /var/run equivalency + rlPhaseStartTest "Check /run equivalency status" + rlRun "semanage fcontext -l > ${FCONTEXT_LIST}" + if grep -q "/run = /var/run" ${FCONTEXT_LIST}; then + echo "Warning: Legacy equivalency settings \"/run = /var/run\" are in place." + elif grep -q "/var/run = /run" ${FCONTEXT_LIST}; then + echo "New equivalency settings /\"var/run = /run\" are in place." + if grep -q "^/var/run" ${FCONTEXT_LIST}; then + rlLog "Warning: /var/run entries found in the file context database" + rlRun "sed '/^\/var\/run/!d; s|[ \t].*$||' ${FCONTEXT_LIST} | uniq > ${FCONTEXT_LIST_VARRUN}" + fi + else echo "Unknown or none /run equivalency settings." + fi + rm -f ${FCONTEXT_LIST} ${FCONTEXT_LIST_VARRUN} + rlPhaseEnd + rlPhaseStartTest "Uninstall test for dsp packages" rlRun "uninstall_report" # Following loop will read each package from file install-pkgs From 3ea1adb99b738defe626282bd87a6fa2ca0fc504 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Fri, 19 Jan 2024 09:55:08 +0100 Subject: [PATCH 317/626] test if exim can send into /var/spool/exim/exim_daemon_notify A recent exim testing on RHEL-8 and RHEL-9 revealed that SELinux prevents the exim processes from sending data into the abstract socket: /var/spool/exim/exim_daemon_notify. The TC reproduces the situation when executed in the right environment. In order to support all the expected actions over the daemon notifier socket, I believe that SELinux policy should allow the sendto permission. The TC looks for appropriate policy rules and file context patterns. The TC covers RHEL-21902 and RHEL-21903. --- selinux-policy/exim-and-similar/Makefile | 4 +++- selinux-policy/exim-and-similar/main.fmf | 3 +++ selinux-policy/exim-and-similar/runtest.sh | 8 ++++++++ 3 files changed, 14 insertions(+), 1 deletion(-) diff --git a/selinux-policy/exim-and-similar/Makefile b/selinux-policy/exim-and-similar/Makefile index 2bbf5b0..3c8dc5d 100644 --- a/selinux-policy/exim-and-similar/Makefile +++ b/selinux-policy/exim-and-similar/Makefile @@ -54,7 +54,7 @@ $(METADATA): Makefile @echo "Type: Regression" >> $(METADATA) @echo "TestTime: 5m" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted /usr/sbin/service setools-console at exim" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted /usr/sbin/service setools-console at exim lsof" >> $(METADATA) @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @echo "License: GPLv2" >> $(METADATA) @@ -66,6 +66,8 @@ $(METADATA): Makefile @echo "Bug: 1444441" >> $(METADATA) # RHEL-7 @echo "Bug: RHEL-14110" >> $(METADATA) # RHEL-9 @echo "Bug: RHEL-14186" >> $(METADATA) # RHEL-8 + @echo "Bug: RHEL-21902" >> $(METADATA) # RHEL-9 + @echo "Bug: RHEL-21903" >> $(METADATA) # RHEL-8 rhts-lint $(METADATA) diff --git a/selinux-policy/exim-and-similar/main.fmf b/selinux-policy/exim-and-similar/main.fmf index 6a63f6d..fed7aad 100644 --- a/selinux-policy/exim-and-similar/main.fmf +++ b/selinux-policy/exim-and-similar/main.fmf @@ -20,6 +20,7 @@ recommend: - setools-console - at - exim + - lsof environment: AVC_ERROR: +no_avc_check duration: 5m @@ -39,6 +40,8 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1444441 - verifies: https://issues.redhat.com/browse/RHEL-14110 - verifies: https://issues.redhat.com/browse/RHEL-14186 + - verifies: https://issues.redhat.com/browse/RHEL-21902 + - verifies: https://issues.redhat.com/browse/RHEL-21903 adjust: - enabled: false when: distro == rhel-4, rhel-alt-7 diff --git a/selinux-policy/exim-and-similar/runtest.sh b/selinux-policy/exim-and-similar/runtest.sh index a1067ac..27750e3 100755 --- a/selinux-policy/exim-and-similar/runtest.sh +++ b/selinux-policy/exim-and-similar/runtest.sh @@ -85,6 +85,13 @@ rlJournalStart rlPhaseEnd fi + if rlIsRHEL 8 9 || rlIsCentOS 8 9 ; then + rlPhaseStartTest "RHEL-21902 + RHEL-21903" + rlSEMatchPathCon "/var/spool/exim/exim_daemon_notify" "exim_spool_t" + rlSESearchRule "allow exim_t exim_t : unix_dgram_socket { sendto } [ ]" + rlPhaseEnd + fi + rlPhaseStartTest "real scenario -- standalone service" rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" if ! rlSEDefined ${PROCESS_CONTEXT} ; then @@ -92,6 +99,7 @@ rlJournalStart PROCESS_CONTEXT="sendmail_t" fi rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "lsof | grep exim_daemon_notify" rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd From 53adb4565103910ba433111fddcb2435eaabfa12 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Wed, 6 Dec 2023 12:42:56 +0100 Subject: [PATCH 318/626] add the chronyd test to upstream repo The chrony component is frequently used by various users on Fedora and RHEL, so it makes sense to run this TC in upstream testing too. There are no changes in the TC functionality. Moving the downstream TC to upstream repo. The TC covers RHEL-18219. --- selinux-policy/chronyd-and-similar/Makefile | 110 +++++ selinux-policy/chronyd-and-similar/PURPOSE | 5 + .../chronyd-and-similar/chrony-nts-test.sh | 41 ++ selinux-policy/chronyd-and-similar/main.fmf | 96 ++++ selinux-policy/chronyd-and-similar/runtest.sh | 454 ++++++++++++++++++ 5 files changed, 706 insertions(+) create mode 100644 selinux-policy/chronyd-and-similar/Makefile create mode 100644 selinux-policy/chronyd-and-similar/PURPOSE create mode 100755 selinux-policy/chronyd-and-similar/chrony-nts-test.sh create mode 100644 selinux-policy/chronyd-and-similar/main.fmf create mode 100755 selinux-policy/chronyd-and-similar/runtest.sh diff --git a/selinux-policy/chronyd-and-similar/Makefile b/selinux-policy/chronyd-and-similar/Makefile new file mode 100644 index 0000000..63baa53 --- /dev/null +++ b/selinux-policy/chronyd-and-similar/Makefile @@ -0,0 +1,110 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/chronyd-and-similar +# Description: SELinux interferes with chronyd and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/chronyd-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE chrony-nts-test.sh + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh chrony-nts-test.sh + chcon -t bin_t runtest.sh chrony-nts-test.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with chronyd and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 1h" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "RunFor: chrony" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy-mls selinux-policy-targeted setools-console chrony ksh nscd /usr/bin/certtool /usr/sbin/service socat" >> $(METADATA) # EPEL + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Releases: -RHEL4" >> $(METADATA) + @echo "Architectures: i386 ppc64 x86_64" >> $(METADATA) + @echo "Bug: 974992" >> $(METADATA) # RHEL-7 + @echo "Bug: 978993" >> $(METADATA) # RHEL-6 + @echo "Bug: 1243764" >> $(METADATA) # RHEL-7 + @echo "Bug: 1243987" >> $(METADATA) # RHEL-7 + @echo "Bug: 1273116" >> $(METADATA) # RHEL-7 + @echo "Bug: 1281473" >> $(METADATA) # RHEL-6 + @echo "Bug: 1290310" >> $(METADATA) # RHEL-6 + @echo "Bug: 1350765" >> $(METADATA) # RHEL-7 + @echo "Bug: 1390657" >> $(METADATA) # RHEL-6 + @echo "Bug: 1416015" >> $(METADATA) # RHEL-7 + @echo "Bug: 1421248" >> $(METADATA) # RHEL-7 + @echo "Bug: 1425408" >> $(METADATA) # RHEL-7 + @echo "Bug: 1440791" >> $(METADATA) # RHEL-7 + @echo "Bug: 1470150" >> $(METADATA) # RHEL-7 + @echo "Bug: 1508486" >> $(METADATA) # RHEL-7 + @echo "Bug: 1509379" >> $(METADATA) # RHEL-7 + @echo "Bug: 1509927" >> $(METADATA) # RHEL-7 + @echo "Bug: 1530525" >> $(METADATA) # RHEL-7 + @echo "Bug: 1567753" >> $(METADATA) # RHEL-7 + @echo "Bug: 1568281" >> $(METADATA) # RHEL-7 + @echo "Bug: 1574418" >> $(METADATA) # RHEL-7 + @echo "Bug: 1575002" >> $(METADATA) # RHEL-7 + @echo "Bug: 1577057" >> $(METADATA) # RHEL-7 + @echo "Bug: 1593267" >> $(METADATA) # RHEL-7 + @echo "Bug: 1593607" >> $(METADATA) # RHEL-8 + @echo "Bug: 1596563" >> $(METADATA) # RHEL-7 + @echo "Bug: 1618757" >> $(METADATA) # RHEL-7 + @echo "Bug: 1622499" >> $(METADATA) # RHEL-8 + @echo "Bug: 1652079" >> $(METADATA) # RHEL-7 + @echo "Bug: 1696252" >> $(METADATA) # RHEL-8 + @echo "Bug: 1772852" >> $(METADATA) # RHEL-8 + @echo "Bug: 1895825" >> $(METADATA) # RHEL-9 + @echo "Bug: 1900143" >> $(METADATA) # Fedora 34 + @echo "Bug: 1961207" >> $(METADATA) # RHEL-8 + @echo "Bug: 2008894" >> $(METADATA) # Fedora 35 + @echo "Bug: 2065313" >> $(METADATA) # RHEL-8 + @echo "Bug: 2118628" >> $(METADATA) # RHEL-8 + @echo "Bug: 2118631" >> $(METADATA) # RHEL-9 + @echo "Bug: 2173604" >> $(METADATA) # RHEL-9 + @echo "Bug: 2169949" >> $(METADATA) # Fedora-38 + @echo "Bug: RHEL-18219" >> $(METADATA) # RHEL-9 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/chronyd-and-similar/PURPOSE b/selinux-policy/chronyd-and-similar/PURPOSE new file mode 100644 index 0000000..b67781b --- /dev/null +++ b/selinux-policy/chronyd-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/chronyd-and-similar +Author: Milos Malik + +SELinux interferes with chronyc, chronyd and related programs. + diff --git a/selinux-policy/chronyd-and-similar/chrony-nts-test.sh b/selinux-policy/chronyd-and-similar/chrony-nts-test.sh new file mode 100755 index 0000000..4771d70 --- /dev/null +++ b/selinux-policy/chronyd-and-similar/chrony-nts-test.sh @@ -0,0 +1,41 @@ +#!/bin/bash + +set -e + +server_name=chrony-nts-test +cert=/etc/pki/tls/certs/nts.crt +key=/etc/pki/tls/private/nts.key + +sed -i "/ $server_name\$/d" /etc/hosts +echo "127.0.0.1 $server_name" >> /etc/hosts + +cat > cert.cfg < /etc/chrony.conf < +component: + - chrony + - selinux-policy +test: ./runtest.sh +framework: beakerlib +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy-mls + - selinux-policy-targeted + - setools-console + - chrony + - ksh + - nscd + - /usr/bin/certtool + - /usr/sbin/service + - socat +environment: + AVC_ERROR: +no_avc_check +duration: 1h +enabled: true +tag: + - NoRHEL4 + - TIP_fedora_fail + - TIPfail_Security + - TIPfail_fedora + - TIPfail_infra + - TIPpass + - Tier3 + - Tier3se + - TipWaived6 + - f33friendly + - targeted +tier: '3' +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=974992 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=978993 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1243764 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1243987 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1273116 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1281473 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1290310 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1350765 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1390657 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1416015 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1421248 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1425408 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1440791 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1470150 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1508486 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1509379 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1509927 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1530525 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1567753 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1568281 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1574418 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1575002 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1577057 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1593267 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1593607 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1596563 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1618757 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1622499 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1652079 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1696252 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1772852 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1895825 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1900143 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1961207 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2008894 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2065313 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1949493 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2118628 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2118631 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2173604 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2169949 + - verifies: https://issues.redhat.com/browse/RHEL-18219 +adjust: + - enabled: false + when: distro == rhel-4 + continue: false + - enabled: false + when: arch == ia64, ppc, s390 + continue: false +extra-nitrate: TC#0202180 +extra-summary: /CoreOS/selinux-policy/Regression/chronyd-and-similar +extra-task: /CoreOS/selinux-policy/Regression/chronyd-and-similar diff --git a/selinux-policy/chronyd-and-similar/runtest.sh b/selinux-policy/chronyd-and-similar/runtest.sh new file mode 100755 index 0000000..d469f05 --- /dev/null +++ b/selinux-policy/chronyd-and-similar/runtest.sh @@ -0,0 +1,454 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/chronyd-and-similar +# Description: SELinux interferes with chronyd and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2012 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +ROOT_PASSWORD="redhat" +SERVICE_PACKAGE="chrony" +SERVICE_NAME="chronyd" +PROCESS_NAME="chronyd" +PROCESS_CONTEXT="chronyd_t" +CHRONYD_RESTRICTED_SERVICE="chronyd-restricted" +CHRONYD_RESTRICTED_UNIT_FILE="/usr/lib/systemd/system/chronyd-restricted.service" +CHRONYD_RESTRICTED_UNIT_DROPIN_DIR="/etc/systemd/system/chronyd-restricted.service.d" +CHRONYD_RESTRICTED_UNIT_DROPIN_FILE="${CHRONYD_RESTRICTED_UNIT_DROPIN_DIR}/context.conf" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop `rlSEListServices 123` + rlFileBackup /etc/chrony.conf + rlFileBackup /etc/shadow + rlFileBackup /etc/chrony.keys + + rlRun "find /var /run -type f -name '*lease*'" + rlRun "find /var /run -type f -name '*lease*' | xargs cat" + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + if ! rlIsRHEL 5 ; then + rlPhaseStartTest "bz#974992 + bz#978993" + rlSEMatchPathCon "/usr/sbin/chronyd" "chronyd_exec_t" + rlSESearchRule "allow chronyd_t chronyd_t : capability { sys_nice } [ ]" + rlSESearchRule "allow chronyd_t chronyd_t : process { setsched } [ ]" + rlPhaseEnd + fi + + if ! rlIsRHEL 5 6 ; then + rlPhaseStartTest "bz#1243764 + bz#1243987" + rlSEMatchPathCon "/usr/libexec/chrony-helper" "chronyd_exec_t" + rlSEMatchPathCon "/var/run/chrony-helper" "chronyd_var_run_t" + rlSEMatchPathCon "/var/run/chrony-helper/added_servers" "chronyd_var_run_t" + rlSEMatchPathCon "/var/run/chrony-helper/lock" "chronyd_var_run_t" + rlSEMatchPathCon "/var/lib/dhclient" "dhcpc_state_t" + rlSEMatchPathCon "/var/lib/dhclient/chrony.servers.eth0" "dhcpc_state_t" + rlSEMatchPathCon "/usr/bin/systemctl" "systemd_systemctl_exec_t" + rlSESearchRule "allow dhcpc_t chronyd_exec_t : file { getattr open read execute }" + rlSESearchRule "type_transition dhcpc_t chronyd_exec_t : process chronyd_t" + rlSESearchRule "allow dhcpc_t chronyd_t : process { transition }" + rlSESearchRule "allow chronyd_t var_run_t : dir { read write add_name remove_name search open getattr }" + rlSESearchRule "type_transition chronyd_t var_run_t : dir chronyd_var_run_t" + rlSESearchRule "allow chronyd_t chronyd_var_run_t : dir { read write add_name remove_name search open getattr }" + rlSESearchRule "allow chronyd_t chronyd_var_run_t : file { getattr open read write create unlink }" + rlSESearchRule "allow chronyd_t dhcpc_state_t : dir { getattr open read search }" + rlSESearchRule "allow chronyd_t dhcpc_state_t : file { getattr open read }" + rlSESearchRule "allow chronyd_t bin_t : file { getattr open read execute_no_trans }" + rlSESearchRule "allow chronyd_t systemd_systemctl_exec_t : file { getattr open read execute_no_trans }" + rlSESearchRule "allow timemaster_t chronyd_t : process { signal }" + rlPhaseEnd + + rlPhaseStartTest "bz#1350765" + rlSESearchRule "allow chronyd_t chronyd_t : capability2 { block_suspend } [ ]" + rlSESearchRule "allow chronyd_t kernel_t : system { module_request } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1416015 + bz#1421248 + bz#1425408 + bz#1440791" + rlSEMatchPathCon "/usr/sbin/chronyd" "chronyd_exec_t" + rlSEMatchPathCon "/etc/adjtime" "adjtime_t" + rlSEMatchPathCon "/var/run/chrony" "chronyd_var_run_t" + rlSEMatchPathCon "/var/run/chrony/chronyd.sock" "chronyd_var_run_t" + rlSEMatchPathCon "/var/run/chrony/chronyc.1117.sock" "chronyd_var_run_t" + rlSESearchRule "allow chronyd_t adjtime_t : file { getattr open read }" + rlSESearchRule "allow chronyd_t chronyd_t : capability { chown }" + rlSESearchRule "allow chronyd_t chronyd_t : unix_dgram_socket { sendto }" + rlSESearchRule "allow chronyd_t chronyd_t : capability { net_admin }" + rlPhaseEnd + + rlPhaseStartTest "bz#1508486" + rlSEMatchPathCon "/usr/libexec/chrony-helper" "chronyd_exec_t" + rlSEMatchPathCon "/usr/bin/chronyc" "chronyc_exec_t" + rlSESearchRule "allow chronyd_t chronyc_exec_t : file { getattr open read execute_no_trans }" + rlSESearchRule "allow chronyd_t chronyc_t : process { transition }" 1 + rlPhaseEnd + + rlPhaseStartTest "bz#1509379" + rlSEMatchPathCon "/usr/bin/chronyc" "chronyc_exec_t" + rlSESearchRule "allow chronyc_t chronyc_t : capability { dac_read_search } [ ]" + rlSESearchRule "type_transition chronyd_t chronyc_exec_t : process chronyc_t" 1 + rlSESearchRule "allow chronyd_t chronyd_t : capability { dac_read_search } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1530525" + rlSEMatchPathCon "/usr/bin/chronyc" "chronyc_exec_t" + rlSEMatchPathCon "/etc" "etc_t" + rlSEMatchPathCon "/etc/chrony.keys" "chronyd_keys_t" +# rlSESearchRule "allow chronyc_t etc_t : dir { write add_name }" +# rlSESearchRule "type_transition chronyc_t etc_t : file chronyd_keys_t" + rlSESearchRule "allow chronyc_t chronyd_keys_t : file { getattr ioctl append write } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1470150" + rlSEMatchPathCon "/var/run/chrony" "chronyd_var_run_t" + rlSEMatchPathCon "/var/run/chrony/chronyc.3781.sock" "chronyd_var_run_t" + rlSESearchRule "allow chronyd_t chronyc_t : unix_dgram_socket { sendto }" + rlSESearchRule "allow chronyc_t chronyd_t : unix_dgram_socket { sendto }" + rlSESearchRule "allow system_cronjob_t chronyc_exec_t : file { getattr open read execute } [ ]" + rlSESearchRule "type_transition system_cronjob_t chronyc_exec_t : process chronyc_t" + rlSESearchRule "allow system_cronjob_t chronyc_t : process { transition } [ ]" + rlSESearchRule "allow inetd_child_t chronyc_exec_t : file { getattr open read execute } [ ]" + rlSESearchRule "type_transition inetd_child_t chronyc_exec_t : process chronyc_t" + rlSESearchRule "allow inetd_child_t chronyc_t : process { transition } [ ]" + rlSESearchRule "allow chronyc_t chronyd_var_run_t : sock_file { create write unlink }" + rlPhaseEnd + fi + + if false ; then + rlPhaseStartTest "bz#1273116" # CLOSED as NOT-A-BUG, unable to reproduce it anymore + rlSEMatchPathCon "/usr/lib/systemd/system/chronyd.service" "chronyd_unit_file_t" + rlSESearchRule "allow chronyd_t chronyd_unit_file_t : service { status }" + rlPhaseEnd + fi + + if ! rlIsRHEL 5 ; then + rlPhaseStartTest "bz#1281473" + rlSEMatchPathCon "/usr/sbin/chronyd" "chronyd_exec_t" + rlSEMatchPathCon "/etc/chrony.keys" "chronyd_keys_t" + rlSEMatchPathCon "/var/run/timemaster/chrony.conf" "timemaster_var_run_t" + rlSESearchRule "allow chronyd_t chronyd_keys_t : file { append setattr }" + rlSESearchRule "allow chronyd_t timemaster_var_run_t : file { getattr open read }" + rlPhaseEnd + + rlPhaseStartTest "bz#1290310" + rlSEMatchPathCon "/usr/sbin/chronyd" "chronyd_exec_t" + rlSEMatchPathCon "/var/run" "var_run_t" + rlSEMatchPathCon "/var/run/chronyd.sock" "chronyd_var_run_t" + rlSESearchRule "allow chronyd_t var_run_t : dir { getattr open search read write add_name remove_name }" + rlSESearchRule "type_transition chronyd_t var_run_t : sock_file chronyd_var_run_t" + rlSESearchRule "allow chronyd_t chronyd_var_run_t : sock_file { create }" + rlPhaseEnd + + rlPhaseStartTest "bz#1390657" + rlSEMatchPathCon "/etc/chrony.keys" "chronyd_keys_t" + rlSESearchRule "allow logrotate_t chronyd_keys_t : file { getattr open read }" + rlPhaseEnd + fi + + if ! rlIsRHEL 5 6 ; then + rlPhaseStartTest "bz#1509927" + rlSEMatchPathCon "/usr/bin/chronyc" "chronyc_exec_t" + rlSESearchRule "allow chronyc_t user_devpts_t : chr_file { read write getattr append open } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1574418" + rlSEMatchPathCon "/usr/bin/chronyc" "chronyc_exec_t" + rlSEMatchPathCon "/tmp" "tmp_t" + rlSEMatchPathCon "/var/lib" "var_lib_t" + rlSEMatchPathCon "/var/lib/check_mk_agent" "var_lib_t" + rlSEMatchPathCon "/var/lib/check_mk_agent/cache" "var_lib_t" + rlSEMatchPathCon "/var/lib/check_mk_agent/cache/chrony.cache.new" "var_lib_t" + rlSEMatchPathCon "/var/log" "var_log_t" + rlSESearchRule "allow chronyc_t tmp_t : dir { write add_name } [ ]" + rlSESearchRule "type_transition chronyc_t tmp_t : file chronyd_tmp_t" + rlSESearchRule "allow chronyc_t chronyd_tmp_t : file { create getattr open write } [ ]" + rlSESearchRule "allow chronyc_t var_log_t : dir { write add_name } [ ]" + rlSESearchRule "type_transition chronyc_t var_log_t : file chronyd_var_log_t" + rlSESearchRule "allow chronyc_t chronyd_var_log_t : file { create getattr open write } [ ]" + rlSESearchRule "allow chronyc_t var_lib_t : dir { write add_name } [ ]" + rlSESearchRule "type_transition chronyc_t var_lib_t : file chronyd_var_lib_t" + rlSESearchRule "allow chronyc_t chronyd_var_lib_t : file { create getattr open write } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1575002 + bz#1577057 + bz#1593267" + rlSEMatchPathCon "/dev/tty1" "tty_device_t" + rlSESearchRule "allow unconfined_t chronyc_exec_t : file { getattr open read execute }" + rlSESearchRule "allow unconfined_t chronyc_t : process { transition }" + rlSESearchRule "type_transition unconfined_t chronyc_exec_t : process chronyc_t" + rlSESearchRule "type_change unconfined_t tty_device_t : chr_file user_tty_device_t" + rlSESearchRule "allow chronyc_t user_tty_device_t : chr_file { read write } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1596563" + rlSEMatchPathCon "/usr/bin/chronyc" "chronyc_exec_t" + rlSEMatchPathCon "/var/run/nscd/socket" "nscd_var_run_t" + rlSEMatchPathCon "/var/db/nscd/passwd" "nscd_var_run_t" + rlSESearchRule "allow chronyc_t nscd_t : unix_stream_socket { connectto }" + rlSESearchRule "allow system_dbusd_t nscd_var_run_t : file { map }" + rlSESearchRule "dontaudit chronyc_t nscd_var_run_t : file { getattr open read }" + rlSESearchRule "allow chronyd_t chronyd_tmpfs_t : file { map }" + rlSESearchRule "allow chronyd_t gpsd_tmpfs_t : file { map }" + rlSESearchRule "allow chronyc_t nscd_t : nscd { shmemhost gethost }" + rlPhaseEnd + + rlPhaseStartTest "bz#1568281" + rlSEMatchPathCon "/usr/bin/chronyc" "chronyc_exec_t" + rlSEMatchPathCon "/run/chrony" "chronyd_var_run_t" + rlSESearchRule "allow logrotate_t chronyc_exec_t : file { getattr open read execute } [ ]" + rlSESearchRule "type_transition logrotate_t chronyc_exec_t : process chronyc_t" + rlSESearchRule "allow logrotate_t chronyc_t : process { transition } [ ]" + rlSESearchRule "allow chronyc_t chronyd_var_run_t : dir { write } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1567753" + rlSEMatchPathCon "/usr/sbin/chronyd" "chronyd_exec_t" + rlSEMatchPathCon "/var/lib/libvirt/dnsmasq" "virt_var_lib_t" + rlSESearchRule "allow chronyd_t virt_var_lib_t : dir { getattr open search read } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1618757 + bz#1622499" + rlSEMatchPathCon "/usr/bin/chronyc" "chronyc_exec_t" + rlSESearchRule "allow chronyc_t unconfined_t : unix_stream_socket { read write ioctl getattr } [ ]" + rlPhaseEnd + fi + + if ! rlIsRHEL 5 6 7 ; then + # bz#1652079 was closed as WONTFIX + rlPhaseStartTest "bz#1652079 + bz#1696252" + rlSEMatchPathCon "/usr/bin/chronyc" "chronyc_exec_t" + rlSEMatchPathCon "/var/lib" "var_lib_t" + rlSEMatchPathCon "/var/lib/test" "var_lib_t" + rlSEMatchPathCon "/var/log" "var_log_t" + rlSEMatchPathCon "/var/log/test" "var_log_t" + rlSEMatchPathCon "/var/run" "var_run_t" + rlSEMatchPathCon "/var/run/test" "var_run_t" + rlSEMatchPathCon "/var/cache" "var_t" + rlSEMatchPathCon "/var/cache/test" "var_t" + rlSESearchRule "allow chronyc_t var_lib_t : dir { getattr open search write add_name } [ ]" + rlSESearchRule "allow chronyc_t var_lib_t : file { getattr ioctl write append } [ ]" + rlSESearchRule "allow chronyc_t var_log_t : dir { getattr open search write add_name } [ ]" + rlSESearchRule "allow chronyc_t var_log_t : file { getattr ioctl write append } [ ]" + rlSESearchRule "allow chronyc_t var_t : file { getattr ioctl write append } [ ]" + rlSESearchRule "allow chronyc_t var_run_t : file { getattr ioctl write append } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#1593607" + rlSEMatchPathCon "/usr/libexec/chrony-helper" "chronyd_exec_t" + rlSESearchRule "allow chronyd_t shell_exec_t : file { map } [ ] mls" + rlPhaseEnd + + rlPhaseStartTest "bz#1772852" + rlSEMatchPathCon "/usr/bin/chronyc" "chronyc_exec_t" + rlSEMatchPathCon "/var/db/nscd/hosts" "nscd_var_run_t" + rlSESearchRule "allow chronyc_t nscd_var_run_t : file { map } [ ]" + rlPhaseEnd + fi + + if ! rlIsRHEL 5 6 7 8 ; then + rlPhaseStartTest "bz#1895825" + rlSEMatchPathCon "/run/chrony-dhcp" "chronyd_var_run_t" + rlSEMatchPathCon "/run/chrony-dhcp/something.source" "chronyd_var_run_t" + rlPhaseEnd + + rlPhaseStartTest "bz#1900143" + rlSEMatchPathCon "/run/systemd/resolve/io.systemd.Resolve" "systemd_resolved_var_run_t" + rlSESearchRule "allow chronyd_t systemd_resolved_var_run_t : sock_file { write } [ ]" + rlRun "grep resolve /etc/nsswitch.conf" + rlPhaseEnd + + rlPhaseStartTest "bz#2173604" + rlSEMatchPathCon "/usr/bin/chronyc" "chronyc_exec_t" + rlRun "ls -dZ /proc/sys/net/ipv6/conf/all | grep :sysctl_net_t" + rlRun "ls -dZ /proc/sys/net/ipv6/conf/all/disable_ipv6 | grep :sysctl_net_t" + rlSESearchRule "allow chronyc_t sysctl_net_t : dir { search } [ ]" + rlSESearchRule "allow chronyc_t sysctl_net_t : file { getattr open read } [ ]" + rlPhaseEnd + fi + + if ! rlIsRHEL 5 6 7 ; then + rlPhaseStartTest "bz#1961207" + rlSEMatchPortCon tcp 4460 ntske_port_t + rlSEMatchPathCon "/usr/share/pki/ca-trust-source/ca-bundle.trust.p11-ki" "cert_t" + rlSESearchRule "allow chronyd_t ntske_port_t : tcp_socket { name_bind name_connect } [ ]" + rlSESearchRule "allow chronyd_t chronyd_t : tcp_socket { listen accept }" + rlSESearchRule "allow chronyd_t cert_t : file { map } [ ]" + rlPhaseEnd + fi + + if rlIsFedora ; then + rlPhaseStartTest "bz#2008894" + rlSEMatchPathCon "/usr/bin/chronyc" "chronyc_exec_t" + rlSESearchRule "allow init_t chronyc_t : process2 { nnp_transition } [ ]" + rlPhaseEnd + + rlPhaseStartTest "real scenario -- chrony-wait service" + rlServiceStop chrony-wait + rlRun "mkdir -p /run/systemd/system/chrony-wait.service.d" + rlRun "echo -e '[Service]\nDynamicUser=yes' > /run/systemd/system/chrony-wait.service.d/override.conf" + rlRun "systemctl daemon-reload" + rlRun "systemctl start chrony-wait.service" + sleep 5 + rlRun "systemctl stop chrony-wait.service" + rlRun "rm -f /run/systemd/system/chrony-wait.service.d/override.conf" + rlRun "systemctl daemon-reload" + rlServiceRestore chrony-wait + rlPhaseEnd + fi + + rlPhaseStartTest "real scenario" + rlRun "echo \"sched_priority 50\" >> /etc/chrony.conf" + rlRun "echo \"refclock SHM 0\" >> /etc/chrony.conf" + rlRun "echo \"refclock SOCK /var/run/chronyd.sock\" >> /etc/chrony.conf" + rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + if rlIsRHEL 5 6 ; then + PROCESS_CONTEXT="initrc_t" + else + PROCESS_CONTEXT="unconfined_service_t" + fi + fi + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + if ! rlIsFedora ; then + rlRun "ipcs -m | grep 0x4e545030" + rlRun "ls -Z /var/run/chronyd.sock | grep :chronyd_var_run_t" + fi + rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status" 1 + rlRun "chronyc tracking" + for OUTPUT_FILE in /tmp/chronyc.output /var/lib/chrony/chronyc.output /var/log/chrony/chronyc.output ; do + rlRun "rm -f ${OUTPUT_FILE}" + rlRun "chronyc tracking > ${OUTPUT_FILE}" + rlRun "test -s ${OUTPUT_FILE}" + rlRun "ls -Z ${OUTPUT_FILE} | grep -e :user_tmp_t -e :chronyd_var_lib_t -e :chronyd_var_log_t" + done + if ! rlIsRHEL 7 ; then + for OUTPUT_FILE in /var/lib/test /var/log/test /var/run/test /var/cache/test ; do + rlRun "rm -f ${OUTPUT_FILE}" + rlRun "chronyc -n tracking > ${OUTPUT_FILE}" + rlRun "test -s ${OUTPUT_FILE}" + rlRun "chronyc -n tracking >> ${OUTPUT_FILE}" + rlRun "ls -Z ${OUTPUT_FILE}" + rlRun "ls -Z ${OUTPUT_FILE} | grep -e :var_lib_t -e :var_log_t -e :var_run_t -e :var_t" + rlRun "rm -f ${OUTPUT_FILE}" + done + fi + if rpm -q nscd >& /dev/null ; then + rlRun "service nscd start" + fi + sleep 2 + rlRun "getsebool -a | grep nscd" + rlRun "chronyc sources" + rlRun "ksh -c \"chronyc sources\"" + if ! rlIsRHEL 5 6 ; then + rlRun "chronyc serverstats" + fi + if rpm -q nscd >& /dev/null ; then + rlRun "service nscd stop" + fi + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "stop status" 1 + rlPhaseEnd + + if ! rlIsRHEL 5 6 ; then + rlPhaseStartTest "real scenario -- bz#1530525" + rlRun "rm -f /etc/chrony.keys" + rlRun "touch /etc/chrony.keys" + rlRun "restorecon -v /etc/chrony.keys" + rlRun "chronyc keygen 1111 SHA1 > /etc/chrony.keys" + rlRun "chronyc keygen 1111 SHA1 >> /etc/chrony.keys" + rlRun "ls -Z /etc/chrony.keys | grep :chronyd_keys_t" + rlPhaseEnd + fi + + if ! rlIsRHEL 5 6 7 ; then + rlPhaseStartTest "real scenario -- bz#1961207" + rlRun "./chrony-nts-test.sh" + rlRun "rm -f /var/lib/chrony/*.nts" + rlRun "systemctl restart chronyd" + rlPhaseEnd + + rlPhaseStartTest "bz#2065313" + rlSESearchRule "allow chronyd_t unconfined_t : unix_dgram_socket { sendto }" + rlPhaseEnd + + rlPhaseStartTest "real scenario -- bz#2065313" + rlRun 'printf "\x6\x1\x0\x0\x0\x21\x0\x0\x21\xd7\xe4\x22\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0" | socat unix-sendto:/run/chrony/chronyd.sock,bind=/run/chrony/chronyc.sock,umask=0000 - | hexdump -C' 0 "special socat command talks to chronyd via its UNIX socket" + rlPhaseEnd + + rlPhaseStartTest "bz#2118628 + bz#2118631" + rlSEMatchPortCon udp 319 ptp_event_port_t + rlSESearchRule "allow chronyd_t ptp_event_port_t : udp_socket { name_bind } [ ]" + rlPhaseEnd + + rlPhaseStartTest "real scenario -- bz#2118628 + bz#2118631" + rlRun "echo -en '\nallow\nptpport 319\nserver 127.0.0.1 port 319 minpoll 0 maxpoll 0\n' >> /etc/chrony.conf" + rlRun "systemctl restart chronyd" + sleep 5 + rlRun "chronyc ntpdata 127.0.0.1 | grep 'Total RX'" + rlPhaseEnd + fi + + if [ -f ${CHRONYD_RESTRICTED_UNIT_FILE} ]; then + rlPhaseStartTest "chronyd-restricted -- bz#2169949 + RHEL-18219" + rlRun "systemctl stop ${SERVICE_NAME}" + rlRun "mkdir -p ${CHRONYD_RESTRICTED_UNIT_DROPIN_DIR}" + if ! grep ^SELinuxContext= ${CHRONYD_RESTRICTED_UNIT_FILE} ; then + # temporary configuration change until it becomes a part of the chrony package + rlRun "echo -e '[Service]\nSELinuxContext=system_u:system_r:chronyd_restricted_t:s0\n' > ${CHRONYD_RESTRICTED_UNIT_DROPIN_FILE}" + rlRun "systemctl daemon-reload" + fi + rlRun "systemctl start ${CHRONYD_RESTRICTED_SERVICE}" + sleep 3 + rlRun "ps -o pid,uid,command,context -C chronyd | grep -1 system_u:system_r:chronyd_restricted_t:" + rlRun "systemctl status ${CHRONYD_RESTRICTED_SERVICE}" + rlRun "systemctl restart ${CHRONYD_RESTRICTED_SERVICE}" + rlRun "systemctl status ${CHRONYD_RESTRICTED_SERVICE}" + rlRun "systemctl stop ${CHRONYD_RESTRICTED_SERVICE}" + rlRun "rm -f ${CHRONYD_RESTRICTED_UNIT_DROPIN_FILE}" + rlRun "systemctl daemon-reload" + rlPhaseEnd + fi + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlRun "rm -f /tmp/chronyc.output /var/lib/chrony/chronyc.output /var/log/chrony/chronyc.output" + rlFileRestore + rlServiceRestore `rlSEListServices 123` + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + From 12ea165a341b5e0890fbb72d6866d38f7f6fee24 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Mon, 29 Jan 2024 14:45:12 +0100 Subject: [PATCH 319/626] test if sysadm_u can run dmidecode via sudo A recently filed customer case revealed that SELinux prevents the sysadm_u users from running the dmidecode command via sudo which has the input/output logging enabled. The following error message appears during the action: sudo: unable to open /var: Permission denied The TC reproduces the situation. In order to support the above-mentioned configuration, I believe that SELinux policy should allow the necessary actions. The TC looks for appropriate policy rules and file context patterns. The TC covers RHEL-16104. --- selinux-policy/dmidecode-and-similar/Makefile | 1 + selinux-policy/dmidecode-and-similar/main.fmf | 1 + .../dmidecode-and-similar/runtest.sh | 25 +++++++++++++++++++ 3 files changed, 27 insertions(+) diff --git a/selinux-policy/dmidecode-and-similar/Makefile b/selinux-policy/dmidecode-and-similar/Makefile index 6de3c03..03a223f 100644 --- a/selinux-policy/dmidecode-and-similar/Makefile +++ b/selinux-policy/dmidecode-and-similar/Makefile @@ -68,6 +68,7 @@ $(METADATA): Makefile @echo "Bug: 1300799" >> $(METADATA) # RHEL-7 @echo "Bug: 1608480" >> $(METADATA) # RHEL-7 @echo "Bug: 1926696" >> $(METADATA) # Fedora 34 + @echo "Bug: RHEL-16104" >> $(METADATA) # RHEL-9 rhts-lint $(METADATA) diff --git a/selinux-policy/dmidecode-and-similar/main.fmf b/selinux-policy/dmidecode-and-similar/main.fmf index 3c7d84d..21e4f79 100644 --- a/selinux-policy/dmidecode-and-similar/main.fmf +++ b/selinux-policy/dmidecode-and-similar/main.fmf @@ -41,6 +41,7 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1300799 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1608480 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1926696 + - verifies: https://issues.redhat.com/browse/RHEL-16104 adjust: - enabled: false when: distro == rhel-4 diff --git a/selinux-policy/dmidecode-and-similar/runtest.sh b/selinux-policy/dmidecode-and-similar/runtest.sh index 51caa22..3b3d0bf 100755 --- a/selinux-policy/dmidecode-and-similar/runtest.sh +++ b/selinux-policy/dmidecode-and-similar/runtest.sh @@ -132,6 +132,31 @@ rlJournalStart done rlPhaseEnd + rlPhaseStartTest "RHEL-16104" + rlSEMatchPathCon "/var" "var_t" + rlSEMatchPathCon "/var/log" "var_log_t" + rlSEMatchPathCon "/var/log/sudo-io" "sudo_log_t" + rlSESearchRule "allow sysadm_sudo_t var_t : dir { read } [ ]" + rlSESearchRule "allow sysadm_sudo_t var_log_t : dir { read } [ ]" + rlSESearchRule "allow sysadm_sudo_t sudo_log_t : dir { read } [ ]" + rlRun "setsebool ssh_sysadm_login on" + rlRun "useradd -Z sysadm_u -G wheel sysadm-user" + USER_SECRET="S3kr3t${RANDOM}" + rlRun "echo ${USER_SECRET} | passwd --stdin sysadm-user" + rlRun "echo -en 'Defaults log_output\nDefaults log_input\nDefaults iolog_dir=/var/log/sudo-io\nsysadm-user ALL=(ALL) NOPASSWD: ALL\n' > /etc/sudoers.d/sysadm-user" + rlRun "rm -rf /var/log/sudo-io" + rlRun -s "./ssh.exp sysadm-user ${USER_SECRET} localhost sudo dmidecode" + rlRun "grep DMI $rlRun_LOG" + rlRun "rm -f $rlRun_LOG" + rlRun "rm -rf /var/log/sudo-io" + rlRun -s "./ssh.exp sysadm-user ${USER_SECRET} localhost sudo -r sysadm_r dmidecode" + rlRun "grep DMI $rlRun_LOG" + rlRun "rm -f $rlRun_LOG" + rlRun "rm -f /etc/sudoers.d/sysadm-user" + rlRun "userdel -rfZ sysadm-user" + rlRun "setsebool ssh_sysadm_login off" + rlPhaseEnd + rlPhaseStartCleanup sleep 2 rlSECheckAVC From c7297bd7a3d512bb861d16685c1c95019520acc6 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Mon, 29 Jan 2024 17:18:52 +0100 Subject: [PATCH 320/626] test if colord can use NoNewPrivileges Recently, openQA testing of new colord version (1.4.7-1) revealed that SELinux prevents the colord process transition from init_t to colord_t domain. The TC reproduces the situation. In order to support the existing colord functionality together with the newly added systemd unit option (NoNewPrivileges=true), I believe that SELinux policy should allow the action. The TC looks for appropriate policy rules and file context patterns. The TC covers BZ#2259679. --- selinux-policy/colord-and-similar/Makefile | 3 ++- selinux-policy/colord-and-similar/main.fmf | 4 ++-- selinux-policy/colord-and-similar/runtest.sh | 9 +++++++++ 3 files changed, 13 insertions(+), 3 deletions(-) diff --git a/selinux-policy/colord-and-similar/Makefile b/selinux-policy/colord-and-similar/Makefile index 4a609b8..32ada87 100644 --- a/selinux-policy/colord-and-similar/Makefile +++ b/selinux-policy/colord-and-similar/Makefile @@ -55,7 +55,7 @@ $(METADATA): Makefile @echo "TestTime: 10m" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) @echo "RunFor: colord" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted glib2 setools-console colord initscripts expect" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted glib2 setools-console colord /usr/sbin/service expect" >> $(METADATA) @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @echo "License: GPLv2" >> $(METADATA) @@ -69,6 +69,7 @@ $(METADATA): Makefile @echo "Bug: 1421247" >> $(METADATA) # RHEL-7 @echo "Bug: 1460480" >> $(METADATA) # RHEL-7 @echo "Bug: 1772669" >> $(METADATA) # RHEL-8 + @echo "Bug: 2259679" >> $(METADATA) # Fedora 40 rhts-lint $(METADATA) diff --git a/selinux-policy/colord-and-similar/main.fmf b/selinux-policy/colord-and-similar/main.fmf index 559be9e..7e4ba6a 100644 --- a/selinux-policy/colord-and-similar/main.fmf +++ b/selinux-policy/colord-and-similar/main.fmf @@ -17,7 +17,7 @@ recommend: - glib2 - setools-console - colord - - initscripts + - /usr/sbin/service - expect environment: AVC_ERROR: +no_avc_check @@ -29,7 +29,6 @@ tag: - NoRHEL4 - NoRHEL5 - NoRHEL6 - - RHEL8 - TIPpass - TIPpass_FIPS - TIPpass_Security @@ -48,6 +47,7 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1772669 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1951114 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1878094 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2259679 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6 diff --git a/selinux-policy/colord-and-similar/runtest.sh b/selinux-policy/colord-and-similar/runtest.sh index 4d7aece..9cd88f0 100755 --- a/selinux-policy/colord-and-similar/runtest.sh +++ b/selinux-policy/colord-and-similar/runtest.sh @@ -142,6 +142,15 @@ rlJournalStart rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd + if rlIsFedora ; then + rlPhaseStartTest "bz#2259679" + rlSEMatchPathCon "/usr/libexec/colord" "colord_exec_t" + rlSEMatchPathCon "/var/lib/colord/mapping.db" "colord_var_lib_t" + rlSESearchRule "allow init_t colord_t : process2 { nnp_transition } [ ]" + rlSESearchRule "allow colord_t colord_var_lib_t : file { read write } [ ]" + rlPhaseEnd + fi + rlPhaseStartCleanup sleep 2 rlSECheckAVC From 4119cf83ed14066a06f3df15af08d8d425df7773 Mon Sep 17 00:00:00 2001 From: bgrech Date: Tue, 30 Jan 2024 09:05:17 -0600 Subject: [PATCH 321/626] Add support for rpm-ostree as a package manager for installDeps --- kernel/selinux-testsuite/runtest.sh | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/kernel/selinux-testsuite/runtest.sh b/kernel/selinux-testsuite/runtest.sh index a940018..b5f6cc9 100755 --- a/kernel/selinux-testsuite/runtest.sh +++ b/kernel/selinux-testsuite/runtest.sh @@ -94,7 +94,13 @@ function installDepsYum() { } function installDeps() { - if type yum >/dev/null; then + if [ -e /run/ostree-booted ]; then + for item in "$@"; do + if ! rpm -q --quiet --whatprovides "$item"; then + rpm-ostree --apply-live -y install "$item" + fi + done + elif type yum >/dev/null; then installDepsYum yum "$@" elif type dnf >/dev/null; then installDepsYum dnf "$@" @@ -186,7 +192,7 @@ rlJournalStart rlRun "installDeps \$REQUIRES" 0 "Install requires" # The CRB repo with libbpf-devel might not be enabled on RHEL - if rlIsRHEL '>=8'; then + if rlIsRHEL '>=8' && ! [ -e /run/ostree-booted ]; then for repo in "rhel-CRB" "beaker-CRB"; do rpm -q libbpf-devel &>/dev/null && break rlRun "dnf install --enablerepo $repo -y libbpf-devel" 0-255 From d5d0a48cc8c18ee431a2aef8c3d873724cc94bad Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Thu, 8 Feb 2024 14:22:08 +0100 Subject: [PATCH 322/626] add a new test plan which covers reboot actions The test plan covers the following actions: * update packages to the latest versions available * reboot * collect SELinux denials that appeared since reboot --- other/collect-denials/main.fmf | 11 ++++++++++ other/collect-denials/runtest.sh | 20 +++++++++++++++++++ other/collect-denials/test.sh | 20 +++++++++++++++++++ other/update-packages/main.fmf | 7 +++++++ other/update-packages/runtest.sh | 19 ++++++++++++++++++ other/update-packages/test.sh | 19 ++++++++++++++++++ plans/reboot.fmf | 11 ++++++++++ .../main.fmf | 2 +- 8 files changed, 108 insertions(+), 1 deletion(-) create mode 100644 other/collect-denials/main.fmf create mode 100755 other/collect-denials/runtest.sh create mode 100755 other/collect-denials/test.sh create mode 100644 other/update-packages/main.fmf create mode 100755 other/update-packages/runtest.sh create mode 100755 other/update-packages/test.sh create mode 100644 plans/reboot.fmf diff --git a/other/collect-denials/main.fmf b/other/collect-denials/main.fmf new file mode 100644 index 0000000..a02c9b6 --- /dev/null +++ b/other/collect-denials/main.fmf @@ -0,0 +1,11 @@ +summary: collect SELinux denials which appeared since boot +contact: Milos Malik +test: ./runtest.sh +framework: beakerlib +recommend: + - audit + - /usr/sbin/service + - policycoreutils +duration: 5m +enabled: true + diff --git a/other/collect-denials/runtest.sh b/other/collect-denials/runtest.sh new file mode 100755 index 0000000..ff52732 --- /dev/null +++ b/other/collect-denials/runtest.sh @@ -0,0 +1,20 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +rlJournalStart + rlPhaseStartSetup + rlRun "sestatus" + rlRun "rpm -qa | grep -e audit -e libsepol -e libselinux -e libsemanage -e selinux-policy -e policycoreutils | sort" + rlPhaseEnd + + rlPhaseStartTest + rlRun "service auditd status -l" + rlRun "ausearch -m avc -m selinux_err -i -ts boot" 1 + rlRun "dmesg | grep -i -e selinux -e type=1300 -e type=1400" + rlPhaseEnd + + rlPhaseStartCleanup + rlPhaseEnd +rlJournalEnd + diff --git a/other/collect-denials/test.sh b/other/collect-denials/test.sh new file mode 100755 index 0000000..f8845e4 --- /dev/null +++ b/other/collect-denials/test.sh @@ -0,0 +1,20 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +rlJournalStart + rlPhaseStartSetup + rlRun "sestatus" + rlRun "rpm -qa | grep -e audit -e libsepol -e libselinux -e libsemanage -e selinux-policy -e policycoreutils | sort" + rlPhaseEnd + + rlPhaseStartTest + rlRun "service auditd status -l" + rlRun "ausearch -m avc -m selinux_err -i -ts boot" + rlRun "dmesg | grep -i -e selinux -e type=1300 -e type=1400" + rlPhaseEnd + + rlPhaseStartCleanup + rlPhaseEnd +rlJournalEnd + diff --git a/other/update-packages/main.fmf b/other/update-packages/main.fmf new file mode 100644 index 0000000..2c54741 --- /dev/null +++ b/other/update-packages/main.fmf @@ -0,0 +1,7 @@ +summary: update packages to the latest versions available +contact: Milos Malik +test: ./runtest.sh +framework: beakerlib +duration: 15m +enabled: true + diff --git a/other/update-packages/runtest.sh b/other/update-packages/runtest.sh new file mode 100755 index 0000000..967588e --- /dev/null +++ b/other/update-packages/runtest.sh @@ -0,0 +1,19 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +rlJournalStart + rlPhaseStartSetup + rlRun "rpm -qa | grep -e audit -e libsepol -e libselinux -e libsemanage -e selinux-policy -e policycoreutils | sort" + rlPhaseEnd + + rlPhaseStartTest + rlRun "dnf clean all" + rlRun "dnf -y update --skip-broken --allowerasing" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "rpm -qa | grep -e audit -e libsepol -e libselinux -e libsemanage -e selinux-policy -e policycoreutils | sort" + rlPhaseEnd +rlJournalEnd + diff --git a/other/update-packages/test.sh b/other/update-packages/test.sh new file mode 100755 index 0000000..967588e --- /dev/null +++ b/other/update-packages/test.sh @@ -0,0 +1,19 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +rlJournalStart + rlPhaseStartSetup + rlRun "rpm -qa | grep -e audit -e libsepol -e libselinux -e libsemanage -e selinux-policy -e policycoreutils | sort" + rlPhaseEnd + + rlPhaseStartTest + rlRun "dnf clean all" + rlRun "dnf -y update --skip-broken --allowerasing" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "rpm -qa | grep -e audit -e libsepol -e libselinux -e libsemanage -e selinux-policy -e policycoreutils | sort" + rlPhaseEnd +rlJournalEnd + diff --git a/plans/reboot.fmf b/plans/reboot.fmf new file mode 100644 index 0000000..cb304d0 --- /dev/null +++ b/plans/reboot.fmf @@ -0,0 +1,11 @@ +summary: update, reboot and check for denials +discover: + how: fmf + url: https://src.fedoraproject.org/tests/selinux + test: + - /other/update-packages + - /selinux-policy/bz533007-unable-to-start-kdump-service + - /other/collect-denials +execute: + how: tmt + diff --git a/selinux-policy/bz533007-unable-to-start-kdump-service/main.fmf b/selinux-policy/bz533007-unable-to-start-kdump-service/main.fmf index eb81cce..152701d 100644 --- a/selinux-policy/bz533007-unable-to-start-kdump-service/main.fmf +++ b/selinux-policy/bz533007-unable-to-start-kdump-service/main.fmf @@ -1,4 +1,4 @@ -summary: kdump service cannot be started because of SELinux +summary: SELinux interferes with kdump and related programs description: |+ SELinux interferes with kdump and related programs. From 1a3d30f8ddfaed64910d54f5c1689d8a6b0e5d4b Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Mon, 12 Feb 2024 11:02:21 +0100 Subject: [PATCH 323/626] kernel/selinux-testsuite: add a fix and a workaround for rpm-ostree 1. Bump the upstream commit to pull in [1]. 2. Apply a workaround to compensate for [2] not yet being applied everywhere where it matters. [1] https://github.com/SELinuxProject/selinux-testsuite/commit/f9f4a604b50eecdc9ff674f1762208f23c15013f [2] https://github.com/fedora-selinux/selinux-policy/pull/2029 Signed-off-by: Ondrej Mosnacek --- kernel/selinux-testsuite/runtest.sh | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/kernel/selinux-testsuite/runtest.sh b/kernel/selinux-testsuite/runtest.sh index b5f6cc9..a5258dc 100755 --- a/kernel/selinux-testsuite/runtest.sh +++ b/kernel/selinux-testsuite/runtest.sh @@ -35,7 +35,7 @@ PACKAGE="selinux-policy" # This should be updated as needed after verifying that the new version # doesn't break testing and after applying all necessary tweaks in the TC. # Run with GIT_BRANCH=master to run the latest upstream version. -DEFAULT_COMMIT="514e324abc099057782ec569b720eaf9b6d9d99f" +DEFAULT_COMMIT="f9f4a604b50eecdc9ff674f1762208f23c15013f" # Default pull requests to merge before running the test. # If non-empty, then after checking out GIT_BRANCH the listed upstream pull # requests (by number) are merged, creating a new temporary local branch. @@ -333,6 +333,18 @@ rlJournalStart rlRun "sed -i 's/tm\.tv_sec = [0-9]*;/tm.tv_sec = $NETWORK_TIMEOUT;/' ./tests/*/*.c" 0 \ "Tweak timeout in networking tests" # 2 secs is too little for SCTP test + # Fixed by https://github.com/fedora-selinux/selinux-policy/pull/2029, + # but may not be in all distro streams. + rlRun "tee -a policy/test_global.te" 0 \ + "Work around missing policy rules" < Date: Wed, 14 Feb 2024 13:09:19 +0100 Subject: [PATCH 324/626] adapt to semanage port dealing with duplicated local customization The semanage command from older policycoreutils versions (<= 3.6-1.el9) behaves in a certain way when a duplicated port context pattern is added. It does not add the pattern but produces the following message: ValueError: Port / already defined The semanage command from new policycoreutils versions (>= 3.6-2.el9) behaves differently when a duplicated port context pattern is added. It adds the pattern and produces the following message: Port / already defined, modifying instead Above-mentioned differences in behavior have some consequences for the automated test when removing a duplicated port context pattern. If the automated test should pass, it needs to anticipate both possibilities. --- .../semanage-port-add-delete-problems/Makefile | 9 +++++---- .../semanage-port-add-delete-problems/main.fmf | 9 +++++---- .../semanage-port-add-delete-problems/runtest.sh | 6 +++++- 3 files changed, 15 insertions(+), 9 deletions(-) diff --git a/policycoreutils/semanage-port-add-delete-problems/Makefile b/policycoreutils/semanage-port-add-delete-problems/Makefile index 263da02..36cdf85 100644 --- a/policycoreutils/semanage-port-add-delete-problems/Makefile +++ b/policycoreutils/semanage-port-add-delete-problems/Makefile @@ -54,13 +54,14 @@ $(METADATA): Makefile @echo "Type: Regression" >> $(METADATA) @echo "TestTime: 15m" >> $(METADATA) @echo "RunFor: policycoreutils" >> $(METADATA) + @echo "Requires: audit" >> $(METADATA) + @echo "Requires: coreutils" >> $(METADATA) + @echo "Requires: grep" >> $(METADATA) + @echo "Requires: libselinux" >> $(METADATA) + @echo "Requires: libselinux-utils" >> $(METADATA) @echo "Requires: policycoreutils" >> $(METADATA) @echo "Requires: policycoreutils-python-utils" >> $(METADATA) @echo "Requires: setools-console" >> $(METADATA) - @echo "Requires: libselinux" >> $(METADATA) - @echo "Requires: libselinux-utils" >> $(METADATA) - @echo "Requires: coreutils" >> $(METADATA) - @echo "Requires: grep" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @echo "License: GPLv2" >> $(METADATA) @echo "Confidential: no" >> $(METADATA) diff --git a/policycoreutils/semanage-port-add-delete-problems/main.fmf b/policycoreutils/semanage-port-add-delete-problems/main.fmf index d0609a9..d948252 100644 --- a/policycoreutils/semanage-port-add-delete-problems/main.fmf +++ b/policycoreutils/semanage-port-add-delete-problems/main.fmf @@ -6,13 +6,14 @@ contact: Milos Malik component: - policycoreutils recommend: + - audit + - coreutils + - grep + - libselinux + - libselinux-utils - policycoreutils - policycoreutils-python-utils - setools-console - - libselinux - - libselinux-utils - - coreutils - - grep duration: 15m extra-summary: /CoreOS/policycoreutils/Regression/semanage-port-add-delete-problems extra-task: /CoreOS/policycoreutils/Regression/semanage-port-add-delete-problems diff --git a/policycoreutils/semanage-port-add-delete-problems/runtest.sh b/policycoreutils/semanage-port-add-delete-problems/runtest.sh index 435fc40..835b043 100755 --- a/policycoreutils/semanage-port-add-delete-problems/runtest.sh +++ b/policycoreutils/semanage-port-add-delete-problems/runtest.sh @@ -115,8 +115,12 @@ rlJournalStart rlRun "semanage port -a -t smtp_port_t -p tcp 25 2>&1 | tee ${OUTPUT_FILE}" rlAssertGrep "port .* already defined" ${OUTPUT_FILE} -i rlRun "semanage port -l | grep 'smtp_port_t.*tcp.*25'" + rm -f ${OUTPUT_FILE} rlRun "semanage port -d -t smtp_port_t -p tcp 25 2>&1 | tee ${OUTPUT_FILE}" - rlAssertGrep "port .* is defined in policy.*cannot be deleted" ${OUTPUT_FILE} -i + # the error may not appear because the local customization can be deleted always + if [ -s ${OUTPUT_FILE} ] ; then + rlAssertGrep "port .* is defined in policy.*cannot be deleted" ${OUTPUT_FILE} -i + fi rlRun "semanage port -d -t smtp_port_t -p tcp 25 2>&1 | tee ${OUTPUT_FILE}" rlAssertGrep "port .* is defined in policy.*cannot be deleted" ${OUTPUT_FILE} -i rlRun "semanage port -l | grep 'smtp_port_t.*tcp.*25'" From 2b69b8c3477263b059daab7cb578d64a2bda0ef2 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Thu, 15 Feb 2024 14:20:53 +0100 Subject: [PATCH 325/626] kernel/selinux-testsuite: hotfix for RHEL-6 The install_t workaround for rpm-ostree doesn't work on RHEL-6, so make it conditional on /run/ostree-booted, so that it is only applied when necessary. Signed-off-by: Ondrej Mosnacek --- kernel/selinux-testsuite/runtest.sh | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) diff --git a/kernel/selinux-testsuite/runtest.sh b/kernel/selinux-testsuite/runtest.sh index a5258dc..1c5e2ce 100755 --- a/kernel/selinux-testsuite/runtest.sh +++ b/kernel/selinux-testsuite/runtest.sh @@ -333,17 +333,19 @@ rlJournalStart rlRun "sed -i 's/tm\.tv_sec = [0-9]*;/tm.tv_sec = $NETWORK_TIMEOUT;/' ./tests/*/*.c" 0 \ "Tweak timeout in networking tests" # 2 secs is too little for SCTP test - # Fixed by https://github.com/fedora-selinux/selinux-policy/pull/2029, - # but may not be in all distro streams. - rlRun "tee -a policy/test_global.te" 0 \ - "Work around missing policy rules" < Date: Thu, 15 Feb 2024 09:14:56 +0100 Subject: [PATCH 326/626] test if systemd-notify can send into /run/systemd/notify A recently filed customer case revealed that SELinux prevents the systemd-notify processes from sending data into UDP socket (to a process waiting on the other side of /run/systemd/notify socket). The TC reproduces the situation. In order to support the expected functions of systemd services (especially type=notify), I believe that SELinux policy should allow the actions. The TC looks for appropriate policy rules and file context patterns. The TC covers RHEL-25514 and RHEL-25605. --- .../systemd-notify-and-similar/Makefile | 6 ++++-- .../systemd-notify-and-similar/main.fmf | 4 ++++ .../reproducer.service | 5 +++++ .../systemd-notify-and-similar/runtest.sh | 16 ++++++++++++++++ 4 files changed, 29 insertions(+), 2 deletions(-) create mode 100644 selinux-policy/systemd-notify-and-similar/reproducer.service diff --git a/selinux-policy/systemd-notify-and-similar/Makefile b/selinux-policy/systemd-notify-and-similar/Makefile index 2e2d3d3..24161e3 100644 --- a/selinux-policy/systemd-notify-and-similar/Makefile +++ b/selinux-policy/systemd-notify-and-similar/Makefile @@ -29,7 +29,7 @@ export TESTVERSION=1.0 BUILT_FILES= -FILES=$(METADATA) runtest.sh Makefile PURPOSE local-notifier.service notifier.sh +FILES=$(METADATA) runtest.sh Makefile PURPOSE local-notifier.service notifier.sh reproducer.service .PHONY: all install download clean @@ -61,8 +61,10 @@ $(METADATA): Makefile @echo "License: GPLv2" >> $(METADATA) @echo "Confidential: no" >> $(METADATA) @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5 -RHEL6" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) @echo "Bug: 1903305" >> $(METADATA) # Fedora 33 + @echo "Bug: RHEL-25514" >> $(METADATA) # RHEL-9 + @echo "Bug: RHEL-25605" >> $(METADATA) # RHEL-8 rhts-lint $(METADATA) diff --git a/selinux-policy/systemd-notify-and-similar/main.fmf b/selinux-policy/systemd-notify-and-similar/main.fmf index 70183bc..76e04c2 100644 --- a/selinux-policy/systemd-notify-and-similar/main.fmf +++ b/selinux-policy/systemd-notify-and-similar/main.fmf @@ -20,6 +20,8 @@ recommend: - setools-console - systemd - /usr/sbin/service +environment: + AVC_ERROR: +no_avc_check duration: 10m enabled: true tag: @@ -33,6 +35,8 @@ tag: tier: '2' link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1903305 + - verifies: https://issues.redhat.com/browse/RHEL-25514 + - verifies: https://issues.redhat.com/browse/RHEL-25605 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 diff --git a/selinux-policy/systemd-notify-and-similar/reproducer.service b/selinux-policy/systemd-notify-and-similar/reproducer.service new file mode 100644 index 0000000..58ec78c --- /dev/null +++ b/selinux-policy/systemd-notify-and-similar/reproducer.service @@ -0,0 +1,5 @@ +[Service] +Type=notify +NotifyAccess=all +ExecStart=/bin/sh -c "sleep 3; systemd-notify --ready; sleep 30" + diff --git a/selinux-policy/systemd-notify-and-similar/runtest.sh b/selinux-policy/systemd-notify-and-similar/runtest.sh index 59a2908..d9cfbe7 100755 --- a/selinux-policy/systemd-notify-and-similar/runtest.sh +++ b/selinux-policy/systemd-notify-and-similar/runtest.sh @@ -103,6 +103,22 @@ rlJournalStart rlRun "systemctl daemon-reload" rlPhaseEnd + rlPhaseStartTest "RHEL-25514 + RHEL-25605" + rlSEMatchPathCon "/usr/bin/systemd-notify" "systemd_notify_exec_t" + rlSEMatchPathCon "/run/systemd/notify" "init_var_run_t" + rlSESearchRule "allow systemd_notify_t systemd_notify_t : capability { sys_admin } [ ]" + rlSESearchRule "allow systemd_notify_t kernel_t : unix_dgram_socket { sendto } [ ]" + + rlRun "cp -f ./reproducer.service /etc/systemd/system/" + rlRun "systemctl daemon-reload" + rlRun "service reproducer start" + rlRun -s "service reproducer status -l" + rlRun "grep -i 'failed.*notify.*permission.*denied' $rlRun_LOG" 1 + rm -f $rlRun_LOG + rlRun "rm -f /etc/systemd/system/reproducer.service" + rlRun "systemctl daemon-reload" + rlPhaseEnd + rlPhaseStartCleanup sleep 2 rlSECheckAVC From 3e8824e0aa70c59816101165e89c3b1d7e7ebace Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Wed, 14 Feb 2024 15:34:22 +0100 Subject: [PATCH 327/626] kernel/selinux-testsuite: fix kernel pkg name detection The directory may also be owned by -modules-core rather than -core in some cases. Use the "config" file as the reference instead. Signed-off-by: Ondrej Mosnacek --- kernel/selinux-testsuite/runtest.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/selinux-testsuite/runtest.sh b/kernel/selinux-testsuite/runtest.sh index 1c5e2ce..cb9ec66 100755 --- a/kernel/selinux-testsuite/runtest.sh +++ b/kernel/selinux-testsuite/runtest.sh @@ -122,7 +122,7 @@ rlJournalStart # Determine the base kernel package name and version corresponding # to the currently running kernel. Use this information to derive # the correct kernel subpackages to install. - if KERNEL_CORE_NVRA="$(rpm -qf "/lib/modules/$(uname -r)")"; then + if KERNEL_CORE_NVRA="$(rpm -qf "/lib/modules/$(uname -r)/config")"; then KERNEL_CORE_NV="${KERNEL_CORE_NVRA%-*}" KERNEL_CORE_N="${KERNEL_CORE_NV%-*}" From 87346d0760497fa33958272e80fa3d47620e2875 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Wed, 14 Feb 2024 11:20:13 +0100 Subject: [PATCH 328/626] kernel/selinux-testsuite: add workaround for CONFIG_SCSI_ISCSI_ATTRS=n This is needed for the testsuite to be runnable on RH automotive kernels. Signed-off-by: Ondrej Mosnacek --- kernel/selinux-testsuite/runtest.sh | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/kernel/selinux-testsuite/runtest.sh b/kernel/selinux-testsuite/runtest.sh index cb9ec66..4d76a33 100755 --- a/kernel/selinux-testsuite/runtest.sh +++ b/kernel/selinux-testsuite/runtest.sh @@ -436,6 +436,13 @@ EOF #if kver_ge 5.14.0-326; then # force_tests+=" inet_socket/mptcp" #fi + + if ! grep -q 'CONFIG_SCSI_ISCSI_ATTRS=y' "/lib/modules/$(uname -r)/config"; then + rlRun "sed -i -e 's/runcon -t test_netlink_iscsi_socket_t/true/' \ + -e 's/runcon -t test_no_netlink_iscsi_socket_t/false/' \ + tests/netlink_socket/test" 0 \ + "Apply workaround for disabled CONFIG_SCSI_ISCSI_ATTRS" + fi fi # CKI mainline kernels don't ship with module build infrastructure From e1ad035bde32168ab8f0ca5f47ad7b32cbb90c33 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Thu, 15 Feb 2024 14:19:53 +0100 Subject: [PATCH 329/626] kernel/selinux-testsuite: add workaround for CONFIG_QFMT_V2=n This is needed for the testsuite to be runnable on RH automotive kernels. Signed-off-by: Ondrej Mosnacek --- kernel/selinux-testsuite/runtest.sh | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/kernel/selinux-testsuite/runtest.sh b/kernel/selinux-testsuite/runtest.sh index 4d76a33..51884a7 100755 --- a/kernel/selinux-testsuite/runtest.sh +++ b/kernel/selinux-testsuite/runtest.sh @@ -443,6 +443,14 @@ EOF tests/netlink_socket/test" 0 \ "Apply workaround for disabled CONFIG_SCSI_ISCSI_ATTRS" fi + + if ! grep -q 'CONFIG_QFMT_V2=y' "/lib/modules/$(uname -r)/config"; then + # patch the filesystem tests to not do quota tests on ext4 + rlRun "sed -i -e 's/\`uname -r\`/\"3.0\"/' \ + -e 's/\\(elsif ( \$fs_type eq \"nfs4\" or \$fs_type eq \"nfs\"\\)/\\1 or \$fs_type eq \"ext4\"/' \ + tests/filesystem/test tests/fs_filesystem/test" 0 \ + "Apply workaround for disabled CONFIG_QFMT_V2" + fi fi # CKI mainline kernels don't ship with module build infrastructure From 485e8279b7b3a2178619c2fff8afde1060e12b18 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Thu, 29 Feb 2024 16:12:35 +0100 Subject: [PATCH 330/626] kernel/selinux-testsuite: remove install_t references on RHEL6 Otherwise the policy fails to build there. Signed-off-by: Ondrej Mosnacek --- kernel/selinux-testsuite/runtest.sh | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/kernel/selinux-testsuite/runtest.sh b/kernel/selinux-testsuite/runtest.sh index 51884a7..a35381f 100755 --- a/kernel/selinux-testsuite/runtest.sh +++ b/kernel/selinux-testsuite/runtest.sh @@ -314,6 +314,11 @@ rlJournalStart rlRun "sed -i 's/\\(allow \\\$1 initrc_t:fd use;\\)/\\1 allow \$1 unconfined_service_t:fd use;/' policy/test_policy.if" 0 fi + if rlIsRHEL '<6'; then + rlRun "sed -i '/install_t/d' policy/test_policy.if" 0 + "RHEL 6 doesn't have install_t" + fi + exclude_tests="" force_tests="" for file in ./tests/nnp*/execnnp.c; do From b2097912cce168be4606f71a8c038efba65242d5 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Wed, 28 Feb 2024 22:30:58 +0100 Subject: [PATCH 331/626] test if 'notself' and 'other' keywords are supported SELinux userspace 3.6 recognizes new keywords: notself, other. * https://github.com/SELinuxProject/selinux/releases/tag/3.6 Purpose of this automated test is to find out whether their implementation matches the expected functionality. --- .../notself-other-keywords/main.fmf | 32 +++++++++ .../notself-other-keywords/notself-module.cil | 3 + .../notself-other-keywords/other-module.cil | 9 +++ .../notself-other-keywords/runtest.sh | 71 +++++++++++++++++++ 4 files changed, 115 insertions(+) create mode 100644 selinux-policy/notself-other-keywords/main.fmf create mode 100644 selinux-policy/notself-other-keywords/notself-module.cil create mode 100644 selinux-policy/notself-other-keywords/other-module.cil create mode 100755 selinux-policy/notself-other-keywords/runtest.sh diff --git a/selinux-policy/notself-other-keywords/main.fmf b/selinux-policy/notself-other-keywords/main.fmf new file mode 100644 index 0000000..edbf75b --- /dev/null +++ b/selinux-policy/notself-other-keywords/main.fmf @@ -0,0 +1,32 @@ +summary: Basic test of the notself/other keywords +contact: Milos Malik +test: ./runtest.sh +framework: beakerlib +component: + - selinux-policy +recommend: + - libsepol + - libsemanage + - libselinux + - policycoreutils + - selinux-policy + - setools-console +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tier: 1 +tag: + - CI-Tier-1 + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - NoRHEL8 + - targeted +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-8 + because: notself/other keywords are not recognized/implemented there +extra-nitrate: TC#0617216 +id: 88fc548f-c1fa-48dc-a5ca-58478774911f diff --git a/selinux-policy/notself-other-keywords/notself-module.cil b/selinux-policy/notself-other-keywords/notself-module.cil new file mode 100644 index 0000000..ae361a7 --- /dev/null +++ b/selinux-policy/notself-other-keywords/notself-module.cil @@ -0,0 +1,3 @@ +(type a_t) +(allow a_t notself ( process ( signal ))) + diff --git a/selinux-policy/notself-other-keywords/other-module.cil b/selinux-policy/notself-other-keywords/other-module.cil new file mode 100644 index 0000000..90e0570 --- /dev/null +++ b/selinux-policy/notself-other-keywords/other-module.cil @@ -0,0 +1,9 @@ +(typeattribute parts) +(type a_t) +(type b_t) +(type c_t) +(typeattributeset parts ( a_t )) +(typeattributeset parts ( b_t )) +(typeattributeset parts ( c_t )) +(allow parts other ( process ( signal ))) + diff --git a/selinux-policy/notself-other-keywords/runtest.sh b/selinux-policy/notself-other-keywords/runtest.sh new file mode 100755 index 0000000..48c5442 --- /dev/null +++ b/selinux-policy/notself-other-keywords/runtest.sh @@ -0,0 +1,71 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +rlJournalStart + CUR_VERSION=`rpm -q --qf "%{version}" policycoreutils | head -n 1` + if rlTestVersion ${CUR_VERSION} '<' 3.6 ; then + rlLog "The installed SELinux userspace does NOT support the notself/other keywords." + rlLog "The automated test is NOT relevant for this environment." + rlJournalEnd + exit 0 + fi + + rlPhaseStartSetup + rlAssertRpm libsepol + rlAssertRpm libsemanage + rlAssertRpm libselinux + rlAssertRpm policycoreutils + rlAssertRpm selinux-policy + + rlRun "setenforce 1" + rlRun "sestatus" + rlPhaseEnd + + rlPhaseStartTest "rules defined via the 'notself' keyword" + rlRun "semodule -lfull | grep notself-module" 1 + rlRun "seinfo -t | grep -vi Types: | wc -l" + # FIXME: seinfo output contains 1 empty line + NO_TYPES_BEFORE=`seinfo -t | grep -vi Types: | wc -l` + rlRun "sesearch -A | wc -l" + NO_ALLOWS_BEFORE=`sesearch -A | wc -l` + rlRun "semodule -i notself-module.cil" + rlRun "semodule -lfull | grep notself-module" + rlRun "seinfo -t | grep -vi Types: | wc -l" + # FIXME: seinfo output contains 1 empty line + NO_TYPES_AFTER=`seinfo -t | grep -vi Types: | wc -l` + rlRun "sesearch -A | wc -l" + NO_ALLOWS_AFTER=`sesearch -A | wc -l` + rlLog "${NO_ALLOWS_BEFORE} + ${NO_TYPES_BEFORE} - 1 = ${NO_ALLOWS_AFTER}" + # FIXME: -1 is used because seinfo output contains 1 empty line + rlAssertEquals "the number of allow rules grows because of the 'notself' usage" $(( NO_ALLOWS_BEFORE + NO_TYPES_BEFORE - 1 )) $NO_ALLOWS_AFTER + rlRun "sesearch -A | grep notself" 1 + rlRun "semodule -r notself-module" + rlPhaseEnd + + rlPhaseStartTest "rules defined via the 'other' keyword" + rlRun "semodule -lfull | grep other-module" 1 + rlRun "seinfo -t a_t -x | grep -i 'types: *0'" + rlRun "sesearch -s a_t -A" 1 + rlRun "semodule -i other-module.cil" + rlRun "semodule -lfull | grep other-module" + rlRun "seinfo -t a_t -x | grep -C 1 -i 'types: *1'" + rlRun "sesearch -A | grep other" 1 + rlLog "the 'other' keyword should NOT generate any allow rules where scontext = tcontext" + rlRun "sesearch -s a_t -t a_t -A | grep allow" 1 + rlRun "sesearch -s b_t -t b_t -A | grep allow" 1 + rlRun "sesearch -s c_t -t c_t -A | grep allow" 1 + rlLog "the 'other' keyword should generate allow rules where scontext != tcontext" + rlRun "sesearch -s a_t -t b_t -A | grep allow" + rlRun "sesearch -s a_t -t c_t -A | grep allow" + rlRun "sesearch -s b_t -t a_t -A | grep allow" + rlRun "sesearch -s b_t -t c_t -A | grep allow" + rlRun "sesearch -s c_t -t a_t -A | grep allow" + rlRun "sesearch -s c_t -t b_t -A | grep allow" + rlRun "semodule -r other-module" + rlPhaseEnd + + rlPhaseStartCleanup + rlPhaseEnd +rlJournalEnd + From 586855095d5a64ef4e89a984bfdfccd8db0b2dc9 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Mon, 4 Mar 2024 13:16:45 +0100 Subject: [PATCH 332/626] Add a test for XFRM refcount underflow Signed-off-by: Ondrej Mosnacek --- kernel/xfrm-refcount-underflow/main.fmf | 18 ++++++ kernel/xfrm-refcount-underflow/runtest.sh | 76 +++++++++++++++++++++++ 2 files changed, 94 insertions(+) create mode 100644 kernel/xfrm-refcount-underflow/main.fmf create mode 100755 kernel/xfrm-refcount-underflow/runtest.sh diff --git a/kernel/xfrm-refcount-underflow/main.fmf b/kernel/xfrm-refcount-underflow/main.fmf new file mode 100644 index 0000000..22e2690 --- /dev/null +++ b/kernel/xfrm-refcount-underflow/main.fmf @@ -0,0 +1,18 @@ +summary: XFRM refcount underflow test +description: | + Test that allocating and deallocating XFRM state and/or policy + structures doesn't lead to selinux_xfrm_refcount imbalance and + underflow. +contact: Ondrej Mosnacek +component: +- kernel +framework: beakerlib +duration: 15m +tier: 2 +enabled: true +adjust: + enabled: false + when: distro < rhel-7 + because: RHEL-6 and below are not worth supporting by this test +link: + - verifies: https://issues.redhat.com/browse/RHEL-27751 diff --git a/kernel/xfrm-refcount-underflow/runtest.sh b/kernel/xfrm-refcount-underflow/runtest.sh new file mode 100755 index 0000000..895a1af --- /dev/null +++ b/kernel/xfrm-refcount-underflow/runtest.sh @@ -0,0 +1,76 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# SPDX-License-Identifier: GPLv2 +# Copyright (c) 2024 Red Hat, Inc. +# Author: Ondrej Mosnacek + +# Include Beakerlib environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +function installDepsYum() { + local yum="$1"; shift + + if "$yum" --help | grep -q -- --skip-broken; then + "$yum" install -y --skip-broken $* + else + for req in $*; do + if ! rpm -q --quiet --whatprovides "$req"; then + "$yum" install -y "$req" || true + fi + done + fi +} + +function installDeps() { + if type yum >/dev/null; then + installDepsYum yum "$@" + elif type dnf >/dev/null; then + installDepsYum dnf "$@" + fi +} + +rlJournalStart + rlPhaseStartSetup + # Determine the base kernel package name and version corresponding + # to the currently running kernel. Use this information to derive + # the correct kernel subpackages to install. + if KERNEL_CORE_NVRA="$(rpm -qf "/lib/modules/$(uname -r)/kernel")"; then + KERNEL_CORE_NV="${KERNEL_CORE_NVRA%-*}" + KERNEL_CORE_N="${KERNEL_CORE_NV%-*}" + + KERNEL_PKG_VRA="${KERNEL_CORE_NVRA#$KERNEL_CORE_N-}" + KERNEL_PKG_BASE="${KERNEL_CORE_N%-core}" + + rlLog "Detected kernel package base name '$KERNEL_PKG_BASE' and version-release.arch '$KERNEL_PKG_VRA'" + KERNEL_PKGS="$KERNEL_PKG_BASE-devel-$KERNEL_PKG_VRA" + else + rlLog "Detected non-RPM running kernel - no extra kernel packages will be installed" + KERNEL_PKGS="" + fi + + rlRun "installDeps systemtap $KERNEL_PKGS" 0 "Install requires" + rlPhaseEnd + + rlPhaseStartTest + function dump_xfrm_refcount() { + local refcount_addr="0x$(grep selinux_xfrm_refcount /proc/kallsyms | cut -f 1 -d ' ')" + stap -e "probe begin { + printf(\"%i\\n\", atomic_read($refcount_addr)) + exit() + }" + } + rlRun "dump_xfrm_refcount" + rlAssertEquals "Assert that XFRM refcount is zero at the beginning" \ + "$(dump_xfrm_refcount)" 0 + rlRun "ip xfrm policy add src 127.0.0.1 dst 127.0.0.1 proto tcp dir out tmpl proto ah mode transport level required" 0 \ + "Add a dummy XFRM policy entry" + rlRun "ip xfrm state add src 127.0.0.1 dst 127.0.0.1 proto ah spi 0x200 auth sha1 0123456789012345" 0 \ + "Add a dummy XFRM state entry" + rlRun "ip xfrm policy flush" 0 "Clear XFRM policy entries" + rlRun "ip xfrm state flush" 0 "Clear XFRM state entries" + rlRun "dump_xfrm_refcount" + rlAssertEquals "Assert that XFRM refcount is still zero" \ + "$(dump_xfrm_refcount)" 0 + rlPhaseEnd +rlJournalPrintText +rlJournalEnd From d95d39273f7fbdc97ae90a89d0f9093d935110fa Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Fri, 8 Mar 2024 09:25:23 +0100 Subject: [PATCH 333/626] kernel/selinux-testsuite: hotfix for install_t workaround The version comparison is wrong. Fix it. Fixes: 485e8279b7b3 ("kernel/selinux-testsuite: remove install_t references on RHEL6") Signed-off-by: Ondrej Mosnacek --- kernel/selinux-testsuite/runtest.sh | 2 -- kernel/xfrm-refcount-underflow/main.fmf | 4 +++- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/kernel/selinux-testsuite/runtest.sh b/kernel/selinux-testsuite/runtest.sh index a35381f..10a98ef 100755 --- a/kernel/selinux-testsuite/runtest.sh +++ b/kernel/selinux-testsuite/runtest.sh @@ -312,9 +312,7 @@ rlJournalStart if ! rlIsRHEL '<7'; then rlRun "sed -i 's/type unconfined_t;/type unconfined_t, unconfined_service_t;/' policy/test_policy.if" 0 rlRun "sed -i 's/\\(allow \\\$1 initrc_t:fd use;\\)/\\1 allow \$1 unconfined_service_t:fd use;/' policy/test_policy.if" 0 - fi - if rlIsRHEL '<6'; then rlRun "sed -i '/install_t/d' policy/test_policy.if" 0 "RHEL 6 doesn't have install_t" fi diff --git a/kernel/xfrm-refcount-underflow/main.fmf b/kernel/xfrm-refcount-underflow/main.fmf index 22e2690..3d3be6f 100644 --- a/kernel/xfrm-refcount-underflow/main.fmf +++ b/kernel/xfrm-refcount-underflow/main.fmf @@ -5,7 +5,7 @@ description: | underflow. contact: Ondrej Mosnacek component: -- kernel + - kernel framework: beakerlib duration: 15m tier: 2 @@ -16,3 +16,5 @@ adjust: because: RHEL-6 and below are not worth supporting by this test link: - verifies: https://issues.redhat.com/browse/RHEL-27751 +extra-nitrate: TC#0617218 +id: d2bfb49c-fe12-48b5-8f17-8edf6f93810a From fd803298d8465fc8d58275005395d346fffb1fe4 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Fri, 8 Mar 2024 08:29:47 +0100 Subject: [PATCH 334/626] fix the synce4l test The _cmd patterns may not be present in the /etc/synce4l.conf file. The automated test should not fail because of them. --- selinux-policy/synce4l-and-similar/runtest.sh | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/selinux-policy/synce4l-and-similar/runtest.sh b/selinux-policy/synce4l-and-similar/runtest.sh index 583c41f..01529a5 100755 --- a/selinux-policy/synce4l-and-similar/runtest.sh +++ b/selinux-policy/synce4l-and-similar/runtest.sh @@ -64,9 +64,10 @@ rlJournalStart rlPhaseEnd rlPhaseStartTest "real scenario -- standalone service" - rlRun "grep _cmd /etc/synce4l.conf" - rlRun "sed -i 's/^\(.*_cmd\) .*$/\1 echo 0/' /etc/synce4l.conf" - rlRun "grep _cmd /etc/synce4l.conf" + if grep -q _cmd /etc/synce4l.conf ; then + rlRun "sed -i 's/^\(.*_cmd\) .*$/\1 echo 0/' /etc/synce4l.conf" + rlRun "grep _cmd /etc/synce4l.conf" + fi if ! rlSEDefined ${PROCESS_CONTEXT} ; then # for RHELs where the SELinux domain does not exist yet PROCESS_CONTEXT="unconfined_service_t" From 4024dfa46fd6d1835f1bb224796c8909e3d36779 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Mon, 11 Mar 2024 09:07:00 +0100 Subject: [PATCH 335/626] kernel/selinux-testsuite: another hotfix for install_t workaround I can't believe I got it wrong AGAIN... I missed the ! operator.... Now it should be correct, as was finally able to test it. Signed-off-by: Ondrej Mosnacek --- kernel/selinux-testsuite/runtest.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/selinux-testsuite/runtest.sh b/kernel/selinux-testsuite/runtest.sh index 10a98ef..09f063a 100755 --- a/kernel/selinux-testsuite/runtest.sh +++ b/kernel/selinux-testsuite/runtest.sh @@ -312,7 +312,7 @@ rlJournalStart if ! rlIsRHEL '<7'; then rlRun "sed -i 's/type unconfined_t;/type unconfined_t, unconfined_service_t;/' policy/test_policy.if" 0 rlRun "sed -i 's/\\(allow \\\$1 initrc_t:fd use;\\)/\\1 allow \$1 unconfined_service_t:fd use;/' policy/test_policy.if" 0 - + else rlRun "sed -i '/install_t/d' policy/test_policy.if" 0 "RHEL 6 doesn't have install_t" fi From 03fc444e76543cfc5eede55e9d5c7303051ff2b4 Mon Sep 17 00:00:00 2001 From: Zdenek Pytela Date: Wed, 7 Feb 2024 15:58:28 +0100 Subject: [PATCH 336/626] Update the install-uninstall-dsp-packages test Particular changes: - install also DSP packages which do not distribute its custom SELinux module in a subpackage with the "-selinux" suffix (Fedora only) - use rlLogWarning to display warnings - list /var/run entries not having an equivalent rule in /run - make use of the DEBUG variable to keep output files with various data after the test finishes: -- list files in /run which have incorrect context -- list installed packages -- list SELinux modules, permissive and unconfined domains -- check if dbus communication is defined bidirectionally --- .../install-uninstall-dsp-packages/Makefile | 2 +- .../additional-dsp-packages.txt | 13 ++++ .../dbus-sendmsg.pl | 71 +++++++++++++++++++ .../install-uninstall-dsp-packages/runtest.sh | 66 ++++++++++++++--- 4 files changed, 140 insertions(+), 12 deletions(-) create mode 100644 selinux-policy/install-uninstall-dsp-packages/additional-dsp-packages.txt create mode 100755 selinux-policy/install-uninstall-dsp-packages/dbus-sendmsg.pl diff --git a/selinux-policy/install-uninstall-dsp-packages/Makefile b/selinux-policy/install-uninstall-dsp-packages/Makefile index 2ad8c5e..b801290 100644 --- a/selinux-policy/install-uninstall-dsp-packages/Makefile +++ b/selinux-policy/install-uninstall-dsp-packages/Makefile @@ -30,7 +30,7 @@ export TESTVERSION=1.0 BUILT_FILES= -FILES=$(METADATA) runtest.sh Makefile PURPOSE +FILES=$(METADATA) additional-dsp-packages.txt dbus-sendmsg.pl runtest.sh Makefile PURPOSE .PHONY: all install download clean diff --git a/selinux-policy/install-uninstall-dsp-packages/additional-dsp-packages.txt b/selinux-policy/install-uninstall-dsp-packages/additional-dsp-packages.txt new file mode 100644 index 0000000..bb3d718 --- /dev/null +++ b/selinux-policy/install-uninstall-dsp-packages/additional-dsp-packages.txt @@ -0,0 +1,13 @@ +# List of additional DSP packages which distribute its custom SELinux module, +# but not in a subpackage with the "-selinux" suffix +# This file is being maintained manually + +BackupPC +# beah - temporary not working in rawhide +ec2-hibinit-agent +google-compute-engine-oslogin +mariadb-cracklib-password-check +mariadb-server-galera +postsrsd +qm +receptor diff --git a/selinux-policy/install-uninstall-dsp-packages/dbus-sendmsg.pl b/selinux-policy/install-uninstall-dsp-packages/dbus-sendmsg.pl new file mode 100755 index 0000000..cc46f51 --- /dev/null +++ b/selinux-policy/install-uninstall-dsp-packages/dbus-sendmsg.pl @@ -0,0 +1,71 @@ +#!/usr/bin/perl -w +### Check if dbus communication is allowed bidirectionally + +use strict; + +my $sesearch_cmd="/usr/bin/sesearch"; +my $sesearch_args="-A -c dbus -p send_msg"; +my ($line, @output); +my (@seoutarray, $seout, $seline); +my $count=0; + +# Take all allow rules matching the description +open SESEARCH, "$sesearch_cmd $sesearch_args |" + or die "Cannot run sesearch: $!"; +while ($line =) { + $count++; + #debug printf "%4d %s", $count, $line; + chomp $line; + # > sesearch -A -t systemd_timedated_t -s initrc_t -c dbus -p send_msg + # allow dbusd_unconfined nsswitch_domain:dbus send_msg; + # allow system_bus_type system_dbusd_t:dbus { acquire_svc send_msg }; + # allow NetworkManager_t xguest_t:dbus send_msg; [ xguest_connect_network ]:True + @output = split /[ :]/, $line; + next if $output[2] eq "self"; + next if $output[2] eq $output[1]; + # Look for the rule in the inverse direction + open $seout, "$sesearch_cmd $sesearch_args -s $output[2] -t $output[1] |" + or die "Cannot run sesearch: $!"; + @seoutarray = <$seout>; + if (@seoutarray == 0) { + print "No reverse match: $line\n"; + } + else { + foreach $seline (@seoutarray) { + if ($seline =~ /\]:/) { + print "Conditional rule: $seline"; + print " Original line: $line\n"; + } + } + } + close $seout; +} +print "Total dbus:send_msg rules number: $count\n"; + +__END__ + +State as of 2024.03.05 +f39: 1738 rules, 8 asymmetrical +RHEL9: 1731 rules, 6 asymmetrical +RHEL8: 2359 rules, 52 asymmetrical + +f39 +No reverse match: allow cronjob_t openshift_app_t:dbus send_msg; +No reverse match: allow cronjob_t openshift_t:dbus send_msg; +No reverse match: allow cronjob_t staff_t:dbus send_msg; +No reverse match: allow cronjob_t sysadm_t:dbus send_msg; +No reverse match: allow cronjob_t user_t:dbus send_msg; +No reverse match: allow pasta_t init_t:dbus send_msg; +No reverse match: allow pasta_t system_dbusd_t:dbus send_msg; +No reverse match: allow pasta_t systemd_hostnamed_t:dbus send_msg; + +RHEL9 +No reverse match: allow cronjob_t openshift_app_t:dbus send_msg; +No reverse match: allow cronjob_t openshift_t:dbus send_msg; +No reverse match: allow cronjob_t staff_t:dbus send_msg; +No reverse match: allow cronjob_t sysadm_t:dbus send_msg; +No reverse match: allow cronjob_t user_t:dbus send_msg; +No reverse match: allow nvme_stas_t system_dbusd_t:dbus { acquire_svc send_msg }; + +RHEL8 + diff --git a/selinux-policy/install-uninstall-dsp-packages/runtest.sh b/selinux-policy/install-uninstall-dsp-packages/runtest.sh index b251ff3..058619f 100755 --- a/selinux-policy/install-uninstall-dsp-packages/runtest.sh +++ b/selinux-policy/install-uninstall-dsp-packages/runtest.sh @@ -34,8 +34,20 @@ PACKAGE="selinux-policy" SKIP_REMOVAL=${SKIP_REMOVAL:-""} SKIP_INSTALL=${SKIP_INSTALL:-""} INSTALL_ONLY=${INSTALL_ONLY:-""} -FCONTEXT_LIST="/tmp/semanage-fcontext" -FCONTEXT_LIST_VARRUN="/tmp/semanage-fcontext-varrun" +ADDITIONAL_DSP_PACKAGES="additional-dsp-packages.txt" +TMPDIR=${TMPDIR-"/var/tmp"} +OUTDIR="${TMPDIR}/test-output" +FCONTEXT_LIST="${OUTDIR}/semanage-fcontext" +FCONTEXT_LIST2="${OUTDIR}/semanage-fcontext2" +FCONTEXT_LIST_VARRUN="${OUTDIR}/semanage-fcontext-varrun" +RESTORECON_RVN_RUN="${OUTDIR}/restorecon-rvn-run" +RPMQA="${OUTDIR}/rpmqa" +SEMODULE_LIST="${OUTDIR}/semodule-list" +SEMODULE_LIST_DSP="${OUTDIR}/semodule-list-dsp" +PERMISSIVE_DOMAINS="${OUTDIR}/permissive-domains" +UNCONFINED_DOMAINS="${OUTDIR}/unconfined-domains" +DBUS_SENDMSG="${OUTDIR}/dbus-sendmsg" +mkdir -p ${OUTDIR} # Function to create a report template for install test function install_report() { @@ -98,12 +110,17 @@ rlJournalStart rlRun "sed -i '/beaker-tasks/d' install-list" # exclude debuginfo packages rlRun "sed -i '/-debuginfo/d' install-list" - # tmp: omit failing vfrnav - rlRun "sed -i '/vfrnav-selinux/d' install-list" # packages names only rlRun "awk '{print \$1}' install-list > pkgonlylist" # exclude updates-source rlRun "grep -vE '(.src)' pkgonlylist | sort -u > install-pkgs" + # include additional packages which do not match the "*-selinux" pattern + # currently for Fedora only + if rlIsFedora ">=38" + then + # remove comments and blank lines + rlRun "sed '/^[#]/d;/^$/d' ${ADDITIONAL_DSP_PACKAGES} >> install-pkgs" + fi # use the same list for checks of the subsequent uninstallation rlRun "cp -f install-pkgs uninstall-pkgs" rlRun "install_report" @@ -130,20 +147,46 @@ rlJournalStart rlPhaseEnd ### Checks performed with all dsp packages installed + ### Status of /run and /var/run equivalency rlPhaseStartTest "Check /run equivalency status" rlRun "semanage fcontext -l > ${FCONTEXT_LIST}" if grep -q "/run = /var/run" ${FCONTEXT_LIST}; then - echo "Warning: Legacy equivalency settings \"/run = /var/run\" are in place." + rlLogInfo "Legacy equivalency settings \"/run = /var/run\" are in place." elif grep -q "/var/run = /run" ${FCONTEXT_LIST}; then - echo "New equivalency settings /\"var/run = /run\" are in place." - if grep -q "^/var/run" ${FCONTEXT_LIST}; then - rlLog "Warning: /var/run entries found in the file context database" - rlRun "sed '/^\/var\/run/!d; s|[ \t].*$||' ${FCONTEXT_LIST} | uniq > ${FCONTEXT_LIST_VARRUN}" + rlLog "New equivalency settings /\"var/run = /run\" are in place." + grep -v "/var/run = /run" ${FCONTEXT_LIST} > ${FCONTEXT_LIST2} + if grep -q "^/var/run" ${FCONTEXT_LIST2}; then + rlLogWarning "/var/run entries found in the file context database" + rlRun "sed '/^\/var\/run/!d; s|[ \t].*$||' ${FCONTEXT_LIST2} | uniq > ${FCONTEXT_LIST_VARRUN}" + + # List /var/run rules which do not have an equivalent one in /run + while read line + do + if ! grep -q "^${line#/var}" ${FCONTEXT_LIST2}; then + rlLog "Dup rule does not exist in /run: \"$line\"" + fi + done < ${FCONTEXT_LIST_VARRUN} fi - else echo "Unknown or none /run equivalency settings." + else rlLogWarning "None or unknown /run equivalency settings." + fi + + [ "$DEBUG" = "yes" ] || + rlRun "rm -f ${FCONTEXT_LIST} ${FCONTEXT_LIST_VARRUN}" + rlPhaseEnd + + ### Store some data which might be of some use later + rlPhaseStartTest "Gather relevant data" + if [ "${DEBUG}" = "yes" ]; then + rlRun "restorecon -Rvn /run > ${RESTORECON_RVN_RUN}" + rlRun "rpm -qa | sort > ${RPMQA}" + rlRun "semanage permissive -l > ${PERMISSIVE_DOMAINS}" + rlRun "seinfo -xa unconfined_domain_type > ${UNCONFINED_DOMAINS}" + rlRun "semodule -lfull > ${SEMODULE_LIST}" + rlRun "grep -v ^100 ${SEMODULE_LIST} > ${SEMODULE_LIST_DSP}" + rlRpmInstall "perl" + rlRun "./dbus-sendmsg.pl > ${DBUS_SENDMSG}" fi - rm -f ${FCONTEXT_LIST} ${FCONTEXT_LIST_VARRUN} rlPhaseEnd rlPhaseStartTest "Uninstall test for dsp packages" @@ -174,6 +217,7 @@ rlJournalStart if [ -f "Err_file" ]; then rlRun "rm -f Err_file" fi + [ "$DEBUG" = "yes" ] || rlRun "rm -f install-list pkgonlylist install-pkgs uninstall-pkgs pkglist.report" rlSECheckAVC --ignore 'type=USER_AVC.*denied.* send_msg .*scontext=.*:unconfined_t:.*tcontext=.*:system_dbusd_t:.*tclass=dbus' \ --ignore 'type=USER_AVC.* start .*:unconfined_t:.*:init_t:.*tclass=system' \ From 60daf3c47de21259268defd83db11cfd705b5448 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Wed, 13 Mar 2024 10:49:32 +0100 Subject: [PATCH 337/626] clean up the tests metadata Metadata of certain tests became outdated. Purpose of this change is: * include the rest of components into main.fmf * remove the failinfedora tag from tests which pass on Fedora * add the failinfedora tag to tests which fail on Fedora or which should not be executed --- libselinux/selinux_restorecon-functions/main.fmf | 1 - main.fmf | 7 +++++-- other/collect-denials/main.fmf | 3 ++- selinux-policy/interface-definitions/main.fmf | 1 + selinux-policy/pam_timestamp-and-related/main.fmf | 1 - selinux-policy/restorecond-fcontext-equivalences/main.fmf | 1 - 6 files changed, 8 insertions(+), 6 deletions(-) diff --git a/libselinux/selinux_restorecon-functions/main.fmf b/libselinux/selinux_restorecon-functions/main.fmf index 728942e..c7372bb 100644 --- a/libselinux/selinux_restorecon-functions/main.fmf +++ b/libselinux/selinux_restorecon-functions/main.fmf @@ -17,7 +17,6 @@ tag: - NoRHEL5 - TIPpass_Security - TierCandidatesPASS - - failinfedora - targeted adjust: - enabled: false diff --git a/main.fmf b/main.fmf index 1be570e..764dffa 100644 --- a/main.fmf +++ b/main.fmf @@ -23,11 +23,14 @@ tags: [generic] /libsepol: component: libsepol +/mcstrans: + component: mcstrans + /policycoreutils: component: policycoreutils /selinux-policy: component: selinux-policy -/other: - component: selinux-policy +/setools: + component: setools diff --git a/other/collect-denials/main.fmf b/other/collect-denials/main.fmf index a02c9b6..61b0c0d 100644 --- a/other/collect-denials/main.fmf +++ b/other/collect-denials/main.fmf @@ -8,4 +8,5 @@ recommend: - policycoreutils duration: 5m enabled: true - +tag: + - failinfedora diff --git a/selinux-policy/interface-definitions/main.fmf b/selinux-policy/interface-definitions/main.fmf index 0c2b9a3..e54b879 100644 --- a/selinux-policy/interface-definitions/main.fmf +++ b/selinux-policy/interface-definitions/main.fmf @@ -15,6 +15,7 @@ tag: - NoRHEL4 - NoRHEL5 - targeted + - failinfedora link: - verifies: https://issues.redhat.com/browse/RHEL-2616 - verifies: https://issues.redhat.com/browse/RHEL-16185 diff --git a/selinux-policy/pam_timestamp-and-related/main.fmf b/selinux-policy/pam_timestamp-and-related/main.fmf index 28e8dfe..8c37de8 100644 --- a/selinux-policy/pam_timestamp-and-related/main.fmf +++ b/selinux-policy/pam_timestamp-and-related/main.fmf @@ -39,7 +39,6 @@ tag: - TIPpass - TIPpass_Security - f32friendly - - failinfedora - targeted link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1791957 diff --git a/selinux-policy/restorecond-fcontext-equivalences/main.fmf b/selinux-policy/restorecond-fcontext-equivalences/main.fmf index 30bd38d..34be7a6 100644 --- a/selinux-policy/restorecond-fcontext-equivalences/main.fmf +++ b/selinux-policy/restorecond-fcontext-equivalences/main.fmf @@ -19,7 +19,6 @@ tag: - NoRHEL5 - NoRHEL6 - NoRHEL7 - - failinfedora - targeted link: - verifies: https://issues.redhat.com/browse/RHEL-5032 From 5389b5acb3f61e4f1c39af4f74cb1cb4564ca49c Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Wed, 3 Jan 2024 11:46:45 +0100 Subject: [PATCH 338/626] test if plymouthd can access /dev/kmsg Recent testing revealed that SELinux prevents the plymouthd processes from accessing the /dev/kmsg device. The TC reproduces the situation. In order to support the expected plymouthd functionality, I believe that SELinux policy should allow the access. The TC looks for appropriate policy rules and file context patterns. The TC covers BZ#2256442. --- .../Makefile | 88 +++++++++ .../PURPOSE | 5 + .../main.fmf | 55 ++++++ .../runtest.sh | 184 ++++++++++++++++++ 4 files changed, 332 insertions(+) create mode 100644 selinux-policy/bz538089-plymouth-operations-denied-during-boot/Makefile create mode 100644 selinux-policy/bz538089-plymouth-operations-denied-during-boot/PURPOSE create mode 100644 selinux-policy/bz538089-plymouth-operations-denied-during-boot/main.fmf create mode 100755 selinux-policy/bz538089-plymouth-operations-denied-during-boot/runtest.sh diff --git a/selinux-policy/bz538089-plymouth-operations-denied-during-boot/Makefile b/selinux-policy/bz538089-plymouth-operations-denied-during-boot/Makefile new file mode 100644 index 0000000..ed51edc --- /dev/null +++ b/selinux-policy/bz538089-plymouth-operations-denied-during-boot/Makefile @@ -0,0 +1,88 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/bz538089-plymouth-operations-denied-during-boot +# Description: some plymouth operations are denied during boot because of SELinux +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2009 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/bz538089-plymouth-operations-denied-during-boot +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: some plymouth operations are denied during boot because of SELinux" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 30m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit" >> $(METADATA) + @echo "Requires: /usr/sbin/service" >> $(METADATA) + @echo "Requires: libselinux" >> $(METADATA) + @echo "Requires: libselinux-utils" >> $(METADATA) + @echo "Requires: plymouth" >> $(METADATA) + @echo "Requires: policycoreutils" >> $(METADATA) + @echo "Requires: selinux-policy" >> $(METADATA) + @echo "Requires: selinux-policy-targeted" >> $(METADATA) + @echo "Requires: setools-console" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Releases: -RHEL4 -RHELServer5 -RHELClient5" >> $(METADATA) + @echo "Bug: 538089" >> $(METADATA) # RHEL-6 + @echo "Bug: 560611" >> $(METADATA) # RHEL-6 + @echo "Bug: 904016" >> $(METADATA) # RHEL-7 + @echo "Bug: 1045382" >> $(METADATA) # RHEL-7 + @echo "Bug: 1131195" >> $(METADATA) # RHEL-6 + @echo "Bug: 1160196" >> $(METADATA) # RHEL-7 + @echo "Bug: 1202429" >> $(METADATA) # Fedora 21 + @echo "Bug: 1517405" >> $(METADATA) # Fedora 27 + @echo "Bug: 1664143" >> $(METADATA) # Fedora 29 + @echo "Bug: 1869814" >> $(METADATA) # RHEL-8 + @echo "Bug: 1871307" >> $(METADATA) # RHEL-8 + @echo "Bug: 2184803" >> $(METADATA) # RHEL-9 + @echo "Bug: 2256442" >> $(METADATA) # Fedora 40 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/bz538089-plymouth-operations-denied-during-boot/PURPOSE b/selinux-policy/bz538089-plymouth-operations-denied-during-boot/PURPOSE new file mode 100644 index 0000000..e16c39f --- /dev/null +++ b/selinux-policy/bz538089-plymouth-operations-denied-during-boot/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/bz538089-plymouth-operations-denied-during-boot +Author: Milos Malik + +SELinux interferes with plymouth / plymouthd and related programs. + diff --git a/selinux-policy/bz538089-plymouth-operations-denied-during-boot/main.fmf b/selinux-policy/bz538089-plymouth-operations-denied-during-boot/main.fmf new file mode 100644 index 0000000..7aa34c3 --- /dev/null +++ b/selinux-policy/bz538089-plymouth-operations-denied-during-boot/main.fmf @@ -0,0 +1,55 @@ +summary: some plymouth operations are denied during boot because of SELinux +description: |+ + SELinux interferes with plymouth / plymouthd and related programs. + +contact: Milos Malik +component: + - selinux-policy +test: ./runtest.sh +framework: beakerlib +require: + - library(selinux-policy/common) +recommend: + - audit + - /usr/sbin/service + - libselinux + - libselinux-utils + - plymouth + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console +environment: + AVC_ERROR: +no_avc_check +duration: 30m +enabled: true +tag: + - kernel-rt + - NoRHEL4 + - NoRHEL5 + - TIPpass_Security + - TierCandidatesPASS + - f32friendly + - f33friendly + - targeted +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=538089 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=560611 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=904016 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1045382 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1131195 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1160196 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1202429 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1517405 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1664143 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1869814 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1871307 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2184803 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2256442 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5 + continue: false +extra-nitrate: TC#0057474 +extra-summary: /CoreOS/selinux-policy/Regression/bz538089-plymouth-operations-denied-during-boot +extra-task: /CoreOS/selinux-policy/Regression/bz538089-plymouth-operations-denied-during-boot diff --git a/selinux-policy/bz538089-plymouth-operations-denied-during-boot/runtest.sh b/selinux-policy/bz538089-plymouth-operations-denied-during-boot/runtest.sh new file mode 100755 index 0000000..5b11531 --- /dev/null +++ b/selinux-policy/bz538089-plymouth-operations-denied-during-boot/runtest.sh @@ -0,0 +1,184 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/bz538089-plymouth-operations-denied-during-boot +# Description: some plymouth operations are denied during boot because of SELinux +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2009 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include rhts environment +. /usr/share/beakerlib/beakerlib.sh + +PACKAGE="selinux-policy" +ROOT_PASSWORD="redhat" +FILE_PATH="/usr/sbin/plymouthd" +FILE_CONTEXT="plymouthd_exec_t" +SERVICE_PACKAGE="plymouth" +SERVICE_NAME="plymouth-start" +PROCESS_NAME="plymouthd" +PROCESS_CONTEXT="plymouthd_t" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} + rlFileBackup /etc/shadow + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "bz#538089" + rlSEMatchPathCon "/bin/plymouth" "plymouth_exec_t" + rlSEMatchPathCon "/sbin/cryptsetup" "lvm_exec_t" + rlSEMatchPathCon "/dev/mapper/control" "lvm_control_t" + rlRun "ls -Z /proc/devices | grep :proc_t" + rlSESearchRule "allow plymouth_t lvm_exec_t : file { getattr open read execute }" + rlSESearchRule "type_transition plymouth_t lvm_exec_t : process lvm_t" + rlSESearchRule "allow plymouth_t lvm_t : process { transition }" + rlSESearchRule "allow lvm_t lvm_t : capability { ipc_lock }" + rlSESearchRule "allow lvm_t proc_t : file { getattr open read }" + rlSESearchRule "allow lvm_t lvm_control_t : chr_file { getattr open read write }" + rlPhaseEnd + + rlPhaseStartTest "bz#560611" + rlSEMatchPathCon "/bin/plymouth" "plymouth_exec_t" + rlRun "ls -Z /proc/cmdline | grep :proc_t" + rlSESearchRule "allow plymouth_t proc_t : file { getattr open read }" + rlPhaseEnd + + if ! rlIsRHEL 5 6 ; then + rlPhaseStartTest "bz#904016" + rlSEMatchPathCon "/usr/sbin/plymouthd" "plymouthd_exec_t" + rlSEMatchPathCon "/var/log/boot.log" "plymouthd_var_log_t" + # when plymouthd runs as plymouthd_t + rlSESearchRule "allow plymouthd_t var_log_t : dir { write add_name }" + rlSESearchRule "type_transition plymouthd_t var_log_t : file plymouthd_var_log_t" + rlSESearchRule "allow plymouthd_t plymouthd_var_log_t : file { create }" + # when plymouthd runs as kernel_t + rlSESearchRule "allow kernel_t var_log_t : dir { write add_name }" + rlRun "sesearch -s kernel_t -t var_log_t -c file -T | grep 'plymouthd_var_log_t.*boot.log'" + rlSESearchRule "allow kernel_t plymouthd_var_log_t : file { create }" + rlPhaseEnd + + rlPhaseStartTest "bz#1045382" + rlSEMatchPathCon "/usr/sbin/plymouthd" "plymouthd_exec_t" + rlSEMatchPathCon "/var/run/udev" "udev_var_run_t" + rlSEMatchPathCon "/var/run/udev/queue.bin" "udev_var_run_t" + rlSESearchRule "allow plymouthd_t plymouthd_t : netlink_kobject_uevent_socket { create setopt bind getattr }" + rlSESearchRule "allow plymouthd_t udev_var_run_t : dir { search }" + rlSESearchRule "allow plymouthd_t udev_var_run_t : file { getattr open read }" + rlPhaseEnd + + rlPhaseStartTest "bz#1160196" + rlSEMatchPathCon "/usr/sbin/plymouthd" "plymouthd_exec_t" + rlSEMatchPathCon "/var/lib/sss" "sssd_var_lib_t" + rlSEMatchPathCon "/var/lib/sss/mc" "sssd_public_t" + rlSEMatchPathCon "/var/lib/sss/mc/group" "sssd_public_t" + rlSEMatchPathCon "/var/lib/sss/pipes" "sssd_var_lib_t" + rlSEMatchPathCon "/var/lib/sss/pipes/nss" "sssd_var_lib_t" + rlSESearchRule "allow plymouthd_t sssd_public_t : dir { getattr search open }" + rlSESearchRule "allow plymouthd_t sssd_public_t : file { getattr open read }" + rlSESearchRule "allow plymouthd_t sssd_var_lib_t : dir { getattr search open }" + rlSESearchRule "allow plymouthd_t sssd_var_lib_t : sock_file { write getattr append open }" + rlPhaseEnd + fi + + if rlIsRHEL 6 ; then + rlPhaseStartTest "bz#1131195" + rlSEMatchPathCon "/var/spool/plymouth/boot.log" "plymouthd_spool_t" + rlSESearchRule "allow xdm_t plymouthd_spool_t : file { getattr }" + rlPhaseEnd + fi + + if ! rlIsRHEL 5 6 ; then + rlPhaseStartTest "bz#1202429" + rlSEMatchPathCon "/dev/ttyUSB0" "usbtty_device_t" + rlSESearchRule "allow plymouthd_t usbtty_device_t : chr_file { read write } [ ]" + rlPhaseEnd + fi + + if ! rlIsRHEL 5 6 ; then + rlPhaseStartTest "bz#1517405" + rlSEMatchPathCon "/dev/fb0" "framebuf_device_t" + rlSESearchRule "allow plymouthd_t framebuf_device_t : chr_file { map } [ ]" + rlPhaseEnd + fi + + if ! rlIsRHEL 5 6 7 ; then + rlPhaseStartTest "bz#1664143" + rlSEMatchPathCon "/sys/firmware/efi/efivars" "efivarfs_t" + rlSESearchRule "allow plymouthd_t efivarfs_t : dir { getattr open search } [ ]" + rlPhaseEnd + fi + + if ! rlIsRHEL 5 6 7 ; then + rlPhaseStartTest "bz#1869814 + bz#1871307" + rlSESearchRule "allow plymouthd_t plymouthd_t : capability { sys_chroot } [ ]" + rlPhaseEnd + fi + + if ! rlIsRHEL 5 6 7 8 ; then + rlPhaseStartTest "bz#2184803" + rlSESearchRule "allow plymouthd_t plymouthd_t : capability2 { bpf } [ ]" + rlPhaseEnd + fi + + if rlIsFedora ; then + rlPhaseStartTest "bz#2256442" + rlSEMatchPathCon "/dev/kmsg" "kmsg_device_t" + rlSESearchRule "allow plymouthd_t kmsg_device_t : chr_file { open read write } [ ]" + rlSESearchRule "allow plymouthd_t kernel_t : system { syslog_read } [ ]" + rlPhaseEnd + fi + + if ! rlIsRHEL 5 6 ; then + rlPhaseStartTest "real scenario -- standalone service" + rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + # for environments where the SELinux domain does not exist yet + PROCESS_CONTEXT="unconfined_service_t" + fi + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + fi + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd + rlJournalPrintText +rlJournalEnd + From cf326c1181d3e527a0578a73b4393120347184d8 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Fri, 15 Mar 2024 16:23:14 +0100 Subject: [PATCH 339/626] test if dhcpcd can read the /run/netns directory A recent dhcpcd + selinux-policy testing revealed that SELinux prevents the dhcpcd processes from reading the /run/netns directory when it exists. The TC reproduces the situation. In order to support the expected dhcpcd functionality, I believe that SELinux policy should allow the access. The TC looks for appropriate policy rules and file context patterns. The TC covers BZ#2269708 and BZ#2270733. --- selinux-policy/dhcpcd-and-similar/Makefile | 4 +++- selinux-policy/dhcpcd-and-similar/main.fmf | 3 +++ selinux-policy/dhcpcd-and-similar/runtest.sh | 10 ++++++++++ 3 files changed, 16 insertions(+), 1 deletion(-) diff --git a/selinux-policy/dhcpcd-and-similar/Makefile b/selinux-policy/dhcpcd-and-similar/Makefile index c714f6f..e124576 100644 --- a/selinux-policy/dhcpcd-and-similar/Makefile +++ b/selinux-policy/dhcpcd-and-similar/Makefile @@ -54,7 +54,7 @@ $(METADATA): Makefile @echo "Type: Regression" >> $(METADATA) @echo "TestTime: 10m" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console dhcpcd /usr/sbin/service" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console dhcpcd /usr/sbin/service iproute" >> $(METADATA) @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @@ -65,6 +65,8 @@ $(METADATA): Makefile @echo "Bug: 1585971" >> $(METADATA) # Fedora 28 @echo "Bug: 1602343" >> $(METADATA) # Fedora 28 @echo "Bug: RHEL-15326" >> $(METADATA) # RHEL-9 + @echo "Bug: 2269708" >> $(METADATA) # Fedora 40 + @echo "Bug: 2270733" >> $(METADATA) # Fedora 41 rhts-lint $(METADATA) diff --git a/selinux-policy/dhcpcd-and-similar/main.fmf b/selinux-policy/dhcpcd-and-similar/main.fmf index 0f9dc46..c6bb75e 100644 --- a/selinux-policy/dhcpcd-and-similar/main.fmf +++ b/selinux-policy/dhcpcd-and-similar/main.fmf @@ -17,6 +17,7 @@ recommend: - setools-console - dhcpcd - /usr/sbin/service + - iproute environment: AVC_ERROR: +no_avc_check duration: 10m @@ -30,6 +31,8 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1585971 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1602343 - verifies: https://issues.redhat.com/browse/RHEL-15326 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2269708 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2270733 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7 diff --git a/selinux-policy/dhcpcd-and-similar/runtest.sh b/selinux-policy/dhcpcd-and-similar/runtest.sh index 9b9e133..ca7370e 100755 --- a/selinux-policy/dhcpcd-and-similar/runtest.sh +++ b/selinux-policy/dhcpcd-and-similar/runtest.sh @@ -91,7 +91,17 @@ rlJournalStart rlPhaseEnd fi + if ! rlIsRHEL 8 ; then + rlPhaseStartTest "bz#2269708 + bz#2270733" + rlSEMatchPathCon "/run/netns" "ifconfig_var_run_t" + rlSESearchRule "allow dhcpc_t ifconfig_var_run_t : dir { read } [ ]" + rlPhaseEnd + fi + rlPhaseStartTest "real scenario -- standalone service" + rlRun "ip netns add test-ns" + rlRun "ip netns del test-ns" + rlRun "ls -lZR /run/netns" rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" if ! rlSEDefined ${PROCESS_CONTEXT} ; then if rlIsRHEL 5 6 ; then From e58558fe843ece142e0aee70a4fac73819fd4bb6 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Fri, 22 Mar 2024 11:32:20 +0100 Subject: [PATCH 340/626] add a new sulogin test A recently filed Fedora bug revealed that SELinux prevents the sulogin processes from using: * the fsetxattr syscall (relabelfrom+relabelto) on /dev/tty* * the ioctl syscall (checkpoint_restore capability) The TC reproduces the situation. Because the relabel* permissions seem to be necessary for a successful run of the sulogin command, SELinux policy should allow them. On the other hand, the checkpoint_restore capability does not seem to be necessary, which means that SELinux policy should dontaudit it. The TC covers BZ#2265391. --- selinux-policy/sulogin-and-similar/main.fmf | 38 +++++++++++++++++ selinux-policy/sulogin-and-similar/runtest.sh | 42 +++++++++++++++++++ 2 files changed, 80 insertions(+) create mode 100644 selinux-policy/sulogin-and-similar/main.fmf create mode 100755 selinux-policy/sulogin-and-similar/runtest.sh diff --git a/selinux-policy/sulogin-and-similar/main.fmf b/selinux-policy/sulogin-and-similar/main.fmf new file mode 100644 index 0000000..2211054 --- /dev/null +++ b/selinux-policy/sulogin-and-similar/main.fmf @@ -0,0 +1,38 @@ +summary: SELinux interferes with sulogin and related programs +test: ./runtest.sh +framework: beakerlib +contact: Milos Malik +component: + - selinux-policy +require: + - library(selinux-policy/common) +recommend: + - audit + - binutils + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - systemd + - /usr/sbin/service +environment: + AVC_ERROR: +no_avc_check +duration: 5m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - targeted +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2265391 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + continue: false +extra-summary: /CoreOS/selinux-policy/Regression/sulogin-and-similar +extra-task: /CoreOS/selinux-policy/Regression/sulogin-and-similar +extra-nitrate: TC#0617279 +id: 3128d079-084d-4c82-a01e-e2a8457a67d0 diff --git a/selinux-policy/sulogin-and-similar/runtest.sh b/selinux-policy/sulogin-and-similar/runtest.sh new file mode 100755 index 0000000..51a1d85 --- /dev/null +++ b/selinux-policy/sulogin-and-similar/runtest.sh @@ -0,0 +1,42 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlAssertRpm selinux-policy + rlAssertRpm selinux-policy-targeted + rlAssertRpm systemd + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + if ! rlIsRHEL 8 9 ; then + rlPhaseStartTest "bz#2265391" + rlSEMatchPathCon "/usr/sbin/sulogin" "sulogin_exec_t" + rlSESearchRule "dontaudit sulogin_t sulogin_t : capability2 { checkpoint_restore } [ ]" + rlSESearchRule "allow sulogin_t tty_device_t : chr_file { relabelfrom relabelto } [ ]" + rlPhaseEnd + fi + + rlPhaseStartTest "real scenario -- standalone service" + rlRun "grep ExecStart= /usr/lib/systemd/system/rescue.service" + rlRun "strings /usr/lib/systemd/systemd-sulogin-shell | grep /sbin/sulogin" + rlRun "service rescue start" + sleep 2 + rlRun "service rescue status" + rlRun "service rescue stop" + sleep 2 + rlRun "service rescue status" 3 + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + rlPhaseEnd +rlJournalEnd + From 703bfed49fd2a09e9f22179d3925f27626978f46 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Wed, 20 Mar 2024 21:24:16 +0100 Subject: [PATCH 341/626] add a new test which covers the logwatch service A recent selinux-policy + logwatch testing revealed that SELinux prevents the uptime process (executed by the logwatch service) from reading the /run/systemd/sessions/ directory. The TC reproduces the situation. In order to avoid unnecessary SELinux denials, I believe that SELinux policy should allow this access. The TC looks for appropriate policy rules and file context patterns. The TC covers BZ#2270484. --- selinux-policy/logwatch-and-similar/Makefile | 68 +++++++++++++ selinux-policy/logwatch-and-similar/PURPOSE | 5 + selinux-policy/logwatch-and-similar/main.fmf | 44 +++++++++ .../logwatch-and-similar/runtest.sh | 95 +++++++++++++++++++ 4 files changed, 212 insertions(+) create mode 100644 selinux-policy/logwatch-and-similar/Makefile create mode 100644 selinux-policy/logwatch-and-similar/PURPOSE create mode 100644 selinux-policy/logwatch-and-similar/main.fmf create mode 100755 selinux-policy/logwatch-and-similar/runtest.sh diff --git a/selinux-policy/logwatch-and-similar/Makefile b/selinux-policy/logwatch-and-similar/Makefile new file mode 100644 index 0000000..857441b --- /dev/null +++ b/selinux-policy/logwatch-and-similar/Makefile @@ -0,0 +1,68 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/logwatch-and-similar +# Description: SELinux interferes with logwatch and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2024 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/logwatch-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with logwatch and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console logwatch sendmail /usr/sbin/service" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA) + @echo "Bug: 2270484" >> $(METADATA) # Fedora 40 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/logwatch-and-similar/PURPOSE b/selinux-policy/logwatch-and-similar/PURPOSE new file mode 100644 index 0000000..6820548 --- /dev/null +++ b/selinux-policy/logwatch-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/logwatch-and-similar +Author: Milos Malik + +Description: SELinux interferes with logwatch and related programs + diff --git a/selinux-policy/logwatch-and-similar/main.fmf b/selinux-policy/logwatch-and-similar/main.fmf new file mode 100644 index 0000000..7fe58e0 --- /dev/null +++ b/selinux-policy/logwatch-and-similar/main.fmf @@ -0,0 +1,44 @@ +summary: SELinux interferes with logwatch and related programs +description: |+ + SELinux interferes with logwatch and related programs. + +contact: Milos Malik +component: + - selinux-policy +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - logwatch + - sendmail + - /usr/sbin/service +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - NoRHEL8 + - Tier3 + - Tier3se + - targeted +tier: '3' +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2270484 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 + because: the logwatch service is not available there +extra-summary: /CoreOS/selinux-policy/Regression/logwatch-and-similar +extra-task: /CoreOS/selinux-policy/Regression/logwatch-and-similar +extra-nitrate: TC#0617270 +id: 047f2fac-7362-412d-8f6a-95cb8af71230 diff --git a/selinux-policy/logwatch-and-similar/runtest.sh b/selinux-policy/logwatch-and-similar/runtest.sh new file mode 100755 index 0000000..a152d4d --- /dev/null +++ b/selinux-policy/logwatch-and-similar/runtest.sh @@ -0,0 +1,95 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/logwatch-and-similar +# Description: SELinux interferes with logwatch and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2024 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +FILE_CONTEXT="logwatch_exec_t" +SERVICE_PACKAGE="logwatch" +SERVICE_NAME="logwatch" +PROCESS_NAME="logwatch" +PROCESS_CONTEXT="logwatch_t" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} + rlFileBackup /etc/shadow + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + if ! rlIsRHEL 9 ; then + rlPhaseStartTest "bz#2270484" + rlSEMatchPathCon "/usr/share/logwatch/scripts/logwatch.pl" "logwatch_exec_t" + rlSEMatchPathCon "/usr/sbin/sendmail.sendmail" "sendmail_exec_t" + rlSEMatchPathCon "/run/systemd/sessions/" "systemd_logind_sessions_t" + rlSESearchRule "allow logwatch_t systemd_logind_sessions_t : dir { read } [ ]" + rlSESearchRule "type_transition logwatch_t sendmail_exec_t : process logwatch_mail_t" + rlSESearchRule "allow logwatch_mail_t init_t : unix_stream_socket { getattr } [ ]" + rlPhaseEnd + fi + + rlPhaseStartTest "real scenario -- standalone service" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + # for environments where the SELinux domain does not exist yet + PROCESS_CONTEXT="unconfined_service_t" + fi + rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /var /run -e /var/ARTIFACTS" 0-255 + rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + + rlPhaseStartTest "real scenario -- timer" + rlRun "systemctl enable ${SERVICE_NAME}.timer" + rlRun "systemctl start ${SERVICE_NAME}.timer" + rlRun "systemctl list-timers --all" + rlRun "sleep 5s" + rlRun "systemctl stop ${SERVICE_NAME}.timer" + rlRun "systemctl disable ${SERVICE_NAME}.timer" + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + From 6a777019bcc92ee9a25b10e92d99c1481f3e8742 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Mon, 27 Nov 2023 13:04:33 +0100 Subject: [PATCH 342/626] improve the incorrectly written io_uring checks I wrote certain io_uring checks incorrectly, because I misunderstood the comments in the RHEL-11792 ticket. They should be correct now. In order to properly test the io_uring feature, the feature needs to be enabled (it is by default on Fedora). If the kernel command line does not contain the "io_uring" string, the automated test adds the necessary options and reboots the machine. --- selinux-policy/anon_inode-and-similar/Makefile | 2 +- selinux-policy/anon_inode-and-similar/main.fmf | 2 ++ selinux-policy/anon_inode-and-similar/runtest.sh | 14 ++++++++++++-- 3 files changed, 15 insertions(+), 3 deletions(-) diff --git a/selinux-policy/anon_inode-and-similar/Makefile b/selinux-policy/anon_inode-and-similar/Makefile index d9db08b..0e381d6 100644 --- a/selinux-policy/anon_inode-and-similar/Makefile +++ b/selinux-policy/anon_inode-and-similar/Makefile @@ -54,7 +54,7 @@ $(METADATA): Makefile @echo "Type: Regression" >> $(METADATA) @echo "TestTime: 30m" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: libselinux policycoreutils selinux-policy selinux-policy-targeted gcc glibc-headers setools-console audit fio" >> $(METADATA) + @echo "Requires: libselinux policycoreutils selinux-policy selinux-policy-targeted gcc glibc-headers setools-console audit fio grubby" >> $(METADATA) @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @echo "License: GPLv2" >> $(METADATA) diff --git a/selinux-policy/anon_inode-and-similar/main.fmf b/selinux-policy/anon_inode-and-similar/main.fmf index 56e34d1..755b0cd 100644 --- a/selinux-policy/anon_inode-and-similar/main.fmf +++ b/selinux-policy/anon_inode-and-similar/main.fmf @@ -16,6 +16,7 @@ recommend: - setools-console - audit - fio + - grubby environment: AVC_ERROR: +no_avc_check duration: 30m @@ -27,6 +28,7 @@ tag: - NoRHEL7 - NoRHEL8 - targeted + - reboot link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1954145 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1974559 diff --git a/selinux-policy/anon_inode-and-similar/runtest.sh b/selinux-policy/anon_inode-and-similar/runtest.sh index 583c1ec..9359ba3 100755 --- a/selinux-policy/anon_inode-and-similar/runtest.sh +++ b/selinux-policy/anon_inode-and-similar/runtest.sh @@ -29,6 +29,15 @@ # Include rhts environment . /usr/share/beakerlib/beakerlib.sh +if rlIsRHEL 9 || rlIsCentOS 9 ; then + if ! grep io_uring /proc/cmdline ; then + grubby --update-kernel ALL --args io_uring.enable=y + grubby --update-kernel ALL --args sysctl.kernel.io_uring_disabled=0 + sync + rhts-reboot + fi +fi + PACKAGE="selinux-policy" rlJournalStart @@ -80,11 +89,12 @@ rlJournalStart fi rlRun "fio --filename=/root/pokus --iodepth=16 --rw=write --ioengine=io_uring --bs=16k --size=2G --numjobs=30 --runtime=100s --group_reporting=1 --name=mytest" 0-255 + rlRun "fio --filename=/root/pokus --iodepth=16 --rw=write --ioengine=io_uring_cmd --bs=16k --size=2G --numjobs=30 --runtime=100s --group_reporting=1 --name=mytest" 0-255 rlPhaseEnd rlPhaseStartTest "RHEL-11792" - rlSEMatchPathCon "/dev/ng0n1" "fixed_disk_device_t" - rlSESearchRule "allow unconfined_t fixed_disk_device_t : io_uring { cmd } [ ]" + rlSESearchRule "allow unconfined_t unconfined_t : io_uring { cmd } [ ]" + rlSESearchRule "allow unconfined_service_t unconfined_service_t : io_uring { cmd } [ ]" rlPhaseEnd rlPhaseStartCleanup From af629f99a2daae826230b3a60d3f66160d1deba8 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Wed, 27 Mar 2024 13:17:57 +0100 Subject: [PATCH 343/626] test if stress-ng can create anon_inode objects A recently filed Fedora bug revealed that SELinux prevents the stress-ng processes from creating anon_inode objects via the memfd_secret syscall. The TC reproduces the situation. In order to support the expected stress-ng functonality, I believe that SELinux policy should allow the action. The TC looks for appropriate policy rules. The TC covers BZ#2270895. --- selinux-policy/anon_inode-and-similar/Makefile | 3 ++- selinux-policy/anon_inode-and-similar/main.fmf | 2 ++ selinux-policy/anon_inode-and-similar/runtest.sh | 5 +++++ 3 files changed, 9 insertions(+), 1 deletion(-) diff --git a/selinux-policy/anon_inode-and-similar/Makefile b/selinux-policy/anon_inode-and-similar/Makefile index 0e381d6..e6d8ba8 100644 --- a/selinux-policy/anon_inode-and-similar/Makefile +++ b/selinux-policy/anon_inode-and-similar/Makefile @@ -54,7 +54,7 @@ $(METADATA): Makefile @echo "Type: Regression" >> $(METADATA) @echo "TestTime: 30m" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: libselinux policycoreutils selinux-policy selinux-policy-targeted gcc glibc-headers setools-console audit fio grubby" >> $(METADATA) + @echo "Requires: libselinux policycoreutils selinux-policy selinux-policy-targeted gcc glibc-headers setools-console audit fio grubby stress-ng" >> $(METADATA) @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @echo "License: GPLv2" >> $(METADATA) @@ -68,6 +68,7 @@ $(METADATA): Makefile @echo "Bug: 2025714" >> $(METADATA) # Fedora 35 @echo "Bug: 2187745" >> $(METADATA) # RHEL-9 @echo "Bug: RHEL-11792" >> $(METADATA) # RHEL-9 + @echo "Bug: 2270895" >> $(METADATA) # Fedora 41 rhts-lint $(METADATA) diff --git a/selinux-policy/anon_inode-and-similar/main.fmf b/selinux-policy/anon_inode-and-similar/main.fmf index 755b0cd..6ef3a5d 100644 --- a/selinux-policy/anon_inode-and-similar/main.fmf +++ b/selinux-policy/anon_inode-and-similar/main.fmf @@ -17,6 +17,7 @@ recommend: - audit - fio - grubby + - stress-ng environment: AVC_ERROR: +no_avc_check duration: 30m @@ -36,6 +37,7 @@ link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2025714 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2187745 - verifies: https://issues.redhat.com/browse/RHEL-11792 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2270895 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8 diff --git a/selinux-policy/anon_inode-and-similar/runtest.sh b/selinux-policy/anon_inode-and-similar/runtest.sh index 9359ba3..ea0818c 100755 --- a/selinux-policy/anon_inode-and-similar/runtest.sh +++ b/selinux-policy/anon_inode-and-similar/runtest.sh @@ -97,6 +97,11 @@ rlJournalStart rlSESearchRule "allow unconfined_service_t unconfined_service_t : io_uring { cmd } [ ]" rlPhaseEnd + rlPhaseStartTest "bz#2270895" + rlSESearchRule "allow unconfined_t unconfined_t : anon_inode { create } [ ]" + rlRun "stress-ng --resources 16 --timeout 5 --log-file /dev/null" + rlPhaseEnd + rlPhaseStartCleanup sleep 2 rlSECheckAVC From 50ee0226ecd1a6023ddb255ca3b5e149921a305a Mon Sep 17 00:00:00 2001 From: Dalibor Pospisil Date: Thu, 4 Apr 2024 09:33:13 +0000 Subject: [PATCH 344/626] selinux-policy/Library/common: ignore auditd stopped do not fail if auditd was not running before --- selinux-policy/Library/common/lib.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/selinux-policy/Library/common/lib.sh b/selinux-policy/Library/common/lib.sh index 48bde49..e5f496b 100755 --- a/selinux-policy/Library/common/lib.sh +++ b/selinux-policy/Library/common/lib.sh @@ -1838,7 +1838,7 @@ __INTERNAL_rlSEenable_full_auditing() { } [[ $auditd_need_restart -eq 1 ]] && { rlLog "stop the audit daemon first" - rlRun "service auditd stop" + rlRun "service auditd stop" 0,2 sleep 5 rlLog "audit daemon configuration file is updated, starting the audit service" rlServiceStart auditd || { From 26a276d5c97f001a9abbced51aa4aff31e49bc6d Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Thu, 4 Apr 2024 07:43:56 +0200 Subject: [PATCH 345/626] fix the tests which fail on CentOS-stream-10 The rlImport command fails in many tests because the epel-release package is not available for RHEL-10 or CentOS-stream-10 yet. As a workaround, an additional exit code 1 is accepted now. --- checkpolicy/sedismod/runtest.sh | 4 ++-- libselinux/validatetrans/runtest.sh | 2 +- selinux-policy/Library/common/runtest.sh | 2 +- selinux-policy/ModemManager-and-similar/runtest.sh | 2 +- selinux-policy/accounts-daemon-and-similar/runtest.sh | 2 +- selinux-policy/acpid-and-similar/runtest.sh | 2 +- selinux-policy/anon_inode-and-similar/runtest.sh | 2 +- selinux-policy/bgpd-and-similar/runtest.sh | 2 +- selinux-policy/blueman-and-similar/runtest.sh | 2 +- selinux-policy/boinc-and-similar/runtest.sh | 2 +- selinux-policy/boltd-and-similar/runtest.sh | 2 +- selinux-policy/bootupd-and-similar/runtest.sh | 2 +- selinux-policy/bz481628-send-msg-to-dbus/runtest.sh | 2 +- .../bz533007-unable-to-start-kdump-service/runtest.sh | 2 +- .../runtest.sh | 2 +- .../bz562833-chrooted-named-file-contexts/runtest.sh | 2 +- selinux-policy/bz624405-pcsc-and-similar/runtest.sh | 2 +- selinux-policy/bz733494-amanda-and-similar/runtest.sh | 2 +- selinux-policy/caddy-and-similar/runtest.sh | 2 +- selinux-policy/capability2-class/runtest.sh | 2 +- selinux-policy/chronyd-and-similar/runtest.sh | 2 +- selinux-policy/cockpit-ws-and-similar/runtest.sh | 2 +- selinux-policy/colord-and-similar/runtest.sh | 2 +- selinux-policy/cups-browsed-and-similar/runtest.sh | 4 ++-- selinux-policy/cups-lpd-and-similar/runtest.sh | 2 +- selinux-policy/cups-pdf-and-similar/runtest.sh | 2 +- selinux-policy/dhclient-and-similar/runtest.sh | 2 +- selinux-policy/dhcpcd-and-similar/runtest.sh | 2 +- selinux-policy/dmidecode-and-similar/runtest.sh | 2 +- selinux-policy/exim-and-similar/runtest.sh | 2 +- selinux-policy/fapolicyd-and-similar/runtest.sh | 2 +- selinux-policy/fedora-third-party-and-similar/runtest.sh | 2 +- selinux-policy/firewalld-and-similar/runtest.sh | 2 +- selinux-policy/fwupd-and-similar/runtest.sh | 2 +- selinux-policy/getrlimit-permission/runtest.sh | 2 +- selinux-policy/hostapd-and-similar/runtest.sh | 2 +- selinux-policy/icecast-and-similar/runtest.sh | 2 +- selinux-policy/install-uninstall-dsp-packages/runtest.sh | 2 +- selinux-policy/journalctl-and-similar/runtest.sh | 2 +- selinux-policy/kerberos-and-similar/runtest.sh | 2 +- selinux-policy/kernel-confined-exec/runtest.sh | 2 +- selinux-policy/ksm-and-similar/runtest.sh | 2 +- selinux-policy/ladvd/runtest.sh | 2 +- selinux-policy/logwatch-and-similar/runtest.sh | 2 +- selinux-policy/nasd-and-similar/runtest.sh | 2 +- selinux-policy/nfsdcld-and-similar/runtest.sh | 2 +- selinux-policy/ntpsec-and-similar/runtest.sh | 2 +- selinux-policy/numad-and-similar/runtest.sh | 2 +- selinux-policy/nvme-stas-and-similar/runtest.sh | 2 +- selinux-policy/opensmtpd-and-similar/runtest.sh | 2 +- selinux-policy/pam_console-and-related/runtest.sh | 2 +- selinux-policy/pam_limits-and-related/runtest.sh | 2 +- selinux-policy/pam_timestamp-and-related/runtest.sh | 2 +- selinux-policy/pcp-daemons-and-similar/runtest.sh | 2 +- selinux-policy/perf_event-and-related/runtest.sh | 2 +- selinux-policy/ping-and-similar/runtest.sh | 2 +- selinux-policy/policykit-general/runtest.sh | 2 +- selinux-policy/rngd-and-similar/runtest.sh | 2 +- selinux-policy/rpc.idmapd-and-similar/runtest.sh | 2 +- selinux-policy/rpmdb-and-similar/runtest.sh | 2 +- selinux-policy/rrdcached-service-and-related/runtest.sh | 2 +- selinux-policy/rsyslog-and-similar/runtest.sh | 2 +- selinux-policy/rtkit-daemon-and-similar/runtest.sh | 2 +- selinux-policy/smbcontrol-and-similar/runtest.sh | 2 +- selinux-policy/snapd-and-similar/runtest.sh | 2 +- selinux-policy/sslh-and-similar/runtest.sh | 2 +- selinux-policy/stalld-and-similar/runtest.sh | 2 +- selinux-policy/sudo-and-dnf/runtest.sh | 2 +- selinux-policy/swap-file-and-systemd-access/runtest.sh | 2 +- selinux-policy/synce4l-and-similar/runtest.sh | 2 +- selinux-policy/systemd-bootchart-and-similar/runtest.sh | 2 +- selinux-policy/systemd-creds/runtest.sh | 2 +- selinux-policy/systemd-generators/runtest.sh | 2 +- selinux-policy/systemd-homed/runtest.sh | 2 +- selinux-policy/systemd-localed/runtest.sh | 2 +- selinux-policy/systemd-machined-and-similar/runtest.sh | 2 +- selinux-policy/systemd-modules-load-and-similar/runtest.sh | 2 +- selinux-policy/systemd-notify-and-similar/runtest.sh | 2 +- selinux-policy/systemd-rfkill-and-similar/runtest.sh | 2 +- selinux-policy/systemd-run-and-similar/runtest.sh | 2 +- selinux-policy/systemd-sysctl-and-similar/runtest.sh | 2 +- selinux-policy/systemd-timesyncd-and-similar/runtest.sh | 2 +- selinux-policy/systemd-userdbd-and-similar/runtest.sh | 2 +- selinux-policy/targetd-and-similar/runtest.sh | 2 +- selinux-policy/thttpd-and-similar/runtest.sh | 2 +- selinux-policy/tlp-and-similar/runtest.sh | 2 +- selinux-policy/usbguard-daemon-and-similar/runtest.sh | 2 +- selinux-policy/usbmuxd-and-similar/runtest.sh | 2 +- selinux-policy/virtualization-daemons/runtest.sh | 6 +----- selinux-policy/watch-permissions/runtest.sh | 2 +- 90 files changed, 92 insertions(+), 96 deletions(-) diff --git a/checkpolicy/sedismod/runtest.sh b/checkpolicy/sedismod/runtest.sh index 8227ccb..27de54e 100755 --- a/checkpolicy/sedismod/runtest.sh +++ b/checkpolicy/sedismod/runtest.sh @@ -31,7 +31,7 @@ PACKAGE="checkpolicy" # TODO: repeat for all policy modules that are installed under /etc/selinux -if rlIsFedora ; then +if rlIsFedora || rlIsCentOS ; then POLICY_FILE="`find /var/lib/selinux/targeted -type d -name base`/hll" elif rlIsRHEL '<7.3' ; then POLICY_FILE=`find /etc/selinux/targeted -type f -name base.pp` @@ -43,7 +43,7 @@ rlJournalStart rlPhaseStartSetup rlAssertRpm ${PACKAGE} OUTPUT_FILE=`mktemp` - if rlIsRHEL '>=7.3' || rlIsFedora ; then + if rlIsRHEL '>=7.3' || rlIsCentOS || rlIsFedora ; then rlRun "semodule -H -E base" else rlRun "cp ${POLICY_FILE} ./base.pp.bz2" diff --git a/libselinux/validatetrans/runtest.sh b/libselinux/validatetrans/runtest.sh index b38050d..5b86d48 100755 --- a/libselinux/validatetrans/runtest.sh +++ b/libselinux/validatetrans/runtest.sh @@ -40,7 +40,7 @@ rlJournalStart fi rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlAssertRpm ${PACKAGE} rlRun "rpm -qf `which validatetrans`" rlRun "rpm -qf `which seinfo`" diff --git a/selinux-policy/Library/common/runtest.sh b/selinux-policy/Library/common/runtest.sh index 124e96a..9f2f5a9 100755 --- a/selinux-policy/Library/common/runtest.sh +++ b/selinux-policy/Library/common/runtest.sh @@ -16,7 +16,7 @@ rlIsRHEL 5 && { rlJournalStart rlPhaseStartSetup - rlRun "rlImport selinux-policy/common" + rlRun "rlImport selinux-policy/common" 0,1 rlRun "uname -a" rlRun "sestatus" rlPhaseEnd diff --git a/selinux-policy/ModemManager-and-similar/runtest.sh b/selinux-policy/ModemManager-and-similar/runtest.sh index a3d0348..bba63cb 100755 --- a/selinux-policy/ModemManager-and-similar/runtest.sh +++ b/selinux-policy/ModemManager-and-similar/runtest.sh @@ -45,7 +45,7 @@ PROCESS_CONTEXT="modemmanager_t" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/accounts-daemon-and-similar/runtest.sh b/selinux-policy/accounts-daemon-and-similar/runtest.sh index 38ea62c..662d1c6 100755 --- a/selinux-policy/accounts-daemon-and-similar/runtest.sh +++ b/selinux-policy/accounts-daemon-and-similar/runtest.sh @@ -40,7 +40,7 @@ PROCESS_CONTEXT="accountsd_t" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/acpid-and-similar/runtest.sh b/selinux-policy/acpid-and-similar/runtest.sh index 52e751d..b24fa65 100755 --- a/selinux-policy/acpid-and-similar/runtest.sh +++ b/selinux-policy/acpid-and-similar/runtest.sh @@ -40,7 +40,7 @@ PROCESS_CONTEXT="apmd_t" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/anon_inode-and-similar/runtest.sh b/selinux-policy/anon_inode-and-similar/runtest.sh index ea0818c..762a788 100755 --- a/selinux-policy/anon_inode-and-similar/runtest.sh +++ b/selinux-policy/anon_inode-and-similar/runtest.sh @@ -48,7 +48,7 @@ rlJournalStart fi rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/bgpd-and-similar/runtest.sh b/selinux-policy/bgpd-and-similar/runtest.sh index c248b5e..8d9e844 100755 --- a/selinux-policy/bgpd-and-similar/runtest.sh +++ b/selinux-policy/bgpd-and-similar/runtest.sh @@ -44,7 +44,7 @@ fi rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/blueman-and-similar/runtest.sh b/selinux-policy/blueman-and-similar/runtest.sh index 2530481..7c0c15c 100755 --- a/selinux-policy/blueman-and-similar/runtest.sh +++ b/selinux-policy/blueman-and-similar/runtest.sh @@ -46,7 +46,7 @@ rlJournalStart fi rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/boinc-and-similar/runtest.sh b/selinux-policy/boinc-and-similar/runtest.sh index d58f467..ab2647c 100755 --- a/selinux-policy/boinc-and-similar/runtest.sh +++ b/selinux-policy/boinc-and-similar/runtest.sh @@ -40,7 +40,7 @@ PROCESS_CONTEXT="boinc_t" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/boltd-and-similar/runtest.sh b/selinux-policy/boltd-and-similar/runtest.sh index f3c9a37..5e7ddb1 100755 --- a/selinux-policy/boltd-and-similar/runtest.sh +++ b/selinux-policy/boltd-and-similar/runtest.sh @@ -42,7 +42,7 @@ DENIED_USERS="guest_u" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/bootupd-and-similar/runtest.sh b/selinux-policy/bootupd-and-similar/runtest.sh index f639e12..3fdddda 100755 --- a/selinux-policy/bootupd-and-similar/runtest.sh +++ b/selinux-policy/bootupd-and-similar/runtest.sh @@ -44,7 +44,7 @@ fi rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/bz481628-send-msg-to-dbus/runtest.sh b/selinux-policy/bz481628-send-msg-to-dbus/runtest.sh index c0e7719..d5df5ec 100755 --- a/selinux-policy/bz481628-send-msg-to-dbus/runtest.sh +++ b/selinux-policy/bz481628-send-msg-to-dbus/runtest.sh @@ -44,7 +44,7 @@ PROCESS_CONTEXT="system_dbusd_t" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/bz533007-unable-to-start-kdump-service/runtest.sh b/selinux-policy/bz533007-unable-to-start-kdump-service/runtest.sh index fd3ec10..5a7c57c 100755 --- a/selinux-policy/bz533007-unable-to-start-kdump-service/runtest.sh +++ b/selinux-policy/bz533007-unable-to-start-kdump-service/runtest.sh @@ -39,7 +39,7 @@ PACKAGE="selinux-policy" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-mls diff --git a/selinux-policy/bz538089-plymouth-operations-denied-during-boot/runtest.sh b/selinux-policy/bz538089-plymouth-operations-denied-during-boot/runtest.sh index 5b11531..005926b 100755 --- a/selinux-policy/bz538089-plymouth-operations-denied-during-boot/runtest.sh +++ b/selinux-policy/bz538089-plymouth-operations-denied-during-boot/runtest.sh @@ -40,7 +40,7 @@ PROCESS_CONTEXT="plymouthd_t" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/bz562833-chrooted-named-file-contexts/runtest.sh b/selinux-policy/bz562833-chrooted-named-file-contexts/runtest.sh index 69a2743..1c88600 100755 --- a/selinux-policy/bz562833-chrooted-named-file-contexts/runtest.sh +++ b/selinux-policy/bz562833-chrooted-named-file-contexts/runtest.sh @@ -34,7 +34,7 @@ ROOT_PASSWORD="redhat" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/bz624405-pcsc-and-similar/runtest.sh b/selinux-policy/bz624405-pcsc-and-similar/runtest.sh index 29d27e5..0093aa4 100755 --- a/selinux-policy/bz624405-pcsc-and-similar/runtest.sh +++ b/selinux-policy/bz624405-pcsc-and-similar/runtest.sh @@ -37,7 +37,7 @@ PROCESS_NAME="pcscd" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-mls diff --git a/selinux-policy/bz733494-amanda-and-similar/runtest.sh b/selinux-policy/bz733494-amanda-and-similar/runtest.sh index a5db0a8..bb1aec9 100755 --- a/selinux-policy/bz733494-amanda-and-similar/runtest.sh +++ b/selinux-policy/bz733494-amanda-and-similar/runtest.sh @@ -45,7 +45,7 @@ rlJournalStart fi rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/caddy-and-similar/runtest.sh b/selinux-policy/caddy-and-similar/runtest.sh index 69ff27c..39f8301 100755 --- a/selinux-policy/caddy-and-similar/runtest.sh +++ b/selinux-policy/caddy-and-similar/runtest.sh @@ -36,7 +36,7 @@ PROCESS_CONTEXT="httpd_t" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/capability2-class/runtest.sh b/selinux-policy/capability2-class/runtest.sh index e81eec7..73e7d37 100755 --- a/selinux-policy/capability2-class/runtest.sh +++ b/selinux-policy/capability2-class/runtest.sh @@ -33,7 +33,7 @@ PACKAGE="selinux-policy" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/chronyd-and-similar/runtest.sh b/selinux-policy/chronyd-and-similar/runtest.sh index d469f05..fb399f4 100755 --- a/selinux-policy/chronyd-and-similar/runtest.sh +++ b/selinux-policy/chronyd-and-similar/runtest.sh @@ -42,7 +42,7 @@ CHRONYD_RESTRICTED_UNIT_DROPIN_FILE="${CHRONYD_RESTRICTED_UNIT_DROPIN_DIR}/conte rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/cockpit-ws-and-similar/runtest.sh b/selinux-policy/cockpit-ws-and-similar/runtest.sh index 3a17767..0dbc556 100755 --- a/selinux-policy/cockpit-ws-and-similar/runtest.sh +++ b/selinux-policy/cockpit-ws-and-similar/runtest.sh @@ -44,7 +44,7 @@ PROCESS_CONTEXT="cockpit_ws_t" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/colord-and-similar/runtest.sh b/selinux-policy/colord-and-similar/runtest.sh index 9cd88f0..ff2ced5 100755 --- a/selinux-policy/colord-and-similar/runtest.sh +++ b/selinux-policy/colord-and-similar/runtest.sh @@ -40,7 +40,7 @@ DENIED_USERS=${DENIED_USERS:-"guest_u xguest_u"} rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/cups-browsed-and-similar/runtest.sh b/selinux-policy/cups-browsed-and-similar/runtest.sh index 8db13de..0a0a5e0 100755 --- a/selinux-policy/cups-browsed-and-similar/runtest.sh +++ b/selinux-policy/cups-browsed-and-similar/runtest.sh @@ -39,9 +39,9 @@ PROCESS_CONTEXT="cupsd_t" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires - SERVICE_PACKAGE=`rpm -qf ${FILE_PATH}` + SERVICE_PACKAGE=`rpm -qf ${FILE_PATH} | head -n 1` rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted rlAssertRpm ${SERVICE_PACKAGE} diff --git a/selinux-policy/cups-lpd-and-similar/runtest.sh b/selinux-policy/cups-lpd-and-similar/runtest.sh index 7669790..ede77b9 100755 --- a/selinux-policy/cups-lpd-and-similar/runtest.sh +++ b/selinux-policy/cups-lpd-and-similar/runtest.sh @@ -39,7 +39,7 @@ PROCESS_CONTEXT="cupsd_lpd_t" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/cups-pdf-and-similar/runtest.sh b/selinux-policy/cups-pdf-and-similar/runtest.sh index cfbd105..0e2613e 100755 --- a/selinux-policy/cups-pdf-and-similar/runtest.sh +++ b/selinux-policy/cups-pdf-and-similar/runtest.sh @@ -47,7 +47,7 @@ rlJournalStart fi rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/dhclient-and-similar/runtest.sh b/selinux-policy/dhclient-and-similar/runtest.sh index 1b448e4..b6b920c 100755 --- a/selinux-policy/dhclient-and-similar/runtest.sh +++ b/selinux-policy/dhclient-and-similar/runtest.sh @@ -37,7 +37,7 @@ rlJournalStart rlLog "If this test fails, please contact mmalik on IRC #selinux" rlLog "This test should fail if tested bugs are NOT fixed yet" rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/dhcpcd-and-similar/runtest.sh b/selinux-policy/dhcpcd-and-similar/runtest.sh index ca7370e..f1fb91c 100755 --- a/selinux-policy/dhcpcd-and-similar/runtest.sh +++ b/selinux-policy/dhcpcd-and-similar/runtest.sh @@ -46,7 +46,7 @@ rlJournalStart exit 0 fi - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/dmidecode-and-similar/runtest.sh b/selinux-policy/dmidecode-and-similar/runtest.sh index 3b3d0bf..3abba0d 100755 --- a/selinux-policy/dmidecode-and-similar/runtest.sh +++ b/selinux-policy/dmidecode-and-similar/runtest.sh @@ -35,7 +35,7 @@ DENIED_USERS=${DENIED_USERS:-"staff_u user_u guest_u xguest_u"} rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/exim-and-similar/runtest.sh b/selinux-policy/exim-and-similar/runtest.sh index 27750e3..7a422c0 100755 --- a/selinux-policy/exim-and-similar/runtest.sh +++ b/selinux-policy/exim-and-similar/runtest.sh @@ -40,7 +40,7 @@ PROCESS_CONTEXT="exim_t" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/fapolicyd-and-similar/runtest.sh b/selinux-policy/fapolicyd-and-similar/runtest.sh index 1d532eb..77549b1 100755 --- a/selinux-policy/fapolicyd-and-similar/runtest.sh +++ b/selinux-policy/fapolicyd-and-similar/runtest.sh @@ -40,7 +40,7 @@ PROCESS_CONTEXT="fapolicyd_t" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/fedora-third-party-and-similar/runtest.sh b/selinux-policy/fedora-third-party-and-similar/runtest.sh index 0903a5e..7c136a9 100755 --- a/selinux-policy/fedora-third-party-and-similar/runtest.sh +++ b/selinux-policy/fedora-third-party-and-similar/runtest.sh @@ -45,7 +45,7 @@ rlJournalStart fi rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/firewalld-and-similar/runtest.sh b/selinux-policy/firewalld-and-similar/runtest.sh index be3e640..f0beb41 100755 --- a/selinux-policy/firewalld-and-similar/runtest.sh +++ b/selinux-policy/firewalld-and-similar/runtest.sh @@ -38,7 +38,7 @@ PROCESS_CONTEXT="firewalld_t" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/fwupd-and-similar/runtest.sh b/selinux-policy/fwupd-and-similar/runtest.sh index ae0fac8..f150b15 100755 --- a/selinux-policy/fwupd-and-similar/runtest.sh +++ b/selinux-policy/fwupd-and-similar/runtest.sh @@ -42,7 +42,7 @@ DENIED_USERS=${DENIED_USERS:-"guest_u xguest_u"} rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/getrlimit-permission/runtest.sh b/selinux-policy/getrlimit-permission/runtest.sh index d1313eb..9d4ee00 100755 --- a/selinux-policy/getrlimit-permission/runtest.sh +++ b/selinux-policy/getrlimit-permission/runtest.sh @@ -33,7 +33,7 @@ PACKAGE="selinux-policy" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/hostapd-and-similar/runtest.sh b/selinux-policy/hostapd-and-similar/runtest.sh index 9947d64..d2b2bbd 100755 --- a/selinux-policy/hostapd-and-similar/runtest.sh +++ b/selinux-policy/hostapd-and-similar/runtest.sh @@ -40,7 +40,7 @@ PROCESS_CONTEXT="hostapd_t" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/icecast-and-similar/runtest.sh b/selinux-policy/icecast-and-similar/runtest.sh index 36b3ded..04a6bb3 100755 --- a/selinux-policy/icecast-and-similar/runtest.sh +++ b/selinux-policy/icecast-and-similar/runtest.sh @@ -46,7 +46,7 @@ rlJournalStart fi rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/install-uninstall-dsp-packages/runtest.sh b/selinux-policy/install-uninstall-dsp-packages/runtest.sh index 058619f..571a4d0 100755 --- a/selinux-policy/install-uninstall-dsp-packages/runtest.sh +++ b/selinux-policy/install-uninstall-dsp-packages/runtest.sh @@ -95,7 +95,7 @@ fi rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESetEnforce rlSEStatus rlSESetTimestamp diff --git a/selinux-policy/journalctl-and-similar/runtest.sh b/selinux-policy/journalctl-and-similar/runtest.sh index 8a85859..2f9dc81 100755 --- a/selinux-policy/journalctl-and-similar/runtest.sh +++ b/selinux-policy/journalctl-and-similar/runtest.sh @@ -40,7 +40,7 @@ DENIED_USERS=${DENIED_USERS:-"guest_u xguest_u"} rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/kerberos-and-similar/runtest.sh b/selinux-policy/kerberos-and-similar/runtest.sh index ce2c4f6..6f5139e 100755 --- a/selinux-policy/kerberos-and-similar/runtest.sh +++ b/selinux-policy/kerberos-and-similar/runtest.sh @@ -34,7 +34,7 @@ ROOT_PASSWORD="redhat" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/kernel-confined-exec/runtest.sh b/selinux-policy/kernel-confined-exec/runtest.sh index 2694fb1..274e0a0 100755 --- a/selinux-policy/kernel-confined-exec/runtest.sh +++ b/selinux-policy/kernel-confined-exec/runtest.sh @@ -22,7 +22,7 @@ function trigger_modprobe() { rlJournalStart rlPhaseStartSetup - rlImport 'selinux-policy/common' + rlImport 'selinux-policy/common' 0,1 rlAssertRpm selinux-policy rlAssertRpm selinux-policy-targeted diff --git a/selinux-policy/ksm-and-similar/runtest.sh b/selinux-policy/ksm-and-similar/runtest.sh index 2d26a1f..29d93d9 100755 --- a/selinux-policy/ksm-and-similar/runtest.sh +++ b/selinux-policy/ksm-and-similar/runtest.sh @@ -44,7 +44,7 @@ rlJournalStart fi rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/ladvd/runtest.sh b/selinux-policy/ladvd/runtest.sh index 7c057b7..4af6367 100755 --- a/selinux-policy/ladvd/runtest.sh +++ b/selinux-policy/ladvd/runtest.sh @@ -38,7 +38,7 @@ rlJournalStart exit 0 fi rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/logwatch-and-similar/runtest.sh b/selinux-policy/logwatch-and-similar/runtest.sh index a152d4d..016d5a8 100755 --- a/selinux-policy/logwatch-and-similar/runtest.sh +++ b/selinux-policy/logwatch-and-similar/runtest.sh @@ -38,7 +38,7 @@ PROCESS_CONTEXT="logwatch_t" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/nasd-and-similar/runtest.sh b/selinux-policy/nasd-and-similar/runtest.sh index 0e0a784..8f312ca 100755 --- a/selinux-policy/nasd-and-similar/runtest.sh +++ b/selinux-policy/nasd-and-similar/runtest.sh @@ -46,7 +46,7 @@ rlJournalStart fi rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/nfsdcld-and-similar/runtest.sh b/selinux-policy/nfsdcld-and-similar/runtest.sh index a97e694..51b1b9f 100755 --- a/selinux-policy/nfsdcld-and-similar/runtest.sh +++ b/selinux-policy/nfsdcld-and-similar/runtest.sh @@ -40,7 +40,7 @@ PROCESS_CONTEXT="rpcd_t" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/ntpsec-and-similar/runtest.sh b/selinux-policy/ntpsec-and-similar/runtest.sh index 78a64a6..355bf1f 100755 --- a/selinux-policy/ntpsec-and-similar/runtest.sh +++ b/selinux-policy/ntpsec-and-similar/runtest.sh @@ -39,7 +39,7 @@ PROCESS_CONTEXT="ntpd_t" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/numad-and-similar/runtest.sh b/selinux-policy/numad-and-similar/runtest.sh index d6996f0..77c1b8e 100755 --- a/selinux-policy/numad-and-similar/runtest.sh +++ b/selinux-policy/numad-and-similar/runtest.sh @@ -37,7 +37,7 @@ PROCESS_CONTEXT="numad_t" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/nvme-stas-and-similar/runtest.sh b/selinux-policy/nvme-stas-and-similar/runtest.sh index ac5dd29..029512f 100755 --- a/selinux-policy/nvme-stas-and-similar/runtest.sh +++ b/selinux-policy/nvme-stas-and-similar/runtest.sh @@ -36,7 +36,7 @@ PROCESS_CONTEXT="nvme_stas_t" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/opensmtpd-and-similar/runtest.sh b/selinux-policy/opensmtpd-and-similar/runtest.sh index e397a87..3fe0ce5 100755 --- a/selinux-policy/opensmtpd-and-similar/runtest.sh +++ b/selinux-policy/opensmtpd-and-similar/runtest.sh @@ -39,7 +39,7 @@ PROCESS_CONTEXT="sendmail_t" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/pam_console-and-related/runtest.sh b/selinux-policy/pam_console-and-related/runtest.sh index 05c8796..20941d0 100755 --- a/selinux-policy/pam_console-and-related/runtest.sh +++ b/selinux-policy/pam_console-and-related/runtest.sh @@ -41,7 +41,7 @@ fi rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/pam_limits-and-related/runtest.sh b/selinux-policy/pam_limits-and-related/runtest.sh index 3eeb144..dc56fa8 100755 --- a/selinux-policy/pam_limits-and-related/runtest.sh +++ b/selinux-policy/pam_limits-and-related/runtest.sh @@ -36,7 +36,7 @@ ALLOWED_USERS=${ALLOWED_USERS:-"guest_u xguest_u user_u staff_u sysadm_u unconfi rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/pam_timestamp-and-related/runtest.sh b/selinux-policy/pam_timestamp-and-related/runtest.sh index 22521a0..1d1c61b 100755 --- a/selinux-policy/pam_timestamp-and-related/runtest.sh +++ b/selinux-policy/pam_timestamp-and-related/runtest.sh @@ -37,7 +37,7 @@ TIMESTAMP_DIR=${TIMESTAMP_DIR:-"/run/pam_timestamp"} rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/pcp-daemons-and-similar/runtest.sh b/selinux-policy/pcp-daemons-and-similar/runtest.sh index 94b5693..69dd098 100755 --- a/selinux-policy/pcp-daemons-and-similar/runtest.sh +++ b/selinux-policy/pcp-daemons-and-similar/runtest.sh @@ -70,7 +70,7 @@ fi rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/perf_event-and-related/runtest.sh b/selinux-policy/perf_event-and-related/runtest.sh index 84b4c1e..6051731 100755 --- a/selinux-policy/perf_event-and-related/runtest.sh +++ b/selinux-policy/perf_event-and-related/runtest.sh @@ -35,7 +35,7 @@ rlJournalStart rlLog "If this test fails, please contact mmalik on IRC #selinux" rlLog "This test should fail if tested bugs are NOT fixed yet" rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted rlAssertRpm perf diff --git a/selinux-policy/ping-and-similar/runtest.sh b/selinux-policy/ping-and-similar/runtest.sh index 004b259..3037afd 100755 --- a/selinux-policy/ping-and-similar/runtest.sh +++ b/selinux-policy/ping-and-similar/runtest.sh @@ -38,7 +38,7 @@ PROCESS_CONTEXT="ping_t" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/policykit-general/runtest.sh b/selinux-policy/policykit-general/runtest.sh index e89eefc..32a2c6b 100755 --- a/selinux-policy/policykit-general/runtest.sh +++ b/selinux-policy/policykit-general/runtest.sh @@ -43,7 +43,7 @@ fi rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/rngd-and-similar/runtest.sh b/selinux-policy/rngd-and-similar/runtest.sh index 4401f0d..e88d2a8 100755 --- a/selinux-policy/rngd-and-similar/runtest.sh +++ b/selinux-policy/rngd-and-similar/runtest.sh @@ -40,7 +40,7 @@ PROCESS_CONTEXT="rngd_t" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/rpc.idmapd-and-similar/runtest.sh b/selinux-policy/rpc.idmapd-and-similar/runtest.sh index b4d7218..e79d688 100755 --- a/selinux-policy/rpc.idmapd-and-similar/runtest.sh +++ b/selinux-policy/rpc.idmapd-and-similar/runtest.sh @@ -40,7 +40,7 @@ PROCESS_CONTEXT="rpcd_t" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/rpmdb-and-similar/runtest.sh b/selinux-policy/rpmdb-and-similar/runtest.sh index 5c33f74..dda6a92 100755 --- a/selinux-policy/rpmdb-and-similar/runtest.sh +++ b/selinux-policy/rpmdb-and-similar/runtest.sh @@ -45,7 +45,7 @@ rlJournalStart rlLog "If this test fails, please contact mmalik or IRC #selinux" rlLog "This test should fail if tested bugs are NOT fixed yet" rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/rrdcached-service-and-related/runtest.sh b/selinux-policy/rrdcached-service-and-related/runtest.sh index bd201e4..b6dfec0 100755 --- a/selinux-policy/rrdcached-service-and-related/runtest.sh +++ b/selinux-policy/rrdcached-service-and-related/runtest.sh @@ -44,7 +44,7 @@ rlJournalStart fi rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlAssertRpm $PACKAGE rlAssertRpm $SERVICE_PACKAGE rlSESetEnforce diff --git a/selinux-policy/rsyslog-and-similar/runtest.sh b/selinux-policy/rsyslog-and-similar/runtest.sh index edda98d..ee1b641 100755 --- a/selinux-policy/rsyslog-and-similar/runtest.sh +++ b/selinux-policy/rsyslog-and-similar/runtest.sh @@ -64,7 +64,7 @@ EOF rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/rtkit-daemon-and-similar/runtest.sh b/selinux-policy/rtkit-daemon-and-similar/runtest.sh index 6cf0153..b618d26 100755 --- a/selinux-policy/rtkit-daemon-and-similar/runtest.sh +++ b/selinux-policy/rtkit-daemon-and-similar/runtest.sh @@ -40,7 +40,7 @@ PROCESS_CONTEXT="rtkit_daemon_t" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/smbcontrol-and-similar/runtest.sh b/selinux-policy/smbcontrol-and-similar/runtest.sh index 02d9bc7..9e8a384 100755 --- a/selinux-policy/smbcontrol-and-similar/runtest.sh +++ b/selinux-policy/smbcontrol-and-similar/runtest.sh @@ -42,7 +42,7 @@ PROCESS_CONTEXT="smbcontrol_t" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/snapd-and-similar/runtest.sh b/selinux-policy/snapd-and-similar/runtest.sh index a644221..e9e39e0 100755 --- a/selinux-policy/snapd-and-similar/runtest.sh +++ b/selinux-policy/snapd-and-similar/runtest.sh @@ -39,7 +39,7 @@ PROCESS_CONTEXT="snappy_t" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/sslh-and-similar/runtest.sh b/selinux-policy/sslh-and-similar/runtest.sh index 6803188..0ff50e0 100755 --- a/selinux-policy/sslh-and-similar/runtest.sh +++ b/selinux-policy/sslh-and-similar/runtest.sh @@ -46,7 +46,7 @@ rlJournalStart fi rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/stalld-and-similar/runtest.sh b/selinux-policy/stalld-and-similar/runtest.sh index 90f86ef..e0d7696 100755 --- a/selinux-policy/stalld-and-similar/runtest.sh +++ b/selinux-policy/stalld-and-similar/runtest.sh @@ -45,7 +45,7 @@ rlJournalStart fi rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/sudo-and-dnf/runtest.sh b/selinux-policy/sudo-and-dnf/runtest.sh index 716001d..cc9cafd 100755 --- a/selinux-policy/sudo-and-dnf/runtest.sh +++ b/selinux-policy/sudo-and-dnf/runtest.sh @@ -33,7 +33,7 @@ PACKAGE="selinux-policy" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/swap-file-and-systemd-access/runtest.sh b/selinux-policy/swap-file-and-systemd-access/runtest.sh index 4dc1413..3c04729 100755 --- a/selinux-policy/swap-file-and-systemd-access/runtest.sh +++ b/selinux-policy/swap-file-and-systemd-access/runtest.sh @@ -41,7 +41,7 @@ rlJournalStart fi rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/synce4l-and-similar/runtest.sh b/selinux-policy/synce4l-and-similar/runtest.sh index 01529a5..a0be444 100755 --- a/selinux-policy/synce4l-and-similar/runtest.sh +++ b/selinux-policy/synce4l-and-similar/runtest.sh @@ -39,7 +39,7 @@ PROCESS_CONTEXT="unconfined_service_t" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/systemd-bootchart-and-similar/runtest.sh b/selinux-policy/systemd-bootchart-and-similar/runtest.sh index 362b6a2..7c41cc4 100755 --- a/selinux-policy/systemd-bootchart-and-similar/runtest.sh +++ b/selinux-policy/systemd-bootchart-and-similar/runtest.sh @@ -50,7 +50,7 @@ rlJournalStart fi rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/systemd-creds/runtest.sh b/selinux-policy/systemd-creds/runtest.sh index 227e890..6b66567 100755 --- a/selinux-policy/systemd-creds/runtest.sh +++ b/selinux-policy/systemd-creds/runtest.sh @@ -34,7 +34,7 @@ SERVICE_PACKAGE="systemd" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/systemd-generators/runtest.sh b/selinux-policy/systemd-generators/runtest.sh index 411a238..3da5533 100755 --- a/selinux-policy/systemd-generators/runtest.sh +++ b/selinux-policy/systemd-generators/runtest.sh @@ -42,7 +42,7 @@ SD_SYSTEM_GENERATORS="" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/systemd-homed/runtest.sh b/selinux-policy/systemd-homed/runtest.sh index c408608..36eb6c5 100755 --- a/selinux-policy/systemd-homed/runtest.sh +++ b/selinux-policy/systemd-homed/runtest.sh @@ -116,7 +116,7 @@ rlJournalStart fi rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE1} rlAssertRpm ${PACKAGE1}-targeted diff --git a/selinux-policy/systemd-localed/runtest.sh b/selinux-policy/systemd-localed/runtest.sh index e104b55..4d6b5d3 100755 --- a/selinux-policy/systemd-localed/runtest.sh +++ b/selinux-policy/systemd-localed/runtest.sh @@ -7,7 +7,7 @@ SERVICE_PACKAGE="systemd" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted rlAssertRpm ${SERVICE_PACKAGE} diff --git a/selinux-policy/systemd-machined-and-similar/runtest.sh b/selinux-policy/systemd-machined-and-similar/runtest.sh index 9a4fa7b..54b3bb2 100755 --- a/selinux-policy/systemd-machined-and-similar/runtest.sh +++ b/selinux-policy/systemd-machined-and-similar/runtest.sh @@ -45,7 +45,7 @@ rlJournalStart fi rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/systemd-modules-load-and-similar/runtest.sh b/selinux-policy/systemd-modules-load-and-similar/runtest.sh index 8ffe27e..a7a862c 100755 --- a/selinux-policy/systemd-modules-load-and-similar/runtest.sh +++ b/selinux-policy/systemd-modules-load-and-similar/runtest.sh @@ -41,7 +41,7 @@ KERNEL_MODULE="nf_conntrack_pptp" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/systemd-notify-and-similar/runtest.sh b/selinux-policy/systemd-notify-and-similar/runtest.sh index d9cfbe7..2a5a9d8 100755 --- a/selinux-policy/systemd-notify-and-similar/runtest.sh +++ b/selinux-policy/systemd-notify-and-similar/runtest.sh @@ -41,7 +41,7 @@ rlJournalStart rlLog "If this test fails, please contact mmalik on IRC #selinux" rlLog "This test should fail if tested bugs are NOT fixed yet" rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/systemd-rfkill-and-similar/runtest.sh b/selinux-policy/systemd-rfkill-and-similar/runtest.sh index cbebe00..4782814 100755 --- a/selinux-policy/systemd-rfkill-and-similar/runtest.sh +++ b/selinux-policy/systemd-rfkill-and-similar/runtest.sh @@ -40,7 +40,7 @@ PROCESS_CONTEXT="systemd_rfkill_t" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/systemd-run-and-similar/runtest.sh b/selinux-policy/systemd-run-and-similar/runtest.sh index 0b0fbd2..8aa5fb1 100755 --- a/selinux-policy/systemd-run-and-similar/runtest.sh +++ b/selinux-policy/systemd-run-and-similar/runtest.sh @@ -32,7 +32,7 @@ PACKAGE="selinux-policy" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/systemd-sysctl-and-similar/runtest.sh b/selinux-policy/systemd-sysctl-and-similar/runtest.sh index 1e18554..e7ef474 100755 --- a/selinux-policy/systemd-sysctl-and-similar/runtest.sh +++ b/selinux-policy/systemd-sysctl-and-similar/runtest.sh @@ -36,7 +36,7 @@ SERVICE_PACKAGE="systemd" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/systemd-timesyncd-and-similar/runtest.sh b/selinux-policy/systemd-timesyncd-and-similar/runtest.sh index a9d5e81..42fa246 100755 --- a/selinux-policy/systemd-timesyncd-and-similar/runtest.sh +++ b/selinux-policy/systemd-timesyncd-and-similar/runtest.sh @@ -39,7 +39,7 @@ PROCESS_CONTEXT="systemd_timedated_t" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires SERVICE_PACKAGE=`rpm -qf ${FILE_PATH} | head -n 1` rlAssertRpm ${PACKAGE} diff --git a/selinux-policy/systemd-userdbd-and-similar/runtest.sh b/selinux-policy/systemd-userdbd-and-similar/runtest.sh index 5df13af..6932575 100755 --- a/selinux-policy/systemd-userdbd-and-similar/runtest.sh +++ b/selinux-policy/systemd-userdbd-and-similar/runtest.sh @@ -48,7 +48,7 @@ rlJournalStart fi rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/targetd-and-similar/runtest.sh b/selinux-policy/targetd-and-similar/runtest.sh index 35fb247..c0530e8 100755 --- a/selinux-policy/targetd-and-similar/runtest.sh +++ b/selinux-policy/targetd-and-similar/runtest.sh @@ -39,7 +39,7 @@ PROCESS_CONTEXT="targetd_t" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/thttpd-and-similar/runtest.sh b/selinux-policy/thttpd-and-similar/runtest.sh index 4570319..860d5c7 100755 --- a/selinux-policy/thttpd-and-similar/runtest.sh +++ b/selinux-policy/thttpd-and-similar/runtest.sh @@ -40,7 +40,7 @@ PROCESS_CONTEXT="httpd_t" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/tlp-and-similar/runtest.sh b/selinux-policy/tlp-and-similar/runtest.sh index 9e39d97..2ec22bb 100755 --- a/selinux-policy/tlp-and-similar/runtest.sh +++ b/selinux-policy/tlp-and-similar/runtest.sh @@ -40,7 +40,7 @@ PROCESS_CONTEXT="tlp_t" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/usbguard-daemon-and-similar/runtest.sh b/selinux-policy/usbguard-daemon-and-similar/runtest.sh index 6c00b0c..e50df2c 100755 --- a/selinux-policy/usbguard-daemon-and-similar/runtest.sh +++ b/selinux-policy/usbguard-daemon-and-similar/runtest.sh @@ -40,7 +40,7 @@ PROCESS_CONTEXT="usbguard_t" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/usbmuxd-and-similar/runtest.sh b/selinux-policy/usbmuxd-and-similar/runtest.sh index e205d5c..57bd228 100755 --- a/selinux-policy/usbmuxd-and-similar/runtest.sh +++ b/selinux-policy/usbmuxd-and-similar/runtest.sh @@ -46,7 +46,7 @@ rlJournalStart fi rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/virtualization-daemons/runtest.sh b/selinux-policy/virtualization-daemons/runtest.sh index 825382b..042b365 100755 --- a/selinux-policy/virtualization-daemons/runtest.sh +++ b/selinux-policy/virtualization-daemons/runtest.sh @@ -66,16 +66,12 @@ fi rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted rlRun "rpm -qa libvirt\*" - rlRun "sed -i 's/^.*task.*never.*$//' /etc/audit/rules.d/audit.rules" - rlRun "echo '-w /etc/shadow -p w' >> /etc/audit/rules.d/audit.rules" - rlRun "service auditd restart" - rlServiceStop ${SERVICE_NAMES} rlFileBackup /etc/shadow diff --git a/selinux-policy/watch-permissions/runtest.sh b/selinux-policy/watch-permissions/runtest.sh index c8183ab..aa26229 100755 --- a/selinux-policy/watch-permissions/runtest.sh +++ b/selinux-policy/watch-permissions/runtest.sh @@ -33,7 +33,7 @@ PACKAGE="selinux-policy" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted From 24ce6bf2dee03648702dc7a65ed5da69945af8c0 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Wed, 10 Apr 2024 13:00:21 +0200 Subject: [PATCH 346/626] make the cups-browsed service running The cups-browsed service does not start with the default configuration. In order to perform a basic SELinux testing, the cups-browsed configuration needs to be modified (for example: BrowsePoll). --- selinux-policy/cups-browsed-and-similar/Makefile | 2 +- selinux-policy/cups-browsed-and-similar/main.fmf | 2 +- selinux-policy/cups-browsed-and-similar/runtest.sh | 2 ++ 3 files changed, 4 insertions(+), 2 deletions(-) diff --git a/selinux-policy/cups-browsed-and-similar/Makefile b/selinux-policy/cups-browsed-and-similar/Makefile index 951aa63..aee1194 100644 --- a/selinux-policy/cups-browsed-and-similar/Makefile +++ b/selinux-policy/cups-browsed-and-similar/Makefile @@ -62,7 +62,7 @@ $(METADATA): Makefile @echo "Confidential: no" >> $(METADATA) @echo "Destructive: no" >> $(METADATA) @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) - @echo "Releases: -RHEL4 -RHELServer5 -RHELClient5 -RHEL6" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6" >> $(METADATA) @echo "Bug: 1395801" >> $(METADATA) # Fedora 26 @echo "Bug: 1401634" >> $(METADATA) # Fedora 26 @echo "Bug: 1719754" >> $(METADATA) # RHEL-7 diff --git a/selinux-policy/cups-browsed-and-similar/main.fmf b/selinux-policy/cups-browsed-and-similar/main.fmf index f913a2a..f7c3a00 100644 --- a/selinux-policy/cups-browsed-and-similar/main.fmf +++ b/selinux-policy/cups-browsed-and-similar/main.fmf @@ -30,7 +30,7 @@ tag: - RHEL8 - Tier1 - Tier1security - - Tier2se + - Tier1se - f32friendly - targeted tier: '1' diff --git a/selinux-policy/cups-browsed-and-similar/runtest.sh b/selinux-policy/cups-browsed-and-similar/runtest.sh index 0a0a5e0..71eeb50 100755 --- a/selinux-policy/cups-browsed-and-similar/runtest.sh +++ b/selinux-policy/cups-browsed-and-similar/runtest.sh @@ -47,6 +47,7 @@ rlJournalStart rlAssertRpm ${SERVICE_PACKAGE} rlFileBackup /etc/shadow + rlFileBackup /etc/cups/cups-browsed.conf rlServiceStop ${SERVICE_NAME} rlSESetEnforce @@ -71,6 +72,7 @@ rlJournalStart rlPhaseEnd rlPhaseStartTest "real scenario" + rlRun "echo -en '\nBrowsePoll localhost\n' >> /etc/cups/cups-browsed.conf" rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" if ! rlSEDefined ${PROCESS_CONTEXT} ; then if rlIsRHEL 5 6 ; then From cc86664885b24eff4e7c4847b8237c02b206a2d1 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Thu, 11 Apr 2024 14:33:27 +0200 Subject: [PATCH 347/626] improve other tests which fail on CentOS-stream-10 Some components/packages are not available on CentOS-stream-10, which leads to conclusion not to run the affected tests/phases there. The /var and /run directories very often contain mislabeled files and directories. In order to find discrepancies between file context patterns and type_transition rules defined in the SELinux policy, the restorecon command is needed. --- policycoreutils/file-contexts/runtest.sh | 6 +++++- selinux-policy/ModemManager-and-similar/runtest.sh | 1 + selinux-policy/blueman-and-similar/runtest.sh | 1 + selinux-policy/bootupd-and-similar/runtest.sh | 2 +- selinux-policy/bz733494-amanda-and-similar/runtest.sh | 4 +++- selinux-policy/cockpit-ws-and-similar/runtest.sh | 4 +++- selinux-policy/firewalld-and-similar/runtest.sh | 4 +++- selinux-policy/icecast-and-similar/runtest.sh | 1 + selinux-policy/kerberos-and-similar/runtest.sh | 4 +++- selinux-policy/sudo-and-dnf/Makefile | 2 +- selinux-policy/sudo-and-dnf/main.fmf | 1 + selinux-policy/systemd-generators/main.fmf | 5 ++++- selinux-policy/systemd-generators/runtest.sh | 3 +++ 13 files changed, 30 insertions(+), 8 deletions(-) diff --git a/policycoreutils/file-contexts/runtest.sh b/policycoreutils/file-contexts/runtest.sh index 3375f00..b736e5a 100755 --- a/policycoreutils/file-contexts/runtest.sh +++ b/policycoreutils/file-contexts/runtest.sh @@ -54,7 +54,11 @@ rlJournalStart rlAssertGrep "/run/\.\* *all files *$RUN_CON" stdout rlAssertGrep "/run *directory *$RUN_CON" stdout rlAssertGrep "/home/\[\^/\]+/bin(/\.\*)? *all files *$HOME_BIN_CON" stdout - rlAssertGrep "/run = /var/run" stdout + if rlIsFedora '>= 40' || rlIsCentOS '>= 10' || rlIsRHEL '>= 10' ; then + rlAssertGrep "/var/run = /run" stdout + else + rlAssertGrep "/run = /var/run" stdout + fi rlPhaseEnd rlPhaseStartTest "semanage fcontext add and delete" diff --git a/selinux-policy/ModemManager-and-similar/runtest.sh b/selinux-policy/ModemManager-and-similar/runtest.sh index bba63cb..63470fb 100755 --- a/selinux-policy/ModemManager-and-similar/runtest.sh +++ b/selinux-policy/ModemManager-and-similar/runtest.sh @@ -115,6 +115,7 @@ rlJournalStart sleep 1 rlRun "service systemd-logind restart" sleep 1 + rlRun "restorecon -Rv /var /run -e /var/ARTIFACTS" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd fi diff --git a/selinux-policy/blueman-and-similar/runtest.sh b/selinux-policy/blueman-and-similar/runtest.sh index 7c0c15c..a0b6ec8 100755 --- a/selinux-policy/blueman-and-similar/runtest.sh +++ b/selinux-policy/blueman-and-similar/runtest.sh @@ -107,6 +107,7 @@ rlJournalStart rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 PYTHON_VERSION=`python --version | tr -d ' ' | cut -d . -f 1,2 | tr '[:upper:]' '[:lower:]'` rlRun "mkdir -p ~/.local/lib/${PYTHON_VERSION}/site-packages/" + rlRun "restorecon -Rv /var /run -e /var/ARTIFACTS" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd diff --git a/selinux-policy/bootupd-and-similar/runtest.sh b/selinux-policy/bootupd-and-similar/runtest.sh index 3fdddda..06a8156 100755 --- a/selinux-policy/bootupd-and-similar/runtest.sh +++ b/selinux-policy/bootupd-and-similar/runtest.sh @@ -34,7 +34,7 @@ FILE_PATH="/usr/libexec/bootupd" SERVICE_PACKAGE="bootupd" SERVICE_NAME="bootupd" PROCESS_NAME="bootupd" -if rlIsFedora ; then +if rlIsFedora || rlIsRHEL '>= 10' || rlIsCentOS '>= 10' ; then FILE_CONTEXT="bootupd_exec_t" PROCESS_CONTEXT="bootupd_t" else diff --git a/selinux-policy/bz733494-amanda-and-similar/runtest.sh b/selinux-policy/bz733494-amanda-and-similar/runtest.sh index bb1aec9..8360689 100755 --- a/selinux-policy/bz733494-amanda-and-similar/runtest.sh +++ b/selinux-policy/bz733494-amanda-and-similar/runtest.sh @@ -195,7 +195,9 @@ rlJournalStart fi rlRun "systemctl enable amanda-udp.socket" rlRun "systemctl start amanda-udp.socket" - rlSEService ${ROOT_PASSWORD} amanda-udp amandad amanda_t "start status restart status stop status" 1 + rlSEService ${ROOT_PASSWORD} amanda-udp amandad amanda_t "start status" 1 + rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 + rlSEService ${ROOT_PASSWORD} amanda-udp amandad amanda_t "restart status stop status" 1 rlRun "systemctl stop amanda-udp.socket" rlRun "systemctl disable amanda-udp.socket" rlPhaseEnd diff --git a/selinux-policy/cockpit-ws-and-similar/runtest.sh b/selinux-policy/cockpit-ws-and-similar/runtest.sh index 0dbc556..9ee500c 100755 --- a/selinux-policy/cockpit-ws-and-similar/runtest.sh +++ b/selinux-policy/cockpit-ws-and-similar/runtest.sh @@ -152,7 +152,9 @@ rlJournalStart PROCESS_CONTEXT="unconfined_service_t" fi fi - rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status restart status stop status" 1 + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd rlPhaseStartTest "bz#1402316 + bz#1402495" diff --git a/selinux-policy/firewalld-and-similar/runtest.sh b/selinux-policy/firewalld-and-similar/runtest.sh index f0beb41..a4c117c 100755 --- a/selinux-policy/firewalld-and-similar/runtest.sh +++ b/selinux-policy/firewalld-and-similar/runtest.sh @@ -205,7 +205,9 @@ rlJournalStart PROCESS_CONTEXT="unconfined_service_t" fi fi - rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status restart status stop status" 1 + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlRun "rm -f /etc/firewalld/lockdown-whitelist.xml*" rlRun "ls -dZ /run/firewalld | grep :firewalld_var_run_t" if rlIsRHEL 7 ; then diff --git a/selinux-policy/icecast-and-similar/runtest.sh b/selinux-policy/icecast-and-similar/runtest.sh index 04a6bb3..bbfa4d4 100755 --- a/selinux-policy/icecast-and-similar/runtest.sh +++ b/selinux-policy/icecast-and-similar/runtest.sh @@ -115,6 +115,7 @@ rlJournalStart rlRun "grep logsize /etc/icecast.xml" rlRun "sed -i 's|^.*\(\).*$|\1|' /etc/icecast.xml" rlRun "grep logarchive /etc/icecast.xml" + rlRun "restorecon -Rv /var /run -e /var/ARTIFACTS" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 if rlIsRHEL 5 6 ; then rlRun "setsebool icecast_connect_any off" diff --git a/selinux-policy/kerberos-and-similar/runtest.sh b/selinux-policy/kerberos-and-similar/runtest.sh index 6f5139e..5ba7389 100755 --- a/selinux-policy/kerberos-and-similar/runtest.sh +++ b/selinux-policy/kerberos-and-similar/runtest.sh @@ -202,7 +202,9 @@ rlJournalStart rlRun "rm -f /etc/krb5.conf" rlRun "cp ./krb5.conf /etc" rlRun "restorecon -v /etc/krb5.conf" - rlSEService ${ROOT_PASSWORD} kprop kpropd kpropd_t "start status restart status stop status" 1 + rlSEService ${ROOT_PASSWORD} kprop kpropd kpropd_t "start status" 1 + rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 + rlSEService ${ROOT_PASSWORD} kprop kpropd kpropd_t "restart status stop status" 1 rlPhaseEnd rlPhaseStartCleanup diff --git a/selinux-policy/sudo-and-dnf/Makefile b/selinux-policy/sudo-and-dnf/Makefile index d1cc3ca..8fd75e9 100644 --- a/selinux-policy/sudo-and-dnf/Makefile +++ b/selinux-policy/sudo-and-dnf/Makefile @@ -54,7 +54,7 @@ $(METADATA): Makefile @echo "Type: Regression" >> $(METADATA) @echo "TestTime: 10m" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console expect openssh-clients shadow-utils sudo dnf" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console expect openssh-clients shadow-utils sudo dnf /usr/sbin/service" >> $(METADATA) @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) diff --git a/selinux-policy/sudo-and-dnf/main.fmf b/selinux-policy/sudo-and-dnf/main.fmf index c46b178..f1591fb 100644 --- a/selinux-policy/sudo-and-dnf/main.fmf +++ b/selinux-policy/sudo-and-dnf/main.fmf @@ -22,6 +22,7 @@ recommend: - shadow-utils - sudo - dnf + - /usr/sbin/service environment: AVC_ERROR: +no_avc_check duration: 10m diff --git a/selinux-policy/systemd-generators/main.fmf b/selinux-policy/systemd-generators/main.fmf index 6bb603a..9374c7f 100644 --- a/selinux-policy/systemd-generators/main.fmf +++ b/selinux-policy/systemd-generators/main.fmf @@ -10,8 +10,11 @@ test: ./runtest.sh framework: beakerlib require: - library(selinux-policy/common) - - selinux-policy recommend: + - audit + - libselinux-utils + - policycoreutils + - selinux-policy - selinux-policy-targeted environment: AVC_ERROR: +no_avc_check diff --git a/selinux-policy/systemd-generators/runtest.sh b/selinux-policy/systemd-generators/runtest.sh index 3da5533..f6f6c25 100755 --- a/selinux-policy/systemd-generators/runtest.sh +++ b/selinux-policy/systemd-generators/runtest.sh @@ -84,6 +84,7 @@ rlJournalStart echo "${SD_SYSTEM_GENERATORS_NOTCONFINED}" rlPhaseEnd + if [ -f /usr/lib/systemd/system/systemd-networkd.service ] ; then ### network-generator actually is a service, not a generator # systemd-network-generator.service is a system service that translates ip= and the @@ -107,6 +108,8 @@ rlJournalStart rlRun "diff /run/systemd/network/71-default.network 71-default-off.network" rlPhaseEnd + fi + ### fstab-generator # systemd-fstab-generator is a generator that translates /etc/fstab (see fstab(5) # for details) into native systemd units early at boot and when configuration of From f10ccbe5cbe97dc66835ee213abf554491428333 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Fri, 12 Apr 2024 19:03:39 +0200 Subject: [PATCH 348/626] add new test which covers various ABRT services A lot of recently filed BZs revealed and confirmed that SELinux prevents the abrt-dump-journal-core processes from: * writing to /run/systemd/userdb/io.systemd.* sockets * connecting to various UNIX streams owned by systemd* processes The TC reproduces the situation. In order to support the expected ABRT functions, I believe that SELinux policy should allow above-mentioned actions. The TC looks for appropriate SELinux policy rules and file context patterns. The TC covers BZ#2274709 and other duplicates. --- selinux-policy/abrt-services/Makefile | 69 +++++++++++++++++++++ selinux-policy/abrt-services/PURPOSE | 5 ++ selinux-policy/abrt-services/main.fmf | 51 ++++++++++++++++ selinux-policy/abrt-services/runtest.sh | 79 +++++++++++++++++++++++++ 4 files changed, 204 insertions(+) create mode 100644 selinux-policy/abrt-services/Makefile create mode 100644 selinux-policy/abrt-services/PURPOSE create mode 100644 selinux-policy/abrt-services/main.fmf create mode 100755 selinux-policy/abrt-services/runtest.sh diff --git a/selinux-policy/abrt-services/Makefile b/selinux-policy/abrt-services/Makefile new file mode 100644 index 0000000..1984edd --- /dev/null +++ b/selinux-policy/abrt-services/Makefile @@ -0,0 +1,69 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/abrt-services +# Description: SELinux interferes with various ABRT services +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2024 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/abrt-services +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with various ABRT services" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "RunFor: abrt" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console psmisc abrt abrt-addon-ccpp abrt-addon-coredump-helper abrt-addon-kerneloops abrt-addon-pstoreoops abrt-addon-upload-watch abrt-addon-vmcore abrt-addon-xorg /usr/sbin/service" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL9" >> $(METADATA) + @echo "Bug: 2274709" >> $(METADATA) # Fedora 40 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/abrt-services/PURPOSE b/selinux-policy/abrt-services/PURPOSE new file mode 100644 index 0000000..0416559 --- /dev/null +++ b/selinux-policy/abrt-services/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/abrt-services +Author: Milos Malik + +SELinux interferes with various ABRT services. + diff --git a/selinux-policy/abrt-services/main.fmf b/selinux-policy/abrt-services/main.fmf new file mode 100644 index 0000000..864e175 --- /dev/null +++ b/selinux-policy/abrt-services/main.fmf @@ -0,0 +1,51 @@ +summary: SELinux interferes with various ABRT services +description: |+ + SELinux interferes with various ABRT services + +contact: Milos Malik +component: + - abrt + - selinux-policy +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - psmisc + - abrt + - abrt-addon-ccpp + - abrt-addon-coredump-helper + - abrt-addon-kerneloops + - abrt-addon-pstoreoops + - abrt-addon-upload-watch + - abrt-addon-vmcore + - abrt-addon-xorg + - /usr/sbin/service +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL9 + - targeted +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2274709 +adjust: + - enabled: false + when: distro >= rhel-9 + because: the abrt* packages are not available there + - enabled: false + when: distro >= centos-stream-9 + because: the abrt* packages are not available there +extra-summary: /CoreOS/selinux-policy/Regression/abrt-services +extra-task: /CoreOS/selinux-policy/Regression/abrt-services +extra-nitrate: TC#0617419 +id: ca742967-9ac5-4f16-be93-d95eb7932224 diff --git a/selinux-policy/abrt-services/runtest.sh b/selinux-policy/abrt-services/runtest.sh new file mode 100755 index 0000000..220c1c6 --- /dev/null +++ b/selinux-policy/abrt-services/runtest.sh @@ -0,0 +1,79 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/abrt-services +# Description: SELinux interferes with various ABRT services +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2024 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlRun "rpm -qa | grep abrt | sort" + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + if rlIsFedora ; then + rlPhaseStartTest "bz#2274709" + rlSEMatchPathCon "/usr/bin/abrt-dump-journal-core" "abrt_dump_oops_exec_t" + rlSEMatchPathCon "/run/systemd/userdb/io.systemd.DynamicUser" "systemd_userdbd_runtime_t" + rlSEMatchPathCon "/run/systemd/userdb/io.systemd.DropIn" "systemd_userdbd_runtime_t" + rlSEMatchPathCon "/run/systemd/userdb/io.systemd.Home" "systemd_userdbd_runtime_t" + rlSESearchRule "allow abrt_dump_oops_t systemd_userdbd_runtime_t : sock_file { write } [ ]" + rlSESearchRule "allow abrt_dump_oops_t systemd_userdbd_t : unix_stream_socket { connectto } [ ]" + rlSESearchRule "allow abrt_dump_oops_t init_t : unix_stream_socket { connectto } [ ]" + rlPhaseEnd + fi + + rlPhaseStartTest "real scenario -- bz#2274709" + for SERVICE_NAME in abrtd abrt-journal-core abrt-oops abrt-pstoreoops abrt-upload-watch abrt-vmcore abrt-xorg ; do + rlRun "service ${SERVICE_NAME} start" + done + sleep 60 & + sleep 10 + rlRun "killall --signal SIGABRT sleep" + rlRun "restorecon -Rv /var /run -e /var/ARTIFACTS" 0-255 + for SERVICE_NAME in abrtd abrt-journal-core abrt-oops abrt-pstoreoops abrt-upload-watch abrt-vmcore abrt-xorg ; do + rlRun "service ${SERVICE_NAME} stop" + done + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + From 674ade6166c9586a741a20ade5cf45d0ddc6fc74 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Wed, 17 Apr 2024 11:04:50 +0200 Subject: [PATCH 349/626] move more downstream tests to upstream repository The following automated tests are important for upstream testing too and that's why they should be moved from the downstream repo to the upstream one. --- .../semanage-handle-functions/Makefile | 63 +++++ libsemanage/semanage-handle-functions/PURPOSE | 3 + .../semanage-handle-functions/functions.c | 132 +++++++++ .../semanage-handle-functions/main.fmf | 34 +++ .../semanage-handle-functions/plan.txt | 29 ++ .../semanage-handle-functions/runtest.sh | 121 ++++++++ .../test_access_check.c | 32 +++ .../semanage-handle-functions/test_connect.c | 33 +++ .../test_handle_create.c | 15 + .../test_is_connected.c | 32 +++ .../test_is_managed.c | 32 +++ .../test_mls_enabled.c | 32 +++ .../semanage-handle-functions/test_root.c | 53 ++++ .../test_transaction.c | 34 +++ .../semanage-seuser-functions/Makefile | 63 +++++ libsemanage/semanage-seuser-functions/PURPOSE | 3 + .../semanage-seuser-functions/functions.c | 263 ++++++++++++++++++ .../semanage-seuser-functions/main.fmf | 28 ++ .../semanage-seuser-functions/runtest.sh | 257 +++++++++++++++++ .../semanage-seuser-functions/test_clone.c | 60 ++++ .../semanage-seuser-functions/test_compare.c | 44 +++ .../semanage-seuser-functions/test_compare2.c | 54 ++++ .../semanage-seuser-functions/test_count.c | 34 +++ .../test_count_local.c | 46 +++ .../semanage-seuser-functions/test_create.c | 53 ++++ .../test_del_local.c | 64 +++++ .../semanage-seuser-functions/test_exists.c | 37 +++ .../test_exists_local.c | 59 ++++ .../test_get_mlsrange.c | 32 +++ .../semanage-seuser-functions/test_get_name.c | 32 +++ .../test_get_sename.c | 32 +++ .../semanage-seuser-functions/test_iterate.c | 49 ++++ .../test_key_create.c | 39 +++ .../test_key_extract.c | 45 +++ .../semanage-seuser-functions/test_list.c | 63 +++++ .../test_modify_local.c | 64 +++++ .../semanage-seuser-functions/test_query.c | 50 ++++ .../test_set_mlsrange.c | 62 +++++ .../semanage-seuser-functions/test_set_name.c | 62 +++++ .../test_set_sename.c | 62 +++++ 40 files changed, 2302 insertions(+) create mode 100644 libsemanage/semanage-handle-functions/Makefile create mode 100644 libsemanage/semanage-handle-functions/PURPOSE create mode 100644 libsemanage/semanage-handle-functions/functions.c create mode 100644 libsemanage/semanage-handle-functions/main.fmf create mode 100644 libsemanage/semanage-handle-functions/plan.txt create mode 100755 libsemanage/semanage-handle-functions/runtest.sh create mode 100644 libsemanage/semanage-handle-functions/test_access_check.c create mode 100644 libsemanage/semanage-handle-functions/test_connect.c create mode 100644 libsemanage/semanage-handle-functions/test_handle_create.c create mode 100644 libsemanage/semanage-handle-functions/test_is_connected.c create mode 100644 libsemanage/semanage-handle-functions/test_is_managed.c create mode 100644 libsemanage/semanage-handle-functions/test_mls_enabled.c create mode 100644 libsemanage/semanage-handle-functions/test_root.c create mode 100644 libsemanage/semanage-handle-functions/test_transaction.c create mode 100644 libsemanage/semanage-seuser-functions/Makefile create mode 100644 libsemanage/semanage-seuser-functions/PURPOSE create mode 100644 libsemanage/semanage-seuser-functions/functions.c create mode 100644 libsemanage/semanage-seuser-functions/main.fmf create mode 100755 libsemanage/semanage-seuser-functions/runtest.sh create mode 100644 libsemanage/semanage-seuser-functions/test_clone.c create mode 100644 libsemanage/semanage-seuser-functions/test_compare.c create mode 100644 libsemanage/semanage-seuser-functions/test_compare2.c create mode 100644 libsemanage/semanage-seuser-functions/test_count.c create mode 100644 libsemanage/semanage-seuser-functions/test_count_local.c create mode 100644 libsemanage/semanage-seuser-functions/test_create.c create mode 100644 libsemanage/semanage-seuser-functions/test_del_local.c create mode 100644 libsemanage/semanage-seuser-functions/test_exists.c create mode 100644 libsemanage/semanage-seuser-functions/test_exists_local.c create mode 100644 libsemanage/semanage-seuser-functions/test_get_mlsrange.c create mode 100644 libsemanage/semanage-seuser-functions/test_get_name.c create mode 100644 libsemanage/semanage-seuser-functions/test_get_sename.c create mode 100644 libsemanage/semanage-seuser-functions/test_iterate.c create mode 100644 libsemanage/semanage-seuser-functions/test_key_create.c create mode 100644 libsemanage/semanage-seuser-functions/test_key_extract.c create mode 100644 libsemanage/semanage-seuser-functions/test_list.c create mode 100644 libsemanage/semanage-seuser-functions/test_modify_local.c create mode 100644 libsemanage/semanage-seuser-functions/test_query.c create mode 100644 libsemanage/semanage-seuser-functions/test_set_mlsrange.c create mode 100644 libsemanage/semanage-seuser-functions/test_set_name.c create mode 100644 libsemanage/semanage-seuser-functions/test_set_sename.c diff --git a/libsemanage/semanage-handle-functions/Makefile b/libsemanage/semanage-handle-functions/Makefile new file mode 100644 index 0000000..c49dbe0 --- /dev/null +++ b/libsemanage/semanage-handle-functions/Makefile @@ -0,0 +1,63 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/libsemanage/Sanity/semanage-handle-functions +# Description: Test functions from handle.h +# Author: Jan Zarsky +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2017 Red Hat, Inc. +# +# This program is free software: you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation, either version 2 of +# the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see http://www.gnu.org/licenses/. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/libsemanage/Sanity/semanage-handle-functions +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE functions.c test_*.c + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + test -x runtest.sh || chmod a+x runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Jan Zarsky " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: Test functions from handle.h" >> $(METADATA) + @echo "Type: Sanity" >> $(METADATA) + @echo "TestTime: 5m" >> $(METADATA) + @echo "RunFor: libsemanage" >> $(METADATA) + @echo "Requires: libsemanage libsemanage-devel glibc gcc" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2+" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHELClient5 -RHELServer5" >> $(METADATA) + + rhts-lint $(METADATA) diff --git a/libsemanage/semanage-handle-functions/PURPOSE b/libsemanage/semanage-handle-functions/PURPOSE new file mode 100644 index 0000000..09a8e19 --- /dev/null +++ b/libsemanage/semanage-handle-functions/PURPOSE @@ -0,0 +1,3 @@ +PURPOSE of /CoreOS/libsemanage/Sanity/semanage-handle-functions +Description: Test functions from handle.h +Author: Jan Zarsky diff --git a/libsemanage/semanage-handle-functions/functions.c b/libsemanage/semanage-handle-functions/functions.c new file mode 100644 index 0000000..7722c09 --- /dev/null +++ b/libsemanage/semanage-handle-functions/functions.c @@ -0,0 +1,132 @@ +#include +#include +#include +#include +#include + +void check_result_int(const char *expected, int real) { + int exp = strtol(expected, NULL, 10); + + if (exp != real) { + fprintf(stderr, "Expected %d but got %d\n", exp, real); + exit(1); + } +} + +semanage_handle_t *test_handle_create() { + semanage_handle_t *sh = NULL; + + sh = semanage_handle_create(); + printf("semanage_handle_create(): %p\n", (void *) sh); + + if (sh == NULL) { + perror("semanage_handle_create"); + exit(1); + } + + return sh; +} + +int test_connect(semanage_handle_t *sh) { + int result = semanage_connect(sh); + printf("semanage_connect(%p): %d\n", (void *) sh, result); + + if (result != 0) { + perror("semanage_connect"); + exit(1); + } + + return result; +} + +int test_disconnect(semanage_handle_t *sh) { + int result = semanage_disconnect(sh); + printf("semanage_disconnect(%p): %d\n", (void *) sh, result); + + if (result != 0) { + perror("semanage_disconnect"); + exit(1); + } + + return result; +} + +int test_begin_transaction(semanage_handle_t *sh) { + int result = semanage_begin_transaction(sh); + printf("semanage_begin_transaction(%p): %d\n", (void *) sh, result); + + if (result != 0) { + perror("semanage_begin_transaction"); + exit(1); + } + + return result; +} + +int test_commit(semanage_handle_t *sh) { + int result = semanage_commit(sh); + printf("semanage_commit(%p): %d\n", (void *) sh, result); + + if (result != 0) { + perror("semanage_commit"); + exit(1); + } + + return result; +} + +#define STATE_INIT 1 +#define STATE_HANDLE 2 +#define STATE_CONN 3 +#define STATE_TRANS 4 + +int get_state(const char *state_str) { + if (strcmp(state_str, "init") == 0) + return STATE_INIT; + if (strcmp(state_str, "handle") == 0) + return STATE_HANDLE; + if (strcmp(state_str, "conn") == 0) + return STATE_CONN; + if (strcmp(state_str, "trans") == 0) + return STATE_TRANS; + + return 0; +} + +semanage_handle_t * get_handle(const char *state_str) { + int state; + semanage_handle_t *sh = NULL; + + state = get_state(state_str); + + if (state >= STATE_INIT) + sh = NULL; + + if (state >= STATE_HANDLE) + sh = test_handle_create(); + + if (state >= STATE_CONN) + test_connect(sh); + + if (state >= STATE_TRANS) + test_begin_transaction(sh); + + return sh; +} + +void destroy_handle(semanage_handle_t *sh, const char *state_str) { + int state; + + state = get_state(state_str); + + if (state >= STATE_TRANS) + test_commit(sh); + + if (state >= STATE_CONN) + test_disconnect(sh); + + if (state >= STATE_HANDLE) { + semanage_handle_destroy(sh); + printf("semanage_handle_destroy(%p)\n", (void *) sh); + } +} diff --git a/libsemanage/semanage-handle-functions/main.fmf b/libsemanage/semanage-handle-functions/main.fmf new file mode 100644 index 0000000..cb3e1d7 --- /dev/null +++ b/libsemanage/semanage-handle-functions/main.fmf @@ -0,0 +1,34 @@ +summary: Test functions from handle.h +description: '' +contact: Milos Malik +component: + - libsemanage +test: ./runtest.sh +framework: beakerlib +recommend: + - libsemanage + - libsemanage-devel + - glibc + - gcc +duration: 5m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - Tier1 + - Tier1se + - f31friendly + - f32friendly + - rhel8-buildroot + - rhel9-buildroot +tier: '1' +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1642305 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1781097 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5 + continue: false +extra-nitrate: TC#0546220 +extra-summary: /CoreOS/libsemanage/Sanity/semanage-handle-functions +extra-task: /CoreOS/libsemanage/Sanity/semanage-handle-functions diff --git a/libsemanage/semanage-handle-functions/plan.txt b/libsemanage/semanage-handle-functions/plan.txt new file mode 100644 index 0000000..521a914 --- /dev/null +++ b/libsemanage/semanage-handle-functions/plan.txt @@ -0,0 +1,29 @@ + init handle conn trans +semanage_set_root x ok ok ok - +semanage_root x ok ok ok - +semanage_handle_create x ok - - - +semanage_set_rebuild fail ok ok - +semanage_set_reload fail ok ok - +semanage_get_hll_compiler_path fail ? ? - +semanage_set_create_store fail ok ok - should be called after connect +semanage_get_disable_dontaudit fail ? ? - +semanage_set_disable_dontaudit fail ? ? - +semanage_get_preserve_tunables fail ? ? - +semanage_set_preserve_tunables fail ? ? - +semanage_get_ignore_module_cache fail ? ? - +semanage_set_ignore_module_cache fail ? ? - +semanage_set_check_contexts fail ok ok - +semanage_get_default_priority fail ok ok - +semanage_set_default_priority fail ok ok - +semanage_is_connected x fail ok ok - +semanage_select_store fail ok ok - should be called before connect +semanage_set_store_root fail ok ok - +semanage_is_managed x fail ok fail - +semanage_mls_enabled x fail ? ok - +semanage_connect x fail ok ? - +semanage_access_check x fail ok ? - +semanage_disconnect x fail fail ok - ok when disconnected twice +semanage_handle_destroy x fail ok ok - +semanage_begin_transaction x fail fail ok ok ok when begin twice +semanage_commit x fail fail fail ok +semanage_reload_policy fail ? ? ? diff --git a/libsemanage/semanage-handle-functions/runtest.sh b/libsemanage/semanage-handle-functions/runtest.sh new file mode 100755 index 0000000..b7fd6f0 --- /dev/null +++ b/libsemanage/semanage-handle-functions/runtest.sh @@ -0,0 +1,121 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/libsemanage/Sanity/semanage-handle-functions +# Description: Test functions from handle.h +# Author: Jan Zarsky +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2017 Red Hat, Inc. +# +# This program is free software: you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation, either version 2 of +# the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see http://www.gnu.org/licenses/. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="libsemanage" + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-devel + rlAssertRpm "glibc" + rlAssertRpm "gcc" + + if rlIsRHEL ">=7" || rlIsFedora; then + rlRun -l "gcc test_root.c -o test_root -lsemanage -Wall -Wextra -std=c99" + fi + + rlRun -l "gcc test_handle_create.c -o test_handle_create -lsemanage -Wall -Wextra -Wno-unused-parameter -std=c99" + rlRun -l "gcc test_access_check.c -o test_access_check -lsemanage -Wall -Wextra -std=c99" + rlRun -l "gcc test_is_managed.c -o test_is_managed -lsemanage -Wall -Wextra -std=c99" + rlRun -l "gcc test_connect.c -o test_connect -lsemanage -Wall -Wextra -std=c99" + rlRun -l "gcc test_is_connected.c -o test_is_connected -lsemanage -Wall -Wextra -std=c99" + rlRun -l "gcc test_mls_enabled.c -o test_mls_enabled -lsemanage -Wall -Wextra -std=c99" + rlRun -l "gcc test_transaction.c -o test_transaction -lsemanage -Wall -Wextra -std=c99" + + ERR_FAIL=1 + ERR_ABORT=134 + rlPhaseEnd + + if rlIsRHEL ">=7" || rlIsFedora; then + rlPhaseStartTest "semanage_root, semanage_test_root" + rlRun "./test_root init" + rlRun "./test_root handle" + rlRun "./test_root conn" + rlRun "./test_root init /somepath" + rlRun "./test_root handle /somepath" + rlRun "./test_root conn /somepath" + rlPhaseEnd + fi + + rlPhaseStartTest "semanage_handle_create, semanage_handle_destroy" + rlRun "./test_handle_create init" + rlPhaseEnd + + rlPhaseStartTest "semanage_access_check" + rlRun "./test_access_check init" $ERR_ABORT + rlRun "./test_access_check handle 2" + rlRun "./test_access_check conn 2" + rlPhaseEnd + + rlPhaseStartTest "semanage_is_managed" + rlRun "./test_is_managed init" $ERR_ABORT + rlRun "./test_is_managed handle 1" + rlRun "./test_is_managed conn" $ERR_FAIL + rlPhaseEnd + + rlPhaseStartTest "semanage_connect, semanage_disconnect" + rlRun "./test_connect init" $ERR_ABORT + rlRun "./test_connect init reversed" $ERR_ABORT + rlRun "./test_connect handle" + rlRun "./test_connect handle twice" + rlRun "./test_connect handle reversed" $ERR_ABORT + # why does it work?? + rlRun "./test_connect conn" + rlPhaseEnd + + rlPhaseStartTest "semanage_is_connected" + rlRun "./test_is_connected init" $ERR_ABORT + rlRun "./test_is_connected handle 0" + rlRun "./test_is_connected conn 1" + rlPhaseEnd + + rlPhaseStartTest "semanage_mls_enabled" + rlRun "./test_mls_enabled init" $ERR_ABORT + rlRun "./test_mls_enabled handle" $ERR_ABORT + rlRun "./test_mls_enabled conn 1" + rlPhaseEnd + + rlPhaseStartTest "semanage_begin_transaction, semanage_commit" + rlRun "./test_transaction init" $ERR_ABORT + rlRun "./test_transaction init reversed" $ERR_ABORT + rlRun "./test_transaction handle" $ERR_ABORT + rlRun "./test_transaction handle reversed" $ERR_ABORT + rlRun "./test_transaction conn" + rlRun "./test_transaction conn twice" + rlRun "./test_transaction conn reversed" $ERR_FAIL + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "rm -f output test_root test_handle_create test_access_check \ + test_is_managed test_connect test_is_connected \ + test_mls_enabled test_transaction" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/libsemanage/semanage-handle-functions/test_access_check.c b/libsemanage/semanage-handle-functions/test_access_check.c new file mode 100644 index 0000000..8eb2530 --- /dev/null +++ b/libsemanage/semanage-handle-functions/test_access_check.c @@ -0,0 +1,32 @@ +#include +#include +#include +#include +#include + +#include "functions.c" + +int main (int argc, char **argv) { + semanage_handle_t *sh; + + if (argc < 2) + exit(1); + + sh = get_handle(argv[1]); + + int result = semanage_access_check(sh); + printf("semanage_access_check(%p): %d\n", (void *) sh, result); + + if (result < 0 || (result != 0 && result != SEMANAGE_CAN_READ + && result != SEMANAGE_CAN_WRITE)) { + perror("semanage_access_check"); + exit(1); + } + + if (argc >= 3) + check_result_int(argv[2], result); + + destroy_handle(sh, argv[1]); + + exit(0); +} diff --git a/libsemanage/semanage-handle-functions/test_connect.c b/libsemanage/semanage-handle-functions/test_connect.c new file mode 100644 index 0000000..df403e0 --- /dev/null +++ b/libsemanage/semanage-handle-functions/test_connect.c @@ -0,0 +1,33 @@ +#include +#include +#include +#include +#include + +#include "functions.c" + +int main (int argc, char **argv) { + semanage_handle_t *sh; + + if (argc < 2) + exit(1); + + sh = get_handle(argv[1]); + + if (argc >= 3 && strcmp(argv[2], "reversed") == 0) { + test_disconnect(sh); + test_connect(sh); + } + else { + test_connect(sh); + test_disconnect(sh); + } + + if (argc >= 3 && strcmp(argv[2], "twice") == 0) { + test_disconnect(sh); + } + + destroy_handle(sh, argv[1]); + + exit(0); +} diff --git a/libsemanage/semanage-handle-functions/test_handle_create.c b/libsemanage/semanage-handle-functions/test_handle_create.c new file mode 100644 index 0000000..65d164e --- /dev/null +++ b/libsemanage/semanage-handle-functions/test_handle_create.c @@ -0,0 +1,15 @@ +#include +#include +#include +#include +#include + +#include "functions.c" + +int main (int argc, char **argv) { + semanage_handle_t *sh = test_handle_create(); + + semanage_handle_destroy(sh); + + exit(0); +} diff --git a/libsemanage/semanage-handle-functions/test_is_connected.c b/libsemanage/semanage-handle-functions/test_is_connected.c new file mode 100644 index 0000000..d428e48 --- /dev/null +++ b/libsemanage/semanage-handle-functions/test_is_connected.c @@ -0,0 +1,32 @@ +#include +#include +#include +#include +#include + +#include "functions.c" + +int main (int argc, char **argv) { + semanage_handle_t *sh; + int result; + + if (argc < 2) + exit(1); + + sh = get_handle(argv[1]); + + result = semanage_is_connected(sh); + printf("semanage_is_connected(%p): %d\n", (void *) sh, result); + + if (result != 0 && result != 1) { + perror("semanage_is_connected"); + exit(1); + } + + if (argc >= 3) + check_result_int(argv[2], result); + + destroy_handle(sh, argv[1]); + + exit(0); +} diff --git a/libsemanage/semanage-handle-functions/test_is_managed.c b/libsemanage/semanage-handle-functions/test_is_managed.c new file mode 100644 index 0000000..4d11cb0 --- /dev/null +++ b/libsemanage/semanage-handle-functions/test_is_managed.c @@ -0,0 +1,32 @@ +#include +#include +#include +#include +#include + +#include "functions.c" + +int main (int argc, char **argv) { + semanage_handle_t *sh; + int result; + + if (argc < 2) + exit(1); + + sh = get_handle(argv[1]); + + result = semanage_is_managed(sh); + printf("semanage_is_managed(%p): %d\n", (void *) sh, result); + + if (result != 0 && result != 1) { + perror("semanage_is_managed"); + exit(1); + } + + if (argc >= 3) + check_result_int(argv[2], result); + + destroy_handle(sh, argv[1]); + + exit(0); +} diff --git a/libsemanage/semanage-handle-functions/test_mls_enabled.c b/libsemanage/semanage-handle-functions/test_mls_enabled.c new file mode 100644 index 0000000..7e943f0 --- /dev/null +++ b/libsemanage/semanage-handle-functions/test_mls_enabled.c @@ -0,0 +1,32 @@ +#include +#include +#include +#include +#include + +#include "functions.c" + +int main (int argc, char **argv) { + semanage_handle_t *sh; + int result; + + if (argc < 2) + exit(1); + + sh = get_handle(argv[1]); + + result = semanage_mls_enabled(sh); + printf("semanage_mls_enabled(%p): %d\n", (void *) sh, result); + + if (result != 0 && result != 1) { + perror("semanage_mls_enabled"); + exit(1); + } + + if (argc >= 4) + check_result_int(argv[3], result); + + destroy_handle(sh, argv[1]); + + exit(0); +} diff --git a/libsemanage/semanage-handle-functions/test_root.c b/libsemanage/semanage-handle-functions/test_root.c new file mode 100644 index 0000000..5786348 --- /dev/null +++ b/libsemanage/semanage-handle-functions/test_root.c @@ -0,0 +1,53 @@ +#include +#include +#include +#include +#include + +#include "functions.c" + +int main (int argc, char **argv) { + semanage_handle_t *sh; + const char *root; + int result; + + if (argc < 2) + exit(1); + + sh = get_handle(argv[1]); + + root = semanage_root(); + printf("semanage_root(): %s\n", root); + + if (root == NULL) { + perror("semanage_root"); + exit(1); + } + + if (argc >= 3) { + result = semanage_set_root(argv[2]); + printf("semanage_set_root(\"%s\"): %d\n", argv[2], result); + + if (root == NULL) { + perror("semanage_set_root"); + exit(1); + } + + root = semanage_root(); + printf("semanage_root(): %s\n", root); + + if (result != 0) { + perror("semanage_root"); + exit(1); + } + + if (strcmp(root, argv[2]) != 0) { + fprintf(stderr, "Expected \"%s\" but got \"%s\"\n", argv[2], root); + exit(1); + } + } + + destroy_handle(sh, argv[1]); + + exit(0); +} diff --git a/libsemanage/semanage-handle-functions/test_transaction.c b/libsemanage/semanage-handle-functions/test_transaction.c new file mode 100644 index 0000000..f1b0e10 --- /dev/null +++ b/libsemanage/semanage-handle-functions/test_transaction.c @@ -0,0 +1,34 @@ +#include +#include +#include +#include +#include + +#include "functions.c" + +int main (int argc, char **argv) { + semanage_handle_t *sh; + + if (argc < 2) + exit(1); + + sh = get_handle(argv[1]); + + if (argc >= 3 && strcmp(argv[2], "reversed") == 0) { + test_commit(sh); + test_begin_transaction(sh); + } + else if (argc >= 3 && strcmp(argv[2], "twice") == 0) { + test_begin_transaction(sh); + test_begin_transaction(sh); + test_commit(sh); + } + else { + test_begin_transaction(sh); + test_commit(sh); + } + + destroy_handle(sh, argv[1]); + + exit(0); +} diff --git a/libsemanage/semanage-seuser-functions/Makefile b/libsemanage/semanage-seuser-functions/Makefile new file mode 100644 index 0000000..d7202f4 --- /dev/null +++ b/libsemanage/semanage-seuser-functions/Makefile @@ -0,0 +1,63 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/libsemanage/Sanity/semanage-seuser-functions +# Description: Test semanage_seuser_* functions +# Author: Jan Zarsky +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2017 Red Hat, Inc. +# +# This program is free software: you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation, either version 2 of +# the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see http://www.gnu.org/licenses/. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/libsemanage/Sanity/semanage-seuser-functions +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE functions.c test_*.c + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + test -x runtest.sh || chmod a+x runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Jan Zarsky " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: Test semanage_seuser_* functions" >> $(METADATA) + @echo "Type: Sanity" >> $(METADATA) + @echo "TestTime: 5m" >> $(METADATA) + @echo "RunFor: libsemanage" >> $(METADATA) + @echo "Requires: libsemanage libsemanage-devel glibc gcc" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2+" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHELClient5 -RHELServer5" >> $(METADATA) + + rhts-lint $(METADATA) diff --git a/libsemanage/semanage-seuser-functions/PURPOSE b/libsemanage/semanage-seuser-functions/PURPOSE new file mode 100644 index 0000000..6b5201a --- /dev/null +++ b/libsemanage/semanage-seuser-functions/PURPOSE @@ -0,0 +1,3 @@ +PURPOSE of /CoreOS/libsemanage/Sanity/semanage-seuser-functions +Description: Test semanage_seuser_* functions +Author: Jan Zarsky diff --git a/libsemanage/semanage-seuser-functions/functions.c b/libsemanage/semanage-seuser-functions/functions.c new file mode 100644 index 0000000..b4152ed --- /dev/null +++ b/libsemanage/semanage-seuser-functions/functions.c @@ -0,0 +1,263 @@ +#include +#include +#include +#include +#include + +void check_result_int(const char *expected, int real) { + int exp = strtol(expected, NULL, 10); + + if (exp != real) { + fprintf(stderr, "Expected %d but got %d\n", exp, real); + exit(1); + } +} + +semanage_handle_t *test_handle_create() { + semanage_handle_t *sh = NULL; + + sh = semanage_handle_create(); + printf("semanage_handle_create(): %p\n", (void *) sh); + + if (sh == NULL) { + perror("semanage_handle_create"); + exit(2); + } + + return sh; +} + +int test_connect(semanage_handle_t *sh) { + int result = semanage_connect(sh); + printf("semanage_connect(%p): %d\n", (void *) sh, result); + + if (result != 0) { + perror("semanage_connect"); + exit(2); + } + + return result; +} + +int test_disconnect(semanage_handle_t *sh) { + int result = semanage_disconnect(sh); + printf("semanage_disconnect(%p): %d\n", (void *) sh, result); + + if (result != 0) { + perror("semanage_disconnect"); + exit(2); + } + + return result; +} + +int test_begin_transaction(semanage_handle_t *sh) { + int result = semanage_begin_transaction(sh); + printf("semanage_begin_transaction(%p): %d\n", (void *) sh, result); + + if (result != 0) { + perror("semanage_begin_transaction"); + exit(2); + } + + return result; +} + +int test_commit(semanage_handle_t *sh) { + int result = semanage_commit(sh); + printf("semanage_commit(%p): %d\n", (void *) sh, result); + + if (result < 0) { + perror("semanage_commit"); + exit(2); + } + + return result; +} + +semanage_seuser_key_t *test_get_key(semanage_handle_t *sh, const char *name) { + semanage_seuser_key_t *key; + int result = semanage_seuser_key_create(sh, name, &key); + printf("semanage_seuser_key_create(%p, %s, %p): %d\n", + (void *) sh, name, (void *) &key, result); + + if (key == NULL || result < 0) { + perror("semanage_seuser_key_create"); + exit(2); + } + + return key; +} + +semanage_seuser_t *test_get_seuser_nth(semanage_handle_t *sh, unsigned int index) { + int result; + semanage_seuser_t **records; + unsigned int count; + + result = semanage_seuser_list(sh, &records, &count); + printf("semanage_seuser_list(%p, %p, %p): %d\n", + (void *) sh, (void *) &records, (void *) &count, result); + + if (result < 0) { + perror("semanage_seuser_list"); + exit(2); + } + + if (count < index + 1) + exit(2); + + return records[index]; +} + +semanage_seuser_t *test_get_seuser_new(semanage_handle_t *sh) { + int result; + semanage_seuser_t *seuser; + + result = semanage_seuser_create(sh, &seuser); + printf("semanage_seuser_create(%p, %p): %d\n", + (void *) sh, (void *) seuser, result); + + if (result < 0) { + perror("semanage_seuser_create"); + exit(2); + } + + return seuser; +} + +semanage_seuser_t *test_get_seuser(semanage_handle_t *sh, const char *param) { + if (strcmp(param, "new") == 0) + return test_get_seuser_new(sh); + + if (strcmp(param, "first") == 0) + return test_get_seuser_nth(sh, 0); + + if (strcmp(param, "second") == 0) + return test_get_seuser_nth(sh, 1); + + fprintf(stderr, "Unknown seuser \"%s\" specified\n", param); + exit(2); +} + +void test_add_local_seuser(semanage_handle_t *sh, semanage_seuser_t *seuser) { + int result; + semanage_seuser_key_t *key; + + result = semanage_seuser_key_extract(sh, seuser, &key); + printf("semanage_seuser_key_extract(%p, %p, %p): %d\n", + (void *) sh, (void *) seuser, (void *) &key, result); + + if (result < 0) { + perror("semanage_seuser_key_extract"); + exit(2); + } + + result = semanage_seuser_modify_local(sh, key, seuser); + printf("semanage_seuser_modify_local(%p, %p, %p): %d\n", + (void *) seuser, (void *) key, (void *) seuser, result); + + if (result < 0) { + perror("semanage_seuser_modify_local"); + exit(2); + } +} + +void test_del_local_seuser(semanage_handle_t *sh, semanage_seuser_t *seuser) { + int result; + semanage_seuser_key_t *key; + + result = semanage_seuser_key_extract(sh, seuser, &key); + printf("semanage_seuser_key_extract(%p, %p, %p): %d\n", + (void *) sh, (void *) seuser, (void *) &key, result); + + if (result < 0) { + perror("semanage_seuser_key_extract"); + exit(2); + } + + result = semanage_seuser_del_local(sh, key); + printf("semanage_seuser_del_local(%p, %p): %d\n", + (void *) seuser, (void *) key, result); + + if (result < 0) { + perror("semanage_seuser_del_local"); + exit(2); + } +} + +#define STATE_INIT 1 +#define STATE_HANDLE 2 +#define STATE_CONN 3 +#define STATE_TRANS 4 + +int get_state(const char *state_str) { + if (strcmp(state_str, "init") == 0) + return STATE_INIT; + if (strcmp(state_str, "handle") == 0) + return STATE_HANDLE; + if (strcmp(state_str, "conn") == 0) + return STATE_CONN; + if (strcmp(state_str, "trans") == 0) + return STATE_TRANS; + + return 0; +} + +semanage_handle_t * get_handle(const char *state_str) { + int state; + semanage_handle_t *sh = NULL; + + state = get_state(state_str); + + if (state >= STATE_INIT) + sh = NULL; + + if (state >= STATE_HANDLE) + sh = test_handle_create(); + + if (state >= STATE_CONN) + test_connect(sh); + + if (state >= STATE_TRANS) + test_begin_transaction(sh); + + return sh; +} + +void destroy_handle(semanage_handle_t *sh, const char *state_str) { + int state; + + state = get_state(state_str); + + if (state >= STATE_TRANS) + test_commit(sh); + + if (state >= STATE_CONN) + test_disconnect(sh); + + if (state >= STATE_HANDLE) { + semanage_handle_destroy(sh); + printf("semanage_handle_destroy(%p)\n", (void *) sh); + } +} + +int strcmp_null(const char *str1, const char *str2) { + if (str1 == NULL && str2 == NULL) + return 0; + + if (str1 == NULL) { + if (strcmp(str2, "NULL") == 0) + return 0; + else + return -1; + } + + if (str2 == NULL) { + if (strcmp(str1, "NULL") == 0) + return 0; + else + return 1; + } + + return strcmp(str1, str2); +} diff --git a/libsemanage/semanage-seuser-functions/main.fmf b/libsemanage/semanage-seuser-functions/main.fmf new file mode 100644 index 0000000..5d42be0 --- /dev/null +++ b/libsemanage/semanage-seuser-functions/main.fmf @@ -0,0 +1,28 @@ +summary: Test semanage_seuser_* functions +description: '' +contact: Milos Malik +component: + - libsemanage +test: ./runtest.sh +framework: beakerlib +recommend: + - libsemanage + - libsemanage-devel + - glibc + - gcc +duration: 5m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - f32friendly + - f33friendly + - rhel8-buildroot + - targeted +adjust: + - enabled: false + when: distro == rhel-4, rhel-5 + continue: false +extra-nitrate: TC#0546750 +extra-summary: /CoreOS/libsemanage/Sanity/semanage-seuser-functions +extra-task: /CoreOS/libsemanage/Sanity/semanage-seuser-functions diff --git a/libsemanage/semanage-seuser-functions/runtest.sh b/libsemanage/semanage-seuser-functions/runtest.sh new file mode 100755 index 0000000..1b87c8e --- /dev/null +++ b/libsemanage/semanage-seuser-functions/runtest.sh @@ -0,0 +1,257 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/libsemanage/Sanity/semanage-seuser-functions +# Description: Test semanage_seuser_* functions +# Author: Jan Zarsky +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2017 Red Hat, Inc. +# +# This program is free software: you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation, either version 2 of +# the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see http://www.gnu.org/licenses/. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="libsemanage" + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-devel + rlAssertRpm "glibc" + rlAssertRpm "gcc" + + for f in test_*.c ; do + out=$(echo -n $f | cut -d'.' -f1) + rlRun "gcc $f -o $out -lsemanage -Wall -Wextra -Werror -std=c99" + done + + POLICY_TYPE="$(grep -E '^SELINUXTYPE=' /etc/selinux/config | cut -d'=' -f2 | tr '[:upper:]' '[:lower:]' | tr -d ' ')" + + if rlIsFedora; then + SEUSERS_PATH="/var/lib/selinux/$POLICY_TYPE/active/seusers" + elif rlIsRHEL '<=7'; then + SEUSERS_PATH="/etc/selinux/$POLICY_TYPE/active/seusers" + if rlIsRHEL '<=6'; then + SEUSERS_PATH="/etc/selinux/$POLICY_TYPE/seusers" + fi + elif rlIsRHEL '>=8'; then + SEUSERS_PATH="/var/lib/selinux/$POLICY_TYPE/active/seusers" + fi + + rlRun "cat $SEUSERS_PATH" + + SEUSERS_COUNT="$(cat $SEUSERS_PATH | grep -vE '^#|^$' | wc -l)" + rlRun "[[ \"$SEUSERS_COUNT\" -gt 0 ]]" + + SEUSERS="$(cat $SEUSERS_PATH | grep -vE '^#|^$' | cut -d':' -f1 | tr '\n' ' ')" + rlRun "[[ -n \"$SEUSERS\" ]]" + + first_line="$(cat $SEUSERS_PATH | grep -vE '^#|^$' | head -n 1)" + SEUSER="$(echo -n $first_line | cut -d':' -f1)" + rlRun "[[ -n \"$SEUSER\" ]]" + SEUSER_SENAME="$(echo -n $first_line | cut -d':' -f2)" + rlRun "[[ -n \"$SEUSER_SENAME\" ]]" + SEUSER_MLSRANGE="$(echo -n $first_line | cut -d':' -f3-4)" + rlRun "[[ -n \"$SEUSER_MLSRANGE\" ]]" + + SEUSER_NONEXISTENT="nonuser" + SEUSER_DEFAULT="__default__" + + ERR_FAIL=1 + ERR_ABORT=134 + ERR_SEGFAULT=139 + + # note: each test_*.c program takes first argument which specifies setup + # before executing specified function + # init semanage handle == NULL + # handle semanage handle obtained via semanage_handle_create + # conn connected via semanage_connect + # trans inside transaction, via semanage_begin_transaction + # program returns 1 on error in function, 2 on error in setup + rlPhaseEnd + + rlPhaseStartTest "semanage_seuser_key_create, semanage_seuser_key_free" + # FIXME + # rlRun "./test_key_create init $SEUSER" $ERR_ABORT,$ERR_SEGFAULT + # rlRun "./test_key_create handle $SEUSER" $ERR_FAIL + rlRun "./test_key_create conn $SEUSER" + rlRun "./test_key_create trans $SEUSER" + rlPhaseEnd + + rlPhaseStartTest "semanage_seuser_key_extract" + # FIXME + #rlRun "./test_key_extract conn new" + rlRun "./test_key_extract conn first" + # FIXME + #rlRun "./test_key_extract trans new" + rlRun "./test_key_extract trans first" + rlPhaseEnd + + rlPhaseStartTest "semanage_seuser_compare" + rlRun "./test_compare conn $SEUSER same" + rlRun "./test_compare conn $SEUSER_NONEXISTENT different" + rlRun "./test_compare trans $SEUSER same" + rlRun "./test_compare trans $SEUSER_NONEXISTENT different" + rlPhaseEnd + + rlPhaseStartTest "semanage_seuser_compare2" + rlRun "./test_compare2 conn NULL 0" $ERR_ABORT,$ERR_SEGFAULT + rlRun "./test_compare2 conn 0 NULL" $ERR_ABORT,$ERR_SEGFAULT + rlRun "./test_compare2 conn NULL NULL" $ERR_ABORT,$ERR_SEGFAULT + rlRun "./test_compare2 conn 0 0" + rlRun "./test_compare2 conn 0 1" + rlRun "./test_compare2 trans NULL 0" $ERR_ABORT,$ERR_SEGFAULT + rlRun "./test_compare2 trans 0 NULL" $ERR_ABORT,$ERR_SEGFAULT + rlRun "./test_compare2 trans NULL NULL" $ERR_ABORT,$ERR_SEGFAULT + rlRun "./test_compare2 trans 0 0" + rlRun "./test_compare2 trans 0 1" + rlPhaseEnd + + rlPhaseStartTest "semanage_seuser_count" + rlRun "./test_count init" $ERR_ABORT,$ERR_SEGFAULT + rlRun "./test_count handle" $ERR_FAIL + rlRun "./test_count conn $SEUSERS_COUNT" + rlRun "./test_count trans $SEUSERS_COUNT" + rlPhaseEnd + + rlPhaseStartTest "semanage_seuser_list" + rlRun "./test_list init" $ERR_ABORT,$ERR_SEGFAULT + rlRun "./test_list handle" $ERR_FAIL + rlRun "./test_list conn $SEUSERS_COUNT $SEUSERS" + rlRun "./test_list trans $SEUSERS_COUNT $SEUSERS" + rlPhaseEnd + + rlPhaseStartTest "semanage_seuser_iterate" + rlRun "./test_iterate init" $ERR_ABORT,$ERR_SEGFAULT + rlRun "./test_iterate handle" $ERR_FAIL + rlRun "./test_iterate conn $SEUSERS" + rlRun "./test_iterate trans $SEUSERS" + rlPhaseEnd + + rlPhaseStartTest "semanage_seuser_exists" + rlRun "./test_exists conn $SEUSER_NONEXISTENT 0" + rlRun "./test_exists conn $SEUSER_DEFAULT 1" + rlRun "./test_exists conn $USER 1" + rlRun "./test_exists trans $SEUSER_NONEXISTENT 0" + rlRun "./test_exists trans $SEUSER_DEFAULT 1" + rlRun "./test_exists trans $SEUSER 1" + rlPhaseEnd + + rlPhaseStartTest "semanage_seuser_query" + rlRun "./test_query conn $SEUSER_NONEXISTENT" $ERR_FAIL + rlRun "./test_query conn $SEUSER_DEFAULT" + rlRun "./test_query conn $SEUSER" + rlRun "./test_query trans $SEUSER_NONEXISTENT" $ERR_FAIL + rlRun "./test_query trans $SEUSER_DEFAULT" + rlRun "./test_query trans $SEUSER" + rlPhaseEnd + + rlPhaseStartTest "semanage_seuser_get_name" + rlRun "./test_get_name conn new NULL" + rlRun "./test_get_name conn first $SEUSER" + rlRun "./test_get_name trans new NULL" + rlRun "./test_get_name trans first $SEUSER" + rlPhaseEnd + + rlPhaseStartTest "semanage_seuser_set_name" + name="someuser" + rlRun "./test_set_name conn $name" + rlRun "./test_set_name trans $name" + rlPhaseEnd + + rlPhaseStartTest "semanage_seuser_get_sename" + rlRun "./test_get_sename conn new NULL" + rlRun "./test_get_sename conn first $SEUSER_SENAME" + rlRun "./test_get_sename trans new NULL" + rlRun "./test_get_sename trans first $SEUSER_SENAME" + rlPhaseEnd + + rlPhaseStartTest "semanage_seuser_set_sename" + sename="someuser_u" + rlRun "./test_set_sename conn $sename" + rlRun "./test_set_sename trans $sename" + rlPhaseEnd + + rlPhaseStartTest "semanage_seuser_get_mlsrange" + rlRun "./test_get_mlsrange conn new NULL" + rlRun "./test_get_mlsrange conn first $SEUSER_MLSRANGE" + rlRun "./test_get_mlsrange trans new NULL" + rlRun "./test_get_mlsrange trans first $SEUSER_MLSRANGE" + rlPhaseEnd + + rlPhaseStartTest "semanage_seuser_set_mlsrange" + mlsrange="c0-s1:c0.c42" + rlRun "./test_set_mlsrange conn $mlsrange" + rlRun "./test_set_mlsrange trans $mlsrange" + rlPhaseEnd + + rlPhaseStartTest "semanage_seuser_clone" + # FIXME + #rlRun "./test_clone conn new" + rlRun "./test_clone conn first" + # FIXME + #rlRun "./test_clone trans new" + rlRun "./test_clone trans first" + rlPhaseEnd + + rlPhaseStartTest "semanage_seuser_create" + # FIXME + #rlRun "./test_create init" $ERR_ABORT,$ERR_SEGFAULT + #rlRun "./test_create handle" $ERR_ABORT,$ERR_SEGFAULT + rlRun "./test_create conn" + rlRun "./test_create trans" + rlPhaseEnd + + rlPhaseStartTest "semanage_seuser_modify_local" + # function requires transaction + #rlRun "./test_modify_local conn new" $ERR_FAIL + #rlRun "./test_modify_local conn first" $ERR_FAIL + #rlRun "./test_modify_local trans new" $ERR_FAIL + rlRun "./test_modify_local trans first" + rlPhaseEnd + + rlPhaseStartTest "semanage_seuser_del_local" + # adding local seuser requires transaction + # FIXME + #rlRun "./test_del_local trans first new" + #rlRun "./test_del_local trans first second" + rlRun "./test_del_local trans first first" + rlPhaseEnd + + rlPhaseStartTest "semanage_seuser_exists_local" + # adding local seuser requires transaction + rlRun "./test_exists_local trans first first 1" + rlRun "./test_exists_local trans first second 0" + rlPhaseEnd + + rlPhaseStartTest "semanage_seuser_count_local" + # adding local seuser requires transaction + # FIXME + #rlRun "./test_count_local trans 0" + rlRun "./test_count_local trans 1" + rlRun "./test_count_local trans 2" + rlPhaseEnd + + rlPhaseStartCleanup + testfiles="$(ls -1 test_* | grep -v '\.c' | tr '\n' ' ')" + rlRun "rm -f $testfiles" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/libsemanage/semanage-seuser-functions/test_clone.c b/libsemanage/semanage-seuser-functions/test_clone.c new file mode 100644 index 0000000..8c2554f --- /dev/null +++ b/libsemanage/semanage-seuser-functions/test_clone.c @@ -0,0 +1,60 @@ +#include +#include +#include +#include +#include + +#include "functions.c" + +int main (int argc, char **argv) { + semanage_handle_t *sh; + semanage_seuser_t *seuser; + semanage_seuser_t *seuser_clone; + int result; + const char *str; + const char *str_clone; + + if (argc < 3) + exit(2); + + sh = get_handle(argv[1]); + + seuser = test_get_seuser(sh, argv[2]); + + result = semanage_seuser_clone(sh, seuser, &seuser_clone); + printf("semanage_seuser_clone(%p, %p): %d\n", + (void *) seuser, (void *) seuser_clone, result); + + if (result < 0) { + perror("semanage_seuser_clone"); + exit(1); + } + + str = semanage_seuser_get_name(seuser); + str_clone = semanage_seuser_get_name(seuser_clone); + + if (strcmp(str, str_clone) != 0) { + fprintf(stderr, "Different in get_name\n"); + exit(1); + } + + str = semanage_seuser_get_sename(seuser); + str_clone = semanage_seuser_get_sename(seuser_clone); + + if (strcmp(str, str_clone) != 0) { + fprintf(stderr, "Different in get_sename\n"); + exit(1); + } + + str = semanage_seuser_get_mlsrange(seuser); + str_clone = semanage_seuser_get_mlsrange(seuser_clone); + + if (strcmp(str, str_clone) != 0) { + fprintf(stderr, "Different in get_mlsrange\n"); + exit(1); + } + + destroy_handle(sh, argv[1]); + + exit(0); +} diff --git a/libsemanage/semanage-seuser-functions/test_compare.c b/libsemanage/semanage-seuser-functions/test_compare.c new file mode 100644 index 0000000..5615463 --- /dev/null +++ b/libsemanage/semanage-seuser-functions/test_compare.c @@ -0,0 +1,44 @@ +#include +#include +#include +#include +#include + +#include "functions.c" + +int main (int argc, char **argv) { + semanage_handle_t *sh; + semanage_seuser_t *seuser; + semanage_seuser_key_t *key; + int result; + + if (argc < 3) + exit(2); + + sh = get_handle(argv[1]); + + seuser = test_get_seuser(sh, "first"); + + key = test_get_key(sh, argv[2]); + + result = semanage_seuser_compare(seuser, key); + printf("semanage_seuser_compare(%p, %p): %d\n", + (void *) seuser, (void *) key, result); + + if (argc >= 4) { + if (strcmp(argv[3], "same") == 0 && result != 0) { + fprintf(stderr, "Expected same but got different\n"); + exit(1); + } + else if (strcmp(argv[3], "different") == 0 && result == 0) { + fprintf(stderr, "Expected different but got same\n"); + exit(1); + } + } + + semanage_seuser_key_free(key); + + destroy_handle(sh, argv[1]); + + exit(0); +} diff --git a/libsemanage/semanage-seuser-functions/test_compare2.c b/libsemanage/semanage-seuser-functions/test_compare2.c new file mode 100644 index 0000000..afeec07 --- /dev/null +++ b/libsemanage/semanage-seuser-functions/test_compare2.c @@ -0,0 +1,54 @@ +#include +#include +#include +#include +#include + +#include "functions.c" + +int main (int argc, char **argv) { + semanage_handle_t *sh; + semanage_seuser_t *seuser; + semanage_seuser_t *seuser2; + int result; + int first = -1; + int second = -1; + + if (argc < 4) + exit(2); + + sh = get_handle(argv[1]); + + if (strcmp(argv[2], "NULL") == 0) { + seuser = NULL; + } + else { + first = strtol(argv[2], NULL, 10); + seuser = test_get_seuser_nth(sh, first); + } + + if (strcmp(argv[3], "NULL") == 0) { + seuser2 = NULL; + } + else { + second = strtol(argv[3], NULL, 10); + seuser2 = test_get_seuser_nth(sh, second); + } + + result = semanage_seuser_compare2(seuser, seuser2); + printf("semanage_seuser_compare(%p, %p): %d\n", + (void *) seuser, (void *) seuser2, result); + + if (first == second && result != 0) { + fprintf(stderr, "Expected same but got different\n"); + exit(1); + } + else if (first != second && result == 0) { + fprintf(stderr, "Expected different but got same\n"); + exit(1); + } + + destroy_handle(sh, argv[1]); + + exit(0); +} diff --git a/libsemanage/semanage-seuser-functions/test_count.c b/libsemanage/semanage-seuser-functions/test_count.c new file mode 100644 index 0000000..7fabe4b --- /dev/null +++ b/libsemanage/semanage-seuser-functions/test_count.c @@ -0,0 +1,34 @@ +#include +#include +#include +#include +#include + +#include "functions.c" + +int main (int argc, char **argv) { + semanage_handle_t *sh; + unsigned int response; + int result; + + if (argc < 2) + exit(2); + + sh = get_handle(argv[1]); + + result = semanage_seuser_count(sh, &response); + printf("semanage_seuser_count(%p, %p): %d, response: %u\n", + (void *) sh, (void *) &response, result, response); + + if (result < 0) { + perror("semanage_seuser_count"); + exit(1); + } + + if (argc >= 3) + check_result_int(argv[2], response); + + destroy_handle(sh, argv[1]); + + exit(0); +} diff --git a/libsemanage/semanage-seuser-functions/test_count_local.c b/libsemanage/semanage-seuser-functions/test_count_local.c new file mode 100644 index 0000000..f25ab6d --- /dev/null +++ b/libsemanage/semanage-seuser-functions/test_count_local.c @@ -0,0 +1,46 @@ +#include +#include +#include +#include +#include + +#include "functions.c" + +int main (int argc, char **argv) { + semanage_handle_t *sh; + semanage_seuser_t *seuser; + int result; + unsigned int response; + int num; + + if (argc < 2) + exit(2); + + sh = get_handle(argv[1]); + + num = strtol(argv[2], NULL, 10); + + for (int i = 0; i < num; i++) { + seuser = test_get_seuser_nth(sh, i); + + test_add_local_seuser(sh, seuser); + } + + result = semanage_seuser_count_local(sh, &response); + printf("semanage_seuser_count_local(%p, %p): %d, response: %d\n", + (void *) sh, (void *) &response, result, response); + + if (result < 0) { + perror("semanage_seuser_count_local"); + exit(1); + } + + if (argc >= 3) + check_result_int(argv[2], response); + + test_del_local_seuser(sh, seuser); + + destroy_handle(sh, argv[1]); + + exit(0); +} diff --git a/libsemanage/semanage-seuser-functions/test_create.c b/libsemanage/semanage-seuser-functions/test_create.c new file mode 100644 index 0000000..a5191a0 --- /dev/null +++ b/libsemanage/semanage-seuser-functions/test_create.c @@ -0,0 +1,53 @@ +#include +#include +#include +#include +#include + +#include "functions.c" + +int main (int argc, char **argv) { + semanage_handle_t *sh; + semanage_seuser_t *seuser; + int result; + const char *str; + + if (argc < 2) + exit(2); + + sh = get_handle(argv[1]); + + result = semanage_seuser_create(sh, &seuser); + printf("semanage_seuser_create(%p, %p): %d\n", + (void *) sh, (void *) seuser, result); + + if (result < 0) { + perror("semanage_seuser_create"); + exit(1); + } + + str = semanage_seuser_get_name(seuser); + + if (str != NULL) { + fprintf(stderr, "Expected name == NULL, got %s\n", str); + exit(1); + } + + str = semanage_seuser_get_sename(seuser); + + if (str != NULL) { + fprintf(stderr, "Expected sename == NULL, got %s\n", str); + exit(1); + } + + str = semanage_seuser_get_mlsrange(seuser); + + if (str != NULL) { + fprintf(stderr, "Expected mlsrange == NULL, got %s\n", str); + exit(1); + } + + destroy_handle(sh, argv[1]); + + exit(0); +} diff --git a/libsemanage/semanage-seuser-functions/test_del_local.c b/libsemanage/semanage-seuser-functions/test_del_local.c new file mode 100644 index 0000000..eced74a --- /dev/null +++ b/libsemanage/semanage-seuser-functions/test_del_local.c @@ -0,0 +1,64 @@ +#include +#include +#include +#include +#include + +#include "functions.c" + +int main (int argc, char **argv) { + semanage_handle_t *sh; + semanage_seuser_t *seuser; + semanage_seuser_t *seuser_del; + semanage_seuser_key_t *key; + semanage_seuser_t **records; + int result; + unsigned int count; + + if (argc < 4) + exit(2); + + sh = get_handle(argv[1]); + + seuser = test_get_seuser(sh, argv[2]); + + test_add_local_seuser(sh, seuser); + + seuser_del = test_get_seuser(sh, argv[3]); + + result = semanage_seuser_key_extract(sh, seuser_del, &key); + printf("semanage_seuser_key_extract(%p, %p, %p): %d\n", + (void *) sh, (void *) seuser_del, (void *) &key, result); + + if (result < 0) { + perror("semanage_seuser_key_extract"); + exit(2); + } + + result = semanage_seuser_del_local(sh, key); + printf("semanage_seuser_del_local(%p, %p): %d\n", + (void *) seuser, (void *) key, result); + + if (result < 0) { + perror("semanage_seuser_del_local"); + exit(1); + } + + result = semanage_seuser_list_local(sh, &records, &count); + printf("semanage_seuser_list_local(%p, %p, %p): %d\n", + (void *) sh, (void *) &records, (void *) &count, result); + + if (result < 0) { + perror("semanage_seuser_list_local"); + exit(2); + } + + if (count != 0) { + fprintf(stderr, "Number of local seusers is not 0!\n"); + exit(1); + } + + destroy_handle(sh, argv[1]); + + exit(0); +} diff --git a/libsemanage/semanage-seuser-functions/test_exists.c b/libsemanage/semanage-seuser-functions/test_exists.c new file mode 100644 index 0000000..c0af3b2 --- /dev/null +++ b/libsemanage/semanage-seuser-functions/test_exists.c @@ -0,0 +1,37 @@ +#include +#include +#include +#include +#include + +#include "functions.c" + +int main (int argc, char **argv) { + semanage_handle_t *sh; + semanage_seuser_key_t *key; + int result; + int response; + + if (argc < 3) + exit(2); + + sh = get_handle(argv[1]); + + key = test_get_key(sh, argv[2]); + + result = semanage_seuser_exists(sh, key, &response); + printf("semanage_seuser_exists(%p, %p, %p): %d, response: %d\n", + (void *) sh, (void *) key, (void *) &response, result, response); + + if (result < 0) { + perror("semanage_seuser_exists"); + exit(1); + } + + if (argc >= 4) + check_result_int(argv[3], response); + + destroy_handle(sh, argv[1]); + + exit(0); +} diff --git a/libsemanage/semanage-seuser-functions/test_exists_local.c b/libsemanage/semanage-seuser-functions/test_exists_local.c new file mode 100644 index 0000000..165d5b3 --- /dev/null +++ b/libsemanage/semanage-seuser-functions/test_exists_local.c @@ -0,0 +1,59 @@ +#include +#include +#include +#include +#include + +#include "functions.c" + +int main (int argc, char **argv) { + semanage_handle_t *sh; + semanage_seuser_t *seuser; + semanage_seuser_t *seuser_exists; + semanage_seuser_key_t *key; + int result; + int response; + int exp; + + if (argc < 4) + exit(2); + + sh = get_handle(argv[1]); + + seuser = test_get_seuser(sh, argv[2]); + seuser_exists = test_get_seuser(sh, argv[3]); + + test_add_local_seuser(sh, seuser); + + result = semanage_seuser_key_extract(sh, seuser_exists, &key); + printf("semanage_seuser_key_extract(%p, %p, %p): %d\n", + (void *) sh, (void *) seuser_exists, (void *) &key, result); + if (result < 0) { + perror("semanage_seuser_key_extract"); + exit(2); + } + + result = semanage_seuser_exists_local(sh, key, &response); + printf("semanage_seuser_exists_local(%p, %p, %p): %d\n", + (void *) sh, (void *) key, (void *) &response, result); + + if (result < 0) { + perror("semanage_seuser_exists_local"); + exit(1); + } + + if (argc >= 5) { + exp = strtol(argv[4], NULL, 10); + + if (response != exp) { + fprintf(stderr, "Expected %d but got %d\n", exp, response); + exit(1); + } + } + + test_del_local_seuser(sh, seuser); + + destroy_handle(sh, argv[1]); + + exit(0); +} diff --git a/libsemanage/semanage-seuser-functions/test_get_mlsrange.c b/libsemanage/semanage-seuser-functions/test_get_mlsrange.c new file mode 100644 index 0000000..97172dc --- /dev/null +++ b/libsemanage/semanage-seuser-functions/test_get_mlsrange.c @@ -0,0 +1,32 @@ +#include +#include +#include +#include +#include + +#include "functions.c" + +int main (int argc, char **argv) { + semanage_handle_t *sh; + semanage_seuser_t *seuser; + + if (argc < 4) + exit(2); + + sh = get_handle(argv[1]); + + seuser = test_get_seuser(sh, argv[2]); + + const char *name = semanage_seuser_get_mlsrange(seuser); + printf("semanage_seuser_get_mlsrange(%p): %s\n", + (void *) seuser, name); + + if (strcmp_null(argv[3], name) != 0) { + fprintf(stderr, "Expected %s but got %s\n", argv[2], name); + exit(1); + } + + destroy_handle(sh, argv[1]); + + exit(0); +} diff --git a/libsemanage/semanage-seuser-functions/test_get_name.c b/libsemanage/semanage-seuser-functions/test_get_name.c new file mode 100644 index 0000000..95d9025 --- /dev/null +++ b/libsemanage/semanage-seuser-functions/test_get_name.c @@ -0,0 +1,32 @@ +#include +#include +#include +#include +#include + +#include "functions.c" + +int main (int argc, char **argv) { + semanage_handle_t *sh; + semanage_seuser_t *seuser; + + if (argc < 4) + exit(2); + + sh = get_handle(argv[1]); + + seuser = test_get_seuser(sh, argv[2]); + + const char *name = semanage_seuser_get_name(seuser); + printf("semanage_seuser_get_name(%p): %s\n", + (void *) seuser, name); + + if (strcmp_null(argv[3], name) != 0) { + fprintf(stderr, "Expected %s but got %s\n", argv[2], name); + exit(1); + } + + destroy_handle(sh, argv[1]); + + exit(0); +} diff --git a/libsemanage/semanage-seuser-functions/test_get_sename.c b/libsemanage/semanage-seuser-functions/test_get_sename.c new file mode 100644 index 0000000..1ed7248 --- /dev/null +++ b/libsemanage/semanage-seuser-functions/test_get_sename.c @@ -0,0 +1,32 @@ +#include +#include +#include +#include +#include + +#include "functions.c" + +int main (int argc, char **argv) { + semanage_handle_t *sh; + semanage_seuser_t *seuser; + + if (argc < 4) + exit(2); + + sh = get_handle(argv[1]); + + seuser = test_get_seuser(sh, argv[2]); + + const char *name = semanage_seuser_get_sename(seuser); + printf("semanage_seuser_get_sename(%p): %s\n", + (void *) seuser, name); + + if (strcmp_null(argv[3], name) != 0) { + fprintf(stderr, "Expected %s but got %s\n", argv[2], name); + exit(1); + } + + destroy_handle(sh, argv[1]); + + exit(0); +} diff --git a/libsemanage/semanage-seuser-functions/test_iterate.c b/libsemanage/semanage-seuser-functions/test_iterate.c new file mode 100644 index 0000000..533087a --- /dev/null +++ b/libsemanage/semanage-seuser-functions/test_iterate.c @@ -0,0 +1,49 @@ +#include +#include +#include +#include +#include + +#include "functions.c" + +int counter = 0; + +int handler(const semanage_seuser_t *record, void *varg) { + char **args = (char **) varg; + + const char *name = semanage_seuser_get_name(record); + + if (strcmp(name, args[2 + counter++]) != 0) + return -1; + + return 0; +} + +int main (int argc, char **argv) { + semanage_handle_t *sh; + int result; + + if (argc < 2) + exit(2); + + sh = get_handle(argv[1]); + + char **param = NULL; + + if (argc >= 3) { + param = argv; + } + + result = semanage_seuser_iterate(sh, &handler, (void *) param); + printf("semanage_seuser_iterate(%p, %p, %p): %d\n", + (void *) sh, (void *) &handler, (void *) param, result); + + if (result < 0) { + perror("semanage_seuser_iterate"); + exit(1); + } + + destroy_handle(sh, argv[1]); + + exit(0); +} diff --git a/libsemanage/semanage-seuser-functions/test_key_create.c b/libsemanage/semanage-seuser-functions/test_key_create.c new file mode 100644 index 0000000..8f3aaf5 --- /dev/null +++ b/libsemanage/semanage-seuser-functions/test_key_create.c @@ -0,0 +1,39 @@ +#include +#include +#include +#include +#include + +#include "functions.c" + +int main (int argc, char **argv) { + semanage_handle_t *sh; + semanage_seuser_key_t *key; + const char *name; + int result; + + if (argc < 3) + exit(2); + + sh = get_handle(argv[1]); + + if (strcmp(argv[2], "NULL") == 0) + name = NULL; + else + name = argv[2]; + + result = semanage_seuser_key_create(sh, name, &key); + printf("semanage_seuser_key_create(%p, %s, %p): %d\n", + (void *) sh, name, (void *) &key, result); + + if (result < 0 || key == NULL) { + perror("semanage_seuser_key_create"); + exit(1); + } + + semanage_seuser_key_free(key); + + destroy_handle(sh, argv[1]); + + exit(0); +} diff --git a/libsemanage/semanage-seuser-functions/test_key_extract.c b/libsemanage/semanage-seuser-functions/test_key_extract.c new file mode 100644 index 0000000..50658dc --- /dev/null +++ b/libsemanage/semanage-seuser-functions/test_key_extract.c @@ -0,0 +1,45 @@ +#include +#include +#include +#include +#include + +#include "functions.c" + +int main (int argc, char **argv) { + semanage_handle_t *sh; + semanage_seuser_t *seuser; + semanage_seuser_key_t *key; + int result; + + if (argc < 3) + exit(2); + + sh = get_handle(argv[1]); + + seuser = test_get_seuser(sh, argv[2]); + + result = semanage_seuser_key_extract(sh, seuser, &key); + printf("semanage_seuser_key_extract(%p, %p, %p): %d\n", + (void *) sh, (void *) seuser, (void *) &key, result); + + if (result < 0) { + perror("semanage_seuser_key_extract"); + exit(1); + } + + result = semanage_seuser_compare(seuser, key); + printf("semanage_seuser_compare(%p, %p): %d\n", + (void *) seuser, (void *) key, result); + + if (result != 0) { + perror("semanage_seuser_compare"); + exit(1); + } + + semanage_seuser_key_free(key); + + destroy_handle(sh, argv[1]); + + exit(0); +} diff --git a/libsemanage/semanage-seuser-functions/test_list.c b/libsemanage/semanage-seuser-functions/test_list.c new file mode 100644 index 0000000..ae06187 --- /dev/null +++ b/libsemanage/semanage-seuser-functions/test_list.c @@ -0,0 +1,63 @@ +#include +#include +#include +#include +#include + +#include "functions.c" + +int main (int argc, char **argv) { + semanage_handle_t *sh; + semanage_seuser_t **records; + unsigned int count; + int result; + + if (argc < 2) + exit(2); + + sh = get_handle(argv[1]); + + result = semanage_seuser_list(sh, &records, &count); + printf("semanage_seuser_list(%p, %p, %p): %d", + (void *) sh, (void *) &records, (void *) &count, result); + + if (result < 0) { + perror("semanage_seuser_list"); + exit(1); + } + + printf(", count: %u, records: ", count); + + const char *name; + + for (unsigned int i = 0; i < count; i++) { + name = semanage_seuser_get_name(records[i]); + printf("%p (%s), ", (void *) records[i], name); + } + + printf("\n"); + + if (argc >= 3) { + unsigned int exp_count = strtoul(argv[2], NULL, 10); + + if (count != exp_count) { + printf("Expected %u but got %u\n", exp_count, count); + exit(1); + } + + const char *name; + + for (unsigned int i = 0; i < count; i++) { + name = semanage_seuser_get_name(records[i]); + + if (strcmp(name, argv[3 + i]) != 0) { + printf("Expected %s but got %s\n", name, argv[3 + i]); + exit(1); + } + } + } + + destroy_handle(sh, argv[1]); + + exit(0); +} diff --git a/libsemanage/semanage-seuser-functions/test_modify_local.c b/libsemanage/semanage-seuser-functions/test_modify_local.c new file mode 100644 index 0000000..53a11f5 --- /dev/null +++ b/libsemanage/semanage-seuser-functions/test_modify_local.c @@ -0,0 +1,64 @@ +#include +#include +#include +#include +#include + +#include "functions.c" + +int main (int argc, char **argv) { + semanage_handle_t *sh; + semanage_seuser_t *seuser; + semanage_seuser_key_t *key; + semanage_seuser_t **records; + int result; + unsigned int count; + + if (argc < 3) + exit(2); + + sh = get_handle(argv[1]); + + seuser = test_get_seuser(sh, argv[2]); + + result = semanage_seuser_key_extract(sh, seuser, &key); + printf("semanage_seuser_key_extract(%p, %p, %p): %d\n", + (void *) sh, (void *) seuser, (void *) &key, result); + + if (result < 0) { + perror("semanage_seuser_key_extract"); + exit(2); + } + + result = semanage_seuser_modify_local(sh, key, seuser); + printf("semanage_seuser_modify_local(%p, %p, %p): %d\n", + (void *) seuser, (void *) key, (void *) seuser, result); + + if (result < 0) { + perror("semanage_seuser_modify_local"); + exit(1); + } + + result = semanage_seuser_list_local(sh, &records, &count); + printf("semanage_seuser_list_local(%p, %p, %p): %d\n", + (void *) sh, (void *) &records, (void *) &count, result); + + if (result < 0) { + perror("semanage_seuser_list_local"); + exit(2); + } + + if (count != 1) { + fprintf(stderr, "Number of local seusers is %u, expected 1!\n", count); + exit(1); + } + + if (semanage_seuser_compare(records[0], key) != 0) { + fprintf(stderr, "Local seuser is different!\n"); + exit(1); + } + + destroy_handle(sh, argv[1]); + + exit(0); +} diff --git a/libsemanage/semanage-seuser-functions/test_query.c b/libsemanage/semanage-seuser-functions/test_query.c new file mode 100644 index 0000000..10b4e27 --- /dev/null +++ b/libsemanage/semanage-seuser-functions/test_query.c @@ -0,0 +1,50 @@ +#include +#include +#include +#include +#include + +#include "functions.c" + +int main (int argc, char **argv) { + semanage_handle_t *sh; + semanage_seuser_key_t *key; + semanage_seuser_t *response; + int result; + + if (argc < 3) + exit(2); + + sh = get_handle(argv[1]); + + result = semanage_seuser_key_create(sh, argv[2], &key); + printf("semanage_seuser_key_create(%p, %s, %p): %d\n", + (void *) sh, argv[2], (void *) &key, result); + + if (result < 0 || key == NULL) { + perror("semanage_seuser_key_create"); + exit(2); + } + + result = semanage_seuser_query(sh, key, &response); + printf("semanage_seuser_query(%p, %p, %p): %d, response: %p\n", + (void *) sh, (void *) key, (void *) &response, result, (void *) response); + + if (result < 0) { + perror("semanage_seuser_query"); + exit(1); + } + + const char *name = semanage_seuser_get_name(response); + printf("semanage_seuser_get_name(%p): %s\n", + (void *) response, name); + + if (strcmp(argv[2], name) != 0) { + perror("semanage_seuser_get_name"); + exit(2); + } + + destroy_handle(sh, argv[1]); + + exit(0); +} diff --git a/libsemanage/semanage-seuser-functions/test_set_mlsrange.c b/libsemanage/semanage-seuser-functions/test_set_mlsrange.c new file mode 100644 index 0000000..48440ac --- /dev/null +++ b/libsemanage/semanage-seuser-functions/test_set_mlsrange.c @@ -0,0 +1,62 @@ +#include +#include +#include +#include +#include + +#include "functions.c" + +int main (int argc, char **argv) { + semanage_handle_t *sh; + semanage_seuser_t *user; + int result; + const char *mlsrange; + + if (argc < 3) + exit(2); + + sh = get_handle(argv[1]); + + user = test_get_seuser(sh, "first"); + + if (strcmp(argv[2], "NULL") == 0) + mlsrange = NULL; + else + mlsrange = argv[2]; + + const char *old_mlsrange = semanage_seuser_get_mlsrange(user); + printf("semanage_seuser_get_mlsrange(%p): %s\n", + (void *) user, old_mlsrange); + + if (old_mlsrange == NULL) { + perror("semanage_seuser_get_mlsrange"); + exit(2); + } + + if (strcmp(old_mlsrange, mlsrange) == 0) { + printf("New mlsrange is the same\n"); + exit(2); + } + + result = semanage_seuser_set_mlsrange(sh, user, mlsrange); + printf("semanage_seuser_set_mlsrange(%p, %p, %s): %d\n", + (void *) sh, (void *) user, mlsrange, result); + + if (result < 0) { + perror("semanage_seuser_set_mlsrange"); + exit(1); + } + + const char *new_mlsrange = semanage_seuser_get_mlsrange(user); + printf("semanage_seuser_get_mlsrange(%p): %s\n", + (void *) user, new_mlsrange); + + if (strcmp(new_mlsrange, mlsrange) != 0) { + perror("semanage_seuser_get_mlsrange"); + exit(1); + } + + destroy_handle(sh, argv[1]); + + exit(0); +} diff --git a/libsemanage/semanage-seuser-functions/test_set_name.c b/libsemanage/semanage-seuser-functions/test_set_name.c new file mode 100644 index 0000000..3e448e8 --- /dev/null +++ b/libsemanage/semanage-seuser-functions/test_set_name.c @@ -0,0 +1,62 @@ +#include +#include +#include +#include +#include + +#include "functions.c" + +int main (int argc, char **argv) { + semanage_handle_t *sh; + semanage_seuser_t *user; + int result; + const char *name; + + if (argc < 3) + exit(2); + + sh = get_handle(argv[1]); + + user = test_get_seuser(sh, "first"); + + if (strcmp(argv[2], "NULL") == 0) + name = NULL; + else + name = argv[2]; + + const char *old_name = semanage_seuser_get_name(user); + printf("semanage_seuser_get_name(%p): %s\n", + (void *) user, old_name); + + if (old_name == NULL) { + perror("semanage_seuser_get_name"); + exit(2); + } + + if (strcmp(old_name, name) == 0) { + printf("New name is the same\n"); + exit(2); + } + + result = semanage_seuser_set_name(sh, user, name); + printf("semanage_seuser_set_name(%p, %p, %s): %d\n", + (void *) sh, (void *) user, name, result); + + if (result < 0) { + perror("semanage_seuser_set_name"); + exit(1); + } + + const char *new_name = semanage_seuser_get_name(user); + printf("semanage_seuser_get_name(%p): %s\n", + (void *) user, new_name); + + if (strcmp(new_name, name) != 0) { + perror("semanage_seuser_get_name"); + exit(1); + } + + destroy_handle(sh, argv[1]); + + exit(0); +} diff --git a/libsemanage/semanage-seuser-functions/test_set_sename.c b/libsemanage/semanage-seuser-functions/test_set_sename.c new file mode 100644 index 0000000..402c5b7 --- /dev/null +++ b/libsemanage/semanage-seuser-functions/test_set_sename.c @@ -0,0 +1,62 @@ +#include +#include +#include +#include +#include + +#include "functions.c" + +int main (int argc, char **argv) { + semanage_handle_t *sh; + semanage_seuser_t *user; + int result; + const char *name; + + if (argc < 3) + exit(2); + + sh = get_handle(argv[1]); + + user = test_get_seuser(sh, "first"); + + if (strcmp(argv[2], "NULL") == 0) + name = NULL; + else + name = argv[2]; + + const char *old_name = semanage_seuser_get_sename(user); + printf("semanage_seuser_get_sename(%p): %s\n", + (void *) user, old_name); + + if (old_name == NULL) { + perror("semanage_seuser_get_sename"); + exit(2); + } + + if (strcmp(old_name, name) == 0) { + printf("New name is the same\n"); + exit(2); + } + + result = semanage_seuser_set_sename(sh, user, name); + printf("semanage_seuser_set_sename(%p, %p, %s): %d\n", + (void *) sh, (void *) user, name, result); + + if (result < 0) { + perror("semanage_seuser_set_sename"); + exit(1); + } + + const char *new_name = semanage_seuser_get_sename(user); + printf("semanage_seuser_get_sename(%p): %s\n", + (void *) user, new_name); + + if (strcmp(new_name, name) != 0) { + perror("semanage_seuser_get_sename"); + exit(1); + } + + destroy_handle(sh, argv[1]); + + exit(0); +} From ed0073cc4ce1080c43b5b254993175f681d6a19a Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Thu, 11 Apr 2024 11:46:52 +0200 Subject: [PATCH 350/626] Add a test for problematic NOP options left behind by NetLabel When NetLabel is configured to send unlabeled traffic, it should fully remove CIPSO options from the IP packets. This test verifies that they are indeed removed (and not just replaced with IPOPT_NOP or IPOPT_END). Signed-off-by: Ondrej Mosnacek --- .../netlabel-leaves-nops-in-packets/main.fmf | 21 ++ .../reproducer.c | 179 ++++++++++++++++++ .../runtest.sh | 32 ++++ 3 files changed, 232 insertions(+) create mode 100644 kernel/netlabel-leaves-nops-in-packets/main.fmf create mode 100644 kernel/netlabel-leaves-nops-in-packets/reproducer.c create mode 100755 kernel/netlabel-leaves-nops-in-packets/runtest.sh diff --git a/kernel/netlabel-leaves-nops-in-packets/main.fmf b/kernel/netlabel-leaves-nops-in-packets/main.fmf new file mode 100644 index 0000000..b238e96 --- /dev/null +++ b/kernel/netlabel-leaves-nops-in-packets/main.fmf @@ -0,0 +1,21 @@ +summary: Netlabel shouldn't leave NOPs in IP options when removing the CIPSO option +description: | + Test that seeting netlabel to unlabeled doesn't just overwrite CIPSO + options with NOPs, but actually removes them. Some routers may drop + packets with IP options, so this is important. +contact: Ondrej Mosnacek +component: + - kernel +framework: beakerlib +duration: 15m +tier: 2 +require: + - gcc + - netlabel_tools +enabled: true +adjust: + enabled: false + when: distro < rhel-7 + because: RHEL-6 and below are not worth supporting by this test +link: + - verifies: https://issues.redhat.com/browse/RHEL-30904 diff --git a/kernel/netlabel-leaves-nops-in-packets/reproducer.c b/kernel/netlabel-leaves-nops-in-packets/reproducer.c new file mode 100644 index 0000000..f3ecb69 --- /dev/null +++ b/kernel/netlabel-leaves-nops-in-packets/reproducer.c @@ -0,0 +1,179 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * A reproducer that checks that CIPSO options are cleared properly + * by NetLabel when it is configured to send unabeled traffic. + * + * Copyright (c) 2024 Red Hat, Inc. + * Author: Ondrej Mosnacek + */ +#include +#include +#include + +#include +#include +#include + +int run_test(int csock, int ssock, const struct addrinfo *clientinfo, + int tnum, size_t expected_opt_length) +{ + char byte; + struct iovec iov; + struct msghdr msg; + struct cmsghdr *cmsg; + union { + struct cmsghdr cmsghdr; + char buf[CMSG_SPACE(256)]; + } control; + int ret, i, result; + + printf("TEST #%i\n", tnum); + + byte = 0; + ret = sendto(csock, &byte, 1, 0, clientinfo->ai_addr, clientinfo->ai_addrlen); + if (ret < 0) { + perror("sendto"); + exit(2); + } + + memset(&iov, 0, sizeof(iov)); + iov.iov_base = &byte; + iov.iov_len = 1; + memset(&msg, 0, sizeof(msg)); + msg.msg_iov = &iov; + msg.msg_iovlen = 1; + msg.msg_control = &control; + msg.msg_controllen = sizeof(control); + ret = recvmsg(ssock, &msg, 0); + if (ret < 0) { + perror("recvmsg"); + exit(2); + } + for (cmsg = CMSG_FIRSTHDR(&msg); cmsg; + cmsg = CMSG_NXTHDR(&msg, cmsg)) { + if (cmsg->cmsg_level != SOL_IP || + cmsg->cmsg_type != IP_RECVOPTS) + continue; + + if (cmsg->cmsg_len - sizeof(struct cmsghdr) > 0) { + printf(" options: "); + for (i = 0; i < cmsg->cmsg_len - sizeof(struct cmsghdr); i++) { + printf("%02x ", (unsigned)(CMSG_DATA(cmsg)[i])); + } + printf("\n"); + result = expected_opt_length == cmsg->cmsg_len - sizeof(struct cmsghdr); + goto done; + } + } + printf(" no IP options\n"); + result = expected_opt_length == 0; + +done: + if (result) + printf(" PASS\n"); + else + printf(" FAIL\n"); + return result; +} + +int main(int argc, char **argv) +{ + static const unsigned char TEST_OPTION[] = { + 1, // NOP + 158, // option type - Experimental + 5, // option length + 0x12, 0x34, 0x56, // dummy data + 1, // NOP + 134, // option type - CIPSO + 11, // option length + 0, 0, 0, 16, // DOI + 1, // tag type 1 + 5, // tag length + 0, // alignment octet + 1, // sensitivity + 0xff, // bitmap of categories + 1, // NOP + 158, // option type - Experimental + 5, // option length + 0x12, 0x34, 0x56, // dummy data + }; + static const size_t TEST_OPTION_CIPSO_OFF = 7; + static const size_t TEST_OPTION_CIPSO_LEN = 11; + + int ret, result, csock, ssock, on = 1; + struct addrinfo hints, *serverinfo, *clientinfo; + + if (argc != 3) { + fprintf(stderr, "need 2 arguments!\n"); + exit(2); + } + + memset(&hints, 0, sizeof(struct addrinfo)); + + hints.ai_family = AF_INET; + hints.ai_socktype = SOCK_DGRAM; + hints.ai_protocol = IPPROTO_UDP; + + ret = getaddrinfo(argv[1], argv[2], &hints, &clientinfo); + if (ret < 0) { + fprintf(stderr, "getaddrinfo: %s\n", gai_strerror(ret)); + exit(2); + } + + ret = getaddrinfo(NULL, argv[2], &hints, &serverinfo); + if (ret < 0) { + fprintf(stderr, "getaddrinfo: %s\n", gai_strerror(ret)); + exit(2); + } + + csock = socket(clientinfo->ai_family, clientinfo->ai_socktype, + IPPROTO_UDP); + if (csock < 0) { + perror("client socket"); + exit(2); + } + + ssock = socket(serverinfo->ai_family, serverinfo->ai_socktype, + IPPROTO_UDP); + if (ssock < 0) { + perror("server socket"); + exit(2); + } + + ret = setsockopt(ssock, SOL_IP, IP_RECVOPTS, &on, sizeof(on)); + if (ret < 0) { + perror("server setsockopt: IP_RECVOPTS"); + exit(2); + } + + if (bind(ssock, serverinfo->ai_addr, serverinfo->ai_addrlen) < 0) { + perror("server bind"); + exit(2); + } + + result = 1; + + /* TEST 1 - only CIPSO */ + ret = setsockopt(csock, SOL_IP, IP_OPTIONS, + TEST_OPTION + TEST_OPTION_CIPSO_OFF, + TEST_OPTION_CIPSO_LEN); + if (ret < 0) { + perror("client setsockopt: IP_OPTIONS"); + exit(2); + } + if (!run_test(csock, ssock, clientinfo, 1, 0)) + result = 0; + + /* TEST 2 - CIPSO surrounded by other options */ + ret = setsockopt(csock, SOL_IP, IP_OPTIONS, + TEST_OPTION, sizeof(TEST_OPTION)); + if (ret < 0) { + perror("client setsockopt: IP_OPTIONS"); + exit(2); + } + if (!run_test(csock, ssock, clientinfo, 2, + (sizeof(TEST_OPTION) - TEST_OPTION_CIPSO_LEN) + 3) & 3) + result = 0; + + return result ? 0 : 1; +} diff --git a/kernel/netlabel-leaves-nops-in-packets/runtest.sh b/kernel/netlabel-leaves-nops-in-packets/runtest.sh new file mode 100755 index 0000000..8a25ff8 --- /dev/null +++ b/kernel/netlabel-leaves-nops-in-packets/runtest.sh @@ -0,0 +1,32 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# SPDX-License-Identifier: GPL-2.0 +# Copyright (c) 2024 Red Hat, Inc. +# Author: Ondrej Mosnacek + +# Include Beakerlib environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +rlJournalStart + rlPhaseStartSetup + rlRun "gcc -o reproducer reproducer.c" 0 "Build the reproducer" + + rlRun "netlabelctl cipsov4 add pass doi:16 tags:1" 0 + rlRun "netlabelctl map del default" 0 + rlRun "netlabelctl map add default address:0.0.0.0/0 protocol:unlbl" 0 + rlRun "netlabelctl map add default address:::/0 protocol:unlbl" 0 + rlPhaseEnd + + rlPhaseStartTest + rlRun "./reproducer 127.0.0.1 9999" 0 "Run the reproducer" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "rm -f reproducer" 0 "Remove the reproducer binary" + + rlRun "netlabelctl map del default" 0 + rlRun "netlabelctl cipsov4 del doi:16" 0 + rlRun "netlabelctl map add default protocol:unlbl" 0 + rlPhaseEnd +rlJournalPrintText +rlJournalEnd From 7f4c2828eb419846e392d4c4e8209a2994ded442 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Fri, 19 Apr 2024 17:26:05 +0200 Subject: [PATCH 351/626] add important downstream tests to upstream repo To improve the quality of upstream testing, some important downstream tests are moved to the upstream repository. --- setools/seinfo/Makefile | 78 ++++++++++++++ setools/seinfo/PURPOSE | 5 + setools/seinfo/main.fmf | 49 +++++++++ setools/seinfo/runtest.sh | 199 ++++++++++++++++++++++++++++++++++++ setools/sesearch/Makefile | 77 ++++++++++++++ setools/sesearch/PURPOSE | 5 + setools/sesearch/main.fmf | 46 +++++++++ setools/sesearch/runtest.sh | 141 +++++++++++++++++++++++++ 8 files changed, 600 insertions(+) create mode 100644 setools/seinfo/Makefile create mode 100644 setools/seinfo/PURPOSE create mode 100644 setools/seinfo/main.fmf create mode 100755 setools/seinfo/runtest.sh create mode 100644 setools/sesearch/Makefile create mode 100644 setools/sesearch/PURPOSE create mode 100644 setools/sesearch/main.fmf create mode 100755 setools/sesearch/runtest.sh diff --git a/setools/seinfo/Makefile b/setools/seinfo/Makefile new file mode 100644 index 0000000..0a3d589 --- /dev/null +++ b/setools/seinfo/Makefile @@ -0,0 +1,78 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/setools/Sanity/seinfo +# Description: Does seinfo work well? Does it support all features? +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2010 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/setools/Sanity/seinfo +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: Does seinfo work well? Does it support all features?" >> $(METADATA) + @echo "Type: Sanity" >> $(METADATA) + @echo "TestTime: 20m" >> $(METADATA) + @echo "RunFor: setools" >> $(METADATA) + @echo "Requires: setools" >> $(METADATA) + @echo "Requires: setools-console" >> $(METADATA) + @echo "Requires: selinux-policy" >> $(METADATA) + @echo "Requires: selinux-policy-targeted" >> $(METADATA) + @echo "Requires: grep" >> $(METADATA) + @echo "Requires: diffutils" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4" >> $(METADATA) + @echo "Bug: 499247" >> $(METADATA) # Fedora + @echo "Bug: 584286" >> $(METADATA) # RHEL-5 + @echo "Bug: 649699" >> $(METADATA) # RHEL-5 + @echo "Bug: 650092" >> $(METADATA) # RHEL-6 + @echo "Bug: 739628" >> $(METADATA) # RHEL-6 + @echo "Bug: 928705" >> $(METADATA) # RHEL-7 + @echo "Bug: 1581761" >> $(METADATA) # RHEL-8 + + rhts-lint $(METADATA) + diff --git a/setools/seinfo/PURPOSE b/setools/seinfo/PURPOSE new file mode 100644 index 0000000..206824a --- /dev/null +++ b/setools/seinfo/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/setools/Sanity/seinfo +Author: Milos Malik + +Does seinfo work well? Does it support all features? + diff --git a/setools/seinfo/main.fmf b/setools/seinfo/main.fmf new file mode 100644 index 0000000..ad77582 --- /dev/null +++ b/setools/seinfo/main.fmf @@ -0,0 +1,49 @@ +summary: Does seinfo work well? Does it support all features? +description: |+ + Does seinfo work well? Does it support all features? + +contact: Milos Malik +component: + - setools +test: ./runtest.sh +framework: beakerlib +require: + - library(selinux-policy/common) +recommend: + - setools + - setools-console + - selinux-policy + - selinux-policy-targeted + - grep + - diffutils +duration: 20m +enabled: true +tag: + - NoRHEL4 + - TIPpass_Security + - Tier1 + - Tier1se + - TipWaived5 + - TipWaived6 + - f31friendly + - f32friendly + - failinrhel8ci + - targeted +tier: '1' +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=499247 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=584286 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=649699 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=650092 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=739628 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=928705 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1581761 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=920981 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1581848 +adjust: + - enabled: false + when: distro == rhel-4 + continue: false +extra-nitrate: TC#0067249 +extra-summary: /CoreOS/setools/Sanity/seinfo +extra-task: /CoreOS/setools/Sanity/seinfo diff --git a/setools/seinfo/runtest.sh b/setools/seinfo/runtest.sh new file mode 100755 index 0000000..05cf002 --- /dev/null +++ b/setools/seinfo/runtest.sh @@ -0,0 +1,199 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/setools/Sanity/seinfo +# Description: Does seinfo work well? Does it support all features? +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2010 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include rhts environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="setools" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" + if rlIsRHEL 5 ; then + rlAssertRpm ${PACKAGE} + else + rlAssertRpm ${PACKAGE}-console + fi + rlAssertRpm selinux-policy + rlAssertRpm selinux-policy-targeted + SHORT_OUTPUT=`mktemp` + LONG_OUTPUT=`mktemp` + rlPhaseEnd + + if seinfo --version | grep -q '3\.3' ; then + rlPhaseStartTest "bz#499247 + bz#584286" + rlRun "seinfo" + rlRun "seinfo --version" + rlRun "seinfo --stats" + for CLASS in "capability" ; do + rlRun "SIMPLE_COUNT=\`seinfo -c${CLASS} | wc -l\`" + rlAssertEquals "the output without details should 1 line long" ${SIMPLE_COUNT} 1 + rlRun "EXPANDED_COUNT=\`seinfo -x -c${CLASS} | wc -l\`" + rlAssertGreater "the output with details should be more than 1 line long" ${EXPANDED_COUNT} 1 + done + + for TYPE in "root_t" ; do + rlRun "SIMPLE_COUNT=\`seinfo -t${TYPE} | wc -l\`" + rlAssertEquals "the output without details should 1 line long" ${SIMPLE_COUNT} 1 + rlRun "EXPANDED_COUNT=\`seinfo -x -t${TYPE} | wc -l\`" + rlAssertGreater "the output with details should be more than 1 line long" ${EXPANDED_COUNT} 1 + done + + if ! rlIsRHEL 5 ; then + ATTRIBUTE="domain" + else + ATTRIBUTE="@ttr0135" + fi + rlRun "SIMPLE_COUNT=\`seinfo -a${ATTRIBUTE} | wc -l\`" + rlAssertEquals "the output without details should 1 line long" ${SIMPLE_COUNT} 1 + rlRun "EXPANDED_COUNT=\`seinfo -x -a${ATTRIBUTE} | wc -l\`" + rlAssertGreater "the output with details should be more than 1 line long" ${EXPANDED_COUNT} 1 + + for ROLE in "sysadm_r" ; do + rlRun "SIMPLE_COUNT=\`seinfo -r${ROLE} | wc -l\`" + rlAssertEquals "the output without details should 1 line long" ${SIMPLE_COUNT} 1 + rlRun "EXPANDED_COUNT=\`seinfo -x -r${ROLE} | wc -l\`" + rlAssertGreater "the output with details should be more than 1 line long" ${EXPANDED_COUNT} 1 + done + + for USER in "root" ; do + rlRun "SIMPLE_COUNT=\`seinfo -u${USER} | wc -l\`" + rlAssertEquals "the output without details should 1 line long" ${SIMPLE_COUNT} 1 + rlRun "EXPANDED_COUNT=\`seinfo -x -u${USER} | wc -l\`" + rlAssertGreater "the output with details should be more than 1 line long" ${EXPANDED_COUNT} 1 + done + + for BOOLEAN in "ftpd_connect_db" ; do + rlRun "SIMPLE_COUNT=\`seinfo -b${BOOLEAN} | wc -c\`" + rlAssertGreater "the output without details should be short" ${SIMPLE_COUNT} 10 + rlRun "EXPANDED_COUNT=\`seinfo -x -b${BOOLEAN} | wc -c\`" + rlAssertGreater "the output with details should be longer" ${EXPANDED_COUNT} ${SIMPLE_COUNT} + done + + if rlIsRHEL 5 ; then + for OPTION_PAIR in \ + "-c|--classes" \ + "-t|--types" \ + "-a|--attribs" \ + "-r|--roles" \ + "-u|--users" \ + "-b|--boolean" \ + "-S|--sensitivities" \ + "-C|--categories" \ + "-f|--fs_use" \ + "-g|--genfscon" \ + "-n|--netifcon" \ + "-o|--nodecon" \ + "-p|--portcon" \ + "-i|--initialsid" ; do + SHORT_OPTION=`echo ${OPTION_PAIR} | cut -d '|' -f 1` + rlRun "seinfo ${SHORT_OPTION} >& ${SHORT_OUTPUT}" + LONG_OPTION=`echo ${OPTION_PAIR} | cut -d '|' -f 2` + rlRun "seinfo ${LONG_OPTION} >& ${LONG_OUTPUT}" + rlRun "diff ${SHORT_OUTPUT} ${LONG_OUTPUT} >& /dev/null" + done + else + for OPTION_PAIR in \ + "-c|--class" \ + "-t|--type" \ + "-a|--attribute" \ + "-r|--role" \ + "-u|--user" \ + "-b|--bool" ; do + SHORT_OPTION=`echo ${OPTION_PAIR} | cut -d '|' -f 1` + rlRun "seinfo ${SHORT_OPTION} >& ${SHORT_OUTPUT}" + LONG_OPTION=`echo ${OPTION_PAIR} | cut -d '|' -f 2` + rlRun "seinfo ${LONG_OPTION} >& ${LONG_OUTPUT}" + rlRun "diff ${SHORT_OUTPUT} ${LONG_OUTPUT} >& /dev/null" + done + fi + rlPhaseEnd + fi + + if false ; then # both bugs were closed as WONTFIX + rlPhaseStartTest "bz#649699 + bz#650092" + for SHORT_OPTION in "-c" "-t" "-a" "-r" "-u" "-b" ; do + rlRun "seinfo ${SHORT_OPTION}xyz" 1-255 + done + for LONG_OPTION in "--class" "--sensitivity" "--category" "--type" "--attribute" \ + "--role" "--user" "--bool" "--constrain" "--initialsid" "--fs_use" "--genfscon" \ + "--netifcon" "--nodecon" "--all" "--portcon --protocol" "--expand" "--stats" \ + "--version" "--help"; do + rlRun "seinfo ${LONG_OPTION}=xyz" 1-255 + done + rlPhaseEnd + fi + + rlPhaseStartTest "bz#739628" + rlRun "seinfo -r | grep -v -e Roles: -e _r$ -e ^$" 1 + rlRun "seinfo -u | grep -v -e Users: -e _u$ -e ^$ -e root$" 1 + rlRun "seinfo -t | grep -v -e Types: -e _t$ -e ^$" 1 + rlPhaseEnd + + if ! rlIsRHEL 5 6 ; then + rlPhaseStartTest "bz#928705 + bz#1581761" + rlRun "seinfo -tspamc_t -x | grep -i alias" + rlRun "seinfo -tspamc_t -x | grep spamc_t" + rlRun "seinfo -tspamc_t -x | grep spamassassin_t" + rlRun "seinfo -tspamassassin_t -x | grep -i alias" + rlRun "seinfo -tspamassassin_t -x | grep spamassassin_t" + rlRun "seinfo -tspamassassin_t -x | grep -i spamc_t" + rlPhaseEnd + fi + + rlPhaseStartTest "bz#1029837" + # there is a difference when seinfo analyzes the policy file stored under /etc/selinux and the active policy stored in the SELinux file-system + if rlIsRHEL 5 6 ; then + SELINUX_FS="/selinux" + else + SELINUX_FS="/sys/fs/selinux" + fi + rlRun "seinfo ${SELINUX_FS}/policy" + for POLICY_TYPE in minimum mls targeted ; do + if [ -f /etc/selinux/${POLICY_TYPE}/policy/policy.* ] ; then + rlRun "seinfo /etc/selinux/${POLICY_TYPE}/policy/policy.*" + fi + done + rlPhaseEnd + + if seinfo --version | grep '^4\.' ; then + rlPhaseStartTest "additional v.4 features in comparison to v.3" + for OPTION in "common" "default" "typebounds" "validatetrans" ; do + rlRun "seinfo --${OPTION}" + rlRun "seinfo --${OPTION} | grep -i ${OPTION}" + done + rlPhaseEnd + fi + + rlPhaseStartCleanup + rm -f ${SHORT_OUTPUT} + rm -f ${LONG_OUTPUT} + rlPhaseEnd + rlJournalPrintText +rlJournalEnd + diff --git a/setools/sesearch/Makefile b/setools/sesearch/Makefile new file mode 100644 index 0000000..93c7504 --- /dev/null +++ b/setools/sesearch/Makefile @@ -0,0 +1,77 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/setools/Sanity/sesearch +# Description: Does sesearch work well? Does it support all features? +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2009 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/setools/Sanity/sesearch +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: Does sesearch work well? Does it support all features?" >> $(METADATA) + @echo "Type: Sanity" >> $(METADATA) + @echo "TestTime: 15m" >> $(METADATA) + @echo "RunFor: setools" >> $(METADATA) + @echo "Requires: setools-console" >> $(METADATA) + @echo "Requires: python3-setools" >> $(METADATA) + @echo "Requires: selinux-policy" >> $(METADATA) + @echo "Requires: selinux-policy-targeted" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4" >> $(METADATA) + @echo "Bug: 526460" >> $(METADATA) # Fedora 11 + @echo "Bug: 583915" >> $(METADATA) # RHEL-6 + @echo "Bug: 602166" >> $(METADATA) # RHEL-6 + @echo "Bug: 649711" >> $(METADATA) # RHEL-5 + @echo "Bug: 650094" >> $(METADATA) # RHEL-6 + @echo "Bug: 836213" >> $(METADATA) # RHEL-7 + @echo "Bug: 924588" >> $(METADATA) # RHEL-7 + @echo "Bug: 1029837" >> $(METADATA) # RHEL-7 + @echo "Bug: 1595582" >> $(METADATA) # RHEL-8 + + rhts-lint $(METADATA) + diff --git a/setools/sesearch/PURPOSE b/setools/sesearch/PURPOSE new file mode 100644 index 0000000..9524a62 --- /dev/null +++ b/setools/sesearch/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/setools/Sanity/sesearch +Author: Milos Malik + +Does sesearch work well? Does it support all features? + diff --git a/setools/sesearch/main.fmf b/setools/sesearch/main.fmf new file mode 100644 index 0000000..ae36e4b --- /dev/null +++ b/setools/sesearch/main.fmf @@ -0,0 +1,46 @@ +summary: Does sesearch work well? Does it support all features? +description: |+ + Does sesearch work well? Does it support all features? + +contact: Milos Malik +component: + - setools +test: ./runtest.sh +framework: beakerlib +recommend: + - setools-console + - python3-setools + - selinux-policy + - selinux-policy-targeted +duration: 15m +enabled: true +tag: + - NoRHEL4 + - TIPpass_Security + - Tier1 + - Tier1se + - TierCandidatesFAIL + - TipWaived7 + - f32friendly + - f33friendly + - targeted +tier: '1' +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=526460 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=583915 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=602166 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=649711 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=650094 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=836213 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=924588 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1029837 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1595582 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=920981 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1595572 +adjust: + - enabled: false + when: distro == rhel-4 + continue: false +extra-nitrate: TC#0062271 +extra-summary: /CoreOS/setools/Sanity/sesearch +extra-task: /CoreOS/setools/Sanity/sesearch diff --git a/setools/sesearch/runtest.sh b/setools/sesearch/runtest.sh new file mode 100755 index 0000000..feb7a22 --- /dev/null +++ b/setools/sesearch/runtest.sh @@ -0,0 +1,141 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/setools/Sanity/sesearch +# Description: Does sesearch work well? Does it support all features? +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2009 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include rhts environment +. /usr/share/beakerlib/beakerlib.sh + +PACKAGE="setools" + +rlJournalStart + rlPhaseStartSetup + if rlIsRHEL 5 ; then + rlAssertRpm ${PACKAGE} + elif rlIsRHEL 6 7 ; then + rlAssertRpm ${PACKAGE}-libs + rlAssertRpm ${PACKAGE}-console + else + rlAssertRpm ${PACKAGE}-console + fi + rlPhaseEnd + + if rlIsRHEL '<=7' ; then + rlPhaseStartTest "Records counting" + if rlIsRHEL 5 6 ; then + rlRun "MAX_COUNT=\`sesearch --all | wc -l\`" + else + rlRun "MAX_COUNT=\`sesearch --allow --auditallow --dontaudit --type --role_allow --role_trans --range_trans | wc -l\`" + fi + if rlIsRHEL 5 ; then + for PARAM in "allow" "neverallow" "audit" "role_trans" "type" ; do + rlRun "FULL_COUNT=\`sesearch --${PARAM} | wc -l\`" + rlRun "echo \${FULL_COUNT}" + rlRun "FILTERED_COUNT=\`sesearch --${PARAM} | grep ${PARAM} | wc -l\`" + rlRun "echo \${FILTERED_COUNT}" + rlAssertGreaterOrEqual "the difference must be between 0 and 2" 2 $((FULL_COUNT - FILTERED_COUNT)) + rlAssertGreaterOrEqual "the difference must be between 0 and 2" $((FULL_COUNT - FILTERED_COUNT)) 0 + rlAssertGreaterOrEqual "number of all rules must be greater or equal to this number" ${MAX_COUNT} ${FULL_COUNT} + done + + rlRun "FULL_COUNT=\`sesearch --rangetrans | wc -l\`" + rlRun "echo \${FULL_COUNT}" + rlRun "FILTERED_COUNT=\`sesearch --rangetrans | grep range_trans | wc -l\`" + rlRun "echo \${FILTERED_COUNT}" + rlAssertGreaterOrEqual "the difference must be between 0 and 2" 2 $((FULL_COUNT - FILTERED_COUNT)) + rlAssertGreaterOrEqual "the difference must be between 0 and 2" $((FULL_COUNT - FILTERED_COUNT)) 0 + rlAssertGreaterOrEqual "number of all rules must be greater or equal to this number" ${MAX_COUNT} ${FULL_COUNT} + else + for PARAM in "allow" "neverallow" "auditallow" "dontaudit" "range_trans" "role_trans" "type" ; do + rlRun "FULL_COUNT=\`sesearch --${PARAM} | grep -v -e 'Found ' -e '^$' | wc -l\`" + rlRun "echo \${FULL_COUNT}" + rlRun "FILTERED_COUNT=\`sesearch --${PARAM} | grep -v -e 'Found ' -e '^$' | grep ${PARAM} | wc -l\`" + rlRun "echo \${FILTERED_COUNT}" + rlAssertEquals "these 2 numbers should be equal" ${FULL_COUNT} ${FILTERED_COUNT} + rlAssertGreater "number of all rules must be greater than any of these numbers" ${MAX_COUNT} ${FULL_COUNT} + done + fi + + rlRun "FULL_COUNT=\`sesearch --role_allow | wc -l\`" + rlRun "echo \${FULL_COUNT}" + rlRun "FILTERED_COUNT=\`sesearch --role_allow | grep allow | wc -l\`" + rlRun "echo \${FILTERED_COUNT}" + rlAssertGreaterOrEqual "the difference must be between 0 and 2" 2 $((FULL_COUNT - FILTERED_COUNT)) + rlAssertGreaterOrEqual "the difference must be between 0 and 2" $((FULL_COUNT - FILTERED_COUNT)) 0 + rlAssertGreaterOrEqual "number of all rules must be greater or equal to this number" ${MAX_COUNT} ${FULL_COUNT} + rlPhaseEnd + fi + + rlPhaseStartTest "bz#649711 + bz#650094 + bz#924588" + rlLog "All three bugs were closed as WONTFIX, so this phase was commented out" + #for SHORT_OPTION in "-s" "-t" "-c" ; do + #rlRun "sesearch -A ${SHORT_OPTION} xxx" 1-255 + #done + + #for LONG_OPTION in "--source" "--target" "--class" ; do + #rlRun "sesearch --allow ${LONG_OPTION}=xxx" 1-255 + #done + rlPhaseEnd + + if rlIsRHEL '<=7' ; then + rlPhaseStartTest "bz#836213" + rlRun "sesearch -s ipsec_t -t ipsec_mgmt_t -c process --allow 2>&1 | grep -i \"found .* av rules\"" + rlRun "sesearch -s ipsec_t -t ipsec_mgmt_t -c process --dontaudit 2>&1 | grep -i \"found .* av rules\"" + rlRun "sesearch -s ipsec_t -t ipsec_mgmt_t -c process --all 2>&1 | grep -i \"found .* av rules\"" + rlPhaseEnd + fi + + rlPhaseStartTest "bz#1029837" + if rlIsRHEL 5 6 ; then + SELINUX_FS="/selinux" + else + SELINUX_FS="/sys/fs/selinux" + fi + rlRun "sesearch -T ${SELINUX_FS}/policy >/dev/null" + for POLICY_TYPE in minimum mls targeted ; do + if [ -f /etc/selinux/${POLICY_TYPE}/policy/policy.* ] ; then + rlRun "sesearch -T /etc/selinux/${POLICY_TYPE}/policy/policy.* >/dev/null" + fi + done + rlPhaseEnd + + rlPhaseStartTest "bz#1595582" + REFERENCE_FILE=`mktemp` + OUTPUT_FILE=`mktemp` + REAL_TYPE="spamc_home_t" + rlRun "sesearch -t ${REAL_TYPE} --allow --dontaudit --auditallow | sort > ${REFERENCE_FILE}" + for ALIAS in spamassassin_home_t pyzor_home_t razor_home_t ; do + rlRun "sesearch -t ${ALIAS} --allow --dontaudit --auditallow | sort > ${OUTPUT_FILE}" + rlRun "diff ${REFERENCE_FILE} ${OUTPUT_FILE}" + done + rm -f ${REFERENCE_FILE} ${OUTPUT_FILE} + rlPhaseEnd + + rlPhaseStartCleanup + rlPhaseEnd + rlJournalPrintText +rlJournalEnd + From 0791bbe53a2519f8b2c5e888d86f31d0de9fbb8b Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Fri, 19 Apr 2024 19:19:19 +0200 Subject: [PATCH 352/626] remove unnecessary requires The setools/seinfo test does not really need the SELinux beaker library to work correctly. The lines which require this library were removed. --- setools/seinfo/Makefile | 1 - setools/seinfo/main.fmf | 2 -- setools/seinfo/runtest.sh | 1 - 3 files changed, 4 deletions(-) diff --git a/setools/seinfo/Makefile b/setools/seinfo/Makefile index 0a3d589..1906663 100644 --- a/setools/seinfo/Makefile +++ b/setools/seinfo/Makefile @@ -60,7 +60,6 @@ $(METADATA): Makefile @echo "Requires: selinux-policy-targeted" >> $(METADATA) @echo "Requires: grep" >> $(METADATA) @echo "Requires: diffutils" >> $(METADATA) - @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @echo "License: GPLv2" >> $(METADATA) @echo "Confidential: no" >> $(METADATA) diff --git a/setools/seinfo/main.fmf b/setools/seinfo/main.fmf index ad77582..6658d35 100644 --- a/setools/seinfo/main.fmf +++ b/setools/seinfo/main.fmf @@ -7,8 +7,6 @@ component: - setools test: ./runtest.sh framework: beakerlib -require: - - library(selinux-policy/common) recommend: - setools - setools-console diff --git a/setools/seinfo/runtest.sh b/setools/seinfo/runtest.sh index 05cf002..46e4b4e 100755 --- a/setools/seinfo/runtest.sh +++ b/setools/seinfo/runtest.sh @@ -33,7 +33,6 @@ PACKAGE="setools" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" if rlIsRHEL 5 ; then rlAssertRpm ${PACKAGE} else From 479b08630fbcb9f87554f6a257a5a11afa32d2d3 Mon Sep 17 00:00:00 2001 From: Zdenek Pytela Date: Fri, 26 Apr 2024 19:08:42 +0200 Subject: [PATCH 353/626] Explicitly exclude packages which make the test fail --- selinux-policy/install-uninstall-dsp-packages/main.fmf | 3 ++- selinux-policy/install-uninstall-dsp-packages/runtest.sh | 6 ++++-- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/selinux-policy/install-uninstall-dsp-packages/main.fmf b/selinux-policy/install-uninstall-dsp-packages/main.fmf index 6da6f00..f5c81aa 100644 --- a/selinux-policy/install-uninstall-dsp-packages/main.fmf +++ b/selinux-policy/install-uninstall-dsp-packages/main.fmf @@ -14,9 +14,10 @@ recommend: - selinux-policy - selinux-policy-targeted - dnf + - perl environment: AVC_ERROR: +no_avc_check -duration: 40m +duration: 60m enabled: true tag: - NoRHEL4 diff --git a/selinux-policy/install-uninstall-dsp-packages/runtest.sh b/selinux-policy/install-uninstall-dsp-packages/runtest.sh index 571a4d0..45d59b4 100755 --- a/selinux-policy/install-uninstall-dsp-packages/runtest.sh +++ b/selinux-policy/install-uninstall-dsp-packages/runtest.sh @@ -110,6 +110,9 @@ rlJournalStart rlRun "sed -i '/beaker-tasks/d' install-list" # exclude debuginfo packages rlRun "sed -i '/-debuginfo/d' install-list" + # exclude packages which make the test fail + rlRun "sed -i '/mrtg-selinux/d' install-list" + rlRun "sed -i '/vfrnav-selinux/d' install-list" # packages names only rlRun "awk '{print \$1}' install-list > pkgonlylist" # exclude updates-source @@ -154,7 +157,7 @@ rlJournalStart if grep -q "/run = /var/run" ${FCONTEXT_LIST}; then rlLogInfo "Legacy equivalency settings \"/run = /var/run\" are in place." elif grep -q "/var/run = /run" ${FCONTEXT_LIST}; then - rlLog "New equivalency settings /\"var/run = /run\" are in place." + rlLog "New equivalency settings \"/var/run = /run\" are in place." grep -v "/var/run = /run" ${FCONTEXT_LIST} > ${FCONTEXT_LIST2} if grep -q "^/var/run" ${FCONTEXT_LIST2}; then rlLogWarning "/var/run entries found in the file context database" @@ -184,7 +187,6 @@ rlJournalStart rlRun "seinfo -xa unconfined_domain_type > ${UNCONFINED_DOMAINS}" rlRun "semodule -lfull > ${SEMODULE_LIST}" rlRun "grep -v ^100 ${SEMODULE_LIST} > ${SEMODULE_LIST_DSP}" - rlRpmInstall "perl" rlRun "./dbus-sendmsg.pl > ${DBUS_SENDMSG}" fi rlPhaseEnd From 744686d75adf3c97f2d8eab6948433f29b357736 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Fri, 26 Apr 2024 17:37:36 +0200 Subject: [PATCH 354/626] do not run broken tests in tier plans Automated tests which break the machines where they run should not be executed via tier plans. Test results coming from broken machines have little value to reviewers. --- plans/gating.fmf | 11 +++++++++++ plans/notier.fmf | 11 +++++++++++ plans/tier1.fmf | 2 +- plans/tier2.fmf | 2 +- plans/tier3.fmf | 2 +- .../install-uninstall-dsp-packages/main.fmf | 1 - 6 files changed, 25 insertions(+), 4 deletions(-) create mode 100644 plans/gating.fmf create mode 100644 plans/notier.fmf diff --git a/plans/gating.fmf b/plans/gating.fmf new file mode 100644 index 0000000..8fa5264 --- /dev/null +++ b/plans/gating.fmf @@ -0,0 +1,11 @@ +summary: Gating test plan +adjust: +- when: trigger == commit + enabled: false + because: do not run this plan on changes caused by a PR/MR +discover: + how: fmf + filter: "tag:CI-Tier-1 & tag:-failinfedora" +execute: + how: tmt + diff --git a/plans/notier.fmf b/plans/notier.fmf new file mode 100644 index 0000000..4191bf5 --- /dev/null +++ b/plans/notier.fmf @@ -0,0 +1,11 @@ +summary: no tier test plan +adjust: +- when: trigger == commit + enabled: false + because: do not run this plan on changes caused by a PR/MR +discover: + how: fmf + filter: "tag:-Tier1 & tag:-Tier2 & tag:-Tier3 & tag:-CI-Tier-1 & tag:-failinfedora" +execute: + how: tmt + diff --git a/plans/tier1.fmf b/plans/tier1.fmf index f311437..21405ed 100644 --- a/plans/tier1.fmf +++ b/plans/tier1.fmf @@ -5,7 +5,7 @@ adjust: because: do not run this plan on changes caused by a PR/MR discover: how: fmf - filter: tier:1 | tag:CI-Tier-1 + filter: "tier:1 & tag:-failinfedora" execute: how: tmt diff --git a/plans/tier2.fmf b/plans/tier2.fmf index f424e5c..1065970 100644 --- a/plans/tier2.fmf +++ b/plans/tier2.fmf @@ -5,7 +5,7 @@ adjust: because: do not run this plan on changes caused by a PR/MR discover: how: fmf - filter: tier:2 + filter: "tier:2 & tag:-failinfedora" execute: how: tmt diff --git a/plans/tier3.fmf b/plans/tier3.fmf index 8ee071d..da2bd80 100644 --- a/plans/tier3.fmf +++ b/plans/tier3.fmf @@ -5,7 +5,7 @@ adjust: because: do not run this plan on changes caused by a PR/MR discover: how: fmf - filter: tier:3 + filter: "tier:3 & tag:-failinfedora" execute: how: tmt diff --git a/selinux-policy/install-uninstall-dsp-packages/main.fmf b/selinux-policy/install-uninstall-dsp-packages/main.fmf index f5c81aa..00025b2 100644 --- a/selinux-policy/install-uninstall-dsp-packages/main.fmf +++ b/selinux-policy/install-uninstall-dsp-packages/main.fmf @@ -25,7 +25,6 @@ tag: - NoRHEL6 - NoRHEL7 - TIPfail_Security - - rhel9_broken - targeted link: adjust: From 4e1655b3f32ed6da47aad3074b2a119a4f2126d3 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Sat, 27 Apr 2024 10:11:05 +0200 Subject: [PATCH 355/626] make the upstream tests up-to-date Some upstream tests diverged from their downstream versions. Let's synchronize them. --- checkpolicy/checkmodule/Makefile | 7 +- checkpolicy/checkmodule/main.fmf | 8 +-- checkpolicy/checkmodule/runtest.sh | 24 ++++++- checkpolicy/checkpolicy-docs/Makefile | 4 +- checkpolicy/checkpolicy-docs/PURPOSE | 2 +- checkpolicy/checkpolicy-docs/main.fmf | 7 +- checkpolicy/checkpolicy/Makefile | 4 ++ checkpolicy/checkpolicy/PURPOSE | 1 + checkpolicy/checkpolicy/main.fmf | 8 ++- checkpolicy/checkpolicy/runtest.sh | 97 ++++++++++++++++++++++++--- 10 files changed, 135 insertions(+), 27 deletions(-) diff --git a/checkpolicy/checkmodule/Makefile b/checkpolicy/checkmodule/Makefile index 4dca103..c0b1096 100644 --- a/checkpolicy/checkmodule/Makefile +++ b/checkpolicy/checkmodule/Makefile @@ -53,12 +53,17 @@ $(METADATA): Makefile @echo "Type: Sanity" >> $(METADATA) @echo "TestTime: 10m" >> $(METADATA) @echo "RunFor: checkpolicy" >> $(METADATA) - @echo "Requires: checkpolicy man grep mktemp policycoreutils policycoreutils-devel" >> $(METADATA) + @echo "Requires: checkpolicy man grep policycoreutils policycoreutils-devel" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @echo "License: GPLv2" >> $(METADATA) @echo "Confidential: no" >> $(METADATA) @echo "Destructive: no" >> $(METADATA) @echo "Releases: -RHEL4" >> $(METADATA) + @echo "Bug: 533796" >> $(METADATA) # RHEL-5 + @echo "Bug: 588294" >> $(METADATA) # RHEL-6 + @echo "Bug: 1064603" >> $(METADATA) # RHEL-7 + @echo "Bug: 1329217" >> $(METADATA) # RHEL-7 + @echo "Bug: 1392394" >> $(METADATA) # RHEL-6 rhts-lint $(METADATA) diff --git a/checkpolicy/checkmodule/main.fmf b/checkpolicy/checkmodule/main.fmf index c990752..8e5531a 100644 --- a/checkpolicy/checkmodule/main.fmf +++ b/checkpolicy/checkmodule/main.fmf @@ -5,11 +5,12 @@ description: |+ contact: Milos Malik component: - checkpolicy +test: ./runtest.sh +framework: beakerlib recommend: - checkpolicy - man - grep - - mktemp - policycoreutils - policycoreutils-devel duration: 10m @@ -17,7 +18,6 @@ enabled: true tag: - CI-Tier-1 - NoRHEL4 - - TIPpass_Security - Tier1 - Tier1se - f31friendly @@ -25,11 +25,11 @@ tag: - targeted tier: '1' link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1329217 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=533796 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=588294 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1392394 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1064603 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1329217 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1392394 adjust: - enabled: false when: distro == rhel-4 diff --git a/checkpolicy/checkmodule/runtest.sh b/checkpolicy/checkmodule/runtest.sh index 49dc17f..430d30d 100755 --- a/checkpolicy/checkmodule/runtest.sh +++ b/checkpolicy/checkmodule/runtest.sh @@ -40,7 +40,7 @@ rlJournalStart rlRun "rpm -ql ${PACKAGE} | grep /usr/share/man/.*checkmodule" rlPhaseEnd - rlPhaseStartTest + rlPhaseStartTest "bz#533796 + bz#588294" rlRun "checkmodule >& ${TEST_FILE}" 1 rlAssertGrep "unable to open policy.conf" ${TEST_FILE} rlRun "checkmodule -b >& ${TEST_FILE}" 1 @@ -74,14 +74,14 @@ rlJournalStart rlRun "checkmodule --help 2>&1 | grep -- -U" rlPhaseEnd - rlPhaseStartTest + rlPhaseStartTest "bz#1064603 + bz#1392394" for POLICY_KIND in minimum mls targeted ; do rlRun "checkmodule -M -m -b -o testmod.mod /etc/selinux/${POLICY_KIND}/policy/policy.* >& ${TEST_FILE}" 1 rlRun "grep -i \"checkmodule.*-b and -m are incompatible with each other\" ${TEST_FILE}" done rlPhaseEnd - rlPhaseStartTest + rlPhaseStartTest "bz#1329217" INPUT_FILE="mypolicy.te" OUTPUT_FILE="mypolicy.output" rlRun "ls -l ${INPUT_FILE}" @@ -94,6 +94,24 @@ rlJournalStart fi rlPhaseEnd + if ! rlIsRHEL 5 6 ; then # semodule_unpackage is not available on RHEL-5 and RHEL-6 + rlPhaseStartTest "handle unknown classes and perms" + rlRun "rm -f base.pp base.mod" + rlRun "semodule -E base" + rlRun "semodule_unpackage base.pp base.mod" + for ACTION in allow deny reject ; do + rlRun "checkmodule -b -o base.out -M -U ${ACTION} base.mod" + rlRun "echo -e 'u\nq\n' | sedismod base.out | grep -i \"${ACTION} unknown\"" + done + rlRun "checkmodule -m -o mypolicy.out -M -U deny mypolicy.te" + rlRun "ls -l mypolicy.out" + for ACTION in allow reject ; do + rlRun "checkmodule -m -o mypolicy.out -M -U ${ACTION} mypolicy.te 2>&1 | grep -i 'only valid.*base module'" + done + rlRun "rm -f base.pp base.mod base.out mypolicy.out" + rlPhaseEnd + fi + rlPhaseStartCleanup rlRun "rm -rf ${TEST_FILE} ${TEST_DIR} ${OUTPUT_FILE}" rlPhaseEnd diff --git a/checkpolicy/checkpolicy-docs/Makefile b/checkpolicy/checkpolicy-docs/Makefile index ea1a0bc..d0b165e 100644 --- a/checkpolicy/checkpolicy-docs/Makefile +++ b/checkpolicy/checkpolicy-docs/Makefile @@ -1,6 +1,6 @@ # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # -# Makefile of /CoreOS/checkpolicy/Sanity/checkpolicy +# Makefile of /CoreOS/checkpolicy/Sanity/checkpolicy-docs # Description: covers an issue where manpage included an unsupported option. # Author: Milos Malik # @@ -24,7 +24,7 @@ # # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -export TEST=/CoreOS/checkpolicy/Sanity/checkpolicy +export TEST=/CoreOS/checkpolicy/Sanity/checkpolicy-docs export TESTVERSION=1.0 BUILT_FILES= diff --git a/checkpolicy/checkpolicy-docs/PURPOSE b/checkpolicy/checkpolicy-docs/PURPOSE index bde34d7..ce7d2cc 100644 --- a/checkpolicy/checkpolicy-docs/PURPOSE +++ b/checkpolicy/checkpolicy-docs/PURPOSE @@ -1,4 +1,4 @@ -PURPOSE of /CoreOS/checkpolicy/Sanity/checkpolicy +PURPOSE of /CoreOS/checkpolicy/Sanity/checkpolicy-docs Description: covers an issue where manpage included an unsupported option. diff --git a/checkpolicy/checkpolicy-docs/main.fmf b/checkpolicy/checkpolicy-docs/main.fmf index 368c6bd..f66b1a9 100644 --- a/checkpolicy/checkpolicy-docs/main.fmf +++ b/checkpolicy/checkpolicy-docs/main.fmf @@ -32,6 +32,7 @@ adjust: - enabled: false when: distro == rhel-4 continue: false -extra-nitrate: TC#0062302 -extra-summary: /CoreOS/checkpolicy/Sanity/checkpolicy -extra-task: /CoreOS/checkpolicy/Sanity/checkpolicy +extra-nitrate: TC#00612804 +extra-summary: /CoreOS/checkpolicy/Sanity/checkpolicy-docs +extra-task: /CoreOS/checkpolicy/Sanity/checkpolicy-docs +id: 8e06af12-0434-448a-aa85-9ed5c854daf9 diff --git a/checkpolicy/checkpolicy/Makefile b/checkpolicy/checkpolicy/Makefile index 1ba29a4..3712630 100644 --- a/checkpolicy/checkpolicy/Makefile +++ b/checkpolicy/checkpolicy/Makefile @@ -59,6 +59,10 @@ $(METADATA): Makefile @echo "Confidential: no" >> $(METADATA) @echo "Destructive: no" >> $(METADATA) @echo "Releases: -RHEL4" >> $(METADATA) + @echo "Bug: 533790" >> $(METADATA) # RHEL-5 + @echo "Bug: 739866" >> $(METADATA) # RHEL-6 + @echo "Bug: 1328966" >> $(METADATA) # RHEL-7 + @echo "Bug: 1328979" >> $(METADATA) # RHEL-7 rhts-lint $(METADATA) diff --git a/checkpolicy/checkpolicy/PURPOSE b/checkpolicy/checkpolicy/PURPOSE index c60c59e..58a2359 100644 --- a/checkpolicy/checkpolicy/PURPOSE +++ b/checkpolicy/checkpolicy/PURPOSE @@ -4,4 +4,5 @@ Description: runs checkpolicy with various options to find out if it behaves cor Author: Milos Malik +This test also covers bz#533790 ( https://bugzilla.redhat.com/show_bug.cgi?id=533790 ). diff --git a/checkpolicy/checkpolicy/main.fmf b/checkpolicy/checkpolicy/main.fmf index f11940a..4459507 100644 --- a/checkpolicy/checkpolicy/main.fmf +++ b/checkpolicy/checkpolicy/main.fmf @@ -4,11 +4,14 @@ description: |+ Author: Milos Malik + This test also covers bz#533790 ( https://bugzilla.redhat.com/show_bug.cgi?id=533790 ). contact: Milos Malik component: - setools - checkpolicy +test: ./runtest.sh +framework: beakerlib recommend: - checkpolicy - setools-console @@ -20,7 +23,6 @@ enabled: true tag: - CI-Tier-1 - NoRHEL4 - - TIPpass_Security - Tier1 - Tier1se - f31friendly @@ -28,10 +30,10 @@ tag: - targeted tier: '1' link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=533790 + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=739866 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1328966 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1328979 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=739866 - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=533790 adjust: - enabled: false when: distro == rhel-4 diff --git a/checkpolicy/checkpolicy/runtest.sh b/checkpolicy/checkpolicy/runtest.sh index fd0de7d..359bc3e 100755 --- a/checkpolicy/checkpolicy/runtest.sh +++ b/checkpolicy/checkpolicy/runtest.sh @@ -34,10 +34,12 @@ PACKAGE="checkpolicy" rlJournalStart rlPhaseStartSetup rlAssertRpm ${PACKAGE} - rlRun "yum -y install selinux-policy-minimum selinux-policy-mls selinux-policy-targeted --enablerepo '*' --nobest" - rlAssertRpm selinux-policy-minimum + if rlIsRHEL "<9" ; then + rlAssertRpm selinux-policy-minimum + fi rlAssertRpm selinux-policy-mls rlAssertRpm selinux-policy-targeted + rlRun "rpm -qa | grep kernel" rlRun "uname -a" TEST_FILE=`mktemp` TEST_DIR=`mktemp -d` @@ -52,7 +54,7 @@ rlJournalStart if rlIsRHEL 5 6 ; then VERSIONS=`seq ${MIN_VERSION} 1 ${MAX_VERSION}` else - # some versions are skipped because seinfo segfaults when inspecting binary policies between v.20 and v.23" + # some versions are skipped because of BZ#1328979 VERSIONS=`seq ${MIN_VERSION} 1 ${MAX_VERSION} | grep -v -e 19 -e 20 -e 21 -e 22 -e 23` fi for CUR_VERSION in ${VERSIONS} ; do @@ -67,7 +69,7 @@ rlJournalStart done rlPhaseEnd - rlPhaseStartTest + rlPhaseStartTest "bz#533790" rlRun "checkpolicy >& ${TEST_FILE}" 1 rlAssertGrep "unable to open policy.conf" ${TEST_FILE} rlRun "checkpolicy -b >& ${TEST_FILE}" 1 @@ -102,7 +104,7 @@ rlJournalStart rlRun "checkpolicy --help 2>&1 | grep -- '-m]'" 1 rlPhaseEnd - rlPhaseStartTest + rlPhaseStartTest "bz#739866" if rlIsRHEL 5 6 ; then ACTIVE_POLICY="/selinux/policy" else @@ -110,7 +112,12 @@ rlJournalStart fi rlRun "echo -e 'q\n' | checkpolicy -Mdb ${ACTIVE_POLICY} | tee ${OUTPUT_FILE}" rlRun "grep -qi -e error -e ebitmap -e 'not match' ${OUTPUT_FILE}" 1 - for POLICY_TYPE in minimum mls targeted ; do + if rlIsRHEL "<9" ; then + LIST="minimum mls targeted" + else + LIST="mls targeted" + fi + for POLICY_TYPE in $LIST ; do if [ ! -e /etc/selinux/${POLICY_TYPE}/policy/policy.* ] ; then continue fi @@ -119,7 +126,7 @@ rlJournalStart done rlPhaseEnd - rlPhaseStartTest + rlPhaseStartTest "bz#1328966 + bz#1328979" if rlIsRHEL 5 6 ; then ACTIVE_POLICY_TREE="/selinux" else # RHEL-7 and above @@ -127,11 +134,16 @@ rlJournalStart fi MIN_VERSION="15" MAX_VERSION=`find /etc/selinux/ -name policy.?? | cut -d / -f 6 | cut -d . -f 2 | head -n 1` - for POLICY_TYPE in minimum mls targeted ; do + if rlIsRHEL "<9" ; then + LIST="minimum mls targeted" + else + LIST="mls targeted" + fi + for POLICY_TYPE in $LIST ; do if rlIsRHEL 5 6 ; then VERSIONS=`seq ${MIN_VERSION} 1 ${MAX_VERSION}` else - # some versions are skipped because seinfo segfaults when inspecting binary policies between v.20 and v.23" + # some versions are skipped because of BZ#1328979 VERSIONS=`seq ${MIN_VERSION} 1 ${MAX_VERSION} | grep -v -e 19 -e 20 -e 21 -e 22 -e 23` fi for CUR_VERSION in ${VERSIONS} ; do @@ -147,8 +159,73 @@ rlJournalStart done rlPhaseEnd + rlPhaseStartTest "handle unknown classes and perms" + for ACTION in allow deny reject ; do + rlRun "rm -f policy.out" + rlWatchdog "checkpolicy -M -U ${ACTION} -o policy.out policy.conf.from.secilc" 15 + if [ -s policy.out ] ; then + rlRun "echo -e 'U\nq\n' | sedispol policy.out 2>&1 | tee ${OUTPUT_FILE}" + rlRun "grep -i \"${ACTION} unknown\" ${OUTPUT_FILE}" + else + rlFail "policy.out is empty or was not created" + fi + done + rlPhaseEnd + + if ! rlIsRHEL '<=8.1'; then + rlPhaseStartTest "sorting ocontexts" + # check -S option in --help + rlRun "checkpolicy --help >$OUTPUT_FILE" 0,1 + rlRun "cat $OUTPUT_FILE" + rlAssertGrep "\[-S\]" $OUTPUT_FILE + + # check -S option in man page + rlRun "PAGER=cat man checkpolicy >$OUTPUT_FILE" + rlRun "cat $OUTPUT_FILE" + rlAssertGrep "\[-S\]" $OUTPUT_FILE + + # run checkpolicy with the -S option + rlWatchdog "checkpolicy -S -M -o policy.out policy.conf.from.secilc" 15 + rlRun "seinfo policy.out" + rlPhaseEnd + fi + + rlPhaseStartTest "Test checkpolicy cil option" + # check -C option without input file + rlRun "checkpolicy -C 2>&1 | grep \"unable to open policy.conf\"" + # check -C option with policy.conf file + rlRun "checkpolicy -C -M -o policy.cil policy.conf.from.secilc" + rlAssertGrep "(allow [a-z]*_.* [a-z]*_.* ([a-z]* ([a-z]*)))" policy.cil + # check -C option with policy binary file + rlRun "checkpolicy -C -M -o policy.cil2 -b /sys/fs/selinux/policy" + rlAssertGrep "(allow [a-z]*_.* [a-z]*_.* ([a-z]* ([a-z]*)))" policy.cil2 + rlPhaseEnd + + if rlIsRHEL '>=9' ; then + rlPhaseStartTest "Test checkpolicy optimize option" + # check -O option without input file + rlRun "checkpolicy -O 2>&1 | grep \"unable to open policy.conf\"" + # Create optimized -O binary with policy.conf file + rlRun "checkpolicy -O -M -o policy.opt policy.conf.from.secilc" + rlRun "seinfo policy.opt" + # Create regular binary with policy.conf file + rlRun "checkpolicy -M -o policy.reg policy.conf.from.secilc" + rlRun "seinfo policy.reg" + # Compare size of optimized and regular binary + OPT1=`stat -c %s policy.opt` + REG1=`stat -c %s policy.reg` + rlAssertGreater "Test if regular file size is higher than optimized file" $REG1 $OPT1 + # Compare allow rule counts between optimized and regular binary + rlRun "seinfo policy.opt > /tmp/optfile" + OPT_CNT=`grep Allow: /tmp/optfile | tr -s ' ' | sed 's/^ //' | cut -d ' ' -f2` + rlRun "seinfo policy.reg > /tmp/regfile" + REG_CNT=`grep Allow: /tmp/regfile | tr -s ' ' | sed 's/^ //' | cut -d ' ' -f2` + rlAssertGreater "Regular file has higher allow rule than optimized file" $REG_CNT $OPT_CNT + rlPhaseEnd + fi + rlPhaseStartCleanup - rm -f ${OUTPUT_FILE} policy.out + rm -f ${OUTPUT_FILE} policy.out policy.cil policy.cil2 policy.opt policy.reg /tmp/optfile /tmp/regfile rlPhaseEnd rlJournalPrintText rlJournalEnd From 2e11118f7af6224dfbff12a203d2c868fa9f8d26 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Thu, 25 Apr 2024 21:30:50 +0200 Subject: [PATCH 356/626] test if logwatch's sendmail can search for disable_ipv6 A recent SELinux policy + logwatch testing revealed that SELinux prevents the sendmail process (executed by the logwatch timer) from searching the /proc/sys/net/ipv6/conf/all/ directory and finding the disable_ipv6 file. The TC reproduces the situation on machines with special IPv6 configuration. In order to avoid unnecessary SELinux denials being triggered during the situation, I believe that SELinux policy should allow the access. The TC looks for appropriate rules and file context patterns. The TC covers BZ#2183432 and RHEL-34135. --- selinux-policy/logwatch-and-similar/Makefile | 4 +++- selinux-policy/logwatch-and-similar/main.fmf | 6 ++++-- selinux-policy/logwatch-and-similar/runtest.sh | 14 ++++++++++++-- 3 files changed, 19 insertions(+), 5 deletions(-) diff --git a/selinux-policy/logwatch-and-similar/Makefile b/selinux-policy/logwatch-and-similar/Makefile index 857441b..2c3dd3b 100644 --- a/selinux-policy/logwatch-and-similar/Makefile +++ b/selinux-policy/logwatch-and-similar/Makefile @@ -52,7 +52,7 @@ $(METADATA): Makefile @echo "Path: $(TEST_DIR)" >> $(METADATA) @echo "Description: SELinux interferes with logwatch and related programs" >> $(METADATA) @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 10m" >> $(METADATA) + @echo "TestTime: 15m" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console logwatch sendmail /usr/sbin/service" >> $(METADATA) @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @@ -62,7 +62,9 @@ $(METADATA): Makefile @echo "Confidential: no" >> $(METADATA) @echo "Destructive: no" >> $(METADATA) @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA) + @echo "Bug: 2183432" >> $(METADATA) # Fedora 38 @echo "Bug: 2270484" >> $(METADATA) # Fedora 40 + @echo "Bug: RHEL-34135" >> $(METADATA) # RHEL-9 rhts-lint $(METADATA) diff --git a/selinux-policy/logwatch-and-similar/main.fmf b/selinux-policy/logwatch-and-similar/main.fmf index 7fe58e0..dbdaf89 100644 --- a/selinux-policy/logwatch-and-similar/main.fmf +++ b/selinux-policy/logwatch-and-similar/main.fmf @@ -20,7 +20,7 @@ recommend: - /usr/sbin/service environment: AVC_ERROR: +no_avc_check -duration: 10m +duration: 15m enabled: true tag: - NoRHEL4 @@ -33,10 +33,12 @@ tag: - targeted tier: '3' link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2183432 + - verifies: https://issues.redhat.com/browse/RHEL-34135 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2270484 adjust: - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8 because: the logwatch service is not available there extra-summary: /CoreOS/selinux-policy/Regression/logwatch-and-similar extra-task: /CoreOS/selinux-policy/Regression/logwatch-and-similar diff --git a/selinux-policy/logwatch-and-similar/runtest.sh b/selinux-policy/logwatch-and-similar/runtest.sh index 016d5a8..fe1de30 100755 --- a/selinux-policy/logwatch-and-similar/runtest.sh +++ b/selinux-policy/logwatch-and-similar/runtest.sh @@ -45,7 +45,7 @@ rlJournalStart rlAssertRpm ${SERVICE_PACKAGE} rlServiceStop ${SERVICE_NAME} - rlFileBackup /etc/shadow + rlFileBackup /usr/lib/systemd/system/logwatch.timer rlSESetEnforce rlSEStatus @@ -53,6 +53,12 @@ rlJournalStart sleep 2 rlPhaseEnd + rlPhaseStartTest "bz#2183432 + RHEL-34135" + rlRun "ls -Z /proc/sys/net/ipv6/conf/all/disable_ipv6 | grep :sysctl_net_t" + rlSESearchRule "allow logwatch_mail_t sysctl_net_t : dir { search } [ ]" + rlSESearchRule "allow logwatch_mail_t sysctl_net_t : file { getattr open read } [ ]" + rlPhaseEnd + if ! rlIsRHEL 9 ; then rlPhaseStartTest "bz#2270484" rlSEMatchPathCon "/usr/share/logwatch/scripts/logwatch.pl" "logwatch_exec_t" @@ -78,7 +84,11 @@ rlJournalStart rlRun "systemctl enable ${SERVICE_NAME}.timer" rlRun "systemctl start ${SERVICE_NAME}.timer" rlRun "systemctl list-timers --all" - rlRun "sleep 5s" + NEXT_TIME=`date -d "now + 1 minute" "+%H:%M"` + rlRun "sed -i 's/AccuracySec=.*$/AccuracySec=1s\nOnCalendar=*-*-* $NEXT_TIME/' /usr/lib/systemd/system/${SERVICE_NAME}.timer" + rlRun "systemctl daemon-reload" + rlRun "systemctl list-timers --all" + rlRun "sleep 2m" rlRun "systemctl stop ${SERVICE_NAME}.timer" rlRun "systemctl disable ${SERVICE_NAME}.timer" rlPhaseEnd From 55c2934207b077ed907a65b424ac99fab988d56f Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 30 Apr 2024 15:17:22 +0200 Subject: [PATCH 357/626] test if sepolgen-ifgen complains about illegal character Several bug reports pointed out that the installation, reinstallation or upgrade of the selinux-policy-devel package produces the following error message: Illegal character '"' Further investigation revealed that there are unexpected/redundant parentheses in the /usr/share/selinux/devel/include/contrib/virt.if file, which also cause the following error messages when the sepolgen-ifgen command is executed: Missing interface definition for virt_pid_filetrans Missing interface definition for virt_systemctl The TC is able to reproduces the problem when executed on a not yet fixed package. The TC passes when the problem is fixed. The TC covers BZ#2254169, BZ#2254206, BZ#2277925. --- selinux-policy/interface-definitions/main.fmf | 5 +++++ selinux-policy/interface-definitions/runtest.sh | 7 +++++++ 2 files changed, 12 insertions(+) diff --git a/selinux-policy/interface-definitions/main.fmf b/selinux-policy/interface-definitions/main.fmf index e54b879..8befb8d 100644 --- a/selinux-policy/interface-definitions/main.fmf +++ b/selinux-policy/interface-definitions/main.fmf @@ -6,6 +6,7 @@ component: recommend: - /usr/bin/sepolgen-ifgen - selinux-policy + - selinux-policy-devel - selinux-policy-targeted test: ./runtest.sh framework: beakerlib @@ -19,6 +20,10 @@ tag: link: - verifies: https://issues.redhat.com/browse/RHEL-2616 - verifies: https://issues.redhat.com/browse/RHEL-16185 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2254169 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2254206 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2277925 + - verifies: https://issues.redhat.com/browse/RHEL-34769 adjust: - enabled: false when: distro == rhel-4, rhel-5 diff --git a/selinux-policy/interface-definitions/runtest.sh b/selinux-policy/interface-definitions/runtest.sh index 6d80041..215404a 100755 --- a/selinux-policy/interface-definitions/runtest.sh +++ b/selinux-policy/interface-definitions/runtest.sh @@ -13,6 +13,13 @@ rlJournalStart rlRun "grep -i missing output.txt" 1 rlPhaseEnd + rlPhaseStartTest "bz#2254169 + bz#2254206 + bz#2277925" + rlRun "yum -y reinstall selinux-policy-devel >& output.txt" + rlRun "grep -i illegal output.txt" 1 + rlRun "sepolgen-ifgen --verbose >& output.txt" + rlRun "grep -i illegal output.txt" 1 + rlPhaseEnd + rlPhaseStartCleanup rm -f output.txt rlPhaseEnd From 6f6051b5749c8d6c3d7b6c1956ee6253e473e836 Mon Sep 17 00:00:00 2001 From: Zdenek Pytela Date: Tue, 7 May 2024 00:16:29 +0200 Subject: [PATCH 358/626] Uninstall selinux-policy-mls before the actual tests start Removing selinux-policy-targeted is actually not caused by particular packages, but it is rather an effect of current usage of conditional dependencies in DSP packages: Requires: (%{name}-selinux if selinux-policy-%{selinuxtype}) which can lead to uninstallation of selinux-policy-targeted when both selinux-policy-targeted and selinux-policy-mls are installed. --- selinux-policy/install-uninstall-dsp-packages/runtest.sh | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/selinux-policy/install-uninstall-dsp-packages/runtest.sh b/selinux-policy/install-uninstall-dsp-packages/runtest.sh index 45d59b4..8b77fb6 100755 --- a/selinux-policy/install-uninstall-dsp-packages/runtest.sh +++ b/selinux-policy/install-uninstall-dsp-packages/runtest.sh @@ -103,6 +103,10 @@ rlJournalStart rlPhaseEnd rlPhaseStartTest "Install test for dsp packages" + # test can fail when selinux-policy-mls is installed + if rpm -q selinux-policy-mls > /dev/null + then rlRun "dnf -y remove selinux-policy-mls" + fi rlRun "dnf list \"*-selinux*\" --enablerepo=\"*\" --disablerepo=\"beaker-tasks\" --disablerepo=\"*-source\" --disablerepo=\"*-debuginfo\" > install-list" # limit the list to not installed packages rlRun "sed -i '1,/Available Packages/d' install-list" @@ -110,9 +114,6 @@ rlJournalStart rlRun "sed -i '/beaker-tasks/d' install-list" # exclude debuginfo packages rlRun "sed -i '/-debuginfo/d' install-list" - # exclude packages which make the test fail - rlRun "sed -i '/mrtg-selinux/d' install-list" - rlRun "sed -i '/vfrnav-selinux/d' install-list" # packages names only rlRun "awk '{print \$1}' install-list > pkgonlylist" # exclude updates-source From 29b9cb2a5c17964c877ecde61247a51135d87eba Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 7 May 2024 11:29:38 +0200 Subject: [PATCH 359/626] add a basic apol test Main purpose of the automated test is to find out if the apol tool can read and analyze the SELinux policies currently installed on the system. Because the apol tool is a graphical one, a working X session is needed to conduct the testing procedure. --- setools/apol/Makefile | 65 +++++++++++++++++++++++++++++++++ setools/apol/PURPOSE | 5 +++ setools/apol/main.fmf | 36 +++++++++++++++++++ setools/apol/runtest.sh | 79 +++++++++++++++++++++++++++++++++++++++++ 4 files changed, 185 insertions(+) create mode 100644 setools/apol/Makefile create mode 100644 setools/apol/PURPOSE create mode 100644 setools/apol/main.fmf create mode 100755 setools/apol/runtest.sh diff --git a/setools/apol/Makefile b/setools/apol/Makefile new file mode 100644 index 0000000..c3390e4 --- /dev/null +++ b/setools/apol/Makefile @@ -0,0 +1,65 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/setools/Sanity/apol +# Description: basic apol testing +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2024 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/setools/Sanity/apol +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: basic apol test" >> $(METADATA) + @echo "Type: Sanity" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: setools" >> $(METADATA) + @echo "Requires: setools-console setools-gui tigervnc-server selinux-policy-mls selinux-policy-targeted gnome-session-xsession gnome-shell" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) + @echo "Bug: RHEL-29967" >> $(METADATA) # RHEL-10 + + rhts-lint $(METADATA) + diff --git a/setools/apol/PURPOSE b/setools/apol/PURPOSE new file mode 100644 index 0000000..0b80714 --- /dev/null +++ b/setools/apol/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/setools/Sanity/apol +Author: Milos Malik + +Is apol able to run? + diff --git a/setools/apol/main.fmf b/setools/apol/main.fmf new file mode 100644 index 0000000..3ec5295 --- /dev/null +++ b/setools/apol/main.fmf @@ -0,0 +1,36 @@ +summary: basic apol test +description: |+ + Is apol able to run? + +contact: Milos Malik +component: + - setools +test: ./runtest.sh +framework: beakerlib +require: + - library(selinux-policy/common) +recommend: + - gnome-shell + - gnome-session-xsession + - setools-console + - setools-gui + - tigervnc-server + - selinux-policy-mls + - selinux-policy-targeted +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - targeted +link: + - relates: https://issues.redhat.com/browse/RHEL-29967 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + continue: false +extra-summary: /CoreOS/setools/Sanity/apol +extra-task: /CoreOS/setools/Sanity/apol +extra-nitrate: TC#0617470 diff --git a/setools/apol/runtest.sh b/setools/apol/runtest.sh new file mode 100755 index 0000000..32f2aa4 --- /dev/null +++ b/setools/apol/runtest.sh @@ -0,0 +1,79 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/setools/Sanity/apol +# Description: basic apol testing +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2024 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include rhts environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +rlJournalStart + rlPhaseStartSetup + rlRun "rpm -qa | grep setools" + for POLICY_KIND in mls targeted ; do + rlAssertRpm selinux-policy-${POLICY_KIND} + done + rlFileBackup /etc/tigervnc/vncserver.users + rlPhaseEnd + + rlPhaseStartTest "real scenario -- RHEL-29967" + USER_NAME="toor" + USER_SECRET="S3kr3t${RANDOM}" + if ! grep -q ":10=${USER_NAME}" /etc/tigervnc/vncserver.users ; then + rlRun "echo -en '\n:10=${USER_NAME}\n' >> /etc/tigervnc/vncserver.users" + fi + rlRun "useradd -o -u 0 -g 0 ${USER_NAME}" + rlRun "echo ${USER_SECRET} | passwd --stdin ${USER_NAME}" + rlRun "mkdir -p /home/${USER_NAME}/.config" + rlRun "mkdir -p /home/${USER_NAME}/.vnc" + rlRun "echo ${USER_SECRET} | vncpasswd -f > /home/${USER_NAME}/.vnc/passwd" + rlRun "chmod go= /home/${USER_NAME}/.vnc/passwd" + rlRun "ls -l /home/${USER_NAME}/.vnc/" + rlRun "restorecon -RvF /home/${USER_NAME}" + rlRun "systemctl enable vncserver@:10.service" + rlRun "systemctl start vncserver@:10.service" + sleep 15 + rlRun "cat /home/${USER_NAME}/.vnc/*.log" + rlRun "systemctl status vncserver@:10.service" + for POLICY_KIND in mls targeted ; do + rlRun "cp /etc/selinux/${POLICY_KIND}/policy/policy.* /home/${USER_NAME}/policy.${POLICY_KIND}" + rlWatchdog "DISPLAY=:10 apol -v /home/${USER_NAME}/policy.${POLICY_KIND} >& output.txt" 30 + rlRun "grep -i 'success.*open.*permission map' output.txt" + rlRun "grep -i 'success.*open.*policy' output.txt" + rlRun "grep -i -e traceback -e error output.txt" 1 + done + rlRun "systemctl stop vncserver@:10.service" + rlRun "systemctl status vncserver@:10.service" 3 + rlRun "systemctl disable vncserver@:10.service" + sleep 15 + rlRun "userdel -rfZ ${USER_NAME}" + rlPhaseEnd + + rlPhaseStartCleanup + rlFileRestore + rlPhaseEnd + rlJournalPrintText +rlJournalEnd + From ab5c434f532b59a3068e3e62e1e142e953a262d8 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Thu, 16 May 2024 14:11:11 +0200 Subject: [PATCH 360/626] improve the failing tests The /policycoreutils/setfiles_binary test: the --downloaddir option is not recognized by the latest version of DNF. The option is removed now. The /other/update-packages test: the --skip-broken option is not recognized by the latest version of DNF. The option is removed now. The /selinux-policy/install-uninstall-dsp-packages test: let's not run this test together with other tests, because it often finds a problem that brakes the environment for the following tests. --- other/update-packages/runtest.sh | 2 +- policycoreutils/setfiles_binary/Makefile | 3 ++- policycoreutils/setfiles_binary/PURPOSE | 2 +- policycoreutils/setfiles_binary/main.fmf | 2 +- policycoreutils/setfiles_binary/runtest.sh | 3 ++- selinux-policy/install-uninstall-dsp-packages/main.fmf | 1 + 6 files changed, 8 insertions(+), 5 deletions(-) diff --git a/other/update-packages/runtest.sh b/other/update-packages/runtest.sh index 967588e..bcdf7d6 100755 --- a/other/update-packages/runtest.sh +++ b/other/update-packages/runtest.sh @@ -9,7 +9,7 @@ rlJournalStart rlPhaseStartTest rlRun "dnf clean all" - rlRun "dnf -y update --skip-broken --allowerasing" + rlRun "dnf -y update --nobest --allowerasing" rlPhaseEnd rlPhaseStartCleanup diff --git a/policycoreutils/setfiles_binary/Makefile b/policycoreutils/setfiles_binary/Makefile index 121f784..c3251f3 100644 --- a/policycoreutils/setfiles_binary/Makefile +++ b/policycoreutils/setfiles_binary/Makefile @@ -42,7 +42,6 @@ build: $(BUILT_FILES) clean: rm -f *~ $(BUILT_FILES) - include /usr/share/rhts/lib/rhts-make.include $(METADATA): Makefile @@ -59,5 +58,7 @@ $(METADATA): Makefile @echo "License: GPLv2" >> $(METADATA) @echo "Confidential: no" >> $(METADATA) @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) @echo "Bug: 1973754" >> $(METADATA) # RHEL-8 + rhts-lint $(METADATA) diff --git a/policycoreutils/setfiles_binary/PURPOSE b/policycoreutils/setfiles_binary/PURPOSE index 7389189..57f484f 100644 --- a/policycoreutils/setfiles_binary/PURPOSE +++ b/policycoreutils/setfiles_binary/PURPOSE @@ -1,3 +1,3 @@ PURPOSE of /CoreOS/policycoreutils/Sanity/setfiles_binary -Description: Setfiles should allow checking given path against binary policy +Description: setfiles should allow checking given path against binary policy Author: Vit Mojzis diff --git a/policycoreutils/setfiles_binary/main.fmf b/policycoreutils/setfiles_binary/main.fmf index 9c1c4f8..0f46801 100644 --- a/policycoreutils/setfiles_binary/main.fmf +++ b/policycoreutils/setfiles_binary/main.fmf @@ -15,7 +15,7 @@ tag: - NoRHEL7 - targeted link: - - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1973754 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1973754 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 diff --git a/policycoreutils/setfiles_binary/runtest.sh b/policycoreutils/setfiles_binary/runtest.sh index e7a292f..7221573 100755 --- a/policycoreutils/setfiles_binary/runtest.sh +++ b/policycoreutils/setfiles_binary/runtest.sh @@ -40,7 +40,7 @@ rlJournalStart rlRun "mkdir policy" rlRun "pushd policy" # download and extract selinux-policy-targeted - rlRun "dnf download selinux-policy-targeted --downloaddir ." + rlRun "dnf download selinux-policy-targeted" rlRun "rpm2cpio *.rpm | cpio -idm" rlRun "popd" # create a mockup of root directory structure @@ -67,6 +67,7 @@ done rlRun "cat setfilesout2" fi rlPhaseEnd + rlPhaseStartCleanup rlRun "popd" rlRun "rm -r $TmpDir" 0 "Removing tmp directory" diff --git a/selinux-policy/install-uninstall-dsp-packages/main.fmf b/selinux-policy/install-uninstall-dsp-packages/main.fmf index 00025b2..e7306d0 100644 --- a/selinux-policy/install-uninstall-dsp-packages/main.fmf +++ b/selinux-policy/install-uninstall-dsp-packages/main.fmf @@ -25,6 +25,7 @@ tag: - NoRHEL6 - NoRHEL7 - TIPfail_Security + - failinfedora - targeted link: adjust: From c162dadbbe67914a7d959a694e3c46186efd70c3 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 14 May 2024 13:45:18 +0200 Subject: [PATCH 361/626] test if bootupd can search under /sys/firmware/efi/efivars A recent bootupd + selinux-policy testing revealed that SELinux prevents the bootupd daemon from getattr/search-ing (syscall=statx) the /sys/firmware/efi/efivars directory. The TC reproduces the situation on machines equipped by EFI system partition. In order to support the bootupd functions on EFI machines, I believe that SELinux policy should allow this access. The TC looks for appropriate policy rules and file context patterns. The TC covers RHEL-36289. --- selinux-policy/bootupd-and-similar/Makefile | 1 + selinux-policy/bootupd-and-similar/main.fmf | 1 + selinux-policy/bootupd-and-similar/runtest.sh | 10 +++++++++- 3 files changed, 11 insertions(+), 1 deletion(-) diff --git a/selinux-policy/bootupd-and-similar/Makefile b/selinux-policy/bootupd-and-similar/Makefile index f23235f..3d0b32d 100644 --- a/selinux-policy/bootupd-and-similar/Makefile +++ b/selinux-policy/bootupd-and-similar/Makefile @@ -65,6 +65,7 @@ $(METADATA): Makefile @echo "Bug: 2029478" >> $(METADATA) # RHEL-9 @echo "Bug: 2044508" >> $(METADATA) # RHEL-9 @echo "Bug: 2218106" >> $(METADATA) # Fedora rawhide + @echo "Bug: RHEL-36289" >> $(METADATA) # RHEL-9 rhts-lint $(METADATA) diff --git a/selinux-policy/bootupd-and-similar/main.fmf b/selinux-policy/bootupd-and-similar/main.fmf index 758cad7..5bb49e6 100644 --- a/selinux-policy/bootupd-and-similar/main.fmf +++ b/selinux-policy/bootupd-and-similar/main.fmf @@ -35,6 +35,7 @@ link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2029478 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2044508 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2218106 + - verifies: https://issues.redhat.com/browse/RHEL-36289 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8 diff --git a/selinux-policy/bootupd-and-similar/runtest.sh b/selinux-policy/bootupd-and-similar/runtest.sh index 06a8156..99d2510 100755 --- a/selinux-policy/bootupd-and-similar/runtest.sh +++ b/selinux-policy/bootupd-and-similar/runtest.sh @@ -34,7 +34,7 @@ FILE_PATH="/usr/libexec/bootupd" SERVICE_PACKAGE="bootupd" SERVICE_NAME="bootupd" PROCESS_NAME="bootupd" -if rlIsFedora || rlIsRHEL '>= 10' || rlIsCentOS '>= 10' ; then +if rlIsFedora || rlIsRHEL '>= 9.5' || rlIsRHEL '>= 10' || rlIsCentOS '>= 10' ; then FILE_CONTEXT="bootupd_exec_t" PROCESS_CONTEXT="bootupd_t" else @@ -74,6 +74,14 @@ rlJournalStart rlSESearchRule "allow ${PROCESS_CONTEXT} dosfs_t : dir { getattr search } [ ]" rlPhaseEnd + rlPhaseStartTest "RHEL-36289" + rlSEMatchPathCon "/usr/libexec/bootupd" "${FILE_CONTEXT}" + if [ -d /sys/firmware/efi/efivars ] ; then + rlRun "ls -RlZ /sys/firmware/efi/efivars" + fi + rlSESearchRule "allow ${PROCESS_CONTEXT} efivarfs_t : dir { getattr search } [ ]" + rlPhaseEnd + rlPhaseStartTest "real scenario -- standalone service" if ! rlSEDefined ${PROCESS_CONTEXT} ; then # for RHELs where the SELinux domain does not exist yet From e08af3f6df516169220260f30d6a40d2336272d2 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Wed, 22 May 2024 11:19:08 +0200 Subject: [PATCH 362/626] add tags to tests which depend on EPEL packages Tests which depend on EPEL packages should be tagged properly. Such tests should not be executed in environments where the EPEL repository is not available. --- selinux-policy/boinc-and-similar/main.fmf | 3 +++ selinux-policy/bz733494-amanda-and-similar/main.fmf | 3 +++ selinux-policy/caddy-and-similar/main.fmf | 3 +++ selinux-policy/cups-pdf-and-similar/main.fmf | 3 +++ selinux-policy/nasd-and-similar/main.fmf | 3 +++ selinux-policy/snapd-and-similar/main.fmf | 3 +++ selinux-policy/sslh-and-similar/main.fmf | 4 +++- selinux-policy/systemd-bootchart-and-similar/main.fmf | 8 ++++---- selinux-policy/thttpd-and-similar/main.fmf | 6 ++++-- selinux-policy/tlp-and-similar/main.fmf | 3 +++ selinux-policy/usbmuxd-and-similar/main.fmf | 2 +- 11 files changed, 33 insertions(+), 8 deletions(-) diff --git a/selinux-policy/boinc-and-similar/main.fmf b/selinux-policy/boinc-and-similar/main.fmf index 24cb118..afa72fe 100644 --- a/selinux-policy/boinc-and-similar/main.fmf +++ b/selinux-policy/boinc-and-similar/main.fmf @@ -31,6 +31,9 @@ tag: - f32friendly - f33friendly - targeted + - epel + - rhel8-epel + - rhel9-epel link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1618683 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1711682 diff --git a/selinux-policy/bz733494-amanda-and-similar/main.fmf b/selinux-policy/bz733494-amanda-and-similar/main.fmf index e9f9505..39d1346 100644 --- a/selinux-policy/bz733494-amanda-and-similar/main.fmf +++ b/selinux-policy/bz733494-amanda-and-similar/main.fmf @@ -54,6 +54,9 @@ adjust: - enabled: false when: distro >= rhel-9 because: the amanda package is not available there + - enabled: false + when: distro >= centos-stream-9 + because: the amanda package is not available there extra-nitrate: TC#0114575 extra-summary: /CoreOS/selinux-policy/Regression/bz733494-amanda-and-similar extra-task: /CoreOS/selinux-policy/Regression/bz733494-amanda-and-similar diff --git a/selinux-policy/caddy-and-similar/main.fmf b/selinux-policy/caddy-and-similar/main.fmf index b1f10a9..ee390a0 100644 --- a/selinux-policy/caddy-and-similar/main.fmf +++ b/selinux-policy/caddy-and-similar/main.fmf @@ -24,6 +24,9 @@ enabled: true tag: - failinfedora - targeted + - epel + - rhel8-epel + - rhel9-epel adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 diff --git a/selinux-policy/cups-pdf-and-similar/main.fmf b/selinux-policy/cups-pdf-and-similar/main.fmf index bf6cf21..1157713 100644 --- a/selinux-policy/cups-pdf-and-similar/main.fmf +++ b/selinux-policy/cups-pdf-and-similar/main.fmf @@ -32,6 +32,9 @@ tag: - NoRHEL6 - NoRHEL7 - targeted + - epel + - rhel8-epel + - rhel9-epel link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=560220 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=563977 diff --git a/selinux-policy/nasd-and-similar/main.fmf b/selinux-policy/nasd-and-similar/main.fmf index 58b27f3..13a57a2 100644 --- a/selinux-policy/nasd-and-similar/main.fmf +++ b/selinux-policy/nasd-and-similar/main.fmf @@ -25,6 +25,9 @@ adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8 because: the nas package is not available there + - enabled: false + when: distro >= centos-stream-9 + because: the nas package is not available there extra-summary: /CoreOS/selinux-policy/Regression/nasd-and-similar extra-task: /CoreOS/selinux-policy/Regression/nasd-and-similar extra-nitrate: TC#0614607 diff --git a/selinux-policy/snapd-and-similar/main.fmf b/selinux-policy/snapd-and-similar/main.fmf index 34efcfa..7b6a8c0 100644 --- a/selinux-policy/snapd-and-similar/main.fmf +++ b/selinux-policy/snapd-and-similar/main.fmf @@ -29,6 +29,9 @@ tag: - NoRHEL6 - failinfedora - targeted + - epel + - rhel8-epel + - rhel9-epel link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2207725 adjust: diff --git a/selinux-policy/sslh-and-similar/main.fmf b/selinux-policy/sslh-and-similar/main.fmf index 4b3bd3e..4cdaca8 100644 --- a/selinux-policy/sslh-and-similar/main.fmf +++ b/selinux-policy/sslh-and-similar/main.fmf @@ -31,6 +31,8 @@ tag: - f33friendly - targeted - failinfedora + - epel + - rhel8-epel link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1534624 adjust: @@ -38,7 +40,7 @@ adjust: when: distro >= rhel-9 because: the sslh package is not available there - enabled: false - when: distro == centos-stream-9 + when: distro >= centos-stream-9 because: the sslh package is not available there - enabled: false when: arch == i386, ppc, s390, s390x diff --git a/selinux-policy/systemd-bootchart-and-similar/main.fmf b/selinux-policy/systemd-bootchart-and-similar/main.fmf index 0f723d1..3b36208 100644 --- a/selinux-policy/systemd-bootchart-and-similar/main.fmf +++ b/selinux-policy/systemd-bootchart-and-similar/main.fmf @@ -20,7 +20,7 @@ recommend: environment: AVC_ERROR: +no_avc_check duration: 10m -enabled: true +enabled: false tag: - NoRHEL4 - NoRHEL5 @@ -30,9 +30,9 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1757050 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1838163 adjust: - - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-8, rhel-9, centos-stream-8, centos-stream-9 - because: the systemd-bootchart package is not available there + - enabled: true + when: distro == fedora + because: the systemd-bootchart package is not available elsewhere extra-nitrate: TC#0608092 extra-summary: /CoreOS/selinux-policy/Regression/systemd-bootchart-and-similar extra-task: /CoreOS/selinux-policy/Regression/systemd-bootchart-and-similar diff --git a/selinux-policy/thttpd-and-similar/main.fmf b/selinux-policy/thttpd-and-similar/main.fmf index 28f74b1..6b601f7 100644 --- a/selinux-policy/thttpd-and-similar/main.fmf +++ b/selinux-policy/thttpd-and-similar/main.fmf @@ -31,6 +31,8 @@ tag: - f31friendly - f32friendly - targeted + - epel + - rhel8-epel tier: '2' link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1069843 @@ -38,10 +40,10 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1111581 adjust: - enabled: false - when: distro == rhel-4, rhel-alt-7, rhel-9 + when: distro == rhel-4, rhel-alt-7, rhel-9, rhel-10 because: the thttpd package is not available there - enabled: false - when: distro == centos-stream-9 + when: distro >= centos-stream-9 because: the thttpd package is not available there - enabled: false when: arch == i386, ppc64, s390 diff --git a/selinux-policy/tlp-and-similar/main.fmf b/selinux-policy/tlp-and-similar/main.fmf index cc29570..2866515 100644 --- a/selinux-policy/tlp-and-similar/main.fmf +++ b/selinux-policy/tlp-and-similar/main.fmf @@ -32,6 +32,9 @@ tag: - failinfedora - f33friendly - targeted + - epel + - rhel8-epel + - rhel9-epel link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1460481 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2221019 diff --git a/selinux-policy/usbmuxd-and-similar/main.fmf b/selinux-policy/usbmuxd-and-similar/main.fmf index 2301b51..79a4c0c 100644 --- a/selinux-policy/usbmuxd-and-similar/main.fmf +++ b/selinux-policy/usbmuxd-and-similar/main.fmf @@ -46,7 +46,7 @@ adjust: when: distro >= rhel-9 because: the usbmuxd package is not available there - enabled: false - when: distro == centos-stream-9 + when: distro >= centos-stream-9 because: the usbmuxd package is not available there - enabled: false when: arch == aarch64, s390x From 60efdf58a5ba650802eee378146bea300414adcc Mon Sep 17 00:00:00 2001 From: Jan Onderka Date: Tue, 28 May 2024 14:34:39 +0200 Subject: [PATCH 363/626] Disable unrelated tests to RHIVOS --- libselinux/container-selinux_crond/main.fmf | 2 ++ libselinux/get_default_context/main.fmf | 1 + libselinux/getpolicyload/main.fmf | 2 ++ libselinux/getsebool/main.fmf | 1 + libselinux/python-bindings/main.fmf | 2 ++ libselinux/selinux_set_callback/main.fmf | 1 + libselinux/setfiles-in-chroot-env/main.fmf | 1 + libselinux/validatetrans/main.fmf | 1 + 8 files changed, 11 insertions(+) diff --git a/libselinux/container-selinux_crond/main.fmf b/libselinux/container-selinux_crond/main.fmf index 91f9a61..8078bd8 100644 --- a/libselinux/container-selinux_crond/main.fmf +++ b/libselinux/container-selinux_crond/main.fmf @@ -12,6 +12,8 @@ recommend: - libselinux-utils - policycoreutils duration: 10m +tag: + - NoRHIVOS link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1862823 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1879368 diff --git a/libselinux/get_default_context/main.fmf b/libselinux/get_default_context/main.fmf index d79b364..893f644 100644 --- a/libselinux/get_default_context/main.fmf +++ b/libselinux/get_default_context/main.fmf @@ -23,6 +23,7 @@ tag: - NoRHEL6 - NoRHEL7 - targeted + - NoRHIVOS link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1879368 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1884282 diff --git a/libselinux/getpolicyload/main.fmf b/libselinux/getpolicyload/main.fmf index 4fb2496..9614113 100644 --- a/libselinux/getpolicyload/main.fmf +++ b/libselinux/getpolicyload/main.fmf @@ -9,6 +9,8 @@ recommends: - policycoreutils duration: 5m enabled: true +tag: + - NoRHIVOS link: - relates: https://issues.redhat.com/browse/RHEL-16233 adjust: diff --git a/libselinux/getsebool/main.fmf b/libselinux/getsebool/main.fmf index 3f36893..c603122 100644 --- a/libselinux/getsebool/main.fmf +++ b/libselinux/getsebool/main.fmf @@ -15,6 +15,7 @@ tag: - f32friendly - f33friendly - targeted + - NoRHIVOS link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1402140 adjust: diff --git a/libselinux/python-bindings/main.fmf b/libselinux/python-bindings/main.fmf index 934d008..8a2b690 100644 --- a/libselinux/python-bindings/main.fmf +++ b/libselinux/python-bindings/main.fmf @@ -6,5 +6,7 @@ component: recommend: - python3-libselinux - python3-pip +tag: + - NoRHIVOS extra-summary: /CoreOS/libselinux/Sanity/python-bindings extra-task: /CoreOS/libselinux/Sanity/python-bindings diff --git a/libselinux/selinux_set_callback/main.fmf b/libselinux/selinux_set_callback/main.fmf index 22cbd2b..5d59faf 100644 --- a/libselinux/selinux_set_callback/main.fmf +++ b/libselinux/selinux_set_callback/main.fmf @@ -21,6 +21,7 @@ tag: - f32friendly - f33friendly - targeted + - NoRHIVOS adjust: - enabled: false when: distro == rhel-4, rhel-5 diff --git a/libselinux/setfiles-in-chroot-env/main.fmf b/libselinux/setfiles-in-chroot-env/main.fmf index 074d84a..b5a9ced 100644 --- a/libselinux/setfiles-in-chroot-env/main.fmf +++ b/libselinux/setfiles-in-chroot-env/main.fmf @@ -14,6 +14,7 @@ duration: 15m enabled: true tag: - targeted + - NoRHIVOS link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2094683 extra-summary: /CoreOS/libselinux/Regression/setfiles-in-chroot-env diff --git a/libselinux/validatetrans/main.fmf b/libselinux/validatetrans/main.fmf index cf9a0e9..922ecc0 100644 --- a/libselinux/validatetrans/main.fmf +++ b/libselinux/validatetrans/main.fmf @@ -27,6 +27,7 @@ tag: - Tier1 - f33friendly - targeted + - NoRHIVOS tier: '1' link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2008965 From 9e9a717326ecb963dfe3c181a427a4e4f45fc879 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Fri, 7 Jun 2024 09:10:45 +0200 Subject: [PATCH 364/626] kernel/...: fix --skip-broken detection for DNF5 The detection of this flag is broken with DNF5, because it now only appears under `dnf install --help`. Also, DNF5 now implements the logic we want (skipping packages that are not available, rather than "broken") under a new --skip-unavailable flag. Therefore, detect both using `dnf install --help` and also check for --skip-unavailable first. Without this fix the tests try to install each package one by one with DNF5, which is suboptimal. Signed-off-by: Ondrej Mosnacek --- kernel/mount-options-memleak/runtest.sh | 4 +++- kernel/selinux-testsuite/runtest.sh | 4 +++- kernel/xfrm-refcount-underflow/runtest.sh | 4 +++- 3 files changed, 9 insertions(+), 3 deletions(-) diff --git a/kernel/mount-options-memleak/runtest.sh b/kernel/mount-options-memleak/runtest.sh index f7fc666..8d21797 100755 --- a/kernel/mount-options-memleak/runtest.sh +++ b/kernel/mount-options-memleak/runtest.sh @@ -16,7 +16,9 @@ fi function installDepsYum() { local yum="$1"; shift - if "$yum" --help | grep -q -- --skip-broken; then + if "$yum" install --help | grep -q -- --skip-unavailable; then + "$yum" install -y --skip-unavailable $* + elif "$yum" install --help | grep -q -- --skip-broken; then "$yum" install -y --skip-broken $* else for req in $*; do diff --git a/kernel/selinux-testsuite/runtest.sh b/kernel/selinux-testsuite/runtest.sh index 09f063a..40846f2 100755 --- a/kernel/selinux-testsuite/runtest.sh +++ b/kernel/selinux-testsuite/runtest.sh @@ -82,7 +82,9 @@ function kver_gt() { ! kver_le "$1"; } function installDepsYum() { local yum="$1"; shift - if "$yum" --help | grep -q -- --skip-broken; then + if "$yum" install --help | grep -q -- --skip-unavailable; then + "$yum" install -y --skip-unavailable $* + elif "$yum" install --help | grep -q -- --skip-broken; then "$yum" install -y --skip-broken $* else for req in $*; do diff --git a/kernel/xfrm-refcount-underflow/runtest.sh b/kernel/xfrm-refcount-underflow/runtest.sh index 895a1af..5822f60 100755 --- a/kernel/xfrm-refcount-underflow/runtest.sh +++ b/kernel/xfrm-refcount-underflow/runtest.sh @@ -10,7 +10,9 @@ function installDepsYum() { local yum="$1"; shift - if "$yum" --help | grep -q -- --skip-broken; then + if "$yum" install --help | grep -q -- --skip-unavailable; then + "$yum" install -y --skip-unavailable $* + elif "$yum" install --help | grep -q -- --skip-broken; then "$yum" install -y --skip-broken $* else for req in $*; do From e1d2c9835a2ee4ef9465b0d329b7fb5dd2468e0a Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Fri, 7 Jun 2024 11:23:42 +0200 Subject: [PATCH 365/626] kernel/xfrm-refcount-overflow: fix kernel pkg name detection Do it the same way as in commit 3e8824e0aa70 ("kernel/selinux-testsuite: fix kernel pkg name detection"). Signed-off-by: Ondrej Mosnacek --- kernel/xfrm-refcount-underflow/runtest.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/xfrm-refcount-underflow/runtest.sh b/kernel/xfrm-refcount-underflow/runtest.sh index 5822f60..580484d 100755 --- a/kernel/xfrm-refcount-underflow/runtest.sh +++ b/kernel/xfrm-refcount-underflow/runtest.sh @@ -36,7 +36,7 @@ rlJournalStart # Determine the base kernel package name and version corresponding # to the currently running kernel. Use this information to derive # the correct kernel subpackages to install. - if KERNEL_CORE_NVRA="$(rpm -qf "/lib/modules/$(uname -r)/kernel")"; then + if KERNEL_CORE_NVRA="$(rpm -qf "/lib/modules/$(uname -r)/config")"; then KERNEL_CORE_NV="${KERNEL_CORE_NVRA%-*}" KERNEL_CORE_N="${KERNEL_CORE_NV%-*}" From 794e0665990ff1cfb7226c251fa6718a275f27be Mon Sep 17 00:00:00 2001 From: bgrech Date: Mon, 3 Jun 2024 19:56:15 -0500 Subject: [PATCH 366/626] RHIVOS adaptations Modify sysd rfkill tests to run kernel-modules install specifically for kernel-automotive in the appropriate system under test --- selinux-policy/systemd-rfkill-and-similar/runtest.sh | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/selinux-policy/systemd-rfkill-and-similar/runtest.sh b/selinux-policy/systemd-rfkill-and-similar/runtest.sh index 4782814..793993a 100755 --- a/selinux-policy/systemd-rfkill-and-similar/runtest.sh +++ b/selinux-policy/systemd-rfkill-and-similar/runtest.sh @@ -47,7 +47,11 @@ rlJournalStart rlAssertRpm ${SERVICE_PACKAGE} rlRun "rpm -qa kernel\*" rlRun "uname -r" - rlRun "yum -y install kernel-modules-`uname -r`" + if ! rlCheckRpm kernel-automotive ; then + rlRun "yum -y install kernel-modules-`uname -r`" + else + rlRun "dnf -y install kernel-automotive-modules-`uname -r`" + fi rlServiceStop ${SERVICE_NAME} rlFileBackup /etc/shadow From d77cf2fc6647b0c70b7c25e28ee47147fc0db1fa Mon Sep 17 00:00:00 2001 From: bgrech Date: Tue, 4 Jun 2024 15:05:56 -0500 Subject: [PATCH 367/626] add NoRHIVOS tag for tests unrelated to rhivos testing --- selinux-policy/ModemManager-and-similar/main.fmf | 1 + selinux-policy/abrt-services/main.fmf | 1 + selinux-policy/accounts-daemon-and-similar/main.fmf | 1 + selinux-policy/acpid-and-similar/main.fmf | 1 + selinux-policy/anon_inode-and-similar/main.fmf | 1 + selinux-policy/bgpd-and-similar/main.fmf | 1 + selinux-policy/blueman-and-similar/main.fmf | 1 + selinux-policy/boinc-and-similar/main.fmf | 1 + selinux-policy/boltd-and-similar/main.fmf | 1 + selinux-policy/bootupd-and-similar/main.fmf | 1 + selinux-policy/bz481628-send-msg-to-dbus/main.fmf | 1 + selinux-policy/bz533007-unable-to-start-kdump-service/main.fmf | 1 + .../bz538089-plymouth-operations-denied-during-boot/main.fmf | 1 + selinux-policy/bz562833-chrooted-named-file-contexts/main.fmf | 1 + selinux-policy/bz624405-pcsc-and-similar/main.fmf | 1 + selinux-policy/bz733494-amanda-and-similar/main.fmf | 1 + selinux-policy/caddy-and-similar/main.fmf | 1 + selinux-policy/capability2-class/main.fmf | 2 ++ selinux-policy/cockpit-ws-and-similar/main.fmf | 1 + selinux-policy/colord-and-similar/main.fmf | 1 + selinux-policy/cups-browsed-and-similar/main.fmf | 1 + selinux-policy/cups-lpd-and-similar/main.fmf | 1 + selinux-policy/cups-pdf-and-similar/main.fmf | 1 + selinux-policy/deny-rules/main.fmf | 1 + selinux-policy/dhclient-and-similar/main.fmf | 2 ++ selinux-policy/dhcpcd-and-similar/main.fmf | 1 + selinux-policy/dmidecode-and-similar/main.fmf | 1 + selinux-policy/exim-and-similar/main.fmf | 1 + selinux-policy/fapolicyd-and-similar/main.fmf | 1 + selinux-policy/fedora-third-party-and-similar/main.fmf | 1 + selinux-policy/firewalld-and-similar/main.fmf | 1 + selinux-policy/fwupd-and-similar/main.fmf | 1 + selinux-policy/getrlimit-permission/main.fmf | 1 + selinux-policy/hostapd-and-similar/main.fmf | 1 + selinux-policy/icecast-and-similar/main.fmf | 1 + selinux-policy/install-uninstall-dsp-packages/main.fmf | 1 + selinux-policy/interface-definitions/main.fmf | 1 + selinux-policy/journalctl-and-similar/main.fmf | 1 + selinux-policy/kerberos-and-similar/main.fmf | 1 + selinux-policy/kernel-confined-exec/main.fmf | 2 ++ selinux-policy/ksm-and-similar/main.fmf | 1 + selinux-policy/ladvd/main.fmf | 1 + selinux-policy/logwatch-and-similar/main.fmf | 1 + selinux-policy/nasd-and-similar/main.fmf | 2 ++ selinux-policy/nfsdcld-and-similar/main.fmf | 1 + selinux-policy/notself-other-keywords/main.fmf | 1 + selinux-policy/ntpsec-and-similar/main.fmf | 1 + selinux-policy/numad-and-similar/main.fmf | 1 + selinux-policy/nvme-stas-and-similar/main.fmf | 1 + selinux-policy/opensmtpd-and-similar/main.fmf | 1 + selinux-policy/pam_console-and-related/main.fmf | 1 + selinux-policy/pam_limits-and-related/main.fmf | 1 + selinux-policy/pam_timestamp-and-related/main.fmf | 1 + selinux-policy/pcp-daemons-and-similar/main.fmf | 1 + selinux-policy/perf_event-and-related/main.fmf | 1 + selinux-policy/ping-and-similar/main.fmf | 1 + selinux-policy/policy-rpm-macros/main.fmf | 1 + selinux-policy/restorecond-fcontext-equivalences/main.fmf | 1 + selinux-policy/rngd-and-similar/main.fmf | 1 + selinux-policy/rpc.idmapd-and-similar/main.fmf | 1 + selinux-policy/rpmdb-and-similar/main.fmf | 1 + selinux-policy/rrdcached-service-and-related/main.fmf | 1 + selinux-policy/rsyslog-and-similar/main.fmf | 1 + selinux-policy/rtkit-daemon-and-similar/main.fmf | 1 + selinux-policy/smbcontrol-and-similar/main.fmf | 1 + selinux-policy/snapd-and-similar/main.fmf | 1 + selinux-policy/sslh-and-similar/main.fmf | 1 + selinux-policy/stalld-and-similar/main.fmf | 1 + selinux-policy/sudo-and-dnf/main.fmf | 1 + selinux-policy/sulogin-and-similar/main.fmf | 1 + selinux-policy/swap-file-and-systemd-access/main.fmf | 1 + selinux-policy/synce4l-and-similar/main.fmf | 1 + selinux-policy/systemd-bootchart-and-similar/main.fmf | 1 + selinux-policy/systemd-creds/main.fmf | 1 + selinux-policy/systemd-generators/main.fmf | 1 + selinux-policy/systemd-homed/main.fmf | 2 ++ selinux-policy/systemd-localed/main.fmf | 1 + selinux-policy/systemd-machined-and-similar/main.fmf | 1 + selinux-policy/systemd-modules-load-and-similar/main.fmf | 1 + selinux-policy/systemd-notify-and-similar/main.fmf | 1 + selinux-policy/systemd-run-and-similar/main.fmf | 1 + selinux-policy/systemd-timesyncd-and-similar/main.fmf | 1 + selinux-policy/systemd-userdbd-and-similar/main.fmf | 1 + selinux-policy/targetd-and-similar/main.fmf | 1 + selinux-policy/thttpd-and-similar/main.fmf | 1 + selinux-policy/tlp-and-similar/main.fmf | 1 + selinux-policy/usbguard-daemon-and-similar/main.fmf | 1 + selinux-policy/usbmuxd-and-similar/main.fmf | 1 + selinux-policy/virtualization-daemons/main.fmf | 1 + selinux-policy/watch-permissions/main.fmf | 2 ++ 90 files changed, 96 insertions(+) diff --git a/selinux-policy/ModemManager-and-similar/main.fmf b/selinux-policy/ModemManager-and-similar/main.fmf index 45a18df..35da033 100644 --- a/selinux-policy/ModemManager-and-similar/main.fmf +++ b/selinux-policy/ModemManager-and-similar/main.fmf @@ -33,6 +33,7 @@ tag: - f31friendly - f32friendly - targeted + - NoRHIVOS tier: '2' link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1120152 diff --git a/selinux-policy/abrt-services/main.fmf b/selinux-policy/abrt-services/main.fmf index 864e175..3cf58bb 100644 --- a/selinux-policy/abrt-services/main.fmf +++ b/selinux-policy/abrt-services/main.fmf @@ -36,6 +36,7 @@ tag: - NoRHEL6 - NoRHEL9 - targeted + - NoRHIVOS link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2274709 adjust: diff --git a/selinux-policy/accounts-daemon-and-similar/main.fmf b/selinux-policy/accounts-daemon-and-similar/main.fmf index 06ce98d..52b9efc 100644 --- a/selinux-policy/accounts-daemon-and-similar/main.fmf +++ b/selinux-policy/accounts-daemon-and-similar/main.fmf @@ -37,6 +37,7 @@ tag: - Tier3se - TierCandidatesPASS - targeted + - NoRHIVOS tier: '3' link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1456760 diff --git a/selinux-policy/acpid-and-similar/main.fmf b/selinux-policy/acpid-and-similar/main.fmf index 0f177b6..6d6c188 100644 --- a/selinux-policy/acpid-and-similar/main.fmf +++ b/selinux-policy/acpid-and-similar/main.fmf @@ -31,6 +31,7 @@ tag: - f31friendly - f32friendly - targeted + - NoRHIVOS tier: '2' link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=995898 diff --git a/selinux-policy/anon_inode-and-similar/main.fmf b/selinux-policy/anon_inode-and-similar/main.fmf index 6ef3a5d..632ca36 100644 --- a/selinux-policy/anon_inode-and-similar/main.fmf +++ b/selinux-policy/anon_inode-and-similar/main.fmf @@ -30,6 +30,7 @@ tag: - NoRHEL8 - targeted - reboot + - NoRHIVOS link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1954145 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1974559 diff --git a/selinux-policy/bgpd-and-similar/main.fmf b/selinux-policy/bgpd-and-similar/main.fmf index 43c39f5..2a836ea 100644 --- a/selinux-policy/bgpd-and-similar/main.fmf +++ b/selinux-policy/bgpd-and-similar/main.fmf @@ -32,6 +32,7 @@ tag: - rhel8-epel - rhel9-epel - targeted + - NoRHIVOS tier: '2' link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1830170 diff --git a/selinux-policy/blueman-and-similar/main.fmf b/selinux-policy/blueman-and-similar/main.fmf index 54cce32..502e9ce 100644 --- a/selinux-policy/blueman-and-similar/main.fmf +++ b/selinux-policy/blueman-and-similar/main.fmf @@ -29,6 +29,7 @@ tag: - NoRHEL6 - NoRHEL7 - targeted + - NoRHIVOS link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1470501 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2027044 diff --git a/selinux-policy/boinc-and-similar/main.fmf b/selinux-policy/boinc-and-similar/main.fmf index afa72fe..a3dcc0a 100644 --- a/selinux-policy/boinc-and-similar/main.fmf +++ b/selinux-policy/boinc-and-similar/main.fmf @@ -34,6 +34,7 @@ tag: - epel - rhel8-epel - rhel9-epel + - NoRHIVOS link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1618683 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1711682 diff --git a/selinux-policy/boltd-and-similar/main.fmf b/selinux-policy/boltd-and-similar/main.fmf index b4b8a85..b9f5ea1 100644 --- a/selinux-policy/boltd-and-similar/main.fmf +++ b/selinux-policy/boltd-and-similar/main.fmf @@ -34,6 +34,7 @@ tag: - f31friendly - f32friendly - targeted + - NoRHIVOS tier: '2' link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1589086 diff --git a/selinux-policy/bootupd-and-similar/main.fmf b/selinux-policy/bootupd-and-similar/main.fmf index 5bb49e6..2dade23 100644 --- a/selinux-policy/bootupd-and-similar/main.fmf +++ b/selinux-policy/bootupd-and-similar/main.fmf @@ -30,6 +30,7 @@ tag: - Tier3 - Tier3se - targeted + - NoRHIVOS tier: '3' link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2029478 diff --git a/selinux-policy/bz481628-send-msg-to-dbus/main.fmf b/selinux-policy/bz481628-send-msg-to-dbus/main.fmf index 27d6716..1f54eb2 100644 --- a/selinux-policy/bz481628-send-msg-to-dbus/main.fmf +++ b/selinux-policy/bz481628-send-msg-to-dbus/main.fmf @@ -31,6 +31,7 @@ tag: - TIPpass - TierCandidatesPASS - targeted + - NoRHIVOS link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=463267 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=481628 diff --git a/selinux-policy/bz533007-unable-to-start-kdump-service/main.fmf b/selinux-policy/bz533007-unable-to-start-kdump-service/main.fmf index 152701d..9f4ecbc 100644 --- a/selinux-policy/bz533007-unable-to-start-kdump-service/main.fmf +++ b/selinux-policy/bz533007-unable-to-start-kdump-service/main.fmf @@ -35,6 +35,7 @@ tag: - TipWaived7 - failinfedora - targeted + - NoRHIVOS link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=533007 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=533366 diff --git a/selinux-policy/bz538089-plymouth-operations-denied-during-boot/main.fmf b/selinux-policy/bz538089-plymouth-operations-denied-during-boot/main.fmf index 7aa34c3..2499927 100644 --- a/selinux-policy/bz538089-plymouth-operations-denied-during-boot/main.fmf +++ b/selinux-policy/bz538089-plymouth-operations-denied-during-boot/main.fmf @@ -32,6 +32,7 @@ tag: - f32friendly - f33friendly - targeted + - NoRHIVOS link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=538089 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=560611 diff --git a/selinux-policy/bz562833-chrooted-named-file-contexts/main.fmf b/selinux-policy/bz562833-chrooted-named-file-contexts/main.fmf index f3985b3..1dc4a23 100644 --- a/selinux-policy/bz562833-chrooted-named-file-contexts/main.fmf +++ b/selinux-policy/bz562833-chrooted-named-file-contexts/main.fmf @@ -32,6 +32,7 @@ tag: - TierCandidatesPASS - f32friendly - targeted + - NoRHIVOS link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=451970 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=562833 diff --git a/selinux-policy/bz624405-pcsc-and-similar/main.fmf b/selinux-policy/bz624405-pcsc-and-similar/main.fmf index 5ab5e8d..2d43271 100644 --- a/selinux-policy/bz624405-pcsc-and-similar/main.fmf +++ b/selinux-policy/bz624405-pcsc-and-similar/main.fmf @@ -36,6 +36,7 @@ tag: - f31friendly - f32friendly - targeted + - NoRHIVOS tier: '3' link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=624405 diff --git a/selinux-policy/bz733494-amanda-and-similar/main.fmf b/selinux-policy/bz733494-amanda-and-similar/main.fmf index 39d1346..5f838a8 100644 --- a/selinux-policy/bz733494-amanda-and-similar/main.fmf +++ b/selinux-policy/bz733494-amanda-and-similar/main.fmf @@ -36,6 +36,7 @@ tag: - f32friendly - rhel9-buildroot - targeted + - NoRHIVOS link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=283971 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=498596 diff --git a/selinux-policy/caddy-and-similar/main.fmf b/selinux-policy/caddy-and-similar/main.fmf index ee390a0..cc426ee 100644 --- a/selinux-policy/caddy-and-similar/main.fmf +++ b/selinux-policy/caddy-and-similar/main.fmf @@ -27,6 +27,7 @@ tag: - epel - rhel8-epel - rhel9-epel + - NoRHIVOS adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 diff --git a/selinux-policy/capability2-class/main.fmf b/selinux-policy/capability2-class/main.fmf index aac92c5..b7a5cad 100644 --- a/selinux-policy/capability2-class/main.fmf +++ b/selinux-policy/capability2-class/main.fmf @@ -27,3 +27,5 @@ adjust: continue: false extra-nitrate: TC#0615396 id: 251fd08a-0f65-4592-8d4d-2b79e9479460 +tag: + - NoRHIVOS diff --git a/selinux-policy/cockpit-ws-and-similar/main.fmf b/selinux-policy/cockpit-ws-and-similar/main.fmf index 056b8fa..f09482f 100644 --- a/selinux-policy/cockpit-ws-and-similar/main.fmf +++ b/selinux-policy/cockpit-ws-and-similar/main.fmf @@ -34,6 +34,7 @@ tag: - TierCandidatesPASS - failinfedora - targeted + - NoRHIVOS link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1100808 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1214223 diff --git a/selinux-policy/colord-and-similar/main.fmf b/selinux-policy/colord-and-similar/main.fmf index 7e4ba6a..0e9565a 100644 --- a/selinux-policy/colord-and-similar/main.fmf +++ b/selinux-policy/colord-and-similar/main.fmf @@ -37,6 +37,7 @@ tag: - f31friendly - f32friendly - targeted + - NoRHIVOS tier: '2' link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1373082 diff --git a/selinux-policy/cups-browsed-and-similar/main.fmf b/selinux-policy/cups-browsed-and-similar/main.fmf index f7c3a00..a868a95 100644 --- a/selinux-policy/cups-browsed-and-similar/main.fmf +++ b/selinux-policy/cups-browsed-and-similar/main.fmf @@ -33,6 +33,7 @@ tag: - Tier1se - f32friendly - targeted + - NoRHIVOS tier: '1' link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1395801 diff --git a/selinux-policy/cups-lpd-and-similar/main.fmf b/selinux-policy/cups-lpd-and-similar/main.fmf index a9173d2..1fddf10 100644 --- a/selinux-policy/cups-lpd-and-similar/main.fmf +++ b/selinux-policy/cups-lpd-and-similar/main.fmf @@ -39,6 +39,7 @@ tag: - f32friendly - rhel9-buildroot - targeted + - NoRHIVOS tier: '2' link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=192216 diff --git a/selinux-policy/cups-pdf-and-similar/main.fmf b/selinux-policy/cups-pdf-and-similar/main.fmf index 1157713..7f64dc5 100644 --- a/selinux-policy/cups-pdf-and-similar/main.fmf +++ b/selinux-policy/cups-pdf-and-similar/main.fmf @@ -35,6 +35,7 @@ tag: - epel - rhel8-epel - rhel9-epel + - NoRHIVOS link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=560220 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=563977 diff --git a/selinux-policy/deny-rules/main.fmf b/selinux-policy/deny-rules/main.fmf index 77ef7a5..72e0dfc 100644 --- a/selinux-policy/deny-rules/main.fmf +++ b/selinux-policy/deny-rules/main.fmf @@ -25,6 +25,7 @@ tag: - NoRHEL7 - NoRHEL8 - targeted + - NoRHIVOS adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-8 diff --git a/selinux-policy/dhclient-and-similar/main.fmf b/selinux-policy/dhclient-and-similar/main.fmf index a956d9f..a359cd7 100644 --- a/selinux-policy/dhclient-and-similar/main.fmf +++ b/selinux-policy/dhclient-and-similar/main.fmf @@ -34,3 +34,5 @@ extra-summary: /CoreOS/selinux-policy/Regression/dhclient-and-similar extra-task: /CoreOS/selinux-policy/Regression/dhclient-and-similar extra-nitrate: TC#0613884 id: bce71943-38b6-428b-af69-20b9e6a60708 +tag: + - NoRHIVOS diff --git a/selinux-policy/dhcpcd-and-similar/main.fmf b/selinux-policy/dhcpcd-and-similar/main.fmf index c6bb75e..ff2cbf1 100644 --- a/selinux-policy/dhcpcd-and-similar/main.fmf +++ b/selinux-policy/dhcpcd-and-similar/main.fmf @@ -27,6 +27,7 @@ tag: - NoRHEL5 - NoRHEL6 - targeted + - NoRHIVOS link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1585971 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1602343 diff --git a/selinux-policy/dmidecode-and-similar/main.fmf b/selinux-policy/dmidecode-and-similar/main.fmf index 21e4f79..c3a00b2 100644 --- a/selinux-policy/dmidecode-and-similar/main.fmf +++ b/selinux-policy/dmidecode-and-similar/main.fmf @@ -34,6 +34,7 @@ tag: - f31friendly - f32friendly - targeted + - NoRHIVOS tier: '2' link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=263141 diff --git a/selinux-policy/exim-and-similar/main.fmf b/selinux-policy/exim-and-similar/main.fmf index fed7aad..0d2cbac 100644 --- a/selinux-policy/exim-and-similar/main.fmf +++ b/selinux-policy/exim-and-similar/main.fmf @@ -35,6 +35,7 @@ tag: - epel - rhel8-epel - rhel9-epel + - NoRHIVOS link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1025315 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1444441 diff --git a/selinux-policy/fapolicyd-and-similar/main.fmf b/selinux-policy/fapolicyd-and-similar/main.fmf index 39a2406..5ffec17 100644 --- a/selinux-policy/fapolicyd-and-similar/main.fmf +++ b/selinux-policy/fapolicyd-and-similar/main.fmf @@ -30,6 +30,7 @@ tag: - NoRHEL7 - fedora-wanted - targeted + - NoRHIVOS link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1865818 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1874491 diff --git a/selinux-policy/fedora-third-party-and-similar/main.fmf b/selinux-policy/fedora-third-party-and-similar/main.fmf index 0c79aa7..adf7a19 100644 --- a/selinux-policy/fedora-third-party-and-similar/main.fmf +++ b/selinux-policy/fedora-third-party-and-similar/main.fmf @@ -33,6 +33,7 @@ tag: - Tier2 - Tier2se - targeted + - NoRHIVOS tier: '2' link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2093453 diff --git a/selinux-policy/firewalld-and-similar/main.fmf b/selinux-policy/firewalld-and-similar/main.fmf index 2eccb4a..7e5698e 100644 --- a/selinux-policy/firewalld-and-similar/main.fmf +++ b/selinux-policy/firewalld-and-similar/main.fmf @@ -39,6 +39,7 @@ tag: - f32friendly - f33friendly - targeted + - NoRHIVOS tier: '3' link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=907902 diff --git a/selinux-policy/fwupd-and-similar/main.fmf b/selinux-policy/fwupd-and-similar/main.fmf index 6360f0d..c0b8813 100644 --- a/selinux-policy/fwupd-and-similar/main.fmf +++ b/selinux-policy/fwupd-and-similar/main.fmf @@ -34,6 +34,7 @@ tag: - Tier3se - TierCandidatesPASS - targeted + - NoRHIVOS tier: '3' link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1772619 diff --git a/selinux-policy/getrlimit-permission/main.fmf b/selinux-policy/getrlimit-permission/main.fmf index ac1ebc2..0c0c654 100644 --- a/selinux-policy/getrlimit-permission/main.fmf +++ b/selinux-policy/getrlimit-permission/main.fmf @@ -29,6 +29,7 @@ tag: - Tier1se - f33friendly - targeted + - NoRHIVOS tier: '1' link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1549691 diff --git a/selinux-policy/hostapd-and-similar/main.fmf b/selinux-policy/hostapd-and-similar/main.fmf index c36293c..46fb896 100644 --- a/selinux-policy/hostapd-and-similar/main.fmf +++ b/selinux-policy/hostapd-and-similar/main.fmf @@ -30,6 +30,7 @@ tag: - TIPpass_Security - failinfedora - targeted + - NoRHIVOS link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1224405 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1225245 diff --git a/selinux-policy/icecast-and-similar/main.fmf b/selinux-policy/icecast-and-similar/main.fmf index 9802ffb..bba9aef 100644 --- a/selinux-policy/icecast-and-similar/main.fmf +++ b/selinux-policy/icecast-and-similar/main.fmf @@ -30,6 +30,7 @@ tag: - f31friendly - f32friendly - targeted + - NoRHIVOS link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=894387 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2156763 diff --git a/selinux-policy/install-uninstall-dsp-packages/main.fmf b/selinux-policy/install-uninstall-dsp-packages/main.fmf index e7306d0..eff82f8 100644 --- a/selinux-policy/install-uninstall-dsp-packages/main.fmf +++ b/selinux-policy/install-uninstall-dsp-packages/main.fmf @@ -27,6 +27,7 @@ tag: - TIPfail_Security - failinfedora - targeted + - NoRHIVOS link: adjust: - enabled: false diff --git a/selinux-policy/interface-definitions/main.fmf b/selinux-policy/interface-definitions/main.fmf index 8befb8d..1d96ce5 100644 --- a/selinux-policy/interface-definitions/main.fmf +++ b/selinux-policy/interface-definitions/main.fmf @@ -17,6 +17,7 @@ tag: - NoRHEL5 - targeted - failinfedora + - NoRHIVOS link: - verifies: https://issues.redhat.com/browse/RHEL-2616 - verifies: https://issues.redhat.com/browse/RHEL-16185 diff --git a/selinux-policy/journalctl-and-similar/main.fmf b/selinux-policy/journalctl-and-similar/main.fmf index 589c483..f7aa19c 100644 --- a/selinux-policy/journalctl-and-similar/main.fmf +++ b/selinux-policy/journalctl-and-similar/main.fmf @@ -31,6 +31,7 @@ tag: - NoRHEL5 - NoRHEL6 - targeted + - NoRHIVOS link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1176713 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1288255 diff --git a/selinux-policy/kerberos-and-similar/main.fmf b/selinux-policy/kerberos-and-similar/main.fmf index dcecfda..471b884 100644 --- a/selinux-policy/kerberos-and-similar/main.fmf +++ b/selinux-policy/kerberos-and-similar/main.fmf @@ -31,6 +31,7 @@ tag: - TipWaived6 - TipWaived7 - targeted + - NoRHIVOS tier: '2' link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=698923 diff --git a/selinux-policy/kernel-confined-exec/main.fmf b/selinux-policy/kernel-confined-exec/main.fmf index a14cf01..4f71f34 100644 --- a/selinux-policy/kernel-confined-exec/main.fmf +++ b/selinux-policy/kernel-confined-exec/main.fmf @@ -28,3 +28,5 @@ link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2068579 extra-nitrate: TC#0614676 id: 4400999a-aa60-4522-b0f7-d7b0656110a3 +tag: + - NoRHIVOS diff --git a/selinux-policy/ksm-and-similar/main.fmf b/selinux-policy/ksm-and-similar/main.fmf index 5c6e492..ec61f2f 100644 --- a/selinux-policy/ksm-and-similar/main.fmf +++ b/selinux-policy/ksm-and-similar/main.fmf @@ -29,6 +29,7 @@ tag: - Tier2 - Tier2se - targeted + - NoRHIVOS tier: '2' link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2021131 diff --git a/selinux-policy/ladvd/main.fmf b/selinux-policy/ladvd/main.fmf index 891c560..78a3451 100644 --- a/selinux-policy/ladvd/main.fmf +++ b/selinux-policy/ladvd/main.fmf @@ -25,6 +25,7 @@ environment: duration: 1h tag: - failinfedora + - NoRHIVOS link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1834325 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1855163 diff --git a/selinux-policy/logwatch-and-similar/main.fmf b/selinux-policy/logwatch-and-similar/main.fmf index dbdaf89..fe6faa2 100644 --- a/selinux-policy/logwatch-and-similar/main.fmf +++ b/selinux-policy/logwatch-and-similar/main.fmf @@ -31,6 +31,7 @@ tag: - Tier3 - Tier3se - targeted + - NoRHIVOS tier: '3' link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2183432 diff --git a/selinux-policy/nasd-and-similar/main.fmf b/selinux-policy/nasd-and-similar/main.fmf index 13a57a2..ef1a288 100644 --- a/selinux-policy/nasd-and-similar/main.fmf +++ b/selinux-policy/nasd-and-similar/main.fmf @@ -32,3 +32,5 @@ extra-summary: /CoreOS/selinux-policy/Regression/nasd-and-similar extra-task: /CoreOS/selinux-policy/Regression/nasd-and-similar extra-nitrate: TC#0614607 id: ad784a9d-5cf4-4aac-b583-68458860acd9 +tag: + - NoRHIVOS diff --git a/selinux-policy/nfsdcld-and-similar/main.fmf b/selinux-policy/nfsdcld-and-similar/main.fmf index edb715c..313d93f 100644 --- a/selinux-policy/nfsdcld-and-similar/main.fmf +++ b/selinux-policy/nfsdcld-and-similar/main.fmf @@ -27,6 +27,7 @@ tag: - NoRHEL6 - NoRHEL7 - targeted + - NoRHIVOS link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1834234 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2026588 diff --git a/selinux-policy/notself-other-keywords/main.fmf b/selinux-policy/notself-other-keywords/main.fmf index edbf75b..6b4201a 100644 --- a/selinux-policy/notself-other-keywords/main.fmf +++ b/selinux-policy/notself-other-keywords/main.fmf @@ -24,6 +24,7 @@ tag: - NoRHEL7 - NoRHEL8 - targeted + - NoRHIVOS adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-8 diff --git a/selinux-policy/ntpsec-and-similar/main.fmf b/selinux-policy/ntpsec-and-similar/main.fmf index 08273c8..e8ee0f3 100644 --- a/selinux-policy/ntpsec-and-similar/main.fmf +++ b/selinux-policy/ntpsec-and-similar/main.fmf @@ -30,6 +30,7 @@ tag: - epel - rhel9-epel - targeted + - NoRHIVOS tier: '3' link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2246805 diff --git a/selinux-policy/numad-and-similar/main.fmf b/selinux-policy/numad-and-similar/main.fmf index ec35de1..9c67835 100644 --- a/selinux-policy/numad-and-similar/main.fmf +++ b/selinux-policy/numad-and-similar/main.fmf @@ -33,6 +33,7 @@ tag: - Tier3se - TipWaived7 - targeted + - NoRHIVOS tier: '3' link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=807157 diff --git a/selinux-policy/nvme-stas-and-similar/main.fmf b/selinux-policy/nvme-stas-and-similar/main.fmf index a83654b..f58450e 100644 --- a/selinux-policy/nvme-stas-and-similar/main.fmf +++ b/selinux-policy/nvme-stas-and-similar/main.fmf @@ -30,6 +30,7 @@ tag: - NoRHEL7 - NoRHEL8 - targeted + - NoRHIVOS link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2111414 - verifies: https://issues.redhat.com/browse/RHEL-1557 diff --git a/selinux-policy/opensmtpd-and-similar/main.fmf b/selinux-policy/opensmtpd-and-similar/main.fmf index 9621bae..35120f9 100644 --- a/selinux-policy/opensmtpd-and-similar/main.fmf +++ b/selinux-policy/opensmtpd-and-similar/main.fmf @@ -31,6 +31,7 @@ tag: - epel - rhel8-epel - rhel9-epel + - NoRHIVOS link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2208696 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2246115 diff --git a/selinux-policy/pam_console-and-related/main.fmf b/selinux-policy/pam_console-and-related/main.fmf index dad130b..3428e12 100644 --- a/selinux-policy/pam_console-and-related/main.fmf +++ b/selinux-policy/pam_console-and-related/main.fmf @@ -38,6 +38,7 @@ tag: - TIPpass_Security - failinfedora - targeted + - NoRHIVOS link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=204986 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=251104 diff --git a/selinux-policy/pam_limits-and-related/main.fmf b/selinux-policy/pam_limits-and-related/main.fmf index aa244d1..c7f1024 100644 --- a/selinux-policy/pam_limits-and-related/main.fmf +++ b/selinux-policy/pam_limits-and-related/main.fmf @@ -35,6 +35,7 @@ tag: - NoRHEL6 - NoRHEL7 - targeted + - NoRHIVOS link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1958819 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2039453 diff --git a/selinux-policy/pam_timestamp-and-related/main.fmf b/selinux-policy/pam_timestamp-and-related/main.fmf index 8c37de8..62828c3 100644 --- a/selinux-policy/pam_timestamp-and-related/main.fmf +++ b/selinux-policy/pam_timestamp-and-related/main.fmf @@ -40,6 +40,7 @@ tag: - TIPpass_Security - f32friendly - targeted + - NoRHIVOS link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1791957 adjust: diff --git a/selinux-policy/pcp-daemons-and-similar/main.fmf b/selinux-policy/pcp-daemons-and-similar/main.fmf index 26a4295..960c4e5 100644 --- a/selinux-policy/pcp-daemons-and-similar/main.fmf +++ b/selinux-policy/pcp-daemons-and-similar/main.fmf @@ -34,6 +34,7 @@ tag: - f32friendly - failinfedora - targeted + - NoRHIVOS link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1028598 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1061159 diff --git a/selinux-policy/perf_event-and-related/main.fmf b/selinux-policy/perf_event-and-related/main.fmf index 0382ccc..2191e90 100644 --- a/selinux-policy/perf_event-and-related/main.fmf +++ b/selinux-policy/perf_event-and-related/main.fmf @@ -29,6 +29,7 @@ tag: - NoRHEL6 - NoRHEL7 - targeted + - NoRHIVOS link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1901957 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1901958 diff --git a/selinux-policy/ping-and-similar/main.fmf b/selinux-policy/ping-and-similar/main.fmf index ba31ab4..e178cb4 100644 --- a/selinux-policy/ping-and-similar/main.fmf +++ b/selinux-policy/ping-and-similar/main.fmf @@ -29,6 +29,7 @@ tag: - TIPpass_Security - TierCandidatesPASS - targeted + - NoRHIVOS link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1552128 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1596065 diff --git a/selinux-policy/policy-rpm-macros/main.fmf b/selinux-policy/policy-rpm-macros/main.fmf index 379dc76..e6c707e 100644 --- a/selinux-policy/policy-rpm-macros/main.fmf +++ b/selinux-policy/policy-rpm-macros/main.fmf @@ -24,6 +24,7 @@ tag: - Tier1se - f32friendly - targeted + - NoRHIVOS tier: '1' link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1380854 diff --git a/selinux-policy/restorecond-fcontext-equivalences/main.fmf b/selinux-policy/restorecond-fcontext-equivalences/main.fmf index 34be7a6..dbdcdf1 100644 --- a/selinux-policy/restorecond-fcontext-equivalences/main.fmf +++ b/selinux-policy/restorecond-fcontext-equivalences/main.fmf @@ -20,6 +20,7 @@ tag: - NoRHEL6 - NoRHEL7 - targeted + - NoRHIVOS link: - verifies: https://issues.redhat.com/browse/RHEL-5032 adjust: diff --git a/selinux-policy/rngd-and-similar/main.fmf b/selinux-policy/rngd-and-similar/main.fmf index bb3b859..f2a2dd0 100644 --- a/selinux-policy/rngd-and-similar/main.fmf +++ b/selinux-policy/rngd-and-similar/main.fmf @@ -35,6 +35,7 @@ tag: - f31friendly - f32friendly - targeted + - NoRHIVOS tier: '2' link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=869810 diff --git a/selinux-policy/rpc.idmapd-and-similar/main.fmf b/selinux-policy/rpc.idmapd-and-similar/main.fmf index 287ab2a..96114b1 100644 --- a/selinux-policy/rpc.idmapd-and-similar/main.fmf +++ b/selinux-policy/rpc.idmapd-and-similar/main.fmf @@ -30,6 +30,7 @@ tag: - Tier3se - targeted - failinfedora + - NoRHIVOS tier: '3' adjust: - enabled: false diff --git a/selinux-policy/rpmdb-and-similar/main.fmf b/selinux-policy/rpmdb-and-similar/main.fmf index 5d67459..0b2d45a 100644 --- a/selinux-policy/rpmdb-and-similar/main.fmf +++ b/selinux-policy/rpmdb-and-similar/main.fmf @@ -29,6 +29,7 @@ tag: - NoRHEL7 - NoRHEL8 - targeted + - NoRHIVOS link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1461313 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1899548 diff --git a/selinux-policy/rrdcached-service-and-related/main.fmf b/selinux-policy/rrdcached-service-and-related/main.fmf index d5d9fff..55ddd25 100644 --- a/selinux-policy/rrdcached-service-and-related/main.fmf +++ b/selinux-policy/rrdcached-service-and-related/main.fmf @@ -29,6 +29,7 @@ tag: - f32friendly - f33friendly - targeted + - NoRHIVOS link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1726255 adjust: diff --git a/selinux-policy/rsyslog-and-similar/main.fmf b/selinux-policy/rsyslog-and-similar/main.fmf index 17a3970..ac991cb 100644 --- a/selinux-policy/rsyslog-and-similar/main.fmf +++ b/selinux-policy/rsyslog-and-similar/main.fmf @@ -30,6 +30,7 @@ enabled: true tag: - NoRHEL4 - targeted + - NoRHIVOS link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1823669 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1823672 diff --git a/selinux-policy/rtkit-daemon-and-similar/main.fmf b/selinux-policy/rtkit-daemon-and-similar/main.fmf index 9e25d45..1b8bf17 100644 --- a/selinux-policy/rtkit-daemon-and-similar/main.fmf +++ b/selinux-policy/rtkit-daemon-and-similar/main.fmf @@ -34,6 +34,7 @@ tag: - f31friendly - f32friendly - targeted + - NoRHIVOS tier: '2' link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1626982 diff --git a/selinux-policy/smbcontrol-and-similar/main.fmf b/selinux-policy/smbcontrol-and-similar/main.fmf index fa5fb41..0c5ccda 100644 --- a/selinux-policy/smbcontrol-and-similar/main.fmf +++ b/selinux-policy/smbcontrol-and-similar/main.fmf @@ -29,6 +29,7 @@ tag: - f31friendly - f32friendly - targeted + - NoRHIVOS tier: '3' link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1326371 diff --git a/selinux-policy/snapd-and-similar/main.fmf b/selinux-policy/snapd-and-similar/main.fmf index 7b6a8c0..cb3e6d8 100644 --- a/selinux-policy/snapd-and-similar/main.fmf +++ b/selinux-policy/snapd-and-similar/main.fmf @@ -32,6 +32,7 @@ tag: - epel - rhel8-epel - rhel9-epel + - NoRHIVOS link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2207725 adjust: diff --git a/selinux-policy/sslh-and-similar/main.fmf b/selinux-policy/sslh-and-similar/main.fmf index 4cdaca8..4ba2649 100644 --- a/selinux-policy/sslh-and-similar/main.fmf +++ b/selinux-policy/sslh-and-similar/main.fmf @@ -33,6 +33,7 @@ tag: - failinfedora - epel - rhel8-epel + - NoRHIVOS link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1534624 adjust: diff --git a/selinux-policy/stalld-and-similar/main.fmf b/selinux-policy/stalld-and-similar/main.fmf index e80d301..9412a54 100644 --- a/selinux-policy/stalld-and-similar/main.fmf +++ b/selinux-policy/stalld-and-similar/main.fmf @@ -31,6 +31,7 @@ tag: - Tier2se - targeted - failinfedora + - NoRHIVOS tier: '2' link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2042614 diff --git a/selinux-policy/sudo-and-dnf/main.fmf b/selinux-policy/sudo-and-dnf/main.fmf index f1591fb..1309946 100644 --- a/selinux-policy/sudo-and-dnf/main.fmf +++ b/selinux-policy/sudo-and-dnf/main.fmf @@ -33,6 +33,7 @@ tag: - NoRHEL6 - NoRHEL7 - targeted + - NoRHIVOS link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2233065 - verifies: https://issues.redhat.com/browse/RHEL-1679 diff --git a/selinux-policy/sulogin-and-similar/main.fmf b/selinux-policy/sulogin-and-similar/main.fmf index 2211054..d69933e 100644 --- a/selinux-policy/sulogin-and-similar/main.fmf +++ b/selinux-policy/sulogin-and-similar/main.fmf @@ -26,6 +26,7 @@ tag: - NoRHEL6 - NoRHEL7 - targeted + - NoRHIVOS link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2265391 adjust: diff --git a/selinux-policy/swap-file-and-systemd-access/main.fmf b/selinux-policy/swap-file-and-systemd-access/main.fmf index 63fe4f2..2ffdf33 100644 --- a/selinux-policy/swap-file-and-systemd-access/main.fmf +++ b/selinux-policy/swap-file-and-systemd-access/main.fmf @@ -29,6 +29,7 @@ tag: - NoRHEL7 - TIPpass - targeted + - NoRHIVOS link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1367279 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1797543 diff --git a/selinux-policy/synce4l-and-similar/main.fmf b/selinux-policy/synce4l-and-similar/main.fmf index 440ca48..0b836fb 100644 --- a/selinux-policy/synce4l-and-similar/main.fmf +++ b/selinux-policy/synce4l-and-similar/main.fmf @@ -29,6 +29,7 @@ tag: - Tier3 - Tier3se - targeted + - NoRHIVOS tier: '3' link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2158402 diff --git a/selinux-policy/systemd-bootchart-and-similar/main.fmf b/selinux-policy/systemd-bootchart-and-similar/main.fmf index 3b36208..82ae6f6 100644 --- a/selinux-policy/systemd-bootchart-and-similar/main.fmf +++ b/selinux-policy/systemd-bootchart-and-similar/main.fmf @@ -26,6 +26,7 @@ tag: - NoRHEL5 - NoRHEL6 - targeted + - NoRHIVOS link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1757050 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1838163 diff --git a/selinux-policy/systemd-creds/main.fmf b/selinux-policy/systemd-creds/main.fmf index 41e08eb..9645849 100644 --- a/selinux-policy/systemd-creds/main.fmf +++ b/selinux-policy/systemd-creds/main.fmf @@ -24,6 +24,7 @@ tag: - Tier2 - Tier2se - targeted + - NoRHIVOS tier: '2' adjust: - enabled: false diff --git a/selinux-policy/systemd-generators/main.fmf b/selinux-policy/systemd-generators/main.fmf index 9374c7f..bf488b0 100644 --- a/selinux-policy/systemd-generators/main.fmf +++ b/selinux-policy/systemd-generators/main.fmf @@ -27,6 +27,7 @@ tag: - TierCandidatesPASS - f32friendly - targeted + - NoRHIVOS link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2230226 adjust: diff --git a/selinux-policy/systemd-homed/main.fmf b/selinux-policy/systemd-homed/main.fmf index c131f4c..b2b0cd1 100644 --- a/selinux-policy/systemd-homed/main.fmf +++ b/selinux-policy/systemd-homed/main.fmf @@ -28,3 +28,5 @@ extra-summary: /CoreOS/selinux-policy/Regression/systemd-homed extra-task: /CoreOS/selinux-policy/Regression/systemd-homed extra-nitrate: TC#0614608 id: 880ecade-0976-4303-a521-aead43e7f8c7 +tag: + - NoRHIVOS diff --git a/selinux-policy/systemd-localed/main.fmf b/selinux-policy/systemd-localed/main.fmf index 02d31cc..32970a4 100644 --- a/selinux-policy/systemd-localed/main.fmf +++ b/selinux-policy/systemd-localed/main.fmf @@ -26,6 +26,7 @@ tag: - NoRHEL6 - NoRHEL7 - targeted + - NoRHIVOS link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2240159 - verifies: https://issues.redhat.com/browse/RHEL-16715 diff --git a/selinux-policy/systemd-machined-and-similar/main.fmf b/selinux-policy/systemd-machined-and-similar/main.fmf index 7ba022c..778b593 100644 --- a/selinux-policy/systemd-machined-and-similar/main.fmf +++ b/selinux-policy/systemd-machined-and-similar/main.fmf @@ -29,6 +29,7 @@ tag: - NoRHEL7 - targeted - failinfedora + - NoRHIVOS link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1847545 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1900869 diff --git a/selinux-policy/systemd-modules-load-and-similar/main.fmf b/selinux-policy/systemd-modules-load-and-similar/main.fmf index feb4149..aa1b202 100644 --- a/selinux-policy/systemd-modules-load-and-similar/main.fmf +++ b/selinux-policy/systemd-modules-load-and-similar/main.fmf @@ -31,6 +31,7 @@ tag: - f33friendly - targeted - failinfedora + - NoRHIVOS link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1358526 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1358960 diff --git a/selinux-policy/systemd-notify-and-similar/main.fmf b/selinux-policy/systemd-notify-and-similar/main.fmf index 76e04c2..4ef8932 100644 --- a/selinux-policy/systemd-notify-and-similar/main.fmf +++ b/selinux-policy/systemd-notify-and-similar/main.fmf @@ -32,6 +32,7 @@ tag: - Tier2 - Tier2se - targeted + - NoRHIVOS tier: '2' link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1903305 diff --git a/selinux-policy/systemd-run-and-similar/main.fmf b/selinux-policy/systemd-run-and-similar/main.fmf index 6754cf4..0a1334c 100644 --- a/selinux-policy/systemd-run-and-similar/main.fmf +++ b/selinux-policy/systemd-run-and-similar/main.fmf @@ -30,6 +30,7 @@ tag: - Tier2 - Tier2se - targeted + - NoRHIVOS tier: '2' link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1559409 diff --git a/selinux-policy/systemd-timesyncd-and-similar/main.fmf b/selinux-policy/systemd-timesyncd-and-similar/main.fmf index c2976f2..ea2b783 100644 --- a/selinux-policy/systemd-timesyncd-and-similar/main.fmf +++ b/selinux-policy/systemd-timesyncd-and-similar/main.fmf @@ -35,6 +35,7 @@ tag: - rhel8-epel - rhel9-epel - targeted + - NoRHIVOS tier: '2' link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1640801 diff --git a/selinux-policy/systemd-userdbd-and-similar/main.fmf b/selinux-policy/systemd-userdbd-and-similar/main.fmf index c8d9998..6bf7f84 100644 --- a/selinux-policy/systemd-userdbd-and-similar/main.fmf +++ b/selinux-policy/systemd-userdbd-and-similar/main.fmf @@ -34,6 +34,7 @@ tag: - NoRHEL9 - failinfedora - targeted + - NoRHIVOS link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1835630 adjust: diff --git a/selinux-policy/targetd-and-similar/main.fmf b/selinux-policy/targetd-and-similar/main.fmf index 1d97e2f..df484b2 100644 --- a/selinux-policy/targetd-and-similar/main.fmf +++ b/selinux-policy/targetd-and-similar/main.fmf @@ -35,6 +35,7 @@ tag: - epel - rhel8-epel - targeted + - NoRHIVOS link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1063714 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1373860 diff --git a/selinux-policy/thttpd-and-similar/main.fmf b/selinux-policy/thttpd-and-similar/main.fmf index 6b601f7..a3ded57 100644 --- a/selinux-policy/thttpd-and-similar/main.fmf +++ b/selinux-policy/thttpd-and-similar/main.fmf @@ -33,6 +33,7 @@ tag: - targeted - epel - rhel8-epel + - NoRHIVOS tier: '2' link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1069843 diff --git a/selinux-policy/tlp-and-similar/main.fmf b/selinux-policy/tlp-and-similar/main.fmf index 2866515..010d91b 100644 --- a/selinux-policy/tlp-and-similar/main.fmf +++ b/selinux-policy/tlp-and-similar/main.fmf @@ -35,6 +35,7 @@ tag: - epel - rhel8-epel - rhel9-epel + - NoRHIVOS link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1460481 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2221019 diff --git a/selinux-policy/usbguard-daemon-and-similar/main.fmf b/selinux-policy/usbguard-daemon-and-similar/main.fmf index 4334a5f..c5b5b64 100644 --- a/selinux-policy/usbguard-daemon-and-similar/main.fmf +++ b/selinux-policy/usbguard-daemon-and-similar/main.fmf @@ -32,6 +32,7 @@ tag: - f33friendly - fedora-wanted - targeted + - NoRHIVOS link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1808527 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1840265 diff --git a/selinux-policy/usbmuxd-and-similar/main.fmf b/selinux-policy/usbmuxd-and-similar/main.fmf index 79a4c0c..11eaad3 100644 --- a/selinux-policy/usbmuxd-and-similar/main.fmf +++ b/selinux-policy/usbmuxd-and-similar/main.fmf @@ -32,6 +32,7 @@ tag: - f31friendly - f32friendly - targeted + - NoRHIVOS tier: '3' link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1521054 diff --git a/selinux-policy/virtualization-daemons/main.fmf b/selinux-policy/virtualization-daemons/main.fmf index 5f1b0a2..77e161b 100644 --- a/selinux-policy/virtualization-daemons/main.fmf +++ b/selinux-policy/virtualization-daemons/main.fmf @@ -42,6 +42,7 @@ tag: - NoRHEL8 - targeted - failinfedora + - NoRHIVOS adjust: - enabled: false when: distro < rhel-9 diff --git a/selinux-policy/watch-permissions/main.fmf b/selinux-policy/watch-permissions/main.fmf index d465382..1a6de54 100644 --- a/selinux-policy/watch-permissions/main.fmf +++ b/selinux-policy/watch-permissions/main.fmf @@ -27,3 +27,5 @@ adjust: because: the watch permission is not defined there extra-nitrate: TC#0615395 id: c4421242-0b97-4a1e-abbb-1dbe5dd21355 +tag: + - NoRHIVOS From 06b265a3ea6086f3b6391333bae90ef6ee5a15f1 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 11 Jun 2024 10:24:44 +0200 Subject: [PATCH 368/626] test if virt-admin can connect to all virt sub-daemons A recently filed bug report revealed that SELinux prevents the virt-admin command from connecting to various virtualization sub-daemons using the admin connection. The TC reproduces the situation. In order to support this virt-admin feature, I believe that SELinux policy should allow the access. The TC looks for appropriate policy rules. The TC covers BZ#2291273. --- selinux-policy/virtualization-daemons/Makefile | 3 ++- selinux-policy/virtualization-daemons/main.fmf | 3 +++ .../virtualization-daemons/runtest.sh | 18 ++++++++++++++++++ 3 files changed, 23 insertions(+), 1 deletion(-) diff --git a/selinux-policy/virtualization-daemons/Makefile b/selinux-policy/virtualization-daemons/Makefile index ffe4846..2a0aa27 100644 --- a/selinux-policy/virtualization-daemons/Makefile +++ b/selinux-policy/virtualization-daemons/Makefile @@ -55,7 +55,7 @@ $(METADATA): Makefile @echo "TestTime: 15m" >> $(METADATA) @echo "RunFor: libvirt" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console /usr/sbin/service libvirt-daemon libvirt-client libvirt-daemon-driver-interface libvirt-daemon-driver-libxl libvirt-daemon-driver-lxc libvirt-daemon-driver-network libvirt-daemon-driver-nodedev libvirt-daemon-driver-nwfilter libvirt-daemon-driver-qemu libvirt-daemon-driver-secret libvirt-daemon-driver-storage-core libvirt-daemon-driver-vbox">> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console /usr/sbin/service libvirt-daemon libvirt-daemon-common libvirt-client libvirt-daemon-driver-interface libvirt-daemon-driver-libxl libvirt-daemon-driver-lxc libvirt-daemon-driver-network libvirt-daemon-driver-nodedev libvirt-daemon-driver-nwfilter libvirt-daemon-driver-qemu libvirt-daemon-driver-secret libvirt-daemon-driver-storage-core libvirt-daemon-driver-vbox">> $(METADATA) @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @@ -63,6 +63,7 @@ $(METADATA): Makefile @echo "Confidential: no" >> $(METADATA) @echo "Destructive: no" >> $(METADATA) @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) + @echo "Bug: 2291273" >> $(METADATA) # Fedora 41 rhts-lint $(METADATA) diff --git a/selinux-policy/virtualization-daemons/main.fmf b/selinux-policy/virtualization-daemons/main.fmf index 77e161b..3df3ce2 100644 --- a/selinux-policy/virtualization-daemons/main.fmf +++ b/selinux-policy/virtualization-daemons/main.fmf @@ -20,6 +20,7 @@ recommend: - /usr/sbin/service - libvirt-client - libvirt-daemon + - libvirt-daemon-common - libvirt-daemon-driver-interface - libvirt-daemon-driver-libxl - libvirt-daemon-driver-lxc @@ -34,6 +35,8 @@ environment: AVC_ERROR: +no_avc_check duration: 15m enabled: true +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2291273 tag: - NoRHEL4 - NoRHEL5 diff --git a/selinux-policy/virtualization-daemons/runtest.sh b/selinux-policy/virtualization-daemons/runtest.sh index 042b365..2cae433 100755 --- a/selinux-policy/virtualization-daemons/runtest.sh +++ b/selinux-policy/virtualization-daemons/runtest.sh @@ -128,6 +128,7 @@ rlJournalStart PROCESS_CONTEXT=`echo ${TUPLE} | cut -d : -f 3` if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status" 1 + rlRun "virt-admin -c ${SERVICE_NAME}:///system exit" 0,1 fi done # stop all the services @@ -141,6 +142,23 @@ rlJournalStart done rlPhaseEnd + if seinfo -a | grep -q virt_driver_domain ; then + rlPhaseStartTest "bz#2291273" + rlSESearchRule "allow virtnetworkd_t unconfined_t : dir { search } [ ]" + rlSESearchRule "allow virtnetworkd_t unconfined_t : file { open read } [ ]" + rlSESearchRule "allow virtnodedevd_t unconfined_t : dir { search } [ ]" + rlSESearchRule "allow virtnodedevd_t unconfined_t : file { open read } [ ]" + rlSESearchRule "allow virtnwfilterd_t unconfined_t : dir { search } [ ]" + rlSESearchRule "allow virtnwfilterd_t unconfined_t : file { open read } [ ]" + rlSESearchRule "allow virtsecretd_t unconfined_t : dir { search } [ ]" + rlSESearchRule "allow virtsecretd_t unconfined_t : file { open read } [ ]" + rlSESearchRule "allow virtstoraged_t unconfined_t : dir { search } [ ]" + rlSESearchRule "allow virtstoraged_t unconfined_t : file { open read } [ ]" + rlSESearchRule "allow virtvboxd_t unconfined_t : dir { search } [ ]" + rlSESearchRule "allow virtvboxd_t unconfined_t : file { open read } [ ]" + rlPhaseEnd + fi + rlPhaseStartCleanup sleep 2 rlSECheckAVC From 12c66e8685d25efefa10d3bcc9eab879e31fc44e Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Wed, 19 Jun 2024 13:42:52 +0200 Subject: [PATCH 369/626] do not run the anon_inode test on s390x machines The automated test causes problems when executed on s390x machines. From now on, the test should not be executed there. --- selinux-policy/anon_inode-and-similar/Makefile | 1 + selinux-policy/anon_inode-and-similar/main.fmf | 3 +++ 2 files changed, 4 insertions(+) diff --git a/selinux-policy/anon_inode-and-similar/Makefile b/selinux-policy/anon_inode-and-similar/Makefile index e6d8ba8..9efa34d 100644 --- a/selinux-policy/anon_inode-and-similar/Makefile +++ b/selinux-policy/anon_inode-and-similar/Makefile @@ -60,6 +60,7 @@ $(METADATA): Makefile @echo "License: GPLv2" >> $(METADATA) @echo "Confidential: no" >> $(METADATA) @echo "Destructive: no" >> $(METADATA) + @echo "Architectures: aarch64 ppc64le x86_64" >> $(METADATA) @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) @echo "Releases: -RHEL4" >> $(METADATA) @echo "Bug: 1954145" >> $(METADATA) # RHEL-9 diff --git a/selinux-policy/anon_inode-and-similar/main.fmf b/selinux-policy/anon_inode-and-similar/main.fmf index 632ca36..a94c107 100644 --- a/selinux-policy/anon_inode-and-similar/main.fmf +++ b/selinux-policy/anon_inode-and-similar/main.fmf @@ -43,6 +43,9 @@ adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8 because: the anon_inode class is not defined there + - enabled: false + when: distro == s390, s390x + because: the automated test gets stuck there extra-nitrate: TC#0612643 extra-summary: /CoreOS/selinux-policy/Regression/anon_inode-and-similar extra-task: /CoreOS/selinux-policy/Regression/anon_inode-and-similar From 725813a7afd252a4a93b56c74a88bb90a239b947 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Thu, 13 Jun 2024 15:06:10 +0200 Subject: [PATCH 370/626] update relevancy of the bootupd test The bootupd package is built for the following architectures: * aarch64 * ppc64le * s390x * x86_64 The automated TC should be executed on these architectures too. --- selinux-policy/bootupd-and-similar/Makefile | 1 + selinux-policy/bootupd-and-similar/PURPOSE | 2 +- selinux-policy/bootupd-and-similar/main.fmf | 4 +--- selinux-policy/bootupd-and-similar/runtest.sh | 4 ++-- 4 files changed, 5 insertions(+), 6 deletions(-) diff --git a/selinux-policy/bootupd-and-similar/Makefile b/selinux-policy/bootupd-and-similar/Makefile index 3d0b32d..c7e9ff5 100644 --- a/selinux-policy/bootupd-and-similar/Makefile +++ b/selinux-policy/bootupd-and-similar/Makefile @@ -66,6 +66,7 @@ $(METADATA): Makefile @echo "Bug: 2044508" >> $(METADATA) # RHEL-9 @echo "Bug: 2218106" >> $(METADATA) # Fedora rawhide @echo "Bug: RHEL-36289" >> $(METADATA) # RHEL-9 + @echo "Bug: RHEL-39514" >> $(METADATA) # RHEL-10 rhts-lint $(METADATA) diff --git a/selinux-policy/bootupd-and-similar/PURPOSE b/selinux-policy/bootupd-and-similar/PURPOSE index 2fbf806..d1f7895 100644 --- a/selinux-policy/bootupd-and-similar/PURPOSE +++ b/selinux-policy/bootupd-and-similar/PURPOSE @@ -2,5 +2,5 @@ PURPOSE of /CoreOS/selinux-policy/Regression/bootupd-and-similar Description: SELinux interferes with the bootupd service and related programs Author: Milos Malik -The TC needs a machine with EFI for successful run. +The TC needs a machine with EFI for a successful run. diff --git a/selinux-policy/bootupd-and-similar/main.fmf b/selinux-policy/bootupd-and-similar/main.fmf index 2dade23..54fa5e9 100644 --- a/selinux-policy/bootupd-and-similar/main.fmf +++ b/selinux-policy/bootupd-and-similar/main.fmf @@ -37,13 +37,11 @@ link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2044508 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2218106 - verifies: https://issues.redhat.com/browse/RHEL-36289 + - verifies: https://issues.redhat.com/browse/RHEL-39514 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8 because: the package is not available there - - enabled: false - when: arch == ppc64, ppc64le, s390x - because: the package is not built for all architectures extra-summary: /CoreOS/selinux-policy/Regression/bootupd-and-similar extra-task: /CoreOS/selinux-policy/Regression/bootupd-and-similar extra-nitrate: TC#0614833 diff --git a/selinux-policy/bootupd-and-similar/runtest.sh b/selinux-policy/bootupd-and-similar/runtest.sh index 99d2510..5e61d7b 100755 --- a/selinux-policy/bootupd-and-similar/runtest.sh +++ b/selinux-policy/bootupd-and-similar/runtest.sh @@ -74,7 +74,7 @@ rlJournalStart rlSESearchRule "allow ${PROCESS_CONTEXT} dosfs_t : dir { getattr search } [ ]" rlPhaseEnd - rlPhaseStartTest "RHEL-36289" + rlPhaseStartTest "RHEL-36289 + RHEL-39514" rlSEMatchPathCon "/usr/libexec/bootupd" "${FILE_CONTEXT}" if [ -d /sys/firmware/efi/efivars ] ; then rlRun "ls -RlZ /sys/firmware/efi/efivars" @@ -84,7 +84,7 @@ rlJournalStart rlPhaseStartTest "real scenario -- standalone service" if ! rlSEDefined ${PROCESS_CONTEXT} ; then - # for RHELs where the SELinux domain does not exist yet + # for OSes where the SELinux domain does not exist yet PROCESS_CONTEXT="unconfined_service_t" fi rlRun "systemctl start ${SERVICE_NAME}.socket" From bbea4d16a352bf3702b646d82f361fcf95d6a7ad Mon Sep 17 00:00:00 2001 From: Zdenek Pytela Date: Tue, 18 Jun 2024 10:55:20 +0200 Subject: [PATCH 371/626] Use "${PREFIX}/run/named" for context check Change context check from "${PREFIX}/var/run/named" to "${PREFIX}/run/named" which matches the actual filesystem state created and used by the bind-chroot service. --- selinux-policy/bz562833-chrooted-named-file-contexts/runtest.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/selinux-policy/bz562833-chrooted-named-file-contexts/runtest.sh b/selinux-policy/bz562833-chrooted-named-file-contexts/runtest.sh index 1c88600..7b6ddd4 100755 --- a/selinux-policy/bz562833-chrooted-named-file-contexts/runtest.sh +++ b/selinux-policy/bz562833-chrooted-named-file-contexts/runtest.sh @@ -60,12 +60,12 @@ rlJournalStart rlSEMatchPathCon "${PREFIX}/dev/random" "random_device_t" rlSEMatchPathCon "${PREFIX}/dev/zero" "zero_device_t" rlSEMatchPathCon "${PREFIX}/etc/named.conf" "named_conf_t" + rlSEMatchPathCon "${PREFIX}/run/named" "named_var_run_t" rlSEMatchPathCon "${PREFIX}/var/log" "var_log_t" rlSEMatchPathCon "${PREFIX}/var/log/named.log" "named_log_t" rlSEMatchPathCon "${PREFIX}/var/named/data" "named_cache_t" rlSEMatchPathCon "${PREFIX}/var/named/slaves" "named_cache_t" rlSEMatchPathCon "${PREFIX}/var/named" "named_zone_t" - rlSEMatchPathCon "${PREFIX}/var/run/named" "named_var_run_t" done rlPhaseEnd From 0a9a89b02103b24d23cf9e22eaf04aeec5b49318 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Thu, 13 Jun 2024 17:28:27 +0200 Subject: [PATCH 372/626] add a basic test which covers systemd-nsresourced Recently, the systemd-nsresourced program became confined by SELinux. Purpose of this TC is to test the basic systemd-nsresourced scenarios. The TC looks for appropriate policy rules and file context patterns. The TC covers BZ#2290477. --- .../systemd-nsresourced-and-similar/Makefile | 68 +++++++++++ .../systemd-nsresourced-and-similar/PURPOSE | 5 + .../systemd-nsresourced-and-similar/main.fmf | 46 ++++++++ .../runtest.sh | 111 ++++++++++++++++++ 4 files changed, 230 insertions(+) create mode 100644 selinux-policy/systemd-nsresourced-and-similar/Makefile create mode 100644 selinux-policy/systemd-nsresourced-and-similar/PURPOSE create mode 100644 selinux-policy/systemd-nsresourced-and-similar/main.fmf create mode 100755 selinux-policy/systemd-nsresourced-and-similar/runtest.sh diff --git a/selinux-policy/systemd-nsresourced-and-similar/Makefile b/selinux-policy/systemd-nsresourced-and-similar/Makefile new file mode 100644 index 0000000..48094f3 --- /dev/null +++ b/selinux-policy/systemd-nsresourced-and-similar/Makefile @@ -0,0 +1,68 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/systemd-nsresourced-and-similar +# Description: SELinux interferes with systemd-nsresourced and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2024 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/systemd-nsresourced-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with systemd-nsresourced and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console systemd /usr/sbin/service nmap-ncat" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8 -RHEL9" >> $(METADATA) + @echo "Bug: 2290477" >> $(METADATA) # Fedora 41 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/systemd-nsresourced-and-similar/PURPOSE b/selinux-policy/systemd-nsresourced-and-similar/PURPOSE new file mode 100644 index 0000000..7b0591c --- /dev/null +++ b/selinux-policy/systemd-nsresourced-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/systemd-nsresourced-and-similar +Author: Milos Malik + +SELinux interferes with systemd-nsresourced and related programs + diff --git a/selinux-policy/systemd-nsresourced-and-similar/main.fmf b/selinux-policy/systemd-nsresourced-and-similar/main.fmf new file mode 100644 index 0000000..307d47f --- /dev/null +++ b/selinux-policy/systemd-nsresourced-and-similar/main.fmf @@ -0,0 +1,46 @@ +summary: SELinux interferes with systemd-nsresourced and related programs +description: |+ + SELinux interferes with systemd-nsresourced and related programs. + +contact: Milos Malik +component: + - selinux-policy +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - systemd + - /usr/sbin/service + - nmap-ncat +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - NoRHEL8 + - NoRHEL9 + - targeted + - NoRHIVOS +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2290477 +adjust: + - enabled: false + when: distro <= fedora-40 + continue: false + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, rhel-9 + continue: false +extra-summary: /CoreOS/selinux-policy/Regression/systemd-nsresourced-and-similar +extra-task: /CoreOS/selinux-policy/Regression/systemd-nsresourced-and-similar +extra-nitrate: TC#0617562 +id: fec4eaaf-8812-4d12-b915-e8dd2228d895 diff --git a/selinux-policy/systemd-nsresourced-and-similar/runtest.sh b/selinux-policy/systemd-nsresourced-and-similar/runtest.sh new file mode 100755 index 0000000..383afad --- /dev/null +++ b/selinux-policy/systemd-nsresourced-and-similar/runtest.sh @@ -0,0 +1,111 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/systemd-nsresourced-and-similar +# Description: SELinux interferes with systemd-nsresourced and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2024 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +FILE_PATH="/usr/lib/systemd/systemd-nsresourced" +FILE_CONTEXT="systemd_nsresourced_exec_t" +SERVICE_PACKAGE="systemd" +SERVICE_NAME="systemd-nsresourced" +PROCESS_NAME="systemd-nsresourced" +PROCESS_CONTEXT="systemd_nsresourced_t" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} + rlFileBackup /etc/shadow + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "bz#2290477" + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + SOURCE_TYPE="init_t" # systemd runs the process + rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" + rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" + rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" + rlSESearchRule "allow abrt_t systemd_nsresourced_t : unix_stream_socket { connectto } [ ]" + rlSESearchRule "allow accountsd_t systemd_nsresourced_t : unix_stream_socket { connectto } [ ]" + rlSESearchRule "allow auditd_t systemd_nsresourced_t : unix_stream_socket { connectto } [ ]" + rlSESearchRule "allow cupsd_t systemd_nsresourced_t : unix_stream_socket { connectto } [ ]" + rlSESearchRule "allow init_t systemd_nsresourced_t : unix_stream_socket { connectto } [ ]" + rlSESearchRule "allow local_login_t systemd_nsresourced_t : unix_stream_socket { connectto } [ ]" + rlSESearchRule "allow policykit_auth_t systemd_nsresourced_t : unix_stream_socket { connectto } [ ]" + rlSESearchRule "allow setroubleshootd_t systemd_nsresourced_t : unix_stream_socket { connectto } [ ]" + rlSESearchRule "allow staff_t systemd_nsresourced_t : unix_stream_socket { connectto } [ ]" + rlSESearchRule "allow xdm_t systemd_nsresourced_t : unix_stream_socket { connectto } [ ]" + rlPhaseEnd + + rlPhaseStartTest "real scenario -- standalone service" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + # for OSes where the SELinux domain does not exist yet + PROCESS_CONTEXT="unconfined_service_t" + fi + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /var /run -e /var/ARTIFACTS" 0-255 + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + + rlPhaseStartTest "real scenario -- socket activation" + rlRun "systemctl enable ${SERVICE_NAME}.socket" + rlRun "systemctl start ${SERVICE_NAME}.socket" + ( tail -f - | ncat -U /run/systemd/io.systemd.NamespaceResource ) & + PROVOCATEUR_PID=$! + sleep 1 + rlRun "ps -o pid,user,context,args -C ${PROCESS_NAME}" + rlRun "ps -o pid,user,context,args -C ${PROCESS_NAME} | grep :${PROCESS_CONTEXT}" + rlRun "kill -9 ${PROVOCATEUR_PID}" + rlRun "killall ncat" 0,1 + if pgrep ncat >& /dev/null ; then + rlRun "killall ncat" 0-255 + fi + rlRun "systemctl stop ${SERVICE_NAME}.socket" + rlRun "systemctl disable ${SERVICE_NAME}.socket" + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + From ba1ba298ba9205da7d06205ef126af2c87ce9068 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Thu, 20 Jun 2024 17:55:09 +0200 Subject: [PATCH 373/626] add a basic test which covers systemd-tmpfiles A recently filed Jira issue revealed that SELinux prevents staff_u users from executing the systemd-tmpfiles program (via the following service: /usr/lib/systemd/user/systemd-tmpfiles-setup.service). The TC reproduces the situation. In order to support the systemd-tmpfiles-setup.service functions for confined users, I believe that SELinux policy should allow the access described above. The TC looks for appropriate policy rules and file context patterns. The TC covers RHEL-40374 and RHEL-44191. --- .../systemd-tmpfiles-and-similar/Makefile | 69 +++++++++++++++ .../systemd-tmpfiles-and-similar/PURPOSE | 5 ++ .../systemd-tmpfiles-and-similar/main.fmf | 48 +++++++++++ .../systemd-tmpfiles-and-similar/runtest.sh | 83 +++++++++++++++++++ .../systemd-tmpfiles-and-similar/ssh.exp | 20 +++++ 5 files changed, 225 insertions(+) create mode 100644 selinux-policy/systemd-tmpfiles-and-similar/Makefile create mode 100644 selinux-policy/systemd-tmpfiles-and-similar/PURPOSE create mode 100644 selinux-policy/systemd-tmpfiles-and-similar/main.fmf create mode 100755 selinux-policy/systemd-tmpfiles-and-similar/runtest.sh create mode 100755 selinux-policy/systemd-tmpfiles-and-similar/ssh.exp diff --git a/selinux-policy/systemd-tmpfiles-and-similar/Makefile b/selinux-policy/systemd-tmpfiles-and-similar/Makefile new file mode 100644 index 0000000..fd16134 --- /dev/null +++ b/selinux-policy/systemd-tmpfiles-and-similar/Makefile @@ -0,0 +1,69 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/systemd-tmpfiles-and-similar +# Description: SELinux interferes with systemd-tmpfiles and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2024 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/systemd-tmpfiles-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE ssh.exp + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh ssh.exp + chcon -t bin_t runtest.sh ssh.exp + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with systemd-tmpfiles and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit expect libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console systemd /usr/sbin/service shadow-utils" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) + @echo "Bug: RHEL-40374" >> $(METADATA) # RHEL-9 + @echo "Bug: RHEL-44191" >> $(METADATA) # RHEL-10 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/systemd-tmpfiles-and-similar/PURPOSE b/selinux-policy/systemd-tmpfiles-and-similar/PURPOSE new file mode 100644 index 0000000..6f0cf3c --- /dev/null +++ b/selinux-policy/systemd-tmpfiles-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/systemd-tmpfiles-and-similar +Author: Milos Malik + +SELinux interferes with systemd-tmpfiles and related programs. + diff --git a/selinux-policy/systemd-tmpfiles-and-similar/main.fmf b/selinux-policy/systemd-tmpfiles-and-similar/main.fmf new file mode 100644 index 0000000..37bd8f2 --- /dev/null +++ b/selinux-policy/systemd-tmpfiles-and-similar/main.fmf @@ -0,0 +1,48 @@ +summary: SELinux interferes with systemd-tmpfiles and related programs +description: |+ + SELinux interferes with systemd-tmpfiles and related programs + +contact: Milos Malik +component: + - selinux-policy +test: ./runtest.sh +framework: beakerlib +require: + - library(selinux-policy/common) +recommend: + - audit + - expect + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - systemd + - /usr/sbin/service + - shadow-utils +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - Tier2 + - Tier2se + - targeted + - NoRHIVOS +tier: '2' +link: + - verifies: https://issues.redhat.com/browse/RHEL-40374 + - verifies: https://issues.redhat.com/browse/RHEL-44191 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + continue: false +extra-summary: /CoreOS/selinux-policy/Regression/systemd-tmpfiles-and-similar +extra-task: /CoreOS/selinux-policy/Regression/systemd-tmpfiles-and-similar +extra-nitrate: TC#0617577 +id: 03d8e784-9026-46ef-a48b-0bbed63f7f95 diff --git a/selinux-policy/systemd-tmpfiles-and-similar/runtest.sh b/selinux-policy/systemd-tmpfiles-and-similar/runtest.sh new file mode 100755 index 0000000..7f2e944 --- /dev/null +++ b/selinux-policy/systemd-tmpfiles-and-similar/runtest.sh @@ -0,0 +1,83 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/systemd-tmpfiles-and-similar +# Description: SELinux interferes with systemd-tmpfiles and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2024 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +SERVICE_PACKAGE="systemd" +ALLOWED_USERS="staff_u sysadm_u unconfined_u" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlSEConfigureSSH + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "RHEL-40374 + RHEL-44191" + rlSEMatchPathCon "/usr/bin/systemd-tmpfiles" "systemd_tmpfiles_exec_t" + rlSESearchRule "allow staff_t systemd_tmpfiles_exec_t : file { getattr open read map execute execute_no_trans } [ ]" + rlRun "setsebool ssh_sysadm_login on" + CREATED_USERS="" + for SELINUX_USER in ${ALLOWED_USERS} ; do + USER_NAME="user${RANDOM}" + USER_SECRET="S3kr3t${RANDOM}" + rlRun "useradd -Z ${SELINUX_USER} ${USER_NAME}" + rlRun "echo ${USER_SECRET} | passwd --stdin ${USER_NAME}" + rlRun "restorecon -Rv /home/${USER_NAME}" + rlRun -s "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost systemctl --no-pager --user status systemd-tmpfiles-setup.service" + rlRun "grep -i failed $rlRun_LOG" 1 + rm -f $rlRun_LOG + rlRun -s "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost systemctl --no-pager --user --failed" + rlRun "grep '0 loaded units listed' $rlRun_LOG" + rm -f $rlRun_LOG + CREATED_USERS="${USER_NAME} ${CREATED_USERS}" + done + rlRun "setsebool ssh_sysadm_login off" + for USER_NAME in ${CREATED_USERS} ; do + rlRun "userdel -rfZ ${USER_NAME}" + done + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/selinux-policy/systemd-tmpfiles-and-similar/ssh.exp b/selinux-policy/systemd-tmpfiles-and-similar/ssh.exp new file mode 100755 index 0000000..58c9647 --- /dev/null +++ b/selinux-policy/systemd-tmpfiles-and-similar/ssh.exp @@ -0,0 +1,20 @@ +#!/usr/bin/expect -f +# Expect script for SSH logging as $username to $hostname using $password and executing $command. +# Usage: +# ./ssh.exp username password hostname command +set username [lrange $argv 0 0] +set password [lrange $argv 1 1] +set hostname [lrange $argv 2 2] +set command [lrange $argv 3 10] +set timeout 15 +# connect to remote host and execute given command +log_user 1 +spawn ssh -t $username@$hostname $command +expect { + -nocase "yes/no" { send -- "yes\r" ; exp_continue } + -nocase "password" { send -- "$password\r" } +} +log_user 1 +# send -- "\r" +expect eof + From 1800d749613d672b0bac3674e4dad0b0dbf5ea16 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 9 Jul 2024 13:52:52 +0200 Subject: [PATCH 374/626] test if matchpathcon works fine in chroot environment A recent anaconda testing on Fedora rawhide machines revealed a regression in the libselinux code which leads to segfaults. The TC reproduces the situation. The TC uses 2 reproducers (python code, binary command) to find out if the problem is present or not. Both of them should pass when the problem is fixed. The TC covers BZ#2295428 and RHEL-46558. --- .../matchpathcon-in-chroot-env/Makefile | 67 +++++++++++++++++++ libselinux/matchpathcon-in-chroot-env/PURPOSE | 5 ++ .../matchpathcon-in-chroot-env/main.fmf | 27 ++++++++ .../matchpathcon-in-chroot-env/runtest.sh | 62 +++++++++++++++++ .../matchpathcon-in-chroot-env/test-script.py | 8 +++ .../matchpathcon-in-chroot-env/test-script.sh | 5 ++ 6 files changed, 174 insertions(+) create mode 100644 libselinux/matchpathcon-in-chroot-env/Makefile create mode 100644 libselinux/matchpathcon-in-chroot-env/PURPOSE create mode 100644 libselinux/matchpathcon-in-chroot-env/main.fmf create mode 100755 libselinux/matchpathcon-in-chroot-env/runtest.sh create mode 100755 libselinux/matchpathcon-in-chroot-env/test-script.py create mode 100755 libselinux/matchpathcon-in-chroot-env/test-script.sh diff --git a/libselinux/matchpathcon-in-chroot-env/Makefile b/libselinux/matchpathcon-in-chroot-env/Makefile new file mode 100644 index 0000000..0028f3e --- /dev/null +++ b/libselinux/matchpathcon-in-chroot-env/Makefile @@ -0,0 +1,67 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/libselinux/Regression/matchpathcon-in-chroot-env +# Description: Does matchpathcon work correctly in chroot environment? +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2024 Red Hat, Inc. +# +# This program is free software: you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation, either version 2 of +# the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see http://www.gnu.org/licenses/. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/libselinux/Regression/matchpathcon-in-chroot-env +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE test-script.sh test-script.py + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + test -x runtest.sh || chmod a+x runtest.sh + test -x test-script.sh || chmod a+x test-script.sh + test -x test-script.py || chmod a+x test-script.py + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: Does matchpathcon work correctly in chroot environment?" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 15m" >> $(METADATA) + @echo "RunFor: libselinux" >> $(METADATA) + @echo "Requires: policycoreutils libselinux libselinux-utils python3-libselinux" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2+" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) + @echo "Bug: 2295428" >> $(METADATA) # Fedora 41 + @echo "Bug: RHEL-46558" >> $(METADATA) # RHEL-10 + + rhts-lint $(METADATA) + diff --git a/libselinux/matchpathcon-in-chroot-env/PURPOSE b/libselinux/matchpathcon-in-chroot-env/PURPOSE new file mode 100644 index 0000000..7cbb17e --- /dev/null +++ b/libselinux/matchpathcon-in-chroot-env/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/libselinux/Regression/matchpathcon-in-chroot-env +Author: Milos Malik + +Does matchpathcon work correctly in chroot environment? + diff --git a/libselinux/matchpathcon-in-chroot-env/main.fmf b/libselinux/matchpathcon-in-chroot-env/main.fmf new file mode 100644 index 0000000..edc58c1 --- /dev/null +++ b/libselinux/matchpathcon-in-chroot-env/main.fmf @@ -0,0 +1,27 @@ +summary: Does matchpathcon work correctly in chroot environment? +description: | + Does matchpathcon work correctly in chroot environment? + +contact: Milos Malik +component: + - libselinux +test: ./runtest.sh +framework: beakerlib +recommend: + - libselinux + - libselinux-utils + - python3-libselinux + - policycoreutils +duration: 15m +enabled: true +tier: '1' +tag: + - targeted + - CI-Tier-1 + - NoRHIVOS +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2295428 + - verifies: https://issues.redhat.com/browse/RHEL-46558 +extra-summary: /CoreOS/libselinux/Regression/matchpathcon-in-chroot-env +extra-task: /CoreOS/libselinux/Regression/matchpathcon-in-chroot-env + diff --git a/libselinux/matchpathcon-in-chroot-env/runtest.sh b/libselinux/matchpathcon-in-chroot-env/runtest.sh new file mode 100755 index 0000000..e273569 --- /dev/null +++ b/libselinux/matchpathcon-in-chroot-env/runtest.sh @@ -0,0 +1,62 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/libselinux/Regression/matchpathcon-in-chroot-env +# Description: Does matchpathcon work correctly in chroot environment? +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2024 Red Hat, Inc. +# +# This program is free software: you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation, either version 2 of +# the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see http://www.gnu.org/licenses/. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="libselinux" +CHROOT_DIR=`mktemp -d` +if rlIsFedora ; then + INSTALL_OPTION="--use-host-config" +fi + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-utils + rlPhaseEnd + + rlPhaseStartTest "bz#2295428 + RHEL-46558" + rlRun "yum -y install filesystem libselinux libselinux-utils python3-libselinux policycoreutils --installroot=${CHROOT_DIR} ${INSTALL_OPTION}" + rlRun "dmesg -c >& /dev/null" + rlRun "cp ./test-script.sh ${CHROOT_DIR}/usr/bin/" + rlRun -s "chroot ${CHROOT_DIR} /usr/bin/test-script.sh" + rlRun "grep -i -e 'segmentation' -e 'fault' $rlRun_LOG" 1 + rm -f $rlRun_LOG + rlRun "cp ./test-script.py ${CHROOT_DIR}/usr/bin/" + rlRun -s "chroot ${CHROOT_DIR} /usr/bin/test-script.py" + rlRun "grep -i -e 'segmentation' -e 'fault' $rlRun_LOG" 1 + rm -f $rlRun_LOG + rlRun "dmesg" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "rm -rf ${CHROOT_DIR}" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + diff --git a/libselinux/matchpathcon-in-chroot-env/test-script.py b/libselinux/matchpathcon-in-chroot-env/test-script.py new file mode 100755 index 0000000..630741f --- /dev/null +++ b/libselinux/matchpathcon-in-chroot-env/test-script.py @@ -0,0 +1,8 @@ +#!/usr/bin/python3 + +import selinux +try: + selinux.matchpathcon("/dev", 16384) +except FileNotFoundError as e: + print(e) + diff --git a/libselinux/matchpathcon-in-chroot-env/test-script.sh b/libselinux/matchpathcon-in-chroot-env/test-script.sh new file mode 100755 index 0000000..77ee72f --- /dev/null +++ b/libselinux/matchpathcon-in-chroot-env/test-script.sh @@ -0,0 +1,5 @@ +#!/bin/bash + +sestatus +matchpathcon /dev ; true + From c4bc437c3f9251c1f61d89698e94e38c34a65da9 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Mon, 15 Apr 2024 12:20:37 +0200 Subject: [PATCH 375/626] Improve README - rename to README.md - add basic instruction how to run tests on localhost Signed-off-by: Petr Lautrbach --- README.md | 16 ++++++++++++++++ README.rst | 0 2 files changed, 16 insertions(+) create mode 100644 README.md delete mode 100644 README.rst diff --git a/README.md b/README.md new file mode 100644 index 0000000..cd129dc --- /dev/null +++ b/README.md @@ -0,0 +1,16 @@ +# SELinux tests + +This repository contains set of test for SELinux kernel, userspace and policy. +Tests are written using [beakerlib](https://github.com/beakerlib/beakerlib) with [TMT Metadata Specification](https://tmt.readthedocs.io/en/latest/spec.html). + +## Plans + + $ tmt plans + Found 5 plans: /plans/ci, /plans/reboot, /plans/tier1, /plans/tier2 and /plans/tier3. + +## Usage + +Run `tier1` on `localhost`: + + # tmt run provision -h local prepare plans -n /plans/tier1 discover execute + # tmt run -l report -h display -v diff --git a/README.rst b/README.rst deleted file mode 100644 index e69de29..0000000 From 3e4943c5966f2bdfdfbbf203b9218c174de5f58c Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Wed, 10 Jul 2024 18:25:32 +0200 Subject: [PATCH 376/626] add missing metadata to the tests Some tests were missing important TCMS metadata. Now, the problem should be fixed. --- libselinux/matchpathcon-in-chroot-env/main.fmf | 3 ++- libselinux/setfiles-in-chroot-env/main.fmf | 2 +- libselinux/setfiles-in-chroot-env/runtest.sh | 5 ++++- policycoreutils/sctp_test/main.fmf | 1 + 4 files changed, 8 insertions(+), 3 deletions(-) diff --git a/libselinux/matchpathcon-in-chroot-env/main.fmf b/libselinux/matchpathcon-in-chroot-env/main.fmf index edc58c1..d671bcf 100644 --- a/libselinux/matchpathcon-in-chroot-env/main.fmf +++ b/libselinux/matchpathcon-in-chroot-env/main.fmf @@ -24,4 +24,5 @@ link: - verifies: https://issues.redhat.com/browse/RHEL-46558 extra-summary: /CoreOS/libselinux/Regression/matchpathcon-in-chroot-env extra-task: /CoreOS/libselinux/Regression/matchpathcon-in-chroot-env - +extra-nitrate: TC#0617627 +id: 649c1bfa-1739-4d87-8799-f37fd30499f4 diff --git a/libselinux/setfiles-in-chroot-env/main.fmf b/libselinux/setfiles-in-chroot-env/main.fmf index b5a9ced..9c3dae5 100644 --- a/libselinux/setfiles-in-chroot-env/main.fmf +++ b/libselinux/setfiles-in-chroot-env/main.fmf @@ -19,4 +19,4 @@ link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2094683 extra-summary: /CoreOS/libselinux/Regression/setfiles-in-chroot-env extra-task: /CoreOS/libselinux/Regression/setfiles-in-chroot-env - +extra-nitrate: TC#0613958 diff --git a/libselinux/setfiles-in-chroot-env/runtest.sh b/libselinux/setfiles-in-chroot-env/runtest.sh index d9afeb2..0dfb100 100755 --- a/libselinux/setfiles-in-chroot-env/runtest.sh +++ b/libselinux/setfiles-in-chroot-env/runtest.sh @@ -30,6 +30,9 @@ PACKAGE="libselinux" CHROOT_DIR=`mktemp -d` +if rlIsFedora ; then + INSTALL_OPTION="--use-host-config" +fi rlJournalStart rlPhaseStartSetup @@ -38,7 +41,7 @@ rlJournalStart rlPhaseEnd rlPhaseStartTest "bz#2094683" - rlRun "yum -y install filesystem policycoreutils selinux-policy-targeted --installroot=${CHROOT_DIR} --disablerepo 'epel*'" + rlRun "yum -y install filesystem policycoreutils selinux-policy-targeted --installroot=${CHROOT_DIR} ${INSTALL_OPTION}" rlRun "cp ./test-script.sh ${CHROOT_DIR}/usr/bin/" rlRun -s "chroot ${CHROOT_DIR} /usr/bin/test-script.sh" rlRun "grep -i -e 'no such file or directory' -e 'not set context' $rlRun_LOG" 1 diff --git a/policycoreutils/sctp_test/main.fmf b/policycoreutils/sctp_test/main.fmf index c82f8da..9b5ed69 100644 --- a/policycoreutils/sctp_test/main.fmf +++ b/policycoreutils/sctp_test/main.fmf @@ -14,3 +14,4 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1770238 extra-summary: /selinux/policycoreutils/sctp_test extra-task: /selinux/policycoreutils/sctp_test +extra-nitrate: TC#0614834 From 64f5b0129bcc32612d891691745547a976b94379 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Thu, 18 Jul 2024 14:19:26 +0200 Subject: [PATCH 377/626] keep the rlSETranslateBoolean() up-to-date Make sure the upstream and downstream version of the rlSETranslateBoolean function is the same. Otherwise, differences can cause problems when running tests which use the function. --- selinux-policy/Library/common/lib.sh | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/selinux-policy/Library/common/lib.sh b/selinux-policy/Library/common/lib.sh index e5f496b..576c44f 100755 --- a/selinux-policy/Library/common/lib.sh +++ b/selinux-policy/Library/common/lib.sh @@ -29,7 +29,7 @@ # # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # library-prefix = rlSE -# library-version = 42 +# library-version = 43 # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ : <<'=cut' @@ -1384,6 +1384,7 @@ function rlSETranslateBoolean() { staff_exec_content allow_staff_exec_content sysadm_exec_content allow_sysadm_exec_content user_exec_content allow_user_exec_content + virt_use_nfs virt_sandbox_use_nfs xguest_exec_content allow_xguest_exec_content xserver_clients_write_xshm allow_write_xshm xserver_execmem allow_xserver_execmem From 9aa71766546e68a0160190a01857521ce885b920 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Fri, 19 Jul 2024 11:31:58 +0200 Subject: [PATCH 378/626] update test relevancy to match the expectations Certain test phases or tests are not relevant for CentOS stream 9. --- libselinux/matchpathcon-in-chroot-env/runtest.sh | 2 ++ selinux-policy/bootupd-and-similar/runtest.sh | 6 +++++- selinux-policy/kernel-confined-exec/main.fmf | 3 +++ selinux-policy/logwatch-and-similar/runtest.sh | 2 +- selinux-policy/sulogin-and-similar/runtest.sh | 2 +- selinux-policy/systemd-nsresourced-and-similar/Makefile | 2 +- selinux-policy/systemd-nsresourced-and-similar/main.fmf | 2 +- 7 files changed, 14 insertions(+), 5 deletions(-) diff --git a/libselinux/matchpathcon-in-chroot-env/runtest.sh b/libselinux/matchpathcon-in-chroot-env/runtest.sh index e273569..e8c82b7 100755 --- a/libselinux/matchpathcon-in-chroot-env/runtest.sh +++ b/libselinux/matchpathcon-in-chroot-env/runtest.sh @@ -32,6 +32,8 @@ PACKAGE="libselinux" CHROOT_DIR=`mktemp -d` if rlIsFedora ; then INSTALL_OPTION="--use-host-config" +else + INSTALL_OPTION="--disablerepo epel" fi rlJournalStart diff --git a/selinux-policy/bootupd-and-similar/runtest.sh b/selinux-policy/bootupd-and-similar/runtest.sh index 5e61d7b..7746e1a 100755 --- a/selinux-policy/bootupd-and-similar/runtest.sh +++ b/selinux-policy/bootupd-and-similar/runtest.sh @@ -34,7 +34,7 @@ FILE_PATH="/usr/libexec/bootupd" SERVICE_PACKAGE="bootupd" SERVICE_NAME="bootupd" PROCESS_NAME="bootupd" -if rlIsFedora || rlIsRHEL '>= 9.5' || rlIsRHEL '>= 10' || rlIsCentOS '>= 10' ; then +if seinfo -t | grep -q bootupd ; then FILE_CONTEXT="bootupd_exec_t" PROCESS_CONTEXT="bootupd_t" else @@ -82,6 +82,7 @@ rlJournalStart rlSESearchRule "allow ${PROCESS_CONTEXT} efivarfs_t : dir { getattr search } [ ]" rlPhaseEnd + if [ -f /usr/lib/systemd/system/bootupd.service ] ; then rlPhaseStartTest "real scenario -- standalone service" if ! rlSEDefined ${PROCESS_CONTEXT} ; then # for OSes where the SELinux domain does not exist yet @@ -93,7 +94,9 @@ rlJournalStart rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlRun "systemctl stop ${SERVICE_NAME}.socket" rlPhaseEnd + fi + if [ -f /usr/lib/systemd/system/bootupd.socket ] ; then rlPhaseStartTest "real scenario -- ${SERVICE_NAME}.socket" rlRun "systemctl enable ${SERVICE_NAME}.socket" rlRun "systemctl start ${SERVICE_NAME}.socket" @@ -104,6 +107,7 @@ rlJournalStart rlRun "systemctl stop ${SERVICE_NAME}.socket" rlRun "systemctl disable ${SERVICE_NAME}.socket" rlPhaseEnd + fi rlPhaseStartCleanup sleep 2 diff --git a/selinux-policy/kernel-confined-exec/main.fmf b/selinux-policy/kernel-confined-exec/main.fmf index 4f71f34..e2c42b9 100644 --- a/selinux-policy/kernel-confined-exec/main.fmf +++ b/selinux-policy/kernel-confined-exec/main.fmf @@ -21,6 +21,9 @@ adjust: - enabled: false when: distro < fedora-38 because: This hardening applies only to F38+ + - enabled: false + when: distro < centos-stream-10 + because: Not yet backported to CentOS - enabled: false when: distro < rhel-10 because: Not yet backported to RHEL diff --git a/selinux-policy/logwatch-and-similar/runtest.sh b/selinux-policy/logwatch-and-similar/runtest.sh index fe1de30..4632ee2 100755 --- a/selinux-policy/logwatch-and-similar/runtest.sh +++ b/selinux-policy/logwatch-and-similar/runtest.sh @@ -59,7 +59,7 @@ rlJournalStart rlSESearchRule "allow logwatch_mail_t sysctl_net_t : file { getattr open read } [ ]" rlPhaseEnd - if ! rlIsRHEL 9 ; then + if ! rlIsRHEL 9 && ! rlIsCentOS 9 ; then rlPhaseStartTest "bz#2270484" rlSEMatchPathCon "/usr/share/logwatch/scripts/logwatch.pl" "logwatch_exec_t" rlSEMatchPathCon "/usr/sbin/sendmail.sendmail" "sendmail_exec_t" diff --git a/selinux-policy/sulogin-and-similar/runtest.sh b/selinux-policy/sulogin-and-similar/runtest.sh index 51a1d85..6fbb8d9 100755 --- a/selinux-policy/sulogin-and-similar/runtest.sh +++ b/selinux-policy/sulogin-and-similar/runtest.sh @@ -15,7 +15,7 @@ rlJournalStart sleep 2 rlPhaseEnd - if ! rlIsRHEL 8 9 ; then + if ! rlIsRHEL 8 9 && ! rlIsCentOS 8 9 ; then rlPhaseStartTest "bz#2265391" rlSEMatchPathCon "/usr/sbin/sulogin" "sulogin_exec_t" rlSESearchRule "dontaudit sulogin_t sulogin_t : capability2 { checkpoint_restore } [ ]" diff --git a/selinux-policy/systemd-nsresourced-and-similar/Makefile b/selinux-policy/systemd-nsresourced-and-similar/Makefile index 48094f3..b87f21b 100644 --- a/selinux-policy/systemd-nsresourced-and-similar/Makefile +++ b/selinux-policy/systemd-nsresourced-and-similar/Makefile @@ -61,7 +61,7 @@ $(METADATA): Makefile @echo "License: GPLv2" >> $(METADATA) @echo "Confidential: no" >> $(METADATA) @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8 -RHEL9" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8 -RHEL9 -RHEL10" >> $(METADATA) @echo "Bug: 2290477" >> $(METADATA) # Fedora 41 rhts-lint $(METADATA) diff --git a/selinux-policy/systemd-nsresourced-and-similar/main.fmf b/selinux-policy/systemd-nsresourced-and-similar/main.fmf index 307d47f..560b247 100644 --- a/selinux-policy/systemd-nsresourced-and-similar/main.fmf +++ b/selinux-policy/systemd-nsresourced-and-similar/main.fmf @@ -38,7 +38,7 @@ adjust: when: distro <= fedora-40 continue: false - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, rhel-9 + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8, rhel-9, centos-stream-9, rhel-10, centos-stream-10 continue: false extra-summary: /CoreOS/selinux-policy/Regression/systemd-nsresourced-and-similar extra-task: /CoreOS/selinux-policy/Regression/systemd-nsresourced-and-similar From ad41a9d3c20f432a80299b3684a2bc08eff0bb49 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 23 Jul 2024 08:44:23 +0200 Subject: [PATCH 379/626] fix problematic tests Avoid problems caused by test failures or tests getting stuck. --- selinux-policy/anon_inode-and-similar/main.fmf | 2 +- selinux-policy/sudo-and-dnf/runtest.sh | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/selinux-policy/anon_inode-and-similar/main.fmf b/selinux-policy/anon_inode-and-similar/main.fmf index a94c107..41ffda8 100644 --- a/selinux-policy/anon_inode-and-similar/main.fmf +++ b/selinux-policy/anon_inode-and-similar/main.fmf @@ -44,7 +44,7 @@ adjust: when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8 because: the anon_inode class is not defined there - enabled: false - when: distro == s390, s390x + when: arch == s390, s390x because: the automated test gets stuck there extra-nitrate: TC#0612643 extra-summary: /CoreOS/selinux-policy/Regression/anon_inode-and-similar diff --git a/selinux-policy/sudo-and-dnf/runtest.sh b/selinux-policy/sudo-and-dnf/runtest.sh index cc9cafd..4bcb027 100755 --- a/selinux-policy/sudo-and-dnf/runtest.sh +++ b/selinux-policy/sudo-and-dnf/runtest.sh @@ -37,7 +37,7 @@ rlJournalStart rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted - rlAssertRpm dnf + rlRun "rpm -q --whatprovides dnf" rlAssertRpm sudo rlSESetEnforce From 5a7dbcf73373e553a2ed341bf2c7688c6d48c21b Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Wed, 24 Jul 2024 11:21:30 +0200 Subject: [PATCH 380/626] increase the chances of successful "yum install" runs Package installations via yum can fail for many reasons. For example: * unsatisfied package dependencies * repository availability problems * unrecognized command line options Hopefully, this change helps the yum command to run successfully when such issues occur. --- libselinux/matchpathcon-in-chroot-env/runtest.sh | 13 +++++++++---- libselinux/setfiles-in-chroot-env/runtest.sh | 11 +++++++++-- 2 files changed, 18 insertions(+), 6 deletions(-) diff --git a/libselinux/matchpathcon-in-chroot-env/runtest.sh b/libselinux/matchpathcon-in-chroot-env/runtest.sh index e8c82b7..f68fca2 100755 --- a/libselinux/matchpathcon-in-chroot-env/runtest.sh +++ b/libselinux/matchpathcon-in-chroot-env/runtest.sh @@ -30,10 +30,15 @@ PACKAGE="libselinux" CHROOT_DIR=`mktemp -d` -if rlIsFedora ; then - INSTALL_OPTION="--use-host-config" -else - INSTALL_OPTION="--disablerepo epel" +INSTALL_OPTION="" +if yum --help | grep -q use-host-config ; then + INSTALL_OPTION="${INSTALL_OPTION} --use-host-config" +fi +if yum install --help | grep -q skip-broken ; then + INSTALL_OPTION="${INSTALL_OPTION} --skip-broken" +fi +if yum install --help | grep -q skip-unavailable ; then + INSTALL_OPTION="${INSTALL_OPTION} --skip-unavailable" fi rlJournalStart diff --git a/libselinux/setfiles-in-chroot-env/runtest.sh b/libselinux/setfiles-in-chroot-env/runtest.sh index 0dfb100..c626652 100755 --- a/libselinux/setfiles-in-chroot-env/runtest.sh +++ b/libselinux/setfiles-in-chroot-env/runtest.sh @@ -30,8 +30,15 @@ PACKAGE="libselinux" CHROOT_DIR=`mktemp -d` -if rlIsFedora ; then - INSTALL_OPTION="--use-host-config" +INSTALL_OPTION="" +if yum --help | grep -q use-host-config ; then + INSTALL_OPTION="${INSTALL_OPTION} --use-host-config" +fi +if yum install --help | grep -q skip-broken ; then + INSTALL_OPTION="${INSTALL_OPTION} --skip-broken" +fi +if yum install --help | grep -q skip-unavailable ; then + INSTALL_OPTION="${INSTALL_OPTION} --skip-unavailable" fi rlJournalStart From 1ea9253e5851d2632488c0ea92a9a09f830ad936 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Mon, 15 Jul 2024 17:12:34 +0200 Subject: [PATCH 381/626] add basic test coverage of the libvirt-dbus service A recent cockpit + selinux-policy testing revealed that SELinux prevents libvirt-dbus processes from connecting to virtqemud processes. The TC reproduces the situation. The libvirt-dbus service is confined by SELinux now. The TC covers basic scenarios in which the service is used. The TC looks for appropriate policy rules and file context patterns. The TC covers RHEL-46893. --- .../libvirt-dbus-and-similar/Makefile | 69 +++++++++++ .../libvirt-dbus-and-similar/PURPOSE | 5 + .../libvirt-dbus-and-similar/main.fmf | 38 ++++++ .../libvirt-dbus-and-similar/runtest.sh | 109 ++++++++++++++++++ 4 files changed, 221 insertions(+) create mode 100644 selinux-policy/libvirt-dbus-and-similar/Makefile create mode 100644 selinux-policy/libvirt-dbus-and-similar/PURPOSE create mode 100644 selinux-policy/libvirt-dbus-and-similar/main.fmf create mode 100755 selinux-policy/libvirt-dbus-and-similar/runtest.sh diff --git a/selinux-policy/libvirt-dbus-and-similar/Makefile b/selinux-policy/libvirt-dbus-and-similar/Makefile new file mode 100644 index 0000000..6ad5719 --- /dev/null +++ b/selinux-policy/libvirt-dbus-and-similar/Makefile @@ -0,0 +1,69 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/libvirt-dbus-and-similar +# Description: SELinux interferes with libvirt-dbus and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2024 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/libvirt-dbus-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with libvirt-dbus and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 15m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "RunFor: libvirt-dbus" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console libvirt-dbus /usr/sbin/service" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) + @echo "Bug: RHEL-46893" >> $(METADATA) # RHEL-10 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/libvirt-dbus-and-similar/PURPOSE b/selinux-policy/libvirt-dbus-and-similar/PURPOSE new file mode 100644 index 0000000..94dfc9b --- /dev/null +++ b/selinux-policy/libvirt-dbus-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/libvirt-dbus-and-similar +Author: Milos Malik + +SELinux interferes with libvirt-dbus and related programs. + diff --git a/selinux-policy/libvirt-dbus-and-similar/main.fmf b/selinux-policy/libvirt-dbus-and-similar/main.fmf new file mode 100644 index 0000000..c5e8620 --- /dev/null +++ b/selinux-policy/libvirt-dbus-and-similar/main.fmf @@ -0,0 +1,38 @@ +summary: SELinux interferes with libvirt-dbus and related programs +description: |+ + SELinux interferes with libvirt-dbus and related programs. + +contact: Milos Malik +component: + - selinux-policy +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - libvirt-dbus + - /usr/sbin/service +environment: + AVC_ERROR: +no_avc_check +duration: 15m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - targeted + - NoRHIVOS +link: + - verifies: https://issues.redhat.com/browse/RHEL-46893 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + because: the libvirt-dbus package is not available there +extra-summary: /CoreOS/selinux-policy/Regression/libvirt-dbus-and-similar +extra-task: /CoreOS/selinux-policy/Regression/libvirt-dbus-and-similar diff --git a/selinux-policy/libvirt-dbus-and-similar/runtest.sh b/selinux-policy/libvirt-dbus-and-similar/runtest.sh new file mode 100755 index 0000000..a624305 --- /dev/null +++ b/selinux-policy/libvirt-dbus-and-similar/runtest.sh @@ -0,0 +1,109 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/libvirt-dbus-and-similar +# Description: SELinux interferes with libvirt-dbus and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2024 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +FILE_PATH="/usr/sbin/libvirt-dbus" +SERVICE_PACKAGE="libvirt-dbus" +SERVICE_NAME="libvirt-dbus" +PROCESS_NAME="libvirt-dbus" + +if seinfo -t | grep -q virt_dbus ; then + FILE_CONTEXT="virt_dbus_exec_t" + PROCESS_CONTEXT="virt_dbus_t" +else + FILE_CONTEXT="bin_t" + PROCESS_CONTEXT="unconfined_service_t" +fi + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} + rlRun "yum -y install libvirt\* --skip-broken" + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "RHEL-46893" + rlSEMatchPathCon ${FILE_PATH} ${FILE_CONTEXT} + rlSESearchRule "allow virt_dbus_t virtqemud_t : unix_stream_socket { connectto } [ ]" + rlSESearchRule "allow virtqemud_t virt_dbus_t : dir { search } [ ]" + rlSESearchRule "allow virtqemud_t virt_dbus_t : file { getattr open read } [ ]" + rlPhaseEnd + + rlPhaseStartTest "real scenario -- standalone service" + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /var /run -e /var/ARTIFACTS" 0-255 + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + + rlPhaseStartTest "real scenario -- communication with other virt* services" + for VIRT_SERVICE in virtinterfaced virtlxcd virtnetworkd virtnodedevd virtnwfilterd virtproxyd virtqemud virtsecretd virtstoraged virtvboxd ; do + if [ -f /usr/lib/systemd/system/${VIRT_SERVICE}.service ] ; then + rlRun "service ${VIRT_SERVICE} start" + fi + done + + AVAIL_DAEMONS="QEMU" + if [ -f /usr/lib/systemd/system/virtlxcd.service ] ; then + AVAIL_DAEMONS="LXC QEMU" + fi + + for DAEMON in ${AVAIL_DAEMONS} ; do + for METHOD in ListDomains ListInterfaces ListNWFilters ListNetworks ListNodeDevices ListSecrets ListStoragePools ; do + rlRun "busctl call org.libvirt /org/libvirt/${DAEMON} org.libvirt.Connect ${METHOD} u 0" 0,1 + done + done + + for VIRT_SERVICE in virtinterfaced virtlxcd virtnetworkd virtnodedevd virtnwfilterd virtproxyd virtqemud virtsecretd virtstoraged virtvboxd ; do + if [ -f /usr/lib/systemd/system/${VIRT_SERVICE}.service ] ; then + rlRun "service ${VIRT_SERVICE} stop" + fi + done + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + From 96d9e69fc47566421d6fdd28ac6f3222b7380dad Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Wed, 24 Jul 2024 09:16:35 +0200 Subject: [PATCH 382/626] test if systemd-machined can create socket in /run/systemd/machine/ Recent cockpit + systemd + selinux-policy testing revealed that SELinux prevents the systemd-machined process (started by the machinectl command) from doing the following actions: * creating the /run/systemd/machine directory * creating the /run/systemd/machine/io.systemd.Machine socket * unlinking the /run/systemd/machine/io.systemd.Machine socket The TC reproduces the situation. In order to support the basic machinectl functions, I believe that SELinux policy allow these actions. The TC looks for appropriate policy rules and file context patterns. The TC covers RHEL-49567. --- .../systemd-machined-and-similar/Makefile | 1 + .../systemd-machined-and-similar/PURPOSE | 1 + .../systemd-machined-and-similar/main.fmf | 1 + .../systemd-machined-and-similar/runtest.sh | 21 ++++++++++++++++++- 4 files changed, 23 insertions(+), 1 deletion(-) diff --git a/selinux-policy/systemd-machined-and-similar/Makefile b/selinux-policy/systemd-machined-and-similar/Makefile index 35c7767..cb3f07b 100644 --- a/selinux-policy/systemd-machined-and-similar/Makefile +++ b/selinux-policy/systemd-machined-and-similar/Makefile @@ -66,6 +66,7 @@ $(METADATA): Makefile @echo "Bug: 1847545" >> $(METADATA) # Fedora 32 @echo "Bug: 1900869" >> $(METADATA) # Fedora 33 @echo "Bug: 1900888" >> $(METADATA) # Fedora 35 + @echo "Bug: RHEL-49567" >> $(METADATA) # RHEL-10 rhts-lint $(METADATA) diff --git a/selinux-policy/systemd-machined-and-similar/PURPOSE b/selinux-policy/systemd-machined-and-similar/PURPOSE index 1734b44..5f4a9e8 100644 --- a/selinux-policy/systemd-machined-and-similar/PURPOSE +++ b/selinux-policy/systemd-machined-and-similar/PURPOSE @@ -3,3 +3,4 @@ Author: Milos Malik SELinux interferes with systemd-machined and related programs. +Related programs: machinectl. diff --git a/selinux-policy/systemd-machined-and-similar/main.fmf b/selinux-policy/systemd-machined-and-similar/main.fmf index 778b593..617fc5e 100644 --- a/selinux-policy/systemd-machined-and-similar/main.fmf +++ b/selinux-policy/systemd-machined-and-similar/main.fmf @@ -34,6 +34,7 @@ link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1847545 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1900869 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1900888 + - verifies: https://issues.redhat.com/browse/RHEL-49567 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7 diff --git a/selinux-policy/systemd-machined-and-similar/runtest.sh b/selinux-policy/systemd-machined-and-similar/runtest.sh index 54b3bb2..422908e 100755 --- a/selinux-policy/systemd-machined-and-similar/runtest.sh +++ b/selinux-policy/systemd-machined-and-similar/runtest.sh @@ -36,6 +36,16 @@ SERVICE_PACKAGE="systemd-container" SERVICE_NAME="systemd-machined" PROCESS_NAME="systemd-machined" PROCESS_CONTEXT="systemd_machined_t" +INSTALL_OPTION="" +if yum --help | grep -q use-host-config ; then + INSTALL_OPTION="${INSTALL_OPTION} --use-host-config" +fi +if yum install --help | grep -q skip-broken ; then + INSTALL_OPTION="${INSTALL_OPTION} --skip-broken" +fi +if yum install --help | grep -q skip-unavailable ; then + INSTALL_OPTION="${INSTALL_OPTION} --skip-unavailable" +fi rlJournalStart if [ ! -f ${FILE_PATH} ] ; then @@ -85,6 +95,15 @@ rlJournalStart rlPhaseEnd fi + rlPhaseStartTest "RHEL-49567" + rlSEMatchPathCon "/usr/lib/systemd/systemd-machined" "systemd_machined_exec_t" + rlSEMatchPathCon "/run/systemd/machine" "systemd_machined_var_run_t" + rlSEMatchPathCon "/run/systemd/machine/io.systemd.Machine" "systemd_machined_var_run_t" + rlSESearchRule "allow systemd_machined_t systemd_machined_var_run_t : dir { create } [ ]" + rlSESearchRule "allow systemd_machined_t systemd_machined_var_run_t : sock_file { create unlink } [ ]" + rlRun "machinectl" + rlPhaseEnd + rlPhaseStartTest "real scenario -- standalone service" if ! rlSEDefined ${PROCESS_CONTEXT} ; then PROCESS_CONTEXT="unconfined_service_t" @@ -96,7 +115,7 @@ rlJournalStart rlPhaseStartTest "real scenario -- bz#1900869 + bz#1900888" rlRun "mkdir -pZ /var/lib/machines/test" - rlRun "dnf -y --installroot=/var/lib/machines/test/ install dhcp-client dnf filesystem glibc glibc-langpack-en glibc-langpack-de iproute iputils less passwd systemd vim-minimal" + rlRun "dnf -y --installroot=/var/lib/machines/test/ install dhcp-client dnf filesystem glibc glibc-langpack-en glibc-langpack-de iproute iputils less passwd systemd vim-minimal ${INSTALL_OPTION}" rlRun "du -sh /var/lib/machines/test" # TODO: remove next 2 lines once the BZs are fixed rlRun "semodule -i testpolicy.cil" From 1d726848e63a140653b38141c7da082c44d3a0b6 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Fri, 26 Jul 2024 16:05:27 +0200 Subject: [PATCH 383/626] skip irrelevant phases and install required packages If required packages are not installed, the tests will try to install them (only 1 attempt per test will be done). Certain test phases may not be relevant if: * required SELinux types/attributes are not defined * required programs/files are not installed * required packages are not available --- selinux-policy/abrt-services/runtest.sh | 2 ++ selinux-policy/deny-rules/runtest.sh | 3 +++ selinux-policy/dhclient-and-similar/runtest.sh | 2 ++ selinux-policy/logwatch-and-similar/runtest.sh | 4 +++- selinux-policy/pam_console-and-related/runtest.sh | 2 ++ selinux-policy/systemd-nsresourced-and-similar/runtest.sh | 8 +++++++- selinux-policy/systemd-timesyncd-and-similar/runtest.sh | 8 ++++++-- selinux-policy/virtualization-daemons/runtest.sh | 2 +- setools/rebuild-from-srpm/runtest.sh | 4 ++++ 9 files changed, 30 insertions(+), 5 deletions(-) diff --git a/selinux-policy/abrt-services/runtest.sh b/selinux-policy/abrt-services/runtest.sh index 220c1c6..abc6c85 100755 --- a/selinux-policy/abrt-services/runtest.sh +++ b/selinux-policy/abrt-services/runtest.sh @@ -57,6 +57,7 @@ rlJournalStart rlPhaseEnd fi + if rpm -qa | grep -q abrt ; then rlPhaseStartTest "real scenario -- bz#2274709" for SERVICE_NAME in abrtd abrt-journal-core abrt-oops abrt-pstoreoops abrt-upload-watch abrt-vmcore abrt-xorg ; do rlRun "service ${SERVICE_NAME} start" @@ -69,6 +70,7 @@ rlJournalStart rlRun "service ${SERVICE_NAME} stop" done rlPhaseEnd + fi rlPhaseStartCleanup sleep 2 diff --git a/selinux-policy/deny-rules/runtest.sh b/selinux-policy/deny-rules/runtest.sh index 73f96af..65f947e 100755 --- a/selinux-policy/deny-rules/runtest.sh +++ b/selinux-policy/deny-rules/runtest.sh @@ -24,6 +24,9 @@ rlJournalStart rlAssertRpm libselinux rlAssertRpm policycoreutils rlAssertRpm selinux-policy + if ! rpm -q strace ; then + rlRun "yum -y install strace" 0-255 + fi rlRun "setenforce 1" rlRun "sestatus" diff --git a/selinux-policy/dhclient-and-similar/runtest.sh b/selinux-policy/dhclient-and-similar/runtest.sh index b6b920c..1c681c1 100755 --- a/selinux-policy/dhclient-and-similar/runtest.sh +++ b/selinux-policy/dhclient-and-similar/runtest.sh @@ -71,6 +71,7 @@ rlJournalStart rlPhaseEnd fi + if which dhclient >& /dev/null ; then rlPhaseStartTest "real scenario" rlRun "rm -rf /run/chrony-dhcp" rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 @@ -82,6 +83,7 @@ rlJournalStart rlRun "ls -alZ /run/chrony-dhcp" fi rlPhaseEnd + fi rlPhaseStartCleanup sleep 2 diff --git a/selinux-policy/logwatch-and-similar/runtest.sh b/selinux-policy/logwatch-and-similar/runtest.sh index 4632ee2..c712baf 100755 --- a/selinux-policy/logwatch-and-similar/runtest.sh +++ b/selinux-policy/logwatch-and-similar/runtest.sh @@ -66,7 +66,9 @@ rlJournalStart rlSEMatchPathCon "/run/systemd/sessions/" "systemd_logind_sessions_t" rlSESearchRule "allow logwatch_t systemd_logind_sessions_t : dir { read } [ ]" rlSESearchRule "type_transition logwatch_t sendmail_exec_t : process logwatch_mail_t" - rlSESearchRule "allow logwatch_mail_t init_t : unix_stream_socket { getattr } [ ]" + if rlIsFedora ; then + rlSESearchRule "allow logwatch_mail_t init_t : unix_stream_socket { getattr } [ ]" + fi rlPhaseEnd fi diff --git a/selinux-policy/pam_console-and-related/runtest.sh b/selinux-policy/pam_console-and-related/runtest.sh index 20941d0..068581b 100755 --- a/selinux-policy/pam_console-and-related/runtest.sh +++ b/selinux-policy/pam_console-and-related/runtest.sh @@ -98,9 +98,11 @@ rlJournalStart rlRun "setsebool ssh_sysadm_login off" rlPhaseEnd + if [ -f /usr/sbin/pam_console_apply ] ; then rlPhaseStartTest "real scenario -- runcon under root" rlRun "runcon system_u:system_r:initrc_t:s0 /bin/bash -c '/usr/sbin/pam_console_apply -r'" rlPhaseEnd + fi rlPhaseStartCleanup sleep 2 diff --git a/selinux-policy/systemd-nsresourced-and-similar/runtest.sh b/selinux-policy/systemd-nsresourced-and-similar/runtest.sh index 383afad..2124748 100755 --- a/selinux-policy/systemd-nsresourced-and-similar/runtest.sh +++ b/selinux-policy/systemd-nsresourced-and-similar/runtest.sh @@ -31,11 +31,11 @@ PACKAGE="selinux-policy" FILE_PATH="/usr/lib/systemd/systemd-nsresourced" -FILE_CONTEXT="systemd_nsresourced_exec_t" SERVICE_PACKAGE="systemd" SERVICE_NAME="systemd-nsresourced" PROCESS_NAME="systemd-nsresourced" PROCESS_CONTEXT="systemd_nsresourced_t" +FILE_CONTEXT="systemd_nsresourced_exec_t" rlJournalStart rlPhaseStartSetup @@ -54,6 +54,7 @@ rlJournalStart sleep 2 rlPhaseEnd + if seinfo -t | grep -q systemd_nsresourced ; then rlPhaseStartTest "bz#2290477" rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" SOURCE_TYPE="init_t" # systemd runs the process @@ -71,7 +72,9 @@ rlJournalStart rlSESearchRule "allow staff_t systemd_nsresourced_t : unix_stream_socket { connectto } [ ]" rlSESearchRule "allow xdm_t systemd_nsresourced_t : unix_stream_socket { connectto } [ ]" rlPhaseEnd + fi + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" if ! rlSEDefined ${PROCESS_CONTEXT} ; then # for OSes where the SELinux domain does not exist yet @@ -81,7 +84,9 @@ rlJournalStart rlRun "restorecon -Rv /var /run -e /var/ARTIFACTS" 0-255 rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd + fi + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.socket ] ; then rlPhaseStartTest "real scenario -- socket activation" rlRun "systemctl enable ${SERVICE_NAME}.socket" rlRun "systemctl start ${SERVICE_NAME}.socket" @@ -98,6 +103,7 @@ rlJournalStart rlRun "systemctl stop ${SERVICE_NAME}.socket" rlRun "systemctl disable ${SERVICE_NAME}.socket" rlPhaseEnd + fi rlPhaseStartCleanup sleep 2 diff --git a/selinux-policy/systemd-timesyncd-and-similar/runtest.sh b/selinux-policy/systemd-timesyncd-and-similar/runtest.sh index 42fa246..2367349 100755 --- a/selinux-policy/systemd-timesyncd-and-similar/runtest.sh +++ b/selinux-policy/systemd-timesyncd-and-similar/runtest.sh @@ -41,10 +41,14 @@ rlJournalStart rlPhaseStartSetup rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires - SERVICE_PACKAGE=`rpm -qf ${FILE_PATH} | head -n 1` rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted - rlAssertRpm ${SERVICE_PACKAGE} + if [ -f ${FILE_PATH} ] ; then + SERVICE_PACKAGE=`rpm -qf ${FILE_PATH} | head -n 1` + rlAssertRpm ${SERVICE_PACKAGE} + else + rlRun "yum -y install ${FILE_PATH}" 0-255 + fi rlServiceStop ${SERVICE_NAME} rlFileBackup /etc/shadow diff --git a/selinux-policy/virtualization-daemons/runtest.sh b/selinux-policy/virtualization-daemons/runtest.sh index 2cae433..f132fdf 100755 --- a/selinux-policy/virtualization-daemons/runtest.sh +++ b/selinux-policy/virtualization-daemons/runtest.sh @@ -32,7 +32,7 @@ PACKAGE="selinux-policy" ROOT_PASSWORD="redhat" SERVICE_NAMES="libvirtd virtinterfaced virtlockd virtlogd virtlxcd virtnetworkd virtnodedevd virtnwfilterd virtproxyd virtqemud virtsecretd virtstoraged virtvboxd virtxend" -if rlIsFedora ">39"; then +if seinfo -a | grep -q virt_driver_domain ; then ALL_TUPLES="libvirtd:libvirtd:virtd_t \ virtinterfaced:virtinterfaced:virtinterfaced_t \ virtlockd:virtlockd:virtlogd_t \ diff --git a/setools/rebuild-from-srpm/runtest.sh b/setools/rebuild-from-srpm/runtest.sh index 698c4ef..cf031ab 100755 --- a/setools/rebuild-from-srpm/runtest.sh +++ b/setools/rebuild-from-srpm/runtest.sh @@ -8,6 +8,10 @@ rlJournalStart rlAssertRpm libsemanage rlAssertRpm libselinux rlAssertRpm policycoreutils + if ! rpm -q rpm-build ; then + rlRun "yum -y install rpm-build" 0-255 + fi + rlRun "rm -f setools*.src.rpm" rlRun "yumdownloader --source setools" rlRun "ls -l setools*src.rpm" From 1fa9327a337545cb8855470b7c41305018b39fb3 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 30 Jul 2024 13:27:03 +0200 Subject: [PATCH 384/626] avoid showing of unprintable characters in the output Unprintable characters in the test output can cause problems when importing test results to the Report Portal. The problem should be fixed now. --- selinux-policy/chronyd-and-similar/runtest.sh | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/selinux-policy/chronyd-and-similar/runtest.sh b/selinux-policy/chronyd-and-similar/runtest.sh index fb399f4..2eb7fc2 100755 --- a/selinux-policy/chronyd-and-similar/runtest.sh +++ b/selinux-policy/chronyd-and-similar/runtest.sh @@ -404,7 +404,8 @@ rlJournalStart rlPhaseEnd rlPhaseStartTest "real scenario -- bz#2065313" - rlRun 'printf "\x6\x1\x0\x0\x0\x21\x0\x0\x21\xd7\xe4\x22\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0" | socat unix-sendto:/run/chrony/chronyd.sock,bind=/run/chrony/chronyc.sock,umask=0000 - | hexdump -C' 0 "special socat command talks to chronyd via its UNIX socket" + rlLog "special socat command talks to chronyd via its UNIX socket" + printf "\x6\x1\x0\x0\x0\x21\x0\x0\x21\xd7\xe4\x22\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0" | socat unix-sendto:/run/chrony/chronyd.sock,bind=/run/chrony/chronyc.sock,umask=0000 - | hexdump -C rlPhaseEnd rlPhaseStartTest "bz#2118628 + bz#2118631" From a915243c7dd88afbf10e5204e609b07bfecf2c77 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 30 Jul 2024 14:43:01 +0200 Subject: [PATCH 385/626] recognize the new virt* policy and adapt checks Instead of checking Fedora or CentOS or RHEL version, the decision to adapt should be made according to the defined SELinux policy types or attributes. The TC also covers RHEL-40834. --- selinux-policy/virtualization-daemons/Makefile | 1 + selinux-policy/virtualization-daemons/main.fmf | 13 +++++++++---- selinux-policy/virtualization-daemons/runtest.sh | 15 +++++++++++++-- 3 files changed, 23 insertions(+), 6 deletions(-) diff --git a/selinux-policy/virtualization-daemons/Makefile b/selinux-policy/virtualization-daemons/Makefile index 2a0aa27..5aaf556 100644 --- a/selinux-policy/virtualization-daemons/Makefile +++ b/selinux-policy/virtualization-daemons/Makefile @@ -64,6 +64,7 @@ $(METADATA): Makefile @echo "Destructive: no" >> $(METADATA) @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) @echo "Bug: 2291273" >> $(METADATA) # Fedora 41 + @echo "Bug: RHEL-40834" >> $(METADATA) # RHEL-10 rhts-lint $(METADATA) diff --git a/selinux-policy/virtualization-daemons/main.fmf b/selinux-policy/virtualization-daemons/main.fmf index 3df3ce2..eb1c349 100644 --- a/selinux-policy/virtualization-daemons/main.fmf +++ b/selinux-policy/virtualization-daemons/main.fmf @@ -37,6 +37,7 @@ duration: 15m enabled: true link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2291273 + - verifies: https://issues.redhat.com/browse/RHEL-40834 tag: - NoRHEL4 - NoRHEL5 @@ -47,7 +48,11 @@ tag: - failinfedora - NoRHIVOS adjust: -- enabled: false - when: distro < rhel-9 - because: the virtualization daemons are not available there - + - enabled: false + when: distro < centos-stream-9 + because: the virtualization daemons are not available there + - enabled: false + when: distro < rhel-9 + because: the virtualization daemons are not available there +extra-nitrate: TC#0617680 +id: 1f7a8a37-7977-4ee0-8b8a-979c03aff369 diff --git a/selinux-policy/virtualization-daemons/runtest.sh b/selinux-policy/virtualization-daemons/runtest.sh index f132fdf..32f85be 100755 --- a/selinux-policy/virtualization-daemons/runtest.sh +++ b/selinux-policy/virtualization-daemons/runtest.sh @@ -63,6 +63,16 @@ ALL_TUPLES="libvirtd:libvirtd:virtd_t \ virtvboxd:virtvboxd:virtd_t" # virtxend:virtxend:virtd_t fi +INSTALL_OPTION="" +if yum --help | grep -q use-host-config ; then + INSTALL_OPTION="${INSTALL_OPTION} --use-host-config" +fi +if yum install --help | grep -q skip-broken ; then + INSTALL_OPTION="${INSTALL_OPTION} --skip-broken" +fi +if yum install --help | grep -q skip-unavailable ; then + INSTALL_OPTION="${INSTALL_OPTION} --skip-unavailable" +fi rlJournalStart rlPhaseStartSetup @@ -74,6 +84,7 @@ rlJournalStart rlServiceStop ${SERVICE_NAMES} rlFileBackup /etc/shadow + rlRun "yum -y install libvirt\* -x \*devel ${INSTALL_OPTION}" 0-255 rlSESetEnforce rlSEStatus @@ -82,7 +93,7 @@ rlJournalStart rlPhaseEnd rlPhaseStartTest "SELinux contexts and rules" - if rlIsFedora ">39"; then + if seinfo -a | grep -q virt_driver_domain ; then rlSEMatchPathCon "/usr/sbin/virtinterfaced" "virtinterfaced_exec_t" rlSEMatchPathCon "/usr/sbin/virtlxcd" "virtd_lxc_exec_t" rlSEMatchPathCon "/usr/sbin/virtnetworkd" "virtnetworkd_exec_t" @@ -143,7 +154,7 @@ rlJournalStart rlPhaseEnd if seinfo -a | grep -q virt_driver_domain ; then - rlPhaseStartTest "bz#2291273" + rlPhaseStartTest "bz#2291273 + RHEL-40834" rlSESearchRule "allow virtnetworkd_t unconfined_t : dir { search } [ ]" rlSESearchRule "allow virtnetworkd_t unconfined_t : file { open read } [ ]" rlSESearchRule "allow virtnodedevd_t unconfined_t : dir { search } [ ]" From a2c9af2d188316233b5ba830e1f3ea4e00f31a2d Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Fri, 2 Aug 2024 16:23:19 +0200 Subject: [PATCH 386/626] fix tests which fail for known reasons The chronyd test does not produce non-printable characters now. The libvirt-dbus test phases relevancy is improved now. --- selinux-policy/chronyd-and-similar/runtest.sh | 4 +--- selinux-policy/libvirt-dbus-and-similar/runtest.sh | 2 ++ 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/selinux-policy/chronyd-and-similar/runtest.sh b/selinux-policy/chronyd-and-similar/runtest.sh index 2eb7fc2..e7c7094 100755 --- a/selinux-policy/chronyd-and-similar/runtest.sh +++ b/selinux-policy/chronyd-and-similar/runtest.sh @@ -53,8 +53,6 @@ rlJournalStart rlFileBackup /etc/shadow rlFileBackup /etc/chrony.keys - rlRun "find /var /run -type f -name '*lease*'" - rlRun "find /var /run -type f -name '*lease*' | xargs cat" rlSESetEnforce rlSEStatus rlSESetTimestamp @@ -286,7 +284,7 @@ rlJournalStart rlPhaseStartTest "bz#1900143" rlSEMatchPathCon "/run/systemd/resolve/io.systemd.Resolve" "systemd_resolved_var_run_t" rlSESearchRule "allow chronyd_t systemd_resolved_var_run_t : sock_file { write } [ ]" - rlRun "grep resolve /etc/nsswitch.conf" + # rlRun "grep resolve /etc/nsswitch.conf" rlPhaseEnd rlPhaseStartTest "bz#2173604" diff --git a/selinux-policy/libvirt-dbus-and-similar/runtest.sh b/selinux-policy/libvirt-dbus-and-similar/runtest.sh index a624305..bf886b1 100755 --- a/selinux-policy/libvirt-dbus-and-similar/runtest.sh +++ b/selinux-policy/libvirt-dbus-and-similar/runtest.sh @@ -60,12 +60,14 @@ rlJournalStart sleep 2 rlPhaseEnd + if seinfo -t | grep -q virt_dbus ; then rlPhaseStartTest "RHEL-46893" rlSEMatchPathCon ${FILE_PATH} ${FILE_CONTEXT} rlSESearchRule "allow virt_dbus_t virtqemud_t : unix_stream_socket { connectto } [ ]" rlSESearchRule "allow virtqemud_t virt_dbus_t : dir { search } [ ]" rlSESearchRule "allow virtqemud_t virt_dbus_t : file { getattr open read } [ ]" rlPhaseEnd + fi rlPhaseStartTest "real scenario -- standalone service" rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 From ed49590c4338fccbbe9e996078ecec7abed6550f Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Wed, 31 Jul 2024 08:49:07 +0200 Subject: [PATCH 387/626] test if stalld works with the queue_track backend Recent changes (BPF code that is involved in the queue_track backend) in the stalld component trigger SELinux denials because SELinux policy does not expect such a behavior. The TC reproduces the situation. In order to support this new feature, I believe that SELinux policy should allow the necessary actions. The TC looks for appropriate policy rules and file context patterns. The TC covers RHEL-50356. --- selinux-policy/stalld-and-similar/Makefile | 3 ++- selinux-policy/stalld-and-similar/main.fmf | 2 ++ selinux-policy/stalld-and-similar/runtest.sh | 23 +++++++++++++++++++- 3 files changed, 26 insertions(+), 2 deletions(-) diff --git a/selinux-policy/stalld-and-similar/Makefile b/selinux-policy/stalld-and-similar/Makefile index 507e472..ac07019 100644 --- a/selinux-policy/stalld-and-similar/Makefile +++ b/selinux-policy/stalld-and-similar/Makefile @@ -55,7 +55,7 @@ $(METADATA): Makefile @echo "TestTime: 10m" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) @echo "RunFor: stalld" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console stalld /usr/sbin/service" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console stalld /usr/sbin/service binutils" >> $(METADATA) @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @@ -69,6 +69,7 @@ $(METADATA): Makefile @echo "Bug: 2102224" >> $(METADATA) # RHEL-9 @echo "Bug: 2105038" >> $(METADATA) # RHEL-9 @echo "Bug: 2140673" >> $(METADATA) # RHEL-9 + @echo "Bug: RHEL-50356" >> $(METADATA) # RHEL-10 rhts-lint $(METADATA) diff --git a/selinux-policy/stalld-and-similar/main.fmf b/selinux-policy/stalld-and-similar/main.fmf index 9412a54..8f566d3 100644 --- a/selinux-policy/stalld-and-similar/main.fmf +++ b/selinux-policy/stalld-and-similar/main.fmf @@ -17,6 +17,7 @@ recommend: - setools-console - stalld - /usr/sbin/service + - binutils environment: AVC_ERROR: +no_avc_check duration: 10m @@ -40,6 +41,7 @@ link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2102224 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2105038 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2140673 + - verifies: https://issues.redhat.com/browse/RHEL-50356 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8 diff --git a/selinux-policy/stalld-and-similar/runtest.sh b/selinux-policy/stalld-and-similar/runtest.sh index e0d7696..95e02ce 100755 --- a/selinux-policy/stalld-and-similar/runtest.sh +++ b/selinux-policy/stalld-and-similar/runtest.sh @@ -38,7 +38,7 @@ PROCESS_NAME="stalld" PROCESS_CONTEXT="stalld_t" rlJournalStart - if ! rpm -q ${SERVICE_PACKAGE} ; then + if ! rpm -q ${SERVICE_PACKAGE} >& /dev/null ; then rlLog "Required packages are not available/installed." rlJournalEnd exit 0 @@ -96,6 +96,27 @@ rlJournalStart rlSESearchRule "allow stalld_t security_t : file { getattr open read } [ ]" rlPhaseEnd + if strings `which stalld` | grep -q queue_track ; then + # if the program recognizes the queue_track option then test it and use it + rlPhaseStartTest "RHEL-50356" + rlSEMatchPathCon "/sys/fs/bpf" "bpf_t" + rlSESearchRule "allow stalld_t stalld_t : capability { sys_resource } [ ]" + rlSESearchRule "allow stalld_t stalld_t : process { setrlimit } [ ]" + rlSESearchRule "allow stalld_t bpf_t : dir { getattr open read } [ ]" + rlSESearchRule "allow stalld_t stalld_t : capability2 { bpf perfmon } [ ]" + rlSESearchRule "allow stalld_t stalld_t : bpf { prog_run prog_load map_read map_write map_create } [ ]" + rlPhaseEnd + + rlPhaseStartTest "real scenario -- RHEL-50356" + rlRun "grep ^AGGR= /etc/sysconfig/stalld" + rlRun "sed -i 's/^AGGR=.*$/AGGR=\"--backend queue_track\"/' /etc/sysconfig/stalld" + rlRun "grep ^AGGR= /etc/sysconfig/stalld" + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status stop status" 5 + rlRun "sed -i 's/^AGGR=.*$/AGGR=/' /etc/sysconfig/stalld" + rlRun "grep ^AGGR= /etc/sysconfig/stalld" + rlPhaseEnd + fi + rlPhaseStartTest "real scenario -- standalone service" if ! rlSEDefined ${PROCESS_CONTEXT} ; then PROCESS_CONTEXT="unconfined_service_t" From 705e5154fa7f769202721e15b2526c53c07e7c28 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Mon, 15 Jul 2024 15:44:42 +0200 Subject: [PATCH 388/626] test if cups-browsed can access /root/.cups/lpoptions A recent cups + selinux-policy testing revealed that SELinux prevents the cups-browsed processes from accessing the /root/.cups/lpoptions file. The TC reproduces the situation. In order to support the cups-browsed ability to access the lpoptions file, I believe that SELinux policy should allow the access. Either file context patterns need to change or an appropriate policy rule need to be added. The TC looks for these changes. The TC covers RHEL-47401. --- selinux-policy/cups-browsed-and-similar/Makefile | 1 + selinux-policy/cups-browsed-and-similar/main.fmf | 1 + selinux-policy/cups-browsed-and-similar/runtest.sh | 2 ++ 3 files changed, 4 insertions(+) diff --git a/selinux-policy/cups-browsed-and-similar/Makefile b/selinux-policy/cups-browsed-and-similar/Makefile index aee1194..a6ec20e 100644 --- a/selinux-policy/cups-browsed-and-similar/Makefile +++ b/selinux-policy/cups-browsed-and-similar/Makefile @@ -66,6 +66,7 @@ $(METADATA): Makefile @echo "Bug: 1395801" >> $(METADATA) # Fedora 26 @echo "Bug: 1401634" >> $(METADATA) # Fedora 26 @echo "Bug: 1719754" >> $(METADATA) # RHEL-7 + @echo "Bug: RHEL-47401" >> $(METADATA) # RHEL-9 rhts-lint $(METADATA) diff --git a/selinux-policy/cups-browsed-and-similar/main.fmf b/selinux-policy/cups-browsed-and-similar/main.fmf index a868a95..c75ebba 100644 --- a/selinux-policy/cups-browsed-and-similar/main.fmf +++ b/selinux-policy/cups-browsed-and-similar/main.fmf @@ -40,6 +40,7 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1401634 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1719754 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1929329 + - verifies: https://issues.redhat.com/browse/RHEL-47401 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6 diff --git a/selinux-policy/cups-browsed-and-similar/runtest.sh b/selinux-policy/cups-browsed-and-similar/runtest.sh index 71eeb50..6aa8b88 100755 --- a/selinux-policy/cups-browsed-and-similar/runtest.sh +++ b/selinux-policy/cups-browsed-and-similar/runtest.sh @@ -83,6 +83,8 @@ rlJournalStart fi rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 + rlRun "mkdir -p /root/.cups" + rlRun "touch /root/.cups/lpoptions" rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd From ab42eb93783515a3dce32ce579c4cd401c2b4829 Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Thu, 15 Aug 2024 23:34:18 +0200 Subject: [PATCH 389/626] libselinux/matchpathcon: Work around yum issue on CentOS 9 Fixes: # cd libselinux/setfiles-in-chroot-env # 1minutetip 1MT-CentOS-Stream-9 # ./runtest.sh yum -y install filesystem libselinux libselinux-utils python3-libselinux policycoreutils --installroot=/tmp/tmp.WhKcf2BrOe --skip-broken' Unable to detect release version (use '--releasever' to specify release version) Error: Failed to download metadata for repo 'epel': Cannot prepare internal mirrorlist: Status code: 404 [ FAIL ] Signed-off-by: Vit Mojzis --- libselinux/setfiles-in-chroot-env/runtest.sh | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libselinux/setfiles-in-chroot-env/runtest.sh b/libselinux/setfiles-in-chroot-env/runtest.sh index c626652..d18d0a4 100755 --- a/libselinux/setfiles-in-chroot-env/runtest.sh +++ b/libselinux/setfiles-in-chroot-env/runtest.sh @@ -40,6 +40,10 @@ fi if yum install --help | grep -q skip-unavailable ; then INSTALL_OPTION="${INSTALL_OPTION} --skip-unavailable" fi +# yum sometimes fails to detect the release version on CentOS 9 +if rlIsCentOS 9 ; then + INSTALL_OPTION="${INSTALL_OPTION} --releasever 9" +fi rlJournalStart rlPhaseStartSetup From b30e460af83fedd6d48d659dc986278c34510a5a Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Fri, 16 Aug 2024 13:40:45 +0200 Subject: [PATCH 390/626] libselinux/matchpathcon: Add the previous fix to the correct test Commit ab42eb93 added the change to another test by mistake. Fixes: # cd libselinux/setfiles-in-chroot-env # 1minutetip 1MT-CentOS-Stream-9 # ./runtest.sh yum -y install filesystem libselinux libselinux-utils python3-libselinux policycoreutils --installroot=/tmp/tmp.WhKcf2BrOe --skip-broken' Unable to detect release version (use '--releasever' to specify release version) Error: Failed to download metadata for repo 'epel': Cannot prepare internal mirrorlist: Status code: 404 [ FAIL ] Signed-off-by: Vit Mojzis --- libselinux/matchpathcon-in-chroot-env/runtest.sh | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libselinux/matchpathcon-in-chroot-env/runtest.sh b/libselinux/matchpathcon-in-chroot-env/runtest.sh index f68fca2..d7bc443 100755 --- a/libselinux/matchpathcon-in-chroot-env/runtest.sh +++ b/libselinux/matchpathcon-in-chroot-env/runtest.sh @@ -40,6 +40,10 @@ fi if yum install --help | grep -q skip-unavailable ; then INSTALL_OPTION="${INSTALL_OPTION} --skip-unavailable" fi +# yum sometimes fails to detect the release version on CentOS 9 +if rlIsCentOS 9 ; then + INSTALL_OPTION="${INSTALL_OPTION} --releasever 9" +fi rlJournalStart rlPhaseStartSetup From 6efe97887e311710f97dd02756b578355760c0c3 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Wed, 28 Aug 2024 15:18:33 +0200 Subject: [PATCH 391/626] kernel/selinux-testsuite: apply a patch for ELN/EL10 compatibility Fedora ELN / RHEL-10 has disabled CONFIG_NET_KEY, so apply a patch that allows the testsuite to succeed by skipping the key_socket test when it is not supported. Signed-off-by: Ondrej Mosnacek --- kernel/selinux-testsuite/runtest.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/selinux-testsuite/runtest.sh b/kernel/selinux-testsuite/runtest.sh index 40846f2..9b317b3 100755 --- a/kernel/selinux-testsuite/runtest.sh +++ b/kernel/selinux-testsuite/runtest.sh @@ -41,7 +41,7 @@ DEFAULT_COMMIT="f9f4a604b50eecdc9ff674f1762208f23c15013f" # requests (by number) are merged, creating a new temporary local branch. DEFAULT_PULLS="" # Default SELinux Patchwork series to apply before running the test. -DEFAULT_PATCHES="" +DEFAULT_PATCHES="883857" # Optional test parameter - location of testuite git. GIT_URL=${GIT_URL:-"https://github.com/SELinuxProject/selinux-testsuite"} From 5e03405ed4f761adcf79e479ebf33c0dc76e4ad5 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Tue, 13 Aug 2024 15:26:19 +0200 Subject: [PATCH 392/626] Add a test for two-way SCTP association setup Signed-off-by: Ondrej Mosnacek --- kernel/sctp_peeloff_corner_case/main.fmf | 25 +++ kernel/sctp_peeloff_corner_case/reproducer.c | 187 +++++++++++++++++++ kernel/sctp_peeloff_corner_case/runtest.sh | 100 ++++++++++ 3 files changed, 312 insertions(+) create mode 100644 kernel/sctp_peeloff_corner_case/main.fmf create mode 100644 kernel/sctp_peeloff_corner_case/reproducer.c create mode 100755 kernel/sctp_peeloff_corner_case/runtest.sh diff --git a/kernel/sctp_peeloff_corner_case/main.fmf b/kernel/sctp_peeloff_corner_case/main.fmf new file mode 100644 index 0000000..582248e --- /dev/null +++ b/kernel/sctp_peeloff_corner_case/main.fmf @@ -0,0 +1,25 @@ +summary: Verify that two-way SCTP association setup doesn't trigger AVCs +description: | + When two SCTP endpoints try to initiate an association + simultaneously with each other, they may hit various corner cases. + This test verifies that this scenario works correctly and that the + resulting association is properly labeled (by peeling it off, which + transfers the label onto the new socket). +contact: Ondrej Mosnacek +component: + - kernel +framework: beakerlib +require: + - make + - gcc + - lksctp-tools-devel + - audit +duration: 10m +tier: 2 +enabled: true +adjust: + - enabled: false + when: distro < rhel-8 + because: RHEL-7 and below don't have SCTP SELinux support +link: + - verifies: https://issues.redhat.com/browse/RHEL-48647 diff --git a/kernel/sctp_peeloff_corner_case/reproducer.c b/kernel/sctp_peeloff_corner_case/reproducer.c new file mode 100644 index 0000000..de6cedb --- /dev/null +++ b/kernel/sctp_peeloff_corner_case/reproducer.c @@ -0,0 +1,187 @@ +// SPDX-License-Identifier: GPLv2 +/* + * Copyright (c) 2024 Red Hat, Inc. + * Author: Ondrej Mosnacek + */ + +#include +#include +#include +#include +#include +#include +#include +#include + +#include +#include +#include +#include +#include + +static const char * const TEST_PORTS[] = { "9998", "9999" }; + +#define ITERATIONS 1000 + +#define member_size(type, member) sizeof(((type *)0)->member) +#define sizeof_up_to(type, member) (offsetof(type, member) + member_size(type, member)) + +enum { + PIPE_R = 0, + PIPE_W, +}; + +int main(int argc, char **argv) +{ + int sock, psock, result, flags, index, i, pipefd[2], pipes[2][2]; + struct addrinfo hints, *info; + struct sctp_event_subscribe subscr_events; + pid_t fork_pid; + char byte = 0x41, data[1024]; + sctp_assoc_t assoc_id; + union sctp_notification *notif; + + result = pipe(pipefd); + if (result < 0) { + perror("pipe"); + return 1; + } + pipes[0][PIPE_R] = pipefd[0]; + pipes[1][PIPE_W] = pipefd[1]; + + result = pipe(pipefd); + if (result < 0) { + perror("pipe"); + return 1; + } + pipes[1][PIPE_R] = pipefd[0]; + pipes[0][PIPE_W] = pipefd[1]; + + fork_pid = fork(); + if (fork_pid < 0) { + perror("fork"); + return 1; + } + + index = !!fork_pid; + close(pipes[!index][PIPE_R]); + close(pipes[!index][PIPE_W]); + + memset(&hints, 0, sizeof(struct addrinfo)); + hints.ai_flags = AI_PASSIVE; + hints.ai_protocol = IPPROTO_SCTP; + hints.ai_family = AF_INET; + hints.ai_socktype = SOCK_SEQPACKET; + + result = getaddrinfo(NULL, TEST_PORTS[index], &hints, &info); + if (result < 0) { + fprintf(stderr, "getaddrinfo: %s\n", gai_strerror(result)); + return 1; + } + + sock = socket(info->ai_family, info->ai_socktype, info->ai_protocol); + if (sock < 0) { + perror("socket"); + return 1; + } + + result = bind(sock, info->ai_addr, info->ai_addrlen); + if (result < 0) { + perror("bind"); + return 1; + } + + if (listen(sock, SOMAXCONN)) { + perror("listen"); + return 1; + } + + memset(&subscr_events, 0, sizeof(subscr_events)); + subscr_events.sctp_association_event = 1; + result = setsockopt(sock, IPPROTO_SCTP, SCTP_EVENTS, &subscr_events, + sizeof_up_to(struct sctp_event_subscribe, + sctp_association_event)); + + memset(&hints, 0, sizeof(struct addrinfo)); + hints.ai_protocol = IPPROTO_SCTP; + hints.ai_socktype = SOCK_SEQPACKET; + + result = getaddrinfo("127.0.0.1", TEST_PORTS[!index], &hints, &info); + if (result < 0) { + fprintf(stderr, "getaddrinfo: %s\n", gai_strerror(result)); + return 1; + } + + for (i = 0; i < ITERATIONS; i++) { + printf("[%i] ITERATION %i...\n", index, i); + + /* synchronize */ + result = write(pipes[index][PIPE_W], &byte, 1); + if (result < 0) { + perror("pipe"); + return 1; + } + result = read(pipes[index][PIPE_R], &byte, 1); + if (result < 0) { + perror("pipe"); + return 1; + } + + result = connect(sock, info->ai_addr, info->ai_addrlen); + if (result < 0 && errno != EISCONN) { + perror("connect"); + return 1; + } + + /* Get assoc_id for sctp_peeloff() */ + flags = 0; + result = sctp_recvmsg(sock, data, sizeof(data), + NULL, 0, NULL, &flags); + if (result < 0) { + perror("sctp_recvmsg"); + return 1; + } + + if ((flags & (MSG_NOTIFICATION | MSG_EOR)) != (MSG_NOTIFICATION | MSG_EOR)) { + fprintf(stderr, "[%i] Invalid sctp_recvmsg response FLAGS: %x\n", index, flags); + return 1; + } + + notif = (union sctp_notification *)data; + if (notif->sn_header.sn_type != SCTP_ASSOC_CHANGE) { + fprintf(stderr, "[%i] Invalid sctp_recvmsg response type: %x\n", index, notif->sn_header.sn_type); + return 1; + } + assoc_id = notif->sn_assoc_change.sac_assoc_id; + psock = sctp_peeloff(sock, assoc_id); + if (psock < 0) { + perror("sctp_peeloff"); + return 1; + } + + data[0] = 42; + result = sctp_sendmsg(psock, data, 1, NULL, 0, + 0, 0, 0, 0, 0); + if (result < 0) { + perror("sctp_sendmsg"); + return 1; + } + + result = sctp_recvmsg(psock, data, sizeof(data), + NULL, 0, NULL, NULL); + if (result < 0) { + perror("sctp_recvmsg"); + return 1; + } + + if (data[0] != 42) { + fprintf(stderr, "[%i] Invalid sctp_recvmsg response: %d\n", index, (int)data[0]); + return 1; + } + + close(psock); + printf("[%i] ITERATION %i SUCCESS!\n", index, i); + } + close(sock); + return 0; +} diff --git a/kernel/sctp_peeloff_corner_case/runtest.sh b/kernel/sctp_peeloff_corner_case/runtest.sh new file mode 100755 index 0000000..19649bd --- /dev/null +++ b/kernel/sctp_peeloff_corner_case/runtest.sh @@ -0,0 +1,100 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# SPDX-License-Identifier: GPLv2 +# Copyright (c) 2024 Red Hat, Inc. +# Author: Ondrej Mosnacek + +# Include Beakerlib environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +function installDepsYum() { + local yum="$1"; shift + + if "$yum" install --help | grep -q -- --skip-unavailable; then + "$yum" install -y --skip-unavailable $* + elif "$yum" install --help | grep -q -- --skip-broken; then + "$yum" install -y --skip-broken $* + else + for req in $*; do + if ! rpm -q --quiet --whatprovides "$req"; then + "$yum" install -y "$req" || true + fi + done + fi +} + +function installDeps() { + if [ -e /run/ostree-booted ]; then + for item in "$@"; do + if ! rpm -q --quiet --whatprovides "$item"; then + rpm-ostree --apply-live -y install "$item" + fi + done + elif type yum >/dev/null; then + installDepsYum yum "$@" + elif type dnf >/dev/null; then + installDepsYum dnf "$@" + fi +} + +function check_avc_begin() { + sleep 1.1 + date +'%x %T' + sleep 1.1 +} + +function check_avc_end() { + marker="marker-$RANDOM" + + auditctl -m "$marker" + + for (( i = 0; i < 100; i++ )); do + if ausearch -i -m user -ts $1 2>/dev/null Date: Tue, 27 Aug 2024 17:17:12 +0200 Subject: [PATCH 393/626] add a new boothd test Recently, the boothd program got confined by SELinux. Purpose of this automated test is to find out if basic scenarios work as expected under the current SELinux policy. The TC covers RHEL-45907. --- selinux-policy/boothd-and-similar/Makefile | 69 +++++++++++++++ selinux-policy/boothd-and-similar/PURPOSE | 6 ++ selinux-policy/boothd-and-similar/main.fmf | 40 +++++++++ selinux-policy/boothd-and-similar/runtest.sh | 93 ++++++++++++++++++++ 4 files changed, 208 insertions(+) create mode 100644 selinux-policy/boothd-and-similar/Makefile create mode 100644 selinux-policy/boothd-and-similar/PURPOSE create mode 100644 selinux-policy/boothd-and-similar/main.fmf create mode 100755 selinux-policy/boothd-and-similar/runtest.sh diff --git a/selinux-policy/boothd-and-similar/Makefile b/selinux-policy/boothd-and-similar/Makefile new file mode 100644 index 0000000..7fd82bb --- /dev/null +++ b/selinux-policy/boothd-and-similar/Makefile @@ -0,0 +1,69 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/boothd-and-similar +# Description: SELinux interferes with boothd and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2024 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/boothd-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: the service was running as initrc_t or init_t, now it is confined by SELinux" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "RunFor: booth" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console booth-arbitrator booth-core /usr/sbin/service net-tools" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) + @echo "Bug: RHEL-45907" >> $(METADATA) # RHEL-10 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/boothd-and-similar/PURPOSE b/selinux-policy/boothd-and-similar/PURPOSE new file mode 100644 index 0000000..def5594 --- /dev/null +++ b/selinux-policy/boothd-and-similar/PURPOSE @@ -0,0 +1,6 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/boothd-and-similar +Author: Milos Malik + +SELinux interferes with boothd and related programs. +Covers the booth-arbitrator service. + diff --git a/selinux-policy/boothd-and-similar/main.fmf b/selinux-policy/boothd-and-similar/main.fmf new file mode 100644 index 0000000..6d1791b --- /dev/null +++ b/selinux-policy/boothd-and-similar/main.fmf @@ -0,0 +1,40 @@ +summary: SELinux interferes with boothd and related programs +description: |+ + SELinux interferes with boothd and related programs. + +contact: Milos Malik +component: + - selinux-policy +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - booth-arbitrator + - booth-core + - /usr/sbin/service + - net-tools +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - targeted + - NoRHIVOS +link: + - verifies: https://issues.redhat.com/browse/RHEL-45907 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + because: the booth package is not available there +extra-summary: /CoreOS/selinux-policy/Regression/boothd-and-similar +extra-task: /CoreOS/selinux-policy/Regression/boothd-and-similar diff --git a/selinux-policy/boothd-and-similar/runtest.sh b/selinux-policy/boothd-and-similar/runtest.sh new file mode 100755 index 0000000..2845bf1 --- /dev/null +++ b/selinux-policy/boothd-and-similar/runtest.sh @@ -0,0 +1,93 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/boothd-and-similar +# Description: SELinux interferes with boothd and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2024 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +FILE_PATH="/usr/sbin/boothd" +SERVICE_PACKAGE="booth-arbitrator" +SERVICE_NAME="booth-arbitrator" +PROCESS_NAME="boothd" +if seinfo -t | grep -q boothd ; then + FILE_CONTEXT="boothd_exec_t" + PROCESS_CONTEXT="boothd_t" +else + FILE_CONTEXT="bin_t" + PROCESS_CONTEXT="unconfined_service_t" +fi + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} + rlFileBackup /etc/booth/booth.conf + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + if seinfo -t | grep -q boothd ; then + rlPhaseStartTest "RHEL-45907" + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + rlSEMatchPathCon "/run/systemd/userdb" "systemd_userdbd_runtime_t" + rlSESearchRule "allow boothd_t systemd_userdbd_runtime_t : dir { read } [ ]" + rlSESearchRule "allow boothd_t systemd_userdbd_runtime_t : sock_file { write } [ ]" + rlSESearchRule "allow boothd_t systemd_userdbd_t : unix_stream_socket { connectto } [ ]" + rlPhaseEnd + fi + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then + rlPhaseStartTest "real scenario -- standalone service" + IF_NAME=`route | grep default | awk '{ print $8 }'` + IP_ADDRESS=`ip addr show ${IF_NAME} | grep 'inet ' | cut -d / -f 1 | awk '{ print $2 }' | head -n 1` + rlRun "cp -f /usr/share/doc/booth/booth.conf.example /etc/booth/booth.conf" + rlRun "sed -i 's/^arbitrator=.*$/arbitrator=\"${IP_ADDRESS}\"/' /etc/booth/booth.conf" + rlRun "grep ^arbitrator /etc/booth/booth.conf" + rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /etc /var /run -e /var/ARTIFACTS" 0-255 + rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + fi + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + rlFileRestore + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + From 2401e40bac22b93b0924e374c5d6c1161e665a82 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Mon, 9 Sep 2024 11:28:37 +0200 Subject: [PATCH 394/626] kernel: improve kernel pkg name detection When kernel-uk-virt is installed, the rpm query returns more than one result, leading to (non-fatal) errors in the Setup phase. Query for the kernel image path instead to avoid this. Signed-off-by: Ondrej Mosnacek --- kernel/sctp_peeloff_corner_case/runtest.sh | 2 +- kernel/selinux-testsuite/runtest.sh | 2 +- kernel/xfrm-refcount-underflow/runtest.sh | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/kernel/sctp_peeloff_corner_case/runtest.sh b/kernel/sctp_peeloff_corner_case/runtest.sh index 19649bd..befc319 100755 --- a/kernel/sctp_peeloff_corner_case/runtest.sh +++ b/kernel/sctp_peeloff_corner_case/runtest.sh @@ -67,7 +67,7 @@ rlJournalStart # Determine the base kernel package name and version corresponding # to the currently running kernel. Use this information to derive # the correct kernel subpackages to install. - if KERNEL_CORE_NVRA="$(rpm -qf "/lib/modules/$(uname -r)/config")"; then + if KERNEL_CORE_NVRA="$(rpm -qf "/boot/vmlinuz-$(uname -r)")"; then KERNEL_CORE_NV="${KERNEL_CORE_NVRA%-*}" KERNEL_CORE_N="${KERNEL_CORE_NV%-*}" diff --git a/kernel/selinux-testsuite/runtest.sh b/kernel/selinux-testsuite/runtest.sh index 9b317b3..a030e15 100755 --- a/kernel/selinux-testsuite/runtest.sh +++ b/kernel/selinux-testsuite/runtest.sh @@ -124,7 +124,7 @@ rlJournalStart # Determine the base kernel package name and version corresponding # to the currently running kernel. Use this information to derive # the correct kernel subpackages to install. - if KERNEL_CORE_NVRA="$(rpm -qf "/lib/modules/$(uname -r)/config")"; then + if KERNEL_CORE_NVRA="$(rpm -qf "/boot/vmlinuz-$(uname -r)")"; then KERNEL_CORE_NV="${KERNEL_CORE_NVRA%-*}" KERNEL_CORE_N="${KERNEL_CORE_NV%-*}" diff --git a/kernel/xfrm-refcount-underflow/runtest.sh b/kernel/xfrm-refcount-underflow/runtest.sh index 580484d..42392ba 100755 --- a/kernel/xfrm-refcount-underflow/runtest.sh +++ b/kernel/xfrm-refcount-underflow/runtest.sh @@ -36,7 +36,7 @@ rlJournalStart # Determine the base kernel package name and version corresponding # to the currently running kernel. Use this information to derive # the correct kernel subpackages to install. - if KERNEL_CORE_NVRA="$(rpm -qf "/lib/modules/$(uname -r)/config")"; then + if KERNEL_CORE_NVRA="$(rpm -qf "/boot/vmlinuz-$(uname -r)")"; then KERNEL_CORE_NV="${KERNEL_CORE_NVRA%-*}" KERNEL_CORE_N="${KERNEL_CORE_NV%-*}" From 34b723751329077aac4db2c7f6fed386ce402ca3 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Fri, 6 Sep 2024 14:04:23 +0200 Subject: [PATCH 395/626] do not rely on /etc/firewalld/lockdown-whitelist.xml Recently, the automated test started failing because the following file was not present: /etc/firewalld/lockdown-whitelist.xml. From now on, the test should not fail because of this. --- selinux-policy/firewalld-and-similar/runtest.sh | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/selinux-policy/firewalld-and-similar/runtest.sh b/selinux-policy/firewalld-and-similar/runtest.sh index a4c117c..58d6f4f 100755 --- a/selinux-policy/firewalld-and-similar/runtest.sh +++ b/selinux-policy/firewalld-and-similar/runtest.sh @@ -194,8 +194,10 @@ rlJournalStart rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" rlRun "rm -rf /run/firewalld" rlRun "rm -f /run/xtables.lock" - rlRun "mv /etc/firewalld/lockdown-whitelist.xml /etc/firewalld/lockdown-whitelist.xml.orig" - rlRun "ln -s /etc/firewalld/lockdown-whitelist.xml.orig /etc/firewalld/lockdown-whitelist.xml" + if [ -f /etc/firewalld/lockdown-whitelist.xml ] ; then + rlRun "mv /etc/firewalld/lockdown-whitelist.xml /etc/firewalld/lockdown-whitelist.xml.orig" + rlRun "ln -s /etc/firewalld/lockdown-whitelist.xml.orig /etc/firewalld/lockdown-whitelist.xml" + fi # see https://bugzilla.redhat.com/show_bug.cgi?id=907902#c7 # rlRun "rm -f /usr/lib{,64}/python2.7/site.{pyc,pyo}" if ! rlSEDefined ${PROCESS_CONTEXT} ; then @@ -206,7 +208,7 @@ rlJournalStart fi fi rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 + rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlRun "rm -f /etc/firewalld/lockdown-whitelist.xml*" rlRun "ls -dZ /run/firewalld | grep :firewalld_var_run_t" From 7615b2d8c7807082e072b57399df9e0f5eb5798a Mon Sep 17 00:00:00 2001 From: Zdenek Pytela Date: Wed, 11 Sep 2024 16:32:19 +0200 Subject: [PATCH 396/626] Do not check if "%{_sbindir}" rpm macro is used With Changes/Unify_bin_and_sbin [1] in process, policy sources stopped to refer to executables with full path using the "%{_bindir}" and "%{_sbindir}" rpm macros. [1] https://fedoraproject.org/wiki/Changes/Unify_bin_and_sbin --- selinux-policy/policy-rpm-macros/runtest.sh | 1 - 1 file changed, 1 deletion(-) diff --git a/selinux-policy/policy-rpm-macros/runtest.sh b/selinux-policy/policy-rpm-macros/runtest.sh index 58aa091..7be30c1 100755 --- a/selinux-policy/policy-rpm-macros/runtest.sh +++ b/selinux-policy/policy-rpm-macros/runtest.sh @@ -47,7 +47,6 @@ rlJournalStart rlPhaseStartTest "bz#1415694" rlRun "grep selinuxenabled ${MACRO_FILE}" - rlRun "grep selinuxenabled ${MACRO_FILE} | grep _sbindir" rlRun "grep selinuxenabled ${MACRO_FILE} | grep /usr/sbin/" 1 rlPhaseEnd From 9d0f01d9c3a84989e555f4f9a23152612cefd712 Mon Sep 17 00:00:00 2001 From: Zdenek Pytela Date: Wed, 11 Sep 2024 16:20:25 +0200 Subject: [PATCH 397/626] Fix the phase for secretmem anon_inode type The fix for bz#2270895 contains a transition when a secretmem type of anon_inode class is to be created, similar to io_uring and userfaultfd. --- selinux-policy/anon_inode-and-similar/runtest.sh | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/selinux-policy/anon_inode-and-similar/runtest.sh b/selinux-policy/anon_inode-and-similar/runtest.sh index 762a788..6efbe69 100755 --- a/selinux-policy/anon_inode-and-similar/runtest.sh +++ b/selinux-policy/anon_inode-and-similar/runtest.sh @@ -98,7 +98,10 @@ rlJournalStart rlPhaseEnd rlPhaseStartTest "bz#2270895" - rlSESearchRule "allow unconfined_t unconfined_t : anon_inode { create } [ ]" + rlSESearchRule "allow unconfined_t secretmem_t : anon_inode { create } [ ]" + rlSESearchRule "allow sysadm_t secretmem_t : anon_inode { create } [ ]" + rlSESearchRule "type_transition unconfined_t unconfined_t : anon_inode secretmem_t [secretmem]" + rlSESearchRule "type_transition sysadm_t sysadm_t : anon_inode secretmem_t [secretmem]" rlRun "stress-ng --resources 16 --timeout 5 --log-file /dev/null" rlPhaseEnd From 28a763c2e01eb3b0be54512d7b82e27e28545949 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Thu, 12 Sep 2024 15:53:29 +0200 Subject: [PATCH 398/626] mark tests which are failing on RHEL-10 Tests which require the EPEL repository are tagged with rhel10-epel. Tests which fail for other reasons are tagged with rhel10_broken. --- libselinux/selabel-functions/main.fmf | 1 + selinux-policy/bgpd-and-similar/main.fmf | 1 + selinux-policy/boinc-and-similar/main.fmf | 1 + selinux-policy/bz533007-unable-to-start-kdump-service/main.fmf | 1 + selinux-policy/cups-pdf-and-similar/main.fmf | 1 + selinux-policy/exim-and-similar/main.fmf | 1 + selinux-policy/ntpsec-and-similar/main.fmf | 1 + selinux-policy/nvme-stas-and-similar/main.fmf | 2 +- selinux-policy/opensmtpd-and-similar/main.fmf | 1 + selinux-policy/snapd-and-similar/main.fmf | 1 + selinux-policy/tlp-and-similar/main.fmf | 1 + setools/apol/main.fmf | 1 + 12 files changed, 12 insertions(+), 1 deletion(-) diff --git a/libselinux/selabel-functions/main.fmf b/libselinux/selabel-functions/main.fmf index f079f81..0a89a8f 100644 --- a/libselinux/selabel-functions/main.fmf +++ b/libselinux/selabel-functions/main.fmf @@ -17,6 +17,7 @@ tag: - TierCandidatesPASS - f33friendly - targeted + - rhel10_broken link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1390909 adjust: diff --git a/selinux-policy/bgpd-and-similar/main.fmf b/selinux-policy/bgpd-and-similar/main.fmf index 2a836ea..c84edb6 100644 --- a/selinux-policy/bgpd-and-similar/main.fmf +++ b/selinux-policy/bgpd-and-similar/main.fmf @@ -31,6 +31,7 @@ tag: - epel - rhel8-epel - rhel9-epel + - rhel10-epel - targeted - NoRHIVOS tier: '2' diff --git a/selinux-policy/boinc-and-similar/main.fmf b/selinux-policy/boinc-and-similar/main.fmf index a3dcc0a..3d3bf7c 100644 --- a/selinux-policy/boinc-and-similar/main.fmf +++ b/selinux-policy/boinc-and-similar/main.fmf @@ -34,6 +34,7 @@ tag: - epel - rhel8-epel - rhel9-epel + - rhel10-epel - NoRHIVOS link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1618683 diff --git a/selinux-policy/bz533007-unable-to-start-kdump-service/main.fmf b/selinux-policy/bz533007-unable-to-start-kdump-service/main.fmf index 9f4ecbc..0714eaa 100644 --- a/selinux-policy/bz533007-unable-to-start-kdump-service/main.fmf +++ b/selinux-policy/bz533007-unable-to-start-kdump-service/main.fmf @@ -36,6 +36,7 @@ tag: - failinfedora - targeted - NoRHIVOS + - rhel10_broken link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=533007 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=533366 diff --git a/selinux-policy/cups-pdf-and-similar/main.fmf b/selinux-policy/cups-pdf-and-similar/main.fmf index 7f64dc5..fd859d9 100644 --- a/selinux-policy/cups-pdf-and-similar/main.fmf +++ b/selinux-policy/cups-pdf-and-similar/main.fmf @@ -35,6 +35,7 @@ tag: - epel - rhel8-epel - rhel9-epel + - rhel10-epel - NoRHIVOS link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=560220 diff --git a/selinux-policy/exim-and-similar/main.fmf b/selinux-policy/exim-and-similar/main.fmf index 0d2cbac..e2ed297 100644 --- a/selinux-policy/exim-and-similar/main.fmf +++ b/selinux-policy/exim-and-similar/main.fmf @@ -35,6 +35,7 @@ tag: - epel - rhel8-epel - rhel9-epel + - rhel10-epel - NoRHIVOS link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1025315 diff --git a/selinux-policy/ntpsec-and-similar/main.fmf b/selinux-policy/ntpsec-and-similar/main.fmf index e8ee0f3..bee3455 100644 --- a/selinux-policy/ntpsec-and-similar/main.fmf +++ b/selinux-policy/ntpsec-and-similar/main.fmf @@ -29,6 +29,7 @@ tag: - NoRHEL8 - epel - rhel9-epel + - rhel10-epel - targeted - NoRHIVOS tier: '3' diff --git a/selinux-policy/nvme-stas-and-similar/main.fmf b/selinux-policy/nvme-stas-and-similar/main.fmf index f58450e..e5b5cf7 100644 --- a/selinux-policy/nvme-stas-and-similar/main.fmf +++ b/selinux-policy/nvme-stas-and-similar/main.fmf @@ -36,7 +36,7 @@ link: - verifies: https://issues.redhat.com/browse/RHEL-1557 adjust: - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8 + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8, rhel-10, centos-stream-10 because: the nvme-stas package is not available there extra-summary: /CoreOS/selinux-policy/Regression/nvme-stas-and-similar extra-task: /CoreOS/selinux-policy/Regression/nvme-stas-and-similar diff --git a/selinux-policy/opensmtpd-and-similar/main.fmf b/selinux-policy/opensmtpd-and-similar/main.fmf index 35120f9..36bf0e7 100644 --- a/selinux-policy/opensmtpd-and-similar/main.fmf +++ b/selinux-policy/opensmtpd-and-similar/main.fmf @@ -31,6 +31,7 @@ tag: - epel - rhel8-epel - rhel9-epel + - rhel10-epel - NoRHIVOS link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2208696 diff --git a/selinux-policy/snapd-and-similar/main.fmf b/selinux-policy/snapd-and-similar/main.fmf index cb3e6d8..9715cbd 100644 --- a/selinux-policy/snapd-and-similar/main.fmf +++ b/selinux-policy/snapd-and-similar/main.fmf @@ -32,6 +32,7 @@ tag: - epel - rhel8-epel - rhel9-epel + - rhel10-epel - NoRHIVOS link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2207725 diff --git a/selinux-policy/tlp-and-similar/main.fmf b/selinux-policy/tlp-and-similar/main.fmf index 010d91b..9144304 100644 --- a/selinux-policy/tlp-and-similar/main.fmf +++ b/selinux-policy/tlp-and-similar/main.fmf @@ -35,6 +35,7 @@ tag: - epel - rhel8-epel - rhel9-epel + - rhel10-epel - NoRHIVOS link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1460481 diff --git a/setools/apol/main.fmf b/setools/apol/main.fmf index 3ec5295..199523b 100644 --- a/setools/apol/main.fmf +++ b/setools/apol/main.fmf @@ -25,6 +25,7 @@ tag: - NoRHEL6 - NoRHEL7 - targeted + - rhel10_broken link: - relates: https://issues.redhat.com/browse/RHEL-29967 adjust: From 4f44f21f576c326266b6c8cca427b702310ae76c Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Fri, 6 Sep 2024 15:20:56 +0200 Subject: [PATCH 399/626] test if new dhcpcd instance can kill an old instance Because the ISC dhcp is no longer maintained by upstream, the dhcpcd package is used as a replacement. Unfortunately, SELinux prevents a new dhcpcd instance from communicating to and terminating the old one. The TC does not reproduce the situation. In order to support the intented dhcpcd functionality, I believe that SELinux policy should allow these actions. The TC looks for appropriate policy rules and file context patterns. The TC covers RHEL-33081 and RHEL-43417. --- selinux-policy/dhcpcd-and-similar/Makefile | 2 ++ selinux-policy/dhcpcd-and-similar/main.fmf | 2 ++ selinux-policy/dhcpcd-and-similar/runtest.sh | 11 +++++++++++ 3 files changed, 15 insertions(+) diff --git a/selinux-policy/dhcpcd-and-similar/Makefile b/selinux-policy/dhcpcd-and-similar/Makefile index e124576..4b3f11f 100644 --- a/selinux-policy/dhcpcd-and-similar/Makefile +++ b/selinux-policy/dhcpcd-and-similar/Makefile @@ -67,6 +67,8 @@ $(METADATA): Makefile @echo "Bug: RHEL-15326" >> $(METADATA) # RHEL-9 @echo "Bug: 2269708" >> $(METADATA) # Fedora 40 @echo "Bug: 2270733" >> $(METADATA) # Fedora 41 + @echo "Bug: RHEL-33081" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-43417" >> $(METADATA) # RHEL-10 rhts-lint $(METADATA) diff --git a/selinux-policy/dhcpcd-and-similar/main.fmf b/selinux-policy/dhcpcd-and-similar/main.fmf index ff2cbf1..6592423 100644 --- a/selinux-policy/dhcpcd-and-similar/main.fmf +++ b/selinux-policy/dhcpcd-and-similar/main.fmf @@ -34,6 +34,8 @@ link: - verifies: https://issues.redhat.com/browse/RHEL-15326 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2269708 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2270733 + - verifies: https://issues.redhat.com/browse/RHEL-33081 + - verifies: https://issues.redhat.com/browse/RHEL-43417 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7 diff --git a/selinux-policy/dhcpcd-and-similar/runtest.sh b/selinux-policy/dhcpcd-and-similar/runtest.sh index f1fb91c..ba9ea50 100755 --- a/selinux-policy/dhcpcd-and-similar/runtest.sh +++ b/selinux-policy/dhcpcd-and-similar/runtest.sh @@ -98,6 +98,17 @@ rlJournalStart rlPhaseEnd fi + if rlIsRHEL 10 || rlIsCentOS 10 ; then + rlPhaseStartTest "RHEL-33081" + rlSEMatchPathCon "/run/dhcpcd/eth0-4.unpriv.sock" "dhcpc_var_run_t" + rlSESearchRule "allow dhcpc_t dhcpc_t : unix_stream_socket { connectto } [ ]" + rlPhaseEnd + + rlPhaseStartTest "RHEL-43417" + rlSESearchRule "allow dhcpc_t dhcpc_t : capability { kill } [ ]" + rlPhaseEnd + fi + rlPhaseStartTest "real scenario -- standalone service" rlRun "ip netns add test-ns" rlRun "ip netns del test-ns" From 917da0db4b3d51f66b167e02e070ab28f81e52da Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 10 Sep 2024 17:15:50 +0200 Subject: [PATCH 400/626] test if systemd-sysctl can read files under /run/sysctl.d/ A recently filed issue revealed that SELinux prevents the systemd-sysctl from reading the files stored under the /run/sysctl.d/ directory. The TC reproduces the situation. In order to support this documented sysctl specific location, I believe that SELinux policy should allow the action. The TC looks for SELinux denials that may appear when reproducing the scenario. The TC covers RHEL-56988 and RHEL-58380. --- selinux-policy/systemd-sysctl-and-similar/Makefile | 2 ++ selinux-policy/systemd-sysctl-and-similar/main.fmf | 2 ++ selinux-policy/systemd-sysctl-and-similar/runtest.sh | 12 +++++++++++- 3 files changed, 15 insertions(+), 1 deletion(-) diff --git a/selinux-policy/systemd-sysctl-and-similar/Makefile b/selinux-policy/systemd-sysctl-and-similar/Makefile index 5b5981e..fbb3c30 100644 --- a/selinux-policy/systemd-sysctl-and-similar/Makefile +++ b/selinux-policy/systemd-sysctl-and-similar/Makefile @@ -64,6 +64,8 @@ $(METADATA): Makefile @echo "Releases: -RHEL4 -RHEL6 -RHEL7 -RHELClient5 -RHELServer5" >> $(METADATA) @echo "Bug: 2056207" >> $(METADATA) # Fedora 36 @echo "Bug: 2056999" >> $(METADATA) # RHEL-9 + @echo "Bug: RHEL-56988" >> $(METADATA) # RHEL-9 + @echo "Bug: RHEL-58380" >> $(METADATA) # RHEL-10 rhts-lint $(METADATA) diff --git a/selinux-policy/systemd-sysctl-and-similar/main.fmf b/selinux-policy/systemd-sysctl-and-similar/main.fmf index 6ae3010..996e1d7 100644 --- a/selinux-policy/systemd-sysctl-and-similar/main.fmf +++ b/selinux-policy/systemd-sysctl-and-similar/main.fmf @@ -29,6 +29,8 @@ tag: link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2056207 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2056999 + - verifies: https://issues.redhat.com/browse/RHEL-56988 + - verifies: https://issues.redhat.com/browse/RHEL-58380 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 diff --git a/selinux-policy/systemd-sysctl-and-similar/runtest.sh b/selinux-policy/systemd-sysctl-and-similar/runtest.sh index e7ef474..4667ee4 100755 --- a/selinux-policy/systemd-sysctl-and-similar/runtest.sh +++ b/selinux-policy/systemd-sysctl-and-similar/runtest.sh @@ -59,11 +59,21 @@ rlJournalStart rlRun "ls -Z /proc/sys/kernel/kptr_restrict | grep :proc_security_t" rlSESearchRule "allow systemd_sysctl_t proc_security_t : file { read } [ ]" rlPhaseEnd + + rlPhaseStartTest "RHEL-56988 + RHEL-58380" + rlRun "man sysctl.d | grep /run/sysctl" + rlRun "mkdir -pZ /run/sysctl.d" + rlRun "echo 'net.ipv4.conf.eno1.rp_filter=0' > /run/sysctl.d/51-rp_filter.conf" + rlRun "restorecon -Rv /run/sysctl.d" + rlRun "service systemd-sysctl stop" + rlRun "service systemd-sysctl start" + rlRun "service systemd-sysctl status" 0,3 + rlPhaseEnd fi rlPhaseStartTest "real scenario" rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 + rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd From 9245b35ac692573edee14bc98d56d0c4a5ccce5a Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Wed, 11 Sep 2024 10:17:19 +0200 Subject: [PATCH 401/626] test if boothd can talk to kernel via UNIX socket A recent booth + selinux-policy testing revealed that SELinux prevents the boothd processes from reading the /run/systemd/userdb/ directory and connecting through the io.systemd.DynamicUser socket stored in it. The TC reproduces the situation. In order to support the intended boothd functionality, I believe that SELinux policy should allow these actions. The TC looks for appropriate policy rules and file context patterns. The TC covers RHEL-57104 and RHEL-58060. --- selinux-policy/boothd-and-similar/Makefile | 4 +++- selinux-policy/boothd-and-similar/main.fmf | 2 ++ selinux-policy/boothd-and-similar/runtest.sh | 4 ++++ 3 files changed, 9 insertions(+), 1 deletion(-) diff --git a/selinux-policy/boothd-and-similar/Makefile b/selinux-policy/boothd-and-similar/Makefile index 7fd82bb..d78cc89 100644 --- a/selinux-policy/boothd-and-similar/Makefile +++ b/selinux-policy/boothd-and-similar/Makefile @@ -50,7 +50,7 @@ $(METADATA): Makefile @echo "Name: $(TEST)" >> $(METADATA) @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) @echo "Path: $(TEST_DIR)" >> $(METADATA) - @echo "Description: the service was running as initrc_t or init_t, now it is confined by SELinux" >> $(METADATA) + @echo "Description: SELinux interferes with boothd and related programs" >> $(METADATA) @echo "Type: Regression" >> $(METADATA) @echo "TestTime: 10m" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) @@ -64,6 +64,8 @@ $(METADATA): Makefile @echo "Destructive: no" >> $(METADATA) @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) @echo "Bug: RHEL-45907" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-57104" >> $(METADATA) # RHEL-9 + @echo "Bug: RHEL-58060" >> $(METADATA) # RHEL-10 rhts-lint $(METADATA) diff --git a/selinux-policy/boothd-and-similar/main.fmf b/selinux-policy/boothd-and-similar/main.fmf index 6d1791b..90edcac 100644 --- a/selinux-policy/boothd-and-similar/main.fmf +++ b/selinux-policy/boothd-and-similar/main.fmf @@ -32,6 +32,8 @@ tag: - NoRHIVOS link: - verifies: https://issues.redhat.com/browse/RHEL-45907 + - verifies: https://issues.redhat.com/browse/RHEL-57104 + - verifies: https://issues.redhat.com/browse/RHEL-58060 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 diff --git a/selinux-policy/boothd-and-similar/runtest.sh b/selinux-policy/boothd-and-similar/runtest.sh index 2845bf1..27231d6 100755 --- a/selinux-policy/boothd-and-similar/runtest.sh +++ b/selinux-policy/boothd-and-similar/runtest.sh @@ -67,6 +67,10 @@ rlJournalStart rlSESearchRule "allow boothd_t systemd_userdbd_runtime_t : sock_file { write } [ ]" rlSESearchRule "allow boothd_t systemd_userdbd_t : unix_stream_socket { connectto } [ ]" rlPhaseEnd + + rlPhaseStartTest "RHEL-57104 + RHEL-58060" + rlSESearchRule "allow boothd_t kernel_t : unix_stream_socket { connectto } [ ]" + rlPhaseEnd fi if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then From 186b346eedae46f437fc62b13cdd244cc69793fc Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Tue, 24 Sep 2024 14:04:23 +0200 Subject: [PATCH 402/626] Some SELABEL_ options are only supported in SELABEL_CTX_FILE Since https://github.com/SELinuxProject/selinux/commit/65c8fd457b056dc23756be2fc80847e57bac768d selabel_open() would fail if used with unsupported option Fixes: selabel_open - ERROR: Invalid argument selabel_options: SELABEL_OPT_PATH = (null), SELABEL_OPT_SUBSET = (null), SELABEL_OPT_VALIDATE = 0, SELABEL_OPT_BASEONLY = 0 Executing: selabel_open(SELABEL_CTX_MEDIA, &selabel_option, 4) :: [ 07:57:09 ] :: [ FAIL ] :: Command './test_open CTX_MEDIA NULL NULL 0 0' (Expected 0, got 22) --- libselinux/selabel-functions/test_best.c | 24 +++++++++--------- libselinux/selabel-functions/test_lookup.c | 24 +++++++++--------- libselinux/selabel-functions/test_open.c | 28 ++++++++++----------- libselinux/selabel-functions/test_partial.c | 24 +++++++++--------- 4 files changed, 50 insertions(+), 50 deletions(-) diff --git a/libselinux/selabel-functions/test_best.c b/libselinux/selabel-functions/test_best.c index 7eca4f4..ffa1ade 100644 --- a/libselinux/selabel-functions/test_best.c +++ b/libselinux/selabel-functions/test_best.c @@ -13,9 +13,9 @@ int main (int argc, char **argv) struct selinux_opt selabel_option [] = { { SELABEL_OPT_PATH, NULL }, - { SELABEL_OPT_SUBSET, NULL }, + { SELABEL_OPT_UNUSED, NULL }, { SELABEL_OPT_VALIDATE, (char *) 1 }, - { SELABEL_OPT_BASEONLY, (char *) 1 } + { SELABEL_OPT_UNUSED, NULL } }; if (argc < 8) { @@ -52,11 +52,11 @@ int main (int argc, char **argv) } // set subset - if (strcmp(argv[3], "NULL") == 0) { - selabel_option[1].value = NULL; - } - else { - selabel_option[1].value = argv[3]; + if (backend == SELABEL_CTX_FILE) { + selabel_option[1].type = SELABEL_OPT_SUBSET; + if (strcmp(argv[3], "NULL") != 0) { + selabel_option[1].value = argv[3]; + } } // set validate @@ -68,11 +68,11 @@ int main (int argc, char **argv) } // set baseonly - if (strcmp(argv[5], "0") == 0) { - selabel_option[3].value = NULL; - } - else { - selabel_option[3].value = (char *) 1; + if (backend == SELABEL_CTX_FILE) { + selabel_option[3].type = SELABEL_OPT_BASEONLY; + if (strcmp(argv[5], "0") != 0) { + selabel_option[3].value = (char *) 1; + } } printf("selabel_options: "); diff --git a/libselinux/selabel-functions/test_lookup.c b/libselinux/selabel-functions/test_lookup.c index ee0caaa..268e460 100644 --- a/libselinux/selabel-functions/test_lookup.c +++ b/libselinux/selabel-functions/test_lookup.c @@ -13,9 +13,9 @@ int main (int argc, char **argv) struct selinux_opt selabel_option [] = { { SELABEL_OPT_PATH, NULL }, - { SELABEL_OPT_SUBSET, NULL }, + { SELABEL_OPT_UNUSED, NULL }, { SELABEL_OPT_VALIDATE, (char *) 1 }, - { SELABEL_OPT_BASEONLY, (char *) 1 } + { SELABEL_OPT_UNUSED, NULL } }; if (argc < 8) { @@ -53,11 +53,11 @@ int main (int argc, char **argv) } // set subset - if (strcmp(argv[3], "NULL") == 0) { - selabel_option[1].value = NULL; - } - else { - selabel_option[1].value = argv[3]; + if (backend == SELABEL_CTX_FILE) { + selabel_option[1].type = SELABEL_OPT_SUBSET; + if (strcmp(argv[3], "NULL") != 0) { + selabel_option[1].value = argv[3]; + } } // set validate @@ -69,11 +69,11 @@ int main (int argc, char **argv) } // set baseonly - if (strcmp(argv[5], "0") == 0) { - selabel_option[3].value = NULL; - } - else { - selabel_option[3].value = (char *) 1; + if (backend == SELABEL_CTX_FILE) { + selabel_option[3].type = SELABEL_OPT_BASEONLY; + if (strcmp(argv[5], "0") != 0) { + selabel_option[3].value = (char *) 1; + } } printf("selabel_options: "); diff --git a/libselinux/selabel-functions/test_open.c b/libselinux/selabel-functions/test_open.c index 87f61ee..f19f720 100644 --- a/libselinux/selabel-functions/test_open.c +++ b/libselinux/selabel-functions/test_open.c @@ -14,9 +14,9 @@ int main (int argc, char **argv) struct selinux_opt selabel_option [] = { { SELABEL_OPT_PATH, NULL }, - { SELABEL_OPT_SUBSET, NULL }, + { SELABEL_OPT_UNUSED, NULL }, { SELABEL_OPT_VALIDATE, (char *) 1 }, - { SELABEL_OPT_BASEONLY, (char *) 1 } + { SELABEL_OPT_UNUSED, NULL } }; if (argc < 6) { @@ -49,12 +49,12 @@ int main (int argc, char **argv) } // set subset - if (strcmp(argv[3], "NULL") == 0) { - selabel_option[1].value = NULL; - } - else { - selabel_option[1].value = argv[3]; - } + if (backend == SELABEL_CTX_FILE) { + selabel_option[1].type = SELABEL_OPT_SUBSET; + if (strcmp(argv[3], "NULL") != 0) { + selabel_option[1].value = argv[3]; + } + } // set validate if (strcmp(argv[4], "0") == 0) { @@ -65,12 +65,12 @@ int main (int argc, char **argv) } // set baseonly - if (strcmp(argv[5], "0") == 0) { - selabel_option[3].value = NULL; - } - else { - selabel_option[3].value = (char *) 1; - } + if (backend == SELABEL_CTX_FILE) { + selabel_option[3].type = SELABEL_OPT_BASEONLY; + if (strcmp(argv[5], "0") != 0) { + selabel_option[3].value = (char *) 1; + } + } if (argc == 7) { nopt = strtol(argv[6], NULL, 10); diff --git a/libselinux/selabel-functions/test_partial.c b/libselinux/selabel-functions/test_partial.c index 4513cfa..dd60016 100644 --- a/libselinux/selabel-functions/test_partial.c +++ b/libselinux/selabel-functions/test_partial.c @@ -13,9 +13,9 @@ int main (int argc, char **argv) struct selinux_opt selabel_option [] = { { SELABEL_OPT_PATH, NULL }, - { SELABEL_OPT_SUBSET, NULL }, + { SELABEL_OPT_UNUSED, NULL }, { SELABEL_OPT_VALIDATE, (char *) 1 }, - { SELABEL_OPT_BASEONLY, (char *) 1 } + { SELABEL_OPT_UNUSED, NULL } }; if (argc < 7) { @@ -52,11 +52,11 @@ int main (int argc, char **argv) } // set subset - if (strcmp(argv[3], "NULL") == 0) { - selabel_option[1].value = NULL; - } - else { - selabel_option[1].value = argv[3]; + if (backend == SELABEL_CTX_FILE) { + selabel_option[1].type = SELABEL_OPT_SUBSET; + if (strcmp(argv[3], "NULL") != 0) { + selabel_option[1].value = argv[3]; + } } // set validate @@ -68,11 +68,11 @@ int main (int argc, char **argv) } // set baseonly - if (strcmp(argv[5], "0") == 0) { - selabel_option[3].value = NULL; - } - else { - selabel_option[3].value = (char *) 1; + if (backend == SELABEL_CTX_FILE) { + selabel_option[3].type = SELABEL_OPT_BASEONLY; + if (strcmp(argv[5], "0") != 0) { + selabel_option[3].value = (char *) 1; + } } printf("selabel_options: "); From f471756eb4a9cfa7261da73129039c124e263620 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 24 Sep 2024 11:34:01 +0200 Subject: [PATCH 403/626] fix the "unable to detect release version" situation The yum process is sometimes not able to detect the Fedora version. From now on, the --releasever option will be included on the command line. --- libselinux/matchpathcon-in-chroot-env/runtest.sh | 3 +++ libselinux/setfiles-in-chroot-env/runtest.sh | 3 +++ 2 files changed, 6 insertions(+) diff --git a/libselinux/matchpathcon-in-chroot-env/runtest.sh b/libselinux/matchpathcon-in-chroot-env/runtest.sh index d7bc443..5e74132 100755 --- a/libselinux/matchpathcon-in-chroot-env/runtest.sh +++ b/libselinux/matchpathcon-in-chroot-env/runtest.sh @@ -43,6 +43,9 @@ fi # yum sometimes fails to detect the release version on CentOS 9 if rlIsCentOS 9 ; then INSTALL_OPTION="${INSTALL_OPTION} --releasever 9" +elif rlIsFedora ; then + RELEASEVER=`grep VERSION_ID /etc/os-release | cut -d = -f 2` + INSTALL_OPTION="${INSTALL_OPTION} --releasever ${RELEASEVER}" fi rlJournalStart diff --git a/libselinux/setfiles-in-chroot-env/runtest.sh b/libselinux/setfiles-in-chroot-env/runtest.sh index d18d0a4..a7ecb83 100755 --- a/libselinux/setfiles-in-chroot-env/runtest.sh +++ b/libselinux/setfiles-in-chroot-env/runtest.sh @@ -43,6 +43,9 @@ fi # yum sometimes fails to detect the release version on CentOS 9 if rlIsCentOS 9 ; then INSTALL_OPTION="${INSTALL_OPTION} --releasever 9" +elif rlIsFedora ; then + RELEASEVER=`grep VERSION_ID /etc/os-release | cut -d = -f 2` + INSTALL_OPTION="${INSTALL_OPTION} --releasever ${RELEASEVER}" fi rlJournalStart From 2b631b367fa84b1f09e9c334e75abb491daff794 Mon Sep 17 00:00:00 2001 From: Jan Onderka Date: Mon, 30 Sep 2024 10:35:09 +0200 Subject: [PATCH 404/626] Set time duration for tests seliabel-functions and selinux_restorecon-functions --- libselinux/selabel-functions/main.fmf | 1 + libselinux/selinux_restorecon-functions/main.fmf | 1 + 2 files changed, 2 insertions(+) diff --git a/libselinux/selabel-functions/main.fmf b/libselinux/selabel-functions/main.fmf index 0a89a8f..f1a3283 100644 --- a/libselinux/selabel-functions/main.fmf +++ b/libselinux/selabel-functions/main.fmf @@ -9,6 +9,7 @@ recommend: - glibc - gcc enabled: true +duration: 10m tag: - CI-Tier-1 - NoRHEL4 diff --git a/libselinux/selinux_restorecon-functions/main.fmf b/libselinux/selinux_restorecon-functions/main.fmf index c7372bb..2819cbc 100644 --- a/libselinux/selinux_restorecon-functions/main.fmf +++ b/libselinux/selinux_restorecon-functions/main.fmf @@ -11,6 +11,7 @@ recommend: - strace - gcc enabled: true +duration: 10m tag: - CI-Tier-1 - NoRHEL4 From 2b36306eb2f9c81e54c60e7a36b0167e727b0bf6 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Fri, 20 Sep 2024 15:41:40 +0200 Subject: [PATCH 405/626] test if 'hostapd_cli ping' can run as a systemd service A recent testing of a documented hostapd + freeradius use case revealed that SELinux prevents the hostapd processes from writing to a control socket located in /tmp. The TC reproduces the situation. In order to support the documented use case, I believe that SELinux policy should allow the action. The TC looks for appropriate policy rules and file context patterns. The TC covers RHEL-59683. --- selinux-policy/hostapd-and-similar/Makefile | 1 + selinux-policy/hostapd-and-similar/main.fmf | 2 ++ selinux-policy/hostapd-and-similar/runtest.sh | 4 +++- 3 files changed, 6 insertions(+), 1 deletion(-) diff --git a/selinux-policy/hostapd-and-similar/Makefile b/selinux-policy/hostapd-and-similar/Makefile index 594646a..4c1c5dd 100644 --- a/selinux-policy/hostapd-and-similar/Makefile +++ b/selinux-policy/hostapd-and-similar/Makefile @@ -76,6 +76,7 @@ $(METADATA): Makefile @echo "Bug: 1979968" >> $(METADATA) # RHEL-9 @echo "Bug: 1784253" >> $(METADATA) # Fedora 35 @echo "Bug: 2032277" >> $(METADATA) # Fedora 35 + @echo "Bug: RHEL-59683" >> $(METADATA) # RHEL-9 rhts-lint $(METADATA) diff --git a/selinux-policy/hostapd-and-similar/main.fmf b/selinux-policy/hostapd-and-similar/main.fmf index 46fb896..aa3ac7a 100644 --- a/selinux-policy/hostapd-and-similar/main.fmf +++ b/selinux-policy/hostapd-and-similar/main.fmf @@ -4,6 +4,7 @@ description: |+ contact: Milos Malik component: + - hostapd - selinux-policy require: - library(selinux-policy/common) @@ -46,6 +47,7 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1784253 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2032277 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2064688 + - verifies: https://issues.redhat.com/browse/RHEL-59683 adjust: - enabled: false when: arch == s390x diff --git a/selinux-policy/hostapd-and-similar/runtest.sh b/selinux-policy/hostapd-and-similar/runtest.sh index d2b2bbd..aee5619 100755 --- a/selinux-policy/hostapd-and-similar/runtest.sh +++ b/selinux-policy/hostapd-and-similar/runtest.sh @@ -112,8 +112,10 @@ rlJournalStart PROCESS_CONTEXT="unconfined_service_t" fi rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 + rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 rlRun "hostapd_cli all_sta" + rlRun "systemd-run hostapd_cli ping" + sleep 5 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd From c9a5369366146c65f856fc9081fe96212047b885 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Fri, 20 Sep 2024 14:13:50 +0200 Subject: [PATCH 406/626] test if systemd-journal-upload can read /run/systemd/journal-upload.conf.d/ A recent systemd + selinux-policy testing revealed that SELinux prevents the systemd-journal-upload processes from reading the the /run/systemd/journal-upload.conf.d/ directory. The TC reproduces the situation. In order to support the documented locations where systemd-journal-upload configurations can be located, I believe that SELinux policy should allow this action. The TC looks for appropriate policy rules and file context patterns. The TC covers RHEL-57774. --- .../systemd-journal-upload/Makefile | 69 +++++++++++++++++++ .../systemd-journal-upload/main.fmf | 39 +++++++++++ .../systemd-journal-upload/runtest.sh | 49 +++++++++++++ 3 files changed, 157 insertions(+) create mode 100644 selinux-policy/systemd-journal-upload/Makefile create mode 100644 selinux-policy/systemd-journal-upload/main.fmf create mode 100755 selinux-policy/systemd-journal-upload/runtest.sh diff --git a/selinux-policy/systemd-journal-upload/Makefile b/selinux-policy/systemd-journal-upload/Makefile new file mode 100644 index 0000000..71c64ef --- /dev/null +++ b/selinux-policy/systemd-journal-upload/Makefile @@ -0,0 +1,69 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/systemd-journal-upload +# Description: SELinux interferes with systemd-journal-upload and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2024 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/systemd-journal-upload +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + test -x runtest.sh || chmod a+x runtest.sh + test -x runtest.sh || chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with systemd-localed and localectl" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "RunFor: systemd" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console /usr/sbin/service systemd-journal-remote" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) + @echo "Bug: RHEL-57774" >> $(METADATA) # RHEL-9 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/systemd-journal-upload/main.fmf b/selinux-policy/systemd-journal-upload/main.fmf new file mode 100644 index 0000000..2771cd6 --- /dev/null +++ b/selinux-policy/systemd-journal-upload/main.fmf @@ -0,0 +1,39 @@ +summary: SELinux interferes with systemd-journal-upload and related programs +test: ./runtest.sh +framework: beakerlib +contact: Milos Malik +component: + - selinux-policy +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - /usr/sbin/service + - systemd-journal-remote +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - targeted + - NoRHIVOS +link: + - verifies: https://issues.redhat.com/browse/RHEL-57774 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + continue: false +extra-summary: /CoreOS/selinux-policy/Regression/systemd-journal-upload +extra-task: /CoreOS/selinux-policy/Regression/systemd-journal-upload +extra-nitrate: TC#0617895 +id: 70a20eff-d2b4-458c-84e8-8e6f18a71d84 diff --git a/selinux-policy/systemd-journal-upload/runtest.sh b/selinux-policy/systemd-journal-upload/runtest.sh new file mode 100755 index 0000000..4c1a71f --- /dev/null +++ b/selinux-policy/systemd-journal-upload/runtest.sh @@ -0,0 +1,49 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +SERVICE_PACKAGE="systemd-journal-remote" +SERVICE_NAME="systemd-journal-upload" +PROCESS_NAME="systemd-journal-upload" +PROCESS_CONTEXT="systemd_journal_upload_t" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "RHEL-57774" + rlSEMatchPathCon "/usr/lib/systemd/systemd-journal-upload" "systemd_journal_upload_exec_t" + rlSEMatchPathCon "/run/systemd/journal-upload.conf.d" "systemd_conf_t" + rlSESearchRule "allow systemd_journal_upload_t systemd_conf_t : dir { read } [ ]" + rlPhaseEnd + + rlPhaseStartTest "real scenario -- RHEL-57774" + rlRun "mkdir -pZ /run/systemd/journal-upload.conf.d" + rlRun "echo -e '[Upload]\nURL=http://localhost/\n' > /run/systemd/journal-upload.conf.d/test.conf" + rlRun "restorecon -Rv /run/systemd" + rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /etc /var /run -e /var/ARTIFACTS" 0-255 + rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "stop status" 1 + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rm -f /run/systemd/journal-upload.conf.d/test.conf + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalEnd + From 6b1406c6b2bec9400b6b7de8eee9b84134a64a33 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Fri, 27 Sep 2024 12:06:56 +0200 Subject: [PATCH 407/626] test if systemd-modules-load can read /run/modprobe.d/*.conf A recent cockpit CI + selinux-policy + FIPS testing revealed that SELinux prevents the systemd-modules-load processes from reading files stored in the /run/modprobe.d/ directory. The TC reproduces the situation. In order to support the documented locations for modprobe config files, I believe that SELinux policy should allow the action. The TC looks for appropriate policy rules and file context patterns. The TC covers RHEL-54591. --- .../systemd-modules-load-and-similar/Makefile | 3 ++- .../systemd-modules-load-and-similar/main.fmf | 3 ++- .../systemd-modules-load-and-similar/runtest.sh | 13 ++++++++++++- 3 files changed, 16 insertions(+), 3 deletions(-) diff --git a/selinux-policy/systemd-modules-load-and-similar/Makefile b/selinux-policy/systemd-modules-load-and-similar/Makefile index d53ce0c..610e027 100644 --- a/selinux-policy/systemd-modules-load-and-similar/Makefile +++ b/selinux-policy/systemd-modules-load-and-similar/Makefile @@ -55,7 +55,7 @@ $(METADATA): Makefile @echo "TestTime: 10m" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) @echo "RunFor: systemd" >> $(METADATA) - @echo "Requires: audit initscripts libselinux libselinux-utils policycoreutils rdma-core selinux-policy selinux-policy-targeted setools-console openssh-clients systemd-udev" >> $(METADATA) + @echo "Requires: audit /usr/sbin/service libselinux libselinux-utils policycoreutils rdma-core selinux-policy selinux-policy-targeted setools-console openssh-clients systemd-udev" >> $(METADATA) @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @@ -84,6 +84,7 @@ $(METADATA): Makefile @echo "Bug: 1972372" >> $(METADATA) # RHEL 9 @echo "Bug: 2088257" >> $(METADATA) # RHEL-9 @echo "Bug: 2088258" >> $(METADATA) # RHEL-9 + @echo "Bug: RHEL-54591" >> $(METADATA) # RHEL-10 rhts-lint $(METADATA) diff --git a/selinux-policy/systemd-modules-load-and-similar/main.fmf b/selinux-policy/systemd-modules-load-and-similar/main.fmf index aa1b202..fd3339c 100644 --- a/selinux-policy/systemd-modules-load-and-similar/main.fmf +++ b/selinux-policy/systemd-modules-load-and-similar/main.fmf @@ -9,7 +9,7 @@ require: - library(selinux-policy/common) recommend: - audit - - initscripts + - /usr/sbin/service - libselinux - libselinux-utils - policycoreutils @@ -55,6 +55,7 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1850953 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2088257 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2088258 + - verifies: https://issues.redhat.com/browse/RHEL-54591 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7 diff --git a/selinux-policy/systemd-modules-load-and-similar/runtest.sh b/selinux-policy/systemd-modules-load-and-similar/runtest.sh index a7a862c..9288bb6 100755 --- a/selinux-policy/systemd-modules-load-and-similar/runtest.sh +++ b/selinux-policy/systemd-modules-load-and-similar/runtest.sh @@ -105,15 +105,19 @@ rlJournalStart rlPhaseEnd rlPhaseStartTest "real scenario -- standalone service" + rlRun "mkdir -p /run/modprobe.d" + rlRun "echo 'blacklist cipher_null' > /run/modprobe.d/test.conf" + rlRun "restorecon -Rv /run/modprobe.d" rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" rlRun "echo ${KERNEL_MODULE} > /etc/modules-load.d/${KERNEL_MODULE}.conf" rlRun "lsmod" rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} - ${PROCESS_CONTEXT} "start status" 1 rlRun "lsmod | grep ${KERNEL_MODULE}" - rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 + rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} - ${PROCESS_CONTEXT} "stop status" 1 rlRun "lsmod" rlRun "rm -f /etc/modules-load.d/${KERNEL_MODULE}.conf" + rlRun "rm -f /run/modprobe.d/test.conf" rlPhaseEnd if modinfo `grep ^ib /etc/rdma/modules/rdma.conf` >& /dev/null ; then @@ -137,6 +141,13 @@ rlJournalStart rlSESearchRule "allow systemd_modules_load_t syslogd_t : unix_dgram_socket { sendto } [ ]" rlSESearchRule "allow systemd_modules_load_t kmsg_device_t : chr_file { write } [ ]" rlPhaseEnd + + rlPhaseStartTest "RHEL-54591" + rlSEMatchPathCon "/usr/lib/systemd/systemd-modules-load" "systemd_modules_load_exec_t" + rlSEMatchPathCon "/run/modprobe.d" "modules_conf_t" + rlSEMatchPathCon "/run/modprobe.d/fips.conf" "modules_conf_t" + rlSESearchRule "allow systemd_modules_load_t modules_conf_t : file { getattr open read } [ ]" + rlPhaseEnd fi rlPhaseStartCleanup From 2aa17596925b3e22f3f45aabcf95f66a14476e1d Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Fri, 27 Sep 2024 13:59:29 +0200 Subject: [PATCH 408/626] test if systemd-homed can read /var/cache/systemd/home/ Several recent BZ reports revealed that SELinux prevents the systemd-homed processes from reading the /var/cache/systemd/home/ directory. The TC reproduces the situation. In order to support the expected systemd-homed functionality, I believe that SELinux policy should allow the action. The TC looks for appropriate policy rules and file context patterns. The TC covers BZ#2036108 and its duplicates. --- selinux-policy/systemd-homed/Makefile | 7 ++++++- selinux-policy/systemd-homed/main.fmf | 7 ++++++- selinux-policy/systemd-homed/runtest.sh | 9 +++++++++ 3 files changed, 21 insertions(+), 2 deletions(-) diff --git a/selinux-policy/systemd-homed/Makefile b/selinux-policy/systemd-homed/Makefile index d067913..5b03c59 100644 --- a/selinux-policy/systemd-homed/Makefile +++ b/selinux-policy/systemd-homed/Makefile @@ -55,7 +55,7 @@ $(METADATA): Makefile @echo "TestTime: 1h" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) @echo "RunFor: systemd" >> $(METADATA) - @echo "Requires: audit expect initscripts systemd libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console" >> $(METADATA) + @echo "Requires: audit expect /usr/sbin/service systemd libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console" >> $(METADATA) @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @echo "License: GPLv2" >> $(METADATA) @@ -64,6 +64,11 @@ $(METADATA): Makefile @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) @echo "Releases: -RHEL4 -RHEL5" >> $(METADATA) @echo "Bug: 1809878" >> $(METADATA) # Fedora 32 + @echo "Bug: 2036108" >> $(METADATA) # Fedora 42 + @echo "Bug: 2315087" >> $(METADATA) # Fedora 41 + @echo "Bug: 2316163" >> $(METADATA) # Fedora 41 + @echo "Bug: 2315812" >> $(METADATA) # Fedora 42 + @echo "Bug: 2315587" >> $(METADATA) # Fedora 41 rhts-lint $(METADATA) diff --git a/selinux-policy/systemd-homed/main.fmf b/selinux-policy/systemd-homed/main.fmf index b2b0cd1..f98dce0 100644 --- a/selinux-policy/systemd-homed/main.fmf +++ b/selinux-policy/systemd-homed/main.fmf @@ -7,7 +7,7 @@ require: recommend: - audit - expect - - initscripts + - /usr/sbin/service - systemd - libselinux - libselinux-utils @@ -20,6 +20,11 @@ environment: duration: 1h link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1809878 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2036108 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2315087 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2315587 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2315812 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2316163 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, rhel-9, centos-stream-8, centos-stream-9 diff --git a/selinux-policy/systemd-homed/runtest.sh b/selinux-policy/systemd-homed/runtest.sh index 36eb6c5..dd7969d 100755 --- a/selinux-policy/systemd-homed/runtest.sh +++ b/selinux-policy/systemd-homed/runtest.sh @@ -216,6 +216,15 @@ rlJournalStart rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time --input-logs" 1 rlPhaseEnd + rlPhaseStartTest "bz#2036108 + bz#2315087" + rlSEMatchPathCon "/usr/lib/systemd/systemd-homed" "systemd_homed_exec_t" + rlSEMatchPathCon "/var/cache/systemd/" "systemd_cache_t" + rlSEMatchPathCon "/var/cache/systemd/home/" "systemd_homed_cache_t" + rlSESearchRule "allow systemd_homed_t systemd_homed_cache_t : dir { read } [ ]" + + rlRun "service systemd-homed restart" + rlPhaseEnd + rlPhaseStartCleanup rlRun "systemctl disable systemd-homed" sleep 2 From 4ca2560ddd362006d3a976b9d158c70e55e8f420 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 1 Oct 2024 10:56:18 +0200 Subject: [PATCH 409/626] add basic test which covers iio-sensor-proxy Sooner or later, the iio-sensor-proxy will be confined by SELinux policy and this automated test should find out if basic functions of the iio-sensor-proxy program/service are affected or not. The TC covers RHEL-17346. --- .../iio-sensor-proxy-and-similar/Makefile | 69 ++++++++++++++ .../iio-sensor-proxy-and-similar/PURPOSE | 5 ++ .../iio-sensor-proxy-and-similar/main.fmf | 40 +++++++++ .../iio-sensor-proxy-and-similar/runtest.sh | 90 +++++++++++++++++++ 4 files changed, 204 insertions(+) create mode 100644 selinux-policy/iio-sensor-proxy-and-similar/Makefile create mode 100644 selinux-policy/iio-sensor-proxy-and-similar/PURPOSE create mode 100644 selinux-policy/iio-sensor-proxy-and-similar/main.fmf create mode 100755 selinux-policy/iio-sensor-proxy-and-similar/runtest.sh diff --git a/selinux-policy/iio-sensor-proxy-and-similar/Makefile b/selinux-policy/iio-sensor-proxy-and-similar/Makefile new file mode 100644 index 0000000..8d57ba2 --- /dev/null +++ b/selinux-policy/iio-sensor-proxy-and-similar/Makefile @@ -0,0 +1,69 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/iio-sensor-proxy-and-similar +# Description: SELinux interferes with iio-sensor-proxy and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2024 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/iio-sensor-proxy-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with iio-sensor-proxy and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: iio-sensor-proxy" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console iio-sensor-proxy /usr/sbin/service" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) + @echo "Bug: RHEL-17346" >> $(METADATA) # RHEL-9 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/iio-sensor-proxy-and-similar/PURPOSE b/selinux-policy/iio-sensor-proxy-and-similar/PURPOSE new file mode 100644 index 0000000..2577aa3 --- /dev/null +++ b/selinux-policy/iio-sensor-proxy-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/iio-sensor-proxy-and-similar +Author: Milos Malik + +SELinux interferes with the iio-sensor-proxy service and related programs. + diff --git a/selinux-policy/iio-sensor-proxy-and-similar/main.fmf b/selinux-policy/iio-sensor-proxy-and-similar/main.fmf new file mode 100644 index 0000000..958c0c9 --- /dev/null +++ b/selinux-policy/iio-sensor-proxy-and-similar/main.fmf @@ -0,0 +1,40 @@ +summary: SELinux interferes with iio-sensor-proxy and related programs +description: |+ + SELinux interferes with the iio-sensor-proxy and related programs. + +contact: Milos Malik +component: + - iio-sensor-proxy + - selinux-policy +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - iio-sensor-proxy + - /usr/sbin/service +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - NoRHEL8 + - targeted + - NoRHIVOS +link: + - verifies: https://issues.redhat.com/browse/RHEL-17346 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + because: the iio-sensor-proxy package is not available there +extra-summary: /CoreOS/selinux-policy/Regression/iio-sensor-proxy-and-similar +extra-task: /CoreOS/selinux-policy/Regression/iio-sensor-proxy-and-similar diff --git a/selinux-policy/iio-sensor-proxy-and-similar/runtest.sh b/selinux-policy/iio-sensor-proxy-and-similar/runtest.sh new file mode 100755 index 0000000..a895535 --- /dev/null +++ b/selinux-policy/iio-sensor-proxy-and-similar/runtest.sh @@ -0,0 +1,90 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/iio-sensor-proxy-and-similar +# Description: SELinux interferes with iio-sensor-proxy and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2024 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +FILE_PATH="/usr/libexec/iio-sensor-proxy" +SERVICE_NAME="iio-sensor-proxy" +PROCESS_NAME="iio-sensor-proxy" +if seinfo -t | grep -q iio_sensor ; then + PROCESS_CONTEXT="iio_sensor_proxy_t" + FILE_CONTEXT="iio_sensor_proxy_exec_t" +else + PROCESS_CONTEXT="unconfined_service_t" + FILE_CONTEXT="bin_t" +fi + +rlJournalStart + if rlIsRHEL 7 || rlIsCentOS 7 ; then + rlLog "Not applicable to this OS version." + rlJournalEnd + exit 0 + fi + + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlRun "rpm -qf ${FILE_PATH}" + + rlServiceStop ${SERVICE_NAME} + rlFileBackup /usr/lib/systemd/system/iio-sensor-proxy.service + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "real scenario -- standalone service" + rlRun "sed -i 's/^.*Environment=.*$/Environment=FAKE_COMPASS=1/' /usr/lib/systemd/system/iio-sensor-proxy.service" + rlRun "systemctl daemon-reload" + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 + rlRun "sed -i 's/^.*Environment=.*$/Environment=FAKE_LIGHT_SENSOR=1/' /usr/lib/systemd/system/iio-sensor-proxy.service" + rlRun "systemctl daemon-reload" + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status" 1 + rlRun "gdbus introspect --system --dest net.hadess.SensorProxy --object-path /net/hadess/SensorProxy" + rlWatchdog "monitor-sensor --all" 10 + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "stop status" 1 + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlRun "systemctl daemon-reload" + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + From 3184400050b9ea3730c51b025da0050126290800 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Mon, 30 Sep 2024 11:45:02 +0200 Subject: [PATCH 410/626] add basic test which covers systemd-mountfsd Recently, the systemd-mountfsd program/service got confined by SELinux. Purpose of this automated test is to cover the basic scenarios in which the daemon is used. The systemd-mountfsd man page was used as the source of test scenarios/ideas. --- .../systemd-mountfsd-and-similar/Makefile | 67 +++++++++++++ .../systemd-mountfsd-and-similar/PURPOSE | 5 + .../systemd-mountfsd-and-similar/main.fmf | 43 ++++++++ .../systemd-mountfsd-and-similar/runtest.sh | 97 +++++++++++++++++++ 4 files changed, 212 insertions(+) create mode 100644 selinux-policy/systemd-mountfsd-and-similar/Makefile create mode 100644 selinux-policy/systemd-mountfsd-and-similar/PURPOSE create mode 100644 selinux-policy/systemd-mountfsd-and-similar/main.fmf create mode 100755 selinux-policy/systemd-mountfsd-and-similar/runtest.sh diff --git a/selinux-policy/systemd-mountfsd-and-similar/Makefile b/selinux-policy/systemd-mountfsd-and-similar/Makefile new file mode 100644 index 0000000..5e6e54e --- /dev/null +++ b/selinux-policy/systemd-mountfsd-and-similar/Makefile @@ -0,0 +1,67 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/systemd-mountfsd-and-similar +# Description: SELinux interferes with systemd-mountfsd and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2024 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/systemd-mountfsd-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with systemd-mountfsd and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console systemd systemd-container /usr/sbin/service nmap-ncat" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8 -RHEL9 -RHEL10" >> $(METADATA) + + rhts-lint $(METADATA) + diff --git a/selinux-policy/systemd-mountfsd-and-similar/PURPOSE b/selinux-policy/systemd-mountfsd-and-similar/PURPOSE new file mode 100644 index 0000000..347a3c1 --- /dev/null +++ b/selinux-policy/systemd-mountfsd-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/systemd-mountfsd-and-similar +Author: Milos Malik + +SELinux interferes with systemd-mountfsd and related programs + diff --git a/selinux-policy/systemd-mountfsd-and-similar/main.fmf b/selinux-policy/systemd-mountfsd-and-similar/main.fmf new file mode 100644 index 0000000..9d36ae7 --- /dev/null +++ b/selinux-policy/systemd-mountfsd-and-similar/main.fmf @@ -0,0 +1,43 @@ +summary: SELinux interferes with systemd-mountfsd and related programs +description: |+ + SELinux interferes with systemd-mountfsd and related programs. + +contact: Milos Malik +component: + - selinux-policy +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - systemd + - systemd-container + - /usr/sbin/service + - nmap-ncat +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - NoRHEL8 + - NoRHEL9 + - targeted + - NoRHIVOS +adjust: + - enabled: false + when: distro <= fedora-40 + continue: false + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8, rhel-9, centos-stream-9, rhel-10, centos-stream-10 + continue: false +extra-summary: /CoreOS/selinux-policy/Regression/systemd-mountfsd-and-similar +extra-task: /CoreOS/selinux-policy/Regression/systemd-mountfsd-and-similar diff --git a/selinux-policy/systemd-mountfsd-and-similar/runtest.sh b/selinux-policy/systemd-mountfsd-and-similar/runtest.sh new file mode 100755 index 0000000..ddd5aae --- /dev/null +++ b/selinux-policy/systemd-mountfsd-and-similar/runtest.sh @@ -0,0 +1,97 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/systemd-mountfsd-and-similar +# Description: SELinux interferes with systemd-mountfsd and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2024 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +FILE_PATH="/usr/lib/systemd/systemd-mountfsd" +SERVICE_PACKAGE="systemd" +SERVICE_NAME="systemd-mountfsd" +PROCESS_NAME="systemd-mountfsd" +PROCESS_CONTEXT="systemd_mountfsd_t" +FILE_CONTEXT="systemd_mountfsd_exec_t" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} + rlFileBackup /etc/shadow + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then + rlPhaseStartTest "real scenario -- standalone service" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + # for OSes where the SELinux domain does not exist yet + PROCESS_CONTEXT="unconfined_service_t" + fi + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /etc /var /run -e /var/ARTIFACTS" 0-255 + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + fi + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.socket ] ; then + rlPhaseStartTest "real scenario -- socket activation" + rlRun "systemctl enable ${SERVICE_NAME}.socket" + rlRun "systemctl start ${SERVICE_NAME}.socket" + ( tail -f - | ncat -U /run/systemd/io.systemd.MountFileSystem ) & + PROVOCATEUR_PID=$! + sleep 1 + rlRun "ps -o pid,user,context,args -C ${PROCESS_NAME}" + rlRun "ps -o pid,user,context,args -C ${PROCESS_NAME} | grep :${PROCESS_CONTEXT}" + rlRun "kill -9 ${PROVOCATEUR_PID}" + rlRun "killall ncat" 0,1 + if pgrep ncat >& /dev/null ; then + rlRun "killall ncat" 0-255 + fi + rlRun "systemctl stop ${SERVICE_NAME}.socket" + rlRun "systemctl disable ${SERVICE_NAME}.socket" + rlPhaseEnd + fi + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + From b5a0def0c7f830cb7fc33a4f6551ccb92930a919 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 1 Oct 2024 12:59:27 +0200 Subject: [PATCH 411/626] add basic test which covers switcheroo-control Sooner or later, the switcheroo-control will be confined by SELinux policy and this automated test should find out if basic functions of the switcheroo-control program/service are affected or not. The TC covers RHEL-24268. --- .../switcheroo-control-and-similar/Makefile | 69 ++++++++++++++++ .../switcheroo-control-and-similar/PURPOSE | 5 ++ .../switcheroo-control-and-similar/main.fmf | 42 ++++++++++ .../switcheroo-control-and-similar/runtest.sh | 81 +++++++++++++++++++ 4 files changed, 197 insertions(+) create mode 100644 selinux-policy/switcheroo-control-and-similar/Makefile create mode 100644 selinux-policy/switcheroo-control-and-similar/PURPOSE create mode 100644 selinux-policy/switcheroo-control-and-similar/main.fmf create mode 100755 selinux-policy/switcheroo-control-and-similar/runtest.sh diff --git a/selinux-policy/switcheroo-control-and-similar/Makefile b/selinux-policy/switcheroo-control-and-similar/Makefile new file mode 100644 index 0000000..2337eb8 --- /dev/null +++ b/selinux-policy/switcheroo-control-and-similar/Makefile @@ -0,0 +1,69 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/switcheroo-control-and-similar +# Description: SELinux interferes with switcheroo-control and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2024 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/switcheroo-control-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with switcheroo-control and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 15m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "RunFor: switcheroo-control" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console switcheroo-control python3-gobject-base /usr/sbin/service" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) + @echo "Bug: RHEL-24268" >> $(METADATA) # RHEL-9 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/switcheroo-control-and-similar/PURPOSE b/selinux-policy/switcheroo-control-and-similar/PURPOSE new file mode 100644 index 0000000..4738c63 --- /dev/null +++ b/selinux-policy/switcheroo-control-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/switcheroo-control-and-similar +Author: Milos Malik + +SELinux interferes with switcheroo-control and related programs. + diff --git a/selinux-policy/switcheroo-control-and-similar/main.fmf b/selinux-policy/switcheroo-control-and-similar/main.fmf new file mode 100644 index 0000000..5674a03 --- /dev/null +++ b/selinux-policy/switcheroo-control-and-similar/main.fmf @@ -0,0 +1,42 @@ +summary: SELinux interferes with switcheroo-control and related programs +description: |+ + SELinux interferes with switcheroo-control and related programs + +contact: Milos Malik +component: + - selinux-policy + - switcheroo-control +test: ./runtest.sh +framework: beakerlib +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - switcheroo-control + - python3-gobject-base + - /usr/sbin/service +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - targeted + - NoRHIVOS +link: + - verifies: https://issues.redhat.com/browse/RHEL-24268 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + because: the switcheroo-control package is not available there +extra-summary: /CoreOS/selinux-policy/Regression/switcheroo-control-and-similar +extra-task: /CoreOS/selinux-policy/Regression/switcheroo-control-and-similar diff --git a/selinux-policy/switcheroo-control-and-similar/runtest.sh b/selinux-policy/switcheroo-control-and-similar/runtest.sh new file mode 100755 index 0000000..c1d2100 --- /dev/null +++ b/selinux-policy/switcheroo-control-and-similar/runtest.sh @@ -0,0 +1,81 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/switcheroo-control-and-similar +# Description: SELinux interferes with switcheroo-control and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2024 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +FILE_PATH="/usr/libexec/switcheroo-control" +SERVICE_PACKAGE="switcheroo-control" +SERVICE_NAME="switcheroo-control" +PROCESS_NAME="switcheroo-control" +if seinfo -t | grep -q switcheroo ; then + PROCESS_CONTEXT="switcheroo_t" + FILE_CONTEXT="switcheroo_exec_t" +else + PROCESS_CONTEXT="unconfined_service_t" + FILE_CONTEXT="bin_t" +fi + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "real scenario -- standalone service" + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "switcherooctl version" + rlRun "switcherooctl list" + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status" 1 + rlRun "restorecon -Rv /etc /var /run -e /var/ARTIFACTS" 0-255 + rlRun "touch ./empty-file" + rlRun "switcherooctl launch ./empty-file" 0,1 + rlRun "rm -f ./empty-file" + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "stop status" 1 + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + From 8ed58cb4ea41d0803bc8955a000129876680ff77 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 1 Oct 2024 14:09:39 +0200 Subject: [PATCH 412/626] add basic test which covers power-profiles-daemon Sooner or later, the power-profiles-daemon will be confined by SELinux policy and this automated test should find out if basic functions of the power-profiles-daemon program/service are affected or not. The TC covers RHEL-61117. --- .../Makefile | 69 +++++++++++++++ .../power-profiles-daemon-and-similar/PURPOSE | 5 ++ .../main.fmf | 41 +++++++++ .../runtest.sh | 87 +++++++++++++++++++ 4 files changed, 202 insertions(+) create mode 100644 selinux-policy/power-profiles-daemon-and-similar/Makefile create mode 100644 selinux-policy/power-profiles-daemon-and-similar/PURPOSE create mode 100644 selinux-policy/power-profiles-daemon-and-similar/main.fmf create mode 100755 selinux-policy/power-profiles-daemon-and-similar/runtest.sh diff --git a/selinux-policy/power-profiles-daemon-and-similar/Makefile b/selinux-policy/power-profiles-daemon-and-similar/Makefile new file mode 100644 index 0000000..d9b17a0 --- /dev/null +++ b/selinux-policy/power-profiles-daemon-and-similar/Makefile @@ -0,0 +1,69 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/power-profiles-daemon-and-similar +# Description: SELinux interferes with power-profiles-daemon and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2024 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/power-profiles-daemon-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with power-profiles-daemon and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: power-profiles-daemon" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console power-profiles-daemon python3-gobject-base /usr/sbin/service" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA) + @echo "Bug: RHEL-61117" >> $(METADATA) # RHEL-9 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/power-profiles-daemon-and-similar/PURPOSE b/selinux-policy/power-profiles-daemon-and-similar/PURPOSE new file mode 100644 index 0000000..e6ef280 --- /dev/null +++ b/selinux-policy/power-profiles-daemon-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/power-profiles-daemon-and-similar +Author: Milos Malik + +SELinux interferes with power-profiles-daemon and related programs. + diff --git a/selinux-policy/power-profiles-daemon-and-similar/main.fmf b/selinux-policy/power-profiles-daemon-and-similar/main.fmf new file mode 100644 index 0000000..11f64f1 --- /dev/null +++ b/selinux-policy/power-profiles-daemon-and-similar/main.fmf @@ -0,0 +1,41 @@ +summary: SELinux interferes with power-profiles-daemon and related programs +description: |+ + SELinux interferes with power-profiles-daemon and related programs. + +contact: Milos Malik +component: + - selinux-policy + - power-profiles-daemon +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - power-profiles-daemon + - python3-gobject-base + - /usr/sbin/service +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - NoRHEL8 + - targeted + - NoRHIVOS +link: + - verifies: https://issues.redhat.com/browse/RHEL-61117 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 + because: the power-profiles-daemon package is not available there +extra-summary: /CoreOS/selinux-policy/Regression/power-profiles-daemon-and-similar +extra-task: /CoreOS/selinux-policy/Regression/power-profiles-daemon-and-similar diff --git a/selinux-policy/power-profiles-daemon-and-similar/runtest.sh b/selinux-policy/power-profiles-daemon-and-similar/runtest.sh new file mode 100755 index 0000000..06b164d --- /dev/null +++ b/selinux-policy/power-profiles-daemon-and-similar/runtest.sh @@ -0,0 +1,87 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/power-profiles-daemon-and-similar +# Description: SELinux interferes with power-profiles-daemon and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2024 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +FILE_PATH="/usr/libexec/power-profiles-daemon" +SERVICE_NAME="power-profiles-daemon" +PROCESS_NAME="power-profiles-daemon" +if seinfo -t | grep -q power_profile ; then + PROCESS_CONTEXT="power_profiles_daemon_t" + FILE_CONTEXT="power_profiles_daemon_exec_t" +else + PROCESS_CONTEXT="unconfined_service_t" + FILE_CONTEXT="bin_t" +fi + +rlJournalStart + if rlIsRHEL 7 8 || rlIsCentOS 7 8 ; then + rlLog "Not applicable to this OS version." + rlJournalEnd + exit 0 + fi + + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlRun "rpm -qf ${FILE_PATH}" + + rlServiceStop ${SERVICE_NAME} + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "real scenario -- standalone service" + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "powerprofilesctl list" + rlRun "powerprofilesctl list-holds" + rlRun "powerprofilesctl version" + rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status" 1 + rlRun "powerprofilesctl get" + rlRun "powerprofilesctl set balanced" 0,1 + rlRun "powerprofilesctl launch echo" 0,1 + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "stop status" 1 + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + From 94564f402a100f76ee02c8cef5c2f46362161c74 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Mon, 30 Sep 2024 13:43:37 +0200 Subject: [PATCH 413/626] run stress-ng only if secretmem_t is defined The test phase covers both BZ#2270895 and RHEL-60837 because they the same. The test phase should not be executed in environments where the following SELinux type is not defined: * secretmem_t --- selinux-policy/anon_inode-and-similar/Makefile | 1 + selinux-policy/anon_inode-and-similar/main.fmf | 1 + selinux-policy/anon_inode-and-similar/runtest.sh | 4 +++- 3 files changed, 5 insertions(+), 1 deletion(-) diff --git a/selinux-policy/anon_inode-and-similar/Makefile b/selinux-policy/anon_inode-and-similar/Makefile index 9efa34d..69a0f7f 100644 --- a/selinux-policy/anon_inode-and-similar/Makefile +++ b/selinux-policy/anon_inode-and-similar/Makefile @@ -70,6 +70,7 @@ $(METADATA): Makefile @echo "Bug: 2187745" >> $(METADATA) # RHEL-9 @echo "Bug: RHEL-11792" >> $(METADATA) # RHEL-9 @echo "Bug: 2270895" >> $(METADATA) # Fedora 41 + @echo "Bug: RHEL-60837" >> $(METADATA) # RHEL-10 rhts-lint $(METADATA) diff --git a/selinux-policy/anon_inode-and-similar/main.fmf b/selinux-policy/anon_inode-and-similar/main.fmf index 41ffda8..81712be 100644 --- a/selinux-policy/anon_inode-and-similar/main.fmf +++ b/selinux-policy/anon_inode-and-similar/main.fmf @@ -39,6 +39,7 @@ link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2187745 - verifies: https://issues.redhat.com/browse/RHEL-11792 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2270895 + - verifies: https://issues.redhat.com/browse/RHEL-60837 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8 diff --git a/selinux-policy/anon_inode-and-similar/runtest.sh b/selinux-policy/anon_inode-and-similar/runtest.sh index 6efbe69..3961d8b 100755 --- a/selinux-policy/anon_inode-and-similar/runtest.sh +++ b/selinux-policy/anon_inode-and-similar/runtest.sh @@ -97,13 +97,15 @@ rlJournalStart rlSESearchRule "allow unconfined_service_t unconfined_service_t : io_uring { cmd } [ ]" rlPhaseEnd - rlPhaseStartTest "bz#2270895" + if seinfo -t | grep -q secretmem_t ; then + rlPhaseStartTest "bz#2270895 + RHEL-60837" rlSESearchRule "allow unconfined_t secretmem_t : anon_inode { create } [ ]" rlSESearchRule "allow sysadm_t secretmem_t : anon_inode { create } [ ]" rlSESearchRule "type_transition unconfined_t unconfined_t : anon_inode secretmem_t [secretmem]" rlSESearchRule "type_transition sysadm_t sysadm_t : anon_inode secretmem_t [secretmem]" rlRun "stress-ng --resources 16 --timeout 5 --log-file /dev/null" rlPhaseEnd + fi rlPhaseStartCleanup sleep 2 From 239992b457504607ff33b2c58b687b2c2fc721b0 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Mon, 7 Oct 2024 11:37:01 +0200 Subject: [PATCH 414/626] add test metadata which were missing Recently created tests were missing FMF ids and Nitrate ids. Newly created SELinux types are slightly different from what I expected. Both issues are solved now. --- selinux-policy/iio-sensor-proxy-and-similar/main.fmf | 2 ++ selinux-policy/iio-sensor-proxy-and-similar/runtest.sh | 6 +++--- selinux-policy/power-profiles-daemon-and-similar/main.fmf | 2 ++ selinux-policy/power-profiles-daemon-and-similar/runtest.sh | 6 +++--- selinux-policy/switcheroo-control-and-similar/main.fmf | 2 ++ selinux-policy/systemd-mountfsd-and-similar/main.fmf | 2 ++ 6 files changed, 14 insertions(+), 6 deletions(-) diff --git a/selinux-policy/iio-sensor-proxy-and-similar/main.fmf b/selinux-policy/iio-sensor-proxy-and-similar/main.fmf index 958c0c9..b414ed3 100644 --- a/selinux-policy/iio-sensor-proxy-and-similar/main.fmf +++ b/selinux-policy/iio-sensor-proxy-and-similar/main.fmf @@ -38,3 +38,5 @@ adjust: because: the iio-sensor-proxy package is not available there extra-summary: /CoreOS/selinux-policy/Regression/iio-sensor-proxy-and-similar extra-task: /CoreOS/selinux-policy/Regression/iio-sensor-proxy-and-similar +extra-nitrate: TC#0617897 +id: f951c38a-3013-490f-893a-fb18e9ad7cbb diff --git a/selinux-policy/iio-sensor-proxy-and-similar/runtest.sh b/selinux-policy/iio-sensor-proxy-and-similar/runtest.sh index a895535..5e26ab7 100755 --- a/selinux-policy/iio-sensor-proxy-and-similar/runtest.sh +++ b/selinux-policy/iio-sensor-proxy-and-similar/runtest.sh @@ -33,9 +33,9 @@ PACKAGE="selinux-policy" FILE_PATH="/usr/libexec/iio-sensor-proxy" SERVICE_NAME="iio-sensor-proxy" PROCESS_NAME="iio-sensor-proxy" -if seinfo -t | grep -q iio_sensor ; then - PROCESS_CONTEXT="iio_sensor_proxy_t" - FILE_CONTEXT="iio_sensor_proxy_exec_t" +if seinfo -t | grep -q iiosensor ; then + PROCESS_CONTEXT="iiosensorproxy_t" + FILE_CONTEXT="iiosensorproxy_exec_t" else PROCESS_CONTEXT="unconfined_service_t" FILE_CONTEXT="bin_t" diff --git a/selinux-policy/power-profiles-daemon-and-similar/main.fmf b/selinux-policy/power-profiles-daemon-and-similar/main.fmf index 11f64f1..8c790f3 100644 --- a/selinux-policy/power-profiles-daemon-and-similar/main.fmf +++ b/selinux-policy/power-profiles-daemon-and-similar/main.fmf @@ -39,3 +39,5 @@ adjust: because: the power-profiles-daemon package is not available there extra-summary: /CoreOS/selinux-policy/Regression/power-profiles-daemon-and-similar extra-task: /CoreOS/selinux-policy/Regression/power-profiles-daemon-and-similar +extra-nitrate: TC#0617900 +id: 8cbc1f54-edde-4301-a19e-3a4cfe29920d diff --git a/selinux-policy/power-profiles-daemon-and-similar/runtest.sh b/selinux-policy/power-profiles-daemon-and-similar/runtest.sh index 06b164d..72e5ea4 100755 --- a/selinux-policy/power-profiles-daemon-and-similar/runtest.sh +++ b/selinux-policy/power-profiles-daemon-and-similar/runtest.sh @@ -33,9 +33,9 @@ PACKAGE="selinux-policy" FILE_PATH="/usr/libexec/power-profiles-daemon" SERVICE_NAME="power-profiles-daemon" PROCESS_NAME="power-profiles-daemon" -if seinfo -t | grep -q power_profile ; then - PROCESS_CONTEXT="power_profiles_daemon_t" - FILE_CONTEXT="power_profiles_daemon_exec_t" +if seinfo -t | grep -q powerprofile ; then + PROCESS_CONTEXT="powerprofiles_t" + FILE_CONTEXT="powerprofiles_exec_t" else PROCESS_CONTEXT="unconfined_service_t" FILE_CONTEXT="bin_t" diff --git a/selinux-policy/switcheroo-control-and-similar/main.fmf b/selinux-policy/switcheroo-control-and-similar/main.fmf index 5674a03..eb2d6bb 100644 --- a/selinux-policy/switcheroo-control-and-similar/main.fmf +++ b/selinux-policy/switcheroo-control-and-similar/main.fmf @@ -40,3 +40,5 @@ adjust: because: the switcheroo-control package is not available there extra-summary: /CoreOS/selinux-policy/Regression/switcheroo-control-and-similar extra-task: /CoreOS/selinux-policy/Regression/switcheroo-control-and-similar +extra-nitrate: TC#0617899 +id: b03995ad-99dc-46ae-a584-d860d8777b74 diff --git a/selinux-policy/systemd-mountfsd-and-similar/main.fmf b/selinux-policy/systemd-mountfsd-and-similar/main.fmf index 9d36ae7..a9f933f 100644 --- a/selinux-policy/systemd-mountfsd-and-similar/main.fmf +++ b/selinux-policy/systemd-mountfsd-and-similar/main.fmf @@ -41,3 +41,5 @@ adjust: continue: false extra-summary: /CoreOS/selinux-policy/Regression/systemd-mountfsd-and-similar extra-task: /CoreOS/selinux-policy/Regression/systemd-mountfsd-and-similar +extra-nitrate: TC#0617898 +id: c1075a93-3218-475b-9aa2-ea0d1792d853 From f179552e1bf5c31c2a8ed9d43cbb1c56fc669bba Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Mon, 7 Oct 2024 16:18:18 +0200 Subject: [PATCH 415/626] do not test services which are not present Try to install packages which bring the services if they are not present already. Skip the "real scenario" test phase if the service is missing. --- selinux-policy/bgpd-and-similar/runtest.sh | 9 ++++++--- selinux-policy/blueman-and-similar/runtest.sh | 9 ++++++--- selinux-policy/boinc-and-similar/runtest.sh | 10 ++++++++-- selinux-policy/caddy-and-similar/runtest.sh | 7 ++++--- selinux-policy/cups-pdf-and-similar/runtest.sh | 7 ++++--- selinux-policy/exim-and-similar/runtest.sh | 10 ++++++++-- selinux-policy/ntpsec-and-similar/runtest.sh | 8 +++++++- selinux-policy/opensmtpd-and-similar/runtest.sh | 8 +++++++- selinux-policy/snapd-and-similar/runtest.sh | 8 +++++++- .../systemd-timesyncd-and-similar/runtest.sh | 2 +- selinux-policy/tlp-and-similar/runtest.sh | 9 ++++++++- 11 files changed, 66 insertions(+), 21 deletions(-) diff --git a/selinux-policy/bgpd-and-similar/runtest.sh b/selinux-policy/bgpd-and-similar/runtest.sh index 8d9e844..7cb5b26 100755 --- a/selinux-policy/bgpd-and-similar/runtest.sh +++ b/selinux-policy/bgpd-and-similar/runtest.sh @@ -49,9 +49,10 @@ rlJournalStart rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted if ! rpm -q ${SERVICE_PACKAGE} ; then - rlRun "yum -y install ${SERVICE_PACKAGE} --enablerepo epel" + rlRun "yum -y install ${SERVICE_PACKAGE} --enablerepo epel" 0,1 + else + rlAssertRpm ${SERVICE_PACKAGE} fi - rlAssertRpm ${SERVICE_PACKAGE} rlServiceStop ${SERVICE_NAME} rlFileBackup /etc/bgpd.conf @@ -77,6 +78,7 @@ rlJournalStart rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" rlPhaseEnd + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" rlRun "sed -i 's/^\(include.*\)$/# \1/' /etc/bgpd.conf" if rlIsRHEL 8 || rlIsCentOS 8 ; then @@ -85,13 +87,14 @@ rlJournalStart PROCESS_CONTEXT="unconfined_service_t" fi rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 + rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 if rlIsRHEL 8 || rlIsCentOS 8 ; then # work around BZ#1830170 that was closed as WONTFIX rlRun "restorecon -v /usr/sbin/bgpd" fi rlPhaseEnd + fi rlPhaseStartCleanup sleep 2 diff --git a/selinux-policy/blueman-and-similar/runtest.sh b/selinux-policy/blueman-and-similar/runtest.sh index a0b6ec8..ee32cbb 100755 --- a/selinux-policy/blueman-and-similar/runtest.sh +++ b/selinux-policy/blueman-and-similar/runtest.sh @@ -51,9 +51,10 @@ rlJournalStart rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted if ! rpm -q ${SERVICE_PACKAGE} ; then - rlRun "yum -y install ${SERVICE_PACKAGE} --enablerepo epel" + rlRun "yum -y install ${SERVICE_PACKAGE} --enablerepo epel" 0,1 + else + rlAssertRpm ${SERVICE_PACKAGE} fi - rlAssertRpm ${SERVICE_PACKAGE} rlServiceStop ${SERVICE_NAME} rlFileBackup /etc/shadow @@ -98,6 +99,7 @@ rlJournalStart rlSESearchRule "allow blueman_t gconf_home_t : dir { read } [ ]" rlPhaseEnd + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" if ! rlSEDefined ${PROCESS_CONTEXT} ; then @@ -107,9 +109,10 @@ rlJournalStart rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 PYTHON_VERSION=`python --version | tr -d ' ' | cut -d . -f 1,2 | tr '[:upper:]' '[:lower:]'` rlRun "mkdir -p ~/.local/lib/${PYTHON_VERSION}/site-packages/" - rlRun "restorecon -Rv /var /run -e /var/ARTIFACTS" 0-255 + rlRun "restorecon -Rv /etc /var /run -e /var/ARTIFACTS" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd + fi rlPhaseStartCleanup sleep 2 diff --git a/selinux-policy/boinc-and-similar/runtest.sh b/selinux-policy/boinc-and-similar/runtest.sh index ab2647c..3db917c 100755 --- a/selinux-policy/boinc-and-similar/runtest.sh +++ b/selinux-policy/boinc-and-similar/runtest.sh @@ -44,7 +44,11 @@ rlJournalStart rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted - rlAssertRpm ${SERVICE_PACKAGE} + if ! rpm -q ${SERVICE_PACKAGE} ; then + rlRun "yum -y install ${SERVICE_PACKAGE} --enablerepo epel" 0,1 + else + rlAssertRpm ${SERVICE_PACKAGE} + fi rlServiceStop ${SERVICE_NAME} rlFileBackup /etc/shadow @@ -81,6 +85,7 @@ rlJournalStart # ReadWritePaths=/var/lib/boinc rlPhaseEnd + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" if ! rlSEDefined ${PROCESS_CONTEXT} ; then @@ -91,9 +96,10 @@ rlJournalStart fi fi rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 + rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd + fi rlPhaseStartCleanup sleep 2 diff --git a/selinux-policy/caddy-and-similar/runtest.sh b/selinux-policy/caddy-and-similar/runtest.sh index 39f8301..ca34360 100755 --- a/selinux-policy/caddy-and-similar/runtest.sh +++ b/selinux-policy/caddy-and-similar/runtest.sh @@ -41,9 +41,10 @@ rlJournalStart rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted if ! rpm -q ${SERVICE_PACKAGE} ; then - rlRun "yum -y install ${SERVICE_PACKAGE} --enablerepo epel" + rlRun "yum -y install ${SERVICE_PACKAGE} --enablerepo epel" 0,1 + else + rlAssertRpm ${SERVICE_PACKAGE} fi - rlAssertRpm ${SERVICE_PACKAGE} rlServiceStop caddy caddy-api @@ -72,7 +73,7 @@ rlJournalStart rlRun "semanage fcontext -l -C | grep caddy" for SERVICE_NAME in caddy caddy-api ; do rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 + rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 done rlPhaseEnd diff --git a/selinux-policy/cups-pdf-and-similar/runtest.sh b/selinux-policy/cups-pdf-and-similar/runtest.sh index 0e2613e..c5b67c0 100755 --- a/selinux-policy/cups-pdf-and-similar/runtest.sh +++ b/selinux-policy/cups-pdf-and-similar/runtest.sh @@ -51,10 +51,11 @@ rlJournalStart rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted - if ! rpm -q cups-pdf >& /dev/null ; then - rlRun "yum -y install cups-pdf --enablerepo epel" + if ! rpm -q ${SERVICE_PACKAGE} >& /dev/null ; then + rlRun "yum -y install ${SERVICE_PACKAGE} --enablerepo epel" 0,1 + else + rlAssertRpm ${SERVICE_PACKAGE} fi - rlAssertRpm ${SERVICE_PACKAGE} rlServiceStart ${SERVICE_NAME} rlFileBackup /etc/shadow diff --git a/selinux-policy/exim-and-similar/runtest.sh b/selinux-policy/exim-and-similar/runtest.sh index 7a422c0..4ed843c 100755 --- a/selinux-policy/exim-and-similar/runtest.sh +++ b/selinux-policy/exim-and-similar/runtest.sh @@ -44,7 +44,11 @@ rlJournalStart rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted - rlAssertRpm ${SERVICE_PACKAGE} + if ! rpm -q ${SERVICE_PACKAGE} ; then + rlRun "yum -y install ${SERVICE_PACKAGE} --enablerepo epel" 0,1 + else + rlAssertRpm ${SERVICE_PACKAGE} + fi rlServiceStop ${SERVICE_NAME} rlFileBackup /etc/shadow @@ -92,6 +96,7 @@ rlJournalStart rlPhaseEnd fi + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" if ! rlSEDefined ${PROCESS_CONTEXT} ; then @@ -100,7 +105,7 @@ rlJournalStart fi rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 rlRun "lsof | grep exim_daemon_notify" - rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 + rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd @@ -116,6 +121,7 @@ rlJournalStart rlRun "service atd stop" rlRun "service exim stop" rlPhaseEnd + fi rlPhaseStartCleanup sleep 2 diff --git a/selinux-policy/ntpsec-and-similar/runtest.sh b/selinux-policy/ntpsec-and-similar/runtest.sh index 355bf1f..2531b93 100755 --- a/selinux-policy/ntpsec-and-similar/runtest.sh +++ b/selinux-policy/ntpsec-and-similar/runtest.sh @@ -43,7 +43,11 @@ rlJournalStart rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted - rlAssertRpm ${SERVICE_PACKAGE} + if ! rpm -q ${SERVICE_PACKAGE} ; then + rlRun "yum -y install ${SERVICE_PACKAGE} --enablerepo epel" 0,1 + else + rlAssertRpm ${SERVICE_PACKAGE} + fi rlServiceStop ${SERVICE_NAME} rlFileBackup /etc/ntp.conf @@ -60,6 +64,7 @@ rlJournalStart rlSEMatchPortCon tcp 4460 ntske_port_t rlPhaseEnd + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" if ! rlSEDefined ${PROCESS_CONTEXT} ; then # for environments where the SELinux domain does not exist yet @@ -70,6 +75,7 @@ rlJournalStart rlRun "restorecon -Rv /etc /var /run -e /var/ARTIFACTS" 0-255 rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd + fi rlPhaseStartCleanup sleep 2 diff --git a/selinux-policy/opensmtpd-and-similar/runtest.sh b/selinux-policy/opensmtpd-and-similar/runtest.sh index 3fe0ce5..be11811 100755 --- a/selinux-policy/opensmtpd-and-similar/runtest.sh +++ b/selinux-policy/opensmtpd-and-similar/runtest.sh @@ -43,7 +43,11 @@ rlJournalStart rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted - rlAssertRpm ${SERVICE_PACKAGE} + if ! rpm -q ${SERVICE_PACKAGE} ; then + rlRun "yum -y install ${SERVICE_PACKAGE} --enablerepo epel" 0,1 + else + rlAssertRpm ${SERVICE_PACKAGE} + fi rlServiceStop ${SERVICE_NAME} postfix sendmail @@ -74,6 +78,7 @@ rlJournalStart rlPhaseEnd fi + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" if ! ls -Z ${FILE_PATH} | grep -q ${FILE_CONTEXT} ; then # for environments where the service is not yet confined @@ -85,6 +90,7 @@ rlJournalStart rlRun "smtpctl show status" rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd + fi rlPhaseStartCleanup sleep 2 diff --git a/selinux-policy/snapd-and-similar/runtest.sh b/selinux-policy/snapd-and-similar/runtest.sh index e9e39e0..8fbc405 100755 --- a/selinux-policy/snapd-and-similar/runtest.sh +++ b/selinux-policy/snapd-and-similar/runtest.sh @@ -43,7 +43,11 @@ rlJournalStart rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted - rlAssertRpm ${SERVICE_PACKAGE} + if ! rpm -q ${SERVICE_PACKAGE} ; then + rlRun "yum -y install ${SERVICE_PACKAGE} --enablerepo epel" 0,1 + else + rlAssertRpm ${SERVICE_PACKAGE} + fi rlAssertRpm spamassassin # rlServiceStop ${SERVICE_NAME} @@ -63,6 +67,7 @@ rlJournalStart rlSESearchRule "allow spamd_t snappy_var_lib_t : dir { search } [ ]" rlPhaseEnd + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" rlRun "ls -alRZ /var/lib/snapd" rlRun "semodule -lfull | grep snap" @@ -78,6 +83,7 @@ rlJournalStart rlRun "service spamassassin stop" rlRun "service spamassassin status" 3 rlPhaseEnd + fi rlPhaseStartCleanup sleep 2 diff --git a/selinux-policy/systemd-timesyncd-and-similar/runtest.sh b/selinux-policy/systemd-timesyncd-and-similar/runtest.sh index 2367349..bded838 100755 --- a/selinux-policy/systemd-timesyncd-and-similar/runtest.sh +++ b/selinux-policy/systemd-timesyncd-and-similar/runtest.sh @@ -128,7 +128,7 @@ rlJournalStart PROCESS_CONTEXT="unconfined_service_t" fi rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 + rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd fi diff --git a/selinux-policy/tlp-and-similar/runtest.sh b/selinux-policy/tlp-and-similar/runtest.sh index 2ec22bb..0c67f65 100755 --- a/selinux-policy/tlp-and-similar/runtest.sh +++ b/selinux-policy/tlp-and-similar/runtest.sh @@ -44,7 +44,11 @@ rlJournalStart rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted - rlAssertRpm ${SERVICE_PACKAGE} + if ! rpm -q ${SERVICE_PACKAGE} ; then + rlRun "yum -y install ${SERVICE_PACKAGE} --enablerepo epel" 0,1 + else + rlAssertRpm ${SERVICE_PACKAGE} + fi rlServiceStop ${SERVICE_NAME} rlFileBackup /etc/shadow @@ -87,6 +91,7 @@ rlJournalStart rlPhaseEnd fi + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" if rpm -q snapd >& /dev/null ; then rlRun "ls -alRZ /var/lib/snapd" @@ -101,8 +106,10 @@ rlJournalStart fi rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} - ${PROCESS_CONTEXT} "start status" 1 rlRun "tlp-stat -v" + rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} - ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd + fi rlPhaseStartCleanup sleep 2 From cb72821400a3a77962093a85ae051071ce14bd68 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 1 Oct 2024 18:54:19 +0200 Subject: [PATCH 416/626] add basic test which covers pcm-sensor-server Sooner or later, the pcm-sensor-server will be confined by SELinux policy and this automated test should find out if basic functions of the pcm-sensor-server program/service are affected or not. The TC covers RHEL-52838. --- .../pcm-sensor-server-and-similar/Makefile | 69 +++++++++++++++ .../pcm-sensor-server-and-similar/PURPOSE | 5 ++ .../pcm-sensor-server-and-similar/main.fmf | 44 ++++++++++ .../pcm-sensor-server-and-similar/runtest.sh | 85 +++++++++++++++++++ 4 files changed, 203 insertions(+) create mode 100644 selinux-policy/pcm-sensor-server-and-similar/Makefile create mode 100644 selinux-policy/pcm-sensor-server-and-similar/PURPOSE create mode 100644 selinux-policy/pcm-sensor-server-and-similar/main.fmf create mode 100755 selinux-policy/pcm-sensor-server-and-similar/runtest.sh diff --git a/selinux-policy/pcm-sensor-server-and-similar/Makefile b/selinux-policy/pcm-sensor-server-and-similar/Makefile new file mode 100644 index 0000000..df8f7dc --- /dev/null +++ b/selinux-policy/pcm-sensor-server-and-similar/Makefile @@ -0,0 +1,69 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/pcm-sensor-server-and-similar +# Description: SELinux interferes with pcm-sensor-server and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2024 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/pcm-sensor-server-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with pcm-sensor-server and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: pcm" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console pcm /usr/sbin/service" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8 -RHEL9" >> $(METADATA) + @echo "Bug: RHEL-52838" >> $(METADATA) # RHEL-10 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/pcm-sensor-server-and-similar/PURPOSE b/selinux-policy/pcm-sensor-server-and-similar/PURPOSE new file mode 100644 index 0000000..521f682 --- /dev/null +++ b/selinux-policy/pcm-sensor-server-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/pcm-sensor-server-and-similar +Author: Milos Malik + +SELinux interferes with pcm-sensor-server and related programs. + diff --git a/selinux-policy/pcm-sensor-server-and-similar/main.fmf b/selinux-policy/pcm-sensor-server-and-similar/main.fmf new file mode 100644 index 0000000..1265942 --- /dev/null +++ b/selinux-policy/pcm-sensor-server-and-similar/main.fmf @@ -0,0 +1,44 @@ +summary: SELinux interferes with pcm-sensor-server and related programs +description: |+ + SELinux interferes with pcm-sensor-server and related programs. + +contact: Milos Malik +component: + - pcm + - selinux-policy +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - pcm + - /usr/sbin/service +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - NoRHEL8 + - NoRHEL9 + - targeted + - NoRHIVOS +link: + - verifies: https://issues.redhat.com/browse/RHEL-52838 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, rhel-9 + because: the pcm-sensor-server service is not available there + - enabled: false + when: arch == aarch64, ppc64le, s390x + because: the pcm package is not available there +extra-summary: /CoreOS/selinux-policy/Regression/pcm-sensor-server-and-similar +extra-task: /CoreOS/selinux-policy/Regression/pcm-sensor-server-and-similar diff --git a/selinux-policy/pcm-sensor-server-and-similar/runtest.sh b/selinux-policy/pcm-sensor-server-and-similar/runtest.sh new file mode 100755 index 0000000..8bcf9a3 --- /dev/null +++ b/selinux-policy/pcm-sensor-server-and-similar/runtest.sh @@ -0,0 +1,85 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/pcm-sensor-server-and-similar +# Description: SELinux interferes pcm-sensor-server and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2024 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +FILE_PATH="/usr/sbin/pcm-sensor-server" +SERVICE_NAME="pcm-sensor-server" +PROCESS_NAME="pcm-sensor-server" +if seinfo -t | grep -q pcm ; then + FILE_CONTEXT="pcmsensor_exec_t" + PROCESS_CONTEXT="pcmsensor_t" +else + FILE_CONTEXT="bin_t" + PROCESS_CONTEXT="unconfined_service_t" +fi + +rlJournalStart + if rlIsRHEL 7 8 9 || rlIsCentOS 7 8 9 ; then + rlLog "Not applicable to this OS version." + rlJournalEnd + exit 0 + fi + + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlRun "rpm -qf ${FILE_PATH}" + + rlServiceStop ${SERVICE_NAME} + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "real scenario -- standalone service" + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "pcm-iio 1.0 -i=1" + rlRun "pcm-memory 1.0 -i=1" + rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status" 1 + rlRun "pcm-latency -i=1" + rlRun "pcm-lspci" + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "stop status" 1 + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + From 981c13333c7d7c0e36ff6ec6ef90e7287d8a7c03 Mon Sep 17 00:00:00 2001 From: Zdenek Pytela Date: Mon, 14 Oct 2024 13:14:31 +0200 Subject: [PATCH 417/626] Install linuxptp for the chrony test In Fedora 41+, the timemaster_t type is available only when the linuxptp-selinux package is installed. It is pulled in by linuxptp if linuxptp-selinux exists, so linuxptp is a safe requirement working for older releases, too. --- selinux-policy/chronyd-and-similar/Makefile | 2 +- selinux-policy/chronyd-and-similar/main.fmf | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/selinux-policy/chronyd-and-similar/Makefile b/selinux-policy/chronyd-and-similar/Makefile index 63baa53..ab9a53b 100644 --- a/selinux-policy/chronyd-and-similar/Makefile +++ b/selinux-policy/chronyd-and-similar/Makefile @@ -55,7 +55,7 @@ $(METADATA): Makefile @echo "TestTime: 1h" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) @echo "RunFor: chrony" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy-mls selinux-policy-targeted setools-console chrony ksh nscd /usr/bin/certtool /usr/sbin/service socat" >> $(METADATA) # EPEL + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy-mls selinux-policy-targeted setools-console chrony ksh nscd /usr/bin/certtool /usr/sbin/service socat linuxptp" >> $(METADATA) # EPEL @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @echo "License: GPLv2" >> $(METADATA) diff --git a/selinux-policy/chronyd-and-similar/main.fmf b/selinux-policy/chronyd-and-similar/main.fmf index 24be338..89eed9a 100644 --- a/selinux-policy/chronyd-and-similar/main.fmf +++ b/selinux-policy/chronyd-and-similar/main.fmf @@ -24,6 +24,7 @@ recommend: - /usr/bin/certtool - /usr/sbin/service - socat + - linuxptp environment: AVC_ERROR: +no_avc_check duration: 1h From c3676f738be4b2f5f48b8d73b6a9c5f05601045d Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Fri, 11 Oct 2024 21:02:20 +0200 Subject: [PATCH 418/626] add basic test which covers the tlshd service Sooner or later, the tlshd service will be confined by SELinux policy and this automated test should find out if basic functions of the program/service are affected or not. The TC covers RHEL-29439 and RHEL-42672. --- selinux-policy/tlshd-and-similar/Makefile | 69 ++++++++++++++++ selinux-policy/tlshd-and-similar/PURPOSE | 5 ++ selinux-policy/tlshd-and-similar/main.fmf | 39 +++++++++ selinux-policy/tlshd-and-similar/runtest.sh | 89 +++++++++++++++++++++ 4 files changed, 202 insertions(+) create mode 100644 selinux-policy/tlshd-and-similar/Makefile create mode 100644 selinux-policy/tlshd-and-similar/PURPOSE create mode 100644 selinux-policy/tlshd-and-similar/main.fmf create mode 100755 selinux-policy/tlshd-and-similar/runtest.sh diff --git a/selinux-policy/tlshd-and-similar/Makefile b/selinux-policy/tlshd-and-similar/Makefile new file mode 100644 index 0000000..8cd29b8 --- /dev/null +++ b/selinux-policy/tlshd-and-similar/Makefile @@ -0,0 +1,69 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/tlshd-and-similar +# Description: SELinux interferes with tlshd and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2024 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/tlshd-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with tlshd and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console tlshd /usr/sbin/service" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA) + @echo "Bug: RHEL-29439" >> $(METADATA) # RHEL-9 + @echo "Bug: RHEL-42672" >> $(METADATA) # RHEL-10 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/tlshd-and-similar/PURPOSE b/selinux-policy/tlshd-and-similar/PURPOSE new file mode 100644 index 0000000..828f1b5 --- /dev/null +++ b/selinux-policy/tlshd-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/tlshd-and-similar +Author: Milos Malik + +SELinux interferes with tlshd and related programs. + diff --git a/selinux-policy/tlshd-and-similar/main.fmf b/selinux-policy/tlshd-and-similar/main.fmf new file mode 100644 index 0000000..73fd3d5 --- /dev/null +++ b/selinux-policy/tlshd-and-similar/main.fmf @@ -0,0 +1,39 @@ +summary: SELinux interferes with tlshd and related programs +description: |+ + SELinux interferes with tlshd and related programs. + +contact: Milos Malik +component: + - selinux-policy +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - ktls-utils + - /usr/sbin/service +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - NoRHEL8 + - NoRHIVOS +link: + - verifies: https://issues.redhat.com/browse/RHEL-29439 + - verifies: https://issues.redhat.com/browse/RHEL-42672 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 + because: the ktls-utils package is not available there +extra-summary: /CoreOS/selinux-policy/Regression/tlshd-and-similar +extra-task: /CoreOS/selinux-policy/Regression/tlshd-and-similar diff --git a/selinux-policy/tlshd-and-similar/runtest.sh b/selinux-policy/tlshd-and-similar/runtest.sh new file mode 100755 index 0000000..6e75aa8 --- /dev/null +++ b/selinux-policy/tlshd-and-similar/runtest.sh @@ -0,0 +1,89 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/tlshd-and-similar +# Description: SELinux interferes with tlshd and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2024 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +FILE_PATH="/usr/sbin/tlshd" +SERVICE_PACKAGE="ktls-utils" +SERVICE_NAME="tlshd" +PROCESS_NAME="tlshd" +if seinfo -t | grep -q tlshd ; then + PROCESS_CONTEXT="tlshd_t" + FILE_CONTEXT="tlshd_exec_t" +else + PROCESS_CONTEXT="unconfined_service_t" + FILE_CONTEXT="bin_t" +fi + +rlJournalStart + if rlIsRHEL 7 8 || rlIsCentOS 7 8 ; then + rlLog "Not applicable to this OS version." + rlJournalEnd + exit 0 + fi + + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "RHEL-29439 + RHEL-42672" + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + rlSESearchRule "allow init_t ${PROCESS_CONTEXT} : process { transition } [ ]" + rlSESearchRule "type_transition init_t ${FILE_CONTEXT} : process ${PROCESS_CONTEXT}" + rlPhaseEnd + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then + rlPhaseStartTest "real scenario -- standalone service" + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + fi + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + From deaf7662f4ec2c2dde737da139b055a5bcad6f10 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Wed, 16 Oct 2024 19:18:06 +0200 Subject: [PATCH 419/626] Test rpm transaction for stderr output Commands stderr output should be hidden unless it's fatal error Verifies: https://issues.redhat.com/browse/RHEL-59192 --- selinux-policy/rpm-suppress-stderr/main.fmf | 17 +++++++ selinux-policy/rpm-suppress-stderr/test.sh | 55 +++++++++++++++++++++ 2 files changed, 72 insertions(+) create mode 100644 selinux-policy/rpm-suppress-stderr/main.fmf create mode 100755 selinux-policy/rpm-suppress-stderr/test.sh diff --git a/selinux-policy/rpm-suppress-stderr/main.fmf b/selinux-policy/rpm-suppress-stderr/main.fmf new file mode 100644 index 0000000..9ea92b7 --- /dev/null +++ b/selinux-policy/rpm-suppress-stderr/main.fmf @@ -0,0 +1,17 @@ +summary: Does rpm install generate any output on stderr? +component: + - selinux-policy +require: + - fuse + - fuse-overlayfs + - dnf +test: ./test.sh +framework: beakerlib +duration: 10m +enabled: true +link: + - https://issues.redhat.com/browse/RHEL-59192 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 + continue: false diff --git a/selinux-policy/rpm-suppress-stderr/test.sh b/selinux-policy/rpm-suppress-stderr/test.sh new file mode 100755 index 0000000..f7432da --- /dev/null +++ b/selinux-policy/rpm-suppress-stderr/test.sh @@ -0,0 +1,55 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# -*- mode: shell-script; indent-tabs-mode: nil; sh-basic-offset: 4; -*- +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +INSTALL_OPTION="" +DOWNLOAD_OPTION="" +if dnf --help | grep -q use-host-config ; then + INSTALL_OPTION="${INSTALL_OPTION} --use-host-config" +fi +if rlIsCentOS 9 ; then + INSTALL_OPTION="${INSTALL_OPTION} --releasever 9" +elif rlIsFedora ; then + RELEASEVER=`grep VERSION_ID /etc/os-release | cut -d = -f 2` + INSTALL_OPTION="${INSTALL_OPTION} --releasever ${RELEASEVER}" +fi +DOWNLOAD_OPTION=${INSTALL_OPTION} +# dnf sometimes fails to detect the release version on CentOS 9 +if dnf install --help | grep -q skip-broken ; then + INSTALL_OPTION="${INSTALL_OPTION} --skip-broken" +fi +if dnf install --help | grep -q skip-unavailable ; then + INSTALL_OPTION="${INSTALL_OPTION} --skip-unavailable" +fi + +rlJournalStart + rlPhaseStartSetup + rlRun "tmp=\$(mktemp -d)" 0 "Create tmp directory" + rlRun "pushd $tmp" + rlRun "set -o pipefail" + rlAssertRpm fuse + rlAssertRpm fuse-overlayfs + rlPhaseEnd + + rlPhaseStartTest + rlRun "mkdir $tmp/lower $tmp/upper $tmp/work $tmp/merged" + rlRun "dnf -y install --installroot=$tmp/lower diffutils libfdisk libselinux-utils libutempter policycoreutils util-linux rpm ${INSTALL_OPTION}" + rlRun "mkdir download" + rlRun "cd download" + rlRun "dnf download --installroot=$tmp/lower rpm-plugin-selinux selinux-policy selinux-policy-targeted ${DOWNLOAD_OPTION}" + rlRun "mv -v *rpm $tmp/lower" + rlRun "cd .." + rlRun "fuse-overlayfs -o lowerdir=$tmp/lower/ -o upperdir=$tmp/upper/ -o workdir=$tmp/work/ $tmp/merged/" + RPMS=$(ls $tmp/merged/ | grep .rpm | xargs) + rlRun "chroot $tmp/merged/ /usr/bin/rpm -i $RPMS 2> error.log" + rlAssert0 "error.log should be empty" "test -s error.log" + rlRun "cat error.log" + rlRun "fusermount -u $tmp/merged/" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "popd" + rlRun "rm -r $tmp" 0 "Remove tmp directory" + rlPhaseEnd +rlJournalEnd From 597fc277daae6e41d9b84910626c75d6b16b0e11 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Fri, 18 Oct 2024 14:30:23 +0200 Subject: [PATCH 420/626] fill in the missing metadata in some tests Now, all tests in the repository should have their nitrate id and UUID in their main.fmf file. --- selinux-policy/boothd-and-similar/main.fmf | 2 ++ .../bz538089-plymouth-operations-denied-during-boot/main.fmf | 1 + selinux-policy/chronyd-and-similar/main.fmf | 1 + selinux-policy/install-uninstall-dsp-packages/main.fmf | 3 ++- selinux-policy/libvirt-dbus-and-similar/main.fmf | 2 ++ selinux-policy/pcm-sensor-server-and-similar/main.fmf | 2 ++ selinux-policy/systemd-generators/main.fmf | 2 ++ selinux-policy/tlshd-and-similar/main.fmf | 2 ++ 8 files changed, 14 insertions(+), 1 deletion(-) diff --git a/selinux-policy/boothd-and-similar/main.fmf b/selinux-policy/boothd-and-similar/main.fmf index 90edcac..0881602 100644 --- a/selinux-policy/boothd-and-similar/main.fmf +++ b/selinux-policy/boothd-and-similar/main.fmf @@ -40,3 +40,5 @@ adjust: because: the booth package is not available there extra-summary: /CoreOS/selinux-policy/Regression/boothd-and-similar extra-task: /CoreOS/selinux-policy/Regression/boothd-and-similar +extra-nitrate: TC#0617767 +id: 7d00eabe-6df9-4577-9b07-1b79ab62f21b diff --git a/selinux-policy/bz538089-plymouth-operations-denied-during-boot/main.fmf b/selinux-policy/bz538089-plymouth-operations-denied-during-boot/main.fmf index 2499927..1fe7c6a 100644 --- a/selinux-policy/bz538089-plymouth-operations-denied-during-boot/main.fmf +++ b/selinux-policy/bz538089-plymouth-operations-denied-during-boot/main.fmf @@ -54,3 +54,4 @@ adjust: extra-nitrate: TC#0057474 extra-summary: /CoreOS/selinux-policy/Regression/bz538089-plymouth-operations-denied-during-boot extra-task: /CoreOS/selinux-policy/Regression/bz538089-plymouth-operations-denied-during-boot +id: b3e914bb-2af2-4edb-9959-d20e81b2e7ce diff --git a/selinux-policy/chronyd-and-similar/main.fmf b/selinux-policy/chronyd-and-similar/main.fmf index 89eed9a..caf9836 100644 --- a/selinux-policy/chronyd-and-similar/main.fmf +++ b/selinux-policy/chronyd-and-similar/main.fmf @@ -95,3 +95,4 @@ adjust: extra-nitrate: TC#0202180 extra-summary: /CoreOS/selinux-policy/Regression/chronyd-and-similar extra-task: /CoreOS/selinux-policy/Regression/chronyd-and-similar +id: d247a2ee-7ce9-4ee2-b3f7-3b04102c7b83 diff --git a/selinux-policy/install-uninstall-dsp-packages/main.fmf b/selinux-policy/install-uninstall-dsp-packages/main.fmf index eff82f8..84dcf79 100644 --- a/selinux-policy/install-uninstall-dsp-packages/main.fmf +++ b/selinux-policy/install-uninstall-dsp-packages/main.fmf @@ -33,6 +33,7 @@ adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 continue: false -extra-nitrate: +extra-nitrate: TC#0617855 extra-summary: /CoreOS/selinux-policy/Sanity/install-uninstall-dsp-packages extra-task: /CoreOS/selinux-policy/Sanity/install-uninstall-dsp-packages +id: 22a728a8-c83b-49f9-8a20-57f0d35c7dc9 diff --git a/selinux-policy/libvirt-dbus-and-similar/main.fmf b/selinux-policy/libvirt-dbus-and-similar/main.fmf index c5e8620..a03ec19 100644 --- a/selinux-policy/libvirt-dbus-and-similar/main.fmf +++ b/selinux-policy/libvirt-dbus-and-similar/main.fmf @@ -36,3 +36,5 @@ adjust: because: the libvirt-dbus package is not available there extra-summary: /CoreOS/selinux-policy/Regression/libvirt-dbus-and-similar extra-task: /CoreOS/selinux-policy/Regression/libvirt-dbus-and-similar +extra-nitrate: TC#0617675 +id: 051fa33d-fa04-4ccc-b4e3-91078ec2199f diff --git a/selinux-policy/pcm-sensor-server-and-similar/main.fmf b/selinux-policy/pcm-sensor-server-and-similar/main.fmf index 1265942..4abbd17 100644 --- a/selinux-policy/pcm-sensor-server-and-similar/main.fmf +++ b/selinux-policy/pcm-sensor-server-and-similar/main.fmf @@ -42,3 +42,5 @@ adjust: because: the pcm package is not available there extra-summary: /CoreOS/selinux-policy/Regression/pcm-sensor-server-and-similar extra-task: /CoreOS/selinux-policy/Regression/pcm-sensor-server-and-similar +extra-nitrate: TC#0617904 +id: a9229ccd-ac0e-4a00-9cc2-733ddb5de881 diff --git a/selinux-policy/systemd-generators/main.fmf b/selinux-policy/systemd-generators/main.fmf index bf488b0..949427e 100644 --- a/selinux-policy/systemd-generators/main.fmf +++ b/selinux-policy/systemd-generators/main.fmf @@ -34,3 +34,5 @@ adjust: - enabled: false when: distro == rhel-7 continue: false +extra-nitrate: TC#0617500 +id: f92a6183-91e3-407a-9ac7-9b7df460109a diff --git a/selinux-policy/tlshd-and-similar/main.fmf b/selinux-policy/tlshd-and-similar/main.fmf index 73fd3d5..f792516 100644 --- a/selinux-policy/tlshd-and-similar/main.fmf +++ b/selinux-policy/tlshd-and-similar/main.fmf @@ -37,3 +37,5 @@ adjust: because: the ktls-utils package is not available there extra-summary: /CoreOS/selinux-policy/Regression/tlshd-and-similar extra-task: /CoreOS/selinux-policy/Regression/tlshd-and-similar +extra-nitrate: TC#0617913 +id: 63121e2f-20f3-4ded-80fe-ab98fecd79af From 386ee4ea46cf560f6714c539deccfdb9edf5a43c Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Fri, 11 Oct 2024 13:58:53 +0200 Subject: [PATCH 421/626] test if systemd-run works inside systemd-run service Recently, debugging of unrelated systemd issue revealed that SELinux prevents a successful execution of systemd-run inside systemd-run session. The TC reproduces the situation. In order to support the above-mentioned scenario, I believe that SELinux policy should allow the dbus-broker to read/write from/to UNIX stream socket owned by the systemd session. The TC looks for appropriate policy rules. The TC covers RHEL-61928 and RHEL-62185. --- selinux-policy/systemd-run-and-similar/Makefile | 2 ++ selinux-policy/systemd-run-and-similar/main.fmf | 2 ++ selinux-policy/systemd-run-and-similar/runtest.sh | 7 +++++++ 3 files changed, 11 insertions(+) diff --git a/selinux-policy/systemd-run-and-similar/Makefile b/selinux-policy/systemd-run-and-similar/Makefile index 9211248..9fe1e29 100644 --- a/selinux-policy/systemd-run-and-similar/Makefile +++ b/selinux-policy/systemd-run-and-similar/Makefile @@ -64,6 +64,8 @@ $(METADATA): Makefile @echo "Bug: 1647162" >> $(METADATA) # Fedora 29 @echo "Bug: 1980241" >> $(METADATA) # Fedora 34 @echo "Bug: 2118784" >> $(METADATA) # RHEL-8 + @echo "Bug: RHEL-61928" >> $(METADATA) # RHEL-9 + @echo "Bug: RHEL-62185" >> $(METADATA) # RHEL-10 rhts-lint $(METADATA) diff --git a/selinux-policy/systemd-run-and-similar/main.fmf b/selinux-policy/systemd-run-and-similar/main.fmf index 0a1334c..6488281 100644 --- a/selinux-policy/systemd-run-and-similar/main.fmf +++ b/selinux-policy/systemd-run-and-similar/main.fmf @@ -37,6 +37,8 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1647162 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1980241 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2118784 + - verifies: https://issues.redhat.com/browse/RHEL-61928 + - verifies: https://issues.redhat.com/browse/RHEL-62185 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 diff --git a/selinux-policy/systemd-run-and-similar/runtest.sh b/selinux-policy/systemd-run-and-similar/runtest.sh index 8aa5fb1..32f5831 100755 --- a/selinux-policy/systemd-run-and-similar/runtest.sh +++ b/selinux-policy/systemd-run-and-similar/runtest.sh @@ -74,6 +74,13 @@ rlJournalStart rlRun "ls -alZ /var/lib/myservice0 /var/lib/private/myservice0" rlPhaseEnd + rlPhaseStartTest "RHEL-61928 + RHEL-62185" + rlSESearchRule "allow system_dbusd_t unconfined_service_t : unix_stream_socket { read write } [ ]" + rlRun -s "systemd-run --wait -- systemd-run --user --machine=adm@ --wait true" + rlRun "grep -i success $rlRun_LOG" + rm -f $rlRun_LOG + rlPhaseEnd + rlPhaseStartCleanup sleep 2 rlSECheckAVC From 2e6dd329b8b781c2038c6e0439543f85ad390ac9 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 22 Oct 2024 14:54:17 +0200 Subject: [PATCH 422/626] add basic test which covers the gnome-remote-desktop service Sooner or later, the gnome-remote-desktop service will be confined by SELinux policy and this automated test should find out if basic functions of the program/service are affected or not. The TC covers RHEL-35877. During the development of the automated test, a new SELinux denial was identified and reported. The reproducer is already part of this test. In order to support various functions of the grdctl program, I believe that SELinux policy should allow the gnome-remote-desktop-daemon processes to watch (syscall = inotify_add_watch) the /etc/gnome-remote-desktop directory. The TC looks for appropriate policy rules and file context patterns. The TC covers BZ#2321236. --- .../gnome-remote-desktop-and-similar/Makefile | 70 +++++++++++++++ .../gnome-remote-desktop-and-similar/PURPOSE | 5 ++ .../gnome-remote-desktop-and-similar/main.fmf | 41 +++++++++ .../runtest.sh | 88 +++++++++++++++++++ 4 files changed, 204 insertions(+) create mode 100644 selinux-policy/gnome-remote-desktop-and-similar/Makefile create mode 100644 selinux-policy/gnome-remote-desktop-and-similar/PURPOSE create mode 100644 selinux-policy/gnome-remote-desktop-and-similar/main.fmf create mode 100755 selinux-policy/gnome-remote-desktop-and-similar/runtest.sh diff --git a/selinux-policy/gnome-remote-desktop-and-similar/Makefile b/selinux-policy/gnome-remote-desktop-and-similar/Makefile new file mode 100644 index 0000000..bc72237 --- /dev/null +++ b/selinux-policy/gnome-remote-desktop-and-similar/Makefile @@ -0,0 +1,70 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/gnome-remote-desktop-and-similar +# Description: SELinux interferes with gnome-remote-desktop-daemon and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2024 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/gnome-remote-desktop-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with gnome-remote-desktop-daemon and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: gnome-remote-desktop" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console /usr/sbin/service gnome-remote-desktop gdm" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) + @echo "Bug: 2321236" >> $(METADATA) # Fedora 42 + @echo "Bug: RHEL-35877" >> $(METADATA) # RHEL-10 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/gnome-remote-desktop-and-similar/PURPOSE b/selinux-policy/gnome-remote-desktop-and-similar/PURPOSE new file mode 100644 index 0000000..ba1be55 --- /dev/null +++ b/selinux-policy/gnome-remote-desktop-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/gnome-remote-desktop-and-similar +Author: Milos Malik + +SELinux interferes with gnome-remote-desktop-daemon and related programs. + diff --git a/selinux-policy/gnome-remote-desktop-and-similar/main.fmf b/selinux-policy/gnome-remote-desktop-and-similar/main.fmf new file mode 100644 index 0000000..79bbc59 --- /dev/null +++ b/selinux-policy/gnome-remote-desktop-and-similar/main.fmf @@ -0,0 +1,41 @@ +summary: SELinux interferes with gnome-remote-desktop and related programs +description: |+ + SELinux interferes with gnome-remote-desktop-daemon and related programs. + +contact: Milos Malik +component: + - selinux-policy +test: ./runtest.sh +framework: beakerlib +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - /usr/sbin/service + - gnome-remote-desktop + - gdm +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - NoRHIVOS +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2321236 + - verifies: https://issues.redhat.com/browse/RHEL-35877 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + continue: false +extra-summary: /CoreOS/selinux-policy/Regression/gnome-remote-desktop-and-similar +extra-task: /CoreOS/selinux-policy/Regression/gnome-remote-desktop-and-similar diff --git a/selinux-policy/gnome-remote-desktop-and-similar/runtest.sh b/selinux-policy/gnome-remote-desktop-and-similar/runtest.sh new file mode 100755 index 0000000..d533dc7 --- /dev/null +++ b/selinux-policy/gnome-remote-desktop-and-similar/runtest.sh @@ -0,0 +1,88 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/gnome-remote-desktop-and-similar +# Description: SELinux interferes with gnome-remote-desktop-daemon and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2024 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +FILE_PATH="/usr/libexec/gnome-remote-desktop-daemon" +SERVICE_PACKAGE="gnome-remote-desktop" +SERVICE_NAME="gnome-remote-desktop" +PROCESS_NAME="gnome-remote-desktop-daemon" +if semodule -l | grep -q gnome_remote_desktop ; then + FILE_CONTEXT="gnome_remote_desktop_exec_t" + PROCESS_CONTEXT="gnome_remote_desktop_t" +else + FILE_CONTEXT="bin_t" + PROCESS_CONTEXT="unconfined_service_t" +fi + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + if rlSEDefined "gnome_remote_desktop_t" ; then + rlPhaseStartTest "bz#2321236" + rlSEMatchPathCon "/usr/libexec/gnome-remote-desktop-daemon" "gnome_remote_desktop_exec_t" + rlSEMatchPathCon "/etc/gnome-remote-desktop" "etc_t" + rlSESearchRule "allow gnome_remote_desktop_t etc_t : dir { watch } [ ]" + rlPhaseEnd + fi + + rlPhaseStartTest "real scenario" + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "grdctl --headless status" + rlRun "grdctl --system status" + rlRun "grdctl --system rdp enable" + rlRun "grdctl --system vnc enable" + rlRun "grdctl --system status" + rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + From e978f12992d355740aec3d72575536ec1b8a347c Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 5 Nov 2024 17:12:21 +0100 Subject: [PATCH 423/626] modify tests to run successfully on CentOS stream machines Some tests failed when executed on CentOS-stream machines because of insufficient code conditions. From now on, this problem should not happen anymore. --- libselinux/get_default_context/runtest.sh | 2 +- libselinux/validatetrans/runtest.sh | 2 +- libsemanage/semanage-handle-functions/runtest.sh | 4 ++-- libsemanage/semanage-seuser-functions/runtest.sh | 2 +- 4 files changed, 5 insertions(+), 5 deletions(-) diff --git a/libselinux/get_default_context/runtest.sh b/libselinux/get_default_context/runtest.sh index 83aae88..94feae4 100755 --- a/libselinux/get_default_context/runtest.sh +++ b/libselinux/get_default_context/runtest.sh @@ -39,7 +39,7 @@ rlJournalStart rlRun "sestatus" rlPhaseEnd - if rlIsRHEL ">=8.3" || rlIsFedora; then + if rlIsRHEL ">=8.3" || rlIsFedora || rlIsCentOS ">=8.3" ; then rlPhaseStartTest "#1879368" rlRun "cat ./reproducer.py" rlRun "./reproducer.py" 0 diff --git a/libselinux/validatetrans/runtest.sh b/libselinux/validatetrans/runtest.sh index 5b86d48..ab468eb 100755 --- a/libselinux/validatetrans/runtest.sh +++ b/libselinux/validatetrans/runtest.sh @@ -33,7 +33,7 @@ PACKAGE="libselinux" rlJournalStart # validatetrans utility is available since Fedora 32 - if ! rlIsRHEL ">8" && ! rlIsFedora ">31"; then + if ! rlIsRHEL ">8" && ! rlIsFedora ">31" && ! rlIsCentOS ">8" ; then rlLog "Not applicable to this OS version." rlJournalEnd exit 0 diff --git a/libsemanage/semanage-handle-functions/runtest.sh b/libsemanage/semanage-handle-functions/runtest.sh index b7fd6f0..b3e26a3 100755 --- a/libsemanage/semanage-handle-functions/runtest.sh +++ b/libsemanage/semanage-handle-functions/runtest.sh @@ -37,7 +37,7 @@ rlJournalStart rlAssertRpm "glibc" rlAssertRpm "gcc" - if rlIsRHEL ">=7" || rlIsFedora; then + if rlIsRHEL ">=7" || rlIsFedora || rlIsCentOS ">=7" ; then rlRun -l "gcc test_root.c -o test_root -lsemanage -Wall -Wextra -std=c99" fi @@ -53,7 +53,7 @@ rlJournalStart ERR_ABORT=134 rlPhaseEnd - if rlIsRHEL ">=7" || rlIsFedora; then + if rlIsRHEL ">=7" || rlIsFedora || rlIsCentOS ">=7" ; then rlPhaseStartTest "semanage_root, semanage_test_root" rlRun "./test_root init" rlRun "./test_root handle" diff --git a/libsemanage/semanage-seuser-functions/runtest.sh b/libsemanage/semanage-seuser-functions/runtest.sh index 1b87c8e..766a800 100755 --- a/libsemanage/semanage-seuser-functions/runtest.sh +++ b/libsemanage/semanage-seuser-functions/runtest.sh @@ -51,7 +51,7 @@ rlJournalStart if rlIsRHEL '<=6'; then SEUSERS_PATH="/etc/selinux/$POLICY_TYPE/seusers" fi - elif rlIsRHEL '>=8'; then + elif rlIsRHEL '>=8' || rlIsCentOS '>=8' ; then SEUSERS_PATH="/var/lib/selinux/$POLICY_TYPE/active/seusers" fi From 68d3f4d812f68981a7ce332fa75b84e7ff4ae914 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Fri, 8 Nov 2024 09:03:39 +0100 Subject: [PATCH 424/626] Test semanage operation with /var/lib/selinux on NFS Verifies: RHEL-60503 --- libsemanage/semanage-root-on-nfs/main.fmf | 11 ++++++ libsemanage/semanage-root-on-nfs/test.sh | 44 +++++++++++++++++++++++ 2 files changed, 55 insertions(+) create mode 100644 libsemanage/semanage-root-on-nfs/main.fmf create mode 100755 libsemanage/semanage-root-on-nfs/test.sh diff --git a/libsemanage/semanage-root-on-nfs/main.fmf b/libsemanage/semanage-root-on-nfs/main.fmf new file mode 100644 index 0000000..20e219d --- /dev/null +++ b/libsemanage/semanage-root-on-nfs/main.fmf @@ -0,0 +1,11 @@ +summary: Test semanage operation with /var/lib/selinux on NFS +test: ./test.sh +framework: beakerlib +component: libsemanage +requires: + - nfs-utils + - policycoreutils-python-utils +duration: 10m +enabled: true +link: + - verifies: https://issues.redhat.com/browse/RHEL-60503 diff --git a/libsemanage/semanage-root-on-nfs/test.sh b/libsemanage/semanage-root-on-nfs/test.sh new file mode 100755 index 0000000..d7c944a --- /dev/null +++ b/libsemanage/semanage-root-on-nfs/test.sh @@ -0,0 +1,44 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# -*- mode: shell-script; indent-tabs-mode: nil; sh-basic-offset: 4; -*- +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +STORE_ROOT=$( grep -E '^store-root' /etc/selinux/semanage.conf | tr -d ' ' | cut -d '=' -f 2 ) +if [ -z "$STORE_ROOT" ]; then + STORE_ROOT=/var/lib/selinux +fi + +rlJournalStart + rlPhaseStartSetup + rlRun "tmp=\$(mktemp -d)" 0 "Create tmp directory" + rlRun "pushd $tmp" + rlRun "set -o pipefail" + rlAssertRpm nfs-utils + rlAssertRpm policycoreutils-python-utils + rlRun "mkdir -p /srv/nfs/selinux" + rlRun "cp -r $STORE_ROOT /srv/selinux" + rlRun "mount --bind /srv/selinux /srv/nfs/selinux" + rlRun "sed -i 's%.*rootdir.*=.*%rootdir=/srv/nfs%' /etc/nfs.conf" + rlRun "systemctl enable nfs-server --now" + rlRun "cat > /etc/exports < Date: Wed, 6 Nov 2024 15:52:33 +0100 Subject: [PATCH 425/626] test if samba-bgqd can collaborate with rpcclient A recent samba + selinux-policy testing revealed that SELinux prevents the rpcclient command from enumerating printers. The TC reproduces the situation. A follow-up testing revealed that the samba-bgqd service, which plays an important role in this scenario, is not confined by SELinux. In order to support the expected rpcclient + samba-bgqd functionality, I believe that SELinux policy should allow the necessary actions. The TC looks for policy rules and file context patterns which reflect the fact that the samba-bgqd program is now confined by SELinux. The TC covers RHEL-53124 and RHEL-64908. --- .../samba-bgqd-and-similar/Makefile | 68 ++++++++++++ selinux-policy/samba-bgqd-and-similar/PURPOSE | 5 + .../samba-bgqd-and-similar/main.fmf | 39 +++++++ .../samba-bgqd-and-similar/runtest.sh | 104 ++++++++++++++++++ 4 files changed, 216 insertions(+) create mode 100644 selinux-policy/samba-bgqd-and-similar/Makefile create mode 100644 selinux-policy/samba-bgqd-and-similar/PURPOSE create mode 100644 selinux-policy/samba-bgqd-and-similar/main.fmf create mode 100755 selinux-policy/samba-bgqd-and-similar/runtest.sh diff --git a/selinux-policy/samba-bgqd-and-similar/Makefile b/selinux-policy/samba-bgqd-and-similar/Makefile new file mode 100644 index 0000000..93dcc29 --- /dev/null +++ b/selinux-policy/samba-bgqd-and-similar/Makefile @@ -0,0 +1,68 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/samba-bgqd-and-similar +# Description: SELinux interferes with samba-bgqd and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2024 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/samba-bgqd-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with samba-bgqd and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 15m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console samba samba-client samba-common-tools" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA) + @echo "Bug: RHEL-53124" >> $(METADATA) # RHEL-9 + @echo "Bug: RHEL-64908" >> $(METADATA) # RHEL-10 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/samba-bgqd-and-similar/PURPOSE b/selinux-policy/samba-bgqd-and-similar/PURPOSE new file mode 100644 index 0000000..eda41a5 --- /dev/null +++ b/selinux-policy/samba-bgqd-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/samba-bgqd-and-similar +Author: Milos Malik + +SELinux interferes with samba-bgqd and related programs. + diff --git a/selinux-policy/samba-bgqd-and-similar/main.fmf b/selinux-policy/samba-bgqd-and-similar/main.fmf new file mode 100644 index 0000000..9ab8a49 --- /dev/null +++ b/selinux-policy/samba-bgqd-and-similar/main.fmf @@ -0,0 +1,39 @@ +summary: SELinux interferes with samba-bgqd and related programs +description: |+ + SELinux interferes with samba-bgqd and related programs. + +contact: Milos Malik +component: + - selinux-policy +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - samba + - samba-client + - samba-common-tools +duration: 15m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - NoRHEL8 + - targeted + - NoRHIVOS +link: + - verifies: https://issues.redhat.com/browse/RHEL-53124 + - verifies: https://issues.redhat.com/browse/RHEL-64908 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 + continue: false +extra-summary: /CoreOS/selinux-policy/Regression/samba-bgqd-and-similar +extra-task: /CoreOS/selinux-policy/Regression/samba-bgqd-and-similar diff --git a/selinux-policy/samba-bgqd-and-similar/runtest.sh b/selinux-policy/samba-bgqd-and-similar/runtest.sh new file mode 100755 index 0000000..ab78817 --- /dev/null +++ b/selinux-policy/samba-bgqd-and-similar/runtest.sh @@ -0,0 +1,104 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/samba-bgqd-and-similar +# Description: SELinux interferes with samba-bgqd and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2024 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +SERVICE_PACKAGE="samba" +FILE_PATH="/usr/libexec/samba/samba-bgqd" +PROCESS_NAME="samba-bgqd" +SERVICE_NAME="samba-bgqd" +if seinfo -t | grep -q samba_bgqd ; then + PROCESS_CONTEXT="samba_bgqd_t" + FILE_CONTEXT="samba_bgqd_exec_t" +else + PROCESS_CONTEXT="unconfined_service_t" + FILE_CONTEXT="bin_t" +fi + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlFileBackup /etc/shadow + rlServiceStop ${SERVICE_NAME} + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + if seinfo -t | grep -q samba_bgqd ; then + rlPhaseStartTest "RHEL-53124 + RHEL-64908" + rlSEMatchPathCon ${FILE_PATH} ${FILE_CONTEXT} + rlSEMatchPathCon "/run/samba-bgqd.pid" "samba_bgqd_var_run_t" + rlSEMatchPathCon "/var/lib/sss" "sssd_var_lib_t" + rlSEMatchPathCon "/var/lib/sss/mc" "sssd_public_t" + rlSESearchRule "allow winbind_rpcd_t samba_bgqd_var_run_t : file { open write lock } [ ]" + rlSESearchRule "allow winbind_rpcd_t samba_bgqd_t : unix_dgram_socket { sendto } [ ]" + rlSESearchRule "allow winbind_rpcd_t samba_bgqd_exec_t : file { getattr open read map execute } [ ]" + rlSESearchRule "allow samba_bgqd_t sssd_public_t : dir { search } [ ]" + rlSESearchRule "allow samba_bgqd_t sssd_var_lib_t : dir { search } [ ]" + rlSESearchRule "allow samba_bgqd_t winbind_rpcd_t : fifo_file { write } [ ]" + rlPhaseEnd + fi + + rlPhaseStartTest "real scenario" + USER_NAME="smbuser${RANDOM}" + USER_SECRET="S3kr3T${RANDOM}" + rlRun "useradd ${USER_NAME}" + rlRun "echo ${USER_SECRET} | passwd --stdin ${USER_NAME}" + rlRun "echo -en '${USER_SECRET}\n${USER_SECRET}\n' | smbpasswd -s -a ${USER_NAME}" + rlRun "systemctl start samba-bgqd" + rlRun "systemctl start smb" + rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 + sleep 2 + rlRun "rpcclient ncacn_np:localhost -c 'enumprinters' -U${USER_NAME}%${USER_SECRET}" + sleep 2 + rlRun "systemctl stop smb" + rlRun "systemctl stop samba-bgqd" + rlRun "smbpasswd -x ${USER_NAME}" + rlRun "userdel -rf ${USER_NAME}" + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + From 9c7a2f4fb49d5dae5aa31091a70d7609fd95c7ae Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Thu, 28 Nov 2024 21:21:02 +0100 Subject: [PATCH 426/626] fix requirements, relevancy and checks The AVC subtest can be disabled, because all modified tests look for SELinux denials directly. At least 1 of the modified tests had an incorrect or incomplete list of package requirements. At least 1 of the modified tests had an incorrect relevancy. --- selinux-policy/blueman-and-similar/Makefile | 1 + selinux-policy/blueman-and-similar/main.fmf | 2 ++ selinux-policy/gnome-remote-desktop-and-similar/runtest.sh | 4 ++++ selinux-policy/power-profiles-daemon-and-similar/Makefile | 1 + selinux-policy/power-profiles-daemon-and-similar/main.fmf | 3 ++- selinux-policy/samba-bgqd-and-similar/Makefile | 1 + selinux-policy/samba-bgqd-and-similar/main.fmf | 2 ++ selinux-policy/smbcontrol-and-similar/Makefile | 1 + selinux-policy/smbcontrol-and-similar/main.fmf | 2 ++ selinux-policy/systemd-mountfsd-and-similar/runtest.sh | 2 +- selinux-policy/systemd-nsresourced-and-similar/runtest.sh | 2 +- selinux-policy/tlshd-and-similar/Makefile | 2 +- selinux-policy/tlshd-and-similar/runtest.sh | 4 ++-- 13 files changed, 21 insertions(+), 6 deletions(-) diff --git a/selinux-policy/blueman-and-similar/Makefile b/selinux-policy/blueman-and-similar/Makefile index 5b1d70a..633c985 100644 --- a/selinux-policy/blueman-and-similar/Makefile +++ b/selinux-policy/blueman-and-similar/Makefile @@ -56,6 +56,7 @@ $(METADATA): Makefile @echo "RunFor: selinux-policy" >> $(METADATA) @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console glib2 gtk3 blueman python-cairo pygtk2 /usr/sbin/service" >> $(METADATA) @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @echo "License: GPLv2" >> $(METADATA) @echo "Confidential: no" >> $(METADATA) diff --git a/selinux-policy/blueman-and-similar/main.fmf b/selinux-policy/blueman-and-similar/main.fmf index 502e9ce..3856db9 100644 --- a/selinux-policy/blueman-and-similar/main.fmf +++ b/selinux-policy/blueman-and-similar/main.fmf @@ -21,6 +21,8 @@ recommend: - python-cairo - pygtk2 - /usr/sbin/service +environment: + AVC_ERROR: +no_avc_check duration: 10m enabled: true tag: diff --git a/selinux-policy/gnome-remote-desktop-and-similar/runtest.sh b/selinux-policy/gnome-remote-desktop-and-similar/runtest.sh index d533dc7..9763687 100755 --- a/selinux-policy/gnome-remote-desktop-and-similar/runtest.sh +++ b/selinux-policy/gnome-remote-desktop-and-similar/runtest.sh @@ -66,6 +66,7 @@ rlJournalStart rlPhaseEnd fi + if [ -f /usr/lib/systemd/system/gnome-remote-desktop.service ] ; then rlPhaseStartTest "real scenario" rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 rlRun "grdctl --headless status" @@ -76,6 +77,9 @@ rlJournalStart rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd + fi + + # TODO: test the gnome-remote-desktop service under normal/confined users rlPhaseStartCleanup sleep 2 diff --git a/selinux-policy/power-profiles-daemon-and-similar/Makefile b/selinux-policy/power-profiles-daemon-and-similar/Makefile index d9b17a0..afd0a0a 100644 --- a/selinux-policy/power-profiles-daemon-and-similar/Makefile +++ b/selinux-policy/power-profiles-daemon-and-similar/Makefile @@ -64,6 +64,7 @@ $(METADATA): Makefile @echo "Destructive: no" >> $(METADATA) @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA) @echo "Bug: RHEL-61117" >> $(METADATA) # RHEL-9 + @echo "Bug: RHEL-62356" >> $(METADATA) # RHEL-10 rhts-lint $(METADATA) diff --git a/selinux-policy/power-profiles-daemon-and-similar/main.fmf b/selinux-policy/power-profiles-daemon-and-similar/main.fmf index 8c790f3..9b522b0 100644 --- a/selinux-policy/power-profiles-daemon-and-similar/main.fmf +++ b/selinux-policy/power-profiles-daemon-and-similar/main.fmf @@ -33,9 +33,10 @@ tag: - NoRHIVOS link: - verifies: https://issues.redhat.com/browse/RHEL-61117 + - verifies: https://issues.redhat.com/browse/RHEL-62356 adjust: - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, rhel-10, centos-stream-10 because: the power-profiles-daemon package is not available there extra-summary: /CoreOS/selinux-policy/Regression/power-profiles-daemon-and-similar extra-task: /CoreOS/selinux-policy/Regression/power-profiles-daemon-and-similar diff --git a/selinux-policy/samba-bgqd-and-similar/Makefile b/selinux-policy/samba-bgqd-and-similar/Makefile index 93dcc29..0c99403 100644 --- a/selinux-policy/samba-bgqd-and-similar/Makefile +++ b/selinux-policy/samba-bgqd-and-similar/Makefile @@ -56,6 +56,7 @@ $(METADATA): Makefile @echo "RunFor: selinux-policy" >> $(METADATA) @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console samba samba-client samba-common-tools" >> $(METADATA) @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @echo "License: GPLv2" >> $(METADATA) @echo "Confidential: no" >> $(METADATA) diff --git a/selinux-policy/samba-bgqd-and-similar/main.fmf b/selinux-policy/samba-bgqd-and-similar/main.fmf index 9ab8a49..99a0a4d 100644 --- a/selinux-policy/samba-bgqd-and-similar/main.fmf +++ b/selinux-policy/samba-bgqd-and-similar/main.fmf @@ -18,6 +18,8 @@ recommend: - samba - samba-client - samba-common-tools +environment: + AVC_ERROR: +no_avc_check duration: 15m enabled: true tag: diff --git a/selinux-policy/smbcontrol-and-similar/Makefile b/selinux-policy/smbcontrol-and-similar/Makefile index 1f8ca03..e483fa0 100644 --- a/selinux-policy/smbcontrol-and-similar/Makefile +++ b/selinux-policy/smbcontrol-and-similar/Makefile @@ -56,6 +56,7 @@ $(METADATA): Makefile @echo "RunFor: selinux-policy" >> $(METADATA) @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console samba-common samba-common-tools" >> $(METADATA) @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @echo "License: GPLv2" >> $(METADATA) @echo "Confidential: no" >> $(METADATA) diff --git a/selinux-policy/smbcontrol-and-similar/main.fmf b/selinux-policy/smbcontrol-and-similar/main.fmf index 0c5ccda..6eefc44 100644 --- a/selinux-policy/smbcontrol-and-similar/main.fmf +++ b/selinux-policy/smbcontrol-and-similar/main.fmf @@ -17,6 +17,8 @@ recommend: - setools-console - samba-common - samba-common-tools +environment: + AVC_ERROR: +no_avc_check duration: 15m enabled: true tag: diff --git a/selinux-policy/systemd-mountfsd-and-similar/runtest.sh b/selinux-policy/systemd-mountfsd-and-similar/runtest.sh index ddd5aae..0388f63 100755 --- a/selinux-policy/systemd-mountfsd-and-similar/runtest.sh +++ b/selinux-policy/systemd-mountfsd-and-similar/runtest.sh @@ -39,7 +39,7 @@ FILE_CONTEXT="systemd_mountfsd_exec_t" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/systemd-nsresourced-and-similar/runtest.sh b/selinux-policy/systemd-nsresourced-and-similar/runtest.sh index 2124748..9fb618c 100755 --- a/selinux-policy/systemd-nsresourced-and-similar/runtest.sh +++ b/selinux-policy/systemd-nsresourced-and-similar/runtest.sh @@ -39,7 +39,7 @@ FILE_CONTEXT="systemd_nsresourced_exec_t" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted diff --git a/selinux-policy/tlshd-and-similar/Makefile b/selinux-policy/tlshd-and-similar/Makefile index 8cd29b8..b6e2928 100644 --- a/selinux-policy/tlshd-and-similar/Makefile +++ b/selinux-policy/tlshd-and-similar/Makefile @@ -54,7 +54,7 @@ $(METADATA): Makefile @echo "Type: Regression" >> $(METADATA) @echo "TestTime: 10m" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console tlshd /usr/sbin/service" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console ktls-utils /usr/sbin/service" >> $(METADATA) @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) diff --git a/selinux-policy/tlshd-and-similar/runtest.sh b/selinux-policy/tlshd-and-similar/runtest.sh index 6e75aa8..4a2fc48 100755 --- a/selinux-policy/tlshd-and-similar/runtest.sh +++ b/selinux-policy/tlshd-and-similar/runtest.sh @@ -35,8 +35,8 @@ SERVICE_PACKAGE="ktls-utils" SERVICE_NAME="tlshd" PROCESS_NAME="tlshd" if seinfo -t | grep -q tlshd ; then - PROCESS_CONTEXT="tlshd_t" - FILE_CONTEXT="tlshd_exec_t" + PROCESS_CONTEXT="ktlshd_t" + FILE_CONTEXT="ktlshd_exec_t" else PROCESS_CONTEXT="unconfined_service_t" FILE_CONTEXT="bin_t" From 0efb4046b15aae90f8a56e1edf73e5262333a663 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 26 Nov 2024 20:28:53 +0100 Subject: [PATCH 427/626] add various virt-install test scenarios test if memory device can be attached to a VM TBA later The TC covers RHEL-65038. test if VM can start with multiqueue virtio interface TBA later The TC covers RHEL-65373. test if VM can start with an isolated port TBA later The TC covers RHEL-65383. test if VM with NUMA setting can start TBA later The TC covers RHEL-65789. test if nbdkit enabled VM can start TBA later The TC covers RHEL-56029 and RHEL-69118. --- .../virt-install-additional/Makefile | 74 +++++++ .../virt-install-additional/PURPOSE | 5 + .../virt-install-additional/dimm.xml | 6 + .../virt-install-additional/main.fmf | 51 +++++ .../virt-install-additional/runtest.sh | 182 ++++++++++++++++++ 5 files changed, 318 insertions(+) create mode 100644 selinux-policy/virt-install-additional/Makefile create mode 100644 selinux-policy/virt-install-additional/PURPOSE create mode 100644 selinux-policy/virt-install-additional/dimm.xml create mode 100644 selinux-policy/virt-install-additional/main.fmf create mode 100755 selinux-policy/virt-install-additional/runtest.sh diff --git a/selinux-policy/virt-install-additional/Makefile b/selinux-policy/virt-install-additional/Makefile new file mode 100644 index 0000000..10abc7e --- /dev/null +++ b/selinux-policy/virt-install-additional/Makefile @@ -0,0 +1,74 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/virt-install-additional +# Description: SELinux interferes with virt-install and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2024 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/virt-install-additional +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with virt-install and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 20m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted /usr/sbin/service setools-console virt-install numad nbdkit" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) + @echo "Architectures: aarch64 s390x x86_64" >> $(METADATA) + @echo "Bug: RHEL-56029" >> $(METADATA) # RHEL-9 + @echo "Bug: RHEL-65038" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-65373" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-65383" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-65789" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-69118" >> $(METADATA) # RHEL-10 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/virt-install-additional/PURPOSE b/selinux-policy/virt-install-additional/PURPOSE new file mode 100644 index 0000000..abe4221 --- /dev/null +++ b/selinux-policy/virt-install-additional/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/virt-install-additional +Author: Milos Malik + +SELinux interferes with virt-install and related programs. +Also covers: numad. diff --git a/selinux-policy/virt-install-additional/dimm.xml b/selinux-policy/virt-install-additional/dimm.xml new file mode 100644 index 0000000..326c928 --- /dev/null +++ b/selinux-policy/virt-install-additional/dimm.xml @@ -0,0 +1,6 @@ + + + 524287 + 0 + + diff --git a/selinux-policy/virt-install-additional/main.fmf b/selinux-policy/virt-install-additional/main.fmf new file mode 100644 index 0000000..970a87d --- /dev/null +++ b/selinux-policy/virt-install-additional/main.fmf @@ -0,0 +1,51 @@ +summary: SELinux interferes with virt-install and related programs. +description: |+ + SELinux interferes with virt-install and related programs. + +contact: Milos Malik +component: + - selinux-policy +test: ./runtest.sh +framework: beakerlib +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - /usr/sbin/service + - setools-console + - virt-install + - numad + - nbdkit +environment: + AVC_ERROR: +no_avc_check +duration: 20m +enabled: true +tag: + - kernel-rt + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - targeted + - NoRHIVOS +link: + - verifies: https://issues.redhat.com/browse/RHEL-56029 + - verifies: https://issues.redhat.com/browse/RHEL-65038 + - verifies: https://issues.redhat.com/browse/RHEL-65373 + - verifies: https://issues.redhat.com/browse/RHEL-65383 + - verifies: https://issues.redhat.com/browse/RHEL-65789 + - verifies: https://issues.redhat.com/browse/RHEL-69118 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + continue: false + - enabled: false + when: distro == ppc64le + continue: false +extra-summary: /CoreOS/selinux-policy/Regression/virt-install-additional +extra-task: /CoreOS/selinux-policy/Regression/virt-install-additional diff --git a/selinux-policy/virt-install-additional/runtest.sh b/selinux-policy/virt-install-additional/runtest.sh new file mode 100755 index 0000000..d6dbcdf --- /dev/null +++ b/selinux-policy/virt-install-additional/runtest.sh @@ -0,0 +1,182 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/virt-install-additional +# Description: SELinux interferes with virt-install and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2024 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm virt-install + + rlRun "yum -y install libvirt\* qemu\* --skip-broken" + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "RHEL-65038" + rlSESearchRule "allow virtqemud_t svirt_tcg_t : lnk_file { read } [ ]" + rlSESearchRule "allow virtqemud_t svirt_tcg_t : process { getrlimit } [ ]" + rlSESearchRule "allow virtqemud_t svirt_t : process { getrlimit } [ ]" + if rlIsRHEL 8 ; then + rlRun "service libvirtd start" + fi + rlRun "service virtqemud start" + rlRun "service virtnetworkd start" + rlRun "service virtstoraged start" + rlRun "virt-install --memory 128 --pxe --virt-type qemu --os-variant alpinelinux3.8 --disk none --wait 0 --name test1 --cpu mode=maximum,check=none,migratable=on,numa.cell.id=0,numa.cell.cpus=0,numa.cell.memory=512000,numa.cell.unit="KiB" --memory maxMemory.slots=16,maxMemory=4096" + sleep 30 + rlRun "virsh list" + rlRun "virsh list | grep 'test1.*running'" + rlRun "virsh attach-device test1 dimm.xml" + sleep 30 + rlRun "virsh destroy test1" + rlRun "virsh undefine test1" + rlRun "service virtstoraged stop" + rlRun "service virtnetworkd stop" + rlRun "service virtqemud stop" + if rlIsRHEL 8 ; then + rlRun "service libvirtd stop" + fi + rlPhaseEnd + + rlPhaseStartTest "RHEL-65373" + rlSESearchRule "allow virtqemud_t virtqemud_t : tun_socket { relabelto relabelfrom } [ ]" + if rlIsRHEL 8 ; then + rlRun "service libvirtd start" + fi + rlRun "service virtqemud start" + rlRun "service virtnetworkd start" + rlRun "service virtstoraged start" + rlRun "virt-install --memory 128 --pxe --virt-type qemu --os-variant alpinelinux3.8 --wait 0 --name test2 --network type=network,mac.address='52:54:00:ee:01:68',source=default,model.type=virtio,driver.queues=4" + sleep 30 + rlRun "virsh list" + rlRun "virsh list | grep 'test2.*running'" + rlRun "virsh destroy test2" + rlRun "virsh undefine test2" + rlRun "service virtstoraged stop" + rlRun "service virtnetworkd stop" + rlRun "service virtqemud stop" + if rlIsRHEL 8 ; then + rlRun "service libvirtd stop" + fi + rlPhaseEnd + + rlPhaseStartTest "RHEL-65383" + rlSESearchRule "allow virtqemud_t sysfs_t : file { write } [ ]" + if rlIsRHEL 8 ; then + rlRun "service libvirtd start" + fi + rlRun "service virtqemud start" + rlRun "service virtnetworkd start" + rlRun "service virtstoraged start" + rlRun "virt-install --memory 128 --pxe --virt-type qemu --os-variant alpinelinux3.8 --wait 0 --name test3 --network type=network,mac.address='52:54:00:23:f2:12',source=default,model.type=virtio --xml xpath.set=./devices/interface/port/@isolated=yes" + sleep 30 + rlRun "virsh list" + rlRun "virsh list | grep 'test3.*running'" + rlRun "virsh destroy test3" + rlRun "virsh undefine test3" + rlRun "service virtstoraged stop" + rlRun "service virtnetworkd stop" + rlRun "service virtqemud stop" + if rlIsRHEL 8 ; then + rlRun "service libvirtd stop" + fi + rlPhaseEnd + + rlPhaseStartTest "RHEL-65789" + rlSESearchRule "allow virtqemud_t numad_exec_t : file { getattr open read map execute } [ ]" + rlSESearchRule "allow virtqemud_t numad_t : process { transition } [ ]" + rlSESearchRule "type_transition virtqemud_t numad_exec_t : process numad_t" + if rlIsRHEL 8 ; then + rlRun "service libvirtd start" + fi + rlRun "service virtqemud start" + rlRun "service virtnetworkd start" + rlRun "service virtstoraged start" + rlRun "virt-install --memory 128 --pxe --virt-type qemu --os-variant alpinelinux3.8 --wait 0 --name test4 --numatune memory.mode='strict',memory.placement='auto'" + sleep 30 + rlRun "virsh list" + rlRun "virsh list | grep 'test4.*running'" + rlRun "virsh destroy test4" + rlRun "virsh undefine test4" + rlRun "service virtstoraged stop" + rlRun "service virtnetworkd stop" + rlRun "service virtqemud stop" + if rlIsRHEL 8 ; then + rlRun "service libvirtd stop" + fi + rlPhaseEnd + + rlPhaseStartTest "RHEL-56029 + RHEL-69118" + if rlIsRHEL 9 || rlIsCentOS 9 ; then + rlSESearchRule "allow virtd_t nbdkit_exec_t : file { entrypoint } [ ]" + elif rlIsRHEL 10 || rlIsCentOS 10 ; then + rlSESearchRule "allow virtqemud_t nbdkit_exec_t : file { getattr open read map execute } [ ]" + rlSESearchRule "allow virtqemud_t nbdkit_t : process { transition } [ ]" + rlSESearchRule "type_transition virtqemud_t nbdkit_exec_t : process nbdkit_t" + fi + if rlIsRHEL 8 ; then + rlRun "service libvirtd start" + fi + rlFileBackup /etc/libvirt/qemu.conf + rlRun "sed -i 's/^.*storage_use_nbdkit.*=.*$/storage_use_nbdkit = 1/' /etc/libvirt/qemu.conf" + rlRun "grep storage_use_nbdkit /etc/libvirt/qemu.conf" + rlRun "service virtqemud start" + rlRun "service virtnetworkd start" + rlRun "service virtstoraged start" + rlRun "virt-install --memory 128 --pxe --virt-type qemu --os-variant alpinelinux3.8 --disk source.protocol=ssh,source.name=/var/lib/libvirt/images/test.img,source.host0.name=10.73.210.25,source.host0.port=22 --wait 0 --name test5" + sleep 30 + rlRun "virsh list" + rlRun "virsh list | grep 'test5.*running'" + rlRun "virsh destroy test5" + rlRun "virsh undefine test5" + rlRun "service virtstoraged stop" + rlRun "service virtnetworkd stop" + rlRun "service virtqemud stop" + if rlIsRHEL 8 ; then + rlRun "service libvirtd stop" + fi + rlFileRestore + rlPhaseEnd + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + From af82a85d6d63aa2f8a16719359112d28c8e2f66c Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Fri, 29 Nov 2024 17:14:54 +0100 Subject: [PATCH 428/626] test if samba-bgqd can search /etc/cups/ and /run/cups/ Recent selinux-policy + cups + samba-bgqd testing revealed SELinux denials which are triggered when the samba-bgqd service is started on a machine where cups* packages are installed. The TC reproduces the situation. In order to support the intended samba-bgqd functionality, I believe that SELinux policy should allow these actions. The TC looks for appropriate policy rules and file context patterns. The TC covers RHEL-69512 and RHEL-69517. --- selinux-policy/samba-bgqd-and-similar/Makefile | 4 +++- selinux-policy/samba-bgqd-and-similar/main.fmf | 3 +++ selinux-policy/samba-bgqd-and-similar/runtest.sh | 8 ++++++++ 3 files changed, 14 insertions(+), 1 deletion(-) diff --git a/selinux-policy/samba-bgqd-and-similar/Makefile b/selinux-policy/samba-bgqd-and-similar/Makefile index 0c99403..614f246 100644 --- a/selinux-policy/samba-bgqd-and-similar/Makefile +++ b/selinux-policy/samba-bgqd-and-similar/Makefile @@ -54,7 +54,7 @@ $(METADATA): Makefile @echo "Type: Regression" >> $(METADATA) @echo "TestTime: 15m" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console samba samba-client samba-common-tools" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console samba samba-client samba-common-tools cups" >> $(METADATA) @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @@ -64,6 +64,8 @@ $(METADATA): Makefile @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA) @echo "Bug: RHEL-53124" >> $(METADATA) # RHEL-9 @echo "Bug: RHEL-64908" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-69512" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-69517" >> $(METADATA) # RHEL-9 rhts-lint $(METADATA) diff --git a/selinux-policy/samba-bgqd-and-similar/main.fmf b/selinux-policy/samba-bgqd-and-similar/main.fmf index 99a0a4d..cb06aa6 100644 --- a/selinux-policy/samba-bgqd-and-similar/main.fmf +++ b/selinux-policy/samba-bgqd-and-similar/main.fmf @@ -18,6 +18,7 @@ recommend: - samba - samba-client - samba-common-tools + - cups environment: AVC_ERROR: +no_avc_check duration: 15m @@ -33,6 +34,8 @@ tag: link: - verifies: https://issues.redhat.com/browse/RHEL-53124 - verifies: https://issues.redhat.com/browse/RHEL-64908 + - verifies: https://issues.redhat.com/browse/RHEL-69512 + - verifies: https://issues.redhat.com/browse/RHEL-69517 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 diff --git a/selinux-policy/samba-bgqd-and-similar/runtest.sh b/selinux-policy/samba-bgqd-and-similar/runtest.sh index ab78817..ea4b805 100755 --- a/selinux-policy/samba-bgqd-and-similar/runtest.sh +++ b/selinux-policy/samba-bgqd-and-similar/runtest.sh @@ -72,6 +72,14 @@ rlJournalStart rlSESearchRule "allow samba_bgqd_t sssd_var_lib_t : dir { search } [ ]" rlSESearchRule "allow samba_bgqd_t winbind_rpcd_t : fifo_file { write } [ ]" rlPhaseEnd + + rlPhaseStartTest "RHEL-69512 + RHEL-69517" + rlSEMatchPathCon ${FILE_PATH} ${FILE_CONTEXT} + rlSEMatchPathCon "/etc/cups" "cupsd_etc_t" + rlSEMatchPathCon "/run/cups" "cupsd_var_run_t" + rlSESearchRule "allow samba_bgqd_t cupsd_etc_t : dir { search } [ ]" + rlSESearchRule "allow samba_bgqd_t cupsd_var_run_t : dir { search } [ ]" + rlPhaseEnd fi rlPhaseStartTest "real scenario" From 46a86a1ff1d5b76b16922d8fa8ecbe301e34e49e Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 3 Dec 2024 15:58:43 +0100 Subject: [PATCH 429/626] do not trigger RHEL-47401 on RHEL-9.x Current decision on RHEL-47401 is not to fix it. In order to avoid unnecessary failures (or waiving), the test scenario will not be tested on RHEL-9 and CentOs stream 9 machines. --- selinux-policy/cups-browsed-and-similar/Makefile | 1 + selinux-policy/cups-browsed-and-similar/main.fmf | 1 + selinux-policy/cups-browsed-and-similar/runtest.sh | 10 +++++++--- 3 files changed, 9 insertions(+), 3 deletions(-) diff --git a/selinux-policy/cups-browsed-and-similar/Makefile b/selinux-policy/cups-browsed-and-similar/Makefile index a6ec20e..f78d4ec 100644 --- a/selinux-policy/cups-browsed-and-similar/Makefile +++ b/selinux-policy/cups-browsed-and-similar/Makefile @@ -67,6 +67,7 @@ $(METADATA): Makefile @echo "Bug: 1401634" >> $(METADATA) # Fedora 26 @echo "Bug: 1719754" >> $(METADATA) # RHEL-7 @echo "Bug: RHEL-47401" >> $(METADATA) # RHEL-9 + @echo "Bug: RHEL-54579" >> $(METADATA) # RHEL-10 rhts-lint $(METADATA) diff --git a/selinux-policy/cups-browsed-and-similar/main.fmf b/selinux-policy/cups-browsed-and-similar/main.fmf index c75ebba..6b201f0 100644 --- a/selinux-policy/cups-browsed-and-similar/main.fmf +++ b/selinux-policy/cups-browsed-and-similar/main.fmf @@ -41,6 +41,7 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1719754 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1929329 - verifies: https://issues.redhat.com/browse/RHEL-47401 + - verifies: https://issues.redhat.com/browse/RHEL-54579 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6 diff --git a/selinux-policy/cups-browsed-and-similar/runtest.sh b/selinux-policy/cups-browsed-and-similar/runtest.sh index 6aa8b88..fc6e607 100755 --- a/selinux-policy/cups-browsed-and-similar/runtest.sh +++ b/selinux-policy/cups-browsed-and-similar/runtest.sh @@ -82,9 +82,13 @@ rlJournalStart fi fi rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 - rlRun "mkdir -p /root/.cups" - rlRun "touch /root/.cups/lpoptions" + rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 + if ! rlIsRHEL 9 && ! rlIsCentOS 9 ; then + # RHEL-47401 closed as won't fix + # RHEL-54579 will be fixed in RHEL-10 + rlRun "mkdir -p /root/.cups" + rlRun "touch /root/.cups/lpoptions" + fi rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd From b0f6b28c82ac0c204dba19b7e1e4cb9d4f461a69 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Mon, 2 Dec 2024 16:29:27 +0100 Subject: [PATCH 430/626] libsemanage: drop disconnect tests It tests wrong behavior which is fixed in the latest libsemanage and in order not to break test runs on older systems lets drop it. Fixes: semanage_handle_create(): 0x4f782c0 semanage_disconnect(0x4f782c0): 0 semanage_connect(0x4f782c0): 0 semanage_handle_destroy(0x4f782c0) [ FAIL ] :: Command './test_connect handle reversed' (Expected 134, got 0) --- libsemanage/sanity-tests/tests/test_handle.c | 4 ---- libsemanage/semanage-handle-functions/runtest.sh | 1 - 2 files changed, 5 deletions(-) diff --git a/libsemanage/sanity-tests/tests/test_handle.c b/libsemanage/sanity-tests/tests/test_handle.c index 810014d..a508043 100644 --- a/libsemanage/sanity-tests/tests/test_handle.c +++ b/libsemanage/sanity-tests/tests/test_handle.c @@ -102,12 +102,8 @@ void test_connect(void) { void test_disconnect(void) { setup_handle(SH_NULL); - CU_ASSERT_SIGNAL(semanage_disconnect(sh), SIGABRT); - helper_handle_create(); - CU_ASSERT_SIGNAL(semanage_disconnect(sh), SIGABRT); - helper_connect(); CU_ASSERT(semanage_disconnect(sh) >= 0); diff --git a/libsemanage/semanage-handle-functions/runtest.sh b/libsemanage/semanage-handle-functions/runtest.sh index b3e26a3..e29a22b 100755 --- a/libsemanage/semanage-handle-functions/runtest.sh +++ b/libsemanage/semanage-handle-functions/runtest.sh @@ -85,7 +85,6 @@ rlJournalStart rlRun "./test_connect init reversed" $ERR_ABORT rlRun "./test_connect handle" rlRun "./test_connect handle twice" - rlRun "./test_connect handle reversed" $ERR_ABORT # why does it work?? rlRun "./test_connect conn" rlPhaseEnd From 25874c879b02bdc9425bac8146478c006aeae4fb Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Wed, 4 Dec 2024 11:13:02 +0100 Subject: [PATCH 431/626] test if virtqemud can use sched_getaffinity syscall on VM A recent virt* and selinux-policy testing revealed that rpc-virtqemud process triggers SELinux denial as a reaction to the "virsh vcpuinfo" command. The TC reproduces the situation. In order to provide the detailed domain vcpu information successfully, I believe that SELinux policy should allow this action. The TC looks for appropriate policy rules. The TC covers RHEL-69920. --- .../virt-install-additional/Makefile | 3 +- .../virt-install-additional/main.fmf | 4 ++ .../virt-install-additional/runtest.sh | 50 ++++++++++++++++--- 3 files changed, 48 insertions(+), 9 deletions(-) diff --git a/selinux-policy/virt-install-additional/Makefile b/selinux-policy/virt-install-additional/Makefile index 10abc7e..bc05e84 100644 --- a/selinux-policy/virt-install-additional/Makefile +++ b/selinux-policy/virt-install-additional/Makefile @@ -54,7 +54,7 @@ $(METADATA): Makefile @echo "Type: Regression" >> $(METADATA) @echo "TestTime: 20m" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted /usr/sbin/service setools-console virt-install numad nbdkit" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted /usr/sbin/service setools-console virt-install libvirt-client numad nbdkit" >> $(METADATA) @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @@ -69,6 +69,7 @@ $(METADATA): Makefile @echo "Bug: RHEL-65383" >> $(METADATA) # RHEL-10 @echo "Bug: RHEL-65789" >> $(METADATA) # RHEL-10 @echo "Bug: RHEL-69118" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-69920" >> $(METADATA) # RHEL-10 rhts-lint $(METADATA) diff --git a/selinux-policy/virt-install-additional/main.fmf b/selinux-policy/virt-install-additional/main.fmf index 970a87d..07b77d2 100644 --- a/selinux-policy/virt-install-additional/main.fmf +++ b/selinux-policy/virt-install-additional/main.fmf @@ -19,6 +19,7 @@ recommend: - /usr/sbin/service - setools-console - virt-install + - libvirt-client - numad - nbdkit environment: @@ -40,6 +41,7 @@ link: - verifies: https://issues.redhat.com/browse/RHEL-65383 - verifies: https://issues.redhat.com/browse/RHEL-65789 - verifies: https://issues.redhat.com/browse/RHEL-69118 + - verifies: https://issues.redhat.com/browse/RHEL-69920 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 @@ -49,3 +51,5 @@ adjust: continue: false extra-summary: /CoreOS/selinux-policy/Regression/virt-install-additional extra-task: /CoreOS/selinux-policy/Regression/virt-install-additional +extra-nitrate: TC#0617996 +id: a2688b1a-bb0f-4489-bfd0-ef573d832d8a diff --git a/selinux-policy/virt-install-additional/runtest.sh b/selinux-policy/virt-install-additional/runtest.sh index d6dbcdf..f903568 100755 --- a/selinux-policy/virt-install-additional/runtest.sh +++ b/selinux-policy/virt-install-additional/runtest.sh @@ -48,9 +48,11 @@ rlJournalStart rlPhaseEnd rlPhaseStartTest "RHEL-65038" - rlSESearchRule "allow virtqemud_t svirt_tcg_t : lnk_file { read } [ ]" - rlSESearchRule "allow virtqemud_t svirt_tcg_t : process { getrlimit } [ ]" - rlSESearchRule "allow virtqemud_t svirt_t : process { getrlimit } [ ]" + if seinfo -a | grep -q virt_driver_domain ; then + rlSESearchRule "allow virtqemud_t svirt_tcg_t : lnk_file { read } [ ]" + rlSESearchRule "allow virtqemud_t svirt_tcg_t : process { getrlimit } [ ]" + rlSESearchRule "allow virtqemud_t svirt_t : process { getrlimit } [ ]" + fi if rlIsRHEL 8 ; then rlRun "service libvirtd start" fi @@ -74,7 +76,9 @@ rlJournalStart rlPhaseEnd rlPhaseStartTest "RHEL-65373" - rlSESearchRule "allow virtqemud_t virtqemud_t : tun_socket { relabelto relabelfrom } [ ]" + if seinfo -a | grep -q virt_driver_domain ; then + rlSESearchRule "allow virtqemud_t virtqemud_t : tun_socket { relabelto relabelfrom } [ ]" + fi if rlIsRHEL 8 ; then rlRun "service libvirtd start" fi @@ -96,7 +100,9 @@ rlJournalStart rlPhaseEnd rlPhaseStartTest "RHEL-65383" - rlSESearchRule "allow virtqemud_t sysfs_t : file { write } [ ]" + if seinfo -a | grep -q virt_driver_domain ; then + rlSESearchRule "allow virtqemud_t sysfs_t : file { write } [ ]" + fi if rlIsRHEL 8 ; then rlRun "service libvirtd start" fi @@ -118,9 +124,11 @@ rlJournalStart rlPhaseEnd rlPhaseStartTest "RHEL-65789" - rlSESearchRule "allow virtqemud_t numad_exec_t : file { getattr open read map execute } [ ]" - rlSESearchRule "allow virtqemud_t numad_t : process { transition } [ ]" - rlSESearchRule "type_transition virtqemud_t numad_exec_t : process numad_t" + if seinfo -a | grep -q virt_driver_domain ; then + rlSESearchRule "allow virtqemud_t numad_exec_t : file { getattr open read map execute } [ ]" + rlSESearchRule "allow virtqemud_t numad_t : process { transition } [ ]" + rlSESearchRule "type_transition virtqemud_t numad_exec_t : process numad_t" + fi if rlIsRHEL 8 ; then rlRun "service libvirtd start" fi @@ -173,6 +181,32 @@ rlJournalStart rlFileRestore rlPhaseEnd + rlPhaseStartTest "RHEL-69920" + if seinfo -a | grep -q virt_driver_domain ; then + rlSESearchRule "allow virtqemud_t svirt_t : process { getsched } [ ]" + rlSESearchRule "allow virtqemud_t svirt_tcg_t : process { getsched } [ ]" + fi + if rlIsRHEL 8 ; then + rlRun "service libvirtd start" + fi + rlRun "service virtqemud start" + rlRun "service virtnetworkd start" + rlRun "service virtstoraged start" + rlRun "virt-install --memory 128 --pxe --virt-type qemu --os-variant alpinelinux3.8 --wait 0 --name test6" + sleep 30 + rlRun "virsh vcpuinfo test6" + rlRun "virsh list" + rlRun "virsh list | grep 'test6.*running'" + rlRun "virsh destroy test6" + rlRun "virsh undefine test6" + rlRun "service virtstoraged stop" + rlRun "service virtnetworkd stop" + rlRun "service virtqemud stop" + if rlIsRHEL 8 ; then + rlRun "service libvirtd stop" + fi + rlPhaseEnd + rlPhaseStartCleanup sleep 2 rlSECheckAVC From 02fe4ae17a3e98693f322117ba033320693bb108 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Wed, 11 Dec 2024 08:35:52 +0100 Subject: [PATCH 432/626] test if GDM can talk to iio-sensor-proxy via D-bus Recent gdm + iio-sensor-proxy + selinux-policy testing revealed that SELinux prevents the D-bus communication between the gdm service and the iio-sensor-proxy service. The TC reproduces the situation. In order to support their intentional collaboration (for example: net.hadess.SensorProxy.ClaimAccelerometer), I believe that SELinux policy should allow the D-bus communication in both directions. The TC looks for appropriate policy rules. The TC covers RHEL-70850. --- selinux-policy/iio-sensor-proxy-and-similar/Makefile | 4 +++- selinux-policy/iio-sensor-proxy-and-similar/PURPOSE | 1 + selinux-policy/iio-sensor-proxy-and-similar/main.fmf | 3 +++ selinux-policy/iio-sensor-proxy-and-similar/runtest.sh | 7 +++++++ 4 files changed, 14 insertions(+), 1 deletion(-) diff --git a/selinux-policy/iio-sensor-proxy-and-similar/Makefile b/selinux-policy/iio-sensor-proxy-and-similar/Makefile index 8d57ba2..1de229f 100644 --- a/selinux-policy/iio-sensor-proxy-and-similar/Makefile +++ b/selinux-policy/iio-sensor-proxy-and-similar/Makefile @@ -55,7 +55,7 @@ $(METADATA): Makefile @echo "TestTime: 10m" >> $(METADATA) @echo "RunFor: iio-sensor-proxy" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console iio-sensor-proxy /usr/sbin/service" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console iio-sensor-proxy /usr/sbin/service gdm" >> $(METADATA) @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @@ -64,6 +64,8 @@ $(METADATA): Makefile @echo "Destructive: no" >> $(METADATA) @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) @echo "Bug: RHEL-17346" >> $(METADATA) # RHEL-9 + @echo "Bug: RHEL-62355" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-70850" >> $(METADATA) # RHEL-10 rhts-lint $(METADATA) diff --git a/selinux-policy/iio-sensor-proxy-and-similar/PURPOSE b/selinux-policy/iio-sensor-proxy-and-similar/PURPOSE index 2577aa3..b41c372 100644 --- a/selinux-policy/iio-sensor-proxy-and-similar/PURPOSE +++ b/selinux-policy/iio-sensor-proxy-and-similar/PURPOSE @@ -3,3 +3,4 @@ Author: Milos Malik SELinux interferes with the iio-sensor-proxy service and related programs. +Known interactions: iio-sensor-proxy + gdm. diff --git a/selinux-policy/iio-sensor-proxy-and-similar/main.fmf b/selinux-policy/iio-sensor-proxy-and-similar/main.fmf index b414ed3..7a59d93 100644 --- a/selinux-policy/iio-sensor-proxy-and-similar/main.fmf +++ b/selinux-policy/iio-sensor-proxy-and-similar/main.fmf @@ -18,6 +18,7 @@ recommend: - setools-console - iio-sensor-proxy - /usr/sbin/service + - gdm environment: AVC_ERROR: +no_avc_check duration: 10m @@ -32,6 +33,8 @@ tag: - NoRHIVOS link: - verifies: https://issues.redhat.com/browse/RHEL-17346 + - verifies: https://issues.redhat.com/browse/RHEL-62355 + - verifies: https://issues.redhat.com/browse/RHEL-70850 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 diff --git a/selinux-policy/iio-sensor-proxy-and-similar/runtest.sh b/selinux-policy/iio-sensor-proxy-and-similar/runtest.sh index 5e26ab7..bf177c6 100755 --- a/selinux-policy/iio-sensor-proxy-and-similar/runtest.sh +++ b/selinux-policy/iio-sensor-proxy-and-similar/runtest.sh @@ -57,6 +57,7 @@ rlJournalStart rlServiceStop ${SERVICE_NAME} rlFileBackup /usr/lib/systemd/system/iio-sensor-proxy.service + rlServiceStart gdm rlSESetEnforce rlSEStatus @@ -64,6 +65,11 @@ rlJournalStart sleep 2 rlPhaseEnd + rlPhaseStartTest "RHEL-70850" + rlSESearchRule "allow xdm_t iiosensorproxy_t : dbus { send_msg } [ ]" + rlSESearchRule "allow iiosensorproxy_t xdm_t : dbus { send_msg } [ ]" + rlPhaseEnd + rlPhaseStartTest "real scenario -- standalone service" rlRun "sed -i 's/^.*Environment=.*$/Environment=FAKE_COMPASS=1/' /usr/lib/systemd/system/iio-sensor-proxy.service" rlRun "systemctl daemon-reload" @@ -84,6 +90,7 @@ rlJournalStart rlFileRestore rlRun "systemctl daemon-reload" rlServiceRestore ${SERVICE_NAME} + rlServiceRestore gdm rlPhaseEnd rlJournalPrintText rlJournalEnd From 0109a9a414a2708ed07c74527ade5bb08293043e Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 7 Jan 2025 13:49:52 +0100 Subject: [PATCH 433/626] test if samba-bgqd can talk to cupsd via socket Recent cups + samba + selinux-policy testing revealed SELinux denials which appear when a samba-bgqd process communicates with the cupsd process via the /run/cups/cups.sock file. The TC reproduces the situation. In order to support the use case and avoid these SELinux denials, I believe that SELinux policy should allow the necessary actions. The TC looks for appropriate policy rules and file context patterns. The TC covers RHEL-72860 and RHEL-72861. --- selinux-policy/samba-bgqd-and-similar/Makefile | 4 +++- selinux-policy/samba-bgqd-and-similar/main.fmf | 4 ++++ selinux-policy/samba-bgqd-and-similar/runtest.sh | 9 +++++++++ 3 files changed, 16 insertions(+), 1 deletion(-) diff --git a/selinux-policy/samba-bgqd-and-similar/Makefile b/selinux-policy/samba-bgqd-and-similar/Makefile index 614f246..df25be8 100644 --- a/selinux-policy/samba-bgqd-and-similar/Makefile +++ b/selinux-policy/samba-bgqd-and-similar/Makefile @@ -54,7 +54,7 @@ $(METADATA): Makefile @echo "Type: Regression" >> $(METADATA) @echo "TestTime: 15m" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console samba samba-client samba-common-tools cups" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console samba samba-client samba-common-tools cups /usr/sbin/service" >> $(METADATA) @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @@ -66,6 +66,8 @@ $(METADATA): Makefile @echo "Bug: RHEL-64908" >> $(METADATA) # RHEL-10 @echo "Bug: RHEL-69512" >> $(METADATA) # RHEL-10 @echo "Bug: RHEL-69517" >> $(METADATA) # RHEL-9 + @echo "Bug: RHEL-72860" >> $(METADATA) # RHEL-9 + @echo "Bug: RHEL-72861" >> $(METADATA) # RHEL-10 rhts-lint $(METADATA) diff --git a/selinux-policy/samba-bgqd-and-similar/main.fmf b/selinux-policy/samba-bgqd-and-similar/main.fmf index cb06aa6..ecf1d9c 100644 --- a/selinux-policy/samba-bgqd-and-similar/main.fmf +++ b/selinux-policy/samba-bgqd-and-similar/main.fmf @@ -19,6 +19,7 @@ recommend: - samba-client - samba-common-tools - cups + - /usr/sbin/service environment: AVC_ERROR: +no_avc_check duration: 15m @@ -36,9 +37,12 @@ link: - verifies: https://issues.redhat.com/browse/RHEL-64908 - verifies: https://issues.redhat.com/browse/RHEL-69512 - verifies: https://issues.redhat.com/browse/RHEL-69517 + - verifies: https://issues.redhat.com/browse/RHEL-72860 + - verifies: https://issues.redhat.com/browse/RHEL-72861 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 continue: false extra-summary: /CoreOS/selinux-policy/Regression/samba-bgqd-and-similar extra-task: /CoreOS/selinux-policy/Regression/samba-bgqd-and-similar +extra-nitrate: TC#0617974 diff --git a/selinux-policy/samba-bgqd-and-similar/runtest.sh b/selinux-policy/samba-bgqd-and-similar/runtest.sh index ea4b805..476534d 100755 --- a/selinux-policy/samba-bgqd-and-similar/runtest.sh +++ b/selinux-policy/samba-bgqd-and-similar/runtest.sh @@ -49,6 +49,7 @@ rlJournalStart rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted rlAssertRpm ${SERVICE_PACKAGE} + rlAssertRpm cups rlFileBackup /etc/shadow rlServiceStop ${SERVICE_NAME} @@ -80,9 +81,16 @@ rlJournalStart rlSESearchRule "allow samba_bgqd_t cupsd_etc_t : dir { search } [ ]" rlSESearchRule "allow samba_bgqd_t cupsd_var_run_t : dir { search } [ ]" rlPhaseEnd + + rlPhaseStartTest "RHEL-72860 + RHEL-72861" + rlSEMatchPathCon "/run/cups/cups.sock" "cupsd_var_run_t" + rlSESearchRule "allow samba_bgqd_t cupsd_var_run_t : sock_file { read write } [ ]" + rlSESearchRule "allow samba_bgqd_t cupsd_t : unix_stream_socket { connectto } [ ]" + rlPhaseEnd fi rlPhaseStartTest "real scenario" + rlRun "service cups start" USER_NAME="smbuser${RANDOM}" USER_SECRET="S3kr3T${RANDOM}" rlRun "useradd ${USER_NAME}" @@ -98,6 +106,7 @@ rlJournalStart rlRun "systemctl stop samba-bgqd" rlRun "smbpasswd -x ${USER_NAME}" rlRun "userdel -rf ${USER_NAME}" + rlRun "service cups stop" rlPhaseEnd rlPhaseStartCleanup From 774bd87aac0327ad2e95037bdaa48df1fc7fff37 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Wed, 8 Jan 2025 12:00:08 +0100 Subject: [PATCH 434/626] improve failing tests and add missing nitrate metadata 1 test was failing because of a test code issue. 1 test was missing an important test phase. The number of tests which are missing their nitrate metadata should be again smaller. --- libselinux/getpolicyload/main.fmf | 2 +- libsemanage/semanage-root-on-nfs/main.fmf | 1 + libsepol/self-keyword-in-type-rules/main.fmf | 1 + policycoreutils/semodule-rebuild-if-modules-changed/main.fmf | 1 + policycoreutils/sepolicy-generate-application/main.fmf | 1 + policycoreutils/spaces-in-fcontext-patterns/main.fmf | 1 + selinux-policy/gnome-remote-desktop-and-similar/main.fmf | 1 + selinux-policy/gnome-remote-desktop-and-similar/runtest.sh | 5 +++++ selinux-policy/rpm-suppress-stderr/main.fmf | 1 + selinux-policy/rpm-suppress-stderr/test.sh | 2 +- 10 files changed, 14 insertions(+), 2 deletions(-) diff --git a/libselinux/getpolicyload/main.fmf b/libselinux/getpolicyload/main.fmf index 9614113..627da13 100644 --- a/libselinux/getpolicyload/main.fmf +++ b/libselinux/getpolicyload/main.fmf @@ -20,4 +20,4 @@ adjust: - enabled: false when: distro < fedora-40 because: the getpolicyload program is not available there - +extra-nitrate: TC#0615981 diff --git a/libsemanage/semanage-root-on-nfs/main.fmf b/libsemanage/semanage-root-on-nfs/main.fmf index 20e219d..2cd8274 100644 --- a/libsemanage/semanage-root-on-nfs/main.fmf +++ b/libsemanage/semanage-root-on-nfs/main.fmf @@ -9,3 +9,4 @@ duration: 10m enabled: true link: - verifies: https://issues.redhat.com/browse/RHEL-60503 +extra-nitrate: TC#0617969 diff --git a/libsepol/self-keyword-in-type-rules/main.fmf b/libsepol/self-keyword-in-type-rules/main.fmf index f54e8a6..038b5d9 100644 --- a/libsepol/self-keyword-in-type-rules/main.fmf +++ b/libsepol/self-keyword-in-type-rules/main.fmf @@ -25,3 +25,4 @@ adjust: because: This feature may not be available in F36 and below link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2069718 +extra-nitrate: TC#0613928 diff --git a/policycoreutils/semodule-rebuild-if-modules-changed/main.fmf b/policycoreutils/semodule-rebuild-if-modules-changed/main.fmf index c2dc056..84f82f2 100644 --- a/policycoreutils/semodule-rebuild-if-modules-changed/main.fmf +++ b/policycoreutils/semodule-rebuild-if-modules-changed/main.fmf @@ -28,3 +28,4 @@ link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2049191 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2049193 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2173959 +extra-nitrate: TC#0613060 diff --git a/policycoreutils/sepolicy-generate-application/main.fmf b/policycoreutils/sepolicy-generate-application/main.fmf index 6c587d8..4096a38 100644 --- a/policycoreutils/sepolicy-generate-application/main.fmf +++ b/policycoreutils/sepolicy-generate-application/main.fmf @@ -11,3 +11,4 @@ recommend: - abrt tier: '3' enabled: true +extra-nitrate: TC#0615932 diff --git a/policycoreutils/spaces-in-fcontext-patterns/main.fmf b/policycoreutils/spaces-in-fcontext-patterns/main.fmf index ad152e7..04ffc0e 100644 --- a/policycoreutils/spaces-in-fcontext-patterns/main.fmf +++ b/policycoreutils/spaces-in-fcontext-patterns/main.fmf @@ -35,3 +35,4 @@ adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 continue: false +extra-nitrate: TC#0614100 diff --git a/selinux-policy/gnome-remote-desktop-and-similar/main.fmf b/selinux-policy/gnome-remote-desktop-and-similar/main.fmf index 79bbc59..07f2c6d 100644 --- a/selinux-policy/gnome-remote-desktop-and-similar/main.fmf +++ b/selinux-policy/gnome-remote-desktop-and-similar/main.fmf @@ -39,3 +39,4 @@ adjust: continue: false extra-summary: /CoreOS/selinux-policy/Regression/gnome-remote-desktop-and-similar extra-task: /CoreOS/selinux-policy/Regression/gnome-remote-desktop-and-similar +extra-nitrate: TC#0617929 diff --git a/selinux-policy/gnome-remote-desktop-and-similar/runtest.sh b/selinux-policy/gnome-remote-desktop-and-similar/runtest.sh index 9763687..6f3fcdf 100755 --- a/selinux-policy/gnome-remote-desktop-and-similar/runtest.sh +++ b/selinux-policy/gnome-remote-desktop-and-similar/runtest.sh @@ -66,6 +66,11 @@ rlJournalStart rlPhaseEnd fi + rlPhaseStartTest "RHEL-35877" + rlSESearchRule "allow gnome_remote_desktop_t policykit_t : dbus { send_msg } [ ]" + rlSESearchRule "allow policykit_t gnome_remote_desktop_t : dbus { send_msg } [ ]" + rlPhaseEnd + if [ -f /usr/lib/systemd/system/gnome-remote-desktop.service ] ; then rlPhaseStartTest "real scenario" rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 diff --git a/selinux-policy/rpm-suppress-stderr/main.fmf b/selinux-policy/rpm-suppress-stderr/main.fmf index 9ea92b7..cdf1174 100644 --- a/selinux-policy/rpm-suppress-stderr/main.fmf +++ b/selinux-policy/rpm-suppress-stderr/main.fmf @@ -15,3 +15,4 @@ adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 continue: false +extra-nitrate: TC#0617968 diff --git a/selinux-policy/rpm-suppress-stderr/test.sh b/selinux-policy/rpm-suppress-stderr/test.sh index f7432da..9325a66 100755 --- a/selinux-policy/rpm-suppress-stderr/test.sh +++ b/selinux-policy/rpm-suppress-stderr/test.sh @@ -43,7 +43,7 @@ rlJournalStart rlRun "fuse-overlayfs -o lowerdir=$tmp/lower/ -o upperdir=$tmp/upper/ -o workdir=$tmp/work/ $tmp/merged/" RPMS=$(ls $tmp/merged/ | grep .rpm | xargs) rlRun "chroot $tmp/merged/ /usr/bin/rpm -i $RPMS 2> error.log" - rlAssert0 "error.log should be empty" "test -s error.log" + rlAssert0 "error.log should be empty" `stat -c "%s" error.log` rlRun "cat error.log" rlRun "fusermount -u $tmp/merged/" rlPhaseEnd From 6be8a931475a48f812155fcc1f1932e8ec71db18 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Thu, 16 Jan 2025 11:20:46 +0100 Subject: [PATCH 435/626] update the failing tests with the latest findings Several automated tests had to be updated to reflect the latest findings (new bugs, new rules because of denials) from testing on various machines. These tests also need to work in environments where the tested services or their policies are not yet present. Test phases relevancy is important. --- .../runtest.sh | 2 +- .../iio-sensor-proxy-and-similar/runtest.sh | 8 +++++- .../runtest.sh | 9 ++++++ .../samba-bgqd-and-similar/runtest.sh | 2 ++ .../switcheroo-control-and-similar/runtest.sh | 28 +++++++++++++++++-- .../systemd-journal-upload/Makefile | 3 +- .../systemd-journal-upload/main.fmf | 1 + .../systemd-journal-upload/runtest.sh | 6 +++- 8 files changed, 53 insertions(+), 6 deletions(-) diff --git a/selinux-policy/gnome-remote-desktop-and-similar/runtest.sh b/selinux-policy/gnome-remote-desktop-and-similar/runtest.sh index 6f3fcdf..9c72937 100755 --- a/selinux-policy/gnome-remote-desktop-and-similar/runtest.sh +++ b/selinux-policy/gnome-remote-desktop-and-similar/runtest.sh @@ -64,12 +64,12 @@ rlJournalStart rlSEMatchPathCon "/etc/gnome-remote-desktop" "etc_t" rlSESearchRule "allow gnome_remote_desktop_t etc_t : dir { watch } [ ]" rlPhaseEnd - fi rlPhaseStartTest "RHEL-35877" rlSESearchRule "allow gnome_remote_desktop_t policykit_t : dbus { send_msg } [ ]" rlSESearchRule "allow policykit_t gnome_remote_desktop_t : dbus { send_msg } [ ]" rlPhaseEnd + fi if [ -f /usr/lib/systemd/system/gnome-remote-desktop.service ] ; then rlPhaseStartTest "real scenario" diff --git a/selinux-policy/iio-sensor-proxy-and-similar/runtest.sh b/selinux-policy/iio-sensor-proxy-and-similar/runtest.sh index bf177c6..041e959 100755 --- a/selinux-policy/iio-sensor-proxy-and-similar/runtest.sh +++ b/selinux-policy/iio-sensor-proxy-and-similar/runtest.sh @@ -65,11 +65,16 @@ rlJournalStart sleep 2 rlPhaseEnd - rlPhaseStartTest "RHEL-70850" + if seinfo -t | grep -q iiosensorproxy ; then + rlPhaseStartTest "RHEL-17346 + RHEL-62355 + RHEL-70850" + rlSEMatchPathCon ${FILE_PATH} ${FILE_CONTEXT} rlSESearchRule "allow xdm_t iiosensorproxy_t : dbus { send_msg } [ ]" rlSESearchRule "allow iiosensorproxy_t xdm_t : dbus { send_msg } [ ]" + rlSESearchRule "allow iiosensorproxy_t iiosensorproxy_t : capability2 { bpf } [ ]" rlPhaseEnd + fi + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" rlRun "sed -i 's/^.*Environment=.*$/Environment=FAKE_COMPASS=1/' /usr/lib/systemd/system/iio-sensor-proxy.service" rlRun "systemctl daemon-reload" @@ -82,6 +87,7 @@ rlJournalStart rlWatchdog "monitor-sensor --all" 10 rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "stop status" 1 rlPhaseEnd + fi rlPhaseStartCleanup sleep 2 diff --git a/selinux-policy/power-profiles-daemon-and-similar/runtest.sh b/selinux-policy/power-profiles-daemon-and-similar/runtest.sh index 72e5ea4..ee54652 100755 --- a/selinux-policy/power-profiles-daemon-and-similar/runtest.sh +++ b/selinux-policy/power-profiles-daemon-and-similar/runtest.sh @@ -63,6 +63,14 @@ rlJournalStart sleep 2 rlPhaseEnd + if rlIsRHEL 9 || rlIsCentOS 9 ; then + rlPhaseStartTest "RHEL-61117" + rlSEMatchPathCon ${FILE_PATH} ${FILE_CONTEXT} + rlSESearchRule "allow powerprofiles_t powerprofiles_t : capability2 { bpf } [ ]" + rlPhaseEnd + fi + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 rlRun "powerprofilesctl list" @@ -75,6 +83,7 @@ rlJournalStart rlRun "powerprofilesctl launch echo" 0,1 rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "stop status" 1 rlPhaseEnd + fi rlPhaseStartCleanup sleep 2 diff --git a/selinux-policy/samba-bgqd-and-similar/runtest.sh b/selinux-policy/samba-bgqd-and-similar/runtest.sh index 476534d..df5195b 100755 --- a/selinux-policy/samba-bgqd-and-similar/runtest.sh +++ b/selinux-policy/samba-bgqd-and-similar/runtest.sh @@ -89,6 +89,7 @@ rlJournalStart rlPhaseEnd fi + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario" rlRun "service cups start" USER_NAME="smbuser${RANDOM}" @@ -108,6 +109,7 @@ rlJournalStart rlRun "userdel -rf ${USER_NAME}" rlRun "service cups stop" rlPhaseEnd + fi rlPhaseStartCleanup sleep 2 diff --git a/selinux-policy/switcheroo-control-and-similar/runtest.sh b/selinux-policy/switcheroo-control-and-similar/runtest.sh index c1d2100..243d0ee 100755 --- a/selinux-policy/switcheroo-control-and-similar/runtest.sh +++ b/selinux-policy/switcheroo-control-and-similar/runtest.sh @@ -35,8 +35,8 @@ SERVICE_PACKAGE="switcheroo-control" SERVICE_NAME="switcheroo-control" PROCESS_NAME="switcheroo-control" if seinfo -t | grep -q switcheroo ; then - PROCESS_CONTEXT="switcheroo_t" - FILE_CONTEXT="switcheroo_exec_t" + PROCESS_CONTEXT="switcheroo_control_t" + FILE_CONTEXT="switcheroo_control_exec_t" else PROCESS_CONTEXT="unconfined_service_t" FILE_CONTEXT="bin_t" @@ -58,6 +58,29 @@ rlJournalStart sleep 2 rlPhaseEnd + if seinfo -t | grep -q switcheroo ; then + rlPhaseStartTest "RHEL-24268" + rlSEMatchPathCon ${FILE_PATH} ${FILE_CONTEXT} + rlSEMatchPathCon "/run/udev/" "udev_var_run_t" + rlSEMatchPathCon "/run/dbus/" "system_dbusd_var_run_t" + rlSEMatchPathCon "/run/dbus/system_bus_socket" "system_dbusd_var_run_t" + rlSESearchRule "allow switcheroo_control_t udev_var_run_t : dir { search } [ ]" + rlSESearchRule "allow switcheroo_control_t switcheroo_control_t : netlink_kobject_uevent_socket { create setopt bind getattr } [ ]" + rlSESearchRule "allow switcheroo_control_t switcheroo_control_t : capability2 { bpf } [ ]" + rlSESearchRule "allow switcheroo_control_t sysfs_t : dir { read } [ ]" + rlSESearchRule "allow switcheroo_control_t sysfs_t : lnk_file { getattr read } [ ]" + rlSESearchRule "allow switcheroo_control_t sysfs_t : file { getattr open read } [ ]" + rlSESearchRule "allow switcheroo_control_t system_dbusd_t : unix_stream_socket { connectto } [ ]" + rlSESearchRule "allow switcheroo_control_t system_dbusd_var_run_t : sock_file { write } [ ]" + rlSESearchRule "allow switcheroo_control_t system_dbusd_var_run_t : dir { search } [ ]" + rlSESearchRule "allow switcheroo_control_t system_dbusd_t : dbus { acquire_svc send_msg } [ ]" + rlSESearchRule "allow system_dbusd_t switcheroo_control_t : dbus { send_msg } [ ]" + rlSESearchRule "allow unconfined_t switcheroo_control_t : dbus { send_msg } [ ]" + rlSESearchRule "allow switcheroo_control_t unconfined_t : dbus { send_msg } [ ]" + rlPhaseEnd + fi + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 rlRun "switcherooctl version" @@ -69,6 +92,7 @@ rlJournalStart rlRun "rm -f ./empty-file" rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "stop status" 1 rlPhaseEnd + fi rlPhaseStartCleanup sleep 2 diff --git a/selinux-policy/systemd-journal-upload/Makefile b/selinux-policy/systemd-journal-upload/Makefile index 71c64ef..2ede7ea 100644 --- a/selinux-policy/systemd-journal-upload/Makefile +++ b/selinux-policy/systemd-journal-upload/Makefile @@ -63,7 +63,8 @@ $(METADATA): Makefile @echo "Destructive: no" >> $(METADATA) @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) - @echo "Bug: RHEL-57774" >> $(METADATA) # RHEL-9 + @echo "Bug: RHEL-57774" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-62196" >> $(METADATA) # RHEL-9 rhts-lint $(METADATA) diff --git a/selinux-policy/systemd-journal-upload/main.fmf b/selinux-policy/systemd-journal-upload/main.fmf index 2771cd6..a134969 100644 --- a/selinux-policy/systemd-journal-upload/main.fmf +++ b/selinux-policy/systemd-journal-upload/main.fmf @@ -29,6 +29,7 @@ tag: - NoRHIVOS link: - verifies: https://issues.redhat.com/browse/RHEL-57774 + - verifies: https://issues.redhat.com/browse/RHEL-62196 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 diff --git a/selinux-policy/systemd-journal-upload/runtest.sh b/selinux-policy/systemd-journal-upload/runtest.sh index 4c1a71f..09a627e 100755 --- a/selinux-policy/systemd-journal-upload/runtest.sh +++ b/selinux-policy/systemd-journal-upload/runtest.sh @@ -23,12 +23,15 @@ rlJournalStart sleep 2 rlPhaseEnd - rlPhaseStartTest "RHEL-57774" + if seinfo -t | grep -q ${PROCESS_CONTEXT} ; then + rlPhaseStartTest "RHEL-57774 + RHEL-62196" rlSEMatchPathCon "/usr/lib/systemd/systemd-journal-upload" "systemd_journal_upload_exec_t" rlSEMatchPathCon "/run/systemd/journal-upload.conf.d" "systemd_conf_t" rlSESearchRule "allow systemd_journal_upload_t systemd_conf_t : dir { read } [ ]" rlPhaseEnd + fi + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- RHEL-57774" rlRun "mkdir -pZ /run/systemd/journal-upload.conf.d" rlRun "echo -e '[Upload]\nURL=http://localhost/\n' > /run/systemd/journal-upload.conf.d/test.conf" @@ -37,6 +40,7 @@ rlJournalStart rlRun "restorecon -Rv /etc /var /run -e /var/ARTIFACTS" 0-255 rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "stop status" 1 rlPhaseEnd + fi rlPhaseStartCleanup sleep 2 From 8cbf323d54e16296d5c82230ea5b4272152928e0 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Wed, 15 Jan 2025 20:53:28 +0100 Subject: [PATCH 436/626] test if policy installation in container works as expected A recent podman + selinux-policy testing revealed too many "Operation not supported" messages in a scenario which tries to install selinux-policy packages inside a container. The TC reproduces the situation. In order to fix the problem, changes were made in both components: libsemanage and selinux-policy. Purpose of the TC is to find out if such error messages still appear or not. The TC covers RHEL-70632. --- .../cross-device-link-in-containers/Makefile | 1 + .../cross-device-link-in-containers/main.fmf | 1 + .../cross-device-link-in-containers/runtest.sh | 13 ++++++++++++- 3 files changed, 14 insertions(+), 1 deletion(-) diff --git a/libsemanage/cross-device-link-in-containers/Makefile b/libsemanage/cross-device-link-in-containers/Makefile index cc5b0cd..d9930e4 100644 --- a/libsemanage/cross-device-link-in-containers/Makefile +++ b/libsemanage/cross-device-link-in-containers/Makefile @@ -59,6 +59,7 @@ $(METADATA): Makefile @echo "Destructive: no" >> $(METADATA) @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) @echo "Bug: 2068085" >> $(METADATA) # RHEL-9 + @echo "Bug: RHEL-70632" >> $(METADATA) # RHEL-10 rhts-lint $(METADATA) diff --git a/libsemanage/cross-device-link-in-containers/main.fmf b/libsemanage/cross-device-link-in-containers/main.fmf index 72ddbf7..90f0fe4 100644 --- a/libsemanage/cross-device-link-in-containers/main.fmf +++ b/libsemanage/cross-device-link-in-containers/main.fmf @@ -21,6 +21,7 @@ tag: - targeted link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2068085 + - verifies: https://issues.redhat.com/browse/RHEL-70632 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 diff --git a/libsemanage/cross-device-link-in-containers/runtest.sh b/libsemanage/cross-device-link-in-containers/runtest.sh index 782bbc2..bcf74b5 100755 --- a/libsemanage/cross-device-link-in-containers/runtest.sh +++ b/libsemanage/cross-device-link-in-containers/runtest.sh @@ -41,14 +41,24 @@ rlJournalStart rlPhaseStartTest "bz#2068085" rlRun "pushd selinux1" + if rlIsCentOS 8 || rlIsRHEL 8 ; then + STREAM_ID="centos/centos:stream8" + elif rlIsCentOS 9 || rlIsRHEL 9 ; then + STREAM_ID="centos/centos:stream9" + elif rlIsCentOS 10 || rlIsRHEL 10 ; then + STREAM_ID="centos/centos:stream10" + else + STREAM_ID="fedora/fedora:rawhide" + fi cat <> ./Dockerfile -FROM quay.io/centos/centos:stream9 +FROM quay.io/${STREAM_ID} RUN dnf install -y selinux-policy selinux-policy-targeted EOF rlRun "cat ./Dockerfile" rlRun -s "podman build -t localhost/selinux . --no-cache" rlAssertGrep "^complete" $rlRun_LOG -i rlAssertGrep "^commit" $rlRun_LOG -i + rlAssertNotGrep "not supported" $rlRun_LOG -i rlRun "popd" rlRun "pushd selinux2" @@ -60,6 +70,7 @@ EOF rlRun -s "podman build -t localhost/selinux2 . --no-cache" rlAssertNotGrep "error" $rlRun_LOG -i rlAssertNotGrep "failed" $rlRun_LOG -i + rlAssertNotGrep "not supported" $rlRun_LOG -i rlRun "popd" rlPhaseEnd From 1b8d7bd95f48a4120ba7aacaf90afd58d33756d3 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Thu, 16 Jan 2025 17:43:31 +0100 Subject: [PATCH 437/626] test if systemd-machined can open+ioctl /dev/vsock Recent systemd-machined + selinux-policy testing revealed that SELinux prevents the systemd-machined processes from accessing the /dev/vsock device. The TC reproduces the situation. In order to support the expected systemd-machined functionality, I believe that SELinux policy should allow this access. The TC looks for appropriate policy rules and file context patterns. The TC covers RHEL-74280. --- selinux-policy/systemd-machined-and-similar/Makefile | 1 + selinux-policy/systemd-machined-and-similar/main.fmf | 1 + selinux-policy/systemd-machined-and-similar/runtest.sh | 7 +++++++ 3 files changed, 9 insertions(+) diff --git a/selinux-policy/systemd-machined-and-similar/Makefile b/selinux-policy/systemd-machined-and-similar/Makefile index cb3f07b..d34d9a0 100644 --- a/selinux-policy/systemd-machined-and-similar/Makefile +++ b/selinux-policy/systemd-machined-and-similar/Makefile @@ -67,6 +67,7 @@ $(METADATA): Makefile @echo "Bug: 1900869" >> $(METADATA) # Fedora 33 @echo "Bug: 1900888" >> $(METADATA) # Fedora 35 @echo "Bug: RHEL-49567" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-74280" >> $(METADATA) # RHEL-10 rhts-lint $(METADATA) diff --git a/selinux-policy/systemd-machined-and-similar/main.fmf b/selinux-policy/systemd-machined-and-similar/main.fmf index 617fc5e..4dc0eb6 100644 --- a/selinux-policy/systemd-machined-and-similar/main.fmf +++ b/selinux-policy/systemd-machined-and-similar/main.fmf @@ -35,6 +35,7 @@ link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1900869 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1900888 - verifies: https://issues.redhat.com/browse/RHEL-49567 + - verifies: https://issues.redhat.com/browse/RHEL-74280 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7 diff --git a/selinux-policy/systemd-machined-and-similar/runtest.sh b/selinux-policy/systemd-machined-and-similar/runtest.sh index 422908e..61fade7 100755 --- a/selinux-policy/systemd-machined-and-similar/runtest.sh +++ b/selinux-policy/systemd-machined-and-similar/runtest.sh @@ -104,6 +104,13 @@ rlJournalStart rlRun "machinectl" rlPhaseEnd + if rlIsRHEL 10 || rlIsCentOS 10 ; then + rlPhaseStartTest "RHEL-74280" + rlSEMatchPathCon "/dev/vsock" "vsock_device_t" + rlSESearchRule "allow systemd_machined_t vsock_device_t : chr_file { getattr open read ioctl } [ ]" + rlPhaseEnd + fi + rlPhaseStartTest "real scenario -- standalone service" if ! rlSEDefined ${PROCESS_CONTEXT} ; then PROCESS_CONTEXT="unconfined_service_t" From 559446d5439a01585647c57fe0d994dd1c8422f7 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Thu, 16 Jan 2025 20:10:25 +0100 Subject: [PATCH 438/626] test if sysadm_u or staff_u can talk to libvirt-dbus A recent cockpit-machines testing in SELinux enabled environments revealed that SELinux prevents certain confined users from communicating to the libvirt-dbus service. The TC reproduces the situation for users derived from sysadm_u and staff_u. In order to support the scenario, I believe that SELinux policy should allow the D-bus communication in both directions. The TC looks for appropriate policy rules and file context patterns. The TC covers RHEL-73914. --- .../libvirt-dbus-and-similar/Makefile | 3 ++- .../libvirt-dbus-and-similar/main.fmf | 1 + .../libvirt-dbus-and-similar/runtest.sh | 25 +++++++++++++++++++ .../libvirt-dbus-and-similar/ssh.exp | 20 +++++++++++++++ 4 files changed, 48 insertions(+), 1 deletion(-) create mode 100755 selinux-policy/libvirt-dbus-and-similar/ssh.exp diff --git a/selinux-policy/libvirt-dbus-and-similar/Makefile b/selinux-policy/libvirt-dbus-and-similar/Makefile index 6ad5719..127fc47 100644 --- a/selinux-policy/libvirt-dbus-and-similar/Makefile +++ b/selinux-policy/libvirt-dbus-and-similar/Makefile @@ -29,7 +29,7 @@ export TESTVERSION=1.0 BUILT_FILES= -FILES=$(METADATA) runtest.sh Makefile PURPOSE +FILES=$(METADATA) runtest.sh Makefile PURPOSE ssh.exp .PHONY: all install download clean @@ -64,6 +64,7 @@ $(METADATA): Makefile @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) @echo "Bug: RHEL-46893" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-73914" >> $(METADATA) # RHEL-10 rhts-lint $(METADATA) diff --git a/selinux-policy/libvirt-dbus-and-similar/main.fmf b/selinux-policy/libvirt-dbus-and-similar/main.fmf index a03ec19..9115a73 100644 --- a/selinux-policy/libvirt-dbus-and-similar/main.fmf +++ b/selinux-policy/libvirt-dbus-and-similar/main.fmf @@ -30,6 +30,7 @@ tag: - NoRHIVOS link: - verifies: https://issues.redhat.com/browse/RHEL-46893 + - verifies: https://issues.redhat.com/browse/RHEL-73914 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 diff --git a/selinux-policy/libvirt-dbus-and-similar/runtest.sh b/selinux-policy/libvirt-dbus-and-similar/runtest.sh index bf886b1..03aff21 100755 --- a/selinux-policy/libvirt-dbus-and-similar/runtest.sh +++ b/selinux-policy/libvirt-dbus-and-similar/runtest.sh @@ -67,13 +67,38 @@ rlJournalStart rlSESearchRule "allow virtqemud_t virt_dbus_t : dir { search } [ ]" rlSESearchRule "allow virtqemud_t virt_dbus_t : file { getattr open read } [ ]" rlPhaseEnd + + rlPhaseStartTest "RHEL-73914" + rlSESearchRule "allow staff_t virt_dbus_t : dbus { send_msg } [ ]" + rlSESearchRule "allow virt_dbus_t staff_t : dbus { send_msg } [ ]" + rlSESearchRule "allow sysadm_t virt_dbus_t : dbus { send_msg } [ ]" + rlSESearchRule "allow virt_dbus_t sysadm_t : dbus { send_msg } [ ]" + rlPhaseEnd fi + rlPhaseStartTest "real scenario -- confined users" + rlRun "service virtqemud start" + rlSEConfigureSSH + rlRun "setsebool ssh_sysadm_login on" + for SELINUX_USER in staff_u sysadm_u ; do + USER_NAME="user${RANDOM}" + USER_SECRET="S3kr3t${RANDOM}" + rlRun "useradd -Z ${SELINUX_USER} -G libvirt ${USER_NAME}" + rlRun "echo ${USER_SECRET} | passwd --stdin ${USER_NAME}" + rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost busctl call org.libvirt /org/libvirt/QEMU org.libvirt.Connect ListDomains u 0" + rlRun "userdel -rfZ ${USER_NAME}" + done + rlRun "setsebool ssh_sysadm_login off" + rlRun "service virtqemud stop" + rlPhaseEnd + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 rlRun "restorecon -Rv /var /run -e /var/ARTIFACTS" 0-255 rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd + fi rlPhaseStartTest "real scenario -- communication with other virt* services" for VIRT_SERVICE in virtinterfaced virtlxcd virtnetworkd virtnodedevd virtnwfilterd virtproxyd virtqemud virtsecretd virtstoraged virtvboxd ; do diff --git a/selinux-policy/libvirt-dbus-and-similar/ssh.exp b/selinux-policy/libvirt-dbus-and-similar/ssh.exp new file mode 100755 index 0000000..58c9647 --- /dev/null +++ b/selinux-policy/libvirt-dbus-and-similar/ssh.exp @@ -0,0 +1,20 @@ +#!/usr/bin/expect -f +# Expect script for SSH logging as $username to $hostname using $password and executing $command. +# Usage: +# ./ssh.exp username password hostname command +set username [lrange $argv 0 0] +set password [lrange $argv 1 1] +set hostname [lrange $argv 2 2] +set command [lrange $argv 3 10] +set timeout 15 +# connect to remote host and execute given command +log_user 1 +spawn ssh -t $username@$hostname $command +expect { + -nocase "yes/no" { send -- "yes\r" ; exp_continue } + -nocase "password" { send -- "$password\r" } +} +log_user 1 +# send -- "\r" +expect eof + From 512ac533f6d3b255359448fcd3a763683a60865c Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Wed, 22 Jan 2025 12:20:11 +0100 Subject: [PATCH 439/626] sestatus has been moved to /usr/bin on modern systems https://fedoraproject.org/wiki/Changes/Unify_bin_and_sbin Fixes: [ FAIL ] :: Command 'rpm -ql policycoreutils | grep /usr/sbin/sestatus' (Expected 0, got 1) --- policycoreutils/sestatus/runtest.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/policycoreutils/sestatus/runtest.sh b/policycoreutils/sestatus/runtest.sh index c8c73d2..ebc56b2 100755 --- a/policycoreutils/sestatus/runtest.sh +++ b/policycoreutils/sestatus/runtest.sh @@ -94,7 +94,7 @@ rlJournalStart # This bug is not worth fixing in RHEL-5 if ! rlIsRHEL 5 ; then rlPhaseStartTest - rlRun "rpm -ql ${PACKAGE} | grep /usr/sbin/sestatus" + rlRun "rpm -ql ${PACKAGE} | grep -E '/usr/s?bin/sestatus'" rlRun "rpm -ql ${PACKAGE} | grep /usr/share/man/man8/sestatus.8" for OPTION in b v ; do rlRun "sestatus --help 2>&1 | grep -- -${OPTION}" From c225414cf39df742f1aa4069c20a69575c48c782 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Mon, 27 Jan 2025 20:08:29 +0100 Subject: [PATCH 440/626] Update a file context and relabel Verifies: https://issues.redhat.com/browse/RHEL-73348 --- .../main.fmf | 9 ++++++ .../test.sh | 28 +++++++++++++++++++ .../update_context.py | 21 ++++++++++++++ 3 files changed, 58 insertions(+) create mode 100644 libsemanage/semanage_setfiles-selinux_restorecon/main.fmf create mode 100755 libsemanage/semanage_setfiles-selinux_restorecon/test.sh create mode 100755 libsemanage/semanage_setfiles-selinux_restorecon/update_context.py diff --git a/libsemanage/semanage_setfiles-selinux_restorecon/main.fmf b/libsemanage/semanage_setfiles-selinux_restorecon/main.fmf new file mode 100644 index 0000000..9ed4f56 --- /dev/null +++ b/libsemanage/semanage_setfiles-selinux_restorecon/main.fmf @@ -0,0 +1,9 @@ +summary: Update a file context and relabel +test: ./test.sh +framework: beakerlib +require: + - python3-policycoreutils + - policycoreutils-python-utils + - python3-libsemanage +link: + - verifies: https://issues.redhat.com/browse/RHEL-73348 diff --git a/libsemanage/semanage_setfiles-selinux_restorecon/test.sh b/libsemanage/semanage_setfiles-selinux_restorecon/test.sh new file mode 100755 index 0000000..788c938 --- /dev/null +++ b/libsemanage/semanage_setfiles-selinux_restorecon/test.sh @@ -0,0 +1,28 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +rlJournalStart + rlPhaseStartSetup + rlRun "tmp=\$(mktemp -d)" 0 "Create tmp directory" + rlRun "set -o pipefail" + rlPhaseEnd + + rlPhaseStartTest + rlRun "mkdir -p $tmp/test/subtest | cut -d ' ' -f 1" + rlRun "ls -Zd $tmp/test $tmp/test/subtest | cut -d ' ' -f 1" + + rlRun "python3 update_context.py $tmp/test pki_tomcat_etc_rw_t" + LABEL=system_u:object_r:pki_tomcat_etc_rw_t:s0 + LABEL_TEST=$(ls -Zd $tmp/test | cut -d ' ' -f 1) + LABEL_SUBTEST=$(ls -Zd $tmp/test/subtest | cut -d ' ' -f 1) + rlRun "ls -Zd $tmp/test $tmp/test/subtest" + rlAssertEquals "Is $tmp/test $LABEL?" "$LABEL_TEST" "$LABEL" + rlAssertEquals "Is $tmp/test/subtest $LABEL?" "$LABEL_SUBTEST" "$LABEL" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "semanage fcontext -D" + rlRun "rm -r $tmp" 0 "Remove tmp directory" + rlPhaseEnd +rlJournalEnd diff --git a/libsemanage/semanage_setfiles-selinux_restorecon/update_context.py b/libsemanage/semanage_setfiles-selinux_restorecon/update_context.py new file mode 100755 index 0000000..6d2538a --- /dev/null +++ b/libsemanage/semanage_setfiles-selinux_restorecon/update_context.py @@ -0,0 +1,21 @@ +#!/usr/bin/env python3 + +import sys +import selinux +import seobject + +def update_context(file_dir, new_context): + suffix = '(/.*)?' + trans = seobject.semanageRecords('targeted') + trans.start() + + fcon = seobject.fcontextRecords(trans) + fcon.add( + file_dir + suffix, + new_context, '', 's0', '') + trans.finish() + selinux.restorecon(file_dir, True, True, True) + + +if __name__ == "__main__": + update_context(sys.argv[1], sys.argv[2]) From 6292a9158b259e75e64a04fbc9374fcc70af78f8 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Wed, 22 Jan 2025 13:09:54 +0100 Subject: [PATCH 441/626] test if virtqemud can access USB devices attached to VMs Recent virtualization + SELinux policy testing revealed that SELinux prevents the virtqemud process from accessing the USB devices which are attached to VMs. The TC reproduces the situation. In order to support this use case and to avoid unnecessary SELinux denials, I believe that SELinux policy should allow the access. The TC looks for appropriate policy rules and file context patterns. The TC covers RHEL-74230. --- .../virt-install-additional/Makefile | 3 +- .../virt-install-additional/main.fmf | 2 ++ .../virt-install-additional/runtest.sh | 33 +++++++++++++++++++ 3 files changed, 37 insertions(+), 1 deletion(-) diff --git a/selinux-policy/virt-install-additional/Makefile b/selinux-policy/virt-install-additional/Makefile index bc05e84..6f8f1a6 100644 --- a/selinux-policy/virt-install-additional/Makefile +++ b/selinux-policy/virt-install-additional/Makefile @@ -54,7 +54,7 @@ $(METADATA): Makefile @echo "Type: Regression" >> $(METADATA) @echo "TestTime: 20m" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted /usr/sbin/service setools-console virt-install libvirt-client numad nbdkit" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted /usr/sbin/service setools-console virt-install libvirt-client numad nbdkit usbutils" >> $(METADATA) @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @@ -70,6 +70,7 @@ $(METADATA): Makefile @echo "Bug: RHEL-65789" >> $(METADATA) # RHEL-10 @echo "Bug: RHEL-69118" >> $(METADATA) # RHEL-10 @echo "Bug: RHEL-69920" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-74230" >> $(METADATA) # RHEL-10 rhts-lint $(METADATA) diff --git a/selinux-policy/virt-install-additional/main.fmf b/selinux-policy/virt-install-additional/main.fmf index 07b77d2..faabe1f 100644 --- a/selinux-policy/virt-install-additional/main.fmf +++ b/selinux-policy/virt-install-additional/main.fmf @@ -22,6 +22,7 @@ recommend: - libvirt-client - numad - nbdkit + - usbutils environment: AVC_ERROR: +no_avc_check duration: 20m @@ -42,6 +43,7 @@ link: - verifies: https://issues.redhat.com/browse/RHEL-65789 - verifies: https://issues.redhat.com/browse/RHEL-69118 - verifies: https://issues.redhat.com/browse/RHEL-69920 + - verifies: https://issues.redhat.com/browse/RHEL-74230 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 diff --git a/selinux-policy/virt-install-additional/runtest.sh b/selinux-policy/virt-install-additional/runtest.sh index f903568..3e087ce 100755 --- a/selinux-policy/virt-install-additional/runtest.sh +++ b/selinux-policy/virt-install-additional/runtest.sh @@ -207,6 +207,39 @@ rlJournalStart fi rlPhaseEnd + rlPhaseStartTest "RHEL-74230" + rlSEMatchPathCon "/dev/bus/usb/001/001" "usb_device_t" + if seinfo -a | grep -q virt_driver_domain ; then + rlSESearchRule "allow virtqemud_t usb_device_t : chr_file { getattr open read write lock setattr } [ ]" + fi + if rlIsRHEL 8 ; then + rlRun "service libvirtd start" + fi + rlRun "service virtqemud start" + rlRun "service virtnetworkd start" + rlRun "service virtstoraged start" + rlRun "service virtnodedevd start" + rlRun "lsusb -t" + # USB devices may not be available + rlRun "virsh nodedev-list | grep usb" 0,1 + for USB_ID in `virsh nodedev-list | grep usb` ; do + rlRun "virt-install --memory 128 --pxe --virt-type qemu --os-variant alpinelinux3.8 --wait 0 --name test-${USB_ID} --host-device ${USB_ID}" + done + sleep 10 + rlRun "virsh list" + for VM_NAME in `virsh list --name` ; do + rlRun "virsh destroy ${VM_NAME}" + rlRun "virsh undefine ${VM_NAME}" + done + rlRun "service virtnodedevd stop" + rlRun "service virtstoraged stop" + rlRun "service virtnetworkd stop" + rlRun "service virtqemud stop" + if rlIsRHEL 8 ; then + rlRun "service libvirtd stop" + fi + rlPhaseEnd + rlPhaseStartCleanup sleep 2 rlSECheckAVC From ed1316d819145d762db92df4c66aaf36d6b775bf Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Mon, 20 Jan 2025 17:42:52 +0100 Subject: [PATCH 442/626] test if boothd can connect to systemd-machined via socket Recent selinux-policy + boothd + systemd-machined testing revealed that SELinux prevents the boothd process from connecting to the systemd-machined process via the /run/systemd/userdb/io.systemd.Machine socket. The TC reproduces the situation. In order to support the boothd and systemd-machined cooperation and to avoid unnecessary SELinux denials, I believe that SELinux policy should allow the access. The TC looks for appropriate policy rules and file context patterns. The TC covers RHEL-75471. --- selinux-policy/boothd-and-similar/Makefile | 3 ++- selinux-policy/boothd-and-similar/main.fmf | 2 ++ selinux-policy/boothd-and-similar/runtest.sh | 8 ++++++++ 3 files changed, 12 insertions(+), 1 deletion(-) diff --git a/selinux-policy/boothd-and-similar/Makefile b/selinux-policy/boothd-and-similar/Makefile index d78cc89..6e66c75 100644 --- a/selinux-policy/boothd-and-similar/Makefile +++ b/selinux-policy/boothd-and-similar/Makefile @@ -55,7 +55,7 @@ $(METADATA): Makefile @echo "TestTime: 10m" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) @echo "RunFor: booth" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console booth-arbitrator booth-core /usr/sbin/service net-tools" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console booth-arbitrator booth-core /usr/sbin/service net-tools systemd-container" >> $(METADATA) @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @@ -66,6 +66,7 @@ $(METADATA): Makefile @echo "Bug: RHEL-45907" >> $(METADATA) # RHEL-10 @echo "Bug: RHEL-57104" >> $(METADATA) # RHEL-9 @echo "Bug: RHEL-58060" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-75471" >> $(METADATA) # RHEL-10 rhts-lint $(METADATA) diff --git a/selinux-policy/boothd-and-similar/main.fmf b/selinux-policy/boothd-and-similar/main.fmf index 0881602..5539ab8 100644 --- a/selinux-policy/boothd-and-similar/main.fmf +++ b/selinux-policy/boothd-and-similar/main.fmf @@ -19,6 +19,7 @@ recommend: - booth-core - /usr/sbin/service - net-tools + - systemd-container environment: AVC_ERROR: +no_avc_check duration: 10m @@ -34,6 +35,7 @@ link: - verifies: https://issues.redhat.com/browse/RHEL-45907 - verifies: https://issues.redhat.com/browse/RHEL-57104 - verifies: https://issues.redhat.com/browse/RHEL-58060 + - verifies: https://issues.redhat.com/browse/RHEL-75471 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 diff --git a/selinux-policy/boothd-and-similar/runtest.sh b/selinux-policy/boothd-and-similar/runtest.sh index 27231d6..6c355b3 100755 --- a/selinux-policy/boothd-and-similar/runtest.sh +++ b/selinux-policy/boothd-and-similar/runtest.sh @@ -52,6 +52,7 @@ rlJournalStart rlServiceStop ${SERVICE_NAME} rlFileBackup /etc/booth/booth.conf + rlRun "service systemd-machined start" rlSESetEnforce rlSEStatus @@ -71,6 +72,10 @@ rlJournalStart rlPhaseStartTest "RHEL-57104 + RHEL-58060" rlSESearchRule "allow boothd_t kernel_t : unix_stream_socket { connectto } [ ]" rlPhaseEnd + + rlPhaseStartTest "RHEL-75471" + rlSESearchRule "allow boothd_t systemd_machined_t : unix_stream_socket { connectto } [ ]" + rlPhaseEnd fi if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then @@ -81,6 +86,9 @@ rlJournalStart rlRun "sed -i 's/^arbitrator=.*$/arbitrator=\"${IP_ADDRESS}\"/' /etc/booth/booth.conf" rlRun "grep ^arbitrator /etc/booth/booth.conf" rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "start status" 1 + rlRun "booth list" + rlRun "booth status" + rlRun "booth peers" rlRun "restorecon -Rv /etc /var /run -e /var/ARTIFACTS" 0-255 rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd From 5a5d3a227c573de823261841d901e777d11aa54d Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 21 Jan 2025 14:09:58 +0100 Subject: [PATCH 443/626] test if systemd-ssh-generator can read /dev/vsock SELinux denials recently found on Beaker machines revealed that SELinux prevents the systemd-ssh-generator processes from reading the /dev/vsock device. The TC reproduces the situation. In order to enable the ssh-generator which belongs to new systemd builds, I believe that SELinux policy should allow the access. The TC looks for appropriate policy rules and file context patterns. The TC covers RHEL-72549. --- selinux-policy/systemd-generators/Makefile | 9 +++++++-- selinux-policy/systemd-generators/main.fmf | 6 +++++- selinux-policy/systemd-generators/runtest.sh | 11 +++++++++++ 3 files changed, 23 insertions(+), 3 deletions(-) diff --git a/selinux-policy/systemd-generators/Makefile b/selinux-policy/systemd-generators/Makefile index dcaae62..041e2b8 100644 --- a/selinux-policy/systemd-generators/Makefile +++ b/selinux-policy/systemd-generators/Makefile @@ -54,21 +54,26 @@ $(METADATA): Makefile @echo "Type: Sanity" >> $(METADATA) @echo "TestTime: 15m" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit" >> $(METADATA) + @echo "Requires: libselinux-utils" >> $(METADATA) @echo "Requires: policycoreutils" >> $(METADATA) @echo "Requires: selinux-policy" >> $(METADATA) @echo "Requires: selinux-policy-targeted" >> $(METADATA) @echo "Requires: zram-generator" >> $(METADATA) + @echo "Requires: setools-console" >> $(METADATA) @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @echo "License: GPLv2" >> $(METADATA) @echo "Confidential: no" >> $(METADATA) @echo "Destructive: no" >> $(METADATA) - #@echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) @echo "Environment: SYSTEMD_PAGER=\"\"" >> $(METADATA) @echo "Releases: -RHEL4" >> $(METADATA) @echo "Releases: -RHEL5" >> $(METADATA) @echo "Releases: -RHEL6" >> $(METADATA) - @echo "Bug: 2230226" >> $(METADATA) + @echo "Releases: -RHEL7" >> $(METADATA) + @echo "Bug: 2230226" >> $(METADATA) # Fedora 39 + @echo "Bug: RHEL-72549" >> $(METADATA) # RHEL-10 rhts-lint $(METADATA) diff --git a/selinux-policy/systemd-generators/main.fmf b/selinux-policy/systemd-generators/main.fmf index 949427e..4e67f10 100644 --- a/selinux-policy/systemd-generators/main.fmf +++ b/selinux-policy/systemd-generators/main.fmf @@ -16,6 +16,8 @@ recommend: - policycoreutils - selinux-policy - selinux-policy-targeted + - setools-console + - zram-generator environment: AVC_ERROR: +no_avc_check duration: 15m @@ -24,15 +26,17 @@ tag: - NoRHEL4 - NoRHEL5 - NoRHEL6 + - NoRHEL7 - TierCandidatesPASS - f32friendly - targeted - NoRHIVOS link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2230226 + - verifies: https://issues.redhat.com/browse/RHEL-72549 adjust: - enabled: false - when: distro == rhel-7 + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 continue: false extra-nitrate: TC#0617500 id: f92a6183-91e3-407a-9ac7-9b7df460109a diff --git a/selinux-policy/systemd-generators/runtest.sh b/selinux-policy/systemd-generators/runtest.sh index f6f6c25..f92caea 100755 --- a/selinux-policy/systemd-generators/runtest.sh +++ b/selinux-policy/systemd-generators/runtest.sh @@ -195,6 +195,17 @@ EOF rlRun "systemctl stop sysv-generator-test.service" rlPhaseEnd + if rlIsCentOS 10 || rlIsRHEL 10 ; then + rlPhaseStartTest "RHEL-72549" + rlSEMatchPathCon "/usr/lib/systemd/system-generators/systemd-ssh-generator" "systemd_ssh_generator_exec_t" + rlSEMatchPathCon "/dev/vsock" "vsock_device_t" + rlSEMatchPathCon "/run/systemd/generator/sshd-vsock.socket" "systemd_unit_file_t" + rlSESearchRule "allow init_t systemd_ssh_generator_exec_t : file { getattr open read execute } [ ]" + rlSESearchRule "type_transition init_t systemd_ssh_generator_exec_t : process systemd_ssh_generator_t" + rlSESearchRule "allow systemd_ssh_generator_t vsock_device_t : chr_file { getattr ioctl open read } [ ]" + rlSESearchRule "allow systemd_ssh_generator_t systemd_unit_file_t : file { create getattr write open } [ ]" + rlPhaseEnd + fi ### generators from other packages: install them all? # dnf install "/usr/lib/systemd/system-generators/*" From 9dce63b31d7ade313189791784373aabfbcefaad Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Fri, 31 Jan 2025 16:26:12 +0100 Subject: [PATCH 444/626] kernel/selinux-testsuite: apply patch to fix hang on CS10 This applies the following patch that fixes behavior with the latest RHEL-10 kernels: https://lore.kernel.org/all/20250131152122.1452103-1-omosnace@redhat.com/ Signed-off-by: Ondrej Mosnacek --- kernel/selinux-testsuite/runtest.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/selinux-testsuite/runtest.sh b/kernel/selinux-testsuite/runtest.sh index a030e15..573599b 100755 --- a/kernel/selinux-testsuite/runtest.sh +++ b/kernel/selinux-testsuite/runtest.sh @@ -41,7 +41,7 @@ DEFAULT_COMMIT="f9f4a604b50eecdc9ff674f1762208f23c15013f" # requests (by number) are merged, creating a new temporary local branch. DEFAULT_PULLS="" # Default SELinux Patchwork series to apply before running the test. -DEFAULT_PATCHES="883857" +DEFAULT_PATCHES="883857 929525" # Optional test parameter - location of testuite git. GIT_URL=${GIT_URL:-"https://github.com/SELinuxProject/selinux-testsuite"} From 8519ca13a76b693a2dd9cdb725995bf462b0fb2b Mon Sep 17 00:00:00 2001 From: Jan Onderka Date: Mon, 3 Feb 2025 18:44:34 +0100 Subject: [PATCH 445/626] rpm-suppress-stderr: Drop '--installroot' from 'dnf download' 'dnf download' does not download rpm files if joined with --installroot option. Fixes: [ BEGIN ] :: Running 'dnf download --installroot=/tmp/tmp.Bw3ejLevcz/lower rpm-plugin-selinux selinux-policy selinux-policy-targeted ' Updating Subscription Management repositories. Unable to read consumer identity This system is not registered with an entitlement server. You can use subscription-manager to register. No package rpm-plugin-selinux available. Exiting due to strict setting. Error: No package rpm-plugin-selinux available. [ FAIL ] :: Command 'dnf download --installroot=/tmp/tmp.Bw3ejLevcz/lower rpm-plugin-selinux selinux-policy selinux-policy-targeted ' (Expected 0, got 1) --- selinux-policy/rpm-suppress-stderr/test.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/selinux-policy/rpm-suppress-stderr/test.sh b/selinux-policy/rpm-suppress-stderr/test.sh index 9325a66..2fd8fd1 100755 --- a/selinux-policy/rpm-suppress-stderr/test.sh +++ b/selinux-policy/rpm-suppress-stderr/test.sh @@ -37,7 +37,7 @@ rlJournalStart rlRun "dnf -y install --installroot=$tmp/lower diffutils libfdisk libselinux-utils libutempter policycoreutils util-linux rpm ${INSTALL_OPTION}" rlRun "mkdir download" rlRun "cd download" - rlRun "dnf download --installroot=$tmp/lower rpm-plugin-selinux selinux-policy selinux-policy-targeted ${DOWNLOAD_OPTION}" + rlRun "dnf download rpm-plugin-selinux selinux-policy selinux-policy-targeted ${DOWNLOAD_OPTION}" rlRun "mv -v *rpm $tmp/lower" rlRun "cd .." rlRun "fuse-overlayfs -o lowerdir=$tmp/lower/ -o upperdir=$tmp/upper/ -o workdir=$tmp/work/ $tmp/merged/" From 1938ff73cb11eb23b5914ea683b3c71c8e9472ec Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 4 Feb 2025 16:24:45 +0100 Subject: [PATCH 446/626] fix gating tests which fail or time out Several automated tests fail during gating because of: * known test code issues * too short duration * additional SELinux policy changes The identified problems should be fixed now. --- .../ModemManager-and-similar/runtest.sh | 4 ++-- selinux-policy/boothd-and-similar/Makefile | 2 +- selinux-policy/boothd-and-similar/main.fmf | 2 +- selinux-policy/rngd-and-similar/runtest.sh | 4 ++-- .../systemd-machined-and-similar/runtest.sh | 15 +++++++++------ selinux-policy/virt-install-additional/runtest.sh | 2 +- 6 files changed, 16 insertions(+), 13 deletions(-) diff --git a/selinux-policy/ModemManager-and-similar/runtest.sh b/selinux-policy/ModemManager-and-similar/runtest.sh index 63470fb..4ad9eb0 100755 --- a/selinux-policy/ModemManager-and-similar/runtest.sh +++ b/selinux-policy/ModemManager-and-similar/runtest.sh @@ -83,7 +83,7 @@ rlJournalStart else DESTINATION="org.freedesktop.ModemManager1" fi - rlRun "gdbus introspect --system --object-path / --dest ${DESTINATION} >& /dev/null" + rlRun "gdbus introspect --system --object-path / --dest ${DESTINATION} >& /dev/null" 0,1 sleep 1 rlRun "ps -efZ | grep -v grep | grep ${PROCESS_NAME}" rlRun "ps -efZ | grep -v grep | grep \"${PROCESS_CONTEXT}.*${PROCESS_NAME}\"" @@ -115,7 +115,7 @@ rlJournalStart sleep 1 rlRun "service systemd-logind restart" sleep 1 - rlRun "restorecon -Rv /var /run -e /var/ARTIFACTS" 0-255 + rlRun "restorecon -Rv /etc /var /run -e /var/ARTIFACTS" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd fi diff --git a/selinux-policy/boothd-and-similar/Makefile b/selinux-policy/boothd-and-similar/Makefile index 6e66c75..fa8e9cf 100644 --- a/selinux-policy/boothd-and-similar/Makefile +++ b/selinux-policy/boothd-and-similar/Makefile @@ -52,7 +52,7 @@ $(METADATA): Makefile @echo "Path: $(TEST_DIR)" >> $(METADATA) @echo "Description: SELinux interferes with boothd and related programs" >> $(METADATA) @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 10m" >> $(METADATA) + @echo "TestTime: 20m" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) @echo "RunFor: booth" >> $(METADATA) @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console booth-arbitrator booth-core /usr/sbin/service net-tools systemd-container" >> $(METADATA) diff --git a/selinux-policy/boothd-and-similar/main.fmf b/selinux-policy/boothd-and-similar/main.fmf index 5539ab8..2b30bee 100644 --- a/selinux-policy/boothd-and-similar/main.fmf +++ b/selinux-policy/boothd-and-similar/main.fmf @@ -22,7 +22,7 @@ recommend: - systemd-container environment: AVC_ERROR: +no_avc_check -duration: 10m +duration: 20m enabled: true tag: - NoRHEL4 diff --git a/selinux-policy/rngd-and-similar/runtest.sh b/selinux-policy/rngd-and-similar/runtest.sh index e88d2a8..ca55d19 100755 --- a/selinux-policy/rngd-and-similar/runtest.sh +++ b/selinux-policy/rngd-and-similar/runtest.sh @@ -169,7 +169,7 @@ rlJournalStart rlRun "setsebool daemons_use_tty on" rlRun "runcon system_u:system_r:initrc_t:s0 bash -c 'rngd -l'" 0-255 rlRun "setsebool daemons_use_tty off" - rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 + rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status" 1 if ${DROP_PRIV} ; then rlLog "modifying the /etc/sysconfig/rngd file" @@ -181,7 +181,7 @@ rlJournalStart fi fi rlRun "grep ^RNGD_ARGS= /etc/sysconfig/rngd" - rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 2 rlPhaseEnd rlPhaseStartCleanup diff --git a/selinux-policy/systemd-machined-and-similar/runtest.sh b/selinux-policy/systemd-machined-and-similar/runtest.sh index 61fade7..a15fd7d 100755 --- a/selinux-policy/systemd-machined-and-similar/runtest.sh +++ b/selinux-policy/systemd-machined-and-similar/runtest.sh @@ -36,6 +36,7 @@ SERVICE_PACKAGE="systemd-container" SERVICE_NAME="systemd-machined" PROCESS_NAME="systemd-machined" PROCESS_CONTEXT="systemd_machined_t" +TEST_POLICY_NEEDED=${TEST_POLICY_NEEDED:-false} INSTALL_OPTION="" if yum --help | grep -q use-host-config ; then INSTALL_OPTION="${INSTALL_OPTION} --use-host-config" @@ -124,9 +125,10 @@ rlJournalStart rlRun "mkdir -pZ /var/lib/machines/test" rlRun "dnf -y --installroot=/var/lib/machines/test/ install dhcp-client dnf filesystem glibc glibc-langpack-en glibc-langpack-de iproute iputils less passwd systemd vim-minimal ${INSTALL_OPTION}" rlRun "du -sh /var/lib/machines/test" - # TODO: remove next 2 lines once the BZs are fixed - rlRun "semodule -i testpolicy.cil" - rlRun "semodule -lfull | grep testpolicy" + if ${TEST_POLICY_NEEDED} ; then + rlRun "semodule -i testpolicy.cil" + rlRun "semodule -lfull | grep testpolicy" + fi rlRun "systemctl start systemd-nspawn@test" rlRun "systemctl status systemd-nspawn@test" rlRun "ps -efZ | grep -e ${PROCESS_CONTEXT} -e unconfined_service_t" @@ -142,9 +144,10 @@ rlJournalStart rlRun "machinectl kill test" rlRun "machinectl terminate test" rlRun "systemctl stop systemd-nspawn@test" - # TODO: remove next 2 lines once the BZs are fixed - rlRun "semodule -r testpolicy" - rlRun "semodule -lfull | grep testpolicy" 1 + if ${TEST_POLICY_NEEDED} ; then + rlRun "semodule -r testpolicy" + rlRun "semodule -lfull | grep testpolicy" 1 + fi rlRun "rm -rf /var/lib/machines/test" rlPhaseEnd diff --git a/selinux-policy/virt-install-additional/runtest.sh b/selinux-policy/virt-install-additional/runtest.sh index 3e087ce..775ee38 100755 --- a/selinux-policy/virt-install-additional/runtest.sh +++ b/selinux-policy/virt-install-additional/runtest.sh @@ -166,7 +166,7 @@ rlJournalStart rlRun "service virtqemud start" rlRun "service virtnetworkd start" rlRun "service virtstoraged start" - rlRun "virt-install --memory 128 --pxe --virt-type qemu --os-variant alpinelinux3.8 --disk source.protocol=ssh,source.name=/var/lib/libvirt/images/test.img,source.host0.name=10.73.210.25,source.host0.port=22 --wait 0 --name test5" + rlRun "virt-install --memory 128 --pxe --virt-type qemu --os-variant alpinelinux3.8 --disk source.protocol=ssh,source.name=/var/lib/libvirt/images/test.img,source.host0.name=localhost,source.host0.port=22 --wait 0 --name test5" sleep 30 rlRun "virsh list" rlRun "virsh list | grep 'test5.*running'" From 70d0bb714060917b91ff883a9444040ab1d6007c Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Mon, 20 Jan 2025 15:05:58 +0100 Subject: [PATCH 447/626] add basic test which covers the tuned-ppd service Sooner or later, the tuned-ppd service will be confined by SELinux policy and this automated test should find out if basic functions of the program/service are affected or not. The TC covers RHEL-69450 and RHEL-69526. --- selinux-policy/tuned-ppd-and-similar/Makefile | 69 ++++++++++++++ selinux-policy/tuned-ppd-and-similar/PURPOSE | 5 + selinux-policy/tuned-ppd-and-similar/main.fmf | 39 ++++++++ .../tuned-ppd-and-similar/runtest.sh | 92 +++++++++++++++++++ 4 files changed, 205 insertions(+) create mode 100644 selinux-policy/tuned-ppd-and-similar/Makefile create mode 100644 selinux-policy/tuned-ppd-and-similar/PURPOSE create mode 100644 selinux-policy/tuned-ppd-and-similar/main.fmf create mode 100755 selinux-policy/tuned-ppd-and-similar/runtest.sh diff --git a/selinux-policy/tuned-ppd-and-similar/Makefile b/selinux-policy/tuned-ppd-and-similar/Makefile new file mode 100644 index 0000000..de75abf --- /dev/null +++ b/selinux-policy/tuned-ppd-and-similar/Makefile @@ -0,0 +1,69 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/tuned-ppd-and-similar +# Description: SELinux interferes with tuned-ppd and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2025 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/tuned-ppd-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with tuned-ppd and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console tuned-ppd /usr/sbin/service" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA) + @echo "Bug: RHEL-69450" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-69526" >> $(METADATA) # RHEL-9 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/tuned-ppd-and-similar/PURPOSE b/selinux-policy/tuned-ppd-and-similar/PURPOSE new file mode 100644 index 0000000..dc2bac6 --- /dev/null +++ b/selinux-policy/tuned-ppd-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/tuned-ppd-and-similar +Author: Milos Malik + +SELinux interferes with tuned-ppd and related programs. + diff --git a/selinux-policy/tuned-ppd-and-similar/main.fmf b/selinux-policy/tuned-ppd-and-similar/main.fmf new file mode 100644 index 0000000..add067b --- /dev/null +++ b/selinux-policy/tuned-ppd-and-similar/main.fmf @@ -0,0 +1,39 @@ +summary: SELinux interferes with tuned-ppd and related programs +description: |+ + SELinux interferes with tuned-ppd and related programs. + +contact: Milos Malik +component: + - selinux-policy +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - tuned-ppd + - /usr/sbin/service +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - NoRHEL8 + - NoRHIVOS +link: + - verifies: https://issues.redhat.com/browse/RHEL-69450 + - verifies: https://issues.redhat.com/browse/RHEL-69526 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 + because: the tuned-ppd package is not available there +extra-summary: /CoreOS/selinux-policy/Regression/tuned-ppd-and-similar +extra-task: /CoreOS/selinux-policy/Regression/tuned-ppd-and-similar diff --git a/selinux-policy/tuned-ppd-and-similar/runtest.sh b/selinux-policy/tuned-ppd-and-similar/runtest.sh new file mode 100755 index 0000000..952ba81 --- /dev/null +++ b/selinux-policy/tuned-ppd-and-similar/runtest.sh @@ -0,0 +1,92 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/tuned-ppd-and-similar +# Description: SELinux interferes with tuned-ppd and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2025 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +FILE_PATH="/usr/sbin/tuned-ppd" +SERVICE_PACKAGE="tuned-ppd" +SERVICE_NAME="tuned-ppd" +PROCESS_NAME="tuned-ppd" +if seinfo -t | grep -q tuned_ppd ; then + PROCESS_CONTEXT="tuned_ppd_t" + FILE_CONTEXT="tuned_ppd_exec_t" +else + PROCESS_CONTEXT="unconfined_service_t" + FILE_CONTEXT="bin_t" +fi + +rlJournalStart + if rlIsRHEL 7 8 || rlIsCentOS 7 8 ; then + rlLog "Not applicable to this OS version." + rlJournalEnd + exit 0 + fi + + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "RHEL-69450 + RHEL-69526" + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + rlSESearchRule "allow init_t ${PROCESS_CONTEXT} : process { transition } [ ]" + rlSESearchRule "type_transition init_t ${FILE_CONTEXT} : process ${PROCESS_CONTEXT}" + rlSESearchRule "allow init_t ${FILE_CONTEXT} : file { getattr open read execute } [ ]" + rlPhaseEnd + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then + rlPhaseStartTest "real scenario -- standalone service" + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "busctl introspect net.hadess.PowerProfiles /org/freedesktop/UPower/PowerProfiles" + rlRun "busctl introspect net.hadess.PowerProfiles /net/hadess/PowerProfiles" + rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + fi + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + From 5660ee6918fde28909c7ad151eff1159841680ca Mon Sep 17 00:00:00 2001 From: Zdenek Pytela Date: Thu, 6 Feb 2025 11:50:39 +0100 Subject: [PATCH 448/626] Check for bin/sulogin, not for /sbin/sulogin With Unify_bin_and_sbin [1] in progres, majority of commands have already been moved from /usr/sbin to /usr/bin in Fedora 42 and newer, therefore the strings check in /usr/lib/systemd/systemd-sulogin-shell should rather use bin/sulogin. This commit fixes the following test failure: [ FAIL ] :: Command 'strings /usr/lib/systemd/systemd-sulogin-shell | grep /sbin/sulogin' (Expected 0, got 1) [1] https://fedoraproject.org/wiki/Changes/Unify_bin_and_sbin --- selinux-policy/sulogin-and-similar/runtest.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/selinux-policy/sulogin-and-similar/runtest.sh b/selinux-policy/sulogin-and-similar/runtest.sh index 6fbb8d9..073d423 100755 --- a/selinux-policy/sulogin-and-similar/runtest.sh +++ b/selinux-policy/sulogin-and-similar/runtest.sh @@ -25,7 +25,7 @@ rlJournalStart rlPhaseStartTest "real scenario -- standalone service" rlRun "grep ExecStart= /usr/lib/systemd/system/rescue.service" - rlRun "strings /usr/lib/systemd/systemd-sulogin-shell | grep /sbin/sulogin" + rlRun "strings /usr/lib/systemd/systemd-sulogin-shell | grep bin/sulogin" rlRun "service rescue start" sleep 2 rlRun "service rescue status" From 255c7cda9260db7de1018aca74599e8f8e05fb93 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Thu, 6 Feb 2025 10:20:32 +0100 Subject: [PATCH 449/626] test if machinectl can kill VMs running under systemd-machined Recent systemd-machined + selinux-policy testing revealed that SELinux prevents the machinectl command (consequently the systemd-machined process) from stopping, rebooting or powering off the VMs. The TC reproduces the situation. In order to support this documented functionality, I believe that SELinux policy should allow these actions. The TC looks for appropriate policy rules and file context patterns. The TC covers RHEL-76352, RHEL-77087 and their duplicates. --- .../systemd-machined-and-similar/Makefile | 3 ++ .../systemd-machined-and-similar/main.fmf | 3 ++ .../systemd-machined-and-similar/runtest.sh | 28 +++++++++++++------ 3 files changed, 26 insertions(+), 8 deletions(-) diff --git a/selinux-policy/systemd-machined-and-similar/Makefile b/selinux-policy/systemd-machined-and-similar/Makefile index d34d9a0..c9b3c59 100644 --- a/selinux-policy/systemd-machined-and-similar/Makefile +++ b/selinux-policy/systemd-machined-and-similar/Makefile @@ -68,6 +68,9 @@ $(METADATA): Makefile @echo "Bug: 1900888" >> $(METADATA) # Fedora 35 @echo "Bug: RHEL-49567" >> $(METADATA) # RHEL-10 @echo "Bug: RHEL-74280" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-76352" >> $(METADATA) # RHEL-9 + @echo "Bug: RHEL-77087" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-78088" >> $(METADATA) # RHEL-10 rhts-lint $(METADATA) diff --git a/selinux-policy/systemd-machined-and-similar/main.fmf b/selinux-policy/systemd-machined-and-similar/main.fmf index 4dc0eb6..18c8819 100644 --- a/selinux-policy/systemd-machined-and-similar/main.fmf +++ b/selinux-policy/systemd-machined-and-similar/main.fmf @@ -36,6 +36,9 @@ link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1900888 - verifies: https://issues.redhat.com/browse/RHEL-49567 - verifies: https://issues.redhat.com/browse/RHEL-74280 + - verifies: https://issues.redhat.com/browse/RHEL-76352 + - verifies: https://issues.redhat.com/browse/RHEL-77087 + - verifies: https://issues.redhat.com/browse/RHEL-78088 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7 diff --git a/selinux-policy/systemd-machined-and-similar/runtest.sh b/selinux-policy/systemd-machined-and-similar/runtest.sh index a15fd7d..d4aa98e 100755 --- a/selinux-policy/systemd-machined-and-similar/runtest.sh +++ b/selinux-policy/systemd-machined-and-similar/runtest.sh @@ -98,10 +98,12 @@ rlJournalStart rlPhaseStartTest "RHEL-49567" rlSEMatchPathCon "/usr/lib/systemd/systemd-machined" "systemd_machined_exec_t" - rlSEMatchPathCon "/run/systemd/machine" "systemd_machined_var_run_t" - rlSEMatchPathCon "/run/systemd/machine/io.systemd.Machine" "systemd_machined_var_run_t" - rlSESearchRule "allow systemd_machined_t systemd_machined_var_run_t : dir { create } [ ]" - rlSESearchRule "allow systemd_machined_t systemd_machined_var_run_t : sock_file { create unlink } [ ]" + if ! rlIsRHEL 9 && ! rlIsCentOS 9 ; then + rlSEMatchPathCon "/run/systemd/machine" "systemd_machined_var_run_t" + rlSEMatchPathCon "/run/systemd/machine/io.systemd.Machine" "systemd_machined_var_run_t" + rlSESearchRule "allow systemd_machined_t systemd_machined_var_run_t : dir { create } [ ]" + rlSESearchRule "allow systemd_machined_t systemd_machined_var_run_t : sock_file { create unlink } [ ]" + fi rlRun "machinectl" rlPhaseEnd @@ -112,12 +114,20 @@ rlJournalStart rlPhaseEnd fi + if ! rlIsRHEL 8 && ! rlIsCentOS 8 ; then + rlPhaseStartTest "RHEL-76352 + RHEL-77087 + RHEL-78088" + rlSESearchRule "allow systemd_machined_t unconfined_service_t : dir { search } [ ]" + rlSESearchRule "allow systemd_machined_t unconfined_service_t : file { getattr open read ioctl } [ ]" + rlSESearchRule "allow systemd_machined_t systemd_machined_t : cap_userns { kill } [ ]" + rlPhaseEnd + fi + rlPhaseStartTest "real scenario -- standalone service" if ! rlSEDefined ${PROCESS_CONTEXT} ; then PROCESS_CONTEXT="unconfined_service_t" fi rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 + rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd @@ -135,9 +145,11 @@ rlJournalStart rlRun "machinectl list" rlRun "machinectl status test" rlWatchdog "machinectl login test" 20 - rlRun "rm -f /tmp/id" - rlRun "machinectl copy-to test /usr/bin/id /tmp/id" - rlRun "machinectl copy-from test /usr/bin/id /tmp/id" + if rlIsFedora ; then + rlRun "rm -f /tmp/id" + rlRun "machinectl copy-to test /usr/bin/id /tmp/id" + rlRun "machinectl copy-from test /usr/bin/id /tmp/id" + fi rlRun "machinectl reboot test" sleep 15 rlRun "machinectl status test" From 5bcfcf4b08adb049c9734778e93b3c838ccabd5e Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Fri, 7 Feb 2025 20:46:39 +0100 Subject: [PATCH 450/626] test if virtqemud can access CD/DVD device on host Recent virtualization + CD/DVD + selinux-policy testing revealed that SELinux prevents the rpc-virtqemud processes from accessing SCSI devices on the host. The TC reproduces the situation. In order to enable this use case, I believe that SELinux policy should allow the access. The TC looks for appropriate policy rules and file context patterns. The TC covers RHEL-76104. --- .../virt-install-additional/Makefile | 5 +- .../virt-install-additional/main.fmf | 8 ++- .../virt-install-additional/runtest.sh | 71 ++++++++++++++----- 3 files changed, 62 insertions(+), 22 deletions(-) diff --git a/selinux-policy/virt-install-additional/Makefile b/selinux-policy/virt-install-additional/Makefile index 6f8f1a6..c2e6bb8 100644 --- a/selinux-policy/virt-install-additional/Makefile +++ b/selinux-policy/virt-install-additional/Makefile @@ -52,9 +52,9 @@ $(METADATA): Makefile @echo "Path: $(TEST_DIR)" >> $(METADATA) @echo "Description: SELinux interferes with virt-install and related programs" >> $(METADATA) @echo "Type: Regression" >> $(METADATA) - @echo "TestTime: 20m" >> $(METADATA) + @echo "TestTime: 30m" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted /usr/sbin/service setools-console virt-install libvirt-client numad nbdkit usbutils" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted /usr/sbin/service setools-console virt-install libvirt-client numad nbdkit usbutils lsscsi" >> $(METADATA) @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @@ -71,6 +71,7 @@ $(METADATA): Makefile @echo "Bug: RHEL-69118" >> $(METADATA) # RHEL-10 @echo "Bug: RHEL-69920" >> $(METADATA) # RHEL-10 @echo "Bug: RHEL-74230" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-76104" >> $(METADATA) # RHEL-10 rhts-lint $(METADATA) diff --git a/selinux-policy/virt-install-additional/main.fmf b/selinux-policy/virt-install-additional/main.fmf index faabe1f..3480092 100644 --- a/selinux-policy/virt-install-additional/main.fmf +++ b/selinux-policy/virt-install-additional/main.fmf @@ -23,9 +23,10 @@ recommend: - numad - nbdkit - usbutils + - lsscsi environment: AVC_ERROR: +no_avc_check -duration: 20m +duration: 30m enabled: true tag: - kernel-rt @@ -44,13 +45,14 @@ link: - verifies: https://issues.redhat.com/browse/RHEL-69118 - verifies: https://issues.redhat.com/browse/RHEL-69920 - verifies: https://issues.redhat.com/browse/RHEL-74230 + - verifies: https://issues.redhat.com/browse/RHEL-76104 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 - continue: false + because: the test is not relevant for these RHELs - enabled: false when: distro == ppc64le - continue: false + because: the virt-install package is not available there extra-summary: /CoreOS/selinux-policy/Regression/virt-install-additional extra-task: /CoreOS/selinux-policy/Regression/virt-install-additional extra-nitrate: TC#0617996 diff --git a/selinux-policy/virt-install-additional/runtest.sh b/selinux-policy/virt-install-additional/runtest.sh index 775ee38..8773acf 100755 --- a/selinux-policy/virt-install-additional/runtest.sh +++ b/selinux-policy/virt-install-additional/runtest.sh @@ -59,14 +59,14 @@ rlJournalStart rlRun "service virtqemud start" rlRun "service virtnetworkd start" rlRun "service virtstoraged start" - rlRun "virt-install --memory 128 --pxe --virt-type qemu --os-variant alpinelinux3.8 --disk none --wait 0 --name test1 --cpu mode=maximum,check=none,migratable=on,numa.cell.id=0,numa.cell.cpus=0,numa.cell.memory=512000,numa.cell.unit="KiB" --memory maxMemory.slots=16,maxMemory=4096" + rlRun "virt-install --memory 128 --pxe --virt-type qemu --os-variant alpinelinux3.8 --disk none --wait 0 --name test1 --cpu mode=maximum,check=none,migratable=on,numa.cell.id=0,numa.cell.cpus=0,numa.cell.memory=512000,numa.cell.unit="KiB" --memory maxMemory.slots=16,maxMemory=4096" 0,1 sleep 30 rlRun "virsh list" rlRun "virsh list | grep 'test1.*running'" - rlRun "virsh attach-device test1 dimm.xml" - sleep 30 + rlWatchdog "virsh attach-device test1 dimm.xml" 30 + sleep 10 rlRun "virsh destroy test1" - rlRun "virsh undefine test1" + rlRun "virsh undefine test1" 0,1 rlRun "service virtstoraged stop" rlRun "service virtnetworkd stop" rlRun "service virtqemud stop" @@ -85,12 +85,12 @@ rlJournalStart rlRun "service virtqemud start" rlRun "service virtnetworkd start" rlRun "service virtstoraged start" - rlRun "virt-install --memory 128 --pxe --virt-type qemu --os-variant alpinelinux3.8 --wait 0 --name test2 --network type=network,mac.address='52:54:00:ee:01:68',source=default,model.type=virtio,driver.queues=4" + rlRun "virt-install --memory 128 --pxe --virt-type qemu --os-variant alpinelinux3.8 --wait 0 --name test2 --network type=network,mac.address='52:54:00:ee:01:68',source=default,model.type=virtio,driver.queues=4" 0,1 sleep 30 rlRun "virsh list" rlRun "virsh list | grep 'test2.*running'" rlRun "virsh destroy test2" - rlRun "virsh undefine test2" + rlRun "virsh undefine test2" 0,1 rlRun "service virtstoraged stop" rlRun "service virtnetworkd stop" rlRun "service virtqemud stop" @@ -109,12 +109,12 @@ rlJournalStart rlRun "service virtqemud start" rlRun "service virtnetworkd start" rlRun "service virtstoraged start" - rlRun "virt-install --memory 128 --pxe --virt-type qemu --os-variant alpinelinux3.8 --wait 0 --name test3 --network type=network,mac.address='52:54:00:23:f2:12',source=default,model.type=virtio --xml xpath.set=./devices/interface/port/@isolated=yes" + rlRun "virt-install --memory 128 --pxe --virt-type qemu --os-variant alpinelinux3.8 --wait 0 --name test3 --network type=network,mac.address='52:54:00:23:f2:12',source=default,model.type=virtio --xml xpath.set=./devices/interface/port/@isolated=yes" 0,1 sleep 30 rlRun "virsh list" rlRun "virsh list | grep 'test3.*running'" rlRun "virsh destroy test3" - rlRun "virsh undefine test3" + rlRun "virsh undefine test3" 0,1 rlRun "service virtstoraged stop" rlRun "service virtnetworkd stop" rlRun "service virtqemud stop" @@ -135,12 +135,12 @@ rlJournalStart rlRun "service virtqemud start" rlRun "service virtnetworkd start" rlRun "service virtstoraged start" - rlRun "virt-install --memory 128 --pxe --virt-type qemu --os-variant alpinelinux3.8 --wait 0 --name test4 --numatune memory.mode='strict',memory.placement='auto'" + rlRun "virt-install --memory 128 --pxe --virt-type qemu --os-variant alpinelinux3.8 --wait 0 --name test4 --numatune memory.mode='strict',memory.placement='auto'" 0,1 sleep 30 rlRun "virsh list" rlRun "virsh list | grep 'test4.*running'" rlRun "virsh destroy test4" - rlRun "virsh undefine test4" + rlRun "virsh undefine test4" 0,1 rlRun "service virtstoraged stop" rlRun "service virtnetworkd stop" rlRun "service virtqemud stop" @@ -166,12 +166,12 @@ rlJournalStart rlRun "service virtqemud start" rlRun "service virtnetworkd start" rlRun "service virtstoraged start" - rlRun "virt-install --memory 128 --pxe --virt-type qemu --os-variant alpinelinux3.8 --disk source.protocol=ssh,source.name=/var/lib/libvirt/images/test.img,source.host0.name=localhost,source.host0.port=22 --wait 0 --name test5" + rlRun "virt-install --memory 128 --pxe --virt-type qemu --os-variant alpinelinux3.8 --disk source.protocol=ssh,source.name=/var/lib/libvirt/images/test.img,source.host0.name=localhost,source.host0.port=22 --wait 0 --name test5" 0,1 sleep 30 rlRun "virsh list" rlRun "virsh list | grep 'test5.*running'" rlRun "virsh destroy test5" - rlRun "virsh undefine test5" + rlRun "virsh undefine test5" 0,1 rlRun "service virtstoraged stop" rlRun "service virtnetworkd stop" rlRun "service virtqemud stop" @@ -192,13 +192,13 @@ rlJournalStart rlRun "service virtqemud start" rlRun "service virtnetworkd start" rlRun "service virtstoraged start" - rlRun "virt-install --memory 128 --pxe --virt-type qemu --os-variant alpinelinux3.8 --wait 0 --name test6" + rlRun "virt-install --memory 128 --pxe --virt-type qemu --os-variant alpinelinux3.8 --wait 0 --name test6" 0,1 sleep 30 rlRun "virsh vcpuinfo test6" rlRun "virsh list" rlRun "virsh list | grep 'test6.*running'" rlRun "virsh destroy test6" - rlRun "virsh undefine test6" + rlRun "virsh undefine test6" 0,1 rlRun "service virtstoraged stop" rlRun "service virtnetworkd stop" rlRun "service virtqemud stop" @@ -210,7 +210,8 @@ rlJournalStart rlPhaseStartTest "RHEL-74230" rlSEMatchPathCon "/dev/bus/usb/001/001" "usb_device_t" if seinfo -a | grep -q virt_driver_domain ; then - rlSESearchRule "allow virtqemud_t usb_device_t : chr_file { getattr open read write lock setattr } [ ]" + rlSESearchRule "allow virtqemud_t usb_device_t : chr_file { getattr } [ ]" + rlSESearchRule "allow virtqemud_t usb_device_t : chr_file { open read write lock setattr } [ virt_use_usb ]" fi if rlIsRHEL 8 ; then rlRun "service libvirtd start" @@ -223,13 +224,13 @@ rlJournalStart # USB devices may not be available rlRun "virsh nodedev-list | grep usb" 0,1 for USB_ID in `virsh nodedev-list | grep usb` ; do - rlRun "virt-install --memory 128 --pxe --virt-type qemu --os-variant alpinelinux3.8 --wait 0 --name test-${USB_ID} --host-device ${USB_ID}" + rlRun "virt-install --memory 128 --pxe --virt-type qemu --os-variant alpinelinux3.8 --wait 0 --name test-${USB_ID} --host-device ${USB_ID}" 0,1 done sleep 10 rlRun "virsh list" for VM_NAME in `virsh list --name` ; do rlRun "virsh destroy ${VM_NAME}" - rlRun "virsh undefine ${VM_NAME}" + rlRun "virsh undefine ${VM_NAME}" 0,1 done rlRun "service virtnodedevd stop" rlRun "service virtstoraged stop" @@ -240,6 +241,42 @@ rlJournalStart fi rlPhaseEnd + rlPhaseStartTest "RHEL-76104" + rlSEMatchPathCon "/dev/sg0" "scsi_generic_device_t" + if seinfo -a | grep -q virt_driver_domain ; then + rlSESearchRule "allow virtqemud_t scsi_generic_device_t : chr_file { getattr open read write lock setattr } [ ]" + fi + rlRun "modprobe scsi_debug ptype=5" + sleep 2 + rlRun "lsscsi -gs" + if rlIsRHEL 8 ; then + rlRun "service libvirtd start" + fi + rlRun "service virtqemud start" + rlRun "service virtnetworkd start" + rlRun "service virtstoraged start" + rlRun "service virtnodedevd start" + # SCSI devices may not be available + rlRun "virsh nodedev-list | grep scsi" 0,1 + for SCSI_ID in `virsh nodedev-list | grep scsi` ; do + rlRun "virt-install --memory 128 --pxe --virt-type qemu --os-variant alpinelinux3.8 --wait 0 --name test-${SCSI_ID} --host-device ${SCSI_ID}" 0,1 + done + sleep 10 + rlRun "virsh list" + for VM_NAME in `virsh list --name` ; do + rlRun "virsh destroy ${VM_NAME}" + rlRun "virsh undefine ${VM_NAME}" 0,1 + done + rlRun "service virtnodedevd stop" + rlRun "service virtstoraged stop" + rlRun "service virtnetworkd stop" + rlRun "service virtqemud stop" + if rlIsRHEL 8 ; then + rlRun "service libvirtd stop" + fi + rlRun "modprobe -r scsi_debug" + rlPhaseEnd + rlPhaseStartCleanup sleep 2 rlSECheckAVC From 783121a5a4106c698d6178413c94c3f6d33026c4 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Thu, 6 Feb 2025 15:18:59 +0100 Subject: [PATCH 451/626] test if virt-admin can connect to virt* daemons via admin sockets Recent virtualization CI test runs discovered SELinux denials when the virt-admin tool tries to connect to the virtqemud process. The TC reproduces the situation via systemd-run. In order to support the following scenario, I believe that SELinux policy should allow the necessary operations: * the virt-admin program is running as unconfined_service_t because it was executed by a process running as unconfined_service_t and the virt-admin process wants to talk to the virtqemud process The TC looks for appropriate policy rules and file context patterns. The TC covers RHEL-77620. --- .../virtualization-daemons/Makefile | 1 + .../virtualization-daemons/main.fmf | 1 + .../virtualization-daemons/runtest.sh | 41 +++++++++++++++++++ 3 files changed, 43 insertions(+) diff --git a/selinux-policy/virtualization-daemons/Makefile b/selinux-policy/virtualization-daemons/Makefile index 5aaf556..3ae25e6 100644 --- a/selinux-policy/virtualization-daemons/Makefile +++ b/selinux-policy/virtualization-daemons/Makefile @@ -65,6 +65,7 @@ $(METADATA): Makefile @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) @echo "Bug: 2291273" >> $(METADATA) # Fedora 41 @echo "Bug: RHEL-40834" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-77620" >> $(METADATA) # RHEL-10 rhts-lint $(METADATA) diff --git a/selinux-policy/virtualization-daemons/main.fmf b/selinux-policy/virtualization-daemons/main.fmf index eb1c349..2716b7e 100644 --- a/selinux-policy/virtualization-daemons/main.fmf +++ b/selinux-policy/virtualization-daemons/main.fmf @@ -38,6 +38,7 @@ enabled: true link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2291273 - verifies: https://issues.redhat.com/browse/RHEL-40834 + - verifies: https://issues.redhat.com/browse/RHEL-77620 tag: - NoRHEL4 - NoRHEL5 diff --git a/selinux-policy/virtualization-daemons/runtest.sh b/selinux-policy/virtualization-daemons/runtest.sh index 32f85be..a142de9 100755 --- a/selinux-policy/virtualization-daemons/runtest.sh +++ b/selinux-policy/virtualization-daemons/runtest.sh @@ -153,6 +153,47 @@ rlJournalStart done rlPhaseEnd + if seinfo -a | grep -q virt_driver_domain ; then + rlPhaseStartTest "RHEL-77620" + rlSEMatchPathCon "/usr/bin/virt-admin" "bin_t" + rlSESearchRule "type_transition init_t bin_t : process unconfined_service_t" + rlSESearchRule "allow virtqemud_t unconfined_service_t : dir { search } [ ]" + rlSESearchRule "allow virtqemud_t unconfined_service_t : file { getattr open read } [ ]" + rlPhaseEnd + fi + + rlPhaseStartTest "real scenario -- admin sockets" + # start all admin sockets + for TUPLE in ${ALL_TUPLES} ; do + SERVICE_NAME=`echo ${TUPLE} | cut -d : -f 1` + PROCESS_NAME=`echo ${TUPLE} | cut -d : -f 2` + PROCESS_CONTEXT=`echo ${TUPLE} | cut -d : -f 3` + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}-admin.socket ] ; then + rlRun "systemctl start ${SERVICE_NAME}-admin.socket" + fi + done + # connect to the services via admin sockets + for TUPLE in ${ALL_TUPLES} ; do + SERVICE_NAME=`echo ${TUPLE} | cut -d : -f 1` + PROCESS_NAME=`echo ${TUPLE} | cut -d : -f 2` + PROCESS_CONTEXT=`echo ${TUPLE} | cut -d : -f 3` + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}-admin.socket ] ; then + rlRun "virt-admin -c ${SERVICE_NAME}:///system client-list admin" 0,1 + rlRun "systemd-run virt-admin -c ${SERVICE_NAME}:///system server-list" 0,1 + fi + done + rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 + # stop all admin sockets + for TUPLE in ${ALL_TUPLES} ; do + SERVICE_NAME=`echo ${TUPLE} | cut -d : -f 1` + PROCESS_NAME=`echo ${TUPLE} | cut -d : -f 2` + PROCESS_CONTEXT=`echo ${TUPLE} | cut -d : -f 3` + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}-admin.socket ] ; then + rlRun "systemctl stop ${SERVICE_NAME}-admin.socket" + fi + done + rlPhaseEnd + if seinfo -a | grep -q virt_driver_domain ; then rlPhaseStartTest "bz#2291273 + RHEL-40834" rlSESearchRule "allow virtnetworkd_t unconfined_t : dir { search } [ ]" From 6026118dccd0be4909a87b93ea0072baf5ac4fb3 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Fri, 7 Feb 2025 14:04:39 +0100 Subject: [PATCH 452/626] test if tlshd can access network and certificates Recent ktls-utils + NVME testing revealed that SELinux prevents the tlshd processes from doing the following activities: * reading the /etc/resolv.conf file * creating and managing a UDP socket * searching the /etc/pki/tls/certs directory * reading the certificate files under /etc/pki/tls/certs/ * reading the /proc/sys/net/ipv6/conf/all/disable_ipv6 file * searching the /proc/sys/net/ipv6 directory * creating and managing a netlink route socket The TC does not reproduce the situation. There is a dedicated automated test for this purpose. In order to enable the expected tlshd functionality, I believe that SELinux policy should allow these actions. The TC looks for appropriate policy rules and file context patterns. The TC covers RHEL-74424. --- selinux-policy/tlshd-and-similar/Makefile | 1 + selinux-policy/tlshd-and-similar/main.fmf | 3 ++- selinux-policy/tlshd-and-similar/runtest.sh | 18 ++++++++++++++++++ 3 files changed, 21 insertions(+), 1 deletion(-) diff --git a/selinux-policy/tlshd-and-similar/Makefile b/selinux-policy/tlshd-and-similar/Makefile index b6e2928..236ebdf 100644 --- a/selinux-policy/tlshd-and-similar/Makefile +++ b/selinux-policy/tlshd-and-similar/Makefile @@ -64,6 +64,7 @@ $(METADATA): Makefile @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA) @echo "Bug: RHEL-29439" >> $(METADATA) # RHEL-9 @echo "Bug: RHEL-42672" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-74424" >> $(METADATA) # RHEL-10 rhts-lint $(METADATA) diff --git a/selinux-policy/tlshd-and-similar/main.fmf b/selinux-policy/tlshd-and-similar/main.fmf index f792516..34a61bc 100644 --- a/selinux-policy/tlshd-and-similar/main.fmf +++ b/selinux-policy/tlshd-and-similar/main.fmf @@ -31,9 +31,10 @@ tag: link: - verifies: https://issues.redhat.com/browse/RHEL-29439 - verifies: https://issues.redhat.com/browse/RHEL-42672 + - verifies: https://issues.redhat.com/browse/RHEL-74424 adjust: - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8 because: the ktls-utils package is not available there extra-summary: /CoreOS/selinux-policy/Regression/tlshd-and-similar extra-task: /CoreOS/selinux-policy/Regression/tlshd-and-similar diff --git a/selinux-policy/tlshd-and-similar/runtest.sh b/selinux-policy/tlshd-and-similar/runtest.sh index 4a2fc48..bf67f0e 100755 --- a/selinux-policy/tlshd-and-similar/runtest.sh +++ b/selinux-policy/tlshd-and-similar/runtest.sh @@ -70,6 +70,24 @@ rlJournalStart rlSESearchRule "type_transition init_t ${FILE_CONTEXT} : process ${PROCESS_CONTEXT}" rlPhaseEnd + if rlSEDefined "ktlshd_t" ; then + rlPhaseStartTest "RHEL-74424" + rlSEMatchPathCon "/etc/resolv.conf" "net_conf_t" + rlSEMatchPathCon "/etc/pki/tls/certs/ca-cert.pem" "cert_t" + rlRun "ls -Z /proc/net/if_inet6 | grep :proc_net_t" + rlRun "ls -Z /proc/sys/net/ipv6/conf/all/disable_ipv6 | grep :sysctl_net_t" + rlSESearchRule "allow ktlshd_t ktlshd_t : key { write } [ ]" + rlSESearchRule "allow ktlshd_t cert_t : dir { search } [ ]" + rlSESearchRule "allow ktlshd_t cert_t : file { getattr open read } [ ]" + rlSESearchRule "allow ktlshd_t net_conf_t : file { getattr open read } [ ]" + rlSESearchRule "allow ktlshd_t proc_net_t : lnk_file { read } [ ]" + rlSESearchRule "allow ktlshd_t ktlshd_t : netlink_route_socket { bind create getattr getopt nlmsg_read setopt } [ ]" + rlSESearchRule "allow ktlshd_t ktlshd_t : udp_socket { connect create getattr setopt } [ ]" + rlSESearchRule "allow ktlshd_t sysctl_net_t : dir { search } [ ]" + rlSESearchRule "allow ktlshd_t sysctl_net_t : file { getattr open read } [ ]" + rlPhaseEnd + fi + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 From d1fffc88e8232c24d79895b45f14ad213fee6124 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Fri, 14 Feb 2025 10:45:57 +0100 Subject: [PATCH 453/626] test if 'bootupctl adopt-and-update' works well Recent bootupd + bootupctl testing revealed that SELinux prevents the bootupd processes from the following actions: * removal of the /boot/bootupd-state.json file * execution of findmnt, mount, udevadm, grub2-install, lsblk commands * automatic transition into their SELinux domains The TC reproduces the situation on EFI configured machines. In order to support the adopt-and-update feature, I believe that SELinux policy should allow these actions. The TC looks for appropriate policy rules and file context patterns. The TC covers RHEL-66584 and RHEL-70849. --- selinux-policy/bootupd-and-similar/Makefile | 2 + selinux-policy/bootupd-and-similar/main.fmf | 2 + selinux-policy/bootupd-and-similar/runtest.sh | 77 ++++++++++++++++--- 3 files changed, 71 insertions(+), 10 deletions(-) diff --git a/selinux-policy/bootupd-and-similar/Makefile b/selinux-policy/bootupd-and-similar/Makefile index c7e9ff5..2134c06 100644 --- a/selinux-policy/bootupd-and-similar/Makefile +++ b/selinux-policy/bootupd-and-similar/Makefile @@ -67,6 +67,8 @@ $(METADATA): Makefile @echo "Bug: 2218106" >> $(METADATA) # Fedora rawhide @echo "Bug: RHEL-36289" >> $(METADATA) # RHEL-9 @echo "Bug: RHEL-39514" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-66584" >> $(METADATA) # RHEL-9 + @echo "Bug: RHEL-70849" >> $(METADATA) # RHEL-9 rhts-lint $(METADATA) diff --git a/selinux-policy/bootupd-and-similar/main.fmf b/selinux-policy/bootupd-and-similar/main.fmf index 54fa5e9..ef081b1 100644 --- a/selinux-policy/bootupd-and-similar/main.fmf +++ b/selinux-policy/bootupd-and-similar/main.fmf @@ -38,6 +38,8 @@ link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2218106 - verifies: https://issues.redhat.com/browse/RHEL-36289 - verifies: https://issues.redhat.com/browse/RHEL-39514 + - verifies: https://issues.redhat.com/browse/RHEL-66584 + - verifies: https://issues.redhat.com/browse/RHEL-70849 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8 diff --git a/selinux-policy/bootupd-and-similar/runtest.sh b/selinux-policy/bootupd-and-similar/runtest.sh index 7746e1a..73e5322 100755 --- a/selinux-policy/bootupd-and-similar/runtest.sh +++ b/selinux-policy/bootupd-and-similar/runtest.sh @@ -32,7 +32,11 @@ PACKAGE="selinux-policy" FILE_PATH="/usr/libexec/bootupd" SERVICE_PACKAGE="bootupd" -SERVICE_NAME="bootupd" +if rlIsFedora ; then + SERVICE_NAME="bootloader-update" +else + SERVICE_NAME="bootupd" +fi PROCESS_NAME="bootupd" if seinfo -t | grep -q bootupd ; then FILE_CONTEXT="bootupd_exec_t" @@ -70,37 +74,82 @@ rlJournalStart rlPhaseStartTest "bz#2218106" rlSEMatchPathCon "/usr/libexec/bootupd" "${FILE_CONTEXT}" - rlRun "ls -RlZ /boot/efi" + if [ -d /boot/efi ] ; then + rlRun "ls -aRlZ /boot/efi" + fi rlSESearchRule "allow ${PROCESS_CONTEXT} dosfs_t : dir { getattr search } [ ]" rlPhaseEnd rlPhaseStartTest "RHEL-36289 + RHEL-39514" rlSEMatchPathCon "/usr/libexec/bootupd" "${FILE_CONTEXT}" if [ -d /sys/firmware/efi/efivars ] ; then - rlRun "ls -RlZ /sys/firmware/efi/efivars" + rlRun "ls -aRlZ /sys/firmware/efi/efivars" fi rlSESearchRule "allow ${PROCESS_CONTEXT} efivarfs_t : dir { getattr search } [ ]" rlPhaseEnd - if [ -f /usr/lib/systemd/system/bootupd.service ] ; then + if rlSEDefined "bootupd_t" ; then + rlPhaseStartTest "RHEL-66584" + rlSEMatchPathCon "/boot/bootupd-state.json" "boot_t" + rlSESearchRule "allow bootupd_t boot_t : dir { write remove_name } [ ]" + rlSESearchRule "allow bootupd_t boot_t : file { unlink } [ ]" + rlSESearchRule "allow bootupd_t dosfs_t : dir { search } [ ]" + rlSESearchRule "allow bootupd_t dosfs_t : file { open } [ ]" + rlPhaseEnd + + rlPhaseStartTest "RHEL-70849" + rlSEMatchPathCon "/usr/bin/findmnt" "bin_t" + rlSEMatchPathCon "/usr/bin/lsblk" "bin_t" + rlSEMatchPathCon "/usr/bin/udevadm" "udev_exec_t" + rlSEMatchPathCon "/usr/bin/mount" "mount_exec_t" + rlSEMatchPathCon "/usr/sbin/grub2-install" "bootloader_exec_t" + rlSESearchRule "allow bootupd_t fixed_disk_device_t : blk_file { getattr } [ ]" + rlSESearchRule "allow bootupd_t bin_t : file { execute execute_no_trans map } [ ]" + rlSESearchRule "allow bootupd_t sysfs_t : dir { read } [ ]" + rlSESearchRule "allow bootupd_t sysfs_t : file { getattr open read } [ ]" + rlSESearchRule "allow bootupd_t sysfs_t : lnk_file { read } [ ]" + rlSESearchRule "allow bootupd_t cert_t : dir { getattr open read search } [ ]" + rlSESearchRule "allow bootupd_t cert_t : file { getattr open read } [ ]" + + rlSESearchRule "allow bootupd_t udev_exec_t : file { getattr open read map execute } [ ]" + rlSESearchRule "type_transition bootupd_t udev_exec_t : process udev_t" + rlSESearchRule "allow bootupd_t udev_t : process { transition } [ ]" + + rlSESearchRule "allow bootupd_t mount_exec_t : file { getattr open read map execute } [ ]" + rlSESearchRule "type_transition bootupd_t mount_exec_t : process mount_t" + rlSESearchRule "allow bootupd_t mount_t : process { transition } [ ]" + + rlSESearchRule "allow bootupd_t bootloader_exec_t : file { getattr open read map execute } [ ]" + rlSESearchRule "type_transition bootupd_t bootloader_exec_t : process bootloader_t" + rlSESearchRule "allow bootupd_t bootloader_t : process { transition } [ ]" + rlPhaseEnd + fi + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" if ! rlSEDefined ${PROCESS_CONTEXT} ; then # for OSes where the SELinux domain does not exist yet PROCESS_CONTEXT="unconfined_service_t" fi - rlRun "systemctl start ${SERVICE_NAME}.socket" - rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /var /run -e /var/ARTIFACTS" 0-255 - rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 - rlRun "systemctl stop ${SERVICE_NAME}.socket" + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.socket ] ; then + rlRun "systemctl start ${SERVICE_NAME}.socket" + fi + rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /etc /var /run -e /var/ARTIFACTS" 0-255 + rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "restart status stop status" 1 + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.socket ] ; then + rlRun "systemctl stop ${SERVICE_NAME}.socket" + fi rlPhaseEnd fi - if [ -f /usr/lib/systemd/system/bootupd.socket ] ; then + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.socket ] ; then rlPhaseStartTest "real scenario -- ${SERVICE_NAME}.socket" rlRun "systemctl enable ${SERVICE_NAME}.socket" rlRun "systemctl start ${SERVICE_NAME}.socket" sleep 1 + rlRun "rm -f /boot/bootupd-state.json" + rlRun "bootupctl adopt-and-update" 0,1 rlRun "bootupctl status" 0,1 rlRun "bootupctl validate" 0,1 rlRun "lsblk" @@ -109,6 +158,14 @@ rlJournalStart rlPhaseEnd fi + rlPhaseStartTest "real scenario without the service or the socket" + rlRun "rm -f /boot/bootupd-state.json" + rlRun "bootupctl adopt-and-update" 0,1 + rlRun "bootupctl status" 0,1 + rlRun "bootupctl validate" 0,1 + rlRun "lsblk" + rlPhaseEnd + rlPhaseStartCleanup sleep 2 rlSECheckAVC From 3d1e1a1ca38943c706d99ca5e3bae5780136621c Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Mon, 24 Feb 2025 14:54:14 +0100 Subject: [PATCH 454/626] increase the duration of tests which timed out There are booth commands which may stall the automated test execution. Let's run them with a 20 second deadline. There are other tests which need more time to finish when executed on slower machines. Their duration got extended. --- libsemanage/sanity-tests/Makefile | 2 +- libsemanage/sanity-tests/main.fmf | 2 +- libsemanage/semanage-seuser-functions/Makefile | 2 +- libsemanage/semanage-seuser-functions/main.fmf | 2 +- policycoreutils/linux-system-roles.selinux-tests/Makefile | 2 +- policycoreutils/linux-system-roles.selinux-tests/main.fmf | 2 +- policycoreutils/org-selinux-dbus-interfaces/Makefile | 2 +- policycoreutils/org-selinux-dbus-interfaces/main.fmf | 2 +- selinux-policy/boothd-and-similar/runtest.sh | 6 +++--- 9 files changed, 11 insertions(+), 11 deletions(-) diff --git a/libsemanage/sanity-tests/Makefile b/libsemanage/sanity-tests/Makefile index 23ef6ac..3d8ffa9 100644 --- a/libsemanage/sanity-tests/Makefile +++ b/libsemanage/sanity-tests/Makefile @@ -51,7 +51,7 @@ $(METADATA): Makefile @echo "Path: $(TEST_DIR)" >> $(METADATA) @echo "Description: Test libsemanage functions" >> $(METADATA) @echo "Type: Sanity" >> $(METADATA) - @echo "TestTime: 60m" >> $(METADATA) + @echo "TestTime: 2h" >> $(METADATA) @echo "RunFor: libsemanage" >> $(METADATA) @echo "Requires: libsemanage libsemanage-devel gcc CUnit CUnit-devel checkpolicy policycoreutils-python-utils" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) diff --git a/libsemanage/sanity-tests/main.fmf b/libsemanage/sanity-tests/main.fmf index 0f8b6c8..a73ec48 100644 --- a/libsemanage/sanity-tests/main.fmf +++ b/libsemanage/sanity-tests/main.fmf @@ -11,7 +11,7 @@ recommend: - CUnit-devel - checkpolicy - policycoreutils-python-utils -duration: 60m +duration: 2h enabled: true tag: - CI-Tier-1 diff --git a/libsemanage/semanage-seuser-functions/Makefile b/libsemanage/semanage-seuser-functions/Makefile index d7202f4..4fbfa60 100644 --- a/libsemanage/semanage-seuser-functions/Makefile +++ b/libsemanage/semanage-seuser-functions/Makefile @@ -51,7 +51,7 @@ $(METADATA): Makefile @echo "Path: $(TEST_DIR)" >> $(METADATA) @echo "Description: Test semanage_seuser_* functions" >> $(METADATA) @echo "Type: Sanity" >> $(METADATA) - @echo "TestTime: 5m" >> $(METADATA) + @echo "TestTime: 15m" >> $(METADATA) @echo "RunFor: libsemanage" >> $(METADATA) @echo "Requires: libsemanage libsemanage-devel glibc gcc" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) diff --git a/libsemanage/semanage-seuser-functions/main.fmf b/libsemanage/semanage-seuser-functions/main.fmf index 5d42be0..be3d129 100644 --- a/libsemanage/semanage-seuser-functions/main.fmf +++ b/libsemanage/semanage-seuser-functions/main.fmf @@ -10,7 +10,7 @@ recommend: - libsemanage-devel - glibc - gcc -duration: 5m +duration: 15m enabled: true tag: - NoRHEL4 diff --git a/policycoreutils/linux-system-roles.selinux-tests/Makefile b/policycoreutils/linux-system-roles.selinux-tests/Makefile index eed0222..15c1ff0 100644 --- a/policycoreutils/linux-system-roles.selinux-tests/Makefile +++ b/policycoreutils/linux-system-roles.selinux-tests/Makefile @@ -50,7 +50,7 @@ $(METADATA): Makefile @echo "Path: $(TEST_DIR)" >> $(METADATA) @echo "Description: Run linux-system-roles.selinux (https://github.com/linux-system-roles/selinux.git) Ansible role tests" >> $(METADATA) @echo "Type: Sanity" >> $(METADATA) - @echo "TestTime: 10m" >> $(METADATA) + @echo "TestTime: 40m" >> $(METADATA) @echo "RunFor: policycoreutils" >> $(METADATA) @echo "Requires: policycoreutils ansible git" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) diff --git a/policycoreutils/linux-system-roles.selinux-tests/main.fmf b/policycoreutils/linux-system-roles.selinux-tests/main.fmf index b0a8910..9588ced 100644 --- a/policycoreutils/linux-system-roles.selinux-tests/main.fmf +++ b/policycoreutils/linux-system-roles.selinux-tests/main.fmf @@ -9,6 +9,6 @@ recommend: - policycoreutils - ansible - git -duration: 20m +duration: 40m extra-summary: linux-system-roles.selinux-tests extra-task: linux-system-roles.selinux-tests diff --git a/policycoreutils/org-selinux-dbus-interfaces/Makefile b/policycoreutils/org-selinux-dbus-interfaces/Makefile index 6756710..6f00b43 100644 --- a/policycoreutils/org-selinux-dbus-interfaces/Makefile +++ b/policycoreutils/org-selinux-dbus-interfaces/Makefile @@ -51,7 +51,7 @@ $(METADATA): Makefile @echo "Path: $(TEST_DIR)" >> $(METADATA) @echo "Description: Do the D-bus interfaces/methods of /org/selinux/object work as expected?" >> $(METADATA) @echo "Type: Sanity" >> $(METADATA) - @echo "TestTime: 10m" >> $(METADATA) + @echo "TestTime: 20m" >> $(METADATA) @echo "RunFor: policycoreutils" >> $(METADATA) @echo "Requires: dbus-tools policycoreutils-dbus selinux-policy-minimum selinux-policy-mls selinux-policy-targeted" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) diff --git a/policycoreutils/org-selinux-dbus-interfaces/main.fmf b/policycoreutils/org-selinux-dbus-interfaces/main.fmf index 40a568b..a9f924f 100644 --- a/policycoreutils/org-selinux-dbus-interfaces/main.fmf +++ b/policycoreutils/org-selinux-dbus-interfaces/main.fmf @@ -9,7 +9,7 @@ recommend: - selinux-policy-minimum - selinux-policy-mls - selinux-policy-targeted -duration: 10m +duration: 20m enabled: true tag: - NoRHEL4 diff --git a/selinux-policy/boothd-and-similar/runtest.sh b/selinux-policy/boothd-and-similar/runtest.sh index 6c355b3..db907b6 100755 --- a/selinux-policy/boothd-and-similar/runtest.sh +++ b/selinux-policy/boothd-and-similar/runtest.sh @@ -86,9 +86,9 @@ rlJournalStart rlRun "sed -i 's/^arbitrator=.*$/arbitrator=\"${IP_ADDRESS}\"/' /etc/booth/booth.conf" rlRun "grep ^arbitrator /etc/booth/booth.conf" rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "start status" 1 - rlRun "booth list" - rlRun "booth status" - rlRun "booth peers" + rlWatchdog "booth list" 20 + rlWatchdog "booth status" 20 + rlWatchdog "booth peers" 20 rlRun "restorecon -Rv /etc /var /run -e /var/ARTIFACTS" 0-255 rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd From b4cacd7c55d92b8877fcb0c2d5bfe7c725106722 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 25 Feb 2025 11:20:07 +0100 Subject: [PATCH 455/626] improve tests which fail because of conflicts There are 2 tests which require conflicting packages. To run them successfully, the conflicting packages need to installed/removed in the right order. 2 additional tests got fixed too. --- selinux-policy/fwupd-and-similar/runtest.sh | 4 ++-- selinux-policy/power-profiles-daemon-and-similar/main.fmf | 1 - selinux-policy/power-profiles-daemon-and-similar/runtest.sh | 6 +++++- selinux-policy/rpm-suppress-stderr/test.sh | 2 ++ selinux-policy/tuned-ppd-and-similar/main.fmf | 3 ++- selinux-policy/tuned-ppd-and-similar/runtest.sh | 5 ++++- 6 files changed, 15 insertions(+), 6 deletions(-) diff --git a/selinux-policy/fwupd-and-similar/runtest.sh b/selinux-policy/fwupd-and-similar/runtest.sh index f150b15..7881022 100755 --- a/selinux-policy/fwupd-and-similar/runtest.sh +++ b/selinux-policy/fwupd-and-similar/runtest.sh @@ -82,7 +82,7 @@ rlJournalStart # RHEL-4, RHEL-5, RHEL-6 is excluded PROCESS_CONTEXT="unconfined_service_t" fi - rlRun "gdbus introspect --system --object-path / --dest ${DESTINATION} >& /dev/null" + rlRun "gdbus introspect --system --object-path / --dest ${DESTINATION} >& /dev/null" 0,1 sleep 1 rlRun "ps -efZ | grep -v grep | grep ${PROCESS_NAME}" rlRun "ps -efZ | grep -v grep | grep \"${PROCESS_CONTEXT}.*${PROCESS_NAME}\"" @@ -96,7 +96,7 @@ rlJournalStart PROCESS_CONTEXT="unconfined_service_t" fi rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 + rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd diff --git a/selinux-policy/power-profiles-daemon-and-similar/main.fmf b/selinux-policy/power-profiles-daemon-and-similar/main.fmf index 9b522b0..f46c363 100644 --- a/selinux-policy/power-profiles-daemon-and-similar/main.fmf +++ b/selinux-policy/power-profiles-daemon-and-similar/main.fmf @@ -16,7 +16,6 @@ recommend: - selinux-policy - selinux-policy-targeted - setools-console - - power-profiles-daemon - python3-gobject-base - /usr/sbin/service environment: diff --git a/selinux-policy/power-profiles-daemon-and-similar/runtest.sh b/selinux-policy/power-profiles-daemon-and-similar/runtest.sh index ee54652..6c5561a 100755 --- a/selinux-policy/power-profiles-daemon-and-similar/runtest.sh +++ b/selinux-policy/power-profiles-daemon-and-similar/runtest.sh @@ -31,6 +31,7 @@ PACKAGE="selinux-policy" FILE_PATH="/usr/libexec/power-profiles-daemon" +SERVICE_PACKAGE="power-profiles-daemon" SERVICE_NAME="power-profiles-daemon" PROCESS_NAME="power-profiles-daemon" if seinfo -t | grep -q powerprofile ; then @@ -50,7 +51,10 @@ rlJournalStart rlPhaseStartSetup rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESatisfyRequires + if rpm -q tuned-ppd ; then + rlRun "yum -y remove tuned-ppd" + fi + rlRun "yum -y install ${SERVICE_PACKAGE}" rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted rlRun "rpm -qf ${FILE_PATH}" diff --git a/selinux-policy/rpm-suppress-stderr/test.sh b/selinux-policy/rpm-suppress-stderr/test.sh index 2fd8fd1..37c2846 100755 --- a/selinux-policy/rpm-suppress-stderr/test.sh +++ b/selinux-policy/rpm-suppress-stderr/test.sh @@ -43,6 +43,8 @@ rlJournalStart rlRun "fuse-overlayfs -o lowerdir=$tmp/lower/ -o upperdir=$tmp/upper/ -o workdir=$tmp/work/ $tmp/merged/" RPMS=$(ls $tmp/merged/ | grep .rpm | xargs) rlRun "chroot $tmp/merged/ /usr/bin/rpm -i $RPMS 2> error.log" + # warnings can be ignored/removed + rlRun "sed -i 's/^warning.*$//' error.log" rlAssert0 "error.log should be empty" `stat -c "%s" error.log` rlRun "cat error.log" rlRun "fusermount -u $tmp/merged/" diff --git a/selinux-policy/tuned-ppd-and-similar/main.fmf b/selinux-policy/tuned-ppd-and-similar/main.fmf index add067b..9d92b40 100644 --- a/selinux-policy/tuned-ppd-and-similar/main.fmf +++ b/selinux-policy/tuned-ppd-and-similar/main.fmf @@ -15,7 +15,6 @@ recommend: - selinux-policy - selinux-policy-targeted - setools-console - - tuned-ppd - /usr/sbin/service environment: AVC_ERROR: +no_avc_check @@ -37,3 +36,5 @@ adjust: because: the tuned-ppd package is not available there extra-summary: /CoreOS/selinux-policy/Regression/tuned-ppd-and-similar extra-task: /CoreOS/selinux-policy/Regression/tuned-ppd-and-similar +extra-nitrate: TC#0618543 +id: 58ffbde5-91ba-44e8-8faf-039f1043a503 diff --git a/selinux-policy/tuned-ppd-and-similar/runtest.sh b/selinux-policy/tuned-ppd-and-similar/runtest.sh index 952ba81..7c16a30 100755 --- a/selinux-policy/tuned-ppd-and-similar/runtest.sh +++ b/selinux-policy/tuned-ppd-and-similar/runtest.sh @@ -51,7 +51,10 @@ rlJournalStart rlPhaseStartSetup rlRun "rlImport 'selinux-policy/common'" 0,1 - rlSESatisfyRequires + if rpm -q power-profiles-daemon ; then + rlRun "yum -y remove power-profiles-daemon" + fi + rlRun "yum -y install ${SERVICE_PACKAGE}" rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted rlAssertRpm ${SERVICE_PACKAGE} From a310ff9f85e85cbaafd58df5b1e31673eaa64146 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Wed, 26 Feb 2025 09:03:51 +0100 Subject: [PATCH 456/626] fix tests which fail in other environments The modified tests were failing because: * the running restorecond service causes problems to the subsequent tests * an irrelevant bug was tested * the bind component is available in multiple versions * rpm output contained unnecessary whitespaces These issues should be fixed now. --- policycoreutils/restorecond_pointer_abuse/runtest.sh | 3 ++- selinux-policy/boothd-and-similar/runtest.sh | 2 ++ .../bz562833-chrooted-named-file-contexts/runtest.sh | 4 ++-- selinux-policy/rpm-suppress-stderr/test.sh | 3 +++ 4 files changed, 9 insertions(+), 3 deletions(-) diff --git a/policycoreutils/restorecond_pointer_abuse/runtest.sh b/policycoreutils/restorecond_pointer_abuse/runtest.sh index 2056c98..57463a3 100755 --- a/policycoreutils/restorecond_pointer_abuse/runtest.sh +++ b/policycoreutils/restorecond_pointer_abuse/runtest.sh @@ -80,8 +80,9 @@ rlJournalStart rlPhaseStartCleanup rlRun "rlFileRestore" 0 - rlServiceRestore restorecond + rlServiceStop restorecond rm -f ${OUTPUT_FILE} rlPhaseEnd rlJournalPrintText rlJournalEnd + diff --git a/selinux-policy/boothd-and-similar/runtest.sh b/selinux-policy/boothd-and-similar/runtest.sh index db907b6..213acb1 100755 --- a/selinux-policy/boothd-and-similar/runtest.sh +++ b/selinux-policy/boothd-and-similar/runtest.sh @@ -72,7 +72,9 @@ rlJournalStart rlPhaseStartTest "RHEL-57104 + RHEL-58060" rlSESearchRule "allow boothd_t kernel_t : unix_stream_socket { connectto } [ ]" rlPhaseEnd + fi + if ! rlIsRHEL 8 9 && ! rlIsCentOS 8 9 ; then rlPhaseStartTest "RHEL-75471" rlSESearchRule "allow boothd_t systemd_machined_t : unix_stream_socket { connectto } [ ]" rlPhaseEnd diff --git a/selinux-policy/bz562833-chrooted-named-file-contexts/runtest.sh b/selinux-policy/bz562833-chrooted-named-file-contexts/runtest.sh index 7b6ddd4..074f2bb 100755 --- a/selinux-policy/bz562833-chrooted-named-file-contexts/runtest.sh +++ b/selinux-policy/bz562833-chrooted-named-file-contexts/runtest.sh @@ -38,7 +38,7 @@ rlJournalStart rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted - rlAssertRpm bind + rlRun "rpm -qa | grep bind | sort" rlServiceStop ` rlSEListServices 53 ` rlFileBackup /etc/shadow @@ -222,7 +222,7 @@ rlJournalStart rlRun "getsebool -a | grep named" rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" rlSEService ${ROOT_PASSWORD} named named named_t "start status" 1 - rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 + rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 rlRun "runcon system_u:system_r:initrc_t:s0 bash -c 'rndc querylog'" rlRun "runcon system_u:system_r:initrc_t:s0 bash -c 'rndc dumpdb'" rlRun "runcon system_u:system_r:initrc_t:s0 bash -c 'rndc tsig-list'" diff --git a/selinux-policy/rpm-suppress-stderr/test.sh b/selinux-policy/rpm-suppress-stderr/test.sh index 37c2846..17a537f 100755 --- a/selinux-policy/rpm-suppress-stderr/test.sh +++ b/selinux-policy/rpm-suppress-stderr/test.sh @@ -45,6 +45,9 @@ rlJournalStart rlRun "chroot $tmp/merged/ /usr/bin/rpm -i $RPMS 2> error.log" # warnings can be ignored/removed rlRun "sed -i 's/^warning.*$//' error.log" + # whitespaces can be ignored/removed + rlRun "sed -i 's/^[[:space:]]*$//' error.log" + rlRun "sed -i '/^$/d' error.log" rlAssert0 "error.log should be empty" `stat -c "%s" error.log` rlRun "cat error.log" rlRun "fusermount -u $tmp/merged/" From dbbbfb5d2c528039438b3e25f569bb375267dd75 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 4 Mar 2025 10:36:27 +0100 Subject: [PATCH 457/626] fix tests which fail or cause other tests to fail The modified tests used to fail on RHEL-10 or they caused other tests to fail on RHEL-10. The reasons are various: * dependency on SELinux types which are no longer defined * insufficient test cleanup * unexpected exit codes * virtual vs. bare metal environment differences These problems should be fixed now. --- policycoreutils/sepolicy-manpage/main.fmf | 1 + policycoreutils/sepolicy-manpage/runtest.sh | 13 +++++++++---- selinux-policy/boothd-and-similar/runtest.sh | 1 + selinux-policy/cockpit-ws-and-similar/runtest.sh | 2 +- selinux-policy/firewalld-and-similar/runtest.sh | 2 ++ .../install-uninstall-dsp-packages/main.fmf | 2 ++ .../pcm-sensor-server-and-similar/Makefile | 2 +- .../pcm-sensor-server-and-similar/main.fmf | 1 + .../pcm-sensor-server-and-similar/runtest.sh | 6 ++++++ .../systemd-modules-load-and-similar/runtest.sh | 2 +- selinux-policy/virt-install-additional/runtest.sh | 2 +- 11 files changed, 26 insertions(+), 8 deletions(-) diff --git a/policycoreutils/sepolicy-manpage/main.fmf b/policycoreutils/sepolicy-manpage/main.fmf index a342f92..107bf51 100644 --- a/policycoreutils/sepolicy-manpage/main.fmf +++ b/policycoreutils/sepolicy-manpage/main.fmf @@ -6,6 +6,7 @@ component: framework: beakerlib recommend: - /usr/bin/sepolicy + - setools-console duration: 1h enabled: true tier: 3 diff --git a/policycoreutils/sepolicy-manpage/runtest.sh b/policycoreutils/sepolicy-manpage/runtest.sh index 6fe835a..5c0f22b 100755 --- a/policycoreutils/sepolicy-manpage/runtest.sh +++ b/policycoreutils/sepolicy-manpage/runtest.sh @@ -17,7 +17,12 @@ rlJournalStart rlPhaseEnd rlPhaseStartTest "sepolicy manpage --web, bz#1854639 + bz#1989840" - rlRun "sepolicy manpage --web -d zebra_t" + if seinfo -a domain -x | grep -q zebra ; then + DOMAIN_PREFIX="zebra" + else + DOMAIN_PREFIX="xserver" + fi + rlRun "sepolicy manpage --web -d ${DOMAIN_PREFIX}_t" if rlIsRHEL 7 8 || rlIsCentOS 7 8 ; then rlRun "ls -l /tmp/*release*" 0 "Html file with OS name exists." rlRun "cat /tmp/*release* > /tmp/testfile" @@ -25,12 +30,12 @@ rlJournalStart rlRun "ls -l /tmp/index.html" 0 "HTML file exists" rlRun "cat /tmp/index.html > /tmp/testfile" fi - rlAssertGrep "href=zebra.html" "/tmp/testfile" - rlRun "ls -l /tmp/zebra.html" + rlAssertGrep "href=${DOMAIN_PREFIX}.html" "/tmp/testfile" + rlRun "ls -l /tmp/${DOMAIN_PREFIX}.html" rlPhaseEnd rlPhaseStartCleanup - rlRun "rm -f /tmp/zebra* /tmp/index.html /tmp/*release*" + rlRun "rm -f /tmp/${DOMAIN_PREFIX}* /tmp/index.html /tmp/*release*" rlPhaseEnd rlJournalEnd diff --git a/selinux-policy/boothd-and-similar/runtest.sh b/selinux-policy/boothd-and-similar/runtest.sh index 213acb1..ad7948e 100755 --- a/selinux-policy/boothd-and-similar/runtest.sh +++ b/selinux-policy/boothd-and-similar/runtest.sh @@ -100,6 +100,7 @@ rlJournalStart sleep 2 rlSECheckAVC rlFileRestore + rlRun "service systemd-machined stop" rlServiceRestore ${SERVICE_NAME} rlPhaseEnd rlJournalPrintText diff --git a/selinux-policy/cockpit-ws-and-similar/runtest.sh b/selinux-policy/cockpit-ws-and-similar/runtest.sh index 9ee500c..e111a41 100755 --- a/selinux-policy/cockpit-ws-and-similar/runtest.sh +++ b/selinux-policy/cockpit-ws-and-similar/runtest.sh @@ -111,7 +111,7 @@ rlJournalStart rlPhaseStartTest "bz#1413509" rlSEMatchPathCon "/usr/libexec/cockpit-ws" "cockpit_ws_exec_t" - rlSEMatchPathCon "/usr/libexec/cockpit-ssh" "cockpit_session_exec_t" + rlSEMatchPathCon "/usr/libexec/cockpit-session" "cockpit_session_exec_t" rlSEMatchPathCon "/var/lib/cockpit" "cockpit_var_lib_t" rlSEMatchPortCon tcp 22 ssh_port_t rlSESearchRule "allow cockpit_ws_t cockpit_session_exec_t : file { getattr open read execute }" diff --git a/selinux-policy/firewalld-and-similar/runtest.sh b/selinux-policy/firewalld-and-similar/runtest.sh index 58d6f4f..df7586f 100755 --- a/selinux-policy/firewalld-and-similar/runtest.sh +++ b/selinux-policy/firewalld-and-similar/runtest.sh @@ -75,10 +75,12 @@ rlJournalStart done rlPhaseEnd + if rlSEDefined "puppetagent_t" ; then rlPhaseStartTest "bz#1214853" rlSESearchRule "allow firewalld_t puppetagent_t : dbus { send_msg }" rlSESearchRule "allow puppetagent_t firewalld_t : dbus { send_msg }" rlPhaseEnd + fi rlPhaseStartTest "bz#1221326" rlSESearchRule "allow firewalld_t openshift_initrc_t : dbus { send_msg }" diff --git a/selinux-policy/install-uninstall-dsp-packages/main.fmf b/selinux-policy/install-uninstall-dsp-packages/main.fmf index 84dcf79..7fee6cc 100644 --- a/selinux-policy/install-uninstall-dsp-packages/main.fmf +++ b/selinux-policy/install-uninstall-dsp-packages/main.fmf @@ -28,6 +28,8 @@ tag: - failinfedora - targeted - NoRHIVOS + - rhel9_broken + - rhel10_broken link: adjust: - enabled: false diff --git a/selinux-policy/pcm-sensor-server-and-similar/Makefile b/selinux-policy/pcm-sensor-server-and-similar/Makefile index df8f7dc..09892d4 100644 --- a/selinux-policy/pcm-sensor-server-and-similar/Makefile +++ b/selinux-policy/pcm-sensor-server-and-similar/Makefile @@ -55,7 +55,7 @@ $(METADATA): Makefile @echo "TestTime: 10m" >> $(METADATA) @echo "RunFor: pcm" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console pcm /usr/sbin/service" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console pcm /usr/sbin/service virt-what" >> $(METADATA) @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) diff --git a/selinux-policy/pcm-sensor-server-and-similar/main.fmf b/selinux-policy/pcm-sensor-server-and-similar/main.fmf index 4abbd17..3476274 100644 --- a/selinux-policy/pcm-sensor-server-and-similar/main.fmf +++ b/selinux-policy/pcm-sensor-server-and-similar/main.fmf @@ -18,6 +18,7 @@ recommend: - setools-console - pcm - /usr/sbin/service + - virt-what environment: AVC_ERROR: +no_avc_check duration: 10m diff --git a/selinux-policy/pcm-sensor-server-and-similar/runtest.sh b/selinux-policy/pcm-sensor-server-and-similar/runtest.sh index 8bcf9a3..eab7a09 100755 --- a/selinux-policy/pcm-sensor-server-and-similar/runtest.sh +++ b/selinux-policy/pcm-sensor-server-and-similar/runtest.sh @@ -63,6 +63,11 @@ rlJournalStart sleep 2 rlPhaseEnd + rm -f output.txt + virt-what >& output.txt + if [ -s output.txt ] ; then + echo "Running on a virtual machine -- ${SERVICE_NAME} does not like that" + else rlPhaseStartTest "real scenario -- standalone service" rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 rlRun "pcm-iio 1.0 -i=1" @@ -73,6 +78,7 @@ rlJournalStart rlRun "pcm-lspci" rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "stop status" 1 rlPhaseEnd + fi rlPhaseStartCleanup sleep 2 diff --git a/selinux-policy/systemd-modules-load-and-similar/runtest.sh b/selinux-policy/systemd-modules-load-and-similar/runtest.sh index 9288bb6..8b7172c 100755 --- a/selinux-policy/systemd-modules-load-and-similar/runtest.sh +++ b/selinux-policy/systemd-modules-load-and-similar/runtest.sh @@ -124,7 +124,7 @@ rlJournalStart rlPhaseStartTest "bz#1942267" tst_Time="$(date '+%T')" # Install kernel-module matching the running kernel version - rlRun "dnf -y install kernel-modules-$(uname -r)" + rlRun "dnf -y install kernel-modules-$(uname -r)" 0,1 rlRun "systemctl start rdma-load-modules@rdma.service" rlRun "systemctl status rdma-load-modules@rdma.service" rlRun "lsmod | grep rdma" diff --git a/selinux-policy/virt-install-additional/runtest.sh b/selinux-policy/virt-install-additional/runtest.sh index 8773acf..ccb456f 100755 --- a/selinux-policy/virt-install-additional/runtest.sh +++ b/selinux-policy/virt-install-additional/runtest.sh @@ -33,7 +33,7 @@ PACKAGE="selinux-policy" rlJournalStart rlPhaseStartSetup - rlRun "rlImport 'selinux-policy/common'" + rlRun "rlImport 'selinux-policy/common'" 0,1 rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted From d55f7ad6aec7dce0818851e44891a0eb1b163327 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Mon, 10 Mar 2025 12:20:06 +0100 Subject: [PATCH 458/626] setsebool: Do not test aliases for non-existing booleans In CentOS Stream 10 some modules were moved from selinux-policy to selinux-policy-epel which is available only in EPEL. It caused problem with non-existing booleans and their aliases. With this change, an alias is not checked when a new boolean does not exist. Fixes: Error getting active value for puppet_manage_all_files [ PASS ] :: Command 'getsebool puppet_manage_all_files 2>&1 | tee /tmp/tmp.nx2NlWq1zd' (Expected 0, got 0) [ BEGIN ] :: Running 'getsebool puppetagent_manage_all_files 2>&1 | tee -a /tmp/tmp.nx2NlWq1zd' Error getting active value for puppetagent_manage_all_files [ PASS ] :: Command 'getsebool puppetagent_manage_all_files 2>&1 | tee -a /tmp/tmp.nx2NlWq1zd' (Expected 0, got 0) [ BEGIN ] :: Running 'uniq -c /tmp/tmp.nx2NlWq1zd | grep '2 '' [ FAIL ] :: Command 'uniq -c /tmp/tmp.nx2NlWq1zd | grep '2 '' (Expected 0, got 1) --- policycoreutils/setsebool/runtest.sh | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/policycoreutils/setsebool/runtest.sh b/policycoreutils/setsebool/runtest.sh index 8678b1b..04878f9 100755 --- a/policycoreutils/setsebool/runtest.sh +++ b/policycoreutils/setsebool/runtest.sh @@ -114,9 +114,14 @@ rlJournalStart for LINE in `cat /etc/selinux/*/booleans.subs_dist | sort | uniq | tr -s ' ' | tr ' ' ':'` ; do OLD_BOOLEAN_NAME=`echo ${LINE} | cut -d : -f 1` NEW_BOOLEAN_NAME=`echo ${LINE} | cut -d : -f 2` - rlRun "getsebool ${OLD_BOOLEAN_NAME} 2>&1 | tee ${OUTPUT_FILE}" - rlRun "getsebool ${NEW_BOOLEAN_NAME} 2>&1 | tee -a ${OUTPUT_FILE}" - rlRun "uniq -c ${OUTPUT_FILE} | grep '2 '" + # do not test this if the new boolean does not exist in the policy + if getsebool ${NEW_BOOLEAN_NAME} &> /dev/null; then + rlRun "getsebool ${OLD_BOOLEAN_NAME} 2>&1 | tee ${OUTPUT_FILE}" + rlRun "getsebool ${NEW_BOOLEAN_NAME} 2>&1 | tee -a ${OUTPUT_FILE}" + rlRun "uniq -c ${OUTPUT_FILE} | grep '2 '" + else + rlLog "$NEW_BOOLEAN_NAME does not exist, skip" + fi done rlPhaseEnd fi From b1adfa9c2b086ecd200069e43c0f201ceeb63994 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Sat, 8 Mar 2025 11:59:47 +0100 Subject: [PATCH 459/626] selinux-policy/policy-rpm-macros: Use our version https://github.com/fedora-selinux/selinux-policy-macros has not been touched for years and it will obsoleted soon. With this update: - add runtest.sh from fedora-selinux/selinux-policy-macros as this repository and rename it to selinux-policy-macros.runtest.sh - update selinux-policy-macros.runtest.sh to use MACRO_FILE env variable if exists - update runtest.sh to export MACRO_FILE variable so that both tests use the same file - use ssh_sysadm_login instead of zabbix_... boolean as zabbix is in EPEL in RHEL like repositories --- selinux-policy/policy-rpm-macros/runtest.sh | 14 +- .../selinux-policy-macros.runtest.sh | 262 ++++++++++++++++++ 2 files changed, 266 insertions(+), 10 deletions(-) create mode 100755 selinux-policy/policy-rpm-macros/selinux-policy-macros.runtest.sh diff --git a/selinux-policy/policy-rpm-macros/runtest.sh b/selinux-policy/policy-rpm-macros/runtest.sh index 7be30c1..2460ddb 100755 --- a/selinux-policy/policy-rpm-macros/runtest.sh +++ b/selinux-policy/policy-rpm-macros/runtest.sh @@ -31,6 +31,7 @@ PACKAGE="selinux-policy" MACRO_FILE="/usr/lib/rpm/macros.d/macros.selinux-policy" +export MACRO_FILE rlJournalStart rlPhaseStartSetup @@ -50,16 +51,9 @@ rlJournalStart rlRun "grep selinuxenabled ${MACRO_FILE} | grep /usr/sbin/" 1 rlPhaseEnd - rlPhaseStartTest "download and prepare the upstream test" - rlRun "git clone https://github.com/fedora-selinux/selinux-policy-macros.git" - rlRun "rm -f selinux-policy-macros/macros.selinux-policy" - rlRun "cp /usr/lib/rpm/macros.d/macros.selinux-policy selinux-policy-macros/" - rlPhaseEnd - - pushd selinux-policy-macros - # running an upstream test written by Petr Lautrbach, thanks - ./runtest.sh - popd + # originally test from https://github.com/fedora-selinux/selinux-policy-macros + # now shipped with this test + ./selinux-policy-macros.runtest.sh rlPhaseStartCleanup rlRun "rm -rf selinux-policy-macros" diff --git a/selinux-policy/policy-rpm-macros/selinux-policy-macros.runtest.sh b/selinux-policy/policy-rpm-macros/selinux-policy-macros.runtest.sh new file mode 100755 index 0000000..7ae2d68 --- /dev/null +++ b/selinux-policy/policy-rpm-macros/selinux-policy-macros.runtest.sh @@ -0,0 +1,262 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of ipp +# Description: Tests for IPP scriptlets +# Author: Petr Lautrbach +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (C) 2017 Red Hat, Inc. All rights reserved. +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include the BeakerLib environment +. /usr/share/beakerlib/beakerlib.sh + +# Set SELinux store +if rlIsRHEL "<=7" || rlIsCentOS "<=7"; then + SELINUXSTOREPATH=/etc/selinux +else + SELINUXSTOREPATH=/var/lib/selinux +fi + +# Set the full test name +TEST="IPP" + +# Package being tested +PACKAGE="IPP" + +MACRO_FILE=${MACRO_FILE:-/usr/lib/rpm/macros.d/macros.selinux-policy} + +set_booleans() { + rlRun "rpm --eval '%selinux_set_booleans -s targeted $*' > run_selinux_set_booleans.sh" 0 + rlRun "bash run_selinux_set_booleans.sh" +} + +unset_booleans() { + rlRun "rpm --eval '%selinux_unset_booleans -s targeted $*' > run_selinux_unset_booleans.sh" 0 + rlRun "bash run_selinux_unset_booleans.sh" +} + + +rlJournalStart + rlPhaseStartSetup "Setup" + rlRun "rlFileBackup --clean ~/.rpmmacros" 0,1 "Backing up ~/.rpmmacros" + rlRun "sed 's|SELINUXSTOREPATH|$SELINUXSTOREPATH|' ${MACRO_FILE} >> ~/.rpmmacros" 0 "Updating ~/.rpmmacros" + rlRun "rlFileBackup --clean ${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" 0,1 "Backing up ${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" + rlRun "rm ${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" 0,1 "Updating ~/.rpmmacros" + rlRun 'TmpDir=$(mktemp -d)' 0 + pushd $TmpDir + rlRun "semanage boolean -E > boolean.import" 0 "Backup local boolean modifications" + rlRun "semanage boolean -D" 0 "Drop local boolean modifications" + rlPhaseEnd + + rlPhaseStartTest "Test install on a clean system" + set_booleans secure_mode=1 secure_mode_insmod=1 + + rlRun "semanage boolean -E > boolean.local" + # test if local changes are applied + rlAssertGrep 'boolean -m \(-1\|--on\) secure_mode' "boolean.local" + rlAssertGrep 'boolean -m \(-1\|--on\) secure_mode_insmod' "boolean.local" + # check the content of /var/lib/selinux/targeted/rpmbooleans.custom, should be almost empty + rlAssertNotGrep '\(-1\|--on\) secure_mode' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" + rlAssertNotGrep '\(-1\|--on\) secure_mode_insmod' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" + rlPhaseEnd + + rlPhaseStartTest "Test uninstall on a clean system" + unset_booleans secure_mode=0 secure_mode_insmod=0 + + # test if local changes are removed + rlRun "semanage boolean -E > boolean.local" + rlAssertNotGrep 'boolean -m \(-1\|--on\) secure_mode' "boolean.local" + rlAssertNotGrep 'boolean -m \(-1\|--on\) secure_mode_insmod' "boolean.local" + rlAssertNotGrep 'secure_mode' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" + rlRun "semanage boolean -m --off secure_mode" 0 "cleanup" + rlRun "semanage boolean -m --off secure_mode_insmod" 0 "cleanup" + rlRun "semanage boolean -D" 0 "cleanup" + rlPhaseEnd + + rlPhaseStartTest "Test install on a system with secure_mode is already on" + rlRun "semanage boolean -m --on secure_mode" 0 "Setting secure_mode=on" + + set_booleans secure_mode=1 secure_mode_insmod=1 + + rlRun "semanage boolean -E > boolean.local" + # test if local changes are applied + rlAssertGrep 'boolean -m \(-1\|--on\) secure_mode' "boolean.local" + rlAssertGrep 'boolean -m \(-1\|--on\) secure_mode_insmod' "boolean.local" + # check the content of /var/lib/selinux/targeted/rpmbooleans.custom, should be almost empty + rlAssertGrep '\(-1\|--on\) secure_mode' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" + rlAssertNotGrep '\(-1\|--on\) secure_mode_insmod' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" + rlPhaseEnd + + rlPhaseStartTest "Test uninstall on a system where secure_mode was on before install" + + unset_booleans secure_mode=0 secure_mode_insmod=0 + + # test if local changes are removed + rlRun "semanage boolean -E > boolean.local" + rlAssertGrep 'boolean -m \(-1\|--on\) secure_mode' "boolean.local" + rlAssertNotGrep 'boolean -m \(-1\|--on\) secure_mode_insmod' "boolean.local" + rlAssertNotGrep 'secure_mode' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" + + rlRun "semanage boolean -m --off secure_mode" 0 "cleanup" + rlRun "semanage boolean -m --off secure_mode_insmod" 0 "cleanup" + rlRun "semanage boolean -D" 0 "cleanup" + + rlPhaseEnd + + rlPhaseStartTest "Test install on a system with secure_mode was changed to off" + rlRun "semanage boolean -m --off secure_mode" 0 "Setting secure_mode=on" + + set_booleans secure_mode=1 secure_mode_insmod=1 + + rlRun "semanage boolean -E > boolean.local" + # test if local changes are applied + rlAssertGrep 'boolean -m \(-1\|--on\) secure_mode' "boolean.local" + rlAssertGrep 'boolean -m \(-1\|--on\) secure_mode_insmod' "boolean.local" + # check the content of /var/lib/selinux/targeted/rpmbooleans.custom, should be almost empty + rlAssertGrep '\(-0\|--off\) secure_mode' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" + rlAssertGrep '\(-0\|--off\) secure_mode_insmod' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" + rlPhaseEnd + + rlPhaseStartTest "Test uninstall on a system where secure_mode was on before install" + + unset_booleans secure_mode=0 secure_mode_insmod=0 + + # test if local changes are removed + rlRun "semanage boolean -E > boolean.local" + rlAssertGrep 'boolean -m \(-0\|--off\) secure_mode' "boolean.local" + rlAssertGrep 'boolean -m \(-0\|--off\) secure_mode_insmod' "boolean.local" + rlAssertNotGrep 'secure_mode' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" + + rlRun "semanage boolean -m --off secure_mode" 0 "cleanup" + rlRun "semanage boolean -m --off secure_mode_insmod" 0 "cleanup" + rlRun "semanage boolean -D" 0 "cleanup" + + rlPhaseEnd + +# ============ Install twice, remove once ====================== + + rlPhaseStartTest "Test install twice on a clean system" + set_booleans secure_mode=1 secure_mode_insmod=1 + set_booleans secure_mode=1 ssh_sysadm_login=1 + + rlRun "semanage boolean -E > boolean.local" + # test if local changes are applied + rlAssertGrep 'boolean -m \(-1\|--on\) secure_mode_insmod' "boolean.local" + rlAssertGrep 'boolean -m \(-1\|--on\) ssh_sysadm_login' "boolean.local" + # check the content of /var/lib/selinux/targeted/rpmbooleans.custom, should be almost empty + rlAssertNotGrep '\(-1\|--on\) secure_mode_insmod' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" + rlAssertNotGrep '\(-1\|--on\) ssh_sysadm_login' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" + rlPhaseEnd + + rlPhaseStartTest "Test uninstall once after install twice" + unset_booleans secure_mode=0 secure_mode_insmod=0 + + # test if local changes are removed + rlRun "semanage boolean -E > boolean.local" + rlAssertGrep 'boolean -m \(-1\|--on\) secure_mode' "boolean.local" + rlAssertNotGrep 'boolean -m \(-1\|--on\) secure_mode_insmod' "boolean.local" + rlAssertGrep 'boolean -m \(-1\|--on\) ssh_sysadm_login' "boolean.local" + rlAssertGrep 'secure_mode$' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" + rlAssertNotGrep 'secure_mode_insmod' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" + rlAssertGrep 'ssh_sysadm_login' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" + rlRun "semanage boolean -m --off secure_mode" 0 "cleanup" + rlRun "semanage boolean -m --off secure_mode_insmod" 0 "cleanup" + rlRun "semanage boolean -m --off ssh_sysadm_login" 0 "cleanup" + rlRun "semanage boolean -D" 0 "cleanup" + rlRun "rm ${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" 0 "cleanup" + rlPhaseEnd + + rlPhaseStartTest "Test install twice on a system with secure_mode is already on" + rlRun "semanage boolean -m --on secure_mode" 0 "Setting secure_mode=on" + + set_booleans secure_mode=1 secure_mode_insmod=1 + set_booleans secure_mode=1 + + rlRun "semanage boolean -E > boolean.local" + # test if local changes are applied + rlAssertGrep 'boolean -m \(-1\|--on\) secure_mode' "boolean.local" + rlAssertGrep 'boolean -m \(-1\|--on\) secure_mode_insmod' "boolean.local" + # check the content of /var/lib/selinux/targeted/rpmbooleans.custom, should be almost empty + rlAssertGrep '\(-1\|--on\) secure_mode' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" + rlAssertGrep '\(-0\|--off\) secure_mode_insmod' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" + rlPhaseEnd + + rlPhaseStartTest "Test uninstall once after install twice on a system where secure_mode was on before install" + + unset_booleans secure_mode=0 secure_mode_insmod=0 + + # test if local changes are removed + rlRun "semanage boolean -E > boolean.local" + rlAssertGrep 'boolean -m \(-1\|--on\) secure_mode' "boolean.local" + rlAssertGrep 'boolean -m \(-0\|--off\) secure_mode_insmod' "boolean.local" + rlAssertGrep '\(-1\|--on\) secure_mode' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" + rlAssertNotGrep 'secure_mode_insmod' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" + + rlRun "semanage boolean -m --off secure_mode" 0 "cleanup" + rlRun "semanage boolean -m --off secure_mode_insmod" 0 "cleanup" + rlRun "semanage boolean -D" 0 "cleanup" + rlRun "rm ${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" 0 "cleanup" + + rlPhaseEnd + + rlPhaseStartTest "Test install twice on a system with secure_mode was changed to off" + rlRun "semanage boolean -m --off secure_mode" 0 "Setting secure_mode=on" + + set_booleans secure_mode=1 secure_mode_insmod=1 + set_booleans secure_mode=1 + + rlRun "semanage boolean -E > boolean.local" + # test if local changes are applied + rlAssertGrep 'boolean -m \(-1\|--on\) secure_mode' "boolean.local" + rlAssertGrep 'boolean -m \(-1\|--on\) secure_mode_insmod' "boolean.local" + # check the content of /var/lib/selinux/targeted/rpmbooleans.custom, should be almost empty + rlAssertGrep '\(-0\|--off\) secure_mode' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" + rlAssertGrep '\(-0\|--off\) secure_mode_insmod' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" + rlPhaseEnd + + rlPhaseStartTest "Test uninstall once after install twice on a system where secure_mode was off before install" + + unset_booleans secure_mode=0 secure_mode_insmod=0 + + # test if local changes are removed + rlRun "semanage boolean -E > boolean.local" + rlAssertGrep 'boolean -m \(-1\|--on\) secure_mode' "boolean.local" + rlAssertGrep 'boolean -m \(-0\|--off\) secure_mode_insmod' "boolean.local" + rlAssertGrep '\(-0\|--off\) secure_mode' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" + rlAssertNotGrep 'secure_mode_insmod' "${SELINUXSTOREPATH}/targeted/rpmbooleans.custom" + + rlRun "semanage boolean -m --off secure_mode" 0 "cleanup" + rlRun "semanage boolean -m --off secure_mode_insmod" 0 "cleanup" + rlRun "semanage boolean -D" 0 "cleanup" + rlPhaseEnd + + rlPhaseStartCleanup "Cleanup" + rlRun "semanage boolean -D" 0 "Clean all boolean changes" + rlRun "semanage import < boolean.import" 0 "Import local boolean modifications back" + popd + rlRun "rm -r $TmpDir" 0 "Removing tmp directory" + rlRun "rlFileRestore" + rlPhaseEnd + +rlJournalEnd + +# Print the test report +rlJournalPrintText From f5e7b111526eaa149f250d73a2d22c29fe64cd19 Mon Sep 17 00:00:00 2001 From: Jan Onderka Date: Wed, 12 Mar 2025 16:33:06 +0100 Subject: [PATCH 460/626] Metadata update for systemd-sysctl-and-similar test and adding NoRHIVOS tag --- selinux-policy/chronyd-and-similar/main.fmf | 1 + selinux-policy/policykit-general/main.fmf | 1 + .../systemd-sysctl-and-similar/PURPOSE | 28 +++++++++++++++++++ 3 files changed, 30 insertions(+) diff --git a/selinux-policy/chronyd-and-similar/main.fmf b/selinux-policy/chronyd-and-similar/main.fmf index caf9836..6ada2ed 100644 --- a/selinux-policy/chronyd-and-similar/main.fmf +++ b/selinux-policy/chronyd-and-similar/main.fmf @@ -41,6 +41,7 @@ tag: - TipWaived6 - f33friendly - targeted + - NoRHIVOS tier: '3' link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=974992 diff --git a/selinux-policy/policykit-general/main.fmf b/selinux-policy/policykit-general/main.fmf index 655a4ab..4055ac8 100644 --- a/selinux-policy/policykit-general/main.fmf +++ b/selinux-policy/policykit-general/main.fmf @@ -38,6 +38,7 @@ tag: - f31friendly - f32friendly - targeted + - NoRHIVOS tier: '2' link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=960669 diff --git a/selinux-policy/systemd-sysctl-and-similar/PURPOSE b/selinux-policy/systemd-sysctl-and-similar/PURPOSE index 6660acb..b98a257 100644 --- a/selinux-policy/systemd-sysctl-and-similar/PURPOSE +++ b/selinux-policy/systemd-sysctl-and-similar/PURPOSE @@ -3,3 +3,31 @@ Author: Milos Malik Does the systemd-sysctl work correctly under SELinux confinement? +Inputs + +new system service file definition +selinux labels for various files +selinux rules present at the system + +Outputs + +Test passes or fail based on presence of specific selinux labels or rules +or failures related to starting and stopping systemd-sysctl service + +Expected log output example + +:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: +:: real scenario +:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: + +:: [ 15:14:27 ] :: [ PASS ] :: Command 'service systemd-sysctl start' (Expected 0, got 0) +:: [ 15:14:46 ] :: [ PASS ] :: Command 'service systemd-sysctl status' (Expected 0,1,3, got 0) +:: [ 15:15:15 ] :: [ PASS ] :: Command 'restorecon -Rv /etc /run /var -e /var/ARTIFACTS' (Expected 0-255, got 0) +:: [ 15:15:19 ] :: [ PASS ] :: Command 'service systemd-sysctl restart' (Expected 0, got 0) +:: [ 15:15:38 ] :: [ PASS ] :: Command 'service systemd-sysctl status' (Expected 0,1,3, got 0) +:: [ 15:15:57 ] :: [ PASS ] :: Command 'service systemd-sysctl stop' (Expected 0, got 0) +:: [ 15:16:15 ] :: [ PASS ] :: Command 'service systemd-sysctl status' (Expected 0,1,3, got 3) +:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: +:: Duration: 127s +:: Assertions: 7 good, 0 bad +:: RESULT: PASS (real scenario) From 5a9000d76f96c0b8c256cd9bbca40f816c0e402d Mon Sep 17 00:00:00 2001 From: Jan Onderka Date: Mon, 17 Mar 2025 15:21:56 +0100 Subject: [PATCH 461/626] Metadata update of PURPOSE files with expected inputs and outputs --- .../realpath_not_final-function/PURPOSE | 58 ++++++++++++++ libselinux/selabel-functions/PURPOSE | 70 +++++++++++++++++ .../selinux_boolean_sub-function/PURPOSE | 54 +++++++++++++ .../selinux_restorecon-functions/PURPOSE | 37 +++++++++ libselinux/selinux_sestatus-functions/PURPOSE | 76 +++++++++++++++++++ libselinux/setenforce/PURPOSE | 40 ++++++++++ 6 files changed, 335 insertions(+) diff --git a/libselinux/realpath_not_final-function/PURPOSE b/libselinux/realpath_not_final-function/PURPOSE index 8305d70..8fcf56a 100644 --- a/libselinux/realpath_not_final-function/PURPOSE +++ b/libselinux/realpath_not_final-function/PURPOSE @@ -1,3 +1,61 @@ PURPOSE of /CoreOS/libselinux/Sanity/realpath_not_final-function Description: Test realpath_not_final function Author: Jan Zarsky + +Inputs + +compiled C source code + +Outputs + +Test passes or fail based on log file content + +Expected log output example + +:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: +:: Test +:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: + +:: [ 06:17:21 ] :: [ BEGIN ] :: Running './test NULL' +/usr/share/beakerlib/testing.sh: line 896: 39526 Segmentation fault (core dumped) ./test NULL +:: [ 06:17:22 ] :: [ PASS ] :: Command './test NULL' (Expected 139, got 139) +:: [ 06:17:22 ] :: [ BEGIN ] :: Running './test /somedir/somefile NULL' +symlink_realpath(/somedir/somefile) realpath() failed: No such file or directory +Executing: realpath_not_final(/somedir/somefile, resolved_path) +realpath_not_final: /somedir +:: [ 06:17:22 ] :: [ PASS ] :: Command './test /somedir/somefile NULL' (Expected 255, got 255) +:: [ 06:17:22 ] :: [ BEGIN ] :: Running './test NULL NULL' +/usr/share/beakerlib/testing.sh: line 896: 39584 Segmentation fault (core dumped) ./test NULL NULL +:: [ 06:17:23 ] :: [ PASS ] :: Command './test NULL NULL' (Expected 139, got 139) +:: [ 06:17:23 ] :: [ BEGIN ] :: Running './test /tmp | tee output' +Executing: realpath_not_final(/tmp, resolved_path) +realpath_not_final: /tmp +:: [ 06:17:23 ] :: [ PASS ] :: Command './test /tmp | tee output' (Expected 0, got 0) +:: [ 06:17:23 ] :: [ BEGIN ] :: Running 'grep 'realpath_not_final: /tmp' output' +realpath_not_final: /tmp +:: [ 06:17:23 ] :: [ PASS ] :: Command 'grep 'realpath_not_final: /tmp' output' (Expected 0, got 0) +:: [ 06:17:24 ] :: [ BEGIN ] :: Running './test //tmp | tee output' +Executing: realpath_not_final(//tmp, resolved_path) +realpath_not_final: //tmp +:: [ 06:17:24 ] :: [ PASS ] :: Command './test //tmp | tee output' (Expected 0, got 0) +:: [ 06:17:24 ] :: [ BEGIN ] :: Running 'grep -E 'realpath_not_final: /tmp|realpath_not_final: //tmp' output' +realpath_not_final: //tmp +:: [ 06:17:24 ] :: [ PASS ] :: Command 'grep -E 'realpath_not_final: /tmp|realpath_not_final: //tmp' output' (Expected 0, got 0) +:: [ 06:17:24 ] :: [ BEGIN ] :: Running './test ///tmp | tee output' +Executing: realpath_not_final(///tmp, resolved_path) +realpath_not_final: //tmp +:: [ 06:17:24 ] :: [ PASS ] :: Command './test ///tmp | tee output' (Expected 0, got 0) +:: [ 06:17:24 ] :: [ BEGIN ] :: Running 'grep -E 'realpath_not_final: /tmp|realpath_not_final: //tmp' output' +realpath_not_final: //tmp +:: [ 06:17:24 ] :: [ PASS ] :: Command 'grep -E 'realpath_not_final: /tmp|realpath_not_final: //tmp' output' (Expected 0, got 0) +:: [ 06:17:24 ] :: [ BEGIN ] :: Running './test ////tmp | tee output' +Executing: realpath_not_final(////tmp, resolved_path) +realpath_not_final: //tmp +:: [ 06:17:24 ] :: [ PASS ] :: Command './test ////tmp | tee output' (Expected 0, got 0) +:: [ 06:17:24 ] :: [ BEGIN ] :: Running 'grep -E 'realpath_not_final: /tmp|realpath_not_final: //tmp' output' +realpath_not_final: //tmp +:: [ 06:17:24 ] :: [ PASS ] :: Command 'grep -E 'realpath_not_final: /tmp|realpath_not_final: //tmp' output' (Expected 0, got 0) +:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: +:: Duration: 3s +:: Assertions: 11 good, 0 bad +:: RESULT: PASS (Test) diff --git a/libselinux/selabel-functions/PURPOSE b/libselinux/selabel-functions/PURPOSE index aa07643..d718413 100644 --- a/libselinux/selabel-functions/PURPOSE +++ b/libselinux/selabel-functions/PURPOSE @@ -1,3 +1,73 @@ PURPOSE of /CoreOS/libselinux/Sanity/selabel-functions Description: Test selabel functions Author: Jan Zarsky + +Inputs + +compiled C source code + +Outputs + +Test passes or fail based on log file content + +Expected log output example + +:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: +:: selabel_lookup and selabel_lookup_raw +:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: + +:: [ 06:17:59 ] :: [ INFO ] :: Handle +:: [ 06:17:59 ] :: [ BEGIN ] :: Running './test_lookup CTX_FILE NULL NULL 0 0 some_input 0 nohandle' +/usr/share/beakerlib/testing.sh: line 896: 45881 Segmentation fault (core dumped) ./test_lookup CTX_FILE NULL NULL 0 0 some_input 0 nohandle +:: [ 06:18:00 ] :: [ PASS ] :: Command './test_lookup CTX_FILE NULL NULL 0 0 some_input 0 nohandle' (Expected 139, got 139) +:: [ 06:18:00 ] :: [ BEGIN ] :: Running './test_lookup CTX_MEDIA NULL NULL 0 0 some_input 0 nohandle' +/usr/share/beakerlib/testing.sh: line 896: 45913 Segmentation fault (core dumped) ./test_lookup CTX_MEDIA NULL NULL 0 0 some_input 0 nohandle +:: [ 06:18:01 ] :: [ PASS ] :: Command './test_lookup CTX_MEDIA NULL NULL 0 0 some_input 0 nohandle' (Expected 139, got 139) +:: [ 06:18:02 ] :: [ BEGIN ] :: Running './test_lookup CTX_X NULL NULL 0 0 some_input 0 nohandle' +/usr/share/beakerlib/testing.sh: line 896: 45945 Segmentation fault (core dumped) ./test_lookup CTX_X NULL NULL 0 0 some_input 0 nohandle +:: [ 06:18:03 ] :: [ PASS ] :: Command './test_lookup CTX_X NULL NULL 0 0 some_input 0 nohandle' (Expected 139, got 139) +:: [ 06:18:03 ] :: [ BEGIN ] :: Running './test_lookup CTX_DB NULL NULL 0 0 some_input 0 nohandle' +/usr/share/beakerlib/testing.sh: line 896: 45977 Segmentation fault (core dumped) ./test_lookup CTX_DB NULL NULL 0 0 some_input 0 nohandle +:: [ 06:18:04 ] :: [ PASS ] :: Command './test_lookup CTX_DB NULL NULL 0 0 some_input 0 nohandle' (Expected 139, got 139) +:: [ 06:18:04 ] :: [ INFO ] :: Path +:: [ 06:18:05 ] :: [ BEGIN ] :: Running './test_lookup CTX_FILE NULL NULL 0 0 NULL 0' +selabel_lookup - ERROR: Invalid argument +selabel_lookup_raw - ERROR: Invalid argument +selabel_options: SELABEL_OPT_PATH = (null), SELABEL_OPT_SUBSET = (null), SELABEL_OPT_VALIDATE = 0, SELABEL_OPT_BASEONLY = 0 +Executing: selabel_open(SELABEL_CTX_FILE, &selabel_option, 4) +Executing: selabel_lookup(hnd, &selabel_context, (null), 0) +Executing: selabel_lookup_raw(hnd, &selabel_context, (null), 0) +:: [ 06:18:05 ] :: [ PASS ] :: Command './test_lookup CTX_FILE NULL NULL 0 0 NULL 0' (Expected 22, got 22) +:: [ 06:18:05 ] :: [ BEGIN ] :: Running './test_lookup CTX_MEDIA NULL NULL 0 0 NULL 0' +selabel_lookup - ERROR: Invalid argument +selabel_lookup_raw - ERROR: Invalid argument +selabel_options: SELABEL_OPT_PATH = (null), SELABEL_OPT_SUBSET = (null), SELABEL_OPT_VALIDATE = 0, SELABEL_OPT_BASEONLY = 0 +Executing: selabel_open(SELABEL_CTX_MEDIA, &selabel_option, 4) +Executing: selabel_lookup(hnd, &selabel_context, (null), 0) +Executing: selabel_lookup_raw(hnd, &selabel_context, (null), 0) +:: [ 06:18:05 ] :: [ PASS ] :: Command './test_lookup CTX_MEDIA NULL NULL 0 0 NULL 0' (Expected 22, got 22) +:: [ 06:18:05 ] :: [ BEGIN ] :: Running './test_lookup CTX_X NULL NULL 0 0 NULL 0' +selabel_lookup - ERROR: Invalid argument +selabel_lookup_raw - ERROR: Invalid argument +selabel_options: SELABEL_OPT_PATH = (null), SELABEL_OPT_SUBSET = (null), SELABEL_OPT_VALIDATE = 0, SELABEL_OPT_BASEONLY = 0 +Executing: selabel_open(SELABEL_CTX_X, &selabel_option, 4) +Executing: selabel_lookup(hnd, &selabel_context, (null), 0) +Executing: selabel_lookup_raw(hnd, &selabel_context, (null), 0) +:: [ 06:18:05 ] :: [ PASS ] :: Command './test_lookup CTX_X NULL NULL 0 0 NULL 0' (Expected 22, got 22) +:: [ 06:18:05 ] :: [ BEGIN ] :: Running './test_lookup CTX_DB NULL NULL 0 0 NULL 0' +selabel_lookup - ERROR: Invalid argument +selabel_lookup_raw - ERROR: Invalid argument +selabel_options: SELABEL_OPT_PATH = (null), SELABEL_OPT_SUBSET = (null), SELABEL_OPT_VALIDATE = 0, SELABEL_OPT_BASEONLY = 0 +Executing: selabel_open(SELABEL_CTX_DB, &selabel_option, 4) +Executing: selabel_lookup(hnd, &selabel_context, (null), 0) +Executing: selabel_lookup_raw(hnd, &selabel_context, (null), 0) +:: [ 06:18:05 ] :: [ PASS ] :: Command './test_lookup CTX_DB NULL NULL 0 0 NULL 0' (Expected 22, got 22) +:: [ 06:18:05 ] :: [ BEGIN ] :: Running './test_lookup CTX_ANDROID_PROP NULL NULL 0 0 NULL 0' +selabel_open - ERROR: Operation not supported +selabel_options: SELABEL_OPT_PATH = (null), SELABEL_OPT_SUBSET = (null), SELABEL_OPT_VALIDATE = 0, SELABEL_OPT_BASEONLY = 0 +Executing: selabel_open(SELABEL_CTX_ANDROID_PROP, &selabel_option, 4) +:: [ 06:18:05 ] :: [ PASS ] :: Command './test_lookup CTX_ANDROID_PROP NULL NULL 0 0 NULL 0' (Expected 255, got 255) +:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: +:: Duration: 6s +:: Assertions: 9 good, 0 bad +:: RESULT: PASS (selabel_lookup and selabel_lookup_raw) diff --git a/libselinux/selinux_boolean_sub-function/PURPOSE b/libselinux/selinux_boolean_sub-function/PURPOSE index 289e8e7..a34845b 100644 --- a/libselinux/selinux_boolean_sub-function/PURPOSE +++ b/libselinux/selinux_boolean_sub-function/PURPOSE @@ -1,3 +1,57 @@ PURPOSE of /CoreOS/libselinux/Sanity/selinux_boolean_sub-function Description: Test selinux_boolean_sub function Author: Jan Zarsky + +Inputs + +compiled C source code + +Outputs + +Test passes or fail based on log file content + +Expected log output example + +:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: +:: Test +:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: + +:: [ 06:19:03 ] :: [ BEGIN ] :: Running './test NULL | tee output' +Executing: selinux_boolean_sub((null)) +selinux_boolean_sub: (null) +:: [ 06:19:04 ] :: [ PASS ] :: Command './test NULL | tee output' (Expected 0, got 0) +:: [ 06:19:04 ] :: [ BEGIN ] :: Running 'grep 'selinux_boolean_sub: (null)' output' +selinux_boolean_sub: (null) +:: [ 06:19:04 ] :: [ PASS ] :: Command 'grep 'selinux_boolean_sub: (null)' output' (Expected 0, got 0) +:: [ 06:19:04 ] :: [ BEGIN ] :: Running './test my_nonexisting_record | tee output' +Executing: selinux_boolean_sub(my_nonexisting_record) +selinux_boolean_sub: my_nonexisting_record +:: [ 06:19:04 ] :: [ PASS ] :: Command './test my_nonexisting_record | tee output' (Expected 0, got 0) +:: [ 06:19:04 ] :: [ BEGIN ] :: Running 'grep 'selinux_boolean_sub: my_nonexisting_record' output' +selinux_boolean_sub: my_nonexisting_record +:: [ 06:19:04 ] :: [ PASS ] :: Command 'grep 'selinux_boolean_sub: my_nonexisting_record' output' (Expected 0, got 0) +:: [ 06:19:04 ] :: [ BEGIN ] :: Running './test allow_auditadm_exec_content | tee output' +Executing: selinux_boolean_sub(allow_auditadm_exec_content) +selinux_boolean_sub: auditadm_exec_content +:: [ 06:19:04 ] :: [ PASS ] :: Command './test allow_auditadm_exec_content | tee output' (Expected 0, got 0) +:: [ 06:19:04 ] :: [ BEGIN ] :: Running 'grep 'selinux_boolean_sub: auditadm_exec_content' output' +selinux_boolean_sub: auditadm_exec_content +:: [ 06:19:04 ] :: [ PASS ] :: Command 'grep 'selinux_boolean_sub: auditadm_exec_content' output' (Expected 0, got 0) +:: [ 06:19:04 ] :: [ BEGIN ] :: Running './test allow_domain_fd_use | tee output' +Executing: selinux_boolean_sub(allow_domain_fd_use) +selinux_boolean_sub: domain_fd_use +:: [ 06:19:04 ] :: [ PASS ] :: Command './test allow_domain_fd_use | tee output' (Expected 0, got 0) +:: [ 06:19:04 ] :: [ BEGIN ] :: Running 'grep 'selinux_boolean_sub: domain_fd_use' output' +selinux_boolean_sub: domain_fd_use +:: [ 06:19:04 ] :: [ PASS ] :: Command 'grep 'selinux_boolean_sub: domain_fd_use' output' (Expected 0, got 0) +:: [ 06:19:04 ] :: [ BEGIN ] :: Running './test virt_sandbox_use_nfs | tee output' +Executing: selinux_boolean_sub(virt_sandbox_use_nfs) +selinux_boolean_sub: virt_use_nfs +:: [ 06:19:04 ] :: [ PASS ] :: Command './test virt_sandbox_use_nfs | tee output' (Expected 0, got 0) +:: [ 06:19:05 ] :: [ BEGIN ] :: Running 'grep 'selinux_boolean_sub: virt_use_nfs' output' +selinux_boolean_sub: virt_use_nfs +:: [ 06:19:05 ] :: [ PASS ] :: Command 'grep 'selinux_boolean_sub: virt_use_nfs' output' (Expected 0, got 0) +:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: +:: Duration: 2s +:: Assertions: 10 good, 0 bad +:: RESULT: PASS (Test) diff --git a/libselinux/selinux_restorecon-functions/PURPOSE b/libselinux/selinux_restorecon-functions/PURPOSE index 8a2f7ba..a51df62 100644 --- a/libselinux/selinux_restorecon-functions/PURPOSE +++ b/libselinux/selinux_restorecon-functions/PURPOSE @@ -1,3 +1,40 @@ PURPOSE of /CoreOS/libselinux/Sanity/selinux_restorecon-functions Description: Test functions in selinux_restorecon.c Author: Jan Zarsky + +Inputs + +compiled C source code + +Outputs + +Test passes or fail based on log files content + +Expected log output example + +:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: +:: /sys directory +:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: + +:: [ 06:19:36 ] :: [ BEGIN ] :: Calling selinux_restorecon on /tmp :: actually running 'strace -ostrace.out -s 64 ./test_restorecon /var/log RECURSE NOCHANGE' +Running selinux_restorecon("/var/log", 0x00000a); +:: [ 06:19:36 ] :: [ PASS ] :: Calling selinux_restorecon on /tmp (Expected 0, got 0) +:: [ 06:19:37 ] :: [ BEGIN ] :: Running 'grep -E "security\.(restorecon_last|sehash)" strace.out' +getxattr("/var/log", "security.sehash", 0xffffd9c79128, 32) = -1 ENODATA (No data available) +getxattr("/var/log/journal", "security.sehash", 0xffffd9c79128, 32) = -1 ENODATA (No data available) +getxattr("/var/log/journal/9f26e28ec0b04e2bbb812e4227ff5bb3", "security.sehash", 0xffffd9c79128, 32) = -1 ENODATA (No data available) +getxattr("/var/log/chrony", "security.sehash", 0xffffd9c79128, 32) = -1 ENODATA (No data available) +getxattr("/var/log/private", "security.sehash", 0xffffd9c79128, 32) = -1 ENODATA (No data available) +getxattr("/var/log/audit", "security.sehash", 0xffffd9c79128, 32) = -1 ENODATA (No data available) +:: [ 06:19:37 ] :: [ PASS ] :: Command 'grep -E "security\.(restorecon_last|sehash)" strace.out' (Expected 0, got 0) +:: [ 06:19:37 ] :: [ BEGIN ] :: Calling selinux_restorecon on /sys :: actually running 'strace -ostrace.out -s 64 ./test_restorecon /sys RECURSE NOCHANGE' +Running selinux_restorecon("/sys", 0x00000a); +:: [ 06:19:55 ] :: [ PASS ] :: Calling selinux_restorecon on /sys (Expected 0, got 0) +:: [ 06:19:55 ] :: [ BEGIN ] :: Running 'grep -E "security\.(restorecon_last|sehash)" strace.out' +:: [ 06:19:55 ] :: [ PASS ] :: Command 'grep -E "security\.(restorecon_last|sehash)" strace.out' (Expected 1, got 1) +:: [ 06:19:55 ] :: [ BEGIN ] :: Running 'rm -f strace.out' +:: [ 06:19:55 ] :: [ PASS ] :: Command 'rm -f strace.out' (Expected 0, got 0) +:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: +:: Duration: 19s +:: Assertions: 5 good, 0 bad +:: RESULT: PASS (/sys directory) diff --git a/libselinux/selinux_sestatus-functions/PURPOSE b/libselinux/selinux_sestatus-functions/PURPOSE index c638364..26011d7 100644 --- a/libselinux/selinux_sestatus-functions/PURPOSE +++ b/libselinux/selinux_sestatus-functions/PURPOSE @@ -1,3 +1,79 @@ PURPOSE of /CoreOS/libselinux/Sanity/selinux_sestatus-functions Description: Test sestatus.c functions Author: Jan Zarsky + +Inputs + +compiled C source code + +Outputs + +Test passes or fail based on res.txt file content + +Expected log output example + +:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: +:: Test +:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: + +:: [ 06:20:25 ] :: [ BEGIN ] :: Running './test > res.txt' +:: [ 06:20:25 ] :: [ PASS ] :: Command './test > res.txt' (Expected 0, got 0) +:: [ 06:20:25 ] :: [ BEGIN ] :: Running 'cat res.txt' +(before open) selinux_status_getenforce -1 +(before open) selinux_status_policyload -1 +(before open) selinux_status_deny_unknown -1 +(before open) selinux_status_updated -1 +selinux_status_open 0 +selinux_status_getenforce 1 +selinux_status_policyload 7 +selinux_status_deny_unknown 0 +selinux_status_updated 0 +selinux_status_close void +:: [ 06:20:26 ] :: [ LOG ] :: Output of 'cat res.txt': +:: [ 06:20:26 ] :: [ LOG ] :: --------------- OUTPUT START --------------- +:: [ 06:20:26 ] :: [ LOG ] :: (before open) selinux_status_getenforce -1 +:: [ 06:20:26 ] :: [ LOG ] :: (before open) selinux_status_policyload -1 +:: [ 06:20:26 ] :: [ LOG ] :: (before open) selinux_status_deny_unknown -1 +:: [ 06:20:26 ] :: [ LOG ] :: (before open) selinux_status_updated -1 +:: [ 06:20:26 ] :: [ LOG ] :: selinux_status_open 0 +:: [ 06:20:26 ] :: [ LOG ] :: selinux_status_getenforce 1 +:: [ 06:20:26 ] :: [ LOG ] :: selinux_status_policyload 7 +:: [ 06:20:26 ] :: [ LOG ] :: selinux_status_deny_unknown 0 +:: [ 06:20:26 ] :: [ LOG ] :: selinux_status_updated 0 +:: [ 06:20:26 ] :: [ LOG ] :: selinux_status_close void +:: [ 06:20:26 ] :: [ LOG ] :: --------------- OUTPUT END --------------- +:: [ 06:20:26 ] :: [ PASS ] :: Command 'cat res.txt' (Expected 0, got 0) +:: [ 06:20:26 ] :: [ BEGIN ] :: Running 'grep "(before open) selinux_status_getenforce -1" res.txt' +(before open) selinux_status_getenforce -1 +:: [ 06:20:26 ] :: [ PASS ] :: Command 'grep "(before open) selinux_status_getenforce -1" res.txt' (Expected 0, got 0) +:: [ 06:20:26 ] :: [ BEGIN ] :: Running 'grep "(before open) selinux_status_policyload -1" res.txt' +(before open) selinux_status_policyload -1 +:: [ 06:20:26 ] :: [ PASS ] :: Command 'grep "(before open) selinux_status_policyload -1" res.txt' (Expected 0, got 0) +:: [ 06:20:26 ] :: [ BEGIN ] :: Running 'grep "(before open) selinux_status_deny_unknown -1" res.txt' +(before open) selinux_status_deny_unknown -1 +:: [ 06:20:26 ] :: [ PASS ] :: Command 'grep "(before open) selinux_status_deny_unknown -1" res.txt' (Expected 0, got 0) +:: [ 06:20:26 ] :: [ BEGIN ] :: Running 'grep "(before open) selinux_status_updated -1" res.txt' +(before open) selinux_status_updated -1 +:: [ 06:20:26 ] :: [ PASS ] :: Command 'grep "(before open) selinux_status_updated -1" res.txt' (Expected 0, got 0) +:: [ 06:20:26 ] :: [ BEGIN ] :: Running 'grep "selinux_status_open 0" res.txt' +selinux_status_open 0 +:: [ 06:20:26 ] :: [ PASS ] :: Command 'grep "selinux_status_open 0" res.txt' (Expected 0, got 0) +:: [ 06:20:26 ] :: [ BEGIN ] :: Running 'grep "selinux_status_getenforce 1" res.txt' +selinux_status_getenforce 1 +:: [ 06:20:26 ] :: [ PASS ] :: Command 'grep "selinux_status_getenforce 1" res.txt' (Expected 0, got 0) +:: [ 06:20:27 ] :: [ BEGIN ] :: Running 'grep -E "selinux_status_policyload [0-9]" res.txt' +selinux_status_policyload 7 +:: [ 06:20:27 ] :: [ PASS ] :: Command 'grep -E "selinux_status_policyload [0-9]" res.txt' (Expected 0, got 0) +:: [ 06:20:27 ] :: [ BEGIN ] :: Running 'grep "selinux_status_deny_unknown 0" res.txt' +selinux_status_deny_unknown 0 +:: [ 06:20:27 ] :: [ PASS ] :: Command 'grep "selinux_status_deny_unknown 0" res.txt' (Expected 0, got 0) +:: [ 06:20:27 ] :: [ BEGIN ] :: Running 'grep "selinux_status_updated 0" res.txt' +selinux_status_updated 0 +:: [ 06:20:27 ] :: [ PASS ] :: Command 'grep "selinux_status_updated 0" res.txt' (Expected 0, got 0) +:: [ 06:20:27 ] :: [ BEGIN ] :: Running 'grep "selinux_status_close void" res.txt' +selinux_status_close void +:: [ 06:20:27 ] :: [ PASS ] :: Command 'grep "selinux_status_close void" res.txt' (Expected 0, got 0) +:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: +:: Duration: 2s +:: Assertions: 12 good, 0 bad +:: RESULT: PASS (Test) diff --git a/libselinux/setenforce/PURPOSE b/libselinux/setenforce/PURPOSE index de8a77e..dd776a1 100644 --- a/libselinux/setenforce/PURPOSE +++ b/libselinux/setenforce/PURPOSE @@ -3,3 +3,43 @@ Author: Milos Malik Does setenforce work as expected? Does it produce correct audit messages? +Inputs + +Various setups related to setenforce + +Outputs + +Test passes or fail based on ausearch resutls + +Expected log output example + +:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: +:: basic use +:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: + +:: [ 06:20:45 ] :: [ BEGIN ] :: Running 'setenforce 1' +:: [ 06:20:45 ] :: [ PASS ] :: Command 'setenforce 1' (Expected 0, got 0) +:: [ 06:20:45 ] :: [ BEGIN ] :: Running 'grep 1 /sys/fs/selinux/enforce' +1 +:: [ 06:20:45 ] :: [ PASS ] :: Command 'grep 1 /sys/fs/selinux/enforce' (Expected 0, got 0) +:: [ 06:20:45 ] :: [ BEGIN ] :: Running 'setenforce 0' +:: [ 06:20:45 ] :: [ PASS ] :: Command 'setenforce 0' (Expected 0, got 0) +:: [ 06:20:45 ] :: [ BEGIN ] :: Running 'grep 0 /sys/fs/selinux/enforce' +0 +:: [ 06:20:45 ] :: [ PASS ] :: Command 'grep 0 /sys/fs/selinux/enforce' (Expected 0, got 0) +:: [ 06:20:45 ] :: [ BEGIN ] :: Running 'setenforce 1' +:: [ 06:20:46 ] :: [ PASS ] :: Command 'setenforce 1' (Expected 0, got 0) +:: [ 06:20:51 ] :: [ BEGIN ] :: Running 'ausearch --input-logs -m MAC_STATUS -i -ts 03/10/2025 06:20:44 | grep 'type=MAC_STATUS.*enforcing=1.*old_enforcing=0'' +type=MAC_STATUS msg=audit(03/10/2025 06:20:45.979:2609) : enforcing=1 old_enforcing=0 auid=root ses=10 enabled=1 old-enabled=1 lsm=selinux res=yes +:: [ 06:20:51 ] :: [ PASS ] :: Command 'ausearch --input-logs -m MAC_STATUS -i -ts 03/10/2025 06:20:44 | grep 'type=MAC_STATUS.*enforcing=1.*old_enforcing=0'' (Expected 0, got 0) +:: [ 06:20:51 ] :: [ BEGIN ] :: Running 'ausearch --input-logs -m MAC_STATUS -i -ts 03/10/2025 06:20:44 | grep 'type=MAC_STATUS.*enforcing=0.*old_enforcing=1'' +type=MAC_STATUS msg=audit(03/10/2025 06:20:45.759:2608) : enforcing=0 old_enforcing=1 auid=root ses=10 enabled=1 old-enabled=1 lsm=selinux res=yes +:: [ 06:20:51 ] :: [ PASS ] :: Command 'ausearch --input-logs -m MAC_STATUS -i -ts 03/10/2025 06:20:44 | grep 'type=MAC_STATUS.*enforcing=0.*old_enforcing=1'' (Expected 0, got 0) +:: [ 06:20:51 ] :: [ BEGIN ] :: Running 'ausearch --input-logs -m MAC_STATUS -i -ts 03/10/2025 06:20:44 | grep 'type=SYSCALL.*comm=setenforce'' +type=SYSCALL msg=audit(03/10/2025 06:20:45.759:2608) : arch=aarch64 syscall=write success=yes exit=1 a0=0x3 a1=0xffffd04eebc0 a2=0x1 a3=0xff78bbc00020 items=0 ppid=75829 pid=79376 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts0 ses=10 comm=setenforce exe=/usr/sbin/setenforce subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +type=SYSCALL msg=audit(03/10/2025 06:20:45.979:2609) : arch=aarch64 syscall=write success=yes exit=1 a0=0x3 a1=0xffffc38319d0 a2=0x1 a3=0xff32e45b8020 items=0 ppid=75829 pid=79426 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts0 ses=10 comm=setenforce exe=/usr/sbin/setenforce subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) +:: [ 06:20:51 ] :: [ PASS ] :: Command 'ausearch --input-logs -m MAC_STATUS -i -ts 03/10/2025 06:20:44 | grep 'type=SYSCALL.*comm=setenforce'' (Expected 0, got 0) +:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: +:: Duration: 7s +:: Assertions: 8 good, 0 bad +:: RESULT: PASS (basic use) From 59cff7b143a21d62def0ad5543a8770e676b59b8 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Thu, 13 Mar 2025 16:45:27 +0100 Subject: [PATCH 462/626] test if chronyc can talk to the restricted chronyd via socket Recent selinux-policy + chrony testing revealed that SELinux prevents communication between chronyc and the restricted chronyd service. The TC reproduces the situation. In order to enable this use case, I believe that SELinux policy should allow the communcation in both directions. The TC looks for appropriate policy rules. The TC covers RHEL-82299 and RHEL-82308. --- selinux-policy/chronyd-and-similar/Makefile | 2 ++ selinux-policy/chronyd-and-similar/main.fmf | 2 ++ selinux-policy/chronyd-and-similar/runtest.sh | 10 +++++++++- 3 files changed, 13 insertions(+), 1 deletion(-) diff --git a/selinux-policy/chronyd-and-similar/Makefile b/selinux-policy/chronyd-and-similar/Makefile index ab9a53b..a26d46f 100644 --- a/selinux-policy/chronyd-and-similar/Makefile +++ b/selinux-policy/chronyd-and-similar/Makefile @@ -105,6 +105,8 @@ $(METADATA): Makefile @echo "Bug: 2173604" >> $(METADATA) # RHEL-9 @echo "Bug: 2169949" >> $(METADATA) # Fedora-38 @echo "Bug: RHEL-18219" >> $(METADATA) # RHEL-9 + @echo "Bug: RHEL-82299" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-82308" >> $(METADATA) # RHEL-9 rhts-lint $(METADATA) diff --git a/selinux-policy/chronyd-and-similar/main.fmf b/selinux-policy/chronyd-and-similar/main.fmf index 6ada2ed..b80882f 100644 --- a/selinux-policy/chronyd-and-similar/main.fmf +++ b/selinux-policy/chronyd-and-similar/main.fmf @@ -86,6 +86,8 @@ link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2173604 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2169949 - verifies: https://issues.redhat.com/browse/RHEL-18219 + - verifies: https://issues.redhat.com/browse/RHEL-82299 + - verifies: https://issues.redhat.com/browse/RHEL-82308 adjust: - enabled: false when: distro == rhel-4 diff --git a/selinux-policy/chronyd-and-similar/runtest.sh b/selinux-policy/chronyd-and-similar/runtest.sh index e7c7094..4e09f92 100755 --- a/selinux-policy/chronyd-and-similar/runtest.sh +++ b/selinux-policy/chronyd-and-similar/runtest.sh @@ -343,7 +343,7 @@ rlJournalStart rlRun "ipcs -m | grep 0x4e545030" rlRun "ls -Z /var/run/chronyd.sock | grep :chronyd_var_run_t" fi - rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 + rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status" 1 rlRun "chronyc tracking" for OUTPUT_FILE in /tmp/chronyc.output /var/lib/chrony/chronyc.output /var/log/chrony/chronyc.output ; do @@ -419,6 +419,13 @@ rlJournalStart rlPhaseEnd fi + if rlSEDefined "chronyd_restricted_t" ; then + rlPhaseStartTest "RHEL-82299 + RHEL-82308" + rlSESearchRule "allow chronyc_t chronyd_restricted_t : unix_dgram_socket { sendto } [ ]" + rlSESearchRule "allow chronyd_restricted_t chronyc_t : unix_dgram_socket { sendto } [ ]" + rlPhaseEnd + fi + if [ -f ${CHRONYD_RESTRICTED_UNIT_FILE} ]; then rlPhaseStartTest "chronyd-restricted -- bz#2169949 + RHEL-18219" rlRun "systemctl stop ${SERVICE_NAME}" @@ -432,6 +439,7 @@ rlJournalStart sleep 3 rlRun "ps -o pid,uid,command,context -C chronyd | grep -1 system_u:system_r:chronyd_restricted_t:" rlRun "systemctl status ${CHRONYD_RESTRICTED_SERVICE}" + rlRun "chronyc reload sources" 0,1 rlRun "systemctl restart ${CHRONYD_RESTRICTED_SERVICE}" rlRun "systemctl status ${CHRONYD_RESTRICTED_SERVICE}" rlRun "systemctl stop ${CHRONYD_RESTRICTED_SERVICE}" From 8db47446be1befb107fb33b9b179a23e676dbc08 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Thu, 20 Mar 2025 15:21:26 +0100 Subject: [PATCH 463/626] test if virtqemud can detach devices or libvirt is macTableManager Testing of various virtualization scenarios revealed that SELinux prevents the virtqemud processes from writing into following files: * /sys/bus/pci/devices/0000:00:05.0/driver_override * /sys/class/net/virbr0/brif/vnet5/learning The TC reproduces these situations. In order to support the use cases described in the following bugs, I believe that SELinux policy should allow the write actions. The TC looks for appropriate policy rules and file context patterns. The TC covers RHEL-65266 and RHEL-65385. --- .../virt-install-additional/Makefile | 2 + .../virt-install-additional/main.fmf | 2 + .../virt-install-additional/runtest.sh | 51 +++++++++++++++++++ 3 files changed, 55 insertions(+) diff --git a/selinux-policy/virt-install-additional/Makefile b/selinux-policy/virt-install-additional/Makefile index c2e6bb8..0f7eedd 100644 --- a/selinux-policy/virt-install-additional/Makefile +++ b/selinux-policy/virt-install-additional/Makefile @@ -65,8 +65,10 @@ $(METADATA): Makefile @echo "Architectures: aarch64 s390x x86_64" >> $(METADATA) @echo "Bug: RHEL-56029" >> $(METADATA) # RHEL-9 @echo "Bug: RHEL-65038" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-65266" >> $(METADATA) # RHEL-10 @echo "Bug: RHEL-65373" >> $(METADATA) # RHEL-10 @echo "Bug: RHEL-65383" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-65385" >> $(METADATA) # RHEL-10 @echo "Bug: RHEL-65789" >> $(METADATA) # RHEL-10 @echo "Bug: RHEL-69118" >> $(METADATA) # RHEL-10 @echo "Bug: RHEL-69920" >> $(METADATA) # RHEL-10 diff --git a/selinux-policy/virt-install-additional/main.fmf b/selinux-policy/virt-install-additional/main.fmf index 3480092..b7ba19a 100644 --- a/selinux-policy/virt-install-additional/main.fmf +++ b/selinux-policy/virt-install-additional/main.fmf @@ -39,8 +39,10 @@ tag: link: - verifies: https://issues.redhat.com/browse/RHEL-56029 - verifies: https://issues.redhat.com/browse/RHEL-65038 + - verifies: https://issues.redhat.com/browse/RHEL-65266 - verifies: https://issues.redhat.com/browse/RHEL-65373 - verifies: https://issues.redhat.com/browse/RHEL-65383 + - verifies: https://issues.redhat.com/browse/RHEL-65385 - verifies: https://issues.redhat.com/browse/RHEL-65789 - verifies: https://issues.redhat.com/browse/RHEL-69118 - verifies: https://issues.redhat.com/browse/RHEL-69920 diff --git a/selinux-policy/virt-install-additional/runtest.sh b/selinux-policy/virt-install-additional/runtest.sh index ccb456f..b5de6be 100755 --- a/selinux-policy/virt-install-additional/runtest.sh +++ b/selinux-policy/virt-install-additional/runtest.sh @@ -277,6 +277,57 @@ rlJournalStart rlRun "modprobe -r scsi_debug" rlPhaseEnd + rlPhaseStartTest "RHEL-65266" + rlSESearchRule "allow virtqemud_t sysfs_t : file { write } [ ]" + rlRun "service virtqemud start" + rlRun "service virtnodedevd start" + rlRun "mkdir -p devices" + rlRun "pushd devices" + rlRun "virsh nodedev-list" + for I in `virsh nodedev-list` ; do + rlRun "virsh nodedev-dumpxml $I > $I" + done + if grep balloon * ; then + J=`grep -l balloon *` + rlRun "virsh nodedev-reattach $J" + else + rlLog "no balloon device was found - cannot reattach it" + fi + rlRun "popd" + rlRun "rm -rf devices" + sleep 2 + rlRun "service virtnodedevd stop" + rlRun "service virtqemud stop" + rlPhaseEnd + + rlPhaseStartTest "RHEL-65385" + rlSESearchRule "allow virtqemud_t sysfs_t : file { write } [ ]" + if rlIsRHEL 8 ; then + rlRun "service libvirtd start" + fi + rlRun "service virtqemud start" + rlRun "service virtnetworkd start" + rlRun "virsh net-list" + rlRun "virsh net-dumpxml default > default.xml" + rlRun "virsh net-destroy default" + rlRun "virsh net-undefine default" + rlRun "sed -i \"s/^\(.*bridge\) \(.*\)$/\1 macTableManager='libvirt' \2/\" default.xml" + rlRun "virsh net-create ./default.xml" + sleep 2 + rlRun "virsh net-list" + rlRun "virt-install --memory 128 --pxe --virt-type qemu --os-variant alpinelinux3.8 --disk none --wait 0 --name test7" 0,1 + sleep 10 + rlRun "virsh list" + rlRun "virsh list | grep 'test7.*running'" + rlRun "virsh destroy test7" + rlRun "virsh undefine test7" 0,1 + rlRun "service virtnetworkd stop" + rlRun "service virtqemud stop" + if rlIsRHEL 8 ; then + rlRun "service libvirtd stop" + fi + rlPhaseEnd + rlPhaseStartCleanup sleep 2 rlSECheckAVC From 1663f9c1b178ed2c7b29b11aefaa707a7c2227d2 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Fri, 21 Mar 2025 16:31:54 +0100 Subject: [PATCH 464/626] test if systemd generators can send data to /run/systemd/journal/socket Recent system roles testing revealed that SELinux prevents various systemd generators from sending any data into /run/systemd/journal/socket. The TC does not reproduce the situation. In order to enable the use case in which systemd-journald is replaced by rsyslog, I believe that SELinux policy should allow these actions. The TC looks for appropriate policy rules and file context patterns. The TC covers RHEL-75879. --- selinux-policy/systemd-generators/Makefile | 1 + selinux-policy/systemd-generators/main.fmf | 1 + selinux-policy/systemd-generators/runtest.sh | 5 +++++ 3 files changed, 7 insertions(+) diff --git a/selinux-policy/systemd-generators/Makefile b/selinux-policy/systemd-generators/Makefile index 041e2b8..9dbed8f 100644 --- a/selinux-policy/systemd-generators/Makefile +++ b/selinux-policy/systemd-generators/Makefile @@ -74,6 +74,7 @@ $(METADATA): Makefile @echo "Releases: -RHEL7" >> $(METADATA) @echo "Bug: 2230226" >> $(METADATA) # Fedora 39 @echo "Bug: RHEL-72549" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-75879" >> $(METADATA) # RHEL-10 rhts-lint $(METADATA) diff --git a/selinux-policy/systemd-generators/main.fmf b/selinux-policy/systemd-generators/main.fmf index 4e67f10..93b9231 100644 --- a/selinux-policy/systemd-generators/main.fmf +++ b/selinux-policy/systemd-generators/main.fmf @@ -34,6 +34,7 @@ tag: link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2230226 - verifies: https://issues.redhat.com/browse/RHEL-72549 + - verifies: https://issues.redhat.com/browse/RHEL-75879 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 diff --git a/selinux-policy/systemd-generators/runtest.sh b/selinux-policy/systemd-generators/runtest.sh index f92caea..bc8be92 100755 --- a/selinux-policy/systemd-generators/runtest.sh +++ b/selinux-policy/systemd-generators/runtest.sh @@ -205,6 +205,11 @@ EOF rlSESearchRule "allow systemd_ssh_generator_t vsock_device_t : chr_file { getattr ioctl open read } [ ]" rlSESearchRule "allow systemd_ssh_generator_t systemd_unit_file_t : file { create getattr write open } [ ]" rlPhaseEnd + + rlPhaseStartTest "RHEL-75879" + rlRun "seinfo -a systemd_generator -x" + rlSESearchRule "allow systemd_fstab_generator_t syslogd_t : unix_dgram_socket { sendto } [ ]" + rlPhaseEnd fi ### generators from other packages: install them all? From 3702d34999e632423ccd12b632fa4c25f76e95ef Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Thu, 20 Mar 2025 10:56:02 +0100 Subject: [PATCH 465/626] test if pcm-sensor-server can run on machines with many CPUs Recent selinux-policy + pcm testing on machines with multiple CPUs revealed that SELinux prevents the pcm-sensor-server process from doing various operation. The TC reproduces that situation on the right HW. In order to support the expected functions of pcm-sensor-server, I believe that SELinux policy should allow these actions. The TC looks for appropriate policy rules and file context patterns. The TC covers RHEL-80452. --- selinux-policy/pcm-sensor-server-and-similar/Makefile | 1 + selinux-policy/pcm-sensor-server-and-similar/main.fmf | 1 + .../pcm-sensor-server-and-similar/runtest.sh | 10 ++++++++++ 3 files changed, 12 insertions(+) diff --git a/selinux-policy/pcm-sensor-server-and-similar/Makefile b/selinux-policy/pcm-sensor-server-and-similar/Makefile index 09892d4..b37360f 100644 --- a/selinux-policy/pcm-sensor-server-and-similar/Makefile +++ b/selinux-policy/pcm-sensor-server-and-similar/Makefile @@ -64,6 +64,7 @@ $(METADATA): Makefile @echo "Destructive: no" >> $(METADATA) @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8 -RHEL9" >> $(METADATA) @echo "Bug: RHEL-52838" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-80452" >> $(METADATA) # RHEL-10 rhts-lint $(METADATA) diff --git a/selinux-policy/pcm-sensor-server-and-similar/main.fmf b/selinux-policy/pcm-sensor-server-and-similar/main.fmf index 3476274..146de4e 100644 --- a/selinux-policy/pcm-sensor-server-and-similar/main.fmf +++ b/selinux-policy/pcm-sensor-server-and-similar/main.fmf @@ -34,6 +34,7 @@ tag: - NoRHIVOS link: - verifies: https://issues.redhat.com/browse/RHEL-52838 + - verifies: https://issues.redhat.com/browse/RHEL-80452 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, rhel-9 diff --git a/selinux-policy/pcm-sensor-server-and-similar/runtest.sh b/selinux-policy/pcm-sensor-server-and-similar/runtest.sh index eab7a09..e54cd3b 100755 --- a/selinux-policy/pcm-sensor-server-and-similar/runtest.sh +++ b/selinux-policy/pcm-sensor-server-and-similar/runtest.sh @@ -63,6 +63,16 @@ rlJournalStart sleep 2 rlPhaseEnd + if rlSEDefined "pcmsensor_t" ; then + rlPhaseStartTest "RHEL-80452" + rlSEMatchPathCon ${FILE_PATH} ${FILE_CONTEXT} + rlSESearchRule "allow pcmsensor_t pcmsensor_t : capability2 { perfmon } [ ]" + rlSESearchRule "allow pcmsensor_t pcmsensor_t : perf_event { cpu kernel open read } [ ]" + rlSESearchRule "allow pcmsensor_t pcmsensor_t : tcp_socket { accept bind create listen } [ ]" + rlSESearchRule "allow pcmsensor_t node_t : tcp_socket { node_bind } [ ]" + rlPhaseEnd + fi + rm -f output.txt virt-what >& output.txt if [ -s output.txt ] ; then From a7b41e8ca1dd0dfabafe7f9d41c83d4198d02918 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Fri, 28 Mar 2025 16:04:58 +0100 Subject: [PATCH 466/626] separate failing tests from no-tier tests Apply the failinfedora tag to the tests which fail on Fedora rawhide. Add a special test plan for regular runs of these failing tests. Make sure that the no-tier test plan contains tests which succeed on Fedora rawhide. --- kernel/connect_AF_UNSPEC/runtest.sh | 2 +- kernel/journald_performance/main.fmf | 2 ++ kernel/labeled-cephfs/main.fmf | 2 ++ other/mounting/main.fmf | 1 + plans/failing.fmf | 11 +++++++++++ plans/notier.fmf | 4 ++++ .../sepolicy-generate-application/main.fmf | 2 ++ selinux-policy/fapolicyd-and-similar/main.fmf | 3 ++- selinux-policy/iio-sensor-proxy-and-similar/main.fmf | 1 + selinux-policy/nasd-and-similar/main.fmf | 1 + selinux-policy/nfsdcld-and-similar/main.fmf | 1 + selinux-policy/nvme-stas-and-similar/main.fmf | 1 + selinux-policy/pam_limits-and-related/main.fmf | 1 + selinux-policy/pcm-sensor-server-and-similar/main.fmf | 1 + selinux-policy/perf_event-and-related/main.fmf | 1 + selinux-policy/stalld-and-similar/main.fmf | 1 - selinux-policy/systemd-homed/main.fmf | 1 + .../systemd-modules-load-and-similar/main.fmf | 1 - selinux-policy/systemd-userdbd-and-similar/main.fmf | 4 ++-- selinux-policy/tlshd-and-similar/main.fmf | 1 + selinux-policy/virt-install-additional/main.fmf | 1 + 21 files changed, 37 insertions(+), 6 deletions(-) create mode 100644 plans/failing.fmf diff --git a/kernel/connect_AF_UNSPEC/runtest.sh b/kernel/connect_AF_UNSPEC/runtest.sh index bc63688..99f4ed2 100755 --- a/kernel/connect_AF_UNSPEC/runtest.sh +++ b/kernel/connect_AF_UNSPEC/runtest.sh @@ -33,7 +33,7 @@ rlJournalStart rlRun "rm -f $EXE6" 0 "Removing the IPv6 reproducer binary" rlRun "kill %1" 0 "Kill the IPv4 server" rlRun "kill %2" 0 "Kill the IPv6 server" - rlRun "wait $(jobs -p)" 0 "Wait for the servers to terminate" + rlRun "wait $(jobs -p | tr '\n' ' ')" 0,143 "Wait for the servers to terminate" rlPhaseEnd rlJournalPrintText rlJournalEnd diff --git a/kernel/journald_performance/main.fmf b/kernel/journald_performance/main.fmf index 755f41a..3f9f019 100644 --- a/kernel/journald_performance/main.fmf +++ b/kernel/journald_performance/main.fmf @@ -22,3 +22,5 @@ adjust: because: RHEL-8.2 and below are not expected to have the bug fixed link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1733259 +tag: + - failinfedora diff --git a/kernel/labeled-cephfs/main.fmf b/kernel/labeled-cephfs/main.fmf index 3d3c68e..c25a15c 100644 --- a/kernel/labeled-cephfs/main.fmf +++ b/kernel/labeled-cephfs/main.fmf @@ -5,6 +5,8 @@ description: | This TC verifies that CephFS security label support works as expected. duration: 30m tier: 2 +tag: + - failinfedora adjust: - enabled: false when: distro < rhel-8 diff --git a/other/mounting/main.fmf b/other/mounting/main.fmf index 05fb64f..b7ac025 100644 --- a/other/mounting/main.fmf +++ b/other/mounting/main.fmf @@ -14,6 +14,7 @@ tag: - NoRHEL4 - NoRHEL5 - NoRHEL6 + - failinfedora - targeted adjust: - enabled: false diff --git a/plans/failing.fmf b/plans/failing.fmf new file mode 100644 index 0000000..defea7e --- /dev/null +++ b/plans/failing.fmf @@ -0,0 +1,11 @@ +summary: test plan which contains failing tests +adjust: +- when: trigger == commit + enabled: false + because: do not run this plan on changes caused by a PR/MR +discover: + how: fmf + filter: "tag:failinfedora" +execute: + how: tmt + diff --git a/plans/notier.fmf b/plans/notier.fmf index 4191bf5..638f579 100644 --- a/plans/notier.fmf +++ b/plans/notier.fmf @@ -8,4 +8,8 @@ discover: filter: "tag:-Tier1 & tag:-Tier2 & tag:-Tier3 & tag:-CI-Tier-1 & tag:-failinfedora" execute: how: tmt +provision: + hardware: + cpu: + cores: '>= 2' diff --git a/policycoreutils/sepolicy-generate-application/main.fmf b/policycoreutils/sepolicy-generate-application/main.fmf index 4096a38..3b95b9c 100644 --- a/policycoreutils/sepolicy-generate-application/main.fmf +++ b/policycoreutils/sepolicy-generate-application/main.fmf @@ -10,5 +10,7 @@ require: recommend: - abrt tier: '3' +tag: + - failinfedora enabled: true extra-nitrate: TC#0615932 diff --git a/selinux-policy/fapolicyd-and-similar/main.fmf b/selinux-policy/fapolicyd-and-similar/main.fmf index 5ffec17..b3fed85 100644 --- a/selinux-policy/fapolicyd-and-similar/main.fmf +++ b/selinux-policy/fapolicyd-and-similar/main.fmf @@ -10,7 +10,7 @@ require: - library(selinux-policy/common) recommend: - audit - - initscripts + - /usr/sbin/service - libselinux - libselinux-utils - policycoreutils @@ -29,6 +29,7 @@ tag: - NoRHEL6 - NoRHEL7 - fedora-wanted + - failinfedora - targeted - NoRHIVOS link: diff --git a/selinux-policy/iio-sensor-proxy-and-similar/main.fmf b/selinux-policy/iio-sensor-proxy-and-similar/main.fmf index 7a59d93..ad25712 100644 --- a/selinux-policy/iio-sensor-proxy-and-similar/main.fmf +++ b/selinux-policy/iio-sensor-proxy-and-similar/main.fmf @@ -30,6 +30,7 @@ tag: - NoRHEL7 - NoRHEL8 - targeted + - failinfedora - NoRHIVOS link: - verifies: https://issues.redhat.com/browse/RHEL-17346 diff --git a/selinux-policy/nasd-and-similar/main.fmf b/selinux-policy/nasd-and-similar/main.fmf index ef1a288..d29086e 100644 --- a/selinux-policy/nasd-and-similar/main.fmf +++ b/selinux-policy/nasd-and-similar/main.fmf @@ -33,4 +33,5 @@ extra-task: /CoreOS/selinux-policy/Regression/nasd-and-similar extra-nitrate: TC#0614607 id: ad784a9d-5cf4-4aac-b583-68458860acd9 tag: + - failinfedora - NoRHIVOS diff --git a/selinux-policy/nfsdcld-and-similar/main.fmf b/selinux-policy/nfsdcld-and-similar/main.fmf index 313d93f..b53c0bb 100644 --- a/selinux-policy/nfsdcld-and-similar/main.fmf +++ b/selinux-policy/nfsdcld-and-similar/main.fmf @@ -27,6 +27,7 @@ tag: - NoRHEL6 - NoRHEL7 - targeted + - failinfedora - NoRHIVOS link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1834234 diff --git a/selinux-policy/nvme-stas-and-similar/main.fmf b/selinux-policy/nvme-stas-and-similar/main.fmf index e5b5cf7..d8408e2 100644 --- a/selinux-policy/nvme-stas-and-similar/main.fmf +++ b/selinux-policy/nvme-stas-and-similar/main.fmf @@ -30,6 +30,7 @@ tag: - NoRHEL7 - NoRHEL8 - targeted + - failinfedora - NoRHIVOS link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2111414 diff --git a/selinux-policy/pam_limits-and-related/main.fmf b/selinux-policy/pam_limits-and-related/main.fmf index c7f1024..aecf466 100644 --- a/selinux-policy/pam_limits-and-related/main.fmf +++ b/selinux-policy/pam_limits-and-related/main.fmf @@ -35,6 +35,7 @@ tag: - NoRHEL6 - NoRHEL7 - targeted + - failinfedora - NoRHIVOS link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1958819 diff --git a/selinux-policy/pcm-sensor-server-and-similar/main.fmf b/selinux-policy/pcm-sensor-server-and-similar/main.fmf index 146de4e..cea7e6f 100644 --- a/selinux-policy/pcm-sensor-server-and-similar/main.fmf +++ b/selinux-policy/pcm-sensor-server-and-similar/main.fmf @@ -31,6 +31,7 @@ tag: - NoRHEL8 - NoRHEL9 - targeted + - failinfedora - NoRHIVOS link: - verifies: https://issues.redhat.com/browse/RHEL-52838 diff --git a/selinux-policy/perf_event-and-related/main.fmf b/selinux-policy/perf_event-and-related/main.fmf index 2191e90..256d414 100644 --- a/selinux-policy/perf_event-and-related/main.fmf +++ b/selinux-policy/perf_event-and-related/main.fmf @@ -29,6 +29,7 @@ tag: - NoRHEL6 - NoRHEL7 - targeted + - failinfedora - NoRHIVOS link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1901957 diff --git a/selinux-policy/stalld-and-similar/main.fmf b/selinux-policy/stalld-and-similar/main.fmf index 8f566d3..ed7a6da 100644 --- a/selinux-policy/stalld-and-similar/main.fmf +++ b/selinux-policy/stalld-and-similar/main.fmf @@ -31,7 +31,6 @@ tag: - Tier2 - Tier2se - targeted - - failinfedora - NoRHIVOS tier: '2' link: diff --git a/selinux-policy/systemd-homed/main.fmf b/selinux-policy/systemd-homed/main.fmf index f98dce0..25edf64 100644 --- a/selinux-policy/systemd-homed/main.fmf +++ b/selinux-policy/systemd-homed/main.fmf @@ -34,4 +34,5 @@ extra-task: /CoreOS/selinux-policy/Regression/systemd-homed extra-nitrate: TC#0614608 id: 880ecade-0976-4303-a521-aead43e7f8c7 tag: + - failinfedora - NoRHIVOS diff --git a/selinux-policy/systemd-modules-load-and-similar/main.fmf b/selinux-policy/systemd-modules-load-and-similar/main.fmf index fd3339c..c4cf5f5 100644 --- a/selinux-policy/systemd-modules-load-and-similar/main.fmf +++ b/selinux-policy/systemd-modules-load-and-similar/main.fmf @@ -30,7 +30,6 @@ tag: - NoRHEL7 - f33friendly - targeted - - failinfedora - NoRHIVOS link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1358526 diff --git a/selinux-policy/systemd-userdbd-and-similar/main.fmf b/selinux-policy/systemd-userdbd-and-similar/main.fmf index 6bf7f84..2b2ff9a 100644 --- a/selinux-policy/systemd-userdbd-and-similar/main.fmf +++ b/selinux-policy/systemd-userdbd-and-similar/main.fmf @@ -19,7 +19,7 @@ recommend: - expect - openssh-clients - systemd - - initscripts + - /usr/sbin/service - shadow-utils environment: AVC_ERROR: +no_avc_check @@ -32,8 +32,8 @@ tag: - NoRHEL7 - NoRHEL8 - NoRHEL9 - - failinfedora - targeted + - failinfedora - NoRHIVOS link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1835630 diff --git a/selinux-policy/tlshd-and-similar/main.fmf b/selinux-policy/tlshd-and-similar/main.fmf index 34a61bc..a22b550 100644 --- a/selinux-policy/tlshd-and-similar/main.fmf +++ b/selinux-policy/tlshd-and-similar/main.fmf @@ -27,6 +27,7 @@ tag: - NoRHEL6 - NoRHEL7 - NoRHEL8 + - failinfedora - NoRHIVOS link: - verifies: https://issues.redhat.com/browse/RHEL-29439 diff --git a/selinux-policy/virt-install-additional/main.fmf b/selinux-policy/virt-install-additional/main.fmf index b7ba19a..06da58a 100644 --- a/selinux-policy/virt-install-additional/main.fmf +++ b/selinux-policy/virt-install-additional/main.fmf @@ -35,6 +35,7 @@ tag: - NoRHEL6 - NoRHEL7 - targeted + - failinfedora - NoRHIVOS link: - verifies: https://issues.redhat.com/browse/RHEL-56029 From 08a8075869b92be34f0976caaec34ee396c52747 Mon Sep 17 00:00:00 2001 From: Jan Onderka Date: Mon, 31 Mar 2025 17:39:13 +0200 Subject: [PATCH 467/626] Metadata update with NoRHIVOS or fusa tags --- libselinux/realpath_not_final-function/main.fmf | 1 + libselinux/selabel-functions/main.fmf | 1 + libselinux/selinux_boolean_sub-function/main.fmf | 1 + libselinux/selinux_restorecon-functions/main.fmf | 1 + libselinux/selinux_sestatus-functions/main.fmf | 1 + libselinux/setenforce/main.fmf | 1 + selinux-policy/rpm-suppress-stderr/main.fmf | 2 ++ selinux-policy/systemd-rfkill-and-similar/main.fmf | 1 + selinux-policy/systemd-sysctl-and-similar/main.fmf | 1 + 9 files changed, 10 insertions(+) diff --git a/libselinux/realpath_not_final-function/main.fmf b/libselinux/realpath_not_final-function/main.fmf index 8ea7d0b..ec6f594 100644 --- a/libselinux/realpath_not_final-function/main.fmf +++ b/libselinux/realpath_not_final-function/main.fmf @@ -18,6 +18,7 @@ tag: - TierCandidatesPASS - f32friendly - f33friendly + - fusa link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1404644 adjust: diff --git a/libselinux/selabel-functions/main.fmf b/libselinux/selabel-functions/main.fmf index f1a3283..f3425df 100644 --- a/libselinux/selabel-functions/main.fmf +++ b/libselinux/selabel-functions/main.fmf @@ -19,6 +19,7 @@ tag: - f33friendly - targeted - rhel10_broken + - fusa link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1390909 adjust: diff --git a/libselinux/selinux_boolean_sub-function/main.fmf b/libselinux/selinux_boolean_sub-function/main.fmf index 8acf7c6..6142ad1 100644 --- a/libselinux/selinux_boolean_sub-function/main.fmf +++ b/libselinux/selinux_boolean_sub-function/main.fmf @@ -18,6 +18,7 @@ tag: - TierCandidatesPASS - f32friendly - f33friendly + - fusa adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6 diff --git a/libselinux/selinux_restorecon-functions/main.fmf b/libselinux/selinux_restorecon-functions/main.fmf index 2819cbc..0eb9686 100644 --- a/libselinux/selinux_restorecon-functions/main.fmf +++ b/libselinux/selinux_restorecon-functions/main.fmf @@ -19,6 +19,7 @@ tag: - TIPpass_Security - TierCandidatesPASS - targeted + - fusa adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6 diff --git a/libselinux/selinux_sestatus-functions/main.fmf b/libselinux/selinux_sestatus-functions/main.fmf index 24abbb1..a3e83ee 100644 --- a/libselinux/selinux_sestatus-functions/main.fmf +++ b/libselinux/selinux_sestatus-functions/main.fmf @@ -21,6 +21,7 @@ tag: - f32friendly - f33friendly - targeted + - fusa tier: '1' adjust: - enabled: false diff --git a/libselinux/setenforce/main.fmf b/libselinux/setenforce/main.fmf index 195774e..9d32b29 100644 --- a/libselinux/setenforce/main.fmf +++ b/libselinux/setenforce/main.fmf @@ -20,6 +20,7 @@ tag: - f32friendly - f33friendly - targeted + - fusa adjust: - enabled: false when: distro == rhel-4, rhel-5 diff --git a/selinux-policy/rpm-suppress-stderr/main.fmf b/selinux-policy/rpm-suppress-stderr/main.fmf index cdf1174..f2e0832 100644 --- a/selinux-policy/rpm-suppress-stderr/main.fmf +++ b/selinux-policy/rpm-suppress-stderr/main.fmf @@ -9,6 +9,8 @@ test: ./test.sh framework: beakerlib duration: 10m enabled: true +tag: + - NoRHIVOS link: - https://issues.redhat.com/browse/RHEL-59192 adjust: diff --git a/selinux-policy/systemd-rfkill-and-similar/main.fmf b/selinux-policy/systemd-rfkill-and-similar/main.fmf index 8e84dc9..27d8a50 100644 --- a/selinux-policy/systemd-rfkill-and-similar/main.fmf +++ b/selinux-policy/systemd-rfkill-and-similar/main.fmf @@ -34,6 +34,7 @@ tag: - f32friendly - f33friendly - targeted + - fusa tier: '2' link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1290255 diff --git a/selinux-policy/systemd-sysctl-and-similar/main.fmf b/selinux-policy/systemd-sysctl-and-similar/main.fmf index 996e1d7..8764793 100644 --- a/selinux-policy/systemd-sysctl-and-similar/main.fmf +++ b/selinux-policy/systemd-sysctl-and-similar/main.fmf @@ -26,6 +26,7 @@ tag: - NoRHEL6 - NoRHEL7 - targeted + - fusa link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2056207 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2056999 From 9b73e15e1ed92147da243918ba3067847916aaec Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Thu, 3 Apr 2025 11:30:24 +0200 Subject: [PATCH 468/626] test if pcscd works OK with NoNewPrivileges=yes Recent pcscd + selinux-policy testing revealed SELinux denials which are caused by the NoNewPrivileges=yes option present in the following file: * /usr/lib/systemd/system/pcscd.service The SELinux denials are also accompanied by the following errors in the systemd journal: pcscd[...]: 00000000 ../src/pcscdaemon.c:704:main() cannot create /run/pcscd/pcscd.pid: Permission denied pcscd[...]: 61013391 ../src/pcscdaemon.c:843:clean_temp_files() Cannot remove /run/pcscd/pcscd.pid: No such file or directory In order to support the intentional changes and avoid these SELinux denials, I believe that SELinux policy should allow the nnp_transition for the pcscd_t domain. The TC looks for appropriate policy rules. The TC covers BZ#2355930, BZ#2356058 and BZ#2357154. --- selinux-policy/bz624405-pcsc-and-similar/Makefile | 3 +++ selinux-policy/bz624405-pcsc-and-similar/main.fmf | 3 +++ selinux-policy/bz624405-pcsc-and-similar/runtest.sh | 8 +++++++- 3 files changed, 13 insertions(+), 1 deletion(-) diff --git a/selinux-policy/bz624405-pcsc-and-similar/Makefile b/selinux-policy/bz624405-pcsc-and-similar/Makefile index d0e27fd..18528c2 100644 --- a/selinux-policy/bz624405-pcsc-and-similar/Makefile +++ b/selinux-policy/bz624405-pcsc-and-similar/Makefile @@ -87,6 +87,9 @@ $(METADATA): Makefile @echo "Bug: 1818759" >> $(METADATA) # Fedora 32 @echo "Bug: 1825182" >> $(METADATA) # Fedora 32 @echo "Bug: 1825188" >> $(METADATA) # Fedora 32 + @echo "Bug: 2355930" >> $(METADATA) # Fedora 43 + @echo "Bug: 2356058" >> $(METADATA) # Fedora 43 + @echo "Bug: 2357154" >> $(METADATA) # Fedora 43 rhts-lint $(METADATA) diff --git a/selinux-policy/bz624405-pcsc-and-similar/main.fmf b/selinux-policy/bz624405-pcsc-and-similar/main.fmf index 2d43271..7d7762f 100644 --- a/selinux-policy/bz624405-pcsc-and-similar/main.fmf +++ b/selinux-policy/bz624405-pcsc-and-similar/main.fmf @@ -49,6 +49,9 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1818759 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1825182 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1825188 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2355930 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2356058 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2357154 adjust: - enabled: false when: arch == s390, s390x diff --git a/selinux-policy/bz624405-pcsc-and-similar/runtest.sh b/selinux-policy/bz624405-pcsc-and-similar/runtest.sh index 0093aa4..c202480 100755 --- a/selinux-policy/bz624405-pcsc-and-similar/runtest.sh +++ b/selinux-policy/bz624405-pcsc-and-similar/runtest.sh @@ -89,8 +89,13 @@ rlJournalStart rlSEMatchPathCon "/usr/sbin/pcscd" "pcscd_exec_t" rlSESearchRule "dontaudit pcscd_t pcscd_t : process { setsched } [ ]" rlPhaseEnd + + rlPhaseStartTest "bz#2355930 + bz#2356058 + bz#2357154" + rlSESearchRule "allow init_t pcscd_t : process2 { nnp_transition } [ ]" + rlPhaseEnd fi + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- bz#624405" rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" if ! rlSEDefined ${PROCESS_CONTEXT} ; then @@ -101,9 +106,10 @@ rlJournalStart fi fi rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 + rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd + fi rlPhaseStartCleanup sleep 2 From 51aa683abb7cfd0b01b9527b2cd6cceaeb548dff Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Thu, 3 Apr 2025 09:31:18 +0200 Subject: [PATCH 469/626] test if gdm can talk to tuned-ppd via D-bus Recent tuned-ppd + gdm + selinux-policy testing revealed that SELinux prevents the D-bus communication between gdm and tuned-ppd. The TC reproduces the situation which is accompanied by the following record in the systemd journal: test-vm dbus-broker[...]: A security policy denied :1.54 to send method call /org/freedesktop/UPower/PowerProfiles:org.freedesktop.DBus.Properties.GetAll to :1.43. In order to enable the bi-directional communication, I believe that SELinux policy should allow sending D-bus messages between these 2 domains. The TC looks for appropriate policy rules and file context patterns. The TC covers RHEL-85849. --- selinux-policy/tuned-ppd-and-similar/Makefile | 3 ++- selinux-policy/tuned-ppd-and-similar/main.fmf | 2 ++ selinux-policy/tuned-ppd-and-similar/runtest.sh | 12 ++++++++++++ 3 files changed, 16 insertions(+), 1 deletion(-) diff --git a/selinux-policy/tuned-ppd-and-similar/Makefile b/selinux-policy/tuned-ppd-and-similar/Makefile index de75abf..4943a64 100644 --- a/selinux-policy/tuned-ppd-and-similar/Makefile +++ b/selinux-policy/tuned-ppd-and-similar/Makefile @@ -54,7 +54,7 @@ $(METADATA): Makefile @echo "Type: Regression" >> $(METADATA) @echo "TestTime: 10m" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console tuned-ppd /usr/sbin/service" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console tuned-ppd /usr/sbin/service gdm" >> $(METADATA) @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @@ -64,6 +64,7 @@ $(METADATA): Makefile @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA) @echo "Bug: RHEL-69450" >> $(METADATA) # RHEL-10 @echo "Bug: RHEL-69526" >> $(METADATA) # RHEL-9 + @echo "Bug: RHEL-85849" >> $(METADATA) # RHEL-10 rhts-lint $(METADATA) diff --git a/selinux-policy/tuned-ppd-and-similar/main.fmf b/selinux-policy/tuned-ppd-and-similar/main.fmf index 9d92b40..9244966 100644 --- a/selinux-policy/tuned-ppd-and-similar/main.fmf +++ b/selinux-policy/tuned-ppd-and-similar/main.fmf @@ -16,6 +16,7 @@ recommend: - selinux-policy-targeted - setools-console - /usr/sbin/service + - gdm environment: AVC_ERROR: +no_avc_check duration: 10m @@ -30,6 +31,7 @@ tag: link: - verifies: https://issues.redhat.com/browse/RHEL-69450 - verifies: https://issues.redhat.com/browse/RHEL-69526 + - verifies: https://issues.redhat.com/browse/RHEL-85849 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 diff --git a/selinux-policy/tuned-ppd-and-similar/runtest.sh b/selinux-policy/tuned-ppd-and-similar/runtest.sh index 7c16a30..d228c1d 100755 --- a/selinux-policy/tuned-ppd-and-similar/runtest.sh +++ b/selinux-policy/tuned-ppd-and-similar/runtest.sh @@ -74,13 +74,25 @@ rlJournalStart rlSESearchRule "allow init_t ${FILE_CONTEXT} : file { getattr open read execute } [ ]" rlPhaseEnd + if rlSEDefined "xdm_t tuned_ppd_t" ; then + rlPhaseStartTest "RHEL-85849" + rlSESearchRule "allow xdm_t tuned_ppd_t : dbus { send_msg } [ ]" + rlSESearchRule "allow tuned_ppd_t xdm_t : dbus { send_msg } [ ]" + rlPhaseEnd + fi + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" + rlRun "service gdm start" + rlRun "service gdm status" + sleep 2 rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 rlRun "busctl introspect net.hadess.PowerProfiles /org/freedesktop/UPower/PowerProfiles" rlRun "busctl introspect net.hadess.PowerProfiles /net/hadess/PowerProfiles" rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + sleep 2 + rlRun "service gdm stop" rlPhaseEnd fi From 5ea123d59ea0e7735876bb7e5bb2125169890bb3 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 15 Apr 2025 14:26:28 +0200 Subject: [PATCH 470/626] add FMF id for the selinux-testsuite --- kernel/selinux-testsuite/main.fmf | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/kernel/selinux-testsuite/main.fmf b/kernel/selinux-testsuite/main.fmf index ebc5ff6..1aad4fb 100644 --- a/kernel/selinux-testsuite/main.fmf +++ b/kernel/selinux-testsuite/main.fmf @@ -3,16 +3,17 @@ description: | This TC runs a functional test suite for the LSM-based SELinux security module. contact: Milos Malik component: -- kernel -- selinux-policy + - kernel + - selinux-policy framework: beakerlib duration: 1h tier: 1 enabled: true adjust: -- enabled: false - when: distro < rhel-6 -- enabled: false - when: arch = i386 + - enabled: false + when: distro < rhel-6 + - enabled: false + when: arch = i386 environment: - AVC_ERROR: +no_avc_check + AVC_ERROR: +no_avc_check +id: f491d519-a7cd-4acf-8405-67a6afcc678a From e07c1a96fb64c9379e9a66d2e9151f25187c8467 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 15 Apr 2025 11:06:06 +0200 Subject: [PATCH 471/626] fix the systemd-journal-upload test for RHEL-9.x One of the test phases failed on RHEL-9.6 because the systemd_conf_t type is not defined there. The issue should be fixed now. --- selinux-policy/systemd-journal-upload/runtest.sh | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/selinux-policy/systemd-journal-upload/runtest.sh b/selinux-policy/systemd-journal-upload/runtest.sh index 09a627e..fe8367e 100755 --- a/selinux-policy/systemd-journal-upload/runtest.sh +++ b/selinux-policy/systemd-journal-upload/runtest.sh @@ -23,11 +23,16 @@ rlJournalStart sleep 2 rlPhaseEnd - if seinfo -t | grep -q ${PROCESS_CONTEXT} ; then + if rlSEDefined ${PROCESS_CONTEXT} ; then rlPhaseStartTest "RHEL-57774 + RHEL-62196" rlSEMatchPathCon "/usr/lib/systemd/systemd-journal-upload" "systemd_journal_upload_exec_t" - rlSEMatchPathCon "/run/systemd/journal-upload.conf.d" "systemd_conf_t" - rlSESearchRule "allow systemd_journal_upload_t systemd_conf_t : dir { read } [ ]" + if rlSEDefined "systemd_conf_t" ; then + rlSEMatchPathCon "/run/systemd/journal-upload.conf.d" "systemd_conf_t" + rlSESearchRule "allow systemd_journal_upload_t systemd_conf_t : dir { read } [ ]" + else + rlSEMatchPathCon "/run/systemd/journal-upload.conf.d" "init_var_run_t" + rlSESearchRule "allow systemd_journal_upload_t init_var_run_t : dir { read } [ ]" + fi rlPhaseEnd fi From 5f0d894eaacf1f08ae70801f5733c3bd6bf013f9 Mon Sep 17 00:00:00 2001 From: Stepan Broz Date: Tue, 15 Apr 2025 17:20:43 +0200 Subject: [PATCH 472/626] logwatch-and-similar: Adjust test relevancy Do not test RHEL-34135 on RHEL-9.4 and lower --- selinux-policy/logwatch-and-similar/runtest.sh | 2 ++ 1 file changed, 2 insertions(+) diff --git a/selinux-policy/logwatch-and-similar/runtest.sh b/selinux-policy/logwatch-and-similar/runtest.sh index c712baf..c3321f1 100755 --- a/selinux-policy/logwatch-and-similar/runtest.sh +++ b/selinux-policy/logwatch-and-similar/runtest.sh @@ -53,11 +53,13 @@ rlJournalStart sleep 2 rlPhaseEnd + if ! rlIsRHEL "<9.5" ; then rlPhaseStartTest "bz#2183432 + RHEL-34135" rlRun "ls -Z /proc/sys/net/ipv6/conf/all/disable_ipv6 | grep :sysctl_net_t" rlSESearchRule "allow logwatch_mail_t sysctl_net_t : dir { search } [ ]" rlSESearchRule "allow logwatch_mail_t sysctl_net_t : file { getattr open read } [ ]" rlPhaseEnd + fi if ! rlIsRHEL 9 && ! rlIsCentOS 9 ; then rlPhaseStartTest "bz#2270484" From 2215420c41b087a57646c0ea2ec96d89f7fe0f95 Mon Sep 17 00:00:00 2001 From: Stepan Broz Date: Tue, 15 Apr 2025 16:15:22 +0200 Subject: [PATCH 473/626] dhcpcd-and-similar: Adjust test relevancy Do not test "bz#2269708 + bz#2270733" on RHEL 9.4 and lower. --- selinux-policy/dhcpcd-and-similar/runtest.sh | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/selinux-policy/dhcpcd-and-similar/runtest.sh b/selinux-policy/dhcpcd-and-similar/runtest.sh index ba9ea50..38218ea 100755 --- a/selinux-policy/dhcpcd-and-similar/runtest.sh +++ b/selinux-policy/dhcpcd-and-similar/runtest.sh @@ -91,7 +91,7 @@ rlJournalStart rlPhaseEnd fi - if ! rlIsRHEL 8 ; then + if ! rlIsRHEL 8 && ! ( rlIsRHEL 9 && rlIsRHEL "<9.5" ); then rlPhaseStartTest "bz#2269708 + bz#2270733" rlSEMatchPathCon "/run/netns" "ifconfig_var_run_t" rlSESearchRule "allow dhcpc_t ifconfig_var_run_t : dir { read } [ ]" @@ -110,9 +110,11 @@ rlJournalStart fi rlPhaseStartTest "real scenario -- standalone service" - rlRun "ip netns add test-ns" - rlRun "ip netns del test-ns" - rlRun "ls -lZR /run/netns" + if ! rlIsRHEL "<9.5" ; then + rlRun "ip netns add test-ns" + rlRun "ip netns del test-ns" + rlRun "ls -lZR /run/netns" + fi rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" if ! rlSEDefined ${PROCESS_CONTEXT} ; then if rlIsRHEL 5 6 ; then From 0f5ba83544fb02bcd4ae801b4542c5c35fecb07f Mon Sep 17 00:00:00 2001 From: Stepan Broz Date: Fri, 11 Apr 2025 14:36:49 +0200 Subject: [PATCH 474/626] selinux-policy/dmidecode-and-similar: Adjust relevancy Do not test RHEL-16104 on RHEL<9.5 --- selinux-policy/dmidecode-and-similar/runtest.sh | 2 ++ 1 file changed, 2 insertions(+) diff --git a/selinux-policy/dmidecode-and-similar/runtest.sh b/selinux-policy/dmidecode-and-similar/runtest.sh index 3abba0d..b8ff02c 100755 --- a/selinux-policy/dmidecode-and-similar/runtest.sh +++ b/selinux-policy/dmidecode-and-similar/runtest.sh @@ -132,6 +132,7 @@ rlJournalStart done rlPhaseEnd + if ! rlIsRHEL "<9.5"; then rlPhaseStartTest "RHEL-16104" rlSEMatchPathCon "/var" "var_t" rlSEMatchPathCon "/var/log" "var_log_t" @@ -156,6 +157,7 @@ rlJournalStart rlRun "userdel -rfZ sysadm-user" rlRun "setsebool ssh_sysadm_login off" rlPhaseEnd + fi rlPhaseStartCleanup sleep 2 From 4e9e25f314c77715c78ac979c46f9511a303965b Mon Sep 17 00:00:00 2001 From: Stepan Broz Date: Tue, 15 Apr 2025 18:28:10 +0200 Subject: [PATCH 475/626] power-profiles-daemon-and-similar: Adjust test relevancy Do not test RHEL-61117 on RHEL-9.5 and lower. --- selinux-policy/power-profiles-daemon-and-similar/runtest.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/selinux-policy/power-profiles-daemon-and-similar/runtest.sh b/selinux-policy/power-profiles-daemon-and-similar/runtest.sh index 6c5561a..fef6400 100755 --- a/selinux-policy/power-profiles-daemon-and-similar/runtest.sh +++ b/selinux-policy/power-profiles-daemon-and-similar/runtest.sh @@ -67,7 +67,7 @@ rlJournalStart sleep 2 rlPhaseEnd - if rlIsRHEL 9 || rlIsCentOS 9 ; then + if ( rlIsRHEL 9 && rlIsRHEL ">9.5" ) || rlIsCentOS 9 ; then rlPhaseStartTest "RHEL-61117" rlSEMatchPathCon ${FILE_PATH} ${FILE_CONTEXT} rlSESearchRule "allow powerprofiles_t powerprofiles_t : capability2 { bpf } [ ]" From 1fcc75ae8393970593b083be91441eab91a202ca Mon Sep 17 00:00:00 2001 From: Stepan Broz Date: Mon, 14 Apr 2025 18:37:51 +0200 Subject: [PATCH 476/626] boothd-and-similar: Adjust relevancy Don't test RHEL-57104 + RHEL-58060 and RHEL-57104 on RHEL-9.5 or lower. Test still FAILs in real-scenario on RHEL-9.5 and lower. --- selinux-policy/boothd-and-similar/runtest.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/selinux-policy/boothd-and-similar/runtest.sh b/selinux-policy/boothd-and-similar/runtest.sh index ad7948e..e32dae0 100755 --- a/selinux-policy/boothd-and-similar/runtest.sh +++ b/selinux-policy/boothd-and-similar/runtest.sh @@ -60,7 +60,7 @@ rlJournalStart sleep 2 rlPhaseEnd - if seinfo -t | grep -q boothd ; then + if seinfo -t | grep -q boothd && ! rlIsRHEL "<9.6" && ! rlIsCentOS "<9.6" ; then rlPhaseStartTest "RHEL-45907" rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" rlSEMatchPathCon "/run/systemd/userdb" "systemd_userdbd_runtime_t" @@ -80,7 +80,7 @@ rlJournalStart rlPhaseEnd fi - if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ]; then rlPhaseStartTest "real scenario -- standalone service" IF_NAME=`route | grep default | awk '{ print $8 }'` IP_ADDRESS=`ip addr show ${IF_NAME} | grep 'inet ' | cut -d / -f 1 | awk '{ print $2 }' | head -n 1` From 3064e3488824639dc250bef49498503d00441c2e Mon Sep 17 00:00:00 2001 From: Stepan Broz Date: Mon, 14 Apr 2025 18:44:59 +0200 Subject: [PATCH 477/626] boothd-and-similar: Adjust relevancy for RHEL-9 RHEL-57104 and other are fixed in RHEL-9.6, RHEL-8 works --- selinux-policy/boothd-and-similar/main.fmf | 3 +++ 1 file changed, 3 insertions(+) diff --git a/selinux-policy/boothd-and-similar/main.fmf b/selinux-policy/boothd-and-similar/main.fmf index 2b30bee..446a168 100644 --- a/selinux-policy/boothd-and-similar/main.fmf +++ b/selinux-policy/boothd-and-similar/main.fmf @@ -40,6 +40,9 @@ adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 because: the booth package is not available there + - enabled: false + when: distro ~< rhel-9.6 + because: RHEL-57104 and other is fixed in RHEL-9.6, RHEL-8 not affected extra-summary: /CoreOS/selinux-policy/Regression/boothd-and-similar extra-task: /CoreOS/selinux-policy/Regression/boothd-and-similar extra-nitrate: TC#0617767 From 06e6c863afd155735d5ced02b12edd5991d92fde Mon Sep 17 00:00:00 2001 From: Stepan Broz Date: Thu, 17 Apr 2025 16:31:11 +0200 Subject: [PATCH 478/626] systemd-tmpfiles-and-similar: Adjust test relevancy Do not execute this test on RHEL 9.4 or lower. --- selinux-policy/systemd-tmpfiles-and-similar/main.fmf | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/selinux-policy/systemd-tmpfiles-and-similar/main.fmf b/selinux-policy/systemd-tmpfiles-and-similar/main.fmf index 37bd8f2..74c164d 100644 --- a/selinux-policy/systemd-tmpfiles-and-similar/main.fmf +++ b/selinux-policy/systemd-tmpfiles-and-similar/main.fmf @@ -40,8 +40,9 @@ link: - verifies: https://issues.redhat.com/browse/RHEL-44191 adjust: - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + when: distro < rhel-9.5 continue: false + because: RHEL-40374 is fixed in RHEL-9.5 and RHEL-44191 in RHEL-10 extra-summary: /CoreOS/selinux-policy/Regression/systemd-tmpfiles-and-similar extra-task: /CoreOS/selinux-policy/Regression/systemd-tmpfiles-and-similar extra-nitrate: TC#0617577 From 1ecae443e08fb2fccdf8daa81003c6f81fd8d6f8 Mon Sep 17 00:00:00 2001 From: Stepan Broz Date: Thu, 17 Apr 2025 15:35:07 +0200 Subject: [PATCH 479/626] systemd-notify-and-similar: Adjust test relevancy Do not test "RHEL-25514 + RHEL-25605" on RHEL-9.4 or lower. Also, upload ssh.exp so that the test works correctly in 1minutetip. --- selinux-policy/systemd-notify-and-similar/Makefile | 2 +- selinux-policy/systemd-notify-and-similar/runtest.sh | 2 ++ 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/selinux-policy/systemd-notify-and-similar/Makefile b/selinux-policy/systemd-notify-and-similar/Makefile index 24161e3..b8c2da8 100644 --- a/selinux-policy/systemd-notify-and-similar/Makefile +++ b/selinux-policy/systemd-notify-and-similar/Makefile @@ -29,7 +29,7 @@ export TESTVERSION=1.0 BUILT_FILES= -FILES=$(METADATA) runtest.sh Makefile PURPOSE local-notifier.service notifier.sh reproducer.service +FILES=$(METADATA) runtest.sh Makefile PURPOSE local-notifier.service notifier.sh reproducer.service ssh.exp .PHONY: all install download clean diff --git a/selinux-policy/systemd-notify-and-similar/runtest.sh b/selinux-policy/systemd-notify-and-similar/runtest.sh index 2a5a9d8..45a16b4 100755 --- a/selinux-policy/systemd-notify-and-similar/runtest.sh +++ b/selinux-policy/systemd-notify-and-similar/runtest.sh @@ -103,6 +103,7 @@ rlJournalStart rlRun "systemctl daemon-reload" rlPhaseEnd + if ! rlIsRHEL "<9.5" ; then rlPhaseStartTest "RHEL-25514 + RHEL-25605" rlSEMatchPathCon "/usr/bin/systemd-notify" "systemd_notify_exec_t" rlSEMatchPathCon "/run/systemd/notify" "init_var_run_t" @@ -118,6 +119,7 @@ rlJournalStart rlRun "rm -f /etc/systemd/system/reproducer.service" rlRun "systemctl daemon-reload" rlPhaseEnd + fi rlPhaseStartCleanup sleep 2 From 094cc6f8c0c49b97f6504e677c18a4887a21b7ac Mon Sep 17 00:00:00 2001 From: Zdenek Pytela Date: Tue, 15 Apr 2025 15:35:14 +0200 Subject: [PATCH 480/626] Update systemd-generators test The loop42 device file is used by other tests, so the name was changed to loop17 not to clash. Minor improvements. --- .../systemd-generators/mnt-loop.mount | 4 ++-- selinux-policy/systemd-generators/runtest.sh | 18 +++++++++++------- 2 files changed, 13 insertions(+), 9 deletions(-) diff --git a/selinux-policy/systemd-generators/mnt-loop.mount b/selinux-policy/systemd-generators/mnt-loop.mount index 3f0b925..840dd8c 100644 --- a/selinux-policy/systemd-generators/mnt-loop.mount +++ b/selinux-policy/systemd-generators/mnt-loop.mount @@ -4,9 +4,9 @@ Documentation=man:fstab(5) man:systemd-fstab-generator(8) SourcePath=/tmp/fstab Before=local-fs.target -After=blockdev@dev-loop42.target +After=blockdev@dev-loop17.target [Mount] -What=/dev/loop42 +What=/dev/loop17 Where=/mnt/loop Type=ext4 diff --git a/selinux-policy/systemd-generators/runtest.sh b/selinux-policy/systemd-generators/runtest.sh index bc8be92..1cd2a13 100755 --- a/selinux-policy/systemd-generators/runtest.sh +++ b/selinux-policy/systemd-generators/runtest.sh @@ -70,7 +70,7 @@ rlJournalStart [ -x "$FILEPATH" ] || continue CONTEXT=$(stat -c"%C" "${FILEPATH}") [ "$?" = 0 ] || continue - if [[ ${CONTEXT} =~ ":init_exec_t:" ]] || [[ ${CONTEXT} =~ ":lib_t:" ]] || [[ ${CONTEXT} =~ ":usr_t:" ]] + if [[ ${CONTEXT} =~ ":init_exec_t:" ]] || [[ ${CONTEXT} =~ ":lib_t:" ]] || [[ ${CONTEXT} =~ ":usr_t:" ]] || [[ ${CONTEXT} =~ ":systemd_generic_generator_exec_t:" ]] then SD_SYSTEM_GENERATORS_NOTCONFINED="${SD_SYSTEM_GENERATORS_NOTCONFINED} $FILEPATH" else @@ -120,7 +120,7 @@ rlJournalStart rlPhaseStartTest "systemd-fstab-generator /etc" rlFileBackup "/etc/fstab" rlRun "mkdir -p /newproc" - echo "/proc /newproc none bind 0 0" >> /etc/fstab + rlRun "echo \"/proc /newproc none bind 0 0\" >> /etc/fstab" rlRun "SYSTEMD_LOG_LEVEL=debug systemd-run -u sdfg-manual.service /usr/lib/systemd/system-generators/systemd-fstab-generator /run/systemd/generator" rlRun "journalctl -u sdfg-manual.service" rlRun "systemctl daemon-reload" @@ -132,14 +132,15 @@ rlJournalStart # fstab-generator 2 - use a local fstab-like file rlPhaseStartTest "systemd-fstab-generator /tmp" - echo "/dev/loop42 /mnt/loop ext4 defaults 0 0" >> /tmp/fstab + rlRun "> /tmp/fstab" + rlRun "echo \"/dev/loop17 /mnt/loop ext4 defaults 0 0\" >> /tmp/fstab" rlRun "mkdir -p /mnt/loop" rlRun "chcon --reference /etc/fstab /tmp/fstab" rlRun "dd if=/dev/zero of=/tmp/loopfile bs=16M count=1" rlRun "chcon -t user_tmp_t /tmp/loopfile" - rlRun "losetup /dev/loop42 /tmp/loopfile" + rlRun "losetup /dev/loop17 /tmp/loopfile" rlRun "losetup -j /tmp/loopfile" - rlRun "mkfs.ext4 /dev/loop42" + rlRun "mkfs.ext4 /dev/loop17" rlRun "systemd-run -E SYSTEMD_FSTAB=/tmp/fstab -u sdfg-tmpfstab.service /usr/lib/systemd/system-generators/systemd-fstab-generator /run/systemd/generator" rlRun "diff /run/systemd/generator/mnt-loop.mount mnt-loop.mount" rlRun "ls -lZa /mnt/loop" @@ -161,6 +162,8 @@ rlJournalStart # exists and is executable, and if it is, pulls the rc-local.service unit into the # boot process. # the service unit file already exists: /usr/lib/systemd/system/rc-local.service + # the generator just creates + # /run/systemd/generator/multi-user.target.wants/rc-local.service symlink rlPhaseStartTest "systemd-rc-local-generator" cat > /etc/rc.d/rc.local << EOF #!/bin/bash @@ -237,8 +240,9 @@ EOF rlPhaseStartCleanup sleep 2 rlRun "rmdir /mnt/loop" - rlRun "losetup -d /dev/loop42" - rlRun "/bin/rm /tmp/loopfile" + rlRun "losetup -d /dev/loop17" + rlRun "rm -f /dev/loop17" + rlRun "rm /tmp/loopfile" rlFileRestore # fixme: remove non-natural generators rlRun "systemctl daemon-reload" From 3b84c2b16536dec9f926b1c7373f209ca1255042 Mon Sep 17 00:00:00 2001 From: Stepan Broz Date: Thu, 17 Apr 2025 16:12:26 +0200 Subject: [PATCH 481/626] systemd-sysctl-and-similar: Adjust test relevancy Do not test "RHEL-56988 + RHEL-58380" on RHEL 9.5 or lower. --- .../systemd-sysctl-and-similar/runtest.sh | 36 ++++++++++--------- 1 file changed, 19 insertions(+), 17 deletions(-) diff --git a/selinux-policy/systemd-sysctl-and-similar/runtest.sh b/selinux-policy/systemd-sysctl-and-similar/runtest.sh index 4667ee4..476f811 100755 --- a/selinux-policy/systemd-sysctl-and-similar/runtest.sh +++ b/selinux-policy/systemd-sysctl-and-similar/runtest.sh @@ -51,24 +51,26 @@ rlJournalStart rlPhaseEnd if ! rlIsRHEL 8 && ! rlIsCentOS 8 ; then - rlPhaseStartTest "bz#2056207 + bz#2056999" - rlSEMatchPathCon "/usr/lib/systemd/systemd-sysctl" "systemd_sysctl_exec_t" - rlRun "ls -Z /proc/sys/fs/suid_dumpable | grep :proc_security_t" - rlRun "ls -Z /proc/sys/fs/protected_hardlinks | grep :proc_security_t" - rlRun "ls -Z /proc/sys/fs/protected_symlinks | grep :proc_security_t" - rlRun "ls -Z /proc/sys/kernel/kptr_restrict | grep :proc_security_t" - rlSESearchRule "allow systemd_sysctl_t proc_security_t : file { read } [ ]" - rlPhaseEnd + rlPhaseStartTest "bz#2056207 + bz#2056999" + rlSEMatchPathCon "/usr/lib/systemd/systemd-sysctl" "systemd_sysctl_exec_t" + rlRun "ls -Z /proc/sys/fs/suid_dumpable | grep :proc_security_t" + rlRun "ls -Z /proc/sys/fs/protected_hardlinks | grep :proc_security_t" + rlRun "ls -Z /proc/sys/fs/protected_symlinks | grep :proc_security_t" + rlRun "ls -Z /proc/sys/kernel/kptr_restrict | grep :proc_security_t" + rlSESearchRule "allow systemd_sysctl_t proc_security_t : file { read } [ ]" + rlPhaseEnd - rlPhaseStartTest "RHEL-56988 + RHEL-58380" - rlRun "man sysctl.d | grep /run/sysctl" - rlRun "mkdir -pZ /run/sysctl.d" - rlRun "echo 'net.ipv4.conf.eno1.rp_filter=0' > /run/sysctl.d/51-rp_filter.conf" - rlRun "restorecon -Rv /run/sysctl.d" - rlRun "service systemd-sysctl stop" - rlRun "service systemd-sysctl start" - rlRun "service systemd-sysctl status" 0,3 - rlPhaseEnd + if ! rlIsRHEL "<9.6" ; then + rlPhaseStartTest "RHEL-56988 + RHEL-58380" + rlRun "man sysctl.d | grep /run/sysctl" + rlRun "mkdir -pZ /run/sysctl.d" + rlRun "echo 'net.ipv4.conf.eno1.rp_filter=0' > /run/sysctl.d/51-rp_filter.conf" + rlRun "restorecon -Rv /run/sysctl.d" + rlRun "service systemd-sysctl stop" + rlRun "service systemd-sysctl start" + rlRun "service systemd-sysctl status" 0,3 + rlPhaseEnd + fi fi rlPhaseStartTest "real scenario" From c2ff2147e96af0d22626b8f6b38fc3579a657768 Mon Sep 17 00:00:00 2001 From: Stepan Broz Date: Thu, 17 Apr 2025 14:05:53 +0200 Subject: [PATCH 482/626] systemd-modules-load-and-similar: Adjust test relevancy Do not test RHEL-54591 on RHEL-9.5 or lower. Fixed in RHEL-9.6 by RHEL-61453. --- .../systemd-modules-load-and-similar/runtest.sh | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/selinux-policy/systemd-modules-load-and-similar/runtest.sh b/selinux-policy/systemd-modules-load-and-similar/runtest.sh index 8b7172c..616028f 100755 --- a/selinux-policy/systemd-modules-load-and-similar/runtest.sh +++ b/selinux-policy/systemd-modules-load-and-similar/runtest.sh @@ -105,9 +105,11 @@ rlJournalStart rlPhaseEnd rlPhaseStartTest "real scenario -- standalone service" - rlRun "mkdir -p /run/modprobe.d" - rlRun "echo 'blacklist cipher_null' > /run/modprobe.d/test.conf" - rlRun "restorecon -Rv /run/modprobe.d" + if ! rlIsRHEL "<9.6" ; then + rlRun "mkdir -p /run/modprobe.d" + rlRun "echo 'blacklist cipher_null' > /run/modprobe.d/test.conf" + rlRun "restorecon -Rv /run/modprobe.d" + fi rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" rlRun "echo ${KERNEL_MODULE} > /etc/modules-load.d/${KERNEL_MODULE}.conf" rlRun "lsmod" @@ -142,6 +144,7 @@ rlJournalStart rlSESearchRule "allow systemd_modules_load_t kmsg_device_t : chr_file { write } [ ]" rlPhaseEnd + if ! ( rlIsRHEL 9 && rlIsRHEL "<9.6" ) ; then rlPhaseStartTest "RHEL-54591" rlSEMatchPathCon "/usr/lib/systemd/systemd-modules-load" "systemd_modules_load_exec_t" rlSEMatchPathCon "/run/modprobe.d" "modules_conf_t" @@ -149,6 +152,7 @@ rlJournalStart rlSESearchRule "allow systemd_modules_load_t modules_conf_t : file { getattr open read } [ ]" rlPhaseEnd fi + fi rlPhaseStartCleanup sleep 2 From 59307b7ba6de212cc62be5c08d643d2aec080b7f Mon Sep 17 00:00:00 2001 From: Stepan Broz Date: Thu, 17 Apr 2025 15:45:42 +0200 Subject: [PATCH 483/626] systemd-run-and-similar: Adjust test relevancy Do not test "RHEL-61928 + RHEL-62185" on RHEL-9.6 or lower. --- selinux-policy/systemd-run-and-similar/runtest.sh | 2 ++ 1 file changed, 2 insertions(+) diff --git a/selinux-policy/systemd-run-and-similar/runtest.sh b/selinux-policy/systemd-run-and-similar/runtest.sh index 32f5831..38b0fa4 100755 --- a/selinux-policy/systemd-run-and-similar/runtest.sh +++ b/selinux-policy/systemd-run-and-similar/runtest.sh @@ -74,12 +74,14 @@ rlJournalStart rlRun "ls -alZ /var/lib/myservice0 /var/lib/private/myservice0" rlPhaseEnd + if ! rlIsRHEL "<9.7" ; then rlPhaseStartTest "RHEL-61928 + RHEL-62185" rlSESearchRule "allow system_dbusd_t unconfined_service_t : unix_stream_socket { read write } [ ]" rlRun -s "systemd-run --wait -- systemd-run --user --machine=adm@ --wait true" rlRun "grep -i success $rlRun_LOG" rm -f $rlRun_LOG rlPhaseEnd + fi rlPhaseStartCleanup sleep 2 From 4cb4fb9cad5f81d7449bffadadec14343b609c03 Mon Sep 17 00:00:00 2001 From: Stepan Broz Date: Thu, 17 Apr 2025 17:09:00 +0200 Subject: [PATCH 484/626] tuned-ppd-and-similar: Adjust test relevancy The "tuned-ppd" package was introduced in RHEL-9.5. --- selinux-policy/tuned-ppd-and-similar/main.fmf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/selinux-policy/tuned-ppd-and-similar/main.fmf b/selinux-policy/tuned-ppd-and-similar/main.fmf index 9244966..909655b 100644 --- a/selinux-policy/tuned-ppd-and-similar/main.fmf +++ b/selinux-policy/tuned-ppd-and-similar/main.fmf @@ -34,7 +34,7 @@ link: - verifies: https://issues.redhat.com/browse/RHEL-85849 adjust: - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 + when: distro < rhel-9.5 because: the tuned-ppd package is not available there extra-summary: /CoreOS/selinux-policy/Regression/tuned-ppd-and-similar extra-task: /CoreOS/selinux-policy/Regression/tuned-ppd-and-similar From 6ed3370e171d469fabe4b0074229e43249901bb7 Mon Sep 17 00:00:00 2001 From: Amith Kumar Date: Wed, 23 Apr 2025 08:32:25 +0530 Subject: [PATCH 485/626] fix homectl test case failures The selinux-policy/systemd-homed test suite failed during recent test run on Fedora-rawhide. Root cause of failure appears to be changed behavior of command "homectl passwd". Fix the test code to address the failures. Couple of other ERRORs are due to import failure of selinux-policy/common library which is out-of-scope of this fix. Signed-off-by: Amith Kumar --- selinux-policy/systemd-homed/runtest.sh | 21 +++++++++++++-------- 1 file changed, 13 insertions(+), 8 deletions(-) diff --git a/selinux-policy/systemd-homed/runtest.sh b/selinux-policy/systemd-homed/runtest.sh index dd7969d..0776bb8 100755 --- a/selinux-policy/systemd-homed/runtest.sh +++ b/selinux-policy/systemd-homed/runtest.sh @@ -31,14 +31,18 @@ PACKAGE1="selinux-policy" PACKAGE2="systemd" +INSTALL_OPTION="" +if dnf install --help | grep -q skip-broken ; then + INSTALL_OPTION="${INSTALL_OPTION} --skip-broken" +fi function create_u() { expect -f - <<<' set timeout -1 spawn homectl create test_u --disk-size=500M - expect "*: " + expect "*test_u: " send -- "Red_123hat\r" - expect "*: " + expect "*test_u*: " send -- "Red_123hat\r" expect eof foreach {pid spawnid os_error_flag value} [wait] break @@ -74,10 +78,12 @@ function passwd_u() { expect -f - <<<' set timeout -1 spawn homectl passwd test_u - expect "*: " + expect "*test_u: " send -- "Sim_123pl1\r" - expect "*: " + expect "*test_u*: " send -- "Sim_123pl1\r" + expect "*test_u: " + send -- "Red_123hat\r" expect eof foreach {pid spawnid os_error_flag value} [wait] break exit $value @@ -88,7 +94,7 @@ function auth_u() { expect -f - <<<' set timeout -1 spawn homectl authenticate test_u - expect "*: " + expect "*test_u: " send -- "Sim_123pl1\r" expect eof foreach {pid spawnid os_error_flag value} [wait] break @@ -100,7 +106,7 @@ function resize_u() { expect -f - <<<' set timeout -1 spawn homectl resize test_u 425.0M - expect "*: " + expect "*test_u: " send -- "Sim_123pl1\r" expect eof foreach {pid spawnid os_error_flag value} [wait] break @@ -153,7 +159,7 @@ rlJournalStart rlPhaseStartTest "homectl inspect" sleep 20 tst_Time="$(date '+%T')" - rlRun "homectl inspect test_u" + rlRun "homectl inspect test_u --no-pager" sleep 5 rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time --input-logs" 1 rlPhaseEnd @@ -221,7 +227,6 @@ rlJournalStart rlSEMatchPathCon "/var/cache/systemd/" "systemd_cache_t" rlSEMatchPathCon "/var/cache/systemd/home/" "systemd_homed_cache_t" rlSESearchRule "allow systemd_homed_t systemd_homed_cache_t : dir { read } [ ]" - rlRun "service systemd-homed restart" rlPhaseEnd From e3660e97bce27c4abf0d60519844f76aede813f6 Mon Sep 17 00:00:00 2001 From: Stepan Broz Date: Tue, 15 Apr 2025 15:17:44 +0200 Subject: [PATCH 486/626] chronyd-and-similar: Adjust test relevancy Do not test "RHEL-82299 + RHEL-82308" and "chronyd-restricted" on RHEL lower than 9.7 or 10.1 respectively. --- selinux-policy/chronyd-and-similar/runtest.sh | 50 ++++++++++--------- 1 file changed, 26 insertions(+), 24 deletions(-) diff --git a/selinux-policy/chronyd-and-similar/runtest.sh b/selinux-policy/chronyd-and-similar/runtest.sh index 4e09f92..b88e654 100755 --- a/selinux-policy/chronyd-and-similar/runtest.sh +++ b/selinux-policy/chronyd-and-similar/runtest.sh @@ -419,33 +419,35 @@ rlJournalStart rlPhaseEnd fi - if rlSEDefined "chronyd_restricted_t" ; then - rlPhaseStartTest "RHEL-82299 + RHEL-82308" - rlSESearchRule "allow chronyc_t chronyd_restricted_t : unix_dgram_socket { sendto } [ ]" - rlSESearchRule "allow chronyd_restricted_t chronyc_t : unix_dgram_socket { sendto } [ ]" - rlPhaseEnd - fi + if ! ( rlIsRHEL 9 && rlIsRHEL "<9.7" ) && ! ( rlIsRHEL 10 && rlIsRHEL "<10.1" ) ; then + if rlSEDefined "chronyd_restricted_t" ; then + rlPhaseStartTest "RHEL-82299 + RHEL-82308" + rlSESearchRule "allow chronyc_t chronyd_restricted_t : unix_dgram_socket { sendto } [ ]" + rlSESearchRule "allow chronyd_restricted_t chronyc_t : unix_dgram_socket { sendto } [ ]" + rlPhaseEnd + fi - if [ -f ${CHRONYD_RESTRICTED_UNIT_FILE} ]; then - rlPhaseStartTest "chronyd-restricted -- bz#2169949 + RHEL-18219" - rlRun "systemctl stop ${SERVICE_NAME}" - rlRun "mkdir -p ${CHRONYD_RESTRICTED_UNIT_DROPIN_DIR}" - if ! grep ^SELinuxContext= ${CHRONYD_RESTRICTED_UNIT_FILE} ; then - # temporary configuration change until it becomes a part of the chrony package - rlRun "echo -e '[Service]\nSELinuxContext=system_u:system_r:chronyd_restricted_t:s0\n' > ${CHRONYD_RESTRICTED_UNIT_DROPIN_FILE}" + if [ -f ${CHRONYD_RESTRICTED_UNIT_FILE} ]; then + rlPhaseStartTest "chronyd-restricted -- bz#2169949 + RHEL-18219" + rlRun "systemctl stop ${SERVICE_NAME}" + rlRun "mkdir -p ${CHRONYD_RESTRICTED_UNIT_DROPIN_DIR}" + if ! grep ^SELinuxContext= ${CHRONYD_RESTRICTED_UNIT_FILE} ; then + # temporary configuration change until it becomes a part of the chrony package + rlRun "echo -e '[Service]\nSELinuxContext=system_u:system_r:chronyd_restricted_t:s0\n' > ${CHRONYD_RESTRICTED_UNIT_DROPIN_FILE}" + rlRun "systemctl daemon-reload" + fi + rlRun "systemctl start ${CHRONYD_RESTRICTED_SERVICE}" + sleep 3 + rlRun "ps -o pid,uid,command,context -C chronyd | grep -1 system_u:system_r:chronyd_restricted_t:" + rlRun "systemctl status ${CHRONYD_RESTRICTED_SERVICE}" + rlRun "chronyc reload sources" 0,1 + rlRun "systemctl restart ${CHRONYD_RESTRICTED_SERVICE}" + rlRun "systemctl status ${CHRONYD_RESTRICTED_SERVICE}" + rlRun "systemctl stop ${CHRONYD_RESTRICTED_SERVICE}" + rlRun "rm -f ${CHRONYD_RESTRICTED_UNIT_DROPIN_FILE}" rlRun "systemctl daemon-reload" + rlPhaseEnd fi - rlRun "systemctl start ${CHRONYD_RESTRICTED_SERVICE}" - sleep 3 - rlRun "ps -o pid,uid,command,context -C chronyd | grep -1 system_u:system_r:chronyd_restricted_t:" - rlRun "systemctl status ${CHRONYD_RESTRICTED_SERVICE}" - rlRun "chronyc reload sources" 0,1 - rlRun "systemctl restart ${CHRONYD_RESTRICTED_SERVICE}" - rlRun "systemctl status ${CHRONYD_RESTRICTED_SERVICE}" - rlRun "systemctl stop ${CHRONYD_RESTRICTED_SERVICE}" - rlRun "rm -f ${CHRONYD_RESTRICTED_UNIT_DROPIN_FILE}" - rlRun "systemctl daemon-reload" - rlPhaseEnd fi rlPhaseStartCleanup From 75afe321fa5d6e4123391334818ddfada05ae7b4 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 29 Apr 2025 08:10:52 +0200 Subject: [PATCH 487/626] require the audit-rules package When the SELinux beaker library is imported, the auditd configuration is modified and the auditd service is restarted. The audit-rules package is necessary for success of the operation, because it brings the auditctl command. --- selinux-policy/Library/common/lib.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/selinux-policy/Library/common/lib.sh b/selinux-policy/Library/common/lib.sh index 576c44f..1946dbd 100755 --- a/selinux-policy/Library/common/lib.sh +++ b/selinux-policy/Library/common/lib.sh @@ -2001,7 +2001,7 @@ rlSELibraryLoaded() { elif rlIsRHEL 7 ; then rlSE_REQUIRES="setools-console expect policycoreutils-python selinux-policy-devel" else - rlSE_REQUIRES="setools-console expect policycoreutils-python-utils selinux-policy-devel" + rlSE_REQUIRES="setools-console expect policycoreutils-python-utils selinux-policy-devel audit-rules" fi __INTERNAL_rlSEenable_full_auditing From 18fce0c6cc2f1c8fdb0757f3c792a3e98a070d33 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 29 Apr 2025 16:25:19 +0200 Subject: [PATCH 488/626] ensure the audit-rules package is installed on RHEL-10 The audit-rules package is not built for RHEL-9.x, but it is built for RHEL-10.x. The SELinux beakerlib library should count with that. --- selinux-policy/Library/common/lib.sh | 2 ++ 1 file changed, 2 insertions(+) diff --git a/selinux-policy/Library/common/lib.sh b/selinux-policy/Library/common/lib.sh index 1946dbd..018d821 100755 --- a/selinux-policy/Library/common/lib.sh +++ b/selinux-policy/Library/common/lib.sh @@ -2000,6 +2000,8 @@ rlSELibraryLoaded() { rlSE_REQUIRES="setools-console expect policycoreutils-python" elif rlIsRHEL 7 ; then rlSE_REQUIRES="setools-console expect policycoreutils-python selinux-policy-devel" + elif rlIsRHEL 8 9 || rlIsCentOS 8 9 ; then + rlSE_REQUIRES="setools-console expect policycoreutils-python-utils selinux-policy-devel" else rlSE_REQUIRES="setools-console expect policycoreutils-python-utils selinux-policy-devel audit-rules" fi From e05b9a7cbb694957db00dd3883cbb84768de0b3c Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 8 Apr 2025 17:31:22 +0200 Subject: [PATCH 489/626] test if journalctl can connect to systemd-nspawn machine A customer case revealed that not all commands mentioned in the RHEL-76352 bug were resolved in the selinux-policy component. The TC executes the missed ones. In order to support the journalctl ability to access virtual machines, I believe that SELinux policy should allow the dbus-broker processes to read the /var/lib/machine/ directories. The TC looks for appropriate policy rules and file context patterns. The TC covers RHEL-85379 and RHEL-86528. --- selinux-policy/systemd-machined-and-similar/Makefile | 2 ++ selinux-policy/systemd-machined-and-similar/main.fmf | 2 ++ selinux-policy/systemd-machined-and-similar/runtest.sh | 10 +++++++++- 3 files changed, 13 insertions(+), 1 deletion(-) diff --git a/selinux-policy/systemd-machined-and-similar/Makefile b/selinux-policy/systemd-machined-and-similar/Makefile index c9b3c59..c954661 100644 --- a/selinux-policy/systemd-machined-and-similar/Makefile +++ b/selinux-policy/systemd-machined-and-similar/Makefile @@ -71,6 +71,8 @@ $(METADATA): Makefile @echo "Bug: RHEL-76352" >> $(METADATA) # RHEL-9 @echo "Bug: RHEL-77087" >> $(METADATA) # RHEL-10 @echo "Bug: RHEL-78088" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-85379" >> $(METADATA) # RHEL-9 + @echo "Bug: RHEL-86528" >> $(METADATA) # RHEL-10 rhts-lint $(METADATA) diff --git a/selinux-policy/systemd-machined-and-similar/main.fmf b/selinux-policy/systemd-machined-and-similar/main.fmf index 18c8819..61d14a8 100644 --- a/selinux-policy/systemd-machined-and-similar/main.fmf +++ b/selinux-policy/systemd-machined-and-similar/main.fmf @@ -39,6 +39,8 @@ link: - verifies: https://issues.redhat.com/browse/RHEL-76352 - verifies: https://issues.redhat.com/browse/RHEL-77087 - verifies: https://issues.redhat.com/browse/RHEL-78088 + - verifies: https://issues.redhat.com/browse/RHEL-85379 + - verifies: https://issues.redhat.com/browse/RHEL-86528 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7 diff --git a/selinux-policy/systemd-machined-and-similar/runtest.sh b/selinux-policy/systemd-machined-and-similar/runtest.sh index d4aa98e..87bd723 100755 --- a/selinux-policy/systemd-machined-and-similar/runtest.sh +++ b/selinux-policy/systemd-machined-and-similar/runtest.sh @@ -120,6 +120,10 @@ rlJournalStart rlSESearchRule "allow systemd_machined_t unconfined_service_t : file { getattr open read ioctl } [ ]" rlSESearchRule "allow systemd_machined_t systemd_machined_t : cap_userns { kill } [ ]" rlPhaseEnd + + rlPhaseStartTest "RHEL-85379 + RHEL-86528" + rlSESearchRule "allow system_dbusd_t systemd_machined_var_lib_t : dir { read } [ ]" + rlPhaseEnd fi rlPhaseStartTest "real scenario -- standalone service" @@ -134,7 +138,7 @@ rlJournalStart rlPhaseStartTest "real scenario -- bz#1900869 + bz#1900888" rlRun "mkdir -pZ /var/lib/machines/test" rlRun "dnf -y --installroot=/var/lib/machines/test/ install dhcp-client dnf filesystem glibc glibc-langpack-en glibc-langpack-de iproute iputils less passwd systemd vim-minimal ${INSTALL_OPTION}" - rlRun "du -sh /var/lib/machines/test" + rlRun "restorecon -Rv /var/lib/machines" if ${TEST_POLICY_NEEDED} ; then rlRun "semodule -i testpolicy.cil" rlRun "semodule -lfull | grep testpolicy" @@ -144,7 +148,11 @@ rlJournalStart rlRun "ps -efZ | grep -e ${PROCESS_CONTEXT} -e unconfined_service_t" rlRun "machinectl list" rlRun "machinectl status test" + rlRun "journalctl -M test --system" + rlRun "journalctl -M test --user" rlWatchdog "machinectl login test" 20 + rlRun "machinectl list-images" + rlRun "machinectl image-status test" if rlIsFedora ; then rlRun "rm -f /tmp/id" rlRun "machinectl copy-to test /usr/bin/id /tmp/id" From 6a1e7f439946069e1f5d15ebed473c13ea971fff Mon Sep 17 00:00:00 2001 From: Jan Onderka Date: Wed, 30 Apr 2025 09:44:04 +0200 Subject: [PATCH 490/626] skip man page test if no present on the system --- checkpolicy/checkmodule/runtest.sh | 10 +++++++--- checkpolicy/checkpolicy-docs/main.fmf | 1 + checkpolicy/checkpolicy/runtest.sh | 14 +++++++++----- policycoreutils/semodule-l-checksum/runtest.sh | 6 ++++-- policycoreutils/sestatus/runtest.sh | 8 ++++++-- .../systemd-sysctl-and-similar/runtest.sh | 4 +++- 6 files changed, 30 insertions(+), 13 deletions(-) diff --git a/checkpolicy/checkmodule/runtest.sh b/checkpolicy/checkmodule/runtest.sh index 430d30d..0d2eb4a 100755 --- a/checkpolicy/checkmodule/runtest.sh +++ b/checkpolicy/checkmodule/runtest.sh @@ -65,11 +65,15 @@ rlJournalStart rlRun "checkmodule ${TEST_FILE}" 1 rlRun "checkmodule -b ${TEST_FILE}" 1 if rlIsRHEL 5 ; then - rlRun "man checkmodule | col -b | grep -- -d" + if [ -e "/usr/share/man/man8/checkmodule.8.gz" ]; then + rlRun "man checkmodule | col -b | grep -- -d" + fi rlRun "checkmodule --help 2>&1 | grep -- -d" fi - rlRun "man checkmodule | col -b | grep -- -h" - rlRun "man checkmodule | col -b | grep -- -U" + if [ -e "/usr/share/man/man8/checkmodule.8.gz" ]; then + rlRun "man checkmodule | col -b | grep -- -h" + rlRun "man checkmodule | col -b | grep -- -U" + fi rlRun "checkmodule --help 2>&1 | grep -- -h" rlRun "checkmodule --help 2>&1 | grep -- -U" rlPhaseEnd diff --git a/checkpolicy/checkpolicy-docs/main.fmf b/checkpolicy/checkpolicy-docs/main.fmf index f66b1a9..76804dd 100644 --- a/checkpolicy/checkpolicy-docs/main.fmf +++ b/checkpolicy/checkpolicy-docs/main.fmf @@ -22,6 +22,7 @@ tag: - f31friendly - f32friendly - targeted + - NoRHIVOS tier: '1' link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1328966 diff --git a/checkpolicy/checkpolicy/runtest.sh b/checkpolicy/checkpolicy/runtest.sh index 359bc3e..6f5a9ef 100755 --- a/checkpolicy/checkpolicy/runtest.sh +++ b/checkpolicy/checkpolicy/runtest.sh @@ -100,7 +100,9 @@ rlJournalStart rlRun "checkpolicy -c 0 2>&1 | grep \"value 0 not in range\"" rlRun "checkpolicy -t 2>&1 | grep \"option requires an argument\"" rlRun "checkpolicy -t xyz 2>&1 | grep -i \"unknown target platform\"" - rlRun "man checkpolicy | col -b | grep -- '-m]'" 1 + if [ -e "/usr/share/man/man8/checkmodule.8.gz" ]; then + rlRun "man checkpolicy | col -b | grep -- '-m]'" 1 + fi rlRun "checkpolicy --help 2>&1 | grep -- '-m]'" 1 rlPhaseEnd @@ -179,10 +181,12 @@ rlJournalStart rlRun "cat $OUTPUT_FILE" rlAssertGrep "\[-S\]" $OUTPUT_FILE - # check -S option in man page - rlRun "PAGER=cat man checkpolicy >$OUTPUT_FILE" - rlRun "cat $OUTPUT_FILE" - rlAssertGrep "\[-S\]" $OUTPUT_FILE + if [ -e "/usr/share/man/man8/checkmodule.8.gz" ];then + # check -S option in man page + rlRun "PAGER=cat man checkpolicy >$OUTPUT_FILE" + rlRun "cat $OUTPUT_FILE" + rlAssertGrep "\[-S\]" $OUTPUT_FILE + fi # run checkpolicy with the -S option rlWatchdog "checkpolicy -S -M -o policy.out policy.conf.from.secilc" 15 diff --git a/policycoreutils/semodule-l-checksum/runtest.sh b/policycoreutils/semodule-l-checksum/runtest.sh index 5096fbc..b16ef6d 100755 --- a/policycoreutils/semodule-l-checksum/runtest.sh +++ b/policycoreutils/semodule-l-checksum/runtest.sh @@ -70,8 +70,10 @@ EOF" rlPhaseEnd rlPhaseStartTest "is the checksum option listed?" - rlRun "man semodule | col -b | grep checksum" - rlRun "man semodule | col -b | grep 'SHA256.*checksum'" + if [ -e "/usr/share/man/man8/semodule.8.gz" ]; then + rlRun "man semodule | col -b | grep checksum" + rlRun "man semodule | col -b | grep 'SHA256.*checksum'" + fi rlRun "semodule --help | grep checksum" rlRun "semodule --help | grep 'checksum.*SHA256'" rlPhaseEnd diff --git a/policycoreutils/sestatus/runtest.sh b/policycoreutils/sestatus/runtest.sh index ebc56b2..1ddd4d5 100755 --- a/policycoreutils/sestatus/runtest.sh +++ b/policycoreutils/sestatus/runtest.sh @@ -98,10 +98,14 @@ rlJournalStart rlRun "rpm -ql ${PACKAGE} | grep /usr/share/man/man8/sestatus.8" for OPTION in b v ; do rlRun "sestatus --help 2>&1 | grep -- -${OPTION}" - rlRun "man sestatus | col -b | grep -- -${OPTION}" + if [ -e "/usr/share/man/man8/sestatus.8.gz" ]; then + rlRun "man sestatus | col -b | grep -- -${OPTION}" + fi done if ! rlIsRHEL 6 ; then - rlRun "man -w sestatus.conf" + if [ -e "/usr/share/man/man5/sestatus.conf.5.gz" ]; then + rlRun "man -w sestatus.conf" + fi fi rlPhaseEnd fi diff --git a/selinux-policy/systemd-sysctl-and-similar/runtest.sh b/selinux-policy/systemd-sysctl-and-similar/runtest.sh index 476f811..3cec638 100755 --- a/selinux-policy/systemd-sysctl-and-similar/runtest.sh +++ b/selinux-policy/systemd-sysctl-and-similar/runtest.sh @@ -62,7 +62,9 @@ rlJournalStart if ! rlIsRHEL "<9.6" ; then rlPhaseStartTest "RHEL-56988 + RHEL-58380" - rlRun "man sysctl.d | grep /run/sysctl" + if [ -e "/usr/share/man/man5/sysctl.d.5.gz" ]; then + rlRun "man sysctl.d | grep /run/sysctl" + fi rlRun "mkdir -pZ /run/sysctl.d" rlRun "echo 'net.ipv4.conf.eno1.rp_filter=0' > /run/sysctl.d/51-rp_filter.conf" rlRun "restorecon -Rv /run/sysctl.d" From 524c361afe391041faa481430ec2ca299a895b7c Mon Sep 17 00:00:00 2001 From: Jan Onderka Date: Wed, 30 Apr 2025 11:02:51 +0200 Subject: [PATCH 491/626] Add NoRHIVOS tag to semanage-root-on-nfs test --- libsemanage/semanage-root-on-nfs/main.fmf | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libsemanage/semanage-root-on-nfs/main.fmf b/libsemanage/semanage-root-on-nfs/main.fmf index 2cd8274..e56fbc8 100644 --- a/libsemanage/semanage-root-on-nfs/main.fmf +++ b/libsemanage/semanage-root-on-nfs/main.fmf @@ -7,6 +7,8 @@ requires: - policycoreutils-python-utils duration: 10m enabled: true +tag: + - NoRHIVOS link: - verifies: https://issues.redhat.com/browse/RHEL-60503 extra-nitrate: TC#0617969 From 6075ad3af589abaa81b28db042af776189532fb6 Mon Sep 17 00:00:00 2001 From: Stepan Broz Date: Fri, 2 May 2025 10:28:57 +0200 Subject: [PATCH 492/626] anon_inode-and-similar: Adjust relevancy of RHEL-11792 Do not test RHEL-11792 on RHEL-9.3 or lower. --- selinux-policy/anon_inode-and-similar/runtest.sh | 2 ++ 1 file changed, 2 insertions(+) diff --git a/selinux-policy/anon_inode-and-similar/runtest.sh b/selinux-policy/anon_inode-and-similar/runtest.sh index 3961d8b..46c25c6 100755 --- a/selinux-policy/anon_inode-and-similar/runtest.sh +++ b/selinux-policy/anon_inode-and-similar/runtest.sh @@ -92,10 +92,12 @@ rlJournalStart rlRun "fio --filename=/root/pokus --iodepth=16 --rw=write --ioengine=io_uring_cmd --bs=16k --size=2G --numjobs=30 --runtime=100s --group_reporting=1 --name=mytest" 0-255 rlPhaseEnd + if ! rlIsRHEL "<9.4"; then rlPhaseStartTest "RHEL-11792" rlSESearchRule "allow unconfined_t unconfined_t : io_uring { cmd } [ ]" rlSESearchRule "allow unconfined_service_t unconfined_service_t : io_uring { cmd } [ ]" rlPhaseEnd + fi if seinfo -t | grep -q secretmem_t ; then rlPhaseStartTest "bz#2270895 + RHEL-60837" From 6b8128b89158002dd4505feff22fad72733fea74 Mon Sep 17 00:00:00 2001 From: Stepan Broz Date: Fri, 2 May 2025 12:05:13 +0200 Subject: [PATCH 493/626] journalctl-and-similar: Adjust subtest relevancy Do not test "bz#2136189 + bz#2153782" on RHEL-8 version below RHEL-8.8, and RHEL-9 versions below RHEL-9.4. --- selinux-policy/journalctl-and-similar/runtest.sh | 2 ++ 1 file changed, 2 insertions(+) diff --git a/selinux-policy/journalctl-and-similar/runtest.sh b/selinux-policy/journalctl-and-similar/runtest.sh index 2f9dc81..4f5a7f3 100755 --- a/selinux-policy/journalctl-and-similar/runtest.sh +++ b/selinux-policy/journalctl-and-similar/runtest.sh @@ -125,6 +125,7 @@ rlJournalStart rlRun "setsebool ssh_sysadm_login off" rlPhaseEnd + if ! ( IrIsRHEL 8 && rlIsRHEL "<8.8" ) && ! ( rlIsRHEL 9 && rlIsRHEL "<9.3" ); then rlPhaseStartTest "bz#2136189 + bz#2153782" rlSESearchRule "allow journalctl_t journalctl_t : capability { sys_resource } [ ]" rlSESearchRule "allow journalctl_t journalctl_t : process { setrlimit } [ ]" @@ -138,6 +139,7 @@ rlJournalStart rlRun "userdel -rfZ ${USER_NAME}" rlRun "setsebool ssh_sysadm_login off" rlPhaseEnd + fi rlPhaseStartCleanup sleep 2 From 5d60a68f27b63d9dfd2e53083cce3824b1592f9f Mon Sep 17 00:00:00 2001 From: Stepan Broz Date: Fri, 2 May 2025 12:24:55 +0200 Subject: [PATCH 494/626] ntpsec-and-similar: Adjust subtest relevancy Do not test "bz#2246805 + RHEL-15085" on RHEL-9.3 or lower. --- selinux-policy/ntpsec-and-similar/runtest.sh | 2 ++ 1 file changed, 2 insertions(+) diff --git a/selinux-policy/ntpsec-and-similar/runtest.sh b/selinux-policy/ntpsec-and-similar/runtest.sh index 2531b93..30ad45c 100755 --- a/selinux-policy/ntpsec-and-similar/runtest.sh +++ b/selinux-policy/ntpsec-and-similar/runtest.sh @@ -58,11 +58,13 @@ rlJournalStart sleep 2 rlPhaseEnd + if ! rlIsRHEL "<9.4" ; then rlPhaseStartTest "bz#2246805 + RHEL-15085" rlSEMatchPathCon "/usr/sbin/ntpd" "ntpd_exec_t" rlSESearchRule "allow ntpd_t ntske_port_t : tcp_socket { name_connect } [ ]" rlSEMatchPortCon tcp 4460 ntske_port_t rlPhaseEnd + fi if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" From 9266ddc41b615fcf7fd6686e87526556557f7835 Mon Sep 17 00:00:00 2001 From: Stepan Broz Date: Fri, 2 May 2025 11:30:06 +0200 Subject: [PATCH 495/626] cups-pdf-and-similar: Adjust relevancy of bz#2234765 Do not test bz#2234765 on RHEL-9.2 or lower. --- selinux-policy/cups-pdf-and-similar/runtest.sh | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/selinux-policy/cups-pdf-and-similar/runtest.sh b/selinux-policy/cups-pdf-and-similar/runtest.sh index c5b67c0..eb81af7 100755 --- a/selinux-policy/cups-pdf-and-similar/runtest.sh +++ b/selinux-policy/cups-pdf-and-similar/runtest.sh @@ -111,9 +111,11 @@ rlJournalStart rlSESearchRule "allow cups_pdf_t cups_pdf_t : unix_dgram_socket { create connect } [ ]" rlPhaseEnd - rlPhaseStartTest "bz#2234765" - rlSESearchRule "allow cups_pdf_t kernel_t : unix_stream_socket { connectto } [ ]" - rlPhaseEnd + if ! rlIsRHEL "<9.3" ; then + rlPhaseStartTest "bz#2234765" + rlSESearchRule "allow cups_pdf_t kernel_t : unix_stream_socket { connectto } [ ]" + rlPhaseEnd + fi fi rlPhaseStartTest "real scenario -- confined users" From 4f908fc2eb2e51879bf52a42bf26f601cc150e06 Mon Sep 17 00:00:00 2001 From: Stepan Broz Date: Fri, 2 May 2025 12:46:30 +0200 Subject: [PATCH 496/626] restorecond-fcontext-equivalences: Adjust relevancy of RHEL-5032 Do not test "RHEL-5032" on RHEL-9.3 or below. --- selinux-policy/restorecond-fcontext-equivalences/test.sh | 2 ++ 1 file changed, 2 insertions(+) diff --git a/selinux-policy/restorecond-fcontext-equivalences/test.sh b/selinux-policy/restorecond-fcontext-equivalences/test.sh index a820705..c49bdd4 100755 --- a/selinux-policy/restorecond-fcontext-equivalences/test.sh +++ b/selinux-policy/restorecond-fcontext-equivalences/test.sh @@ -12,6 +12,7 @@ rlJournalStart rlRun "echo -en '\n/bin/*\n/sbin/*\n/lib/*\n/lib64/*\n' >> /etc/selinux/restorecond.conf" rlPhaseEnd + if ! rlIsRHEL "<9.4" ; then rlPhaseStartTest "RHEL-5032" rlRun "service restorecond start" rlRun "service restorecond status" @@ -20,6 +21,7 @@ rlJournalStart rm -f $rlRun_LOG rlRun "service restorecond stop" rlPhaseEnd + fi rlPhaseStartCleanup rlFileRestore From c7f2624eb5e2772f4ffd60c9a2062de5c69eb576 Mon Sep 17 00:00:00 2001 From: Stepan Broz Date: Fri, 2 May 2025 11:41:18 +0200 Subject: [PATCH 497/626] dhcpcd-and-similar: Adjust relevancy of RHEL-15326 Do not test RHEL-15326 on RHEL-9.3 or lower RHEL-9. --- selinux-policy/dhcpcd-and-similar/runtest.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/selinux-policy/dhcpcd-and-similar/runtest.sh b/selinux-policy/dhcpcd-and-similar/runtest.sh index 38218ea..c856c12 100755 --- a/selinux-policy/dhcpcd-and-similar/runtest.sh +++ b/selinux-policy/dhcpcd-and-similar/runtest.sh @@ -85,7 +85,7 @@ rlJournalStart rlSESearchRule "allow dhcpc_t dhcpc_var_run_t : sock_file { create unlink }" rlPhaseEnd - if rlIsRHEL 9 || rlIsCentOS 9 ; then + if ( rlIsRHEL 9 && rlIsRHEL ">9.3" ) || rlIsCentOS 9 ; then rlPhaseStartTest "RHEL-15326" rlSESearchRule "allow dhcpc_t dhcpc_t : capability2 { bpf } [ ]" rlPhaseEnd From 3ba64529c70586bd13a5114eca7300bdd3a006fd Mon Sep 17 00:00:00 2001 From: Stepan Broz Date: Fri, 2 May 2025 10:40:22 +0200 Subject: [PATCH 498/626] bz538089-plymouth-operations-denied-during-boot: Adjust relevancy of bz#2184803 Do not test bz#2184803 on RHEL-9.2 or lower. --- .../bz538089-plymouth-operations-denied-during-boot/runtest.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/selinux-policy/bz538089-plymouth-operations-denied-during-boot/runtest.sh b/selinux-policy/bz538089-plymouth-operations-denied-during-boot/runtest.sh index 005926b..8a67d47 100755 --- a/selinux-policy/bz538089-plymouth-operations-denied-during-boot/runtest.sh +++ b/selinux-policy/bz538089-plymouth-operations-denied-during-boot/runtest.sh @@ -145,7 +145,7 @@ rlJournalStart rlPhaseEnd fi - if ! rlIsRHEL 5 6 7 8 ; then + if ! rlIsRHEL "<9.3" ; then rlPhaseStartTest "bz#2184803" rlSESearchRule "allow plymouthd_t plymouthd_t : capability2 { bpf } [ ]" rlPhaseEnd From 4cb40a2a477f223fd4b1c3d22240ea070377d9f4 Mon Sep 17 00:00:00 2001 From: Stepan Broz Date: Fri, 2 May 2025 12:40:46 +0200 Subject: [PATCH 499/626] opensmtpd-and-similar: Adjust subtest relevancy Do not test "bz#2246115" and "bz#2208696" on RHEL-9.3 or below. --- .../opensmtpd-and-similar/runtest.sh | 26 ++++++++++--------- 1 file changed, 14 insertions(+), 12 deletions(-) diff --git a/selinux-policy/opensmtpd-and-similar/runtest.sh b/selinux-policy/opensmtpd-and-similar/runtest.sh index be11811..c98321a 100755 --- a/selinux-policy/opensmtpd-and-similar/runtest.sh +++ b/selinux-policy/opensmtpd-and-similar/runtest.sh @@ -58,19 +58,21 @@ rlJournalStart rlPhaseEnd if ! rlIsRHEL 8 && ! rlIsCentOS 8 ; then - rlPhaseStartTest "bz#2208696" - rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" - rlSEMatchPathCon "/var/run" "var_run_t" - rlSEMatchPathCon "/var/run/smtpd.sock" "sendmail_var_run_t" - rlSESearchRule "allow sendmail_t sendmail_t : capability { sys_chroot fowner } [ ]" - rlSESearchRule "type_transition sendmail_t var_run_t : sock_file sendmail_var_run_t" - rlSESearchRule "allow sendmail_t sendmail_var_run_t : sock_file { create setattr unlink write } [ ]" - rlPhaseEnd + if ! rlIsRHEL "<9.4" ; then + rlPhaseStartTest "bz#2208696" + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + rlSEMatchPathCon "/var/run" "var_run_t" + rlSEMatchPathCon "/var/run/smtpd.sock" "sendmail_var_run_t" + rlSESearchRule "allow sendmail_t sendmail_t : capability { sys_chroot fowner } [ ]" + rlSESearchRule "type_transition sendmail_t var_run_t : sock_file sendmail_var_run_t" + rlSESearchRule "allow sendmail_t sendmail_var_run_t : sock_file { create setattr unlink write } [ ]" + rlPhaseEnd - rlPhaseStartTest "bz#2246115" - rlSEMatchPathCon "/run/smtpd.sock" "sendmail_var_run_t" - rlSESearchRule "allow sendmail_t sendmail_t : unix_stream_socket { connectto } [ ]" - rlPhaseEnd + rlPhaseStartTest "bz#2246115" + rlSEMatchPathCon "/run/smtpd.sock" "sendmail_var_run_t" + rlSESearchRule "allow sendmail_t sendmail_t : unix_stream_socket { connectto } [ ]" + rlPhaseEnd + fi rlPhaseStartTest "RHEL-15175" # actions on the /var/run/smtpd.pid file From c4ad09fc7a64d9575d77a90e25a080258352e9da Mon Sep 17 00:00:00 2001 From: Stepan Broz Date: Fri, 2 May 2025 13:04:08 +0200 Subject: [PATCH 500/626] systemd-localed: Adjust test relevancy Do not test "bz#2240159 + RHEL-16715 + RHEL-16716" on RHEL-9 versions RHEL-9.3 or lower. --- selinux-policy/systemd-localed/runtest.sh | 2 ++ 1 file changed, 2 insertions(+) diff --git a/selinux-policy/systemd-localed/runtest.sh b/selinux-policy/systemd-localed/runtest.sh index 4d6b5d3..5292292 100755 --- a/selinux-policy/systemd-localed/runtest.sh +++ b/selinux-policy/systemd-localed/runtest.sh @@ -21,6 +21,7 @@ rlJournalStart sleep 2 rlPhaseEnd + if ! ( rlIsRHEL 9 && rlIsRHEL "<9.4" ) ; then rlPhaseStartTest "bz#2240159 + RHEL-16715 + RHEL-16716" rlSEMatchPathCon "/usr/lib/systemd/systemd-localed" "systemd_localed_exec_t" rlSEMatchPathCon "/etc/X11/xorg.conf.d" "xserver_etc_t" @@ -39,6 +40,7 @@ rlJournalStart rlRun "service systemd-localed stop" rlRun "service systemd-localed status" 3 rlPhaseEnd + fi rlPhaseStartCleanup sleep 2 From e340f43c20b9bc152a99aeb43fc1d1cdf0b5c87a Mon Sep 17 00:00:00 2001 From: Stepan Broz Date: Fri, 2 May 2025 11:52:41 +0200 Subject: [PATCH 501/626] exim-and-similar: Adjust subtest relevancy Do not test "RHEL-14110 + RHEL-14186" and "RHEL-21902 + RHEL-21903" on RHEL-9 lower than 9.4. --- selinux-policy/exim-and-similar/runtest.sh | 28 ++++++++++++---------- 1 file changed, 15 insertions(+), 13 deletions(-) diff --git a/selinux-policy/exim-and-similar/runtest.sh b/selinux-policy/exim-and-similar/runtest.sh index 4ed843c..f496967 100755 --- a/selinux-policy/exim-and-similar/runtest.sh +++ b/selinux-policy/exim-and-similar/runtest.sh @@ -89,7 +89,7 @@ rlJournalStart rlPhaseEnd fi - if rlIsRHEL 8 9 || rlIsCentOS 8 9 ; then + if rlIsRHEL 8 || ( rlIsRHEL 9 && rlIsRHEL ">9.3" ) || rlIsCentOS 8 9 ; then rlPhaseStartTest "RHEL-21902 + RHEL-21903" rlSEMatchPathCon "/var/spool/exim/exim_daemon_notify" "exim_spool_t" rlSESearchRule "allow exim_t exim_t : unix_dgram_socket { sendto } [ ]" @@ -109,18 +109,20 @@ rlJournalStart rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd - rlPhaseStartTest "real scenario -- RHEL-14110 + RHEL-14186" - rlSEMatchPathCon "/var/spool/exim/input" "exim_spool_t" - rlSESearchRule "allow system_mail_t exim_spool_t : dir { create } [ ]" - rlRun "sed -i 's/^.*\(split_spool_directory\).*=.*$/\1 = true/' /etc/exim/exim.conf" - rlRun "service exim start" - rlRun "service atd start" - rlRun "echo '/usr/bin/id -Z' | at now" - sleep 15s - rlRun "ls -lZ /var/spool/exim/input" - rlRun "service atd stop" - rlRun "service exim stop" - rlPhaseEnd + if ! ( rlIsRHEL 9 && rlIsRHEL "<9.4" ) ; then + rlPhaseStartTest "real scenario -- RHEL-14110 + RHEL-14186" + rlSEMatchPathCon "/var/spool/exim/input" "exim_spool_t" + rlSESearchRule "allow system_mail_t exim_spool_t : dir { create } [ ]" + rlRun "sed -i 's/^.*\(split_spool_directory\).*=.*$/\1 = true/' /etc/exim/exim.conf" + rlRun "service exim start" + rlRun "service atd start" + rlRun "echo '/usr/bin/id -Z' | at now" + sleep 15s + rlRun "ls -lZ /var/spool/exim/input" + rlRun "service atd stop" + rlRun "service exim stop" + rlPhaseEnd + fi fi rlPhaseStartCleanup From 7e8b5cffe4e9b7f351ffd7bbeed7c1330621f3dc Mon Sep 17 00:00:00 2001 From: Stepan Broz Date: Mon, 12 May 2025 11:13:11 +0200 Subject: [PATCH 502/626] perf_event-and-related: do not test bz2229936 on RHEL<9.3 --- selinux-policy/perf_event-and-related/runtest.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/selinux-policy/perf_event-and-related/runtest.sh b/selinux-policy/perf_event-and-related/runtest.sh index 6051731..5b50dec 100755 --- a/selinux-policy/perf_event-and-related/runtest.sh +++ b/selinux-policy/perf_event-and-related/runtest.sh @@ -64,7 +64,7 @@ rlJournalStart rlSESearchRule "allow sysadm_t sysadm_t : perf_event { open cpu kernel read write } [ ]" rlPhaseEnd - if ! rlIsRHEL 8 && ! rlIsCentOS 8 ; then + if ! rlIsRHEL "<9.3" && ! rlIsCentOS 8 ; then rlPhaseStartTest "bz#2229936" rlSESearchRule "allow sysadm_t kernel_t : bpf { prog_run } [ ]" rlPhaseEnd From 79e1779579b262639169cffee3cf0d7e18e2af7c Mon Sep 17 00:00:00 2001 From: Stepan Broz Date: Mon, 12 May 2025 14:35:33 +0200 Subject: [PATCH 503/626] systemd-machined-and-similar: Adjust subtest relevancies - Do not test "RHEL-76352-RHEL-77087-RHEL-78088" on RHEL-9.5 or below - Do not test "RHEL-85379-RHEL-86528" on RHEL-9.6 or below --- selinux-policy/systemd-machined-and-similar/runtest.sh | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/selinux-policy/systemd-machined-and-similar/runtest.sh b/selinux-policy/systemd-machined-and-similar/runtest.sh index 87bd723..688629f 100755 --- a/selinux-policy/systemd-machined-and-similar/runtest.sh +++ b/selinux-policy/systemd-machined-and-similar/runtest.sh @@ -114,13 +114,15 @@ rlJournalStart rlPhaseEnd fi - if ! rlIsRHEL 8 && ! rlIsCentOS 8 ; then + if ! rlIsRHEL "<9.6" && ! rlIsCentOS 8 ; then rlPhaseStartTest "RHEL-76352 + RHEL-77087 + RHEL-78088" rlSESearchRule "allow systemd_machined_t unconfined_service_t : dir { search } [ ]" rlSESearchRule "allow systemd_machined_t unconfined_service_t : file { getattr open read ioctl } [ ]" rlSESearchRule "allow systemd_machined_t systemd_machined_t : cap_userns { kill } [ ]" rlPhaseEnd + fi + if ! rlIsRHEL "<9.7" && ! rlIsCentOS 8 ; then rlPhaseStartTest "RHEL-85379 + RHEL-86528" rlSESearchRule "allow system_dbusd_t systemd_machined_var_lib_t : dir { read } [ ]" rlPhaseEnd From 07867a3e8f1cd091863922489c599223503f7d1a Mon Sep 17 00:00:00 2001 From: Jan Onderka Date: Tue, 13 May 2025 16:34:36 +0200 Subject: [PATCH 504/626] add uniq ID and fusa tag to tests --- kernel/selinux-testsuite/main.fmf | 2 ++ .../bz1838257-rpm-scripts-use-deprecated-telinit/main.fmf | 1 + 2 files changed, 3 insertions(+) diff --git a/kernel/selinux-testsuite/main.fmf b/kernel/selinux-testsuite/main.fmf index 1aad4fb..ece9456 100644 --- a/kernel/selinux-testsuite/main.fmf +++ b/kernel/selinux-testsuite/main.fmf @@ -9,6 +9,8 @@ framework: beakerlib duration: 1h tier: 1 enabled: true +tag: + - fusa adjust: - enabled: false when: distro < rhel-6 diff --git a/libsepol/Sanity/bz1838257-rpm-scripts-use-deprecated-telinit/main.fmf b/libsepol/Sanity/bz1838257-rpm-scripts-use-deprecated-telinit/main.fmf index 0687010..d831b58 100644 --- a/libsepol/Sanity/bz1838257-rpm-scripts-use-deprecated-telinit/main.fmf +++ b/libsepol/Sanity/bz1838257-rpm-scripts-use-deprecated-telinit/main.fmf @@ -24,3 +24,4 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1838257 extra-summary: /CoreOS/libsepol/Sanity/bz1838257-rpm-scripts-use-deprecated-telinit extra-task: /CoreOS/libsepol/Sanity/bz1838257-rpm-scripts-use-deprecated-telinit +id: bfadc6af-3873-4dd9-a7af-3f97bd92e150 From b8c668a56708183fcfc801beb722ecee5a2e2687 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 13 May 2025 12:23:37 +0200 Subject: [PATCH 505/626] add missing FMF ids into selected tests Just adding the FMF ids. No functional changes in the tests. --- libsemanage/semanage-root-on-nfs/main.fmf | 1 + libsemanage/semanage_setfiles-selinux_restorecon/main.fmf | 1 + policycoreutils/fixfiles-F-B-N/main.fmf | 1 + policycoreutils/linux-system-roles.selinux-tests/main.fmf | 1 + policycoreutils/restorecon/main.fmf | 1 + policycoreutils/restorecond_pointer_abuse/main.fmf | 1 + policycoreutils/semanage-permissive-d-problems/main.fmf | 1 + policycoreutils/semanage-port-add-delete-problems/main.fmf | 1 + policycoreutils/semodule-l-checksum/main.fmf | 1 + 9 files changed, 9 insertions(+) diff --git a/libsemanage/semanage-root-on-nfs/main.fmf b/libsemanage/semanage-root-on-nfs/main.fmf index e56fbc8..5a4de5b 100644 --- a/libsemanage/semanage-root-on-nfs/main.fmf +++ b/libsemanage/semanage-root-on-nfs/main.fmf @@ -12,3 +12,4 @@ tag: link: - verifies: https://issues.redhat.com/browse/RHEL-60503 extra-nitrate: TC#0617969 +id: 2d20011e-cab6-43a6-8a82-9bb0a7c9736b diff --git a/libsemanage/semanage_setfiles-selinux_restorecon/main.fmf b/libsemanage/semanage_setfiles-selinux_restorecon/main.fmf index 9ed4f56..4944deb 100644 --- a/libsemanage/semanage_setfiles-selinux_restorecon/main.fmf +++ b/libsemanage/semanage_setfiles-selinux_restorecon/main.fmf @@ -7,3 +7,4 @@ require: - python3-libsemanage link: - verifies: https://issues.redhat.com/browse/RHEL-73348 +id: f4ecd93d-d4bc-45fc-8386-193dd4f922e4 diff --git a/policycoreutils/fixfiles-F-B-N/main.fmf b/policycoreutils/fixfiles-F-B-N/main.fmf index 1472b82..be30bd5 100644 --- a/policycoreutils/fixfiles-F-B-N/main.fmf +++ b/policycoreutils/fixfiles-F-B-N/main.fmf @@ -5,3 +5,4 @@ component: - policycoreutils extra-summary: /CoreOS/policycoreutils/Sanity/fixfiles-F-B-N extra-task: /CoreOS/policycoreutils/Sanity/fixfiles-F-B-N +id: d70961fa-6c8b-442d-9706-c8ef47969685 diff --git a/policycoreutils/linux-system-roles.selinux-tests/main.fmf b/policycoreutils/linux-system-roles.selinux-tests/main.fmf index 9588ced..6cf38ed 100644 --- a/policycoreutils/linux-system-roles.selinux-tests/main.fmf +++ b/policycoreutils/linux-system-roles.selinux-tests/main.fmf @@ -12,3 +12,4 @@ recommend: duration: 40m extra-summary: linux-system-roles.selinux-tests extra-task: linux-system-roles.selinux-tests +id: 4889350b-d9fa-4cbf-86ff-f16a1c729f9e diff --git a/policycoreutils/restorecon/main.fmf b/policycoreutils/restorecon/main.fmf index d6fc352..71144f5 100644 --- a/policycoreutils/restorecon/main.fmf +++ b/policycoreutils/restorecon/main.fmf @@ -53,3 +53,4 @@ adjust: extra-nitrate: TC#0111587 extra-summary: /CoreOS/policycoreutils/Sanity/restorecon extra-task: /CoreOS/policycoreutils/Sanity/restorecon +id: 72bbba2d-1a9e-4009-ae20-145046b8f234 diff --git a/policycoreutils/restorecond_pointer_abuse/main.fmf b/policycoreutils/restorecond_pointer_abuse/main.fmf index 8225183..7a6d450 100644 --- a/policycoreutils/restorecond_pointer_abuse/main.fmf +++ b/policycoreutils/restorecond_pointer_abuse/main.fmf @@ -22,3 +22,4 @@ recommend: adjust: - enabled: false when: distro < rhel-7 +id: a900e46c-6cf9-49e1-9625-5beb609760c5 diff --git a/policycoreutils/semanage-permissive-d-problems/main.fmf b/policycoreutils/semanage-permissive-d-problems/main.fmf index 3256315..cea9905 100644 --- a/policycoreutils/semanage-permissive-d-problems/main.fmf +++ b/policycoreutils/semanage-permissive-d-problems/main.fmf @@ -16,3 +16,4 @@ recommend: duration: 20m extra-summary: /CoreOS/policycoreutils/Regression/semanage-permissive-d-problems extra-task: /CoreOS/policycoreutils/Regression/semanage-permissive-d-problems +id: f9d05e51-8ec4-4b3c-a016-bbdf79775d64 diff --git a/policycoreutils/semanage-port-add-delete-problems/main.fmf b/policycoreutils/semanage-port-add-delete-problems/main.fmf index d948252..43aece3 100644 --- a/policycoreutils/semanage-port-add-delete-problems/main.fmf +++ b/policycoreutils/semanage-port-add-delete-problems/main.fmf @@ -17,3 +17,4 @@ recommend: duration: 15m extra-summary: /CoreOS/policycoreutils/Regression/semanage-port-add-delete-problems extra-task: /CoreOS/policycoreutils/Regression/semanage-port-add-delete-problems +id: 3db01ce3-7cf2-4f3a-9b71-412d7cd7ce64 diff --git a/policycoreutils/semodule-l-checksum/main.fmf b/policycoreutils/semodule-l-checksum/main.fmf index 5b72615..bb39ac8 100644 --- a/policycoreutils/semodule-l-checksum/main.fmf +++ b/policycoreutils/semodule-l-checksum/main.fmf @@ -10,3 +10,4 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1731501 extra-summary: /CoreOS/policycoreutils/Sanity/bz1731501-Test-semodule-l-checksum extra-task: /CoreOS/policycoreutils/Sanity/bz1731501-Test-semodule-l-checksum +id: 115f6c6a-426a-4f92-9ea3-9dfca5624c6e From 56d272ebd876d984d2b51ad886113e36d8cff32c Mon Sep 17 00:00:00 2001 From: Jan Onderka Date: Wed, 14 May 2025 11:05:05 +0200 Subject: [PATCH 506/626] semanage_setfiles-selinux_restorecon: work with multiple SELINUXTYPES Enable test execution with different SELINXTYPE than 'targeted', otherwise the test ends with failure due to hardcoded 'targeted' policy and expected pki_tomcat_etc_rw_t type might not be present at current policy --- libsemanage/semanage_setfiles-selinux_restorecon/main.fmf | 1 + libsemanage/semanage_setfiles-selinux_restorecon/test.sh | 8 +++++--- .../update_context.py | 6 +++--- 3 files changed, 9 insertions(+), 6 deletions(-) diff --git a/libsemanage/semanage_setfiles-selinux_restorecon/main.fmf b/libsemanage/semanage_setfiles-selinux_restorecon/main.fmf index 4944deb..2dce7fb 100644 --- a/libsemanage/semanage_setfiles-selinux_restorecon/main.fmf +++ b/libsemanage/semanage_setfiles-selinux_restorecon/main.fmf @@ -5,6 +5,7 @@ require: - python3-policycoreutils - policycoreutils-python-utils - python3-libsemanage + - setools-console link: - verifies: https://issues.redhat.com/browse/RHEL-73348 id: f4ecd93d-d4bc-45fc-8386-193dd4f922e4 diff --git a/libsemanage/semanage_setfiles-selinux_restorecon/test.sh b/libsemanage/semanage_setfiles-selinux_restorecon/test.sh index 788c938..b52efd9 100755 --- a/libsemanage/semanage_setfiles-selinux_restorecon/test.sh +++ b/libsemanage/semanage_setfiles-selinux_restorecon/test.sh @@ -6,14 +6,16 @@ rlJournalStart rlPhaseStartSetup rlRun "tmp=\$(mktemp -d)" 0 "Create tmp directory" rlRun "set -o pipefail" + rlRun "source /etc/selinux/config" + rlRun "ETC_RW_T_LABEL=\"$(seinfo -t | grep etc_rw_t | head -1 | awk '{$1=$1};1')\"" rlPhaseEnd rlPhaseStartTest rlRun "mkdir -p $tmp/test/subtest | cut -d ' ' -f 1" rlRun "ls -Zd $tmp/test $tmp/test/subtest | cut -d ' ' -f 1" - rlRun "python3 update_context.py $tmp/test pki_tomcat_etc_rw_t" - LABEL=system_u:object_r:pki_tomcat_etc_rw_t:s0 + rlRun "python3 update_context.py $tmp/test ${ETC_RW_T_LABEL} ${SELINUXTYPE}" + LABEL="system_u:object_r:${ETC_RW_T_LABEL}:s0" LABEL_TEST=$(ls -Zd $tmp/test | cut -d ' ' -f 1) LABEL_SUBTEST=$(ls -Zd $tmp/test/subtest | cut -d ' ' -f 1) rlRun "ls -Zd $tmp/test $tmp/test/subtest" @@ -23,6 +25,6 @@ rlJournalStart rlPhaseStartCleanup rlRun "semanage fcontext -D" - rlRun "rm -r $tmp" 0 "Remove tmp directory" + rlRun "rm -rf $tmp" 0 "Remove tmp directory" rlPhaseEnd rlJournalEnd diff --git a/libsemanage/semanage_setfiles-selinux_restorecon/update_context.py b/libsemanage/semanage_setfiles-selinux_restorecon/update_context.py index 6d2538a..e58eac8 100755 --- a/libsemanage/semanage_setfiles-selinux_restorecon/update_context.py +++ b/libsemanage/semanage_setfiles-selinux_restorecon/update_context.py @@ -4,9 +4,9 @@ import sys import selinux import seobject -def update_context(file_dir, new_context): +def update_context(file_dir, new_context, selinux_policy): suffix = '(/.*)?' - trans = seobject.semanageRecords('targeted') + trans = seobject.semanageRecords(selinux_policy) trans.start() fcon = seobject.fcontextRecords(trans) @@ -18,4 +18,4 @@ def update_context(file_dir, new_context): if __name__ == "__main__": - update_context(sys.argv[1], sys.argv[2]) + update_context(sys.argv[1], sys.argv[2], sys.argv[3]) From 937d363e84ab88e09e45adbed4e5ddb1db12d728 Mon Sep 17 00:00:00 2001 From: Stepan Broz Date: Fri, 2 May 2025 10:54:04 +0200 Subject: [PATCH 507/626] chronyd-and-similar: Adjust relevancy of bz#2173604 Do not test bz#2173604 on RHEL-9.2 or lower. --- selinux-policy/chronyd-and-similar/runtest.sh | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/selinux-policy/chronyd-and-similar/runtest.sh b/selinux-policy/chronyd-and-similar/runtest.sh index b88e654..269bb91 100755 --- a/selinux-policy/chronyd-and-similar/runtest.sh +++ b/selinux-policy/chronyd-and-similar/runtest.sh @@ -287,13 +287,15 @@ rlJournalStart # rlRun "grep resolve /etc/nsswitch.conf" rlPhaseEnd - rlPhaseStartTest "bz#2173604" - rlSEMatchPathCon "/usr/bin/chronyc" "chronyc_exec_t" - rlRun "ls -dZ /proc/sys/net/ipv6/conf/all | grep :sysctl_net_t" - rlRun "ls -dZ /proc/sys/net/ipv6/conf/all/disable_ipv6 | grep :sysctl_net_t" - rlSESearchRule "allow chronyc_t sysctl_net_t : dir { search } [ ]" - rlSESearchRule "allow chronyc_t sysctl_net_t : file { getattr open read } [ ]" - rlPhaseEnd + if ! rlIsRHEL "<9.3" ; then + rlPhaseStartTest "bz#2173604" + rlSEMatchPathCon "/usr/bin/chronyc" "chronyc_exec_t" + rlRun "ls -dZ /proc/sys/net/ipv6/conf/all | grep :sysctl_net_t" + rlRun "ls -dZ /proc/sys/net/ipv6/conf/all/disable_ipv6 | grep :sysctl_net_t" + rlSESearchRule "allow chronyc_t sysctl_net_t : dir { search } [ ]" + rlSESearchRule "allow chronyc_t sysctl_net_t : file { getattr open read } [ ]" + rlPhaseEnd + fi fi if ! rlIsRHEL 5 6 7 ; then From cc300caa91b35677c3980ef8bc8f775c7fcb6c47 Mon Sep 17 00:00:00 2001 From: Amith Kumar Date: Wed, 21 May 2025 16:46:47 +0530 Subject: [PATCH 508/626] Fix failing deny_load_module testcase The selinux-policy/deny-rules test suite failed during recent test runs on Fedora-rawhide. The cause of failure seems to be missing deny rules compatible to recent rawhide release. Fix the test code and address the failures. Signed-off-by: Amith Kumar --- selinux-policy/deny-rules/runtest.sh | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/selinux-policy/deny-rules/runtest.sh b/selinux-policy/deny-rules/runtest.sh index 65f947e..36b5bbc 100755 --- a/selinux-policy/deny-rules/runtest.sh +++ b/selinux-policy/deny-rules/runtest.sh @@ -19,6 +19,7 @@ rlJournalStart fi rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 rlAssertRpm libsepol rlAssertRpm libsemanage rlAssertRpm libselinux @@ -41,6 +42,8 @@ rlJournalStart rlRun "echo 'PasswordAuthentication yes' > /etc/ssh/sshd_config.d/001-enable-password.conf" fi rlRun "service sshd restart" + rlSESetTimestamp + sleep 2 rlPhaseEnd rlPhaseStartTest "prevent the reading of a file" @@ -114,7 +117,8 @@ rlJournalStart fi rlRun "echo -e '( deny ${USER_TYPE} ${USER_TYPE} ( system ( module_load module_request )))' > testpolicy.cil" rlRun "echo -e '( deny kmod_t kmod_t ( system ( module_load module_request )))' >> testpolicy.cil" - rlRun "semodule -i testpolicy.cil" + rlRun "echo -e '( deny kmod_t modules_object_t ( system ( module_load )))' >> testpolicy.cil" + rlRun "semodule -i testpolicy.cil" rlRun "semodule -lfull | grep testpolicy" rlRun -s "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost modprobe dummy" rlRun "grep -i 'permission denied' $rlRun_LOG" @@ -133,6 +137,7 @@ rlJournalStart rlRun "rm -f /etc/ssh/sshd_config.d/001-enable-password.conf" fi rlRun "service sshd restart" + rlSECheckAVC --ignore 'type=AVC .* denied { unlink } .* comm=rm .*:sysadm_t:.*:machineid_t:.*tclass=file' --ignore 'type=AVC .* denied { module_load } .* comm=modprobe .*:kmod_t:.*:modules_object_t:.*tclass=system' rlPhaseEnd rlJournalEnd From fed18a00fbb24dde8360fce9e47dbc336fac936f Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 20 May 2025 14:41:54 +0200 Subject: [PATCH 509/626] test if dependency on /sbin/service is gone Scriptlets of the setroubleshoot package now run the auditctl program directly instead of running the /sbin/service command which belongs to the initscripts-service package. The TC checks if the dependency was removed. The TC covers BZ#2365614 and RHEL-90842. --- .../independent-on-initscripts/main.fmf | 17 +++++++++++++++++ .../independent-on-initscripts/test.sh | 18 ++++++++++++++++++ 2 files changed, 35 insertions(+) create mode 100644 setroubleshoot/independent-on-initscripts/main.fmf create mode 100755 setroubleshoot/independent-on-initscripts/test.sh diff --git a/setroubleshoot/independent-on-initscripts/main.fmf b/setroubleshoot/independent-on-initscripts/main.fmf new file mode 100644 index 0000000..ffd5eb7 --- /dev/null +++ b/setroubleshoot/independent-on-initscripts/main.fmf @@ -0,0 +1,17 @@ +summary: Is setroubleshoot still dependent on initscripts* packages? +contact: Milos Malik +component: + - setroubleshoot +test: ./test.sh +framework: beakerlib +recommend: + - setroubleshoot-server +duration: 5m +enabled: true +link: + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2365614 + - verifies: https://issues.redhat.com/browse/RHEL-90842 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, rhel-9, centos-stream-8, centos-stream-9 + continue: false diff --git a/setroubleshoot/independent-on-initscripts/test.sh b/setroubleshoot/independent-on-initscripts/test.sh new file mode 100755 index 0000000..7d1e6a4 --- /dev/null +++ b/setroubleshoot/independent-on-initscripts/test.sh @@ -0,0 +1,18 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm setroubleshoot-server + rlPhaseEnd + + rlPhaseStartTest "bz#2365614" + rlRun "rpm -q --requires setroubleshoot-server | grep initscripts" 1 + rlRun "rpm -q --scripts setroubleshoot-server | grep service" 1 + rlRun "rpm -q --scripts setroubleshoot-server | grep 'auditctl.*reload'" + rlPhaseEnd + + rlPhaseStartCleanup + rlPhaseEnd +rlJournalEnd From 03d60e2e84cd4109559d29a8b32ae3fb95dd2959 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 27 May 2025 13:56:18 +0200 Subject: [PATCH 510/626] run the services only if they are present Not all tested services are available for all architectures. Some tests fail when they try to start/stop service which is not present. Let's make the tests more robust. --- selinux-policy/libvirt-dbus-and-similar/runtest.sh | 10 +++++++--- selinux-policy/tuned-ppd-and-similar/runtest.sh | 14 +++++++++----- selinux-policy/virt-install-additional/runtest.sh | 8 ++++++-- 3 files changed, 22 insertions(+), 10 deletions(-) diff --git a/selinux-policy/libvirt-dbus-and-similar/runtest.sh b/selinux-policy/libvirt-dbus-and-similar/runtest.sh index 03aff21..7a87688 100755 --- a/selinux-policy/libvirt-dbus-and-similar/runtest.sh +++ b/selinux-policy/libvirt-dbus-and-similar/runtest.sh @@ -77,7 +77,9 @@ rlJournalStart fi rlPhaseStartTest "real scenario -- confined users" - rlRun "service virtqemud start" + if [ -f /usr/lib/systemd/system/virtqemud.service ] ; then + rlRun "service virtqemud start" + fi rlSEConfigureSSH rlRun "setsebool ssh_sysadm_login on" for SELINUX_USER in staff_u sysadm_u ; do @@ -89,13 +91,15 @@ rlJournalStart rlRun "userdel -rfZ ${USER_NAME}" done rlRun "setsebool ssh_sysadm_login off" - rlRun "service virtqemud stop" + if [ -f /usr/lib/systemd/system/virtqemud.service ] ; then + rlRun "service virtqemud stop" + fi rlPhaseEnd if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /var /run -e /var/ARTIFACTS" 0-255 + rlRun "restorecon -Rv /etc /var /run -e /var/ARTIFACTS" 0-255 rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd fi diff --git a/selinux-policy/tuned-ppd-and-similar/runtest.sh b/selinux-policy/tuned-ppd-and-similar/runtest.sh index d228c1d..e337ae3 100755 --- a/selinux-policy/tuned-ppd-and-similar/runtest.sh +++ b/selinux-policy/tuned-ppd-and-similar/runtest.sh @@ -83,16 +83,20 @@ rlJournalStart if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" - rlRun "service gdm start" - rlRun "service gdm status" - sleep 2 + if [ -f /usr/lib/systemd/system/gdm.service ] ; then + rlRun "service gdm start" + rlRun "service gdm status" + sleep 2 + fi rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 rlRun "busctl introspect net.hadess.PowerProfiles /org/freedesktop/UPower/PowerProfiles" rlRun "busctl introspect net.hadess.PowerProfiles /net/hadess/PowerProfiles" rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 - sleep 2 - rlRun "service gdm stop" + if [ -f /usr/lib/systemd/system/gdm.service ] ; then + sleep 2 + rlRun "service gdm stop" + fi rlPhaseEnd fi diff --git a/selinux-policy/virt-install-additional/runtest.sh b/selinux-policy/virt-install-additional/runtest.sh index b5de6be..b05be78 100755 --- a/selinux-policy/virt-install-additional/runtest.sh +++ b/selinux-policy/virt-install-additional/runtest.sh @@ -278,7 +278,9 @@ rlJournalStart rlPhaseEnd rlPhaseStartTest "RHEL-65266" - rlSESearchRule "allow virtqemud_t sysfs_t : file { write } [ ]" + if seinfo -a | grep -q virt_driver_domain ; then + rlSESearchRule "allow virtqemud_t sysfs_t : file { write } [ ]" + fi rlRun "service virtqemud start" rlRun "service virtnodedevd start" rlRun "mkdir -p devices" @@ -301,7 +303,9 @@ rlJournalStart rlPhaseEnd rlPhaseStartTest "RHEL-65385" - rlSESearchRule "allow virtqemud_t sysfs_t : file { write } [ ]" + if seinfo -a | grep -q virt_driver_domain ; then + rlSESearchRule "allow virtqemud_t sysfs_t : file { write } [ ]" + fi if rlIsRHEL 8 ; then rlRun "service libvirtd start" fi From 9fbaa60c55fc1348a6aa49853c7e7161297ec3d3 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Thu, 29 May 2025 15:48:05 +0200 Subject: [PATCH 511/626] Test selabel_lookup with local fcontext modifications In specific conditions, it was not possible to override default file context using `semanage fcontext`. The test imitates the right condition and checks whether it works as expected. Related: https://bugzilla.redhat.com/show_bug.cgi?id=2360183 --- .../selabel_lookup-and-local-changes/main.fmf | 23 ++++++++ .../selabel_lookup-and-local-changes/test.sh | 52 +++++++++++++++++++ 2 files changed, 75 insertions(+) create mode 100644 libselinux/selabel_lookup-and-local-changes/main.fmf create mode 100755 libselinux/selabel_lookup-and-local-changes/test.sh diff --git a/libselinux/selabel_lookup-and-local-changes/main.fmf b/libselinux/selabel_lookup-and-local-changes/main.fmf new file mode 100644 index 0000000..66cbf9d --- /dev/null +++ b/libselinux/selabel_lookup-and-local-changes/main.fmf @@ -0,0 +1,23 @@ +summary: Test selabel_lookup with local fcontext modifications +description: We need to be sure that different of local fcontext modifications are consistently resolved +test: ./test.sh +framework: beakerlib +contact: Petr Lautrbach +component: + - libselinux +require: + - libselinux-utils + - policycoreutils-python-utils +enabled: true +duration: 10m +tier: 1 +tag: + - CI-Tier-1 + - NoRHEL4 + - NoRHEL5 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6 + continue: false +link: + - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2360183 diff --git a/libselinux/selabel_lookup-and-local-changes/test.sh b/libselinux/selabel_lookup-and-local-changes/test.sh new file mode 100755 index 0000000..1a944b7 --- /dev/null +++ b/libselinux/selabel_lookup-and-local-changes/test.sh @@ -0,0 +1,52 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PATHS="/rc.d/init.d/test42XYZ-selabel +/usr/bin/test42XYZ-selabel_lookup +/var/lib/test42XYZ-selabel_lookup/bestmatch" + +PATHSPECS='/rc\.d/init\.d/test42XYZ-(selabel|lookup) +/usr/bin/test42XYZ-selabel_lookup +/var/lib/test42XYZ-selabel_lookup(/.*)?' + +rlJournalStart + rlPhaseStartSetup + rlRun "tmp=\$(mktemp -d)" 0 "Create tmp directory" + rlRun "pushd $tmp" + rlRun "set -o pipefail" + rlPhaseEnd + + rlPhaseStartTest + echo -n '' > test-selabel-lookup.cil + for pathspec in $PATHSPECS; do + echo "(filecon \"${pathspec}\" file (system_u object_r shell_exec_t ((s0) (s0))))" >> test-selabel-lookup.cil + done + rlRun "cat test-selabel-lookup.cil" + rlRun "semodule -i test-selabel-lookup.cil" + for path in $PATHS; do + rlRun -s "selabel_lookup -b file -k ${path}" + rlAssertGrep shell_exec_t $rlRun_LOG + done + for pathspec in $PATHSPECS; do + rlRun "semanage fcontext -a -t bin_t '${pathspec}'" + done + rlRun "semanage fcontext -l -C" + for path in $PATHS; do + rlRun -s "selabel_lookup -b file -k ${path}" + rlAssertGrep bin_t $rlRun_LOG + + echo $? + rlRun "matchpathcon ${path}" + done + for pathspec in $PATHSPECS; do + rlRun "semanage fcontext -d -t bin_t '${pathspec}'" + done + rlRun "semodule -r test-selabel-lookup" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "popd" + rlRun "rm -r $tmp" 0 "Remove tmp directory" + rlPhaseEnd +rlJournalEnd From 34a1e679ecb38ec1bedbbd52b8907ecf00cbec39 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 20 May 2025 15:27:46 +0200 Subject: [PATCH 512/626] test if tuned-ppd can talk to SSSD via socket Recently, a SSSD enabled machine which also runs the tuned-ppd service revealed that SELinux prevents the tuned-ppd process from writing to the /var/lib/sss/pipes/nss socket and then connecting to the sssd process. The TC does not reproduce the situation. In order to support the communication between tuned-ppd and SSSD (tuned-ppd <-> nsswitch <-> SSSD), I believe that SELinux policy should allow the actions. The TC looks for appropriate policy rules and file context patterns. The TC covers BZ#2367076. --- selinux-policy/tuned-ppd-and-similar/Makefile | 1 + selinux-policy/tuned-ppd-and-similar/main.fmf | 1 + selinux-policy/tuned-ppd-and-similar/runtest.sh | 8 ++++++++ 3 files changed, 10 insertions(+) diff --git a/selinux-policy/tuned-ppd-and-similar/Makefile b/selinux-policy/tuned-ppd-and-similar/Makefile index 4943a64..695018b 100644 --- a/selinux-policy/tuned-ppd-and-similar/Makefile +++ b/selinux-policy/tuned-ppd-and-similar/Makefile @@ -65,6 +65,7 @@ $(METADATA): Makefile @echo "Bug: RHEL-69450" >> $(METADATA) # RHEL-10 @echo "Bug: RHEL-69526" >> $(METADATA) # RHEL-9 @echo "Bug: RHEL-85849" >> $(METADATA) # RHEL-10 + @echo "Bug: 2367076" >> $(METADATA) # Fedora 41 rhts-lint $(METADATA) diff --git a/selinux-policy/tuned-ppd-and-similar/main.fmf b/selinux-policy/tuned-ppd-and-similar/main.fmf index 909655b..559686f 100644 --- a/selinux-policy/tuned-ppd-and-similar/main.fmf +++ b/selinux-policy/tuned-ppd-and-similar/main.fmf @@ -32,6 +32,7 @@ link: - verifies: https://issues.redhat.com/browse/RHEL-69450 - verifies: https://issues.redhat.com/browse/RHEL-69526 - verifies: https://issues.redhat.com/browse/RHEL-85849 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2367076 adjust: - enabled: false when: distro < rhel-9.5 diff --git a/selinux-policy/tuned-ppd-and-similar/runtest.sh b/selinux-policy/tuned-ppd-and-similar/runtest.sh index e337ae3..95fd37a 100755 --- a/selinux-policy/tuned-ppd-and-similar/runtest.sh +++ b/selinux-policy/tuned-ppd-and-similar/runtest.sh @@ -81,6 +81,14 @@ rlJournalStart rlPhaseEnd fi + if rlSEDefined "tuned_ppd_t sssd_t" ; then + rlPhaseStartTest "bz#2367076" + rlSEMatchPathCon "/var/lib/sss/pipes/nss" "sssd_var_lib_t" + rlSESearchRule "allow tuned_ppd_t sssd_var_lib_t : sock_file { write } [ ]" + rlSESearchRule "allow tuned_ppd_t sssd_t : unix_stream_socket { connectto } [ ]" + rlPhaseEnd + fi + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" if [ -f /usr/lib/systemd/system/gdm.service ] ; then From f54862208135d884790d520d001545c6868f67bf Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 27 May 2025 16:42:48 +0200 Subject: [PATCH 513/626] test if samba-bgqd can send data into /var/lib/samba/private/msg.sock/ Recent selinux-policy + samba testing revealed that SELinux prevents the samba-bgqd process from sending data into UNIX datagram sockets located in the /var/lib/samba/private/msg.sock/ directory. The TC reproduces the situation on ppc64le machines. In order to support the intentional samba-bgqd behavior, I believe that SELinux policy should allow this action. The TC looks for appropriate policy rules and file context patterns. The TC covers RHEL-93731. --- selinux-policy/samba-bgqd-and-similar/Makefile | 1 + selinux-policy/samba-bgqd-and-similar/main.fmf | 2 ++ selinux-policy/samba-bgqd-and-similar/runtest.sh | 5 +++++ 3 files changed, 8 insertions(+) diff --git a/selinux-policy/samba-bgqd-and-similar/Makefile b/selinux-policy/samba-bgqd-and-similar/Makefile index df25be8..e53e298 100644 --- a/selinux-policy/samba-bgqd-and-similar/Makefile +++ b/selinux-policy/samba-bgqd-and-similar/Makefile @@ -68,6 +68,7 @@ $(METADATA): Makefile @echo "Bug: RHEL-69517" >> $(METADATA) # RHEL-9 @echo "Bug: RHEL-72860" >> $(METADATA) # RHEL-9 @echo "Bug: RHEL-72861" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-93731" >> $(METADATA) # RHEL-10 rhts-lint $(METADATA) diff --git a/selinux-policy/samba-bgqd-and-similar/main.fmf b/selinux-policy/samba-bgqd-and-similar/main.fmf index ecf1d9c..9a8ed19 100644 --- a/selinux-policy/samba-bgqd-and-similar/main.fmf +++ b/selinux-policy/samba-bgqd-and-similar/main.fmf @@ -39,6 +39,7 @@ link: - verifies: https://issues.redhat.com/browse/RHEL-69517 - verifies: https://issues.redhat.com/browse/RHEL-72860 - verifies: https://issues.redhat.com/browse/RHEL-72861 + - verifies: https://issues.redhat.com/browse/RHEL-93731 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 @@ -46,3 +47,4 @@ adjust: extra-summary: /CoreOS/selinux-policy/Regression/samba-bgqd-and-similar extra-task: /CoreOS/selinux-policy/Regression/samba-bgqd-and-similar extra-nitrate: TC#0617974 +id: 1da15d16-92c5-405e-bc80-ed0ab0ea65a8 diff --git a/selinux-policy/samba-bgqd-and-similar/runtest.sh b/selinux-policy/samba-bgqd-and-similar/runtest.sh index df5195b..e7d3fe7 100755 --- a/selinux-policy/samba-bgqd-and-similar/runtest.sh +++ b/selinux-policy/samba-bgqd-and-similar/runtest.sh @@ -87,6 +87,11 @@ rlJournalStart rlSESearchRule "allow samba_bgqd_t cupsd_var_run_t : sock_file { read write } [ ]" rlSESearchRule "allow samba_bgqd_t cupsd_t : unix_stream_socket { connectto } [ ]" rlPhaseEnd + + rlPhaseStartTest "RHEL-93731" + rlSEMatchPathCon "/var/lib/samba/private/msg.sock/668534" "samba_var_t" + rlSESearchRule "allow samba_bgqd_t smbd_t : unix_dgram_socket { sendto } [ ]" + rlPhaseEnd fi if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then From c809f6be4fc435a2adfb50c59cb062b32c0b7d8d Mon Sep 17 00:00:00 2001 From: Petr Matyas Date: Thu, 5 Jun 2025 12:21:22 +0200 Subject: [PATCH 514/626] Update dependencies of policycoreutils setfiles test Proper list of dependecies is necessary as not all distros have every package preinstalled, for example on RHIVOS we didn't have e2fsprogs in the system, while on more general use systems it is included almost always, which is why it wasn't causing problems before --- policycoreutils/setfiles/main.fmf | 2 ++ 1 file changed, 2 insertions(+) diff --git a/policycoreutils/setfiles/main.fmf b/policycoreutils/setfiles/main.fmf index e49118d..af4d84d 100644 --- a/policycoreutils/setfiles/main.fmf +++ b/policycoreutils/setfiles/main.fmf @@ -5,6 +5,8 @@ component: - policycoreutils recommend: - policycoreutils +require: + - e2fsprogs duration: 30m enabled: true tag: From a6904ef9bcf836cca8d182e67b1b1e7bd09ee586 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Mon, 26 May 2025 18:24:57 +0200 Subject: [PATCH 515/626] test if gdm can talk to switcheroo via D-bus A recently filed customer case revealed that SELinux prevents dbus-broker processes (executed by GDM or gnome-shell) from communicating to switcheroo-control processes. The TC reproduces the situation. In order to support various GNOME features, I believe that SELinux policy should allow this action. The TC looks for appropriate policy rules and file context patterns. The TC covers RHEL-93335 and RHEL-93535. --- selinux-policy/switcheroo-control-and-similar/Makefile | 4 +++- selinux-policy/switcheroo-control-and-similar/main.fmf | 3 +++ selinux-policy/switcheroo-control-and-similar/runtest.sh | 6 ++++++ setroubleshoot/independent-on-initscripts/main.fmf | 5 ++++- 4 files changed, 16 insertions(+), 2 deletions(-) diff --git a/selinux-policy/switcheroo-control-and-similar/Makefile b/selinux-policy/switcheroo-control-and-similar/Makefile index 2337eb8..1174fbd 100644 --- a/selinux-policy/switcheroo-control-and-similar/Makefile +++ b/selinux-policy/switcheroo-control-and-similar/Makefile @@ -55,7 +55,7 @@ $(METADATA): Makefile @echo "TestTime: 15m" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) @echo "RunFor: switcheroo-control" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console switcheroo-control python3-gobject-base /usr/sbin/service" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console switcheroo-control python3-gobject-base /usr/sbin/service gdm" >> $(METADATA) @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @echo "License: GPLv2" >> $(METADATA) @@ -64,6 +64,8 @@ $(METADATA): Makefile @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) @echo "Bug: RHEL-24268" >> $(METADATA) # RHEL-9 + @echo "Bug: RHEL-93335" >> $(METADATA) # RHEL-9 + @echo "Bug: RHEL-93535" >> $(METADATA) # RHEL-10 rhts-lint $(METADATA) diff --git a/selinux-policy/switcheroo-control-and-similar/main.fmf b/selinux-policy/switcheroo-control-and-similar/main.fmf index eb2d6bb..4c8ed75 100644 --- a/selinux-policy/switcheroo-control-and-similar/main.fmf +++ b/selinux-policy/switcheroo-control-and-similar/main.fmf @@ -21,6 +21,7 @@ recommend: - switcheroo-control - python3-gobject-base - /usr/sbin/service + - gdm environment: AVC_ERROR: +no_avc_check duration: 10m @@ -34,6 +35,8 @@ tag: - NoRHIVOS link: - verifies: https://issues.redhat.com/browse/RHEL-24268 + - verifies: https://issues.redhat.com/browse/RHEL-93335 + - verifies: https://issues.redhat.com/browse/RHEL-93535 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 diff --git a/selinux-policy/switcheroo-control-and-similar/runtest.sh b/selinux-policy/switcheroo-control-and-similar/runtest.sh index 243d0ee..f95007b 100755 --- a/selinux-policy/switcheroo-control-and-similar/runtest.sh +++ b/selinux-policy/switcheroo-control-and-similar/runtest.sh @@ -51,6 +51,7 @@ rlJournalStart rlAssertRpm ${SERVICE_PACKAGE} rlServiceStop ${SERVICE_NAME} + rlServiceStart gdm rlSESetEnforce rlSEStatus @@ -78,6 +79,11 @@ rlJournalStart rlSESearchRule "allow unconfined_t switcheroo_control_t : dbus { send_msg } [ ]" rlSESearchRule "allow switcheroo_control_t unconfined_t : dbus { send_msg } [ ]" rlPhaseEnd + + rlPhaseStartTest "RHEL-93335 + RHEL-93535" + rlSESearchRule "allow xdm_t switcheroo_control_t : dbus { send_msg } [ ]" + rlSESearchRule "allow switcheroo_control_t xdm_t : dbus { send_msg } [ ]" + rlPhaseEnd fi if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then diff --git a/setroubleshoot/independent-on-initscripts/main.fmf b/setroubleshoot/independent-on-initscripts/main.fmf index ffd5eb7..a5735d9 100644 --- a/setroubleshoot/independent-on-initscripts/main.fmf +++ b/setroubleshoot/independent-on-initscripts/main.fmf @@ -13,5 +13,8 @@ link: - verifies: https://issues.redhat.com/browse/RHEL-90842 adjust: - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, rhel-9, centos-stream-8, centos-stream-9 + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, rhel-9, centos-stream-8, + centos-stream-9 continue: false +extra-nitrate: TC#0619234 +id: 945c84e9-8e15-4ab6-a2be-65841c8e0a8a From b873a41d17c922b1e725ec1d708968ebecff9942 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Fri, 6 Jun 2025 16:04:20 +0200 Subject: [PATCH 516/626] kernel/selinux-testsuite: apply patch series to cover cap2_userns We need to ensure that at least one cap2_userns permission has test coverage to check a formal box somewhere. Apply an upstream patch series that adds this coverage. Signed-off-by: Ondrej Mosnacek --- kernel/selinux-testsuite/runtest.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/selinux-testsuite/runtest.sh b/kernel/selinux-testsuite/runtest.sh index 573599b..9514dd0 100755 --- a/kernel/selinux-testsuite/runtest.sh +++ b/kernel/selinux-testsuite/runtest.sh @@ -41,7 +41,7 @@ DEFAULT_COMMIT="f9f4a604b50eecdc9ff674f1762208f23c15013f" # requests (by number) are merged, creating a new temporary local branch. DEFAULT_PULLS="" # Default SELinux Patchwork series to apply before running the test. -DEFAULT_PATCHES="883857 929525" +DEFAULT_PATCHES="883857 929525 969268" # Optional test parameter - location of testuite git. GIT_URL=${GIT_URL:-"https://github.com/SELinuxProject/selinux-testsuite"} From 7b73a19fe551b2e028153c32f95c14839e015a01 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Mon, 9 Jun 2025 13:48:32 +0200 Subject: [PATCH 517/626] modify tests to cope with a missing selinux-policy-* packages Even though the tests require various selinux-policy-* packages, some of packages may not be available on all platforms and architectures. It can also happen that SELinux policy store is installed in an unusual location. The tests should cope with both situations. --- checkpolicy/checkpolicy/runtest.sh | 9 ++++++--- libselinux/container-selinux_crond/runtest.sh | 2 +- policycoreutils/semanage-interface/runtest.sh | 4 ++++ policycoreutils/semanage-login/runtest.sh | 4 ++++ policycoreutils/semanage-user/runtest.sh | 4 ++++ selinux-policy/libvirt-dbus-and-similar/runtest.sh | 2 +- selinux-policy/rngd-and-similar/main.fmf | 2 +- selinux-policy/stalld-and-similar/runtest.sh | 4 ++-- 8 files changed, 23 insertions(+), 8 deletions(-) diff --git a/checkpolicy/checkpolicy/runtest.sh b/checkpolicy/checkpolicy/runtest.sh index 6f5a9ef..059454f 100755 --- a/checkpolicy/checkpolicy/runtest.sh +++ b/checkpolicy/checkpolicy/runtest.sh @@ -37,8 +37,7 @@ rlJournalStart if rlIsRHEL "<9" ; then rlAssertRpm selinux-policy-minimum fi - rlAssertRpm selinux-policy-mls - rlAssertRpm selinux-policy-targeted + rlRun "rpm -qa | grep selinux-policy" rlRun "rpm -qa | grep kernel" rlRun "uname -a" TEST_FILE=`mktemp` @@ -120,7 +119,7 @@ rlJournalStart LIST="mls targeted" fi for POLICY_TYPE in $LIST ; do - if [ ! -e /etc/selinux/${POLICY_TYPE}/policy/policy.* ] ; then + if ! stat /etc/selinux/${POLICY_TYPE}/policy/policy.* >& /dev/null ; then continue fi rlRun "echo -e 'q\n' | checkpolicy -Mdb /etc/selinux/${POLICY_TYPE}/policy/policy.* | tee ${OUTPUT_FILE}" @@ -142,6 +141,10 @@ rlJournalStart LIST="mls targeted" fi for POLICY_TYPE in $LIST ; do + if ! stat /etc/selinux/${POLICY_TYPE}/policy/policy.* >& /dev/null ; then + rlLog "${POLICY_TYPE} policy file is not available, skipping" + continue + fi if rlIsRHEL 5 6 ; then VERSIONS=`seq ${MIN_VERSION} 1 ${MAX_VERSION}` else diff --git a/libselinux/container-selinux_crond/runtest.sh b/libselinux/container-selinux_crond/runtest.sh index 74dde71..0963796 100755 --- a/libselinux/container-selinux_crond/runtest.sh +++ b/libselinux/container-selinux_crond/runtest.sh @@ -35,7 +35,7 @@ rlJournalStart rlPhaseStartSetup rlAssertRpm ${PACKAGE} rlAssertRpm cronie - rlAssertRpm container-selinux + rlRun "rpm -qa | grep -e container-selinux -e selinux-policy" rlRun "setenforce 1" rlRun "sestatus" OUTPUT_FILE=`mktemp` diff --git a/policycoreutils/semanage-interface/runtest.sh b/policycoreutils/semanage-interface/runtest.sh index 70dbbc7..ed99caf 100755 --- a/policycoreutils/semanage-interface/runtest.sh +++ b/policycoreutils/semanage-interface/runtest.sh @@ -34,6 +34,7 @@ PACKAGE="policycoreutils" rlJournalStart rlPhaseStartSetup rlAssertRpm ${PACKAGE} + rlRun "rpm -qa | grep selinux-policy" rlPhaseEnd rlPhaseStartTest @@ -42,6 +43,9 @@ rlJournalStart if [ ! -d /etc/selinux/${POLICY_TYPE} ] ; then continue fi + if ! stat /etc/selinux/${POLICY_TYPE}/policy/policy.* >& /dev/null ; then + continue + fi rlRun "semanage interface -l -S ${POLICY_TYPE}" done if ! rlIsRHEL 5; then diff --git a/policycoreutils/semanage-login/runtest.sh b/policycoreutils/semanage-login/runtest.sh index 97111d8..0986fc5 100755 --- a/policycoreutils/semanage-login/runtest.sh +++ b/policycoreutils/semanage-login/runtest.sh @@ -34,6 +34,7 @@ PACKAGE="policycoreutils" rlJournalStart rlPhaseStartSetup rlAssertRpm ${PACKAGE} + rlRun "rpm -qa | grep selinux-policy" rlPhaseEnd rlPhaseStartTest @@ -42,6 +43,9 @@ rlJournalStart if [ ! -d /etc/selinux/${POLICY_TYPE} ] ; then continue fi + if ! stat /etc/selinux/${POLICY_TYPE}/policy/policy.* >& /dev/null ; then + continue + fi rlRun "semanage login -l -S ${POLICY_TYPE}" done if ! rlIsRHEL 5; then diff --git a/policycoreutils/semanage-user/runtest.sh b/policycoreutils/semanage-user/runtest.sh index eb4035d..6326db6 100755 --- a/policycoreutils/semanage-user/runtest.sh +++ b/policycoreutils/semanage-user/runtest.sh @@ -34,6 +34,7 @@ PACKAGE="policycoreutils" rlJournalStart rlPhaseStartSetup rlAssertRpm ${PACKAGE} + rlRun "rpm -qa | grep selinux-policy" rlRun "make -f /usr/share/selinux/devel/Makefile" rlRun "ls -l testpolicy.pp" rlPhaseEnd @@ -50,6 +51,9 @@ rlJournalStart if [ ! -d /etc/selinux/${POLICY_TYPE} ] ; then continue fi + if ! stat /etc/selinux/${POLICY_TYPE}/policy/policy.* >& /dev/null ; then + continue + fi rlRun "semanage user -l -S ${POLICY_TYPE}" done if ! rlIsRHEL 5; then diff --git a/selinux-policy/libvirt-dbus-and-similar/runtest.sh b/selinux-policy/libvirt-dbus-and-similar/runtest.sh index 7a87688..d6907cb 100755 --- a/selinux-policy/libvirt-dbus-and-similar/runtest.sh +++ b/selinux-policy/libvirt-dbus-and-similar/runtest.sh @@ -52,7 +52,7 @@ rlJournalStart rlAssertRpm ${SERVICE_PACKAGE} rlServiceStop ${SERVICE_NAME} - rlRun "yum -y install libvirt\* --skip-broken" + rlRun "yum -y install libvirt\* --skip-broken -x \*i686\* -x glibc32" rlSESetEnforce rlSEStatus diff --git a/selinux-policy/rngd-and-similar/main.fmf b/selinux-policy/rngd-and-similar/main.fmf index f2a2dd0..acda722 100644 --- a/selinux-policy/rngd-and-similar/main.fmf +++ b/selinux-policy/rngd-and-similar/main.fmf @@ -69,7 +69,7 @@ adjust: when: distro == rhel-4, rhel-5, rhel-6 continue: false - enabled: false - when: arch == s390x + when: arch == aarch64, s390x continue: false extra-nitrate: TC#0300433 extra-summary: /CoreOS/selinux-policy/Regression/rngd-and-similar diff --git a/selinux-policy/stalld-and-similar/runtest.sh b/selinux-policy/stalld-and-similar/runtest.sh index 95e02ce..4f712cb 100755 --- a/selinux-policy/stalld-and-similar/runtest.sh +++ b/selinux-policy/stalld-and-similar/runtest.sh @@ -111,7 +111,7 @@ rlJournalStart rlRun "grep ^AGGR= /etc/sysconfig/stalld" rlRun "sed -i 's/^AGGR=.*$/AGGR=\"--backend queue_track\"/' /etc/sysconfig/stalld" rlRun "grep ^AGGR= /etc/sysconfig/stalld" - rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status stop status" 5 + rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "start status stop status" 5 rlRun "sed -i 's/^AGGR=.*$/AGGR=/' /etc/sysconfig/stalld" rlRun "grep ^AGGR= /etc/sysconfig/stalld" rlPhaseEnd @@ -129,7 +129,7 @@ rlJournalStart rlRun "journalctl -u ${SERVICE_NAME} > after.txt" rlRun "setsebool domain_can_write_kmsg on" rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status" 1 - rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 + rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "stop status" 1 rlRun "setsebool domain_can_write_kmsg off" rlRun "diff before.txt after.txt | grep -i -e 'operation not permitted' -e 'permission denied'" 1 From faa792f255ec59b57cd34b7ff8f1193efde6b2d3 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Thu, 29 May 2025 13:44:32 +0200 Subject: [PATCH 518/626] test if exim can find /proc/sys/net/ipv6/conf/all/disable_ipv6 A regular exim + selinux-policy testing performed on Testing Farm machines revealed that SELinux prevents the exim processes from searching the /proc/sys/net/ipv6/conf/all/disable_ipv6 file. The TC reproduces the situation on TF machines. In order to avoid unnecessary SELinux denials, I believe that SELinux policy should allow this access. The TC looks for appropriate policy rules and file context patterns. The TC covers RHEL-94268. --- selinux-policy/exim-and-similar/Makefile | 1 + selinux-policy/exim-and-similar/main.fmf | 1 + selinux-policy/exim-and-similar/runtest.sh | 8 ++++++++ 3 files changed, 10 insertions(+) diff --git a/selinux-policy/exim-and-similar/Makefile b/selinux-policy/exim-and-similar/Makefile index 3c8dc5d..4982ecb 100644 --- a/selinux-policy/exim-and-similar/Makefile +++ b/selinux-policy/exim-and-similar/Makefile @@ -68,6 +68,7 @@ $(METADATA): Makefile @echo "Bug: RHEL-14186" >> $(METADATA) # RHEL-8 @echo "Bug: RHEL-21902" >> $(METADATA) # RHEL-9 @echo "Bug: RHEL-21903" >> $(METADATA) # RHEL-8 + @echo "Bug: RHEL-94268" >> $(METADATA) # RHEL-9 rhts-lint $(METADATA) diff --git a/selinux-policy/exim-and-similar/main.fmf b/selinux-policy/exim-and-similar/main.fmf index e2ed297..a16d8f5 100644 --- a/selinux-policy/exim-and-similar/main.fmf +++ b/selinux-policy/exim-and-similar/main.fmf @@ -44,6 +44,7 @@ link: - verifies: https://issues.redhat.com/browse/RHEL-14186 - verifies: https://issues.redhat.com/browse/RHEL-21902 - verifies: https://issues.redhat.com/browse/RHEL-21903 + - verifies: https://issues.redhat.com/browse/RHEL-94268 adjust: - enabled: false when: distro == rhel-4, rhel-alt-7 diff --git a/selinux-policy/exim-and-similar/runtest.sh b/selinux-policy/exim-and-similar/runtest.sh index f496967..01b5036 100755 --- a/selinux-policy/exim-and-similar/runtest.sh +++ b/selinux-policy/exim-and-similar/runtest.sh @@ -96,6 +96,14 @@ rlJournalStart rlPhaseEnd fi + if rlIsRHEL '>9.6' || rlIsRHEL '>10.0' || rlIsFedora ; then + rlPhaseStartTest "RHEL-94268" + rlRun "ls -dZ /proc/sys/net/ | grep :sysctl_net_t" + rlRun "ls -Z /proc/sys/net/ipv6/conf/all/disable_ipv6 | grep :sysctl_net_t" + rlSESearchRule "allow exim_t sysctl_net_t : dir { search } [ ]" + rlPhaseEnd + fi + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" From 450f6475d0c7dcc80b59059a951e5fbfa494e5b0 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 10 Jun 2025 12:07:16 +0200 Subject: [PATCH 519/626] provide a dummy certificate for the smtpd service The opensmtpd service does not start when the /etc/pki/tls/cert.pem file is missing. Let's provide an empty file to work around this issue. --- selinux-policy/opensmtpd-and-similar/runtest.sh | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/selinux-policy/opensmtpd-and-similar/runtest.sh b/selinux-policy/opensmtpd-and-similar/runtest.sh index c98321a..c728060 100755 --- a/selinux-policy/opensmtpd-and-similar/runtest.sh +++ b/selinux-policy/opensmtpd-and-similar/runtest.sh @@ -49,6 +49,11 @@ rlJournalStart rlAssertRpm ${SERVICE_PACKAGE} fi + if [ -e /etc/pki/tls/cert.pem ] ; then + CERTIFICATE_MISSING="false" + else + CERTIFICATE_MISSING="true" + fi rlServiceStop ${SERVICE_NAME} postfix sendmail rlSESetEnforce @@ -86,6 +91,9 @@ rlJournalStart # for environments where the service is not yet confined PROCESS_CONTEXT="unconfined_service_t" fi + if ${CERTIFICATE_MISSING} ; then + rlRun "touch /etc/pki/tls/cert.pem" + fi rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 rlRun "sestatus | mailx -s test-email root@localhost" rlRun "restorecon -Rv /etc /var /run -e /var/ARTIFACTS" 0-255 @@ -98,6 +106,9 @@ rlJournalStart sleep 2 rlSECheckAVC + if ${CERTIFICATE_MISSING} ; then + rlRun "rm -f /etc/pki/tls/cert.pem" + fi rlServiceRestore ${SERVICE_NAME} postfix sendmail rlPhaseEnd rlJournalPrintText From 1481683fec811ccb449a5af2883c9e9ea45bc050 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Mon, 2 Jun 2025 12:01:00 +0200 Subject: [PATCH 520/626] test if tuned-ppd can create /etc/tuned/ppd_base_profile with correct label Several reported BZs revealed that the tuned-ppd process can create an incorrectly labeled ppd_base_profile file under the /etc/tuned directory if the file does not exist. The TC reproduces the situation. In order to fix this issue, SELinux policy should define a filename transition rule which ensures that the correct SELinux label is applied when the file is created. The TC looks for appropriate policy rules and file context patterns. The TC covers bz#2359851, bz#2361423 and their duplicates. --- selinux-policy/tuned-ppd-and-similar/Makefile | 4 +++ selinux-policy/tuned-ppd-and-similar/main.fmf | 4 +++ .../tuned-ppd-and-similar/runtest.sh | 28 ++++++++++++++++++- 3 files changed, 35 insertions(+), 1 deletion(-) diff --git a/selinux-policy/tuned-ppd-and-similar/Makefile b/selinux-policy/tuned-ppd-and-similar/Makefile index 695018b..5aa5106 100644 --- a/selinux-policy/tuned-ppd-and-similar/Makefile +++ b/selinux-policy/tuned-ppd-and-similar/Makefile @@ -65,7 +65,11 @@ $(METADATA): Makefile @echo "Bug: RHEL-69450" >> $(METADATA) # RHEL-10 @echo "Bug: RHEL-69526" >> $(METADATA) # RHEL-9 @echo "Bug: RHEL-85849" >> $(METADATA) # RHEL-10 + @echo "Bug: 2359851" >> $(METADATA) # Fedora 42 + @echo "Bug: 2360026" >> $(METADATA) # Fedora 42 + @echo "Bug: 2361423" >> $(METADATA) # Fedora 42 @echo "Bug: 2367076" >> $(METADATA) # Fedora 41 + @echo "Bug: 2367711" >> $(METADATA) # Fedora 42 rhts-lint $(METADATA) diff --git a/selinux-policy/tuned-ppd-and-similar/main.fmf b/selinux-policy/tuned-ppd-and-similar/main.fmf index 559686f..e02c525 100644 --- a/selinux-policy/tuned-ppd-and-similar/main.fmf +++ b/selinux-policy/tuned-ppd-and-similar/main.fmf @@ -32,7 +32,11 @@ link: - verifies: https://issues.redhat.com/browse/RHEL-69450 - verifies: https://issues.redhat.com/browse/RHEL-69526 - verifies: https://issues.redhat.com/browse/RHEL-85849 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2359851 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2360026 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2361423 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2367076 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2367711 adjust: - enabled: false when: distro < rhel-9.5 diff --git a/selinux-policy/tuned-ppd-and-similar/runtest.sh b/selinux-policy/tuned-ppd-and-similar/runtest.sh index 95fd37a..85cdb7b 100755 --- a/selinux-policy/tuned-ppd-and-similar/runtest.sh +++ b/selinux-policy/tuned-ppd-and-similar/runtest.sh @@ -60,6 +60,7 @@ rlJournalStart rlAssertRpm ${SERVICE_PACKAGE} rlServiceStop ${SERVICE_NAME} + rlFileBackup /etc/tuned/ppd_base_profile rlSESetEnforce rlSEStatus @@ -89,6 +90,16 @@ rlJournalStart rlPhaseEnd fi + if rlSEDefined "tuned_rw_etc_t tuned_ppd_t" ; then + rlPhaseStartTest "bz#2359851 + bz#2360026 + bz#2361423 + bz#2367711" + rlSEMatchPathCon "/etc/tuned" "tuned_etc_t" + rlSEMatchPathCon "/etc/tuned/ppd_base_profile" "tuned_rw_etc_t" + rlSESearchRule "type_transition tuned_ppd_t tuned_etc_t : file tuned_rw_etc_t ppd_base_profile" + rlSESearchRule "allow tuned_ppd_t tuned_etc_t : dir { write add_name } [ ]" + rlSESearchRule "allow tuned_ppd_t tuned_rw_etc_t : file { create write } [ ]" + rlPhaseEnd + fi + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" if [ -f /usr/lib/systemd/system/gdm.service ] ; then @@ -100,7 +111,21 @@ rlJournalStart rlRun "busctl introspect net.hadess.PowerProfiles /org/freedesktop/UPower/PowerProfiles" rlRun "busctl introspect net.hadess.PowerProfiles /net/hadess/PowerProfiles" rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 - rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status" 1 + rlRun "ls -Z /etc/tuned/ppd_base_profile" + rlRun "tuned-adm active" + rlRun "rm -f /etc/tuned/ppd_base_profile" + if tuned-adm active | grep -q powersave ; then + rlRun "tuned-adm profile balanced" + else + rlRun "tuned-adm profile powersave" + fi + sleep 2 + rlRun "ls -Z /etc/tuned/ppd_base_profile" + rlRun "tuned-adm auto_profile" + rlRun "ls -Z /etc/tuned/ppd_base_profile | grep :tuned_rw_etc_t" + rlRun "tuned-adm verify" + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "stop status" 1 if [ -f /usr/lib/systemd/system/gdm.service ] ; then sleep 2 rlRun "service gdm stop" @@ -112,6 +137,7 @@ rlJournalStart sleep 2 rlSECheckAVC + rlFileRestore rlServiceRestore ${SERVICE_NAME} rlPhaseEnd rlJournalPrintText From 1b68d30d647f7492b35d68b80720f67014bdfe55 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Thu, 6 Feb 2025 09:27:49 +0100 Subject: [PATCH 521/626] kernel/selinux-testsuite: bump ustream commit ref This pulls various fixes and new tests. Signed-off-by: Ondrej Mosnacek --- kernel/selinux-testsuite/runtest.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kernel/selinux-testsuite/runtest.sh b/kernel/selinux-testsuite/runtest.sh index 9514dd0..28ac367 100755 --- a/kernel/selinux-testsuite/runtest.sh +++ b/kernel/selinux-testsuite/runtest.sh @@ -35,13 +35,13 @@ PACKAGE="selinux-policy" # This should be updated as needed after verifying that the new version # doesn't break testing and after applying all necessary tweaks in the TC. # Run with GIT_BRANCH=master to run the latest upstream version. -DEFAULT_COMMIT="f9f4a604b50eecdc9ff674f1762208f23c15013f" +DEFAULT_COMMIT="f24939eedb09dee75962cbee48460b435f59266b" # Default pull requests to merge before running the test. # If non-empty, then after checking out GIT_BRANCH the listed upstream pull # requests (by number) are merged, creating a new temporary local branch. DEFAULT_PULLS="" # Default SELinux Patchwork series to apply before running the test. -DEFAULT_PATCHES="883857 929525 969268" +DEFAULT_PATCHES="" # Optional test parameter - location of testuite git. GIT_URL=${GIT_URL:-"https://github.com/SELinuxProject/selinux-testsuite"} From 4a8550185cdf1387d6aced4336fde1299cad948d Mon Sep 17 00:00:00 2001 From: Amith Kumar Date: Fri, 13 Jun 2025 05:16:33 +0530 Subject: [PATCH 522/626] Fix rhel-9 avc causing deny_rules test failure The upstream selinux-policy/deny-rules test suite failed during its run on rhel-9. Cause of failure is an AVC denial triggered by modprobe command while executing module_load. Fix the test code to address the AVC & test failure. Signed-off-by: Amith Kumar --- selinux-policy/deny-rules/runtest.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/selinux-policy/deny-rules/runtest.sh b/selinux-policy/deny-rules/runtest.sh index 36b5bbc..3464738 100755 --- a/selinux-policy/deny-rules/runtest.sh +++ b/selinux-policy/deny-rules/runtest.sh @@ -137,7 +137,7 @@ rlJournalStart rlRun "rm -f /etc/ssh/sshd_config.d/001-enable-password.conf" fi rlRun "service sshd restart" - rlSECheckAVC --ignore 'type=AVC .* denied { unlink } .* comm=rm .*:sysadm_t:.*:machineid_t:.*tclass=file' --ignore 'type=AVC .* denied { module_load } .* comm=modprobe .*:kmod_t:.*:modules_object_t:.*tclass=system' + rlSECheckAVC --ignore 'type=AVC .* denied { unlink } .* comm=rm .*:sysadm_t:.*:machineid_t:.*tclass=file' --ignore 'type=AVC .* denied { module_load } .* comm=modprobe .*:kmod_t:.*:modules_object_t:.*tclass=system' --ignore 'type=AVC.*module_load.*:kmod_t:.*:kmod_t:.*tclass=system' rlPhaseEnd rlJournalEnd From 4d517e7d9b6179dc79912cedb369b80e2a995759 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Thu, 12 Jun 2025 18:35:21 +0200 Subject: [PATCH 523/626] show the size and label of /etc/tuned/ppd_base_profile Instead of comparing the SELinux label of that file against a fixed value, show the label and the file size. --- selinux-policy/tuned-ppd-and-similar/runtest.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/selinux-policy/tuned-ppd-and-similar/runtest.sh b/selinux-policy/tuned-ppd-and-similar/runtest.sh index 85cdb7b..0bc5804 100755 --- a/selinux-policy/tuned-ppd-and-similar/runtest.sh +++ b/selinux-policy/tuned-ppd-and-similar/runtest.sh @@ -121,9 +121,9 @@ rlJournalStart rlRun "tuned-adm profile powersave" fi sleep 2 - rlRun "ls -Z /etc/tuned/ppd_base_profile" + rlRun "ls -lZ /etc/tuned/ppd_base_profile" rlRun "tuned-adm auto_profile" - rlRun "ls -Z /etc/tuned/ppd_base_profile | grep :tuned_rw_etc_t" + rlRun "ls -lZ /etc/tuned/ppd_base_profile" rlRun "tuned-adm verify" rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "stop status" 1 if [ -f /usr/lib/systemd/system/gdm.service ] ; then From c7425fefd166165ee83bd9a40fb02b504606b7a8 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Mon, 16 Jun 2025 10:13:57 +0200 Subject: [PATCH 524/626] skip the RHEL-2616 test phase on RHEL-9.x Even though the RHEL-2616 bug was investigated on RHEL-9.x, it's not fixed and it got auto-closed. Until a solution is found or the bug is escalated, the automated test will skip the particular test phase. --- selinux-policy/interface-definitions/runtest.sh | 3 +++ 1 file changed, 3 insertions(+) diff --git a/selinux-policy/interface-definitions/runtest.sh b/selinux-policy/interface-definitions/runtest.sh index 215404a..29c0826 100755 --- a/selinux-policy/interface-definitions/runtest.sh +++ b/selinux-policy/interface-definitions/runtest.sh @@ -8,10 +8,13 @@ rlJournalStart rlAssertRpm policycoreutils rlPhaseEnd + if ! rlIsRHEL 9 && ! rlIsCentOS 9 ; then + # the bug is fixed on RHEL-8 but it was auto-closed on RHEL-9 rlPhaseStartTest "RHEL-2616 + RHEL-16185" rlRun "sepolgen-ifgen -v -d 2>/dev/null | sort | uniq > output.txt" rlRun "grep -i missing output.txt" 1 rlPhaseEnd + fi rlPhaseStartTest "bz#2254169 + bz#2254206 + bz#2277925" rlRun "yum -y reinstall selinux-policy-devel >& output.txt" From 27ab7e5e8ad8fb7ff634e13a5b0851d52fa13a73 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Mon, 23 Jun 2025 15:57:12 +0200 Subject: [PATCH 525/626] kernel/selinux-testsuite: bump ustream commit ref Mainly to pull "tests/inet_socket: properly detect IPSEC support", which makes the testsuite run successfully on automotive RHEL again. Signed-off-by: Ondrej Mosnacek --- kernel/selinux-testsuite/runtest.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/selinux-testsuite/runtest.sh b/kernel/selinux-testsuite/runtest.sh index 28ac367..dbb1e56 100755 --- a/kernel/selinux-testsuite/runtest.sh +++ b/kernel/selinux-testsuite/runtest.sh @@ -35,7 +35,7 @@ PACKAGE="selinux-policy" # This should be updated as needed after verifying that the new version # doesn't break testing and after applying all necessary tweaks in the TC. # Run with GIT_BRANCH=master to run the latest upstream version. -DEFAULT_COMMIT="f24939eedb09dee75962cbee48460b435f59266b" +DEFAULT_COMMIT="7a25c1a8a1c30e46409f81ee82fe53850ad7f1e3" # Default pull requests to merge before running the test. # If non-empty, then after checking out GIT_BRANCH the listed upstream pull # requests (by number) are merged, creating a new temporary local branch. From 967d55a3a3139037bd36e2f4d6fbb6ac5f66a514 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Mon, 23 Jun 2025 09:47:33 +0200 Subject: [PATCH 526/626] make sure that whole /etc is labeled correctly The rlSELibraryLoaded() now makes sure that the /etc directory and its subdirectories are labeled correctly. If they are mislabeled, a lot executed tests can trigger unnecessary SELinux denials. --- selinux-policy/Library/common/lib.sh | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/selinux-policy/Library/common/lib.sh b/selinux-policy/Library/common/lib.sh index 018d821..61c8ca9 100755 --- a/selinux-policy/Library/common/lib.sh +++ b/selinux-policy/Library/common/lib.sh @@ -29,7 +29,7 @@ # # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # library-prefix = rlSE -# library-version = 43 +# library-version = 44 # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ : <<'=cut' @@ -2006,6 +2006,13 @@ rlSELibraryLoaded() { rlSE_REQUIRES="setools-console expect policycoreutils-python-utils selinux-policy-devel audit-rules" fi + # make sure that these directories exist in home directories of + # tested users since the time they were created + rlRun "mkdir -p /etc/skel/.{cache,config,local}" + + # make sure the /etc directory is labeled correctly + rlRun "restorecon -Rv /etc" + __INTERNAL_rlSEenable_full_auditing local t=$(date +%s) From 0e555c68c661c62231db7c1582a9f52f093ed4c5 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Mon, 23 Jun 2025 20:23:30 +0200 Subject: [PATCH 527/626] Skip bootc-e2e tests bootc-e2e tests requires specific environment related to image mode. The image is prepared using buildah and later booted. This is not supported in this test suite (yet) Signed-off-by: Petr Lautrbach --- policycoreutils/linux-system-roles.selinux-tests/runtest.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/policycoreutils/linux-system-roles.selinux-tests/runtest.sh b/policycoreutils/linux-system-roles.selinux-tests/runtest.sh index 20bae06..83fc6cc 100755 --- a/policycoreutils/linux-system-roles.selinux-tests/runtest.sh +++ b/policycoreutils/linux-system-roles.selinux-tests/runtest.sh @@ -51,7 +51,7 @@ rlJournalStart if [ $ansible_test = "tests_all_transitions.yml" ]; then continue fi - rlRun "ansible-playbook -i localhost, -c local -v $ansible_test" + rlRun "ansible-playbook --skip-tags tests::bootc-e2e -i localhost, -c local -v $ansible_test" done rlPhaseEnd From bca963344a08f05a8ef7c464606048fdd2db95f2 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 24 Jun 2025 11:18:04 +0200 Subject: [PATCH 528/626] reconsider the set of broken tests Check if all tests tagged with rhel9_broken or rhel10_broken are really broken. If not, remove the tag. If there are other broken tests not yet tagged, assign them the relevant broken tag. --- libselinux/selabel-functions/main.fmf | 1 - selinux-policy/anon_inode-and-similar/main.fmf | 2 ++ selinux-policy/anon_inode-and-similar/runtest.sh | 2 +- .../bz533007-unable-to-start-kdump-service/runtest.sh | 2 +- selinux-policy/snapd-and-similar/main.fmf | 2 ++ selinux-policy/tlp-and-similar/main.fmf | 2 ++ 6 files changed, 8 insertions(+), 3 deletions(-) diff --git a/libselinux/selabel-functions/main.fmf b/libselinux/selabel-functions/main.fmf index f3425df..50a8029 100644 --- a/libselinux/selabel-functions/main.fmf +++ b/libselinux/selabel-functions/main.fmf @@ -18,7 +18,6 @@ tag: - TierCandidatesPASS - f33friendly - targeted - - rhel10_broken - fusa link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1390909 diff --git a/selinux-policy/anon_inode-and-similar/main.fmf b/selinux-policy/anon_inode-and-similar/main.fmf index 81712be..c348cbb 100644 --- a/selinux-policy/anon_inode-and-similar/main.fmf +++ b/selinux-policy/anon_inode-and-similar/main.fmf @@ -30,6 +30,8 @@ tag: - NoRHEL8 - targeted - reboot + - rhel9_broken + - rhel10_broken - NoRHIVOS link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1954145 diff --git a/selinux-policy/anon_inode-and-similar/runtest.sh b/selinux-policy/anon_inode-and-similar/runtest.sh index 46c25c6..8a506d3 100755 --- a/selinux-policy/anon_inode-and-similar/runtest.sh +++ b/selinux-policy/anon_inode-and-similar/runtest.sh @@ -34,7 +34,7 @@ if rlIsRHEL 9 || rlIsCentOS 9 ; then grubby --update-kernel ALL --args io_uring.enable=y grubby --update-kernel ALL --args sysctl.kernel.io_uring_disabled=0 sync - rhts-reboot + tmt-reboot fi fi diff --git a/selinux-policy/bz533007-unable-to-start-kdump-service/runtest.sh b/selinux-policy/bz533007-unable-to-start-kdump-service/runtest.sh index 5a7c57c..3606222 100755 --- a/selinux-policy/bz533007-unable-to-start-kdump-service/runtest.sh +++ b/selinux-policy/bz533007-unable-to-start-kdump-service/runtest.sh @@ -32,7 +32,7 @@ if ! grep crashkernel= /proc/cmdline ; then grubby --update-kernel ALL --args crashkernel=512M sync - rhts-reboot + tmt-reboot fi PACKAGE="selinux-policy" diff --git a/selinux-policy/snapd-and-similar/main.fmf b/selinux-policy/snapd-and-similar/main.fmf index 9715cbd..2fe0e0f 100644 --- a/selinux-policy/snapd-and-similar/main.fmf +++ b/selinux-policy/snapd-and-similar/main.fmf @@ -33,6 +33,8 @@ tag: - rhel8-epel - rhel9-epel - rhel10-epel + - rhel9_broken + - rhel10_broken - NoRHIVOS link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2207725 diff --git a/selinux-policy/tlp-and-similar/main.fmf b/selinux-policy/tlp-and-similar/main.fmf index 9144304..b04f5e7 100644 --- a/selinux-policy/tlp-and-similar/main.fmf +++ b/selinux-policy/tlp-and-similar/main.fmf @@ -36,6 +36,8 @@ tag: - rhel8-epel - rhel9-epel - rhel10-epel + - rhel9_broken + - rhel10_broken - NoRHIVOS link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1460481 From f0131ccacae22f53b119cd5d59d4ed1581dfbe18 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Wed, 9 Jul 2025 11:38:04 +0200 Subject: [PATCH 529/626] kernel/selinux-testsuite: bump upstream ref The only important commit is 72e60b601832 ("policy/test_secretmem.te: add anon_inode perms required in Linux v6.16-rc5"), which fixes the testsuite to work on 6.16-rc5+ kernels. Signed-off-by: Ondrej Mosnacek --- kernel/selinux-testsuite/runtest.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/selinux-testsuite/runtest.sh b/kernel/selinux-testsuite/runtest.sh index dbb1e56..cefb9e1 100755 --- a/kernel/selinux-testsuite/runtest.sh +++ b/kernel/selinux-testsuite/runtest.sh @@ -35,7 +35,7 @@ PACKAGE="selinux-policy" # This should be updated as needed after verifying that the new version # doesn't break testing and after applying all necessary tweaks in the TC. # Run with GIT_BRANCH=master to run the latest upstream version. -DEFAULT_COMMIT="7a25c1a8a1c30e46409f81ee82fe53850ad7f1e3" +DEFAULT_COMMIT="72e60b6018321a3da9d5e328477e29ee7366e498" # Default pull requests to merge before running the test. # If non-empty, then after checking out GIT_BRANCH the listed upstream pull # requests (by number) are merged, creating a new temporary local branch. From dff2d2b919c1af94f97c3dd892649cf367c5ac87 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Wed, 25 Jun 2025 18:03:42 +0200 Subject: [PATCH 530/626] adapt to policies with reduced set of types and rules There are policies which define less types and rules than the targeted policy. The executed automated tests should adapt if they still make sense. --- .../journalctl-and-similar/runtest.sh | 26 ++++++++++++------- .../systemd-run-and-similar/runtest.sh | 2 ++ .../systemd-tmpfiles-and-similar/runtest.sh | 4 ++- 3 files changed, 21 insertions(+), 11 deletions(-) diff --git a/selinux-policy/journalctl-and-similar/runtest.sh b/selinux-policy/journalctl-and-similar/runtest.sh index 4f5a7f3..87426c5 100755 --- a/selinux-policy/journalctl-and-similar/runtest.sh +++ b/selinux-policy/journalctl-and-similar/runtest.sh @@ -62,15 +62,21 @@ rlJournalStart rlPhaseStartTest "bz#1288255" rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" - rlSESearchRule "allow staff_t ${FILE_CONTEXT} : file { getattr open read execute } [ ]" - rlSESearchRule "allow sysadm_t ${FILE_CONTEXT} : file { getattr open read execute } [ ]" - rlSESearchRule "allow user_t ${FILE_CONTEXT} : file { getattr open read execute } [ ]" - rlSESearchRule "allow staff_t ${PROCESS_CONTEXT} : process { transition } [ ]" - rlSESearchRule "allow sysadm_t ${PROCESS_CONTEXT} : process { transition } [ ]" - rlSESearchRule "allow user_t ${PROCESS_CONTEXT} : process { transition } [ ]" - rlSESearchRule "type_transition staff_t ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} [ ]" - rlSESearchRule "type_transition sysadm_t ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} [ ]" - rlSESearchRule "type_transition user_t ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} [ ]" + if rlSEDefined "staff_t" ; then + rlSESearchRule "allow staff_t ${FILE_CONTEXT} : file { getattr open read execute } [ ]" + rlSESearchRule "allow staff_t ${PROCESS_CONTEXT} : process { transition } [ ]" + rlSESearchRule "type_transition staff_t ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} [ ]" + fi + if rlSEDefined "sysadm_t" ; then + rlSESearchRule "allow sysadm_t ${FILE_CONTEXT} : file { getattr open read execute } [ ]" + rlSESearchRule "allow sysadm_t ${PROCESS_CONTEXT} : process { transition } [ ]" + rlSESearchRule "type_transition sysadm_t ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} [ ]" + fi + if rlSEDefined "user_t" ; then + rlSESearchRule "allow user_t ${FILE_CONTEXT} : file { getattr open read execute } [ ]" + rlSESearchRule "allow user_t ${PROCESS_CONTEXT} : process { transition } [ ]" + rlSESearchRule "type_transition user_t ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} [ ]" + fi rlPhaseEnd rlPhaseStartTest "bz#1685689" @@ -90,7 +96,7 @@ rlJournalStart rlSESearchRule "allow journalctl_t journalctl_t : process { setrlimit } [ ]" rlPhaseEnd - if ! rlIsFedora ; then + if ! rlIsFedora && rlSEDefined "user_t" ; then rlPhaseStartTest "bz#2017838" rlSEMatchPathCon "/run/log/journal/somehash/system.journal" "syslogd_var_run_t" rlSEMatchPathCon "/var/lib/systemd/catalog/database" "init_var_lib_t" diff --git a/selinux-policy/systemd-run-and-similar/runtest.sh b/selinux-policy/systemd-run-and-similar/runtest.sh index 38b0fa4..e4a4fee 100755 --- a/selinux-policy/systemd-run-and-similar/runtest.sh +++ b/selinux-policy/systemd-run-and-similar/runtest.sh @@ -69,9 +69,11 @@ rlJournalStart rlSEMatchPathCon "/var/lib" "var_lib_t" rlSEMatchPathCon "/var/lib/myservice0" "var_lib_t" rlSESearchRule "allow init_t var_lib_t : lnk_file { getattr read } [ ]" + rlRun "setsebool daemons_use_tty on" rlRun "systemd-run -p DynamicUser=yes -p StateDirectory=myservice0 touch /var/lib/myservice0/foo" rlRun "systemd-run -p DynamicUser=yes -p StateDirectory=myservice0 --pipe wc -c /var/lib/myservice0/foo" rlRun "ls -alZ /var/lib/myservice0 /var/lib/private/myservice0" + rlRun "setsebool daemons_use_tty off" rlPhaseEnd if ! rlIsRHEL "<9.7" ; then diff --git a/selinux-policy/systemd-tmpfiles-and-similar/runtest.sh b/selinux-policy/systemd-tmpfiles-and-similar/runtest.sh index 7f2e944..6c28056 100755 --- a/selinux-policy/systemd-tmpfiles-and-similar/runtest.sh +++ b/selinux-policy/systemd-tmpfiles-and-similar/runtest.sh @@ -51,7 +51,9 @@ rlJournalStart rlPhaseStartTest "RHEL-40374 + RHEL-44191" rlSEMatchPathCon "/usr/bin/systemd-tmpfiles" "systemd_tmpfiles_exec_t" - rlSESearchRule "allow staff_t systemd_tmpfiles_exec_t : file { getattr open read map execute execute_no_trans } [ ]" + if rlSEDefined "staff_t" ; then + rlSESearchRule "allow staff_t systemd_tmpfiles_exec_t : file { getattr open read map execute execute_no_trans } [ ]" + fi rlRun "setsebool ssh_sysadm_login on" CREATED_USERS="" for SELINUX_USER in ${ALLOWED_USERS} ; do From 7ac017780e02aea0cfb9dab7f9f1f85283bd460e Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Mon, 23 Jun 2025 15:35:05 +0200 Subject: [PATCH 531/626] add a basic systemd-importd test Recently, exploratory systemd-importd + selinux-policy testing revealed that SELinux prevents the systemd-importd service from creating and deleting the /run/systemd/io.systemd.Import socket. The TC reproduces the situation. In order to support the systemd-importd service start with the default configuration, I believe that SELinux policy should allow the actions listed above. The TC looks for appropriate policy rules and file context patterns. The TC covers RHEL-98490. --- .../systemd-importd-and-similar/Makefile | 69 ++++++++++++ .../systemd-importd-and-similar/PURPOSE | 5 + .../systemd-importd-and-similar/main.fmf | 42 ++++++++ .../systemd-importd-and-similar/runtest.sh | 102 ++++++++++++++++++ 4 files changed, 218 insertions(+) create mode 100644 selinux-policy/systemd-importd-and-similar/Makefile create mode 100644 selinux-policy/systemd-importd-and-similar/PURPOSE create mode 100644 selinux-policy/systemd-importd-and-similar/main.fmf create mode 100755 selinux-policy/systemd-importd-and-similar/runtest.sh diff --git a/selinux-policy/systemd-importd-and-similar/Makefile b/selinux-policy/systemd-importd-and-similar/Makefile new file mode 100644 index 0000000..dc0acf1 --- /dev/null +++ b/selinux-policy/systemd-importd-and-similar/Makefile @@ -0,0 +1,69 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/systemd-importd-and-similar +# Description: SELinux interferes with systemd-importd and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2025 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/systemd-importd-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with systemd-importd and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "RunFor: systemd" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console systemd systemd-container /usr/sbin/service shadow-utils" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) + @echo "Bug: RHEL-98490" >> $(METADATA) # RHEL-10 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/systemd-importd-and-similar/PURPOSE b/selinux-policy/systemd-importd-and-similar/PURPOSE new file mode 100644 index 0000000..9be09c0 --- /dev/null +++ b/selinux-policy/systemd-importd-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/systemd-importd-and-similar +Author: Milos Malik + +SELinux interferes with systemd-importd and related programs. + diff --git a/selinux-policy/systemd-importd-and-similar/main.fmf b/selinux-policy/systemd-importd-and-similar/main.fmf new file mode 100644 index 0000000..e533f54 --- /dev/null +++ b/selinux-policy/systemd-importd-and-similar/main.fmf @@ -0,0 +1,42 @@ +summary: SELinux interferes with systemd-importd and related programs +description: |+ + SELinux interferes with systemd-importd and related programs. + +contact: Milos Malik +component: + - selinux-policy + - systemd +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - systemd + - /usr/sbin/service + - shadow-utils + - systemd-container +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - targeted + - failinfedora + - NoRHIVOS +link: + - verifies: https://issues.redhat.com/browse/RHEL-98490 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7 + because: the systemd-importd program is not available there +extra-nitrate: TC#0619330 +id: b692e9f4-64d8-4cb3-bba9-f4281d8075a2 diff --git a/selinux-policy/systemd-importd-and-similar/runtest.sh b/selinux-policy/systemd-importd-and-similar/runtest.sh new file mode 100755 index 0000000..c61d8c9 --- /dev/null +++ b/selinux-policy/systemd-importd-and-similar/runtest.sh @@ -0,0 +1,102 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/systemd-importd-and-similar +# Description: SELinux interferes with systemd-importd and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2025 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +ROOT_PASSWORD="redhat" +FILE_PATH="/usr/lib/systemd/systemd-importd" +FILE_CONTEXT="systemd_importd_exec_t" +SERVICE_PACKAGE="systemd-container" +SERVICE_NAME="systemd-importd" +PROCESS_NAME="systemd-importd" +PROCESS_CONTEXT="systemd_importd_t" + +rlJournalStart + if [ ! -f /usr/lib/systemd/systemd-importd ] ; then + rlLog "Not applicable to this OS version." + rlJournalEnd + exit 0 + fi + + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlAssertRpm ${SERVICE_PACKAGE} + + rlServiceStop ${SERVICE_NAME} + rlFileBackup /etc/shadow + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + if rlSEDefined ${PROCESS_CONTEXT} ; then + rlPhaseStartTest "SELinux contexts and rules" + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + SOURCE_TYPE="init_t" # systemd runs the process + rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS" + rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS" + rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" + rlPhaseEnd + fi + + if rlIsRHEL 10 || rlIsCentOS 10 || rlIsFedora ; then + rlPhaseStartTest "RHEL-98490" + rlSEMatchPathCon "/run/systemd/io.systemd.Import" "init_var_run_t" + rlSESearchRule "allow systemd_importd_t init_var_run_t : sock_file { create unlink } [ ]" + rlPhaseEnd + fi + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then + rlPhaseStartTest "real scenario -- standalone service" + rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + PROCESS_CONTEXT="unconfined_service_t" + fi + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 + rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + fi + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlFileRestore + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + From be07ded92919d9c64f3fc01d07c78ac975f64712 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Wed, 23 Jul 2025 13:37:45 +0200 Subject: [PATCH 532/626] skip certain tests on RHEL-10 because of their irrelevance The following tests are not relevant for RHEL-10 because the required packages are not available for RHEL-10: * /selinux-policy/caddy-and-similar * /selinux-policy/cups-pdf-and-similar * /selinux-policy/ntpsec-and-similar --- selinux-policy/caddy-and-similar/Makefile | 2 +- selinux-policy/caddy-and-similar/main.fmf | 2 +- selinux-policy/cups-pdf-and-similar/Makefile | 2 +- selinux-policy/cups-pdf-and-similar/main.fmf | 3 +-- selinux-policy/ntpsec-and-similar/Makefile | 2 +- selinux-policy/ntpsec-and-similar/main.fmf | 3 +-- 6 files changed, 6 insertions(+), 8 deletions(-) diff --git a/selinux-policy/caddy-and-similar/Makefile b/selinux-policy/caddy-and-similar/Makefile index 7bd0661..30ed418 100644 --- a/selinux-policy/caddy-and-similar/Makefile +++ b/selinux-policy/caddy-and-similar/Makefile @@ -61,7 +61,7 @@ $(METADATA): Makefile @echo "License: GPLv2" >> $(METADATA) @echo "Confidential: no" >> $(METADATA) @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL10" >> $(METADATA) @echo "Bug: 1706651" >> $(METADATA) # Fedora 30 @echo "Bug: 2122886" >> $(METADATA) # Fedora 36 diff --git a/selinux-policy/caddy-and-similar/main.fmf b/selinux-policy/caddy-and-similar/main.fmf index cc426ee..be06a73 100644 --- a/selinux-policy/caddy-and-similar/main.fmf +++ b/selinux-policy/caddy-and-similar/main.fmf @@ -30,7 +30,7 @@ tag: - NoRHIVOS adjust: - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, centos-stream-10, rhel-10 because: the caddy package is not available there link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1706651 diff --git a/selinux-policy/cups-pdf-and-similar/Makefile b/selinux-policy/cups-pdf-and-similar/Makefile index c5b6428..4b09310 100644 --- a/selinux-policy/cups-pdf-and-similar/Makefile +++ b/selinux-policy/cups-pdf-and-similar/Makefile @@ -62,7 +62,7 @@ $(METADATA): Makefile @echo "License: GPLv2" >> $(METADATA) @echo "Confidential: no" >> $(METADATA) @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL10" >> $(METADATA) @echo "Bug: 560220" >> $(METADATA) # Fedora 12 @echo "Bug: 563977" >> $(METADATA) # Fedora 12 @echo "Bug: 570782" >> $(METADATA) # Fedora 12 diff --git a/selinux-policy/cups-pdf-and-similar/main.fmf b/selinux-policy/cups-pdf-and-similar/main.fmf index fd859d9..f83fbee 100644 --- a/selinux-policy/cups-pdf-and-similar/main.fmf +++ b/selinux-policy/cups-pdf-and-similar/main.fmf @@ -35,7 +35,6 @@ tag: - epel - rhel8-epel - rhel9-epel - - rhel10-epel - NoRHIVOS link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=560220 @@ -50,7 +49,7 @@ link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2234765 adjust: - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-alt-7 + when: distro == rhel-4, rhel-5, rhel-6, rhel-alt-7, rhel-10, centos-stream-10 continue: false extra-nitrate: TC#0607292 extra-summary: /CoreOS/selinux-policy/Regression/cups-pdf-and-similar diff --git a/selinux-policy/ntpsec-and-similar/Makefile b/selinux-policy/ntpsec-and-similar/Makefile index e0800fe..bd21b6d 100644 --- a/selinux-policy/ntpsec-and-similar/Makefile +++ b/selinux-policy/ntpsec-and-similar/Makefile @@ -61,7 +61,7 @@ $(METADATA): Makefile @echo "License: GPLv2" >> $(METADATA) @echo "Confidential: no" >> $(METADATA) @echo "Destructive: no" >> $(METADATA) - @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8 -RHEL9" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8 -RHEL10" >> $(METADATA) @echo "Bug: 2246805" >> $(METADATA) # Fedora 38 @echo "Bug: RHEL-15085" >> $(METADATA) # RHEL-9 diff --git a/selinux-policy/ntpsec-and-similar/main.fmf b/selinux-policy/ntpsec-and-similar/main.fmf index bee3455..ba88066 100644 --- a/selinux-policy/ntpsec-and-similar/main.fmf +++ b/selinux-policy/ntpsec-and-similar/main.fmf @@ -29,7 +29,6 @@ tag: - NoRHEL8 - epel - rhel9-epel - - rhel10-epel - targeted - NoRHIVOS tier: '3' @@ -38,7 +37,7 @@ link: - verifies: https://issues.redhat.com/browse/RHEL-15085 adjust: - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8 + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8, rhel-10, centos-stream-10 because: the ntpsec package is not available there extra-summary: /CoreOS/selinux-policy/Regression/ntpsec-and-similar extra-task: /CoreOS/selinux-policy/Regression/ntpsec-and-similar From fc90e6893021dc261f901c7b5d87437aaad7b70a Mon Sep 17 00:00:00 2001 From: Zdenek Pytela Date: Tue, 8 Jul 2025 16:07:28 +0200 Subject: [PATCH 533/626] Add basic test which covers systemd-oomd --- selinux-policy/systemd-oomd/Makefile | 79 +++++++++++ selinux-policy/systemd-oomd/PURPOSE | 5 + selinux-policy/systemd-oomd/main.fmf | 39 ++++++ selinux-policy/systemd-oomd/runtest.sh | 147 ++++++++++++++++++++ selinux-policy/systemd-oomd/ssh-nosleep.exp | 20 +++ selinux-policy/systemd-oomd/ssh-sleep40.exp | 20 +++ 6 files changed, 310 insertions(+) create mode 100644 selinux-policy/systemd-oomd/Makefile create mode 100644 selinux-policy/systemd-oomd/PURPOSE create mode 100644 selinux-policy/systemd-oomd/main.fmf create mode 100755 selinux-policy/systemd-oomd/runtest.sh create mode 100755 selinux-policy/systemd-oomd/ssh-nosleep.exp create mode 100755 selinux-policy/systemd-oomd/ssh-sleep40.exp diff --git a/selinux-policy/systemd-oomd/Makefile b/selinux-policy/systemd-oomd/Makefile new file mode 100644 index 0000000..d8c2bcd --- /dev/null +++ b/selinux-policy/systemd-oomd/Makefile @@ -0,0 +1,79 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Sanity/systemd-oomd +# Description: Testing systemd-oomd service +# Author: Zdenek Pytela +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2010 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Sanity/systemd-oomd +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE ssh-sleep40.exp ssh-nosleep.exp + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Zdenek Pytela " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: Testing systemd-oomd" >> $(METADATA) + @echo "Type: Sanity" >> $(METADATA) + @echo "TestTime: 15m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "Requires: audit" >> $(METADATA) + @echo "Requires: expect" >> $(METADATA) + @echo "Requires: libselinux-utils" >> $(METADATA) + @echo "Requires: policycoreutils" >> $(METADATA) + @echo "Requires: selinux-policy" >> $(METADATA) + @echo "Requires: selinux-policy-targeted" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Environment: SYSTEMD_PAGER=\"\"" >> $(METADATA) + @echo "Releases: -RHEL4" >> $(METADATA) + @echo "Releases: -RHEL5" >> $(METADATA) + @echo "Releases: -RHEL6" >> $(METADATA) + @echo "Releases: -RHEL7" >> $(METADATA) + @echo "Releases: -RHEL8" >> $(METADATA) + @echo "Releases: -RHEL9" >> $(METADATA) + @echo "Releases: -RHEL10" >> $(METADATA) + + rhts-lint $(METADATA) + diff --git a/selinux-policy/systemd-oomd/PURPOSE b/selinux-policy/systemd-oomd/PURPOSE new file mode 100644 index 0000000..90bc7a4 --- /dev/null +++ b/selinux-policy/systemd-oomd/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Sanity/systemd-oomd +Author: Zdenek Pytela + +Test systemd-oomd service + diff --git a/selinux-policy/systemd-oomd/main.fmf b/selinux-policy/systemd-oomd/main.fmf new file mode 100644 index 0000000..cd29105 --- /dev/null +++ b/selinux-policy/systemd-oomd/main.fmf @@ -0,0 +1,39 @@ +summary: systemd-oomd - userspace out-of-memory (OOM) killer +description: |+ + Testing systemd-oomd service + +contact: Zdenek Pytela +component: + - selinux-policy + - systemd +test: ./runtest.sh +framework: beakerlib +require: + - library(selinux-policy/common) +recommend: + - audit + - expect + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console +environment: + AVC_ERROR: +no_avc_check +duration: 5m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - NoRHEL8 + - NoRHEL9 + - NoRHEL10 + - TierCandidatesPASS + - targeted + - NoRHIVOS +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, rhel-9, rhel-10 + continue: false diff --git a/selinux-policy/systemd-oomd/runtest.sh b/selinux-policy/systemd-oomd/runtest.sh new file mode 100755 index 0000000..1534656 --- /dev/null +++ b/selinux-policy/systemd-oomd/runtest.sh @@ -0,0 +1,147 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Sanity/systemd-oomd +# Description: Testing systemd-oomd service +# Author: Zdenek Pytela +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2010 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include rhts environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +SERVICE_NAME="systemd-oomd" +FILE_PATH="/usr/lib/systemd/systemd-oomd" +FILE_CONTEXT="systemd_oomd_exec_t" +PROCESS_NAME="systemd-oomd" +PROCESS_CONTEXT="systemd_oomd_t" + +### systemd-oomd is a system service that uses cgroups-v2 and pressure stall +### information (PSI) to monitor and take a corrective action before an OOM occurs +### in the kernel space. +### Monitoring and actions on units can be enabled by setting ManagedOOMSwap= +### and ManagedOOMMemoryPressure=. Cgroups of units with ManagedOOMSwap= or +### ManagedOOMMemoryPressure= set to kill will be monitored. + +rlJournalStart + if [ ! -x ${FILE_PATH} ]; then + rlLog "Not applicable to this OS version." + rlJournalEnd + exit 0 + fi + + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlSEConfigureSSH + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + rlRun "cat /etc/system-release" + rlRun "uname -a" + rlRun "rpm -qa \"selinux-*\" \"systemd*\"|sort" + rlPhaseEnd + + rlPhaseStartTest "SELinux contexts and rules" + # Is the service SELinux confined? + CONTEXT=$(stat -c"%C" "${FILE_PATH}") + if [[ ${CONTEXT} =~ ":init_exec_t:" ]] ; then + rlLog "The ${SERVICE_NAME} service is not SELinux confined." + else + rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" + rlSEMatchPathCon "/proc/pressure" "proc_psi_t" + rlSESearchRule "allow systemd_oomd_t proc_psi_t : file { getattr ioctl lock open read } [ ]" + rlSESearchRule "allow systemd_oomd_t domain : dir { getattr ioctl lock open read search } [ ]" + rlSESearchRule "allow systemd_oomd_t domain : file { getattr ioctl lock open read } [ ]" + rlSESearchRule "allow systemd_oomd_t cgroup_t : dir { getattr ioctl lock open read search setattr write } [ ]" + rlSESearchRule "allow systemd_oomd_t domain : process { sigkill } [ ]" + rlSESearchRule "allow systemd_oomd_t self : capability { kill } [ ]" + fi + rlPhaseEnd + + ### Basic systemd-oomd setup + ### https://fedoraproject.org/wiki/Changes/EnableSystemdOomd#How_to_test + rlPhaseStartTest "Real scenario" + + # sd-oomd conflicts earlyoom + if systemctl list-unit-files earlyoom.service &>/dev/null; then + rlRun "systemctl disable --now --quiet earlyoom.service" + fi + rlRun "systemctl enable --now ${SERVICE_NAME}" + rlRun "systemctl status ${SERVICE_NAME}" + + # enable swap-based killing on all units in the root slice + cat >> /etc/systemd/system/-.slice.d/override.conf << EOF +[Slice] +ManagedOOMSwap=kill +EOF + + # memory pressure example settings + cat >> /etc/systemd/system/user@.service.d/override.conf << EOF +[Service] +ManagedOOMMemoryPressure=kill +ManagedOOMMemoryPressureLimit=10% +EOF + + rlRun "systemctl daemon-reload" + rlRun "systemctl restart ${SERVICE_NAME}" + rlRun "systemctl status ${SERVICE_NAME}" + + # create a user and run a stress test - it can hang the system for a while + USER_NAME="user${RANDOM}" + USER_SECRET="S3kr3T${RANDOM}" + rlRun "useradd -G systemd-journal ${USER_NAME}" + rlRun "echo ${USER_SECRET} | passwd --stdin ${USER_NAME}" + + USER_ID=$(id -u ${USER_NAME}) + SYSTEM_SERVICE_NAME="user@${USER_ID}.service" + USER_SERVICE_NAME="useroomcheck-${RANDOM}.service" + rlRun "./ssh-sleep40.exp ${USER_NAME} ${USER_SECRET} localhost systemd-run --user -u ${USER_SERVICE_NAME} tail /dev/zero" + + rlLog "Checking journal for the oom killer string" + rlRun "./ssh-nosleep.exp ${USER_NAME} ${USER_SECRET} localhost journalctl -u ${USER_SERVICE_NAME} -g \"A process of this unit has been killed by the OOM killer\"" + rlRun "./ssh-nosleep.exp ${USER_NAME} ${USER_SECRET} localhost journalctl --user -u ${USER_SERVICE_NAME} -g \"A process of this unit has been killed by the OOM killer\"" + + rlRun "systemctl status ${SERVICE_NAME}" + if [ "${DEBUG}" = "yes" ]; then + rlLog "Displaying list of monitored cgroups and pressure information" + rlRun "oomctl dump" + rlLog "Displaying journal content for the system ${SYSTEM_SERVICE_NAME} service" + rlRun "journalctl -u ${SYSTEM_SERVICE_NAME}" + rlLog "Displaying journal content for the user ${USER_SERVICE_NAME} service" + rlRun "./ssh-nosleep.exp ${USER_NAME} ${USER_SECRET} localhost journalctl --user -u ${USER_SERVICE_NAME}" + fi + rlPhaseEnd + + ### cleanup, restoring the previous content + rlPhaseStartCleanup + rlRun "userdel -rf ${USER_NAME}" + rm -f /etc/systemd/system/-.slice.d/override.conf + rm -f /etc/systemd/system/user@.service.d/override.conf + rlRun "systemctl daemon-reload" + rlSECheckAVC + rlPhaseEnd + rlJournalPrintText +rlJournalEnd diff --git a/selinux-policy/systemd-oomd/ssh-nosleep.exp b/selinux-policy/systemd-oomd/ssh-nosleep.exp new file mode 100755 index 0000000..33e5d4f --- /dev/null +++ b/selinux-policy/systemd-oomd/ssh-nosleep.exp @@ -0,0 +1,20 @@ +#!/usr/bin/expect -f +# Expect script for SSH logging as $username to $hostname using $password and executing $command. +# Usage: +# ./ssh.exp username password hostname command +set username [lrange $argv 0 0] +set password [lrange $argv 1 1] +set hostname [lrange $argv 2 2] +set command [lrange $argv 3 10] +set timeout 30 +# connect to remote host and execute given command +log_user 1 +spawn ssh -t $username@$hostname "$command" +expect { + -nocase "yes/no" { send -- "yes\r" ; exp_continue } + -nocase "password" { send -- "$password\r" } +} +log_user 1 +# send -- "\r" +expect eof + diff --git a/selinux-policy/systemd-oomd/ssh-sleep40.exp b/selinux-policy/systemd-oomd/ssh-sleep40.exp new file mode 100755 index 0000000..69563d6 --- /dev/null +++ b/selinux-policy/systemd-oomd/ssh-sleep40.exp @@ -0,0 +1,20 @@ +#!/usr/bin/expect -f +# Expect script for SSH logging as $username to $hostname using $password and executing $command. +# Usage: +# ./ssh.exp username password hostname command +set username [lrange $argv 0 0] +set password [lrange $argv 1 1] +set hostname [lrange $argv 2 2] +set command [lrange $argv 3 10] +set timeout 30 +# connect to remote host and execute given command +log_user 1 +spawn ssh -t $username@$hostname "$command ; sleep 40" +expect { + -nocase "yes/no" { send -- "yes\r" ; exp_continue } + -nocase "password" { send -- "$password\r" } +} +log_user 1 +# send -- "\r" +expect eof + From c857e84cc919645408e9092fd398759561e08d50 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 8 Jul 2025 09:00:24 +0200 Subject: [PATCH 534/626] test if mdevctl (virtnodedevd_t) can create dirs under /etc/mdevctl.d/ A recent libvirt testing of mediated devices revealed that SELinux prevents the mdevctl process (executed by the virtnodedevd service) from creating directories under /etc/mdevctl.d/. The TC reproduces the situation. In order to enable the expected mdevctl behavior, I believe that SELinux policy should allow this action. The TC looks for appropriate policy rules and file context patterns. The TC covers RHEL-98559. test if virtqemud can reset PCI devices Recently, an experimental libvirt + selinux-policy testing that SELinux prevents the rpc-virtqemud process from writing (syscall = openat) into /sys/bus/pci/devices/0000:00:00.0/config file. The TC reproduces the situation. In order to support the nodedev-reset function and to avoid unnecessary SELinux denials, I believe that SELinux policy should allow this action. The TC looks for appropriate policy rules and file context patterns. The TC covers RHEL-101417. --- .../virt-install-additional/Makefile | 2 ++ .../virt-install-additional/main.fmf | 2 ++ .../virt-install-additional/nodedev.xml | 7 ++++ .../virt-install-additional/runtest.sh | 35 +++++++++++++++++++ 4 files changed, 46 insertions(+) create mode 100644 selinux-policy/virt-install-additional/nodedev.xml diff --git a/selinux-policy/virt-install-additional/Makefile b/selinux-policy/virt-install-additional/Makefile index 0f7eedd..20b3ae0 100644 --- a/selinux-policy/virt-install-additional/Makefile +++ b/selinux-policy/virt-install-additional/Makefile @@ -74,6 +74,8 @@ $(METADATA): Makefile @echo "Bug: RHEL-69920" >> $(METADATA) # RHEL-10 @echo "Bug: RHEL-74230" >> $(METADATA) # RHEL-10 @echo "Bug: RHEL-76104" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-98559" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-101417" >> $(METADATA) # RHEL-10 rhts-lint $(METADATA) diff --git a/selinux-policy/virt-install-additional/main.fmf b/selinux-policy/virt-install-additional/main.fmf index 06da58a..7cf0d61 100644 --- a/selinux-policy/virt-install-additional/main.fmf +++ b/selinux-policy/virt-install-additional/main.fmf @@ -49,6 +49,8 @@ link: - verifies: https://issues.redhat.com/browse/RHEL-69920 - verifies: https://issues.redhat.com/browse/RHEL-74230 - verifies: https://issues.redhat.com/browse/RHEL-76104 + - verifies: https://issues.redhat.com/browse/RHEL-98559 + - verifies: https://issues.redhat.com/browse/RHEL-101417 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 diff --git a/selinux-policy/virt-install-additional/nodedev.xml b/selinux-policy/virt-install-additional/nodedev.xml new file mode 100644 index 0000000..7dcb0df --- /dev/null +++ b/selinux-policy/virt-install-additional/nodedev.xml @@ -0,0 +1,7 @@ + +PLACEHOLDER + + +8d312cf6-f92a-485c-8db8-ba9299848f46 + + diff --git a/selinux-policy/virt-install-additional/runtest.sh b/selinux-policy/virt-install-additional/runtest.sh index b05be78..313e7a4 100755 --- a/selinux-policy/virt-install-additional/runtest.sh +++ b/selinux-policy/virt-install-additional/runtest.sh @@ -332,6 +332,41 @@ rlJournalStart fi rlPhaseEnd + rlPhaseStartTest "RHEL-98559" + if rlSEDefined "virtnodedevd_t mdevctl_conf_t" ; then + rlSEMatchPathCon "/etc/mdevctl.d" "mdevctl_conf_t" + rlSESearchRule "allow virtnodedevd_t mdevctl_conf_t : dir { create } [ ]" + fi + rlRun "service virtqemud start" + rlRun "service virtnodedevd start" + rlRun "virsh nodedev-list | grep pci" + LAST_PCI_DEVICE=`virsh nodedev-list | grep pci | tail -n 1` + rlRun "sed -i \"s/PLACEHOLDER/${LAST_PCI_DEVICE}/\" nodedev.xml" + rlRun "cat nodedev.xml" + rlRun "virsh nodedev-define ./nodedev.xml" + sleep 1 + rlRun "service virtnodedevd stop" + rlRun "service virtqemud stop" + rlPhaseEnd + + rlPhaseStartTest "RHEL-101417" + if [ -d /sys/bus/pci/devices ] ; then + rlRun "find /sys/bus/pci/devices -type f -name config -ls" + fi + if seinfo -a | grep -q virt_driver_domain ; then + rlSESearchRule "allow virtqemud_t sysfs_t : file { write } [ ]" + fi + rlRun "service virtqemud start" + rlRun "service virtnodedevd start" + rlRun "virsh nodedev-list | grep pci" + for I in `virsh nodedev-list | grep pci` ; do + rlRun "virsh nodedev-reset $I" 0,1 + sleep 1 + done + rlRun "service virtnodedevd stop" + rlRun "service virtqemud stop" + rlPhaseEnd + rlPhaseStartCleanup sleep 2 rlSECheckAVC From 0c58cf0a60ccf1d15493dc5d853206fd3a4411a3 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Thu, 24 Jul 2025 17:01:03 +0200 Subject: [PATCH 535/626] kernel: make flamegraph generation opt-in To avoid running code from untrusted repositories, make the generation of flamegraphs optional (via a test parameter) and disabled by default. The test parameter should only be set to 1 as needed when running the test manually and kept disabled in automated test runs. Signed-off-by: Ondrej Mosnacek --- kernel/journald_performance/runtest.sh | 19 ++++++++++++++----- kernel/synflood/runtest.sh | 15 ++++++++++++--- 2 files changed, 26 insertions(+), 8 deletions(-) diff --git a/kernel/journald_performance/runtest.sh b/kernel/journald_performance/runtest.sh index bb960db..a207d54 100755 --- a/kernel/journald_performance/runtest.sh +++ b/kernel/journald_performance/runtest.sh @@ -7,6 +7,9 @@ # Include Beakerlib environment . /usr/share/beakerlib/beakerlib.sh || exit 1 +# Set this parameter to 1 to also generate a flamegraph. +GENERATE_FLAMEGRAPH="${GENERATE_FLAMEGRAPH:-0}" + FG_URL="https://github.com/brendangregg/FlameGraph" FG_DIR="FlameGraph" @@ -17,7 +20,9 @@ rlJournalStart rlPhaseStartSetup rlRun "uname -r" 0 "Print running kernel version" - rlRun "git clone $FG_URL $FG_DIR" + if [ "$GENERATE_FLAMEGRAPH" != 0 ]; then + rlRun "git clone $FG_URL $FG_DIR" + fi rlPhaseEnd rlPhaseStartTest @@ -30,7 +35,9 @@ rlJournalStart "Capture perf data on systemd-journald" rlRun "kill %1" - rlRun "perf script -i perf.data | $FG_DIR/stackcollapse-perf.pl | $FG_DIR/flamegraph.pl > flamegraph.svg" + if [ "$GENERATE_FLAMEGRAPH" != 0 ]; then + rlRun "perf script -i perf.data | $FG_DIR/stackcollapse-perf.pl | $FG_DIR/flamegraph.pl > flamegraph.svg" + fi rlRun "perf report -i perf.data -g none --pretty raw | grep $TARGET_SYMBOL" PERCENT="$(perf report -g none --pretty raw | grep $TARGET_SYMBOL | \ @@ -42,10 +49,12 @@ rlJournalStart rlPhaseStartCleanup rlFileSubmit "perf.data" - rlFileSubmit "flamegraph.svg" + if [ "$GENERATE_FLAMEGRAPH" != 0 ]; then + rlFileSubmit "flamegraph.svg" - rlRun "rm -rf $FG_DIR" - rlRun "rm -f perf.data flamegraph.svg" + rlRun "rm -rf $FG_DIR flamegraph.svg" + fi + rlRun "rm -f perf.data" rlPhaseEnd rlJournalPrintText rlJournalEnd diff --git a/kernel/synflood/runtest.sh b/kernel/synflood/runtest.sh index aaaf8ab..7a4327c 100755 --- a/kernel/synflood/runtest.sh +++ b/kernel/synflood/runtest.sh @@ -7,6 +7,9 @@ # Include Beakerlib environment . /usr/share/beakerlib/beakerlib.sh || exit 1 +# Set this parameter to 1 to also generate a flamegraph. +GENERATE_FLAMEGRAPH="${GENERATE_FLAMEGRAPH:-0}" + TEST_PORT=8080 FG_URL="https://github.com/brendangregg/FlameGraph" @@ -32,7 +35,9 @@ else rlRun "uname -r" - rlRun "git clone $FG_URL $FG_DIR" + if [ "$GENERATE_FLAMEGRAPH" != 0 ]; then + rlRun "git clone $FG_URL $FG_DIR" + fi rlPhaseEnd rlPhaseStartTest @@ -64,10 +69,14 @@ else rlPhaseEnd rlPhaseStartCleanup - rlRun "perf script -i perf.data | $FG_DIR/stackcollapse-perf.pl | $FG_DIR/flamegraph.pl > flamegraph.svg" + if [ "$GENERATE_FLAMEGRAPH" != 0 ]; then + rlRun "perf script -i perf.data | $FG_DIR/stackcollapse-perf.pl | $FG_DIR/flamegraph.pl > flamegraph.svg" + rlFileSubmit "flamegraph.svg" + rlRun "rm -f flamegraph.svg" + fi rlRun "xz -T0 perf.data" - for file in "perf.data.xz" "flamegraph.svg" "perf-report.txt"; do + for file in "perf.data.xz" "perf-report.txt"; do rlFileSubmit "$file" rlRun "rm -f $file" done From 7093be1ae3eb295ea60e6c3f72fb66bc32bcb423 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Mon, 7 Jul 2025 17:13:49 +0200 Subject: [PATCH 536/626] test if power-profiles-daemon can switch between profiles A recently reported bug revealed that SELinux prevents the power-profiles-daemon processes from writing to the following file: * /sys/devices/system/cpu/cpufreq/policy6/energy_performance_preference The TC does not reproduce the situation usually. In order to support the intentional behavior of the daemon when power cable gets unplugged/plugged, I believe that SELinux policy should allow the action. The TC looks for appropriate policy rules and file context patterns. The TC covers RHEL-100718. --- .../Makefile | 1 + .../main.fmf | 1 + .../runtest.sh | 20 ++++++++++++++++++- 3 files changed, 21 insertions(+), 1 deletion(-) diff --git a/selinux-policy/power-profiles-daemon-and-similar/Makefile b/selinux-policy/power-profiles-daemon-and-similar/Makefile index afd0a0a..e69ab07 100644 --- a/selinux-policy/power-profiles-daemon-and-similar/Makefile +++ b/selinux-policy/power-profiles-daemon-and-similar/Makefile @@ -65,6 +65,7 @@ $(METADATA): Makefile @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA) @echo "Bug: RHEL-61117" >> $(METADATA) # RHEL-9 @echo "Bug: RHEL-62356" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-100718" >> $(METADATA) # RHEL-9 rhts-lint $(METADATA) diff --git a/selinux-policy/power-profiles-daemon-and-similar/main.fmf b/selinux-policy/power-profiles-daemon-and-similar/main.fmf index f46c363..bb99a94 100644 --- a/selinux-policy/power-profiles-daemon-and-similar/main.fmf +++ b/selinux-policy/power-profiles-daemon-and-similar/main.fmf @@ -33,6 +33,7 @@ tag: link: - verifies: https://issues.redhat.com/browse/RHEL-61117 - verifies: https://issues.redhat.com/browse/RHEL-62356 + - verifies: https://issues.redhat.com/browse/RHEL-100718 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, rhel-10, centos-stream-10 diff --git a/selinux-policy/power-profiles-daemon-and-similar/runtest.sh b/selinux-policy/power-profiles-daemon-and-similar/runtest.sh index fef6400..d2bd088 100755 --- a/selinux-policy/power-profiles-daemon-and-similar/runtest.sh +++ b/selinux-policy/power-profiles-daemon-and-similar/runtest.sh @@ -74,6 +74,16 @@ rlJournalStart rlPhaseEnd fi + rlPhaseStartTest "RHEL-100718" + if [ -d /sys/devices/system/cpu/cpufreq ] ; then + for CUR_FILE in `find /sys/devices/system/cpu/cpufreq -type f -name energy_performance_preference` ; do + CUR_TYPE=`secon --type --file ${CUR_FILE}` + rlSESearchRule "allow powerprofiles_t $CUR_TYPE : file { write } [ ]" + done + fi + rlSESearchRule "allow powerprofiles_t fs_t : filesystem { getattr } [ ]" + rlPhaseEnd + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 @@ -82,8 +92,16 @@ rlJournalStart rlRun "powerprofilesctl version" rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status" 1 + ORIG_PROFILE=`powerprofilesctl get` + if echo ${ORIG_PROFILE} | grep -q balanced ; then + rlRun "powerprofilesctl set power-saver" 0,1 + else + rlRun "powerprofilesctl set balanced" 0,1 + fi + sleep 2 rlRun "powerprofilesctl get" - rlRun "powerprofilesctl set balanced" 0,1 + rlRun "powerprofilesctl set ${ORIG_PROFILE}" + sleep 2 rlRun "powerprofilesctl launch echo" 0,1 rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "stop status" 1 rlPhaseEnd From b663bc4abf8bfe2467a1a1c7cce29e96834d89c1 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 8 Jul 2025 12:27:10 +0200 Subject: [PATCH 537/626] test if tuned-ppd can watch certain dirs under /sys Several recent bug reports revealed that SELinux prevents the tuned-ppd processes from using the inotify_add_watch syscall on the following directories: * /sys/devices/system/cpu/intel_pstate (permission: watch) * /sys/firmware/acpi (permission: watch_reads) In order to support the expected tuned-ppd behavior, I believe that SELinux policy should allow these actions. The TC looks for appropriate policy rules and file context patterns. The TC covers RHEL-101686, RHEL-101687, BZ#2358952 and their duplicates. --- selinux-policy/tuned-ppd-and-similar/Makefile | 5 +++++ selinux-policy/tuned-ppd-and-similar/main.fmf | 5 +++++ selinux-policy/tuned-ppd-and-similar/runtest.sh | 12 ++++++++++++ 3 files changed, 22 insertions(+) diff --git a/selinux-policy/tuned-ppd-and-similar/Makefile b/selinux-policy/tuned-ppd-and-similar/Makefile index 5aa5106..3fabb16 100644 --- a/selinux-policy/tuned-ppd-and-similar/Makefile +++ b/selinux-policy/tuned-ppd-and-similar/Makefile @@ -65,11 +65,16 @@ $(METADATA): Makefile @echo "Bug: RHEL-69450" >> $(METADATA) # RHEL-10 @echo "Bug: RHEL-69526" >> $(METADATA) # RHEL-9 @echo "Bug: RHEL-85849" >> $(METADATA) # RHEL-10 + @echo "Bug: 2358952" >> $(METADATA) # Fedora 42 + @echo "Bug: 2359047" >> $(METADATA) # Fedora 42 @echo "Bug: 2359851" >> $(METADATA) # Fedora 42 @echo "Bug: 2360026" >> $(METADATA) # Fedora 42 + @echo "Bug: 2360121" >> $(METADATA) # Fedora 41 @echo "Bug: 2361423" >> $(METADATA) # Fedora 42 @echo "Bug: 2367076" >> $(METADATA) # Fedora 41 @echo "Bug: 2367711" >> $(METADATA) # Fedora 42 + @echo "Bug: RHEL-101686" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-101687" >> $(METADATA) # RHEL-9 rhts-lint $(METADATA) diff --git a/selinux-policy/tuned-ppd-and-similar/main.fmf b/selinux-policy/tuned-ppd-and-similar/main.fmf index e02c525..48fc7ba 100644 --- a/selinux-policy/tuned-ppd-and-similar/main.fmf +++ b/selinux-policy/tuned-ppd-and-similar/main.fmf @@ -32,11 +32,16 @@ link: - verifies: https://issues.redhat.com/browse/RHEL-69450 - verifies: https://issues.redhat.com/browse/RHEL-69526 - verifies: https://issues.redhat.com/browse/RHEL-85849 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2358952 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2359047 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2359851 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2360026 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2360121 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2361423 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2367076 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2367711 + - verifies: https://issues.redhat.com/browse/RHEL-101686 + - verifies: https://issues.redhat.com/browse/RHEL-101687 adjust: - enabled: false when: distro < rhel-9.5 diff --git a/selinux-policy/tuned-ppd-and-similar/runtest.sh b/selinux-policy/tuned-ppd-and-similar/runtest.sh index 0bc5804..cde5383 100755 --- a/selinux-policy/tuned-ppd-and-similar/runtest.sh +++ b/selinux-policy/tuned-ppd-and-similar/runtest.sh @@ -100,6 +100,18 @@ rlJournalStart rlPhaseEnd fi + if rlSEDefined "tuned_ppd_t" ; then + rlPhaseStartTest "RHEL-101686 + RHEL-101687" + rlSEMatchPathCon "/sys/devices/system/cpu/intel_pstate" "sysfs_t" + rlSESearchRule "allow tuned_ppd_t sysfs_t : dir { watch } [ ]" + rlPhaseEnd + + rlPhaseStartTest "bz#2358952 + bz#2359047 + bz#2360121" + rlSEMatchPathCon "/sys/firmware/acpi" "sysfs_t" + rlSESearchRule "allow tuned_ppd_t sysfs_t : dir { watch_reads } [ ]" + rlPhaseEnd + fi + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" if [ -f /usr/lib/systemd/system/gdm.service ] ; then From 9948e7bcf02e2a3175b0a6329b90824243d56f9f Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Thu, 24 Jul 2025 14:03:02 +0200 Subject: [PATCH 538/626] libsemanage/verify-options-in-semanage-conf: Extend error messages Userspace 3.9 changes the error message to "OSError: No data available". Signed-off-by: Vit Mojzis --- libsemanage/verify-options-in-semanage-conf/runtest.sh | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/libsemanage/verify-options-in-semanage-conf/runtest.sh b/libsemanage/verify-options-in-semanage-conf/runtest.sh index d17ed44..c295509 100755 --- a/libsemanage/verify-options-in-semanage-conf/runtest.sh +++ b/libsemanage/verify-options-in-semanage-conf/runtest.sh @@ -61,7 +61,7 @@ rlJournalStart rlAssertNotGrep "semodule.*failed" ${OUTPUT_FILE} -i rlRun "semodule -l | grep ${MODULE_NAME}" rlRun "semanage module -a ${MODULE_NAME}.pp 2>&1 | tee ${OUTPUT_FILE}" - rlAssertNotGrep "could not commit semanage transaction|no such file or directory" ${OUTPUT_FILE} -Ei + rlAssertNotGrep "could not commit semanage transaction|no such file or directory|No data available" ${OUTPUT_FILE} -Ei rlRun "semanage module -l | grep ${MODULE_NAME}" rlPhaseEnd @@ -73,7 +73,7 @@ rlJournalStart rlAssertNotGrep "semodule.*failed" ${OUTPUT_FILE} -i rlRun "semodule -l | grep ${MODULE_NAME}" rlRun "semanage module -a ${MODULE_NAME}.pp 2>&1 | tee ${OUTPUT_FILE}" - rlAssertNotGrep "could not commit semanage transaction|no such file or directory" ${OUTPUT_FILE} -Ei + rlAssertNotGrep "could not commit semanage transaction|no such file or directory|No data available" ${OUTPUT_FILE} -Ei rlRun "semanage module -l | grep ${MODULE_NAME}" rlPhaseEnd @@ -102,7 +102,7 @@ rlJournalStart rlAssertGrep "semodule.*failed" ${OUTPUT_FILE} -i rlRun "semodule -l | grep ${MODULE_NAME}" 1 rlRun "semanage module -a ${MODULE_NAME}.pp 2>&1 | tee ${OUTPUT_FILE}" - rlAssertGrep "could not commit semanage transaction|no such file or directory" ${OUTPUT_FILE} -Ei + rlAssertGrep "could not commit semanage transaction|no such file or directory|No data available" ${OUTPUT_FILE} -Ei rlRun "semanage module -l | grep ${MODULE_NAME}" 1 rlPhaseEnd @@ -114,7 +114,7 @@ rlJournalStart rlAssertGrep "semodule.*failed" ${OUTPUT_FILE} -i rlRun "semodule -l | grep ${MODULE_NAME}" 1 rlRun "semanage module -a ${MODULE_NAME}.pp 2>&1 | tee ${OUTPUT_FILE}" - rlAssertGrep "could not commit semanage transaction|no such file or directory" ${OUTPUT_FILE} -Ei + rlAssertGrep "could not commit semanage transaction|no such file or directory|No data available" ${OUTPUT_FILE} -Ei rlRun "semanage module -l | grep ${MODULE_NAME}" 1 rlPhaseEnd From bd01c13f8cf93774efea22c5aa58f069331c4fb8 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Mon, 28 Jul 2025 09:06:36 +0200 Subject: [PATCH 539/626] test if recent systemd generators issues are fixed Recent selinux-policy testing revealed that policies for various systemd generators are not complete. For example: * SELinux prevented the vsftpd-generator program from executing commands like mkdir, ls, ln, gawk etc. * SELinux prevented systemd-cryptsetup-generator from creating files like /run/systemd/generator/systemd-cryptsetup@luks*.service In order to support the functionality of various systemd generators, I believe that SELinux policy allow the actions mentioned above. The TC looks for appropriate policy rules and file context patterns. The TC covers RHEL-98656, RHEL-100415 and RHEL-100721. --- selinux-policy/systemd-generators/Makefile | 3 +++ selinux-policy/systemd-generators/main.fmf | 3 +++ selinux-policy/systemd-generators/runtest.sh | 10 ++++++++++ 3 files changed, 16 insertions(+) diff --git a/selinux-policy/systemd-generators/Makefile b/selinux-policy/systemd-generators/Makefile index 9dbed8f..aab82d9 100644 --- a/selinux-policy/systemd-generators/Makefile +++ b/selinux-policy/systemd-generators/Makefile @@ -75,6 +75,9 @@ $(METADATA): Makefile @echo "Bug: 2230226" >> $(METADATA) # Fedora 39 @echo "Bug: RHEL-72549" >> $(METADATA) # RHEL-10 @echo "Bug: RHEL-75879" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-98656" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-100415" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-100721" >> $(METADATA) # RHEL-10 rhts-lint $(METADATA) diff --git a/selinux-policy/systemd-generators/main.fmf b/selinux-policy/systemd-generators/main.fmf index 93b9231..ee5326b 100644 --- a/selinux-policy/systemd-generators/main.fmf +++ b/selinux-policy/systemd-generators/main.fmf @@ -35,6 +35,9 @@ link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2230226 - verifies: https://issues.redhat.com/browse/RHEL-72549 - verifies: https://issues.redhat.com/browse/RHEL-75879 + - verifies: https://issues.redhat.com/browse/RHEL-98656 + - verifies: https://issues.redhat.com/browse/RHEL-100415 + - verifies: https://issues.redhat.com/browse/RHEL-100721 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 diff --git a/selinux-policy/systemd-generators/runtest.sh b/selinux-policy/systemd-generators/runtest.sh index 1cd2a13..1024c7b 100755 --- a/selinux-policy/systemd-generators/runtest.sh +++ b/selinux-policy/systemd-generators/runtest.sh @@ -213,6 +213,16 @@ EOF rlRun "seinfo -a systemd_generator -x" rlSESearchRule "allow systemd_fstab_generator_t syslogd_t : unix_dgram_socket { sendto } [ ]" rlPhaseEnd + + rlPhaseStartTest "RHEL-98656" + rlSEMatchPathCon "/usr/lib/systemd/system-generators/systemd-cryptsetup-generator" "systemd_cryptsetup_generator_exec_t" + rlSESearchRule "allow systemd_cryptsetup_generator_t systemd_unit_file_t : file { getattr create open write } [ ]" + rlPhaseEnd + + rlPhaseStartTest "RHEL-100415 + RHEL-100721" + rlSEMatchPathCon "/usr/lib/systemd/system-generators/vsftpd-generator" "systemd_vsftpd_generator_exec_t" + rlSESearchRule "allow systemd_vsftpd_generator_t bin_t : file { execute execute_no_trans map } [ ]" + rlPhaseEnd fi ### generators from other packages: install them all? From bbaec0906ee230e8b8ad4d01079e0dcde0f84a3f Mon Sep 17 00:00:00 2001 From: Zdenek Pytela Date: Mon, 11 Aug 2025 13:37:54 +0200 Subject: [PATCH 540/626] Update systemd-oomd test Do not check the type of /proc/pressure with matchpathcon because the type is assigned using genfscon which is not recognised by userspace tools. Ensure that the /etc/systemd/system/-.slice.d and /etc/systemd/system/user@.service.d directories exist before creating files in them. --- selinux-policy/systemd-oomd/runtest.sh | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/selinux-policy/systemd-oomd/runtest.sh b/selinux-policy/systemd-oomd/runtest.sh index 1534656..6ab389b 100755 --- a/selinux-policy/systemd-oomd/runtest.sh +++ b/selinux-policy/systemd-oomd/runtest.sh @@ -71,7 +71,6 @@ rlJournalStart rlLog "The ${SERVICE_NAME} service is not SELinux confined." else rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}" - rlSEMatchPathCon "/proc/pressure" "proc_psi_t" rlSESearchRule "allow systemd_oomd_t proc_psi_t : file { getattr ioctl lock open read } [ ]" rlSESearchRule "allow systemd_oomd_t domain : dir { getattr ioctl lock open read search } [ ]" rlSESearchRule "allow systemd_oomd_t domain : file { getattr ioctl lock open read } [ ]" @@ -93,12 +92,14 @@ rlJournalStart rlRun "systemctl status ${SERVICE_NAME}" # enable swap-based killing on all units in the root slice + mkdir -p /etc/systemd/system/-.slice.d cat >> /etc/systemd/system/-.slice.d/override.conf << EOF [Slice] ManagedOOMSwap=kill EOF # memory pressure example settings + mkdir -p /etc/systemd/system/user@.service.d cat >> /etc/systemd/system/user@.service.d/override.conf << EOF [Service] ManagedOOMMemoryPressure=kill From 16ec518546238a8944df393c3fc03ebfb48adc7f Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Wed, 13 Aug 2025 10:37:59 +0200 Subject: [PATCH 541/626] add new test which covers the valkey* services The valkey component is a replacement for the redis component. The automated test covers basic functions of the valkey* services. The TC covers RHEL-102631. --- selinux-policy/valkey-and-similar/Makefile | 70 +++++++++++++ selinux-policy/valkey-and-similar/PURPOSE | 5 + selinux-policy/valkey-and-similar/main.fmf | 37 +++++++ selinux-policy/valkey-and-similar/runtest.sh | 103 +++++++++++++++++++ 4 files changed, 215 insertions(+) create mode 100644 selinux-policy/valkey-and-similar/Makefile create mode 100644 selinux-policy/valkey-and-similar/PURPOSE create mode 100644 selinux-policy/valkey-and-similar/main.fmf create mode 100755 selinux-policy/valkey-and-similar/runtest.sh diff --git a/selinux-policy/valkey-and-similar/Makefile b/selinux-policy/valkey-and-similar/Makefile new file mode 100644 index 0000000..2e576bf --- /dev/null +++ b/selinux-policy/valkey-and-similar/Makefile @@ -0,0 +1,70 @@ +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Makefile of /CoreOS/selinux-policy/Regression/valkey-and-similar +# Description: SELinux interferes with valkey and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2025 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +export TEST=/CoreOS/selinux-policy/Regression/valkey-and-similar +export TESTVERSION=1.0 + +BUILT_FILES= + +FILES=$(METADATA) runtest.sh Makefile PURPOSE + +.PHONY: all install download clean + +run: $(FILES) build + ./runtest.sh + +build: $(BUILT_FILES) + chmod a+x runtest.sh + chcon -t bin_t runtest.sh + +clean: + rm -f *~ $(BUILT_FILES) + +include /usr/share/rhts/lib/rhts-make.include + +$(METADATA): Makefile + @echo "Owner: Milos Malik " > $(METADATA) + @echo "Name: $(TEST)" >> $(METADATA) + @echo "TestVersion: $(TESTVERSION)" >> $(METADATA) + @echo "Path: $(TEST_DIR)" >> $(METADATA) + @echo "Description: SELinux interferes with valkey and related programs" >> $(METADATA) + @echo "Type: Regression" >> $(METADATA) + @echo "TestTime: 10m" >> $(METADATA) + @echo "RunFor: selinux-policy" >> $(METADATA) + @echo "RunFor: valkey" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console valkey /usr/sbin/service" >> $(METADATA) + @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) + @echo "Priority: Normal" >> $(METADATA) + @echo "License: GPLv2" >> $(METADATA) + @echo "Confidential: no" >> $(METADATA) + @echo "Destructive: no" >> $(METADATA) + @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) + @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA) + @echo "Bug: RHEL-102631" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-108982" >> $(METADATA) # RHEL-9 + + rhts-lint $(METADATA) + diff --git a/selinux-policy/valkey-and-similar/PURPOSE b/selinux-policy/valkey-and-similar/PURPOSE new file mode 100644 index 0000000..e131f98 --- /dev/null +++ b/selinux-policy/valkey-and-similar/PURPOSE @@ -0,0 +1,5 @@ +PURPOSE of /CoreOS/selinux-policy/Regression/valkey-and-similar +Author: Milos Malik + +SELinux interferes with valkey-server, valkey-sentinel and related programs. + diff --git a/selinux-policy/valkey-and-similar/main.fmf b/selinux-policy/valkey-and-similar/main.fmf new file mode 100644 index 0000000..4029ed9 --- /dev/null +++ b/selinux-policy/valkey-and-similar/main.fmf @@ -0,0 +1,37 @@ +summary: SELinux interferes with valkey and related programs +description: |+ + SELinux interferes with valkey-server, valkey-sentinel and related programs. + +contact: Milos Malik +component: + - selinux-policy +test: ./runtest.sh +framework: beakerlib +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - valkey + - /usr/sbin/service +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tier: '3' +link: + - verifies: https://issues.redhat.com/browse/RHEL-102631 + - verifies: https://issues.redhat.com/browse/RHEL-108982 +tag: + - Tier3 + - Tier3se + - NoRHIVOS +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 + because: the package is not available there diff --git a/selinux-policy/valkey-and-similar/runtest.sh b/selinux-policy/valkey-and-similar/runtest.sh new file mode 100755 index 0000000..4a356ed --- /dev/null +++ b/selinux-policy/valkey-and-similar/runtest.sh @@ -0,0 +1,103 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/valkey-and-similar +# Description: SELinux interferes with valkey and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2025 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +FILE_CONTEXT="redis_exec_t" +SERVICE_PACKAGE="valkey" +SERVICE_NAME="valkey" +PROCESS_NAME="valkey-server" +PROCESS_CONTEXT="redis_t" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" + rlSESatisfyRequires + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + if rpm -qa | grep -q valkey ; then + rlAssertRpm ${SERVICE_PACKAGE} + rlServiceStop valkey valkey-sentinel + fi + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + rlPhaseStartTest "RHEL-102631" + rlSEMatchPathCon `which valkey-server` ${FILE_CONTEXT} + rlSEMatchPathCon `which valkey-sentinel` ${FILE_CONTEXT} + rlSEMatchPathCon "/etc/valkey" "redis_conf_t" + rlSEMatchPathCon "/etc/valkey/sentinel.conf" "redis_conf_t" + rlSEMatchPathCon "/etc/valkey/valkey.conf" "redis_conf_t" + rlSEMatchPathCon "/var/log/valkey" "redis_log_t" + rlSEMatchPathCon "/var/lib/valkey" "redis_var_lib_t" + rlSEMatchPathCon "/var/run/valkey" "redis_var_run_t" + rlSEMatchPathCon "/usr/lib/systemd/system/valkey-sentinel.service" "redis_unit_file_t" + rlSEMatchPathCon "/usr/lib/systemd/system/valkey.service" "redis_unit_file_t" + rlPhaseEnd + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then + rlPhaseStartTest "real scenario -- ${SERVICE_NAME} service" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + PROCESS_CONTEXT="unconfined_service_t" + fi + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlWatchdog "valkey-cli --stat" 10 + rlRun "restorecon -Rv /etc /var /run -e /var/ARTIFACTS" 0-255 + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + fi + + SERVICE_NAME="valkey-sentinel" + PROCESS_NAME="valkey-sentinel" + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then + rlPhaseStartTest "real scenario -- ${SERVICE_NAME} service" + if ! rlSEDefined ${PROCESS_CONTEXT} ; then + PROCESS_CONTEXT="unconfined_service_t" + fi + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 + rlWatchdog "valkey-cli --stat -u valkey://default:PASSWORD@localhost:26379/0" 10 + rlRun "restorecon -Rv /etc /var /run -e /var/ARTIFACTS" 0-255 + rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlPhaseEnd + fi + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + rlServiceRestore valkey valkey-sentinel + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + From 22bdc812bb0c32d4f280e1f2f697032a2fe1579c Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Mon, 18 Aug 2025 14:38:23 +0200 Subject: [PATCH 542/626] test if fapolicyd can connect to systemd-machined via its socket A combined fapolicyd + systemd-machined + selinux-policy testing revealed that SELinux prevents the fapolicyd processes from connecting to the systemd-machined process via its UNIX socket located at: /run/systemd/userdb/io.systemd.Machine. The TC reproduces the situation. In order to support this behavior dictated by the nsswitch configuration, I believe that SELinux policy should allow this action. The TC looks for appropriate policy rules and file context patterns. The TC covers RHEL-77071. --- selinux-policy/fapolicyd-and-similar/Makefile | 3 ++- selinux-policy/fapolicyd-and-similar/main.fmf | 2 ++ selinux-policy/fapolicyd-and-similar/runtest.sh | 13 ++++++++++++- 3 files changed, 16 insertions(+), 2 deletions(-) diff --git a/selinux-policy/fapolicyd-and-similar/Makefile b/selinux-policy/fapolicyd-and-similar/Makefile index cdfcfed..17eef10 100644 --- a/selinux-policy/fapolicyd-and-similar/Makefile +++ b/selinux-policy/fapolicyd-and-similar/Makefile @@ -55,7 +55,7 @@ $(METADATA): Makefile @echo "TestTime: 10m" >> $(METADATA) @echo "RunFor: fapolicyd" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit initscripts libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console fapolicyd fapolicyd-selinux" >> $(METADATA) + @echo "Requires: audit /usr/sbin/service libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console fapolicyd fapolicyd-selinux systemd-container" >> $(METADATA) @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @@ -67,6 +67,7 @@ $(METADATA): Makefile @echo "Bug: 1874491" >> $(METADATA) # Fedora 33 @echo "Bug: 1876538" >> $(METADATA) # Fedora 33 @echo "Bug: 1932225" >> $(METADATA) + @echo "Bug: RHEL-77071" >> $(METADATA) # RHEL-10 rhts-lint $(METADATA) diff --git a/selinux-policy/fapolicyd-and-similar/main.fmf b/selinux-policy/fapolicyd-and-similar/main.fmf index b3fed85..30e15a7 100644 --- a/selinux-policy/fapolicyd-and-similar/main.fmf +++ b/selinux-policy/fapolicyd-and-similar/main.fmf @@ -19,6 +19,7 @@ recommend: - setools-console - fapolicyd - fapolicyd-selinux + - systemd-container environment: AVC_ERROR: +no_avc_check duration: 10m @@ -37,6 +38,7 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1874491 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1876538 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1932225 + - verifies: https://issues.redhat.com/browse/RHEL-77071 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 diff --git a/selinux-policy/fapolicyd-and-similar/runtest.sh b/selinux-policy/fapolicyd-and-similar/runtest.sh index 77549b1..90f3d2f 100755 --- a/selinux-policy/fapolicyd-and-similar/runtest.sh +++ b/selinux-policy/fapolicyd-and-similar/runtest.sh @@ -109,10 +109,21 @@ rlJournalStart PROCESS_CONTEXT="unconfined_service_t" fi rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 + rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd + rlPhaseStartTest "RHEL-77071" + rlSESearchRule "allow fapolicyd_t systemd_machined_t : unix_stream_socket { connectto } [ ]" + rlRun "service systemd-machined start" + rlRun "service systemd-machined status -l" + rlRun "service fapolicyd start" + rlRun "service fapolicyd status -l" + sleep 5 + rlRun "service fapolicyd stop" + rlRun "service systemd-machined stop" + rlPhaseEnd + rlPhaseStartCleanup sleep 2 rlSECheckAVC From 7a6077caace65b3b255e78acc616bc4c4ac1be53 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Thu, 21 Aug 2025 08:26:00 +0200 Subject: [PATCH 543/626] fix several failing tests Several automated tests were updated, because they were failing on RHEL-10 machines. The list of reasons follows: * incorrect test relevancy * unimportant SELinux denials * newly defined SELinux labels * missing metadata --- selinux-policy/hostapd-and-similar/runtest.sh | 1 + selinux-policy/iio-sensor-proxy-and-similar/main.fmf | 3 +++ selinux-policy/pam_limits-and-related/runtest.sh | 2 +- selinux-policy/systemd-generators/runtest.sh | 2 +- selinux-policy/systemd-homed/main.fmf | 2 +- selinux-policy/systemd-userdbd-and-similar/runtest.sh | 4 ++-- selinux-policy/tlshd-and-similar/runtest.sh | 2 +- selinux-policy/valkey-and-similar/main.fmf | 2 ++ 8 files changed, 12 insertions(+), 6 deletions(-) diff --git a/selinux-policy/hostapd-and-similar/runtest.sh b/selinux-policy/hostapd-and-similar/runtest.sh index aee5619..c36d878 100755 --- a/selinux-policy/hostapd-and-similar/runtest.sh +++ b/selinux-policy/hostapd-and-similar/runtest.sh @@ -100,6 +100,7 @@ rlJournalStart rlPhaseStartTest "real scenario -- standalone service" rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" rlRun "modprobe mac80211_hwsim" + rlRun "lsmod | grep mac80211_hwsim" rlRun "sed -i 's/^interface=.*$//' /etc/hostapd/hostapd.conf" rlRun "sed -i 's/^hw_mode=.*$//' /etc/hostapd/hostapd.conf" rlRun "sed -i 's/^channel=.*$//' /etc/hostapd/hostapd.conf" diff --git a/selinux-policy/iio-sensor-proxy-and-similar/main.fmf b/selinux-policy/iio-sensor-proxy-and-similar/main.fmf index ad25712..633e118 100644 --- a/selinux-policy/iio-sensor-proxy-and-similar/main.fmf +++ b/selinux-policy/iio-sensor-proxy-and-similar/main.fmf @@ -40,6 +40,9 @@ adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 because: the iio-sensor-proxy package is not available there + - enabled: false + when: arch == s390x + because: the service is not activatable there extra-summary: /CoreOS/selinux-policy/Regression/iio-sensor-proxy-and-similar extra-task: /CoreOS/selinux-policy/Regression/iio-sensor-proxy-and-similar extra-nitrate: TC#0617897 diff --git a/selinux-policy/pam_limits-and-related/runtest.sh b/selinux-policy/pam_limits-and-related/runtest.sh index dc56fa8..e788de1 100755 --- a/selinux-policy/pam_limits-and-related/runtest.sh +++ b/selinux-policy/pam_limits-and-related/runtest.sh @@ -82,7 +82,7 @@ rlJournalStart rlPhaseStartCleanup sleep 2 - rlSECheckAVC + rlSECheckAVC --ignore 'type=AVC.*connectto.*:guest_t:.*:systemd_machined_t:' --ignore 'type=AVC.*connectto.*:xguest_t:.*:systemd_machined_t:' rlFileRestore rlPhaseEnd diff --git a/selinux-policy/systemd-generators/runtest.sh b/selinux-policy/systemd-generators/runtest.sh index 1024c7b..d52e632 100755 --- a/selinux-policy/systemd-generators/runtest.sh +++ b/selinux-policy/systemd-generators/runtest.sh @@ -202,7 +202,7 @@ EOF rlPhaseStartTest "RHEL-72549" rlSEMatchPathCon "/usr/lib/systemd/system-generators/systemd-ssh-generator" "systemd_ssh_generator_exec_t" rlSEMatchPathCon "/dev/vsock" "vsock_device_t" - rlSEMatchPathCon "/run/systemd/generator/sshd-vsock.socket" "systemd_unit_file_t" + rlSEMatchPathCon "/run/systemd/generator/sshd-vsock.socket" "systemd_generator_unit_file_t" rlSESearchRule "allow init_t systemd_ssh_generator_exec_t : file { getattr open read execute } [ ]" rlSESearchRule "type_transition init_t systemd_ssh_generator_exec_t : process systemd_ssh_generator_t" rlSESearchRule "allow systemd_ssh_generator_t vsock_device_t : chr_file { getattr ioctl open read } [ ]" diff --git a/selinux-policy/systemd-homed/main.fmf b/selinux-policy/systemd-homed/main.fmf index 25edf64..ef2d162 100644 --- a/selinux-policy/systemd-homed/main.fmf +++ b/selinux-policy/systemd-homed/main.fmf @@ -27,7 +27,7 @@ link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2316163 adjust: - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, rhel-9, centos-stream-8, centos-stream-9 + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, rhel-9, centos-stream-8, centos-stream-9, rhel-10, centos-stream-10 because: the systemd-homed program is not available there extra-summary: /CoreOS/selinux-policy/Regression/systemd-homed extra-task: /CoreOS/selinux-policy/Regression/systemd-homed diff --git a/selinux-policy/systemd-userdbd-and-similar/runtest.sh b/selinux-policy/systemd-userdbd-and-similar/runtest.sh index 6932575..3120cf3 100755 --- a/selinux-policy/systemd-userdbd-and-similar/runtest.sh +++ b/selinux-policy/systemd-userdbd-and-similar/runtest.sh @@ -106,7 +106,7 @@ rlJournalStart PROCESS_CONTEXT="unconfined_service_t" fi rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 + rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd @@ -121,7 +121,7 @@ rlJournalStart rlPhaseStartCleanup sleep 2 - rlSECheckAVC + rlSECheckAVC --ignore 'type=AVC.*connectto.*userdbctl.*:guest_t:.*:systemd_machined_t:' --ignore 'type=AVC.*connectto.*userdbctl.*:xguest_t:.*:systemd_machined_t:' rlFileRestore rlServiceRestore ${SERVICE_NAME} diff --git a/selinux-policy/tlshd-and-similar/runtest.sh b/selinux-policy/tlshd-and-similar/runtest.sh index bf67f0e..0e13e00 100755 --- a/selinux-policy/tlshd-and-similar/runtest.sh +++ b/selinux-policy/tlshd-and-similar/runtest.sh @@ -80,7 +80,7 @@ rlJournalStart rlSESearchRule "allow ktlshd_t cert_t : dir { search } [ ]" rlSESearchRule "allow ktlshd_t cert_t : file { getattr open read } [ ]" rlSESearchRule "allow ktlshd_t net_conf_t : file { getattr open read } [ ]" - rlSESearchRule "allow ktlshd_t proc_net_t : lnk_file { read } [ ]" + # rlSESearchRule "allow ktlshd_t proc_net_t : lnk_file { read } [ ]" rlSESearchRule "allow ktlshd_t ktlshd_t : netlink_route_socket { bind create getattr getopt nlmsg_read setopt } [ ]" rlSESearchRule "allow ktlshd_t ktlshd_t : udp_socket { connect create getattr setopt } [ ]" rlSESearchRule "allow ktlshd_t sysctl_net_t : dir { search } [ ]" diff --git a/selinux-policy/valkey-and-similar/main.fmf b/selinux-policy/valkey-and-similar/main.fmf index 4029ed9..110f6a2 100644 --- a/selinux-policy/valkey-and-similar/main.fmf +++ b/selinux-policy/valkey-and-similar/main.fmf @@ -35,3 +35,5 @@ adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 because: the package is not available there +extra-nitrate: TC#0619564 +id: 337de041-c42f-4292-99d4-f687ec629fc9 From 7e37b29514557e1c45e345816ff7bd0f0775dd2b Mon Sep 17 00:00:00 2001 From: jan janasek Date: Wed, 20 Aug 2025 08:57:08 +0200 Subject: [PATCH 544/626] fix .fmf metadata all tests with CI-Tier-1 tag should have "tier: 1" in their metadata, also removing tags Tier1 and Tier1se and lastly tests with "tier: 2" and "tier: 3" should not have CI-Tier-1 tag. Signed-off-by: Jan Janasek --- checkpolicy/checkmodule/main.fmf | 4 +--- checkpolicy/checkpolicy-docs/main.fmf | 4 +--- checkpolicy/checkpolicy/main.fmf | 4 +--- checkpolicy/sedismod/main.fmf | 5 +---- checkpolicy/sedispol/main.fmf | 5 +---- libselinux/matchpathcon-in-chroot-env/main.fmf | 2 +- libselinux/realpath_not_final-function/main.fmf | 1 + libselinux/selabel-functions/main.fmf | 1 + libselinux/selinux_boolean_sub-function/main.fmf | 1 + libselinux/selinux_restorecon-functions/main.fmf | 1 + libselinux/selinux_sestatus-functions/main.fmf | 4 +--- libselinux/selinux_set_callback/main.fmf | 1 + libselinux/setenforce/main.fmf | 1 + libselinux/validatetrans/main.fmf | 3 +-- libsemanage/sanity-tests/main.fmf | 4 +--- libsemanage/semanage-handle-functions/main.fmf | 4 +--- libsemanage/verify-options-in-semanage-conf/main.fmf | 1 + libsepol/sepol_check_context/main.fmf | 1 + .../bz442327-setfscreatecon-with-invalid-context/main.fmf | 5 +---- policycoreutils/CIL-modules-without-compilation/main.fmf | 4 +--- policycoreutils/booleans/main.fmf | 1 + policycoreutils/file-contexts/main.fmf | 1 + policycoreutils/load_policy/main.fmf | 1 + policycoreutils/modules/main.fmf | 1 + policycoreutils/python-module-precedence-issue/main.fmf | 1 + policycoreutils/restorecon/main.fmf | 4 +--- policycoreutils/selinux-info/main.fmf | 1 + policycoreutils/semanage-interface/main.fmf | 1 + policycoreutils/semanage-login/main.fmf | 1 + policycoreutils/semanage-user/main.fmf | 1 + policycoreutils/sestatus/main.fmf | 4 +--- policycoreutils/setfiles/main.fmf | 4 +--- policycoreutils/setsebool/main.fmf | 4 +--- policycoreutils/spaces-in-fcontext-patterns/main.fmf | 4 +--- selinux-policy/bz481628-send-msg-to-dbus/main.fmf | 1 + selinux-policy/cups-browsed-and-similar/main.fmf | 5 +---- selinux-policy/dmidecode-and-similar/main.fmf | 5 +---- selinux-policy/getrlimit-permission/main.fmf | 4 +--- selinux-policy/ping-and-similar/main.fmf | 1 + selinux-policy/policy-rpm-macros/main.fmf | 4 +--- selinux-policy/policykit-general/main.fmf | 5 +---- selinux-policy/rrdcached-service-and-related/main.fmf | 1 + selinux-policy/rtkit-daemon-and-similar/main.fmf | 5 +---- setools/seinfo/main.fmf | 4 +--- setools/sesearch/main.fmf | 4 +--- 45 files changed, 45 insertions(+), 79 deletions(-) diff --git a/checkpolicy/checkmodule/main.fmf b/checkpolicy/checkmodule/main.fmf index 8e5531a..2020861 100644 --- a/checkpolicy/checkmodule/main.fmf +++ b/checkpolicy/checkmodule/main.fmf @@ -18,12 +18,10 @@ enabled: true tag: - CI-Tier-1 - NoRHEL4 - - Tier1 - - Tier1se - f31friendly - f32friendly - targeted -tier: '1' +tier: 1 link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=533796 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=588294 diff --git a/checkpolicy/checkpolicy-docs/main.fmf b/checkpolicy/checkpolicy-docs/main.fmf index 76804dd..b333ac5 100644 --- a/checkpolicy/checkpolicy-docs/main.fmf +++ b/checkpolicy/checkpolicy-docs/main.fmf @@ -17,13 +17,11 @@ tag: - CI-Tier-1 - NoRHEL4 - TIPpass_Security - - Tier1 - - Tier1se - f31friendly - f32friendly - targeted - NoRHIVOS -tier: '1' +tier: 1 link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1328966 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1328979 diff --git a/checkpolicy/checkpolicy/main.fmf b/checkpolicy/checkpolicy/main.fmf index 4459507..39ed072 100644 --- a/checkpolicy/checkpolicy/main.fmf +++ b/checkpolicy/checkpolicy/main.fmf @@ -23,12 +23,10 @@ enabled: true tag: - CI-Tier-1 - NoRHEL4 - - Tier1 - - Tier1se - f31friendly - f32friendly - targeted -tier: '1' +tier: 1 link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=533790 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=739866 diff --git a/checkpolicy/sedismod/main.fmf b/checkpolicy/sedismod/main.fmf index 4c103ca..edde1e2 100644 --- a/checkpolicy/sedismod/main.fmf +++ b/checkpolicy/sedismod/main.fmf @@ -14,17 +14,14 @@ recommend: duration: 10m enabled: true tag: - - CI-Tier-1 - NoRHEL4 - NoRHEL5 - TIPpass_Security - - Tier2 - - Tier2se - TierCandidatesPASS - f31friendly - f32friendly - targeted -tier: '2' +tier: 2 adjust: - enabled: false when: distro == rhel-4, rhel-5 diff --git a/checkpolicy/sedispol/main.fmf b/checkpolicy/sedispol/main.fmf index 0888f3f..dfcb6a8 100644 --- a/checkpolicy/sedispol/main.fmf +++ b/checkpolicy/sedispol/main.fmf @@ -12,15 +12,12 @@ recommend: duration: 10m enabled: true tag: - - CI-Tier-1 - NoRHEL4 - NoRHEL5 - - Tier2 - - Tier2se - f31friendly - f32friendly - targeted -tier: '2' +tier: 2 link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1303696 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1337890 diff --git a/libselinux/matchpathcon-in-chroot-env/main.fmf b/libselinux/matchpathcon-in-chroot-env/main.fmf index d671bcf..8bc4d6f 100644 --- a/libselinux/matchpathcon-in-chroot-env/main.fmf +++ b/libselinux/matchpathcon-in-chroot-env/main.fmf @@ -14,7 +14,7 @@ recommend: - policycoreutils duration: 15m enabled: true -tier: '1' +tier: 1 tag: - targeted - CI-Tier-1 diff --git a/libselinux/realpath_not_final-function/main.fmf b/libselinux/realpath_not_final-function/main.fmf index ec6f594..6fc50f8 100644 --- a/libselinux/realpath_not_final-function/main.fmf +++ b/libselinux/realpath_not_final-function/main.fmf @@ -19,6 +19,7 @@ tag: - f32friendly - f33friendly - fusa +tier: 1 link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1404644 adjust: diff --git a/libselinux/selabel-functions/main.fmf b/libselinux/selabel-functions/main.fmf index 50a8029..c3e7bae 100644 --- a/libselinux/selabel-functions/main.fmf +++ b/libselinux/selabel-functions/main.fmf @@ -19,6 +19,7 @@ tag: - f33friendly - targeted - fusa +tier: 1 link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1390909 adjust: diff --git a/libselinux/selinux_boolean_sub-function/main.fmf b/libselinux/selinux_boolean_sub-function/main.fmf index 6142ad1..3b69a94 100644 --- a/libselinux/selinux_boolean_sub-function/main.fmf +++ b/libselinux/selinux_boolean_sub-function/main.fmf @@ -19,6 +19,7 @@ tag: - f32friendly - f33friendly - fusa +tier: 1 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6 diff --git a/libselinux/selinux_restorecon-functions/main.fmf b/libselinux/selinux_restorecon-functions/main.fmf index 0eb9686..bc551ee 100644 --- a/libselinux/selinux_restorecon-functions/main.fmf +++ b/libselinux/selinux_restorecon-functions/main.fmf @@ -20,6 +20,7 @@ tag: - TierCandidatesPASS - targeted - fusa +tier: 1 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6 diff --git a/libselinux/selinux_sestatus-functions/main.fmf b/libselinux/selinux_sestatus-functions/main.fmf index a3e83ee..97ab55d 100644 --- a/libselinux/selinux_sestatus-functions/main.fmf +++ b/libselinux/selinux_sestatus-functions/main.fmf @@ -15,14 +15,12 @@ tag: - NoRHEL5 - NoRHEL6 - TIPpass_Security - - Tier1 - - Tier1se - TierCandidatesPASS - f32friendly - f33friendly - targeted - fusa -tier: '1' +tier: 1 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6 diff --git a/libselinux/selinux_set_callback/main.fmf b/libselinux/selinux_set_callback/main.fmf index 5d59faf..1a278f1 100644 --- a/libselinux/selinux_set_callback/main.fmf +++ b/libselinux/selinux_set_callback/main.fmf @@ -22,6 +22,7 @@ tag: - f33friendly - targeted - NoRHIVOS +tier: 1 adjust: - enabled: false when: distro == rhel-4, rhel-5 diff --git a/libselinux/setenforce/main.fmf b/libselinux/setenforce/main.fmf index 9d32b29..82a8763 100644 --- a/libselinux/setenforce/main.fmf +++ b/libselinux/setenforce/main.fmf @@ -21,6 +21,7 @@ tag: - f33friendly - targeted - fusa +tier: 1 adjust: - enabled: false when: distro == rhel-4, rhel-5 diff --git a/libselinux/validatetrans/main.fmf b/libselinux/validatetrans/main.fmf index 922ecc0..5c4b812 100644 --- a/libselinux/validatetrans/main.fmf +++ b/libselinux/validatetrans/main.fmf @@ -24,11 +24,10 @@ tag: - NoRHEL5 - NoRHEL6 - NoRHEL7 - - Tier1 - f33friendly - targeted - NoRHIVOS -tier: '1' +tier: 1 link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2008965 adjust: diff --git a/libsemanage/sanity-tests/main.fmf b/libsemanage/sanity-tests/main.fmf index a73ec48..10309ea 100644 --- a/libsemanage/sanity-tests/main.fmf +++ b/libsemanage/sanity-tests/main.fmf @@ -17,8 +17,6 @@ tag: - CI-Tier-1 - NoRHEL4 - NoRHEL5 - - Tier1 - - Tier1se - f31friendly - f32friendly - failinfedora @@ -26,7 +24,7 @@ tag: - rhel8-crb - rhel9-buildroot - targeted -tier: '1' +tier: 1 link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1642305 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1781097 diff --git a/libsemanage/semanage-handle-functions/main.fmf b/libsemanage/semanage-handle-functions/main.fmf index cb3e1d7..91a3234 100644 --- a/libsemanage/semanage-handle-functions/main.fmf +++ b/libsemanage/semanage-handle-functions/main.fmf @@ -15,13 +15,11 @@ enabled: true tag: - NoRHEL4 - NoRHEL5 - - Tier1 - - Tier1se - f31friendly - f32friendly - rhel8-buildroot - rhel9-buildroot -tier: '1' +tier: 1 link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1642305 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1781097 diff --git a/libsemanage/verify-options-in-semanage-conf/main.fmf b/libsemanage/verify-options-in-semanage-conf/main.fmf index 380bfad..73f2096 100644 --- a/libsemanage/verify-options-in-semanage-conf/main.fmf +++ b/libsemanage/verify-options-in-semanage-conf/main.fmf @@ -28,6 +28,7 @@ tag: - f32friendly - f33friendly - targeted +tier: 1 link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1400705 adjust: diff --git a/libsepol/sepol_check_context/main.fmf b/libsepol/sepol_check_context/main.fmf index 9b3fd10..81de590 100644 --- a/libsepol/sepol_check_context/main.fmf +++ b/libsepol/sepol_check_context/main.fmf @@ -19,6 +19,7 @@ tag: - f32friendly - f33friendly - targeted +tier: 1 adjust: - enabled: false when: distro == rhel-4, rhel-5 diff --git a/mcstrans/bz442327-setfscreatecon-with-invalid-context/main.fmf b/mcstrans/bz442327-setfscreatecon-with-invalid-context/main.fmf index ce3a355..bef40cb 100644 --- a/mcstrans/bz442327-setfscreatecon-with-invalid-context/main.fmf +++ b/mcstrans/bz442327-setfscreatecon-with-invalid-context/main.fmf @@ -23,16 +23,13 @@ environment: duration: 5m enabled: true tag: - - CI-Tier-1 - NoRHEL4 - TIPpass_Security - - Tier3 - - Tier3se - f31friendly - f32friendly - failinrhel8ci - targeted -tier: '3' +tier: 3 link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=442327 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=800470 diff --git a/policycoreutils/CIL-modules-without-compilation/main.fmf b/policycoreutils/CIL-modules-without-compilation/main.fmf index 179a8ee..c4082d9 100644 --- a/policycoreutils/CIL-modules-without-compilation/main.fmf +++ b/policycoreutils/CIL-modules-without-compilation/main.fmf @@ -15,13 +15,11 @@ tag: - NoRHEL5 - NoRHEL6 - TIPpass_Security - - Tier1 - - Tier1se - TierCandidatesPASS - f32friendly - f33friendly - targeted -tier: '1' +tier: 1 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6 diff --git a/policycoreutils/booleans/main.fmf b/policycoreutils/booleans/main.fmf index 5d39c1b..ef60e1b 100644 --- a/policycoreutils/booleans/main.fmf +++ b/policycoreutils/booleans/main.fmf @@ -16,6 +16,7 @@ tag: - f32friendly - f33friendly - targeted +tier: 1 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6 diff --git a/policycoreutils/file-contexts/main.fmf b/policycoreutils/file-contexts/main.fmf index fe1d35f..e06a54c 100644 --- a/policycoreutils/file-contexts/main.fmf +++ b/policycoreutils/file-contexts/main.fmf @@ -17,6 +17,7 @@ tag: - f32friendly - f33friendly - targeted +tier: 1 link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1822100 adjust: diff --git a/policycoreutils/load_policy/main.fmf b/policycoreutils/load_policy/main.fmf index 274d8bd..391e40d 100644 --- a/policycoreutils/load_policy/main.fmf +++ b/policycoreutils/load_policy/main.fmf @@ -22,6 +22,7 @@ tag: - f33friendly - failinrhel8ci - targeted +tier: 1 adjust: - enabled: false when: distro == rhel-4, rhel-5 diff --git a/policycoreutils/modules/main.fmf b/policycoreutils/modules/main.fmf index 2ec292c..e566551 100644 --- a/policycoreutils/modules/main.fmf +++ b/policycoreutils/modules/main.fmf @@ -17,6 +17,7 @@ tag: - TierCandidatesPASS - f32friendly - f33friendly +tier: 1 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6 diff --git a/policycoreutils/python-module-precedence-issue/main.fmf b/policycoreutils/python-module-precedence-issue/main.fmf index 2dc5935..7564e9e 100644 --- a/policycoreutils/python-module-precedence-issue/main.fmf +++ b/policycoreutils/python-module-precedence-issue/main.fmf @@ -20,6 +20,7 @@ tag: - f32friendly - f33friendly - targeted +tier: 1 link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2128976 adjust: diff --git a/policycoreutils/restorecon/main.fmf b/policycoreutils/restorecon/main.fmf index 71144f5..75f61cb 100644 --- a/policycoreutils/restorecon/main.fmf +++ b/policycoreutils/restorecon/main.fmf @@ -33,12 +33,10 @@ tag: - CI-Tier-1 - NoRHEL4 - TIPpass_Security - - Tier1 - - Tier1se - f31friendly - f32friendly - targeted -tier: '1' +tier: 1 link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=739587 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=767568 diff --git a/policycoreutils/selinux-info/main.fmf b/policycoreutils/selinux-info/main.fmf index 94d42af..e05574e 100644 --- a/policycoreutils/selinux-info/main.fmf +++ b/policycoreutils/selinux-info/main.fmf @@ -17,6 +17,7 @@ tag: - f32friendly - f33friendly - targeted +tier: 1 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6 diff --git a/policycoreutils/semanage-interface/main.fmf b/policycoreutils/semanage-interface/main.fmf index f24537b..2229388 100644 --- a/policycoreutils/semanage-interface/main.fmf +++ b/policycoreutils/semanage-interface/main.fmf @@ -21,6 +21,7 @@ tag: - f33friendly - rhel-7.0 - targeted +tier: 1 link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=953826 adjust: diff --git a/policycoreutils/semanage-login/main.fmf b/policycoreutils/semanage-login/main.fmf index b518544..0dbe091 100644 --- a/policycoreutils/semanage-login/main.fmf +++ b/policycoreutils/semanage-login/main.fmf @@ -22,6 +22,7 @@ tag: - f33friendly - rhel-7.0 - targeted +tier: 1 link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=953826 adjust: diff --git a/policycoreutils/semanage-user/main.fmf b/policycoreutils/semanage-user/main.fmf index 761cd94..5c58c0d 100644 --- a/policycoreutils/semanage-user/main.fmf +++ b/policycoreutils/semanage-user/main.fmf @@ -23,6 +23,7 @@ tag: - f33friendly - rhel-7.0 - targeted +tier: 1 link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=953826 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=987444 diff --git a/policycoreutils/sestatus/main.fmf b/policycoreutils/sestatus/main.fmf index 22f1a56..7f8d71c 100644 --- a/policycoreutils/sestatus/main.fmf +++ b/policycoreutils/sestatus/main.fmf @@ -13,12 +13,10 @@ tag: - CI-Tier-1 - NoRHEL4 - TIPpass_Security - - Tier1 - - Tier1se - f31friendly - f32friendly - targeted -tier: '1' +tier: 1 link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=705027 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=705031 diff --git a/policycoreutils/setfiles/main.fmf b/policycoreutils/setfiles/main.fmf index af4d84d..d4e2cce 100644 --- a/policycoreutils/setfiles/main.fmf +++ b/policycoreutils/setfiles/main.fmf @@ -12,12 +12,10 @@ enabled: true tag: - CI-Tier-1 - TIPfail_Security - - Tier1 - - Tier1se - f31friendly - f32friendly - targeted -tier: '1' +tier: 1 link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1098062 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1086572 diff --git a/policycoreutils/setsebool/main.fmf b/policycoreutils/setsebool/main.fmf index 3ff5791..8ad08b5 100644 --- a/policycoreutils/setsebool/main.fmf +++ b/policycoreutils/setsebool/main.fmf @@ -19,14 +19,12 @@ tag: - TIPpass - TIPpass_FIPS - TIPpass_Security - - Tier1 - - Tier1se - TipWaived7 - f31friendly - f33friendly - failinrhel8ci - targeted -tier: '1' +tier: 1 link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1002529 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=856550 diff --git a/policycoreutils/spaces-in-fcontext-patterns/main.fmf b/policycoreutils/spaces-in-fcontext-patterns/main.fmf index 04ffc0e..7537f7b 100644 --- a/policycoreutils/spaces-in-fcontext-patterns/main.fmf +++ b/policycoreutils/spaces-in-fcontext-patterns/main.fmf @@ -25,10 +25,8 @@ tag: - NoRHEL5 - NoRHEL6 - NoRHEL7 - - Tier1 - - Tier1se - targeted -tier: '1' +tier: 1 link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1893545 adjust: diff --git a/selinux-policy/bz481628-send-msg-to-dbus/main.fmf b/selinux-policy/bz481628-send-msg-to-dbus/main.fmf index 1f54eb2..a85118a 100644 --- a/selinux-policy/bz481628-send-msg-to-dbus/main.fmf +++ b/selinux-policy/bz481628-send-msg-to-dbus/main.fmf @@ -32,6 +32,7 @@ tag: - TierCandidatesPASS - targeted - NoRHIVOS +tier: 1 link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=463267 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=481628 diff --git a/selinux-policy/cups-browsed-and-similar/main.fmf b/selinux-policy/cups-browsed-and-similar/main.fmf index 6b201f0..edef678 100644 --- a/selinux-policy/cups-browsed-and-similar/main.fmf +++ b/selinux-policy/cups-browsed-and-similar/main.fmf @@ -28,13 +28,10 @@ tag: - NoRHEL5 - NoRHEL6 - RHEL8 - - Tier1 - - Tier1security - - Tier1se - f32friendly - targeted - NoRHIVOS -tier: '1' +tier: 1 link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1395801 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1401634 diff --git a/selinux-policy/dmidecode-and-similar/main.fmf b/selinux-policy/dmidecode-and-similar/main.fmf index c3a00b2..515452e 100644 --- a/selinux-policy/dmidecode-and-similar/main.fmf +++ b/selinux-policy/dmidecode-and-similar/main.fmf @@ -26,16 +26,13 @@ environment: duration: 15m enabled: true tag: - - CI-Tier-1 - NoRHEL4 - TIPpass_Security - - Tier2 - - Tier2se - f31friendly - f32friendly - targeted - NoRHIVOS -tier: '2' +tier: 2 link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=263141 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1289274 diff --git a/selinux-policy/getrlimit-permission/main.fmf b/selinux-policy/getrlimit-permission/main.fmf index 0c0c654..0e8bc76 100644 --- a/selinux-policy/getrlimit-permission/main.fmf +++ b/selinux-policy/getrlimit-permission/main.fmf @@ -25,12 +25,10 @@ tag: - NoRHEL4 - NoRHEL5 - NoRHEL6 - - Tier1 - - Tier1se - f33friendly - targeted - NoRHIVOS -tier: '1' +tier: 1 link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1549691 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1549772 diff --git a/selinux-policy/ping-and-similar/main.fmf b/selinux-policy/ping-and-similar/main.fmf index e178cb4..e6dcc63 100644 --- a/selinux-policy/ping-and-similar/main.fmf +++ b/selinux-policy/ping-and-similar/main.fmf @@ -30,6 +30,7 @@ tag: - TierCandidatesPASS - targeted - NoRHIVOS +tier: 1 link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1552128 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1596065 diff --git a/selinux-policy/policy-rpm-macros/main.fmf b/selinux-policy/policy-rpm-macros/main.fmf index e6c707e..05abb8b 100644 --- a/selinux-policy/policy-rpm-macros/main.fmf +++ b/selinux-policy/policy-rpm-macros/main.fmf @@ -20,12 +20,10 @@ tag: - NoRHEL5 - NoRHEL6 - TIPpass_Security - - Tier1 - - Tier1se - f32friendly - targeted - NoRHIVOS -tier: '1' +tier: 1 link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1380854 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1415694 diff --git a/selinux-policy/policykit-general/main.fmf b/selinux-policy/policykit-general/main.fmf index 4055ac8..cfe4971 100644 --- a/selinux-policy/policykit-general/main.fmf +++ b/selinux-policy/policykit-general/main.fmf @@ -26,20 +26,17 @@ environment: duration: 20m enabled: true tag: - - CI-Tier-1 - NoRHEL4 - NoRHEL5 - TIPpass - TIPpass_FIPS - TIPpass_Security - - Tier2 - - Tier2se - TipWaived7 - f31friendly - f32friendly - targeted - NoRHIVOS -tier: '2' +tier: 2 link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=960669 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=962791 diff --git a/selinux-policy/rrdcached-service-and-related/main.fmf b/selinux-policy/rrdcached-service-and-related/main.fmf index 55ddd25..b132e77 100644 --- a/selinux-policy/rrdcached-service-and-related/main.fmf +++ b/selinux-policy/rrdcached-service-and-related/main.fmf @@ -30,6 +30,7 @@ tag: - f33friendly - targeted - NoRHIVOS +tier: 1 link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1726255 adjust: diff --git a/selinux-policy/rtkit-daemon-and-similar/main.fmf b/selinux-policy/rtkit-daemon-and-similar/main.fmf index 1b8bf17..626d670 100644 --- a/selinux-policy/rtkit-daemon-and-similar/main.fmf +++ b/selinux-policy/rtkit-daemon-and-similar/main.fmf @@ -23,19 +23,16 @@ environment: duration: 10m enabled: true tag: - - CI-Tier-1 - NoRHEL4 - NoRHEL5 - TIPpass_FIPS - TIPpass_Security - - Tier2 - - Tier2se - TierCandidatesPASS - f31friendly - f32friendly - targeted - NoRHIVOS -tier: '2' +tier: 2 link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1626982 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1703241 diff --git a/setools/seinfo/main.fmf b/setools/seinfo/main.fmf index 6658d35..3dee162 100644 --- a/setools/seinfo/main.fmf +++ b/setools/seinfo/main.fmf @@ -19,15 +19,13 @@ enabled: true tag: - NoRHEL4 - TIPpass_Security - - Tier1 - - Tier1se - TipWaived5 - TipWaived6 - f31friendly - f32friendly - failinrhel8ci - targeted -tier: '1' +tier: 1 link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=499247 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=584286 diff --git a/setools/sesearch/main.fmf b/setools/sesearch/main.fmf index ae36e4b..155469e 100644 --- a/setools/sesearch/main.fmf +++ b/setools/sesearch/main.fmf @@ -17,14 +17,12 @@ enabled: true tag: - NoRHEL4 - TIPpass_Security - - Tier1 - - Tier1se - TierCandidatesFAIL - TipWaived7 - f32friendly - f33friendly - targeted -tier: '1' +tier: 1 link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=526460 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=583915 From a74ee6af1782957f0cfecf3fcc6514aa9a4466e0 Mon Sep 17 00:00:00 2001 From: jan janasek Date: Tue, 26 Aug 2025 09:05:24 +0200 Subject: [PATCH 545/626] tag:Tier clean up Removed redundant tags (e.g., Tier2/Tier3 and Tier2se/Tier3se) from all tests with "tier: 2" and "tier: 3" metadata. The "tier" metadata is used instead. Signed-off-by: Jan Janasek --- policycoreutils/sepolicy-generate/main.fmf | 4 +--- selinux-policy/ModemManager-and-similar/main.fmf | 4 +--- selinux-policy/accounts-daemon-and-similar/main.fmf | 4 +--- selinux-policy/acpid-and-similar/main.fmf | 4 +--- selinux-policy/bgpd-and-similar/main.fmf | 4 +--- selinux-policy/boltd-and-similar/main.fmf | 4 +--- selinux-policy/bootupd-and-similar/main.fmf | 4 +--- selinux-policy/bz624405-pcsc-and-similar/main.fmf | 4 +--- selinux-policy/chronyd-and-similar/main.fmf | 4 +--- selinux-policy/colord-and-similar/main.fmf | 4 +--- selinux-policy/cups-lpd-and-similar/main.fmf | 4 +--- selinux-policy/fedora-third-party-and-similar/main.fmf | 4 +--- selinux-policy/firewalld-and-similar/main.fmf | 4 +--- selinux-policy/fwupd-and-similar/main.fmf | 4 +--- selinux-policy/kerberos-and-similar/main.fmf | 4 +--- selinux-policy/ksm-and-similar/main.fmf | 4 +--- selinux-policy/logwatch-and-similar/main.fmf | 4 +--- selinux-policy/numad-and-similar/main.fmf | 4 +--- selinux-policy/rngd-and-similar/main.fmf | 4 +--- selinux-policy/rpc.idmapd-and-similar/main.fmf | 4 +--- selinux-policy/smbcontrol-and-similar/main.fmf | 4 +--- selinux-policy/stalld-and-similar/main.fmf | 4 +--- selinux-policy/synce4l-and-similar/main.fmf | 4 +--- selinux-policy/systemd-creds/main.fmf | 4 +--- selinux-policy/systemd-notify-and-similar/main.fmf | 4 +--- selinux-policy/systemd-rfkill-and-similar/main.fmf | 4 +--- selinux-policy/systemd-run-and-similar/main.fmf | 4 +--- selinux-policy/systemd-timesyncd-and-similar/main.fmf | 4 +--- selinux-policy/systemd-tmpfiles-and-similar/main.fmf | 4 +--- selinux-policy/thttpd-and-similar/main.fmf | 4 +--- selinux-policy/usbmuxd-and-similar/main.fmf | 4 +--- 31 files changed, 31 insertions(+), 93 deletions(-) diff --git a/policycoreutils/sepolicy-generate/main.fmf b/policycoreutils/sepolicy-generate/main.fmf index 878ee66..0bc1144 100644 --- a/policycoreutils/sepolicy-generate/main.fmf +++ b/policycoreutils/sepolicy-generate/main.fmf @@ -15,13 +15,11 @@ tag: - NoRHEL6 - TIPpass_FIPS - TIPpass_Security - - Tier3 - - Tier3se - TipWaived7 - f31friendly - f32friendly - targeted -tier: '3' +tier: 3 link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1271324 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=924686 diff --git a/selinux-policy/ModemManager-and-similar/main.fmf b/selinux-policy/ModemManager-and-similar/main.fmf index 35da033..83674f3 100644 --- a/selinux-policy/ModemManager-and-similar/main.fmf +++ b/selinux-policy/ModemManager-and-similar/main.fmf @@ -28,13 +28,11 @@ tag: - NoRHEL4 - NoRHEL5 - TIPpass_Security - - Tier2 - - Tier2se - f31friendly - f32friendly - targeted - NoRHIVOS -tier: '2' +tier: 2 link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1120152 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1362273 diff --git a/selinux-policy/accounts-daemon-and-similar/main.fmf b/selinux-policy/accounts-daemon-and-similar/main.fmf index 52b9efc..320de21 100644 --- a/selinux-policy/accounts-daemon-and-similar/main.fmf +++ b/selinux-policy/accounts-daemon-and-similar/main.fmf @@ -33,12 +33,10 @@ tag: - NoRHEL6 - TIPpass - TIPpass_Security - - Tier3 - - Tier3se - TierCandidatesPASS - targeted - NoRHIVOS -tier: '3' +tier: 3 link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1456760 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1507089 diff --git a/selinux-policy/acpid-and-similar/main.fmf b/selinux-policy/acpid-and-similar/main.fmf index 6d6c188..11de4a9 100644 --- a/selinux-policy/acpid-and-similar/main.fmf +++ b/selinux-policy/acpid-and-similar/main.fmf @@ -26,13 +26,11 @@ tag: - NoRHEL4 - TIPpass - TIPpass_Security - - Tier2 - - Tier2se - f31friendly - f32friendly - targeted - NoRHIVOS -tier: '2' +tier: 2 link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=995898 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1358478 diff --git a/selinux-policy/bgpd-and-similar/main.fmf b/selinux-policy/bgpd-and-similar/main.fmf index c84edb6..218eef7 100644 --- a/selinux-policy/bgpd-and-similar/main.fmf +++ b/selinux-policy/bgpd-and-similar/main.fmf @@ -26,15 +26,13 @@ tag: - NoRHEL5 - NoRHEL6 - NoRHEL7 - - Tier2 - - Tier2se - epel - rhel8-epel - rhel9-epel - rhel10-epel - targeted - NoRHIVOS -tier: '2' +tier: 2 link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1830170 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2055578 diff --git a/selinux-policy/boltd-and-similar/main.fmf b/selinux-policy/boltd-and-similar/main.fmf index b9f5ea1..c1cb2fa 100644 --- a/selinux-policy/boltd-and-similar/main.fmf +++ b/selinux-policy/boltd-and-similar/main.fmf @@ -28,14 +28,12 @@ tag: - NoRHEL4 - NoRHEL5 - NoRHEL6 - - Tier2 - - Tier2se - TierCandidatesPASS - f31friendly - f32friendly - targeted - NoRHIVOS -tier: '2' +tier: 2 link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1589086 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1625786 diff --git a/selinux-policy/bootupd-and-similar/main.fmf b/selinux-policy/bootupd-and-similar/main.fmf index ef081b1..cbd16ae 100644 --- a/selinux-policy/bootupd-and-similar/main.fmf +++ b/selinux-policy/bootupd-and-similar/main.fmf @@ -27,11 +27,9 @@ tag: - NoRHEL6 - NoRHEL7 - NoRHEL8 - - Tier3 - - Tier3se - targeted - NoRHIVOS -tier: '3' +tier: 3 link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2029478 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2044508 diff --git a/selinux-policy/bz624405-pcsc-and-similar/main.fmf b/selinux-policy/bz624405-pcsc-and-similar/main.fmf index 7d7762f..55f68de 100644 --- a/selinux-policy/bz624405-pcsc-and-similar/main.fmf +++ b/selinux-policy/bz624405-pcsc-and-similar/main.fmf @@ -31,13 +31,11 @@ tag: - TIPpass - TIPpass_FIPS - TIPpass_Security - - Tier3 - - Tier3se - f31friendly - f32friendly - targeted - NoRHIVOS -tier: '3' +tier: 3 link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=624405 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=752453 diff --git a/selinux-policy/chronyd-and-similar/main.fmf b/selinux-policy/chronyd-and-similar/main.fmf index b80882f..5263193 100644 --- a/selinux-policy/chronyd-and-similar/main.fmf +++ b/selinux-policy/chronyd-and-similar/main.fmf @@ -36,13 +36,11 @@ tag: - TIPfail_fedora - TIPfail_infra - TIPpass - - Tier3 - - Tier3se - TipWaived6 - f33friendly - targeted - NoRHIVOS -tier: '3' +tier: 3 link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=974992 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=978993 diff --git a/selinux-policy/colord-and-similar/main.fmf b/selinux-policy/colord-and-similar/main.fmf index 0e9565a..0fcf28b 100644 --- a/selinux-policy/colord-and-similar/main.fmf +++ b/selinux-policy/colord-and-similar/main.fmf @@ -32,13 +32,11 @@ tag: - TIPpass - TIPpass_FIPS - TIPpass_Security - - Tier2 - - Tier2se - f31friendly - f32friendly - targeted - NoRHIVOS -tier: '2' +tier: 2 link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1373082 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1381579 diff --git a/selinux-policy/cups-lpd-and-similar/main.fmf b/selinux-policy/cups-lpd-and-similar/main.fmf index 1fddf10..d0c1613 100644 --- a/selinux-policy/cups-lpd-and-similar/main.fmf +++ b/selinux-policy/cups-lpd-and-similar/main.fmf @@ -33,14 +33,12 @@ enabled: true tag: - NoRHEL4 - RHEL8 - - Tier2 - - Tier2se - customer_scenario - f32friendly - rhel9-buildroot - targeted - NoRHIVOS -tier: '2' +tier: 2 link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=192216 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1004198 diff --git a/selinux-policy/fedora-third-party-and-similar/main.fmf b/selinux-policy/fedora-third-party-and-similar/main.fmf index adf7a19..96fb3e8 100644 --- a/selinux-policy/fedora-third-party-and-similar/main.fmf +++ b/selinux-policy/fedora-third-party-and-similar/main.fmf @@ -30,11 +30,9 @@ tag: - NoRHEL7 - NoRHEL8 - NoRHEL9 - - Tier2 - - Tier2se - targeted - NoRHIVOS -tier: '2' +tier: 2 link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2093453 adjust: diff --git a/selinux-policy/firewalld-and-similar/main.fmf b/selinux-policy/firewalld-and-similar/main.fmf index 7e5698e..fe87934 100644 --- a/selinux-policy/firewalld-and-similar/main.fmf +++ b/selinux-policy/firewalld-and-similar/main.fmf @@ -33,14 +33,12 @@ tag: - TIPpass - TIPpass_FIPS - TIPpass_Security - - Tier3 - - Tier3se - TierCandidatesPASS - f32friendly - f33friendly - targeted - NoRHIVOS -tier: '3' +tier: 3 link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=907902 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=989922 diff --git a/selinux-policy/fwupd-and-similar/main.fmf b/selinux-policy/fwupd-and-similar/main.fmf index c0b8813..6793750 100644 --- a/selinux-policy/fwupd-and-similar/main.fmf +++ b/selinux-policy/fwupd-and-similar/main.fmf @@ -30,12 +30,10 @@ tag: - NoRHEL4 - NoRHEL5 - NoRHEL6 - - Tier3 - - Tier3se - TierCandidatesPASS - targeted - NoRHIVOS -tier: '3' +tier: 3 link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1772619 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1832231 diff --git a/selinux-policy/kerberos-and-similar/main.fmf b/selinux-policy/kerberos-and-similar/main.fmf index 471b884..95d3cd8 100644 --- a/selinux-policy/kerberos-and-similar/main.fmf +++ b/selinux-policy/kerberos-and-similar/main.fmf @@ -26,13 +26,11 @@ tag: - NoRHEL4 - NoRHEL5 - TIPpass_Security - - Tier2 - - Tier2se - TipWaived6 - TipWaived7 - targeted - NoRHIVOS -tier: '2' +tier: 2 link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=698923 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=713218 diff --git a/selinux-policy/ksm-and-similar/main.fmf b/selinux-policy/ksm-and-similar/main.fmf index ec61f2f..f0571ad 100644 --- a/selinux-policy/ksm-and-similar/main.fmf +++ b/selinux-policy/ksm-and-similar/main.fmf @@ -26,11 +26,9 @@ tag: - NoRHEL5 - NoRHEL6 - NoRHEL7 - - Tier2 - - Tier2se - targeted - NoRHIVOS -tier: '2' +tier: 2 link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2021131 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2091416 diff --git a/selinux-policy/logwatch-and-similar/main.fmf b/selinux-policy/logwatch-and-similar/main.fmf index fe6faa2..011161c 100644 --- a/selinux-policy/logwatch-and-similar/main.fmf +++ b/selinux-policy/logwatch-and-similar/main.fmf @@ -28,11 +28,9 @@ tag: - NoRHEL6 - NoRHEL7 - NoRHEL8 - - Tier3 - - Tier3se - targeted - NoRHIVOS -tier: '3' +tier: 3 link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2183432 - verifies: https://issues.redhat.com/browse/RHEL-34135 diff --git a/selinux-policy/numad-and-similar/main.fmf b/selinux-policy/numad-and-similar/main.fmf index 9c67835..fe2c982 100644 --- a/selinux-policy/numad-and-similar/main.fmf +++ b/selinux-policy/numad-and-similar/main.fmf @@ -29,12 +29,10 @@ tag: - TIPpass - TIPpass_FIPS - TIPpass_Security - - Tier3 - - Tier3se - TipWaived7 - targeted - NoRHIVOS -tier: '3' +tier: 3 link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=807157 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=857086 diff --git a/selinux-policy/rngd-and-similar/main.fmf b/selinux-policy/rngd-and-similar/main.fmf index acda722..4a9c443 100644 --- a/selinux-policy/rngd-and-similar/main.fmf +++ b/selinux-policy/rngd-and-similar/main.fmf @@ -29,14 +29,12 @@ tag: - NoRHEL6 - TIPpass - TIPpass_Security - - Tier2 - - Tier2se - TierCandidatesPASS - f31friendly - f32friendly - targeted - NoRHIVOS -tier: '2' +tier: 2 link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=869810 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=869813 diff --git a/selinux-policy/rpc.idmapd-and-similar/main.fmf b/selinux-policy/rpc.idmapd-and-similar/main.fmf index 96114b1..446aba2 100644 --- a/selinux-policy/rpc.idmapd-and-similar/main.fmf +++ b/selinux-policy/rpc.idmapd-and-similar/main.fmf @@ -26,12 +26,10 @@ tag: - NoRHEL5 - NoRHEL6 - NoRHEL7 - - Tier3 - - Tier3se - targeted - failinfedora - NoRHIVOS -tier: '3' +tier: 3 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 diff --git a/selinux-policy/smbcontrol-and-similar/main.fmf b/selinux-policy/smbcontrol-and-similar/main.fmf index 6eefc44..d9d0478 100644 --- a/selinux-policy/smbcontrol-and-similar/main.fmf +++ b/selinux-policy/smbcontrol-and-similar/main.fmf @@ -25,14 +25,12 @@ tag: - NoRHEL4 - NoRHEL5 - TIPpass_Security - - Tier3 - - Tier3se - TierCandidatesPASS - f31friendly - f32friendly - targeted - NoRHIVOS -tier: '3' +tier: 3 link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1326371 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1326621 diff --git a/selinux-policy/stalld-and-similar/main.fmf b/selinux-policy/stalld-and-similar/main.fmf index ed7a6da..22ef9ba 100644 --- a/selinux-policy/stalld-and-similar/main.fmf +++ b/selinux-policy/stalld-and-similar/main.fmf @@ -28,11 +28,9 @@ tag: - NoRHEL6 - NoRHEL7 - NoRHEL8 - - Tier2 - - Tier2se - targeted - NoRHIVOS -tier: '2' +tier: 2 link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2042614 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2092864 diff --git a/selinux-policy/synce4l-and-similar/main.fmf b/selinux-policy/synce4l-and-similar/main.fmf index 0b836fb..985b93f 100644 --- a/selinux-policy/synce4l-and-similar/main.fmf +++ b/selinux-policy/synce4l-and-similar/main.fmf @@ -26,11 +26,9 @@ tag: - NoRHEL5 - NoRHEL6 - NoRHEL7 - - Tier3 - - Tier3se - targeted - NoRHIVOS -tier: '3' +tier: 3 link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2158402 adjust: diff --git a/selinux-policy/systemd-creds/main.fmf b/selinux-policy/systemd-creds/main.fmf index 9645849..ba11ac5 100644 --- a/selinux-policy/systemd-creds/main.fmf +++ b/selinux-policy/systemd-creds/main.fmf @@ -21,11 +21,9 @@ environment: duration: 10m enabled: true tag: - - Tier2 - - Tier2se - targeted - NoRHIVOS -tier: '2' +tier: 2 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8 diff --git a/selinux-policy/systemd-notify-and-similar/main.fmf b/selinux-policy/systemd-notify-and-similar/main.fmf index 4ef8932..04933f1 100644 --- a/selinux-policy/systemd-notify-and-similar/main.fmf +++ b/selinux-policy/systemd-notify-and-similar/main.fmf @@ -29,11 +29,9 @@ tag: - NoRHEL5 - NoRHEL6 - NoRHEL7 - - Tier2 - - Tier2se - targeted - NoRHIVOS -tier: '2' +tier: 2 link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1903305 - verifies: https://issues.redhat.com/browse/RHEL-25514 diff --git a/selinux-policy/systemd-rfkill-and-similar/main.fmf b/selinux-policy/systemd-rfkill-and-similar/main.fmf index 27d8a50..963d8c6 100644 --- a/selinux-policy/systemd-rfkill-and-similar/main.fmf +++ b/selinux-policy/systemd-rfkill-and-similar/main.fmf @@ -29,13 +29,11 @@ tag: - NoRHEL5 - NoRHEL6 - TIPpass - - Tier2 - - Tier2se - f32friendly - f33friendly - targeted - fusa -tier: '2' +tier: 2 link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1290255 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1309839 diff --git a/selinux-policy/systemd-run-and-similar/main.fmf b/selinux-policy/systemd-run-and-similar/main.fmf index 6488281..e6419b4 100644 --- a/selinux-policy/systemd-run-and-similar/main.fmf +++ b/selinux-policy/systemd-run-and-similar/main.fmf @@ -27,11 +27,9 @@ tag: - NoRHEL5 - NoRHEL6 - NoRHEL7 - - Tier2 - - Tier2se - targeted - NoRHIVOS -tier: '2' +tier: 2 link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1559409 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1647162 diff --git a/selinux-policy/systemd-timesyncd-and-similar/main.fmf b/selinux-policy/systemd-timesyncd-and-similar/main.fmf index ea2b783..c4e8578 100644 --- a/selinux-policy/systemd-timesyncd-and-similar/main.fmf +++ b/selinux-policy/systemd-timesyncd-and-similar/main.fmf @@ -29,14 +29,12 @@ tag: - NoRHEL7 - TIPpass - TIPpass_Security - - Tier2 - - Tier2se - epel - rhel8-epel - rhel9-epel - targeted - NoRHIVOS -tier: '2' +tier: 2 link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1640801 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1649257 diff --git a/selinux-policy/systemd-tmpfiles-and-similar/main.fmf b/selinux-policy/systemd-tmpfiles-and-similar/main.fmf index 74c164d..9b77f7b 100644 --- a/selinux-policy/systemd-tmpfiles-and-similar/main.fmf +++ b/selinux-policy/systemd-tmpfiles-and-similar/main.fmf @@ -30,11 +30,9 @@ tag: - NoRHEL5 - NoRHEL6 - NoRHEL7 - - Tier2 - - Tier2se - targeted - NoRHIVOS -tier: '2' +tier: 2 link: - verifies: https://issues.redhat.com/browse/RHEL-40374 - verifies: https://issues.redhat.com/browse/RHEL-44191 diff --git a/selinux-policy/thttpd-and-similar/main.fmf b/selinux-policy/thttpd-and-similar/main.fmf index a3ded57..4cef10b 100644 --- a/selinux-policy/thttpd-and-similar/main.fmf +++ b/selinux-policy/thttpd-and-similar/main.fmf @@ -25,8 +25,6 @@ duration: 5m enabled: true tag: - NoRHEL4 - - Tier2 - - Tier2se - TierCandidatesPASS - f31friendly - f32friendly @@ -34,7 +32,7 @@ tag: - epel - rhel8-epel - NoRHIVOS -tier: '2' +tier: 2 link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1069843 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1087384 diff --git a/selinux-policy/usbmuxd-and-similar/main.fmf b/selinux-policy/usbmuxd-and-similar/main.fmf index 11eaad3..2f30ccd 100644 --- a/selinux-policy/usbmuxd-and-similar/main.fmf +++ b/selinux-policy/usbmuxd-and-similar/main.fmf @@ -26,14 +26,12 @@ tag: - NoRHEL5 - NoRHEL6 - TIPpass_Security - - Tier3 - - Tier3se - TipWaived7 - f31friendly - f32friendly - targeted - NoRHIVOS -tier: '3' +tier: 3 link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1521054 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1582205 From 160b772afeed49fc961a0a81c07597698ffea2d7 Mon Sep 17 00:00:00 2001 From: jan janasek Date: Tue, 26 Aug 2025 09:20:59 +0200 Subject: [PATCH 546/626] adding gating guideline to README Adds documentation to the README file to explain the test tiering system and its role in our gating process. This clarifies the meaning of 'tier: 1/2/3' metadata and explains that older tags (e.g., tag:Tier1) have been deprecated. Signed-off-by: Jan Janasek --- README.md | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/README.md b/README.md index cd129dc..31b5c7d 100644 --- a/README.md +++ b/README.md @@ -3,6 +3,16 @@ This repository contains set of test for SELinux kernel, userspace and policy. Tests are written using [beakerlib](https://github.com/beakerlib/beakerlib) with [TMT Metadata Specification](https://tmt.readthedocs.io/en/latest/spec.html). + +## Gating Guidelines +Test tiers define a test's priority for our **gating process**. + +* **`tier: 1`**: Critical tests that must pass for any code merge. +* **`tier: 2`**: Important but non-critical tests. +* **`tier: 3`**: Non-critical tests. + +All other tier metadata (e.g., `tag:Tier1`) is now deprecated. + ## Plans $ tmt plans From a68d8721c6f56c31506bc66d0529d3d77eb21640 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 12 Aug 2025 16:17:50 +0200 Subject: [PATCH 547/626] test if systemd-machined can inspect dead/empty images Recent systemd-machined + selinux-policy testing revealed that SELinux prevents the systemd-machined processes from creating and removing the following directories and files: * /run/systemd/nspawn/ * /run/systemd/nspawn/locks/ * /run/systemd/nspawn/locks/inode-* In order to support various systemd-machined and machinectl functions, I believe that SELinux policy should allow above-mentioned actions. The TC looks for appropriate policy rules and file context patterns. The TC covers RHEL-105966 and RHEL-108849. --- selinux-policy/systemd-machined-and-similar/Makefile | 2 ++ selinux-policy/systemd-machined-and-similar/main.fmf | 2 ++ selinux-policy/systemd-machined-and-similar/runtest.sh | 7 +++++++ 3 files changed, 11 insertions(+) diff --git a/selinux-policy/systemd-machined-and-similar/Makefile b/selinux-policy/systemd-machined-and-similar/Makefile index c954661..f99a7c8 100644 --- a/selinux-policy/systemd-machined-and-similar/Makefile +++ b/selinux-policy/systemd-machined-and-similar/Makefile @@ -73,6 +73,8 @@ $(METADATA): Makefile @echo "Bug: RHEL-78088" >> $(METADATA) # RHEL-10 @echo "Bug: RHEL-85379" >> $(METADATA) # RHEL-9 @echo "Bug: RHEL-86528" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-105966" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-108849" >> $(METADATA) # RHEL-9 rhts-lint $(METADATA) diff --git a/selinux-policy/systemd-machined-and-similar/main.fmf b/selinux-policy/systemd-machined-and-similar/main.fmf index 61d14a8..f76c62c 100644 --- a/selinux-policy/systemd-machined-and-similar/main.fmf +++ b/selinux-policy/systemd-machined-and-similar/main.fmf @@ -41,6 +41,8 @@ link: - verifies: https://issues.redhat.com/browse/RHEL-78088 - verifies: https://issues.redhat.com/browse/RHEL-85379 - verifies: https://issues.redhat.com/browse/RHEL-86528 + - verifies: https://issues.redhat.com/browse/RHEL-105966 + - verifies: https://issues.redhat.com/browse/RHEL-108849 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7 diff --git a/selinux-policy/systemd-machined-and-similar/runtest.sh b/selinux-policy/systemd-machined-and-similar/runtest.sh index 688629f..0894522 100755 --- a/selinux-policy/systemd-machined-and-similar/runtest.sh +++ b/selinux-policy/systemd-machined-and-similar/runtest.sh @@ -173,6 +173,13 @@ rlJournalStart rlRun "rm -rf /var/lib/machines/test" rlPhaseEnd + rlPhaseStartTest "RHEL-105966 + RHEL-108849" + rlRun "mkdir -pZ /var/lib/machines/test" + rlRun "machinectl list-images" + rlRun "machinectl image-status test" + rlRun "rm -rf /var/lib/machines/test" + rlPhaseEnd + rlPhaseStartCleanup sleep 2 rlSECheckAVC From 14479be1b9a618dbcde4d66c2eb9bd6d084117de Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Thu, 28 Aug 2025 16:36:40 +0200 Subject: [PATCH 548/626] perform the rules check on RHEL-10/CentOS stream 10 only Currently, the SELinux denial shown in RHEL-77071 is not reproducible on RHEL-9 or CentOS stream 9. It makes no sense to check the SELinux policy rule existence there. The test code relevancy was updated. --- selinux-policy/fapolicyd-and-similar/runtest.sh | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/selinux-policy/fapolicyd-and-similar/runtest.sh b/selinux-policy/fapolicyd-and-similar/runtest.sh index 90f3d2f..8b359e8 100755 --- a/selinux-policy/fapolicyd-and-similar/runtest.sh +++ b/selinux-policy/fapolicyd-and-similar/runtest.sh @@ -114,7 +114,9 @@ rlJournalStart rlPhaseEnd rlPhaseStartTest "RHEL-77071" - rlSESearchRule "allow fapolicyd_t systemd_machined_t : unix_stream_socket { connectto } [ ]" + if rlIsCentOS 10 || rlIsRHEL 10 ; then + rlSESearchRule "allow fapolicyd_t systemd_machined_t : unix_stream_socket { connectto } [ ]" + fi rlRun "service systemd-machined start" rlRun "service systemd-machined status -l" rlRun "service fapolicyd start" From d2d11302117235eff030f833b3402dbbf9421cd0 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Thu, 4 Sep 2025 10:04:21 +0200 Subject: [PATCH 549/626] inform the framework to expect SELinux denials Some tests intentionally trigger SELinux denials during their run and there is no need to fail because of them. The default value of avc check is not suitable for these tests. --- kernel/avc_log_actual_context_if_invalid/main.fmf | 3 +++ kernel/avc_tracepoint/main.fmf | 3 +++ kernel/getxattr_read_out_of_bounds/main.fmf | 3 +++ kernel/selinux-testsuite/main.fmf | 3 +++ libselinux/validatetrans/main.fmf | 3 +++ mcstrans/bz442327-setfscreatecon-with-invalid-context/main.fmf | 3 +++ selinux-policy/deny-rules/main.fmf | 3 +++ selinux-policy/getrlimit-permission/main.fmf | 3 +++ 8 files changed, 24 insertions(+) diff --git a/kernel/avc_log_actual_context_if_invalid/main.fmf b/kernel/avc_log_actual_context_if_invalid/main.fmf index 44160b6..719b580 100644 --- a/kernel/avc_log_actual_context_if_invalid/main.fmf +++ b/kernel/avc_log_actual_context_if_invalid/main.fmf @@ -25,3 +25,6 @@ link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1719666 environment: AVC_ERROR: +no_avc_check +check: + - how: avc + result: xfail diff --git a/kernel/avc_tracepoint/main.fmf b/kernel/avc_tracepoint/main.fmf index 5f6ff5d..2599ce5 100644 --- a/kernel/avc_tracepoint/main.fmf +++ b/kernel/avc_tracepoint/main.fmf @@ -25,3 +25,6 @@ link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1954024 environment: AVC_ERROR: +no_avc_check +check: + - how: avc + result: xfail diff --git a/kernel/getxattr_read_out_of_bounds/main.fmf b/kernel/getxattr_read_out_of_bounds/main.fmf index f3360cb..0a807f2 100644 --- a/kernel/getxattr_read_out_of_bounds/main.fmf +++ b/kernel/getxattr_read_out_of_bounds/main.fmf @@ -21,3 +21,6 @@ link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1595706 environment: AVC_ERROR: +no_avc_check +check: + - how: avc + result: xfail diff --git a/kernel/selinux-testsuite/main.fmf b/kernel/selinux-testsuite/main.fmf index ece9456..2dd60df 100644 --- a/kernel/selinux-testsuite/main.fmf +++ b/kernel/selinux-testsuite/main.fmf @@ -18,4 +18,7 @@ adjust: when: arch = i386 environment: AVC_ERROR: +no_avc_check +check: + - how: avc + result: xfail id: f491d519-a7cd-4acf-8405-67a6afcc678a diff --git a/libselinux/validatetrans/main.fmf b/libselinux/validatetrans/main.fmf index 5c4b812..198ed13 100644 --- a/libselinux/validatetrans/main.fmf +++ b/libselinux/validatetrans/main.fmf @@ -17,6 +17,9 @@ recommend: - setools-console environment: AVC_ERROR: +no_avc_check +check: + - how: avc + result: xfail duration: 10m enabled: true tag: diff --git a/mcstrans/bz442327-setfscreatecon-with-invalid-context/main.fmf b/mcstrans/bz442327-setfscreatecon-with-invalid-context/main.fmf index bef40cb..cf211c2 100644 --- a/mcstrans/bz442327-setfscreatecon-with-invalid-context/main.fmf +++ b/mcstrans/bz442327-setfscreatecon-with-invalid-context/main.fmf @@ -20,6 +20,9 @@ recommend: - policycoreutils environment: AVC_ERROR: +no_avc_check +check: + - how: avc + result: xfail duration: 5m enabled: true tag: diff --git a/selinux-policy/deny-rules/main.fmf b/selinux-policy/deny-rules/main.fmf index 72e0dfc..43b5448 100644 --- a/selinux-policy/deny-rules/main.fmf +++ b/selinux-policy/deny-rules/main.fmf @@ -14,6 +14,9 @@ recommend: - expect environment: AVC_ERROR: +no_avc_check +check: + - how: avc + result: xfail duration: 10m enabled: true tier: 1 diff --git a/selinux-policy/getrlimit-permission/main.fmf b/selinux-policy/getrlimit-permission/main.fmf index 0e8bc76..81ee08b 100644 --- a/selinux-policy/getrlimit-permission/main.fmf +++ b/selinux-policy/getrlimit-permission/main.fmf @@ -18,6 +18,9 @@ recommend: - util-linux environment: AVC_ERROR: +no_avc_check +check: + - how: avc + result: xfail duration: 10m enabled: true tag: From af6d8ea1450da08a36c424bdd0f71a6ce733f258 Mon Sep 17 00:00:00 2001 From: Jan Onderka Date: Mon, 15 Sep 2025 13:12:59 +0200 Subject: [PATCH 550/626] policycoreutils linux system roles test disable for RHIVOS --- policycoreutils/linux-system-roles.selinux-tests/main.fmf | 2 ++ 1 file changed, 2 insertions(+) diff --git a/policycoreutils/linux-system-roles.selinux-tests/main.fmf b/policycoreutils/linux-system-roles.selinux-tests/main.fmf index 6cf38ed..73aaefc 100644 --- a/policycoreutils/linux-system-roles.selinux-tests/main.fmf +++ b/policycoreutils/linux-system-roles.selinux-tests/main.fmf @@ -10,6 +10,8 @@ recommend: - ansible - git duration: 40m +tag: + - NoRHIVOS extra-summary: linux-system-roles.selinux-tests extra-task: linux-system-roles.selinux-tests id: 4889350b-d9fa-4cbf-86ff-f16a1c729f9e From 447bd53465883dd8509d7b615d2fa15372595b1d Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Thu, 25 Sep 2025 16:33:18 +0200 Subject: [PATCH 551/626] add a general plan for image mode testing The newly added image-mode plan runs all relevant tests except for those which: * are broken * require multiple hosts * do reboots * are not suitable for image mode environments The image-mode test plan does not recognize tiers. That may change in the future. --- plans/image-mode.fmf | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) create mode 100644 plans/image-mode.fmf diff --git a/plans/image-mode.fmf b/plans/image-mode.fmf new file mode 100644 index 0000000..2b074df --- /dev/null +++ b/plans/image-mode.fmf @@ -0,0 +1,17 @@ +summary: general test plan for image mode +enabled: true +adjust+: +- when: trigger == build + enabled: false + because: do not run this plan on a new build +- when: trigger == commit + enabled: false + because: do not run this plan on changes caused by a PR/MR +discover: + how: fmf + filter: 'tag:-tf_broken & tag:-multihost & tag:-reboot & tag:-avoidImageMode' +prepare: +- how: install + package: https://download.copr.fedorainfracloud.org/results/mmalik/mnt-tests/epel-10-x86_64/09597416-mnt-tests/mnt-tests-1.0-1.el10.noarch.rpm +execute: + how: tmt From 0d14d2424ab81a57eb8bdd2f0c31201630142f0e Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Thu, 25 Sep 2025 19:48:11 +0200 Subject: [PATCH 552/626] find tests which do reboots and tag them properly These tests should have the 'reboot' tag. The tag can then be used as a filter for running tests. --- kernel/labeling_before_policy_load/main.fmf | 2 ++ kernel/mount-options-memleak/main.fmf | 2 ++ selinux-policy/bz533007-unable-to-start-kdump-service/main.fmf | 1 + 3 files changed, 5 insertions(+) diff --git a/kernel/labeling_before_policy_load/main.fmf b/kernel/labeling_before_policy_load/main.fmf index edddad8..3258f9c 100644 --- a/kernel/labeling_before_policy_load/main.fmf +++ b/kernel/labeling_before_policy_load/main.fmf @@ -25,3 +25,5 @@ adjust: because: RHEL-8.2 and below are not expected to support this link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1777525 +tag: + - reboot diff --git a/kernel/mount-options-memleak/main.fmf b/kernel/mount-options-memleak/main.fmf index e54f7b6..5913209 100644 --- a/kernel/mount-options-memleak/main.fmf +++ b/kernel/mount-options-memleak/main.fmf @@ -15,3 +15,5 @@ adjust: because: RHEL-6 and below are not worth supporting by this test link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2187402 +tag: + - reboot diff --git a/selinux-policy/bz533007-unable-to-start-kdump-service/main.fmf b/selinux-policy/bz533007-unable-to-start-kdump-service/main.fmf index 0714eaa..02da87f 100644 --- a/selinux-policy/bz533007-unable-to-start-kdump-service/main.fmf +++ b/selinux-policy/bz533007-unable-to-start-kdump-service/main.fmf @@ -37,6 +37,7 @@ tag: - targeted - NoRHIVOS - rhel10_broken + - reboot link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=533007 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=533366 From 1eb61b3a69e617572829ec483a384b36a41be23a Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Fri, 26 Sep 2025 09:06:42 +0200 Subject: [PATCH 553/626] exclude unsuitable tests from image mode testing Tests which are not suitable (various reasons) for image mode testing will get the avoidImageMode tag. If their conditions improve, the tag can be removed. --- kernel/labeled-cephfs/main.fmf | 1 + kernel/ocontext-race/main.fmf | 2 ++ kernel/xfrm-refcount-underflow/main.fmf | 2 ++ libsemanage/semanage-root-on-nfs/main.fmf | 1 + libsemanage/semanage-seuser-functions/main.fmf | 1 + libsemanage/usepasswd-in-semanage-conf/main.fmf | 1 + libsepol/sepol_check_context/main.fmf | 1 + mcstrans/internal-examples-testsuite/main.fmf | 1 + other/collect-denials/main.fmf | 1 + other/update-packages/main.fmf | 3 ++- policycoreutils/fixfiles-F-B-N/main.fmf | 2 ++ .../linux-system-roles.selinux-tests/main.fmf | 1 + policycoreutils/load_policy/main.fmf | 1 + policycoreutils/org-selinux-dbus-interfaces/main.fmf | 1 + .../python-module-precedence-issue/main.fmf | 1 + policycoreutils/restorecon/main.fmf | 1 + policycoreutils/restorecond_pointer_abuse/main.fmf | 2 ++ policycoreutils/sctp_test/main.fmf | 2 ++ policycoreutils/semanage-interface/main.fmf | 2 +- policycoreutils/semanage-login/main.fmf | 2 +- .../semanage-port-add-delete-problems/main.fmf | 2 ++ policycoreutils/semanage-user/main.fmf | 2 +- .../semodule-rebuild-if-modules-changed/runtest.sh | 6 +++++- policycoreutils/sepolicy-generate/main.fmf | 1 + policycoreutils/setsebool/main.fmf | 1 + selinux-policy/blueman-and-similar/main.fmf | 2 +- selinux-policy/boothd-and-similar/main.fmf | 1 + selinux-policy/bootupd-and-similar/main.fmf | 1 + .../bz562833-chrooted-named-file-contexts/main.fmf | 1 + selinux-policy/caddy-and-similar/main.fmf | 1 + selinux-policy/cups-pdf-and-similar/main.fmf | 1 + selinux-policy/deny-rules/runtest.sh | 4 ++-- selinux-policy/dhcpcd-and-similar/main.fmf | 1 + selinux-policy/exim-and-similar/main.fmf | 1 + selinux-policy/hostapd-and-similar/main.fmf | 1 + selinux-policy/iio-sensor-proxy-and-similar/runtest.sh | 7 ++++--- selinux-policy/install-uninstall-dsp-packages/main.fmf | 1 + selinux-policy/interface-definitions/main.fmf | 1 + selinux-policy/kerberos-and-similar/runtest.sh | 1 + selinux-policy/kernel-confined-exec/main.fmf | 1 + selinux-policy/ksm-and-similar/runtest.sh | 7 +++++-- selinux-policy/libvirt-dbus-and-similar/main.fmf | 1 + selinux-policy/logwatch-and-similar/runtest.sh | 10 +++++++--- selinux-policy/pcp-daemons-and-similar/main.fmf | 1 + .../restorecond-fcontext-equivalences/main.fmf | 1 + selinux-policy/rpm-suppress-stderr/main.fmf | 1 + selinux-policy/rpmdb-and-similar/main.fmf | 1 + selinux-policy/rsyslog-and-similar/main.fmf | 1 + selinux-policy/snapd-and-similar/main.fmf | 1 + selinux-policy/systemd-creds/main.fmf | 1 + selinux-policy/systemd-generators/main.fmf | 1 + selinux-policy/systemd-notify-and-similar/main.fmf | 1 + selinux-policy/valkey-and-similar/main.fmf | 1 + selinux-policy/virt-install-additional/main.fmf | 1 + selinux-policy/virtualization-daemons/main.fmf | 1 + setools/apol/main.fmf | 3 +-- setools/rebuild-from-srpm/main.fmf | 1 + 57 files changed, 82 insertions(+), 18 deletions(-) diff --git a/kernel/labeled-cephfs/main.fmf b/kernel/labeled-cephfs/main.fmf index c25a15c..e4e3ded 100644 --- a/kernel/labeled-cephfs/main.fmf +++ b/kernel/labeled-cephfs/main.fmf @@ -7,6 +7,7 @@ duration: 30m tier: 2 tag: - failinfedora + - avoidImageMode adjust: - enabled: false when: distro < rhel-8 diff --git a/kernel/ocontext-race/main.fmf b/kernel/ocontext-race/main.fmf index 8add542..2748fbd 100644 --- a/kernel/ocontext-race/main.fmf +++ b/kernel/ocontext-race/main.fmf @@ -23,3 +23,5 @@ extra-hardware: | link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1969344 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2040196 +tag: + - avoidImageMode diff --git a/kernel/xfrm-refcount-underflow/main.fmf b/kernel/xfrm-refcount-underflow/main.fmf index 3d3be6f..b0db0ea 100644 --- a/kernel/xfrm-refcount-underflow/main.fmf +++ b/kernel/xfrm-refcount-underflow/main.fmf @@ -7,6 +7,8 @@ contact: Ondrej Mosnacek component: - kernel framework: beakerlib +recommend: + - systemtap duration: 15m tier: 2 enabled: true diff --git a/libsemanage/semanage-root-on-nfs/main.fmf b/libsemanage/semanage-root-on-nfs/main.fmf index 5a4de5b..e4bf5a7 100644 --- a/libsemanage/semanage-root-on-nfs/main.fmf +++ b/libsemanage/semanage-root-on-nfs/main.fmf @@ -9,6 +9,7 @@ duration: 10m enabled: true tag: - NoRHIVOS + - avoidImageMode link: - verifies: https://issues.redhat.com/browse/RHEL-60503 extra-nitrate: TC#0617969 diff --git a/libsemanage/semanage-seuser-functions/main.fmf b/libsemanage/semanage-seuser-functions/main.fmf index be3d129..0924387 100644 --- a/libsemanage/semanage-seuser-functions/main.fmf +++ b/libsemanage/semanage-seuser-functions/main.fmf @@ -19,6 +19,7 @@ tag: - f33friendly - rhel8-buildroot - targeted + - avoidImageMode adjust: - enabled: false when: distro == rhel-4, rhel-5 diff --git a/libsemanage/usepasswd-in-semanage-conf/main.fmf b/libsemanage/usepasswd-in-semanage-conf/main.fmf index 3a32954..55d9502 100644 --- a/libsemanage/usepasswd-in-semanage-conf/main.fmf +++ b/libsemanage/usepasswd-in-semanage-conf/main.fmf @@ -22,6 +22,7 @@ tag: - NoRHEL4 - NoRHEL5 - targeted + - avoidImageMode link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1871786 adjust: diff --git a/libsepol/sepol_check_context/main.fmf b/libsepol/sepol_check_context/main.fmf index 81de590..0f0a82b 100644 --- a/libsepol/sepol_check_context/main.fmf +++ b/libsepol/sepol_check_context/main.fmf @@ -19,6 +19,7 @@ tag: - f32friendly - f33friendly - targeted + - avoidImageMode tier: 1 adjust: - enabled: false diff --git a/mcstrans/internal-examples-testsuite/main.fmf b/mcstrans/internal-examples-testsuite/main.fmf index 85aea97..0ee1be6 100644 --- a/mcstrans/internal-examples-testsuite/main.fmf +++ b/mcstrans/internal-examples-testsuite/main.fmf @@ -26,6 +26,7 @@ tag: - f32friendly - f33friendly - targeted + - avoidImageMode link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1656304 adjust: diff --git a/other/collect-denials/main.fmf b/other/collect-denials/main.fmf index 61b0c0d..6d6aa03 100644 --- a/other/collect-denials/main.fmf +++ b/other/collect-denials/main.fmf @@ -10,3 +10,4 @@ duration: 5m enabled: true tag: - failinfedora + - avoidImageMode diff --git a/other/update-packages/main.fmf b/other/update-packages/main.fmf index 2c54741..179a2e4 100644 --- a/other/update-packages/main.fmf +++ b/other/update-packages/main.fmf @@ -4,4 +4,5 @@ test: ./runtest.sh framework: beakerlib duration: 15m enabled: true - +tag: + - avoidImageMode diff --git a/policycoreutils/fixfiles-F-B-N/main.fmf b/policycoreutils/fixfiles-F-B-N/main.fmf index be30bd5..ace6639 100644 --- a/policycoreutils/fixfiles-F-B-N/main.fmf +++ b/policycoreutils/fixfiles-F-B-N/main.fmf @@ -6,3 +6,5 @@ component: extra-summary: /CoreOS/policycoreutils/Sanity/fixfiles-F-B-N extra-task: /CoreOS/policycoreutils/Sanity/fixfiles-F-B-N id: d70961fa-6c8b-442d-9706-c8ef47969685 +tag: + - avoidImageMode diff --git a/policycoreutils/linux-system-roles.selinux-tests/main.fmf b/policycoreutils/linux-system-roles.selinux-tests/main.fmf index 73aaefc..6498f6d 100644 --- a/policycoreutils/linux-system-roles.selinux-tests/main.fmf +++ b/policycoreutils/linux-system-roles.selinux-tests/main.fmf @@ -12,6 +12,7 @@ recommend: duration: 40m tag: - NoRHIVOS + - avoidImageMode extra-summary: linux-system-roles.selinux-tests extra-task: linux-system-roles.selinux-tests id: 4889350b-d9fa-4cbf-86ff-f16a1c729f9e diff --git a/policycoreutils/load_policy/main.fmf b/policycoreutils/load_policy/main.fmf index 391e40d..764cadc 100644 --- a/policycoreutils/load_policy/main.fmf +++ b/policycoreutils/load_policy/main.fmf @@ -22,6 +22,7 @@ tag: - f33friendly - failinrhel8ci - targeted + - avoidImageMode tier: 1 adjust: - enabled: false diff --git a/policycoreutils/org-selinux-dbus-interfaces/main.fmf b/policycoreutils/org-selinux-dbus-interfaces/main.fmf index a9f924f..93c052d 100644 --- a/policycoreutils/org-selinux-dbus-interfaces/main.fmf +++ b/policycoreutils/org-selinux-dbus-interfaces/main.fmf @@ -21,6 +21,7 @@ tag: - f32friendly - f33friendly - targeted + - avoidImageMode link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1415988 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1754873 diff --git a/policycoreutils/python-module-precedence-issue/main.fmf b/policycoreutils/python-module-precedence-issue/main.fmf index 7564e9e..b3c1807 100644 --- a/policycoreutils/python-module-precedence-issue/main.fmf +++ b/policycoreutils/python-module-precedence-issue/main.fmf @@ -20,6 +20,7 @@ tag: - f32friendly - f33friendly - targeted + - avoidImageMode tier: 1 link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2128976 diff --git a/policycoreutils/restorecon/main.fmf b/policycoreutils/restorecon/main.fmf index 75f61cb..e20ff1f 100644 --- a/policycoreutils/restorecon/main.fmf +++ b/policycoreutils/restorecon/main.fmf @@ -36,6 +36,7 @@ tag: - f31friendly - f32friendly - targeted + - avoidImageMode tier: 1 link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=739587 diff --git a/policycoreutils/restorecond_pointer_abuse/main.fmf b/policycoreutils/restorecond_pointer_abuse/main.fmf index 7a6d450..4dffd53 100644 --- a/policycoreutils/restorecond_pointer_abuse/main.fmf +++ b/policycoreutils/restorecond_pointer_abuse/main.fmf @@ -23,3 +23,5 @@ adjust: - enabled: false when: distro < rhel-7 id: a900e46c-6cf9-49e1-9625-5beb609760c5 +tag: + - avoidImageMode diff --git a/policycoreutils/sctp_test/main.fmf b/policycoreutils/sctp_test/main.fmf index 9b5ed69..8b2d0ea 100644 --- a/policycoreutils/sctp_test/main.fmf +++ b/policycoreutils/sctp_test/main.fmf @@ -15,3 +15,5 @@ link: extra-summary: /selinux/policycoreutils/sctp_test extra-task: /selinux/policycoreutils/sctp_test extra-nitrate: TC#0614834 +tag: + - avoidImageMode diff --git a/policycoreutils/semanage-interface/main.fmf b/policycoreutils/semanage-interface/main.fmf index 2229388..adc896b 100644 --- a/policycoreutils/semanage-interface/main.fmf +++ b/policycoreutils/semanage-interface/main.fmf @@ -19,8 +19,8 @@ tag: - TierCandidatesPASS - f32friendly - f33friendly - - rhel-7.0 - targeted + - avoidImageMode tier: 1 link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=953826 diff --git a/policycoreutils/semanage-login/main.fmf b/policycoreutils/semanage-login/main.fmf index 0dbe091..9b56fa1 100644 --- a/policycoreutils/semanage-login/main.fmf +++ b/policycoreutils/semanage-login/main.fmf @@ -20,8 +20,8 @@ tag: - TierCandidatesPASS - f32friendly - f33friendly - - rhel-7.0 - targeted + - avoidImageMode tier: 1 link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=953826 diff --git a/policycoreutils/semanage-port-add-delete-problems/main.fmf b/policycoreutils/semanage-port-add-delete-problems/main.fmf index 43aece3..f9c20d5 100644 --- a/policycoreutils/semanage-port-add-delete-problems/main.fmf +++ b/policycoreutils/semanage-port-add-delete-problems/main.fmf @@ -18,3 +18,5 @@ duration: 15m extra-summary: /CoreOS/policycoreutils/Regression/semanage-port-add-delete-problems extra-task: /CoreOS/policycoreutils/Regression/semanage-port-add-delete-problems id: 3db01ce3-7cf2-4f3a-9b71-412d7cd7ce64 +tag: + - avoidImageMode diff --git a/policycoreutils/semanage-user/main.fmf b/policycoreutils/semanage-user/main.fmf index 5c58c0d..05e6aa5 100644 --- a/policycoreutils/semanage-user/main.fmf +++ b/policycoreutils/semanage-user/main.fmf @@ -21,8 +21,8 @@ tag: - TierCandidatesPASS - f32friendly - f33friendly - - rhel-7.0 - targeted + - avoidImageMode tier: 1 link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=953826 diff --git a/policycoreutils/semodule-rebuild-if-modules-changed/runtest.sh b/policycoreutils/semodule-rebuild-if-modules-changed/runtest.sh index b87505c..2e658ed 100755 --- a/policycoreutils/semodule-rebuild-if-modules-changed/runtest.sh +++ b/policycoreutils/semodule-rebuild-if-modules-changed/runtest.sh @@ -7,7 +7,11 @@ # Include Beakerlib environment . /usr/share/beakerlib/beakerlib.sh || exit 1 -STORE_ROOT=/var/lib/selinux +if grep -q ^store-root /etc/selinux/semanage.conf + STORE_ROOT=`grep ^store-root /etc/selinux/semanage.conf | cut -d = -f 2` +else + STORE_ROOT=/var/lib/selinux +fi STORE_TYPE=targeted MODULES_ROOT="$STORE_ROOT/$STORE_TYPE/active/modules" STORE_POLICY="$STORE_ROOT/$STORE_TYPE/active/policy.kern" diff --git a/policycoreutils/sepolicy-generate/main.fmf b/policycoreutils/sepolicy-generate/main.fmf index 0bc1144..3bd18e5 100644 --- a/policycoreutils/sepolicy-generate/main.fmf +++ b/policycoreutils/sepolicy-generate/main.fmf @@ -19,6 +19,7 @@ tag: - f31friendly - f32friendly - targeted + - avoidImageMode tier: 3 link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1271324 diff --git a/policycoreutils/setsebool/main.fmf b/policycoreutils/setsebool/main.fmf index 8ad08b5..1d0b2b4 100644 --- a/policycoreutils/setsebool/main.fmf +++ b/policycoreutils/setsebool/main.fmf @@ -24,6 +24,7 @@ tag: - f33friendly - failinrhel8ci - targeted + - avoidImageMode tier: 1 link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1002529 diff --git a/selinux-policy/blueman-and-similar/main.fmf b/selinux-policy/blueman-and-similar/main.fmf index 3856db9..39bff7e 100644 --- a/selinux-policy/blueman-and-similar/main.fmf +++ b/selinux-policy/blueman-and-similar/main.fmf @@ -37,7 +37,7 @@ link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2027044 adjust: - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7, rhel-8, rhel-9, centos-stream-8, centos-stream-9 + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7, rhel-8, rhel-9, centos-stream-8, centos-stream-9, rhel-10, centos-stream-10 because: the blueman package is not available there extra-nitrate: TC#0563638 extra-summary: /CoreOS/selinux-policy/Regression/blueman-and-similar diff --git a/selinux-policy/boothd-and-similar/main.fmf b/selinux-policy/boothd-and-similar/main.fmf index 446a168..3e43139 100644 --- a/selinux-policy/boothd-and-similar/main.fmf +++ b/selinux-policy/boothd-and-similar/main.fmf @@ -31,6 +31,7 @@ tag: - NoRHEL7 - targeted - NoRHIVOS + - avoidImageMode link: - verifies: https://issues.redhat.com/browse/RHEL-45907 - verifies: https://issues.redhat.com/browse/RHEL-57104 diff --git a/selinux-policy/bootupd-and-similar/main.fmf b/selinux-policy/bootupd-and-similar/main.fmf index cbd16ae..d892f6e 100644 --- a/selinux-policy/bootupd-and-similar/main.fmf +++ b/selinux-policy/bootupd-and-similar/main.fmf @@ -29,6 +29,7 @@ tag: - NoRHEL8 - targeted - NoRHIVOS + - avoidImageMode tier: 3 link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2029478 diff --git a/selinux-policy/bz562833-chrooted-named-file-contexts/main.fmf b/selinux-policy/bz562833-chrooted-named-file-contexts/main.fmf index 1dc4a23..5ecc85f 100644 --- a/selinux-policy/bz562833-chrooted-named-file-contexts/main.fmf +++ b/selinux-policy/bz562833-chrooted-named-file-contexts/main.fmf @@ -33,6 +33,7 @@ tag: - f32friendly - targeted - NoRHIVOS + - avoidImageMode link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=451970 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=562833 diff --git a/selinux-policy/caddy-and-similar/main.fmf b/selinux-policy/caddy-and-similar/main.fmf index be06a73..57f9b9c 100644 --- a/selinux-policy/caddy-and-similar/main.fmf +++ b/selinux-policy/caddy-and-similar/main.fmf @@ -28,6 +28,7 @@ tag: - rhel8-epel - rhel9-epel - NoRHIVOS + - avoidImageMode adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, centos-stream-10, rhel-10 diff --git a/selinux-policy/cups-pdf-and-similar/main.fmf b/selinux-policy/cups-pdf-and-similar/main.fmf index f83fbee..2589357 100644 --- a/selinux-policy/cups-pdf-and-similar/main.fmf +++ b/selinux-policy/cups-pdf-and-similar/main.fmf @@ -36,6 +36,7 @@ tag: - rhel8-epel - rhel9-epel - NoRHIVOS + - avoidImageMode link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=560220 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=563977 diff --git a/selinux-policy/deny-rules/runtest.sh b/selinux-policy/deny-rules/runtest.sh index 3464738..2fb86c6 100755 --- a/selinux-policy/deny-rules/runtest.sh +++ b/selinux-policy/deny-rules/runtest.sh @@ -118,12 +118,12 @@ rlJournalStart rlRun "echo -e '( deny ${USER_TYPE} ${USER_TYPE} ( system ( module_load module_request )))' > testpolicy.cil" rlRun "echo -e '( deny kmod_t kmod_t ( system ( module_load module_request )))' >> testpolicy.cil" rlRun "echo -e '( deny kmod_t modules_object_t ( system ( module_load )))' >> testpolicy.cil" - rlRun "semodule -i testpolicy.cil" + rlRun "semodule -i testpolicy.cil" rlRun "semodule -lfull | grep testpolicy" rlRun -s "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost modprobe dummy" rlRun "grep -i 'permission denied' $rlRun_LOG" rm -f $rlRun_LOG - rlRun "lsmod | grep dummy" 1 + rlRun "lsmod | grep ^dummy" 1 rlRun "semodule -r testpolicy" rlRun "modprobe dummy" rlRun "lsmod | grep dummy" diff --git a/selinux-policy/dhcpcd-and-similar/main.fmf b/selinux-policy/dhcpcd-and-similar/main.fmf index 6592423..b2cbd84 100644 --- a/selinux-policy/dhcpcd-and-similar/main.fmf +++ b/selinux-policy/dhcpcd-and-similar/main.fmf @@ -28,6 +28,7 @@ tag: - NoRHEL6 - targeted - NoRHIVOS + - avoidImageMode link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1585971 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1602343 diff --git a/selinux-policy/exim-and-similar/main.fmf b/selinux-policy/exim-and-similar/main.fmf index a16d8f5..e480e0a 100644 --- a/selinux-policy/exim-and-similar/main.fmf +++ b/selinux-policy/exim-and-similar/main.fmf @@ -37,6 +37,7 @@ tag: - rhel9-epel - rhel10-epel - NoRHIVOS + - avoidImageMode link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1025315 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1444441 diff --git a/selinux-policy/hostapd-and-similar/main.fmf b/selinux-policy/hostapd-and-similar/main.fmf index aa3ac7a..8879021 100644 --- a/selinux-policy/hostapd-and-similar/main.fmf +++ b/selinux-policy/hostapd-and-similar/main.fmf @@ -32,6 +32,7 @@ tag: - failinfedora - targeted - NoRHIVOS + - avoidImageMode link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1224405 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1225245 diff --git a/selinux-policy/iio-sensor-proxy-and-similar/runtest.sh b/selinux-policy/iio-sensor-proxy-and-similar/runtest.sh index 041e959..224e218 100755 --- a/selinux-policy/iio-sensor-proxy-and-similar/runtest.sh +++ b/selinux-policy/iio-sensor-proxy-and-similar/runtest.sh @@ -56,7 +56,7 @@ rlJournalStart rlRun "rpm -qf ${FILE_PATH}" rlServiceStop ${SERVICE_NAME} - rlFileBackup /usr/lib/systemd/system/iio-sensor-proxy.service + rlFileBackup /etc/systemd/system/iio-sensor-proxy.service rlServiceStart gdm rlSESetEnforce @@ -76,11 +76,12 @@ rlJournalStart if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" - rlRun "sed -i 's/^.*Environment=.*$/Environment=FAKE_COMPASS=1/' /usr/lib/systemd/system/iio-sensor-proxy.service" + rlRun "cp -f /usr/lib/systemd/system/iio-sensor-proxy.service /etc/systemd/system/" + rlRun "sed -i 's/^.*Environment=.*$/Environment=FAKE_COMPASS=1/' /etc/systemd/system/iio-sensor-proxy.service" rlRun "systemctl daemon-reload" rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 - rlRun "sed -i 's/^.*Environment=.*$/Environment=FAKE_LIGHT_SENSOR=1/' /usr/lib/systemd/system/iio-sensor-proxy.service" + rlRun "sed -i 's/^.*Environment=.*$/Environment=FAKE_LIGHT_SENSOR=1/' /etc/systemd/system/iio-sensor-proxy.service" rlRun "systemctl daemon-reload" rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status" 1 rlRun "gdbus introspect --system --dest net.hadess.SensorProxy --object-path /net/hadess/SensorProxy" diff --git a/selinux-policy/install-uninstall-dsp-packages/main.fmf b/selinux-policy/install-uninstall-dsp-packages/main.fmf index 7fee6cc..4943936 100644 --- a/selinux-policy/install-uninstall-dsp-packages/main.fmf +++ b/selinux-policy/install-uninstall-dsp-packages/main.fmf @@ -30,6 +30,7 @@ tag: - NoRHIVOS - rhel9_broken - rhel10_broken + - avoidImageMode link: adjust: - enabled: false diff --git a/selinux-policy/interface-definitions/main.fmf b/selinux-policy/interface-definitions/main.fmf index 1d96ce5..b51e068 100644 --- a/selinux-policy/interface-definitions/main.fmf +++ b/selinux-policy/interface-definitions/main.fmf @@ -18,6 +18,7 @@ tag: - targeted - failinfedora - NoRHIVOS + - avoidImageMode link: - verifies: https://issues.redhat.com/browse/RHEL-2616 - verifies: https://issues.redhat.com/browse/RHEL-16185 diff --git a/selinux-policy/kerberos-and-similar/runtest.sh b/selinux-policy/kerberos-and-similar/runtest.sh index 5ba7389..c8b16a2 100755 --- a/selinux-policy/kerberos-and-similar/runtest.sh +++ b/selinux-policy/kerberos-and-similar/runtest.sh @@ -198,6 +198,7 @@ rlJournalStart fi rlPhaseStartTest "real scenario for kpropd" + rlRun "mkdir -p /var/kerberos/krb5kdc" rlRun "touch /var/kerberos/krb5kdc/kpropd.acl" rlRun "rm -f /etc/krb5.conf" rlRun "cp ./krb5.conf /etc" diff --git a/selinux-policy/kernel-confined-exec/main.fmf b/selinux-policy/kernel-confined-exec/main.fmf index e2c42b9..cb38a23 100644 --- a/selinux-policy/kernel-confined-exec/main.fmf +++ b/selinux-policy/kernel-confined-exec/main.fmf @@ -33,3 +33,4 @@ extra-nitrate: TC#0614676 id: 4400999a-aa60-4522-b0f7-d7b0656110a3 tag: - NoRHIVOS + - avoidImageMode diff --git a/selinux-policy/ksm-and-similar/runtest.sh b/selinux-policy/ksm-and-similar/runtest.sh index 29d93d9..b4533f0 100755 --- a/selinux-policy/ksm-and-similar/runtest.sh +++ b/selinux-policy/ksm-and-similar/runtest.sh @@ -51,7 +51,7 @@ rlJournalStart rlRun "rpm -qf ${FILE_PATH}" rlServiceStop ${SERVICE_NAME} - rlFileBackup /usr/lib/systemd/system/ksm.service + rlFileBackup /etc/systemd/system/ksm.service rlSESetEnforce rlSEStatus @@ -79,16 +79,19 @@ rlJournalStart rlPhaseEnd fi + if [ -f /usr/lib/systemd/system/ksm.service ] ; then rlPhaseStartTest "real scenario -- standalone service" if ! rlSEDefined ${PROCESS_CONTEXT} ; then PROCESS_CONTEXT="unconfined_service_t" fi - rlRun "sed -i 's/^ConditionVirtualization=.*$//' /usr/lib/systemd/system/ksm.service" + rlRun "cp -f /usr/lib/systemd/system/ksm.service /etc/systemd/system/" + rlRun "sed -i 's/^ConditionVirtualization=.*$//' /etc/systemd/system/ksm.service" rlRun "systemctl daemon-reload" rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "start status" 1 rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd + fi rlPhaseStartCleanup sleep 2 diff --git a/selinux-policy/libvirt-dbus-and-similar/main.fmf b/selinux-policy/libvirt-dbus-and-similar/main.fmf index 9115a73..a039ecc 100644 --- a/selinux-policy/libvirt-dbus-and-similar/main.fmf +++ b/selinux-policy/libvirt-dbus-and-similar/main.fmf @@ -28,6 +28,7 @@ tag: - NoRHEL7 - targeted - NoRHIVOS + - avoidImageMode link: - verifies: https://issues.redhat.com/browse/RHEL-46893 - verifies: https://issues.redhat.com/browse/RHEL-73914 diff --git a/selinux-policy/logwatch-and-similar/runtest.sh b/selinux-policy/logwatch-and-similar/runtest.sh index c3321f1..bb60374 100755 --- a/selinux-policy/logwatch-and-similar/runtest.sh +++ b/selinux-policy/logwatch-and-similar/runtest.sh @@ -45,7 +45,7 @@ rlJournalStart rlAssertRpm ${SERVICE_PACKAGE} rlServiceStop ${SERVICE_NAME} - rlFileBackup /usr/lib/systemd/system/logwatch.timer + rlFileBackup /etc/systemd/system/logwatch.timer rlSESetEnforce rlSEStatus @@ -75,27 +75,31 @@ rlJournalStart fi rlPhaseStartTest "real scenario -- standalone service" + rlRun "mkdir -p /var/cache/logwatch" if ! rlSEDefined ${PROCESS_CONTEXT} ; then # for environments where the SELinux domain does not exist yet PROCESS_CONTEXT="unconfined_service_t" fi rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "start status" 1 - rlRun "restorecon -Rv /var /run -e /var/ARTIFACTS" 0-255 + rlRun "restorecon -Rv /etc /var /run -e /var/ARTIFACTS" 0-255 rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.timer ] ; then rlPhaseStartTest "real scenario -- timer" rlRun "systemctl enable ${SERVICE_NAME}.timer" rlRun "systemctl start ${SERVICE_NAME}.timer" rlRun "systemctl list-timers --all" NEXT_TIME=`date -d "now + 1 minute" "+%H:%M"` - rlRun "sed -i 's/AccuracySec=.*$/AccuracySec=1s\nOnCalendar=*-*-* $NEXT_TIME/' /usr/lib/systemd/system/${SERVICE_NAME}.timer" + rlRun "cp -f /usr/lib/systemd/system/${SERVICE_NAME}.timer /etc/systemd/system/" + rlRun "sed -i 's/AccuracySec=.*$/AccuracySec=1s\nOnCalendar=*-*-* $NEXT_TIME/' /etc/systemd/system/${SERVICE_NAME}.timer" rlRun "systemctl daemon-reload" rlRun "systemctl list-timers --all" rlRun "sleep 2m" rlRun "systemctl stop ${SERVICE_NAME}.timer" rlRun "systemctl disable ${SERVICE_NAME}.timer" rlPhaseEnd + fi rlPhaseStartCleanup sleep 2 diff --git a/selinux-policy/pcp-daemons-and-similar/main.fmf b/selinux-policy/pcp-daemons-and-similar/main.fmf index 960c4e5..f03984c 100644 --- a/selinux-policy/pcp-daemons-and-similar/main.fmf +++ b/selinux-policy/pcp-daemons-and-similar/main.fmf @@ -35,6 +35,7 @@ tag: - failinfedora - targeted - NoRHIVOS + - avoidImageMode link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1028598 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1061159 diff --git a/selinux-policy/restorecond-fcontext-equivalences/main.fmf b/selinux-policy/restorecond-fcontext-equivalences/main.fmf index dbdcdf1..771533d 100644 --- a/selinux-policy/restorecond-fcontext-equivalences/main.fmf +++ b/selinux-policy/restorecond-fcontext-equivalences/main.fmf @@ -21,6 +21,7 @@ tag: - NoRHEL7 - targeted - NoRHIVOS + - avoidImageMode link: - verifies: https://issues.redhat.com/browse/RHEL-5032 adjust: diff --git a/selinux-policy/rpm-suppress-stderr/main.fmf b/selinux-policy/rpm-suppress-stderr/main.fmf index f2e0832..b86deaa 100644 --- a/selinux-policy/rpm-suppress-stderr/main.fmf +++ b/selinux-policy/rpm-suppress-stderr/main.fmf @@ -11,6 +11,7 @@ duration: 10m enabled: true tag: - NoRHIVOS + - avoidImageMode link: - https://issues.redhat.com/browse/RHEL-59192 adjust: diff --git a/selinux-policy/rpmdb-and-similar/main.fmf b/selinux-policy/rpmdb-and-similar/main.fmf index 0b2d45a..af883fa 100644 --- a/selinux-policy/rpmdb-and-similar/main.fmf +++ b/selinux-policy/rpmdb-and-similar/main.fmf @@ -30,6 +30,7 @@ tag: - NoRHEL8 - targeted - NoRHIVOS + - avoidImageMode link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1461313 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1899548 diff --git a/selinux-policy/rsyslog-and-similar/main.fmf b/selinux-policy/rsyslog-and-similar/main.fmf index ac991cb..e1e0924 100644 --- a/selinux-policy/rsyslog-and-similar/main.fmf +++ b/selinux-policy/rsyslog-and-similar/main.fmf @@ -31,6 +31,7 @@ tag: - NoRHEL4 - targeted - NoRHIVOS + - avoidImageMode link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1823669 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1823672 diff --git a/selinux-policy/snapd-and-similar/main.fmf b/selinux-policy/snapd-and-similar/main.fmf index 2fe0e0f..1507e52 100644 --- a/selinux-policy/snapd-and-similar/main.fmf +++ b/selinux-policy/snapd-and-similar/main.fmf @@ -36,6 +36,7 @@ tag: - rhel9_broken - rhel10_broken - NoRHIVOS + - avoidImageMode link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2207725 adjust: diff --git a/selinux-policy/systemd-creds/main.fmf b/selinux-policy/systemd-creds/main.fmf index ba11ac5..168e9a8 100644 --- a/selinux-policy/systemd-creds/main.fmf +++ b/selinux-policy/systemd-creds/main.fmf @@ -23,6 +23,7 @@ enabled: true tag: - targeted - NoRHIVOS + - avoidImageMode tier: 2 adjust: - enabled: false diff --git a/selinux-policy/systemd-generators/main.fmf b/selinux-policy/systemd-generators/main.fmf index ee5326b..a037266 100644 --- a/selinux-policy/systemd-generators/main.fmf +++ b/selinux-policy/systemd-generators/main.fmf @@ -31,6 +31,7 @@ tag: - f32friendly - targeted - NoRHIVOS + - avoidImageMode link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2230226 - verifies: https://issues.redhat.com/browse/RHEL-72549 diff --git a/selinux-policy/systemd-notify-and-similar/main.fmf b/selinux-policy/systemd-notify-and-similar/main.fmf index 04933f1..294c863 100644 --- a/selinux-policy/systemd-notify-and-similar/main.fmf +++ b/selinux-policy/systemd-notify-and-similar/main.fmf @@ -31,6 +31,7 @@ tag: - NoRHEL7 - targeted - NoRHIVOS + - avoidImageMode tier: 2 link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1903305 diff --git a/selinux-policy/valkey-and-similar/main.fmf b/selinux-policy/valkey-and-similar/main.fmf index 110f6a2..6fd1b47 100644 --- a/selinux-policy/valkey-and-similar/main.fmf +++ b/selinux-policy/valkey-and-similar/main.fmf @@ -31,6 +31,7 @@ tag: - Tier3 - Tier3se - NoRHIVOS + - avoidImageMode adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 diff --git a/selinux-policy/virt-install-additional/main.fmf b/selinux-policy/virt-install-additional/main.fmf index 7cf0d61..c0e5f85 100644 --- a/selinux-policy/virt-install-additional/main.fmf +++ b/selinux-policy/virt-install-additional/main.fmf @@ -37,6 +37,7 @@ tag: - targeted - failinfedora - NoRHIVOS + - avoidImageMode link: - verifies: https://issues.redhat.com/browse/RHEL-56029 - verifies: https://issues.redhat.com/browse/RHEL-65038 diff --git a/selinux-policy/virtualization-daemons/main.fmf b/selinux-policy/virtualization-daemons/main.fmf index 2716b7e..f30e275 100644 --- a/selinux-policy/virtualization-daemons/main.fmf +++ b/selinux-policy/virtualization-daemons/main.fmf @@ -48,6 +48,7 @@ tag: - targeted - failinfedora - NoRHIVOS + - avoidImageMode adjust: - enabled: false when: distro < centos-stream-9 diff --git a/setools/apol/main.fmf b/setools/apol/main.fmf index 199523b..7714c25 100644 --- a/setools/apol/main.fmf +++ b/setools/apol/main.fmf @@ -25,12 +25,11 @@ tag: - NoRHEL6 - NoRHEL7 - targeted - - rhel10_broken link: - relates: https://issues.redhat.com/browse/RHEL-29967 adjust: - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-10 continue: false extra-summary: /CoreOS/setools/Sanity/apol extra-task: /CoreOS/setools/Sanity/apol diff --git a/setools/rebuild-from-srpm/main.fmf b/setools/rebuild-from-srpm/main.fmf index 01286da..78a4763 100644 --- a/setools/rebuild-from-srpm/main.fmf +++ b/setools/rebuild-from-srpm/main.fmf @@ -21,6 +21,7 @@ tag: - NoRHEL6 - NoRHEL7 - targeted + - avoidImageMode link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2251915 - verifies: https://issues.redhat.com/browse/RHEL-18067 From 36d28b09f5d50849e0488079e1f0bbd85e729261 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Thu, 2 Oct 2025 13:58:11 +0200 Subject: [PATCH 554/626] fix a syntax error A syntax error appears when the following test is executed: * policycoreutils/semodule-rebuild-if-modules-changed The problem is a missing "then" word in the test code. --- policycoreutils/semodule-rebuild-if-modules-changed/runtest.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/policycoreutils/semodule-rebuild-if-modules-changed/runtest.sh b/policycoreutils/semodule-rebuild-if-modules-changed/runtest.sh index 2e658ed..8291323 100755 --- a/policycoreutils/semodule-rebuild-if-modules-changed/runtest.sh +++ b/policycoreutils/semodule-rebuild-if-modules-changed/runtest.sh @@ -7,7 +7,7 @@ # Include Beakerlib environment . /usr/share/beakerlib/beakerlib.sh || exit 1 -if grep -q ^store-root /etc/selinux/semanage.conf +if grep -q ^store-root /etc/selinux/semanage.conf ; then STORE_ROOT=`grep ^store-root /etc/selinux/semanage.conf | cut -d = -f 2` else STORE_ROOT=/var/lib/selinux From 33fd7a4bdf37bac5ed64ec9a2e42d1bea791ba4c Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Thu, 9 Oct 2025 18:16:05 +0200 Subject: [PATCH 555/626] Increase the time limit when testing RHIVOS preload The preload scripts cause all tests to take significantly longer than usual, often triggering timeouts with current time limits. Increase the time limit to 1500%. https://issues.redhat.com/browse/VROOM-29315 Usage: tmt -c rhivos_preload=true run or context: rhivos_preload: true --- main.fmf | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/main.fmf b/main.fmf index 764dffa..94ef62f 100644 --- a/main.fmf +++ b/main.fmf @@ -34,3 +34,7 @@ tags: [generic] /setools: component: setools + +adjust+: + - duration+: '*15' + when: rhivos_preload is defined and rhivos_preload == true From caa904c01f069e8ce1398404a3c87508cd0292f0 Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Thu, 9 Oct 2025 18:17:00 +0200 Subject: [PATCH 556/626] Fix "adjust" statements Whenever a key is defined in the tmt hierarchy and some child also defines that key, the child's will overwrite the previous one. The "+" changes the operation to "append", so the content of key+ in the child is added to the existing key. Meaning that any "adjust" statement in a test plan using a test that defines it's own "adjust:" is ignored. Since we are expecting other statements to be appended to the "adjust" sections, the content of each section needs to be a single list item as opposed to a set of key-value pairs (first line needs to start with a hyphen). - Replace all "adjust:" sections with "adjust+:" in order to honor any adjustments further up the tree (parent tests, or test plans). - Fix malformed "adjust" sections (sets of key-value pairs) Signed-off-by: Vit Mojzis --- checkpolicy/checkmodule/main.fmf | 2 +- checkpolicy/checkpolicy-docs/main.fmf | 2 +- checkpolicy/checkpolicy/main.fmf | 2 +- checkpolicy/sedismod/main.fmf | 2 +- checkpolicy/sedispol/main.fmf | 2 +- kernel/avc_log_actual_context_if_invalid/main.fmf | 2 +- kernel/avc_tracepoint/main.fmf | 2 +- kernel/bogus-warning-in-selinux_ima_measure_state/main.fmf | 2 +- kernel/connect_AF_UNSPEC/main.fmf | 2 +- kernel/genfs_fallback/main.fmf | 2 +- kernel/journald_performance/main.fmf | 2 +- kernel/keycreate_empty_value/main.fmf | 2 +- kernel/labeled-cephfs/main.fmf | 2 +- kernel/labeling_before_policy_load/main.fmf | 2 +- kernel/mount-options-memleak/main.fmf | 4 ++-- kernel/netlabel-leaves-nops-in-packets/main.fmf | 4 ++-- kernel/netlabel_many_ifaces/main.fmf | 4 ++-- kernel/ocontext-race/main.fmf | 2 +- kernel/sctp_peeloff_corner_case/main.fmf | 2 +- kernel/sctp_peer_label_bug/main.fmf | 2 +- kernel/selinux-testsuite/main.fmf | 2 +- kernel/setsebool-deadlock/main.fmf | 2 +- kernel/synflood/main.fmf | 2 +- kernel/wrong-rules-after-setsebool/main.fmf | 4 ++-- kernel/xfrm-refcount-underflow/main.fmf | 4 ++-- libselinux/get_default_context/main.fmf | 2 +- libselinux/getpolicyload/main.fmf | 2 +- libselinux/getsebool/main.fmf | 2 +- libselinux/realpath_not_final-function/main.fmf | 2 +- libselinux/selabel-functions/main.fmf | 2 +- libselinux/selabel_lookup-and-local-changes/main.fmf | 2 +- libselinux/selinux_boolean_sub-function/main.fmf | 2 +- libselinux/selinux_restorecon-functions/main.fmf | 2 +- libselinux/selinux_sestatus-functions/main.fmf | 2 +- libselinux/selinux_set_callback/main.fmf | 2 +- libselinux/setenforce/main.fmf | 2 +- libselinux/validatetrans/main.fmf | 2 +- libsemanage/cross-device-link-in-containers/main.fmf | 2 +- libsemanage/sanity-tests/main.fmf | 2 +- libsemanage/semanage-handle-functions/main.fmf | 2 +- libsemanage/semanage-seuser-functions/main.fmf | 2 +- libsemanage/usepasswd-in-semanage-conf/main.fmf | 2 +- libsemanage/verify-options-in-semanage-conf/main.fmf | 2 +- libsepol/self-keyword-in-type-rules/main.fmf | 2 +- libsepol/sepol_check_context/main.fmf | 2 +- .../bz442327-setfscreatecon-with-invalid-context/main.fmf | 2 +- mcstrans/internal-examples-testsuite/main.fmf | 2 +- .../mcstrans-daemon-segfaults-when-using-secon-C/main.fmf | 2 +- other/mounting/main.fmf | 2 +- plans/failing.fmf | 2 +- plans/gating.fmf | 2 +- plans/notier.fmf | 2 +- plans/tier1.fmf | 2 +- plans/tier2.fmf | 2 +- plans/tier3.fmf | 2 +- policycoreutils/CIL-modules-without-compilation/main.fmf | 2 +- policycoreutils/booleans/main.fmf | 2 +- policycoreutils/file-contexts/main.fmf | 2 +- policycoreutils/load_policy/main.fmf | 2 +- policycoreutils/modules/main.fmf | 2 +- policycoreutils/org-selinux-dbus-interfaces/main.fmf | 2 +- policycoreutils/python-module-precedence-issue/main.fmf | 2 +- policycoreutils/restorecon/main.fmf | 2 +- policycoreutils/restorecond_pointer_abuse/main.fmf | 2 +- policycoreutils/selinux-autorelabel-service/main.fmf | 2 +- policycoreutils/selinux-info/main.fmf | 2 +- policycoreutils/semanage-imports-port-defs/main.fmf | 2 +- policycoreutils/semanage-interface/main.fmf | 2 +- policycoreutils/semanage-login/main.fmf | 2 +- policycoreutils/semanage-user/main.fmf | 2 +- policycoreutils/semodule-rebuild-if-modules-changed/main.fmf | 2 +- policycoreutils/sepolicy-generate/main.fmf | 2 +- policycoreutils/sepolicy-manpage/main.fmf | 2 +- policycoreutils/sestatus/main.fmf | 2 +- policycoreutils/setfiles_binary/main.fmf | 2 +- policycoreutils/setsebool/main.fmf | 2 +- policycoreutils/spaces-in-fcontext-patterns/main.fmf | 2 +- selinux-policy/ModemManager-and-similar/main.fmf | 2 +- selinux-policy/abrt-services/main.fmf | 2 +- selinux-policy/accounts-daemon-and-similar/main.fmf | 2 +- selinux-policy/acpid-and-similar/main.fmf | 2 +- selinux-policy/anon_inode-and-similar/main.fmf | 2 +- selinux-policy/bgpd-and-similar/main.fmf | 2 +- selinux-policy/blueman-and-similar/main.fmf | 2 +- selinux-policy/boinc-and-similar/main.fmf | 2 +- selinux-policy/boltd-and-similar/main.fmf | 2 +- selinux-policy/boothd-and-similar/main.fmf | 2 +- selinux-policy/bootupd-and-similar/main.fmf | 2 +- selinux-policy/bz481628-send-msg-to-dbus/main.fmf | 2 +- .../bz533007-unable-to-start-kdump-service/main.fmf | 2 +- .../bz538089-plymouth-operations-denied-during-boot/main.fmf | 2 +- selinux-policy/bz562833-chrooted-named-file-contexts/main.fmf | 2 +- selinux-policy/bz624405-pcsc-and-similar/main.fmf | 2 +- selinux-policy/bz733494-amanda-and-similar/main.fmf | 2 +- selinux-policy/caddy-and-similar/main.fmf | 2 +- selinux-policy/capability2-class/main.fmf | 2 +- selinux-policy/chronyd-and-similar/main.fmf | 2 +- selinux-policy/cockpit-ws-and-similar/main.fmf | 2 +- selinux-policy/colord-and-similar/main.fmf | 2 +- selinux-policy/cups-browsed-and-similar/main.fmf | 2 +- selinux-policy/cups-lpd-and-similar/main.fmf | 2 +- selinux-policy/cups-pdf-and-similar/main.fmf | 2 +- selinux-policy/deny-rules/main.fmf | 2 +- selinux-policy/dhclient-and-similar/main.fmf | 2 +- selinux-policy/dhcpcd-and-similar/main.fmf | 2 +- selinux-policy/dmidecode-and-similar/main.fmf | 2 +- selinux-policy/exim-and-similar/main.fmf | 2 +- selinux-policy/fapolicyd-and-similar/main.fmf | 2 +- selinux-policy/fedora-third-party-and-similar/main.fmf | 2 +- selinux-policy/firewalld-and-similar/main.fmf | 2 +- selinux-policy/fwupd-and-similar/main.fmf | 2 +- selinux-policy/getrlimit-permission/main.fmf | 2 +- selinux-policy/gnome-remote-desktop-and-similar/main.fmf | 2 +- selinux-policy/hostapd-and-similar/main.fmf | 2 +- selinux-policy/icecast-and-similar/main.fmf | 2 +- selinux-policy/iio-sensor-proxy-and-similar/main.fmf | 2 +- selinux-policy/install-uninstall-dsp-packages/main.fmf | 2 +- selinux-policy/interface-definitions/main.fmf | 2 +- selinux-policy/journalctl-and-similar/main.fmf | 2 +- selinux-policy/kerberos-and-similar/main.fmf | 2 +- selinux-policy/kernel-confined-exec/main.fmf | 2 +- selinux-policy/ksm-and-similar/main.fmf | 2 +- selinux-policy/ladvd/main.fmf | 2 +- selinux-policy/libvirt-dbus-and-similar/main.fmf | 2 +- selinux-policy/logwatch-and-similar/main.fmf | 2 +- selinux-policy/nasd-and-similar/main.fmf | 2 +- selinux-policy/nfsdcld-and-similar/main.fmf | 2 +- selinux-policy/notself-other-keywords/main.fmf | 2 +- selinux-policy/ntpsec-and-similar/main.fmf | 2 +- selinux-policy/numad-and-similar/main.fmf | 2 +- selinux-policy/nvme-stas-and-similar/main.fmf | 2 +- selinux-policy/opensmtpd-and-similar/main.fmf | 2 +- selinux-policy/pam_console-and-related/main.fmf | 2 +- selinux-policy/pam_limits-and-related/main.fmf | 2 +- selinux-policy/pam_timestamp-and-related/main.fmf | 2 +- selinux-policy/pcm-sensor-server-and-similar/main.fmf | 2 +- selinux-policy/pcp-daemons-and-similar/main.fmf | 2 +- selinux-policy/perf_event-and-related/main.fmf | 2 +- selinux-policy/ping-and-similar/main.fmf | 2 +- selinux-policy/policy-rpm-macros/main.fmf | 2 +- selinux-policy/policykit-general/main.fmf | 2 +- selinux-policy/power-profiles-daemon-and-similar/main.fmf | 2 +- selinux-policy/restorecond-fcontext-equivalences/main.fmf | 2 +- selinux-policy/rngd-and-similar/main.fmf | 2 +- selinux-policy/rpc.idmapd-and-similar/main.fmf | 2 +- selinux-policy/rpm-suppress-stderr/main.fmf | 2 +- selinux-policy/rpmdb-and-similar/main.fmf | 2 +- selinux-policy/rrdcached-service-and-related/main.fmf | 2 +- selinux-policy/rsyslog-and-similar/main.fmf | 2 +- selinux-policy/rtkit-daemon-and-similar/main.fmf | 2 +- selinux-policy/samba-bgqd-and-similar/main.fmf | 2 +- selinux-policy/smbcontrol-and-similar/main.fmf | 2 +- selinux-policy/snapd-and-similar/main.fmf | 2 +- selinux-policy/sslh-and-similar/main.fmf | 2 +- selinux-policy/stalld-and-similar/main.fmf | 2 +- selinux-policy/sudo-and-dnf/main.fmf | 2 +- selinux-policy/sulogin-and-similar/main.fmf | 2 +- selinux-policy/swap-file-and-systemd-access/main.fmf | 2 +- selinux-policy/switcheroo-control-and-similar/main.fmf | 2 +- selinux-policy/synce4l-and-similar/main.fmf | 2 +- selinux-policy/systemd-bootchart-and-similar/main.fmf | 2 +- selinux-policy/systemd-creds/main.fmf | 2 +- selinux-policy/systemd-generators/main.fmf | 2 +- selinux-policy/systemd-homed/main.fmf | 2 +- selinux-policy/systemd-importd-and-similar/main.fmf | 2 +- selinux-policy/systemd-journal-upload/main.fmf | 2 +- selinux-policy/systemd-localed/main.fmf | 2 +- selinux-policy/systemd-machined-and-similar/main.fmf | 2 +- selinux-policy/systemd-modules-load-and-similar/main.fmf | 2 +- selinux-policy/systemd-mountfsd-and-similar/main.fmf | 2 +- selinux-policy/systemd-notify-and-similar/main.fmf | 2 +- selinux-policy/systemd-nsresourced-and-similar/main.fmf | 2 +- selinux-policy/systemd-oomd/main.fmf | 2 +- selinux-policy/systemd-rfkill-and-similar/main.fmf | 2 +- selinux-policy/systemd-run-and-similar/main.fmf | 2 +- selinux-policy/systemd-sysctl-and-similar/main.fmf | 2 +- selinux-policy/systemd-timesyncd-and-similar/main.fmf | 2 +- selinux-policy/systemd-tmpfiles-and-similar/main.fmf | 2 +- selinux-policy/systemd-userdbd-and-similar/main.fmf | 2 +- selinux-policy/targetd-and-similar/main.fmf | 2 +- selinux-policy/thttpd-and-similar/main.fmf | 2 +- selinux-policy/tlp-and-similar/main.fmf | 2 +- selinux-policy/tlshd-and-similar/main.fmf | 2 +- selinux-policy/tuned-ppd-and-similar/main.fmf | 2 +- selinux-policy/usbguard-daemon-and-similar/main.fmf | 2 +- selinux-policy/usbmuxd-and-similar/main.fmf | 2 +- selinux-policy/valkey-and-similar/main.fmf | 2 +- selinux-policy/virt-install-additional/main.fmf | 2 +- selinux-policy/virtualization-daemons/main.fmf | 2 +- selinux-policy/watch-permissions/main.fmf | 2 +- setools/apol/main.fmf | 2 +- setools/rebuild-from-srpm/main.fmf | 2 +- setools/seinfo/main.fmf | 2 +- setools/sesearch/main.fmf | 2 +- setroubleshoot/independent-on-initscripts/main.fmf | 2 +- 195 files changed, 200 insertions(+), 200 deletions(-) diff --git a/checkpolicy/checkmodule/main.fmf b/checkpolicy/checkmodule/main.fmf index 2020861..0c472de 100644 --- a/checkpolicy/checkmodule/main.fmf +++ b/checkpolicy/checkmodule/main.fmf @@ -28,7 +28,7 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1064603 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1329217 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1392394 -adjust: +adjust+: - enabled: false when: distro == rhel-4 continue: false diff --git a/checkpolicy/checkpolicy-docs/main.fmf b/checkpolicy/checkpolicy-docs/main.fmf index b333ac5..58021b7 100644 --- a/checkpolicy/checkpolicy-docs/main.fmf +++ b/checkpolicy/checkpolicy-docs/main.fmf @@ -27,7 +27,7 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1328979 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=739866 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=533790 -adjust: +adjust+: - enabled: false when: distro == rhel-4 continue: false diff --git a/checkpolicy/checkpolicy/main.fmf b/checkpolicy/checkpolicy/main.fmf index 39ed072..6d24ebe 100644 --- a/checkpolicy/checkpolicy/main.fmf +++ b/checkpolicy/checkpolicy/main.fmf @@ -32,7 +32,7 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=739866 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1328966 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1328979 -adjust: +adjust+: - enabled: false when: distro == rhel-4 continue: false diff --git a/checkpolicy/sedismod/main.fmf b/checkpolicy/sedismod/main.fmf index edde1e2..a9ad051 100644 --- a/checkpolicy/sedismod/main.fmf +++ b/checkpolicy/sedismod/main.fmf @@ -22,7 +22,7 @@ tag: - f32friendly - targeted tier: 2 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5 continue: false diff --git a/checkpolicy/sedispol/main.fmf b/checkpolicy/sedispol/main.fmf index dfcb6a8..829c255 100644 --- a/checkpolicy/sedispol/main.fmf +++ b/checkpolicy/sedispol/main.fmf @@ -21,7 +21,7 @@ tier: 2 link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1303696 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1337890 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5 continue: false diff --git a/kernel/avc_log_actual_context_if_invalid/main.fmf b/kernel/avc_log_actual_context_if_invalid/main.fmf index 719b580..7826746 100644 --- a/kernel/avc_log_actual_context_if_invalid/main.fmf +++ b/kernel/avc_log_actual_context_if_invalid/main.fmf @@ -16,7 +16,7 @@ require: duration: 15m tier: 2 enabled: true -adjust: +adjust+: - enabled: false when: distro < rhel-8.1 because: RHEL-8.0 and below is not expected to support this diff --git a/kernel/avc_tracepoint/main.fmf b/kernel/avc_tracepoint/main.fmf index 2599ce5..e0794c8 100644 --- a/kernel/avc_tracepoint/main.fmf +++ b/kernel/avc_tracepoint/main.fmf @@ -14,7 +14,7 @@ require: duration: 5m tier: 2 enabled: true -adjust: +adjust+: - enabled: false when: distro < rhel-8.5 because: RHEL-8.5 and below are not expected to support this diff --git a/kernel/bogus-warning-in-selinux_ima_measure_state/main.fmf b/kernel/bogus-warning-in-selinux_ima_measure_state/main.fmf index 57e2859..1d3922d 100644 --- a/kernel/bogus-warning-in-selinux_ima_measure_state/main.fmf +++ b/kernel/bogus-warning-in-selinux_ima_measure_state/main.fmf @@ -11,7 +11,7 @@ require: duration: 5m tier: 2 enabled: true -adjust: +adjust+: - enabled: false when: distro < fedora-36 because: some kernels on Fedora 35 and below don't have the fix diff --git a/kernel/connect_AF_UNSPEC/main.fmf b/kernel/connect_AF_UNSPEC/main.fmf index 7afdbc4..6cc8d77 100644 --- a/kernel/connect_AF_UNSPEC/main.fmf +++ b/kernel/connect_AF_UNSPEC/main.fmf @@ -13,7 +13,7 @@ require: duration: 5m tier: 2 enabled: true -adjust: +adjust+: - enabled: false when: distro ~< rhel-8.1 because: RHEL-8.0 is not expected to have the bug fixed diff --git a/kernel/genfs_fallback/main.fmf b/kernel/genfs_fallback/main.fmf index 36161e9..c83e5a9 100644 --- a/kernel/genfs_fallback/main.fmf +++ b/kernel/genfs_fallback/main.fmf @@ -16,7 +16,7 @@ require: duration: 5m tier: 2 enabled: true -adjust: +adjust+: - enabled: false when: distro < rhel-8.5 because: RHEL-8.5 and below are not expected to support this diff --git a/kernel/journald_performance/main.fmf b/kernel/journald_performance/main.fmf index 3f9f019..310c826 100644 --- a/kernel/journald_performance/main.fmf +++ b/kernel/journald_performance/main.fmf @@ -16,7 +16,7 @@ require: duration: 30m tier: 2 enabled: true -adjust: +adjust+: - enabled: false when: distro < rhel-8.3 because: RHEL-8.2 and below are not expected to have the bug fixed diff --git a/kernel/keycreate_empty_value/main.fmf b/kernel/keycreate_empty_value/main.fmf index 80cfd80..d0d90da 100644 --- a/kernel/keycreate_empty_value/main.fmf +++ b/kernel/keycreate_empty_value/main.fmf @@ -12,7 +12,7 @@ require: duration: 5m tier: 2 enabled: true -adjust: +adjust+: - enabled: false when: distro < rhel-8.1 because: RHEL-8.0 and below are not expected to have the bug fixed diff --git a/kernel/labeled-cephfs/main.fmf b/kernel/labeled-cephfs/main.fmf index e4e3ded..371ab50 100644 --- a/kernel/labeled-cephfs/main.fmf +++ b/kernel/labeled-cephfs/main.fmf @@ -8,6 +8,6 @@ tier: 2 tag: - failinfedora - avoidImageMode -adjust: +adjust+: - enabled: false when: distro < rhel-8 diff --git a/kernel/labeling_before_policy_load/main.fmf b/kernel/labeling_before_policy_load/main.fmf index 3258f9c..a0b5c9f 100644 --- a/kernel/labeling_before_policy_load/main.fmf +++ b/kernel/labeling_before_policy_load/main.fmf @@ -19,7 +19,7 @@ require: duration: 30m tier: 2 enabled: true -adjust: +adjust+: - enabled: false when: distro < rhel-8.3 because: RHEL-8.2 and below are not expected to support this diff --git a/kernel/mount-options-memleak/main.fmf b/kernel/mount-options-memleak/main.fmf index 5913209..08dfec9 100644 --- a/kernel/mount-options-memleak/main.fmf +++ b/kernel/mount-options-memleak/main.fmf @@ -9,8 +9,8 @@ framework: beakerlib duration: 1h tier: 2 enabled: true -adjust: - enabled: false +adjust+: + - enabled: false when: distro < rhel-7 because: RHEL-6 and below are not worth supporting by this test link: diff --git a/kernel/netlabel-leaves-nops-in-packets/main.fmf b/kernel/netlabel-leaves-nops-in-packets/main.fmf index b238e96..7d13bb0 100644 --- a/kernel/netlabel-leaves-nops-in-packets/main.fmf +++ b/kernel/netlabel-leaves-nops-in-packets/main.fmf @@ -13,8 +13,8 @@ require: - gcc - netlabel_tools enabled: true -adjust: - enabled: false +adjust+: + - enabled: false when: distro < rhel-7 because: RHEL-6 and below are not worth supporting by this test link: diff --git a/kernel/netlabel_many_ifaces/main.fmf b/kernel/netlabel_many_ifaces/main.fmf index 4aaeb04..cfb456e 100644 --- a/kernel/netlabel_many_ifaces/main.fmf +++ b/kernel/netlabel_many_ifaces/main.fmf @@ -12,7 +12,7 @@ require: duration: 5m tier: 2 enabled: true -adjust: - enabled: false +adjust+: + - enabled: false when: distro < rhel-8.4 because: not fixed below RHEL 8.4... diff --git a/kernel/ocontext-race/main.fmf b/kernel/ocontext-race/main.fmf index 2748fbd..93b7423 100644 --- a/kernel/ocontext-race/main.fmf +++ b/kernel/ocontext-race/main.fmf @@ -11,7 +11,7 @@ require: duration: 15m tier: 2 enabled: true -adjust: +adjust+: - enabled: false when: distro < rhel-7 because: RHEL-6 and below are not worth supporting by this test diff --git a/kernel/sctp_peeloff_corner_case/main.fmf b/kernel/sctp_peeloff_corner_case/main.fmf index 582248e..68b07e7 100644 --- a/kernel/sctp_peeloff_corner_case/main.fmf +++ b/kernel/sctp_peeloff_corner_case/main.fmf @@ -17,7 +17,7 @@ require: duration: 10m tier: 2 enabled: true -adjust: +adjust+: - enabled: false when: distro < rhel-8 because: RHEL-7 and below don't have SCTP SELinux support diff --git a/kernel/sctp_peer_label_bug/main.fmf b/kernel/sctp_peer_label_bug/main.fmf index ae87830..70d0fc7 100644 --- a/kernel/sctp_peer_label_bug/main.fmf +++ b/kernel/sctp_peer_label_bug/main.fmf @@ -16,7 +16,7 @@ recommend: duration: 10m tier: 2 enabled: true -adjust: +adjust+: - enabled: false when: distro < rhel-8 because: RHEL-7 and below don't have SCTP SELinux support diff --git a/kernel/selinux-testsuite/main.fmf b/kernel/selinux-testsuite/main.fmf index 2dd60df..d3875ba 100644 --- a/kernel/selinux-testsuite/main.fmf +++ b/kernel/selinux-testsuite/main.fmf @@ -11,7 +11,7 @@ tier: 1 enabled: true tag: - fusa -adjust: +adjust+: - enabled: false when: distro < rhel-6 - enabled: false diff --git a/kernel/setsebool-deadlock/main.fmf b/kernel/setsebool-deadlock/main.fmf index 48a51f5..e83260e 100644 --- a/kernel/setsebool-deadlock/main.fmf +++ b/kernel/setsebool-deadlock/main.fmf @@ -14,7 +14,7 @@ require: duration: 5m tier: 3 enabled: true -adjust: +adjust+: - enabled: false when: distro < fedora-34 because: some kernels on Fedora 33 and below don't have the fix diff --git a/kernel/synflood/main.fmf b/kernel/synflood/main.fmf index 369876d..76a24ee 100644 --- a/kernel/synflood/main.fmf +++ b/kernel/synflood/main.fmf @@ -21,7 +21,7 @@ duration: 1h # currently disabled due to being unreliable enabled: false tier: 3 -adjust: +adjust+: - enabled: false when: distro < rhel-8 because: The test doesn't work well on RHEL-7 diff --git a/kernel/wrong-rules-after-setsebool/main.fmf b/kernel/wrong-rules-after-setsebool/main.fmf index d31ce1f..4dfcd12 100644 --- a/kernel/wrong-rules-after-setsebool/main.fmf +++ b/kernel/wrong-rules-after-setsebool/main.fmf @@ -14,7 +14,7 @@ require: duration: 5m tier: 2 enabled: true -adjust: - enabled: false +adjust+: + - enabled: false when: distro < rhel-7 because: RHEL-6 and below are not worth supporting by this test diff --git a/kernel/xfrm-refcount-underflow/main.fmf b/kernel/xfrm-refcount-underflow/main.fmf index b0db0ea..a08b332 100644 --- a/kernel/xfrm-refcount-underflow/main.fmf +++ b/kernel/xfrm-refcount-underflow/main.fmf @@ -12,8 +12,8 @@ recommend: duration: 15m tier: 2 enabled: true -adjust: - enabled: false +adjust+: + - enabled: false when: distro < rhel-7 because: RHEL-6 and below are not worth supporting by this test link: diff --git a/libselinux/get_default_context/main.fmf b/libselinux/get_default_context/main.fmf index 893f644..55bc274 100644 --- a/libselinux/get_default_context/main.fmf +++ b/libselinux/get_default_context/main.fmf @@ -27,7 +27,7 @@ tag: link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1879368 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1884282 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 continue: false diff --git a/libselinux/getpolicyload/main.fmf b/libselinux/getpolicyload/main.fmf index 627da13..5ac18eb 100644 --- a/libselinux/getpolicyload/main.fmf +++ b/libselinux/getpolicyload/main.fmf @@ -13,7 +13,7 @@ tag: - NoRHIVOS link: - relates: https://issues.redhat.com/browse/RHEL-16233 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 because: the getpolicyload program is not available there diff --git a/libselinux/getsebool/main.fmf b/libselinux/getsebool/main.fmf index c603122..9621457 100644 --- a/libselinux/getsebool/main.fmf +++ b/libselinux/getsebool/main.fmf @@ -18,7 +18,7 @@ tag: - NoRHIVOS link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1402140 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5 continue: false diff --git a/libselinux/realpath_not_final-function/main.fmf b/libselinux/realpath_not_final-function/main.fmf index 6fc50f8..e22cf47 100644 --- a/libselinux/realpath_not_final-function/main.fmf +++ b/libselinux/realpath_not_final-function/main.fmf @@ -22,7 +22,7 @@ tag: tier: 1 link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1404644 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6 continue: false diff --git a/libselinux/selabel-functions/main.fmf b/libselinux/selabel-functions/main.fmf index c3e7bae..c61f519 100644 --- a/libselinux/selabel-functions/main.fmf +++ b/libselinux/selabel-functions/main.fmf @@ -22,7 +22,7 @@ tag: tier: 1 link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1390909 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5 continue: false diff --git a/libselinux/selabel_lookup-and-local-changes/main.fmf b/libselinux/selabel_lookup-and-local-changes/main.fmf index 66cbf9d..24a0713 100644 --- a/libselinux/selabel_lookup-and-local-changes/main.fmf +++ b/libselinux/selabel_lookup-and-local-changes/main.fmf @@ -15,7 +15,7 @@ tag: - CI-Tier-1 - NoRHEL4 - NoRHEL5 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6 continue: false diff --git a/libselinux/selinux_boolean_sub-function/main.fmf b/libselinux/selinux_boolean_sub-function/main.fmf index 3b69a94..e370b46 100644 --- a/libselinux/selinux_boolean_sub-function/main.fmf +++ b/libselinux/selinux_boolean_sub-function/main.fmf @@ -20,7 +20,7 @@ tag: - f33friendly - fusa tier: 1 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6 continue: false diff --git a/libselinux/selinux_restorecon-functions/main.fmf b/libselinux/selinux_restorecon-functions/main.fmf index bc551ee..f6e1a3e 100644 --- a/libselinux/selinux_restorecon-functions/main.fmf +++ b/libselinux/selinux_restorecon-functions/main.fmf @@ -21,7 +21,7 @@ tag: - targeted - fusa tier: 1 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6 continue: false diff --git a/libselinux/selinux_sestatus-functions/main.fmf b/libselinux/selinux_sestatus-functions/main.fmf index 97ab55d..cb94b2f 100644 --- a/libselinux/selinux_sestatus-functions/main.fmf +++ b/libselinux/selinux_sestatus-functions/main.fmf @@ -21,7 +21,7 @@ tag: - targeted - fusa tier: 1 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6 continue: false diff --git a/libselinux/selinux_set_callback/main.fmf b/libselinux/selinux_set_callback/main.fmf index 1a278f1..e60ab41 100644 --- a/libselinux/selinux_set_callback/main.fmf +++ b/libselinux/selinux_set_callback/main.fmf @@ -23,7 +23,7 @@ tag: - targeted - NoRHIVOS tier: 1 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5 continue: false diff --git a/libselinux/setenforce/main.fmf b/libselinux/setenforce/main.fmf index 82a8763..900021b 100644 --- a/libselinux/setenforce/main.fmf +++ b/libselinux/setenforce/main.fmf @@ -22,7 +22,7 @@ tag: - targeted - fusa tier: 1 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5 continue: false diff --git a/libselinux/validatetrans/main.fmf b/libselinux/validatetrans/main.fmf index 198ed13..b8eef52 100644 --- a/libselinux/validatetrans/main.fmf +++ b/libselinux/validatetrans/main.fmf @@ -33,7 +33,7 @@ tag: tier: 1 link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2008965 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8 because: the validatetrans program is not available there diff --git a/libsemanage/cross-device-link-in-containers/main.fmf b/libsemanage/cross-device-link-in-containers/main.fmf index 90f0fe4..834fcf4 100644 --- a/libsemanage/cross-device-link-in-containers/main.fmf +++ b/libsemanage/cross-device-link-in-containers/main.fmf @@ -22,7 +22,7 @@ tag: link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2068085 - verifies: https://issues.redhat.com/browse/RHEL-70632 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 continue: false diff --git a/libsemanage/sanity-tests/main.fmf b/libsemanage/sanity-tests/main.fmf index 10309ea..e5e8f4f 100644 --- a/libsemanage/sanity-tests/main.fmf +++ b/libsemanage/sanity-tests/main.fmf @@ -29,7 +29,7 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1642305 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1781097 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1636973 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5 continue: false diff --git a/libsemanage/semanage-handle-functions/main.fmf b/libsemanage/semanage-handle-functions/main.fmf index 91a3234..0c6e3c5 100644 --- a/libsemanage/semanage-handle-functions/main.fmf +++ b/libsemanage/semanage-handle-functions/main.fmf @@ -23,7 +23,7 @@ tier: 1 link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1642305 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1781097 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5 continue: false diff --git a/libsemanage/semanage-seuser-functions/main.fmf b/libsemanage/semanage-seuser-functions/main.fmf index 0924387..58089d1 100644 --- a/libsemanage/semanage-seuser-functions/main.fmf +++ b/libsemanage/semanage-seuser-functions/main.fmf @@ -20,7 +20,7 @@ tag: - rhel8-buildroot - targeted - avoidImageMode -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5 continue: false diff --git a/libsemanage/usepasswd-in-semanage-conf/main.fmf b/libsemanage/usepasswd-in-semanage-conf/main.fmf index 55d9502..0e37053 100644 --- a/libsemanage/usepasswd-in-semanage-conf/main.fmf +++ b/libsemanage/usepasswd-in-semanage-conf/main.fmf @@ -25,7 +25,7 @@ tag: - avoidImageMode link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1871786 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5 continue: false diff --git a/libsemanage/verify-options-in-semanage-conf/main.fmf b/libsemanage/verify-options-in-semanage-conf/main.fmf index 73f2096..5b32f86 100644 --- a/libsemanage/verify-options-in-semanage-conf/main.fmf +++ b/libsemanage/verify-options-in-semanage-conf/main.fmf @@ -31,7 +31,7 @@ tag: tier: 1 link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1400705 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5 continue: false diff --git a/libsepol/self-keyword-in-type-rules/main.fmf b/libsepol/self-keyword-in-type-rules/main.fmf index 038b5d9..5db34a4 100644 --- a/libsepol/self-keyword-in-type-rules/main.fmf +++ b/libsepol/self-keyword-in-type-rules/main.fmf @@ -16,7 +16,7 @@ require: duration: 15m tier: 2 enabled: true -adjust: +adjust+: - enabled: false when: distro < rhel-9.1 because: RHEL-8 and below are not expected to support this diff --git a/libsepol/sepol_check_context/main.fmf b/libsepol/sepol_check_context/main.fmf index 0f0a82b..f0e3b5e 100644 --- a/libsepol/sepol_check_context/main.fmf +++ b/libsepol/sepol_check_context/main.fmf @@ -21,7 +21,7 @@ tag: - targeted - avoidImageMode tier: 1 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5 continue: false diff --git a/mcstrans/bz442327-setfscreatecon-with-invalid-context/main.fmf b/mcstrans/bz442327-setfscreatecon-with-invalid-context/main.fmf index cf211c2..fc979e6 100644 --- a/mcstrans/bz442327-setfscreatecon-with-invalid-context/main.fmf +++ b/mcstrans/bz442327-setfscreatecon-with-invalid-context/main.fmf @@ -36,7 +36,7 @@ tier: 3 link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=442327 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=800470 -adjust: +adjust+: - enabled: false when: distro == rhel-4 continue: false diff --git a/mcstrans/internal-examples-testsuite/main.fmf b/mcstrans/internal-examples-testsuite/main.fmf index 0ee1be6..ec20c6b 100644 --- a/mcstrans/internal-examples-testsuite/main.fmf +++ b/mcstrans/internal-examples-testsuite/main.fmf @@ -29,7 +29,7 @@ tag: - avoidImageMode link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1656304 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5 continue: false diff --git a/mcstrans/mcstrans-daemon-segfaults-when-using-secon-C/main.fmf b/mcstrans/mcstrans-daemon-segfaults-when-using-secon-C/main.fmf index 149799d..7d3bd93 100644 --- a/mcstrans/mcstrans-daemon-segfaults-when-using-secon-C/main.fmf +++ b/mcstrans/mcstrans-daemon-segfaults-when-using-secon-C/main.fmf @@ -29,7 +29,7 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1315996 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1316680 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1699784 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5 continue: false diff --git a/other/mounting/main.fmf b/other/mounting/main.fmf index b7ac025..2ee20f9 100644 --- a/other/mounting/main.fmf +++ b/other/mounting/main.fmf @@ -16,7 +16,7 @@ tag: - NoRHEL6 - failinfedora - targeted -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6 continue: false diff --git a/plans/failing.fmf b/plans/failing.fmf index defea7e..178ab77 100644 --- a/plans/failing.fmf +++ b/plans/failing.fmf @@ -1,5 +1,5 @@ summary: test plan which contains failing tests -adjust: +adjust+: - when: trigger == commit enabled: false because: do not run this plan on changes caused by a PR/MR diff --git a/plans/gating.fmf b/plans/gating.fmf index 8fa5264..a2c97ba 100644 --- a/plans/gating.fmf +++ b/plans/gating.fmf @@ -1,5 +1,5 @@ summary: Gating test plan -adjust: +adjust+: - when: trigger == commit enabled: false because: do not run this plan on changes caused by a PR/MR diff --git a/plans/notier.fmf b/plans/notier.fmf index 638f579..790b033 100644 --- a/plans/notier.fmf +++ b/plans/notier.fmf @@ -1,5 +1,5 @@ summary: no tier test plan -adjust: +adjust+: - when: trigger == commit enabled: false because: do not run this plan on changes caused by a PR/MR diff --git a/plans/tier1.fmf b/plans/tier1.fmf index 21405ed..bf35d2d 100644 --- a/plans/tier1.fmf +++ b/plans/tier1.fmf @@ -1,5 +1,5 @@ summary: Tier1 test plan -adjust: +adjust+: - when: trigger == commit enabled: false because: do not run this plan on changes caused by a PR/MR diff --git a/plans/tier2.fmf b/plans/tier2.fmf index 1065970..ab9f339 100644 --- a/plans/tier2.fmf +++ b/plans/tier2.fmf @@ -1,5 +1,5 @@ summary: Tier2 test plan -adjust: +adjust+: - when: trigger == commit enabled: false because: do not run this plan on changes caused by a PR/MR diff --git a/plans/tier3.fmf b/plans/tier3.fmf index da2bd80..b57f030 100644 --- a/plans/tier3.fmf +++ b/plans/tier3.fmf @@ -1,5 +1,5 @@ summary: Tier3 test plan -adjust: +adjust+: - when: trigger == commit enabled: false because: do not run this plan on changes caused by a PR/MR diff --git a/policycoreutils/CIL-modules-without-compilation/main.fmf b/policycoreutils/CIL-modules-without-compilation/main.fmf index c4082d9..38386d3 100644 --- a/policycoreutils/CIL-modules-without-compilation/main.fmf +++ b/policycoreutils/CIL-modules-without-compilation/main.fmf @@ -20,7 +20,7 @@ tag: - f33friendly - targeted tier: 1 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6 continue: false diff --git a/policycoreutils/booleans/main.fmf b/policycoreutils/booleans/main.fmf index ef60e1b..9b3f7d4 100644 --- a/policycoreutils/booleans/main.fmf +++ b/policycoreutils/booleans/main.fmf @@ -17,7 +17,7 @@ tag: - f33friendly - targeted tier: 1 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6 continue: false diff --git a/policycoreutils/file-contexts/main.fmf b/policycoreutils/file-contexts/main.fmf index e06a54c..7f3dfa1 100644 --- a/policycoreutils/file-contexts/main.fmf +++ b/policycoreutils/file-contexts/main.fmf @@ -20,7 +20,7 @@ tag: tier: 1 link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1822100 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6 continue: false diff --git a/policycoreutils/load_policy/main.fmf b/policycoreutils/load_policy/main.fmf index 764cadc..b4e572f 100644 --- a/policycoreutils/load_policy/main.fmf +++ b/policycoreutils/load_policy/main.fmf @@ -24,7 +24,7 @@ tag: - targeted - avoidImageMode tier: 1 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5 continue: false diff --git a/policycoreutils/modules/main.fmf b/policycoreutils/modules/main.fmf index e566551..cde2ca0 100644 --- a/policycoreutils/modules/main.fmf +++ b/policycoreutils/modules/main.fmf @@ -18,7 +18,7 @@ tag: - f32friendly - f33friendly tier: 1 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6 continue: false diff --git a/policycoreutils/org-selinux-dbus-interfaces/main.fmf b/policycoreutils/org-selinux-dbus-interfaces/main.fmf index 93c052d..1a6c054 100644 --- a/policycoreutils/org-selinux-dbus-interfaces/main.fmf +++ b/policycoreutils/org-selinux-dbus-interfaces/main.fmf @@ -25,7 +25,7 @@ tag: link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1415988 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1754873 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6 continue: false diff --git a/policycoreutils/python-module-precedence-issue/main.fmf b/policycoreutils/python-module-precedence-issue/main.fmf index b3c1807..a84f7f9 100644 --- a/policycoreutils/python-module-precedence-issue/main.fmf +++ b/policycoreutils/python-module-precedence-issue/main.fmf @@ -24,7 +24,7 @@ tag: tier: 1 link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2128976 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6 continue: false diff --git a/policycoreutils/restorecon/main.fmf b/policycoreutils/restorecon/main.fmf index e20ff1f..9d6fcb9 100644 --- a/policycoreutils/restorecon/main.fmf +++ b/policycoreutils/restorecon/main.fmf @@ -45,7 +45,7 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=736153 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=741371 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=740669 -adjust: +adjust+: - enabled: false when: distro == rhel-4 continue: false diff --git a/policycoreutils/restorecond_pointer_abuse/main.fmf b/policycoreutils/restorecond_pointer_abuse/main.fmf index 4dffd53..b4f30c1 100644 --- a/policycoreutils/restorecond_pointer_abuse/main.fmf +++ b/policycoreutils/restorecond_pointer_abuse/main.fmf @@ -19,7 +19,7 @@ recommend: - systemd - policycoreutils - libselinux-utils -adjust: +adjust+: - enabled: false when: distro < rhel-7 id: a900e46c-6cf9-49e1-9625-5beb609760c5 diff --git a/policycoreutils/selinux-autorelabel-service/main.fmf b/policycoreutils/selinux-autorelabel-service/main.fmf index 82c489a..0243f14 100644 --- a/policycoreutils/selinux-autorelabel-service/main.fmf +++ b/policycoreutils/selinux-autorelabel-service/main.fmf @@ -25,7 +25,7 @@ tag: link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1766578 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1778094 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 continue: false diff --git a/policycoreutils/selinux-info/main.fmf b/policycoreutils/selinux-info/main.fmf index e05574e..1c05e99 100644 --- a/policycoreutils/selinux-info/main.fmf +++ b/policycoreutils/selinux-info/main.fmf @@ -18,7 +18,7 @@ tag: - f33friendly - targeted tier: 1 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6 continue: false diff --git a/policycoreutils/semanage-imports-port-defs/main.fmf b/policycoreutils/semanage-imports-port-defs/main.fmf index 87d7764..9de2dc9 100644 --- a/policycoreutils/semanage-imports-port-defs/main.fmf +++ b/policycoreutils/semanage-imports-port-defs/main.fmf @@ -16,7 +16,7 @@ tier: 1 link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2063353 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2108174 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6 because: the test is not relevant there diff --git a/policycoreutils/semanage-interface/main.fmf b/policycoreutils/semanage-interface/main.fmf index adc896b..d961f08 100644 --- a/policycoreutils/semanage-interface/main.fmf +++ b/policycoreutils/semanage-interface/main.fmf @@ -24,7 +24,7 @@ tag: tier: 1 link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=953826 -adjust: +adjust+: - enabled: false when: distro == rhel-4 continue: false diff --git a/policycoreutils/semanage-login/main.fmf b/policycoreutils/semanage-login/main.fmf index 9b56fa1..e883371 100644 --- a/policycoreutils/semanage-login/main.fmf +++ b/policycoreutils/semanage-login/main.fmf @@ -25,7 +25,7 @@ tag: tier: 1 link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=953826 -adjust: +adjust+: - enabled: false when: distro == rhel-4 continue: false diff --git a/policycoreutils/semanage-user/main.fmf b/policycoreutils/semanage-user/main.fmf index 05e6aa5..4ef5dbd 100644 --- a/policycoreutils/semanage-user/main.fmf +++ b/policycoreutils/semanage-user/main.fmf @@ -27,7 +27,7 @@ tier: 1 link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=953826 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=987444 -adjust: +adjust+: - enabled: false when: distro == rhel-4 continue: false diff --git a/policycoreutils/semodule-rebuild-if-modules-changed/main.fmf b/policycoreutils/semodule-rebuild-if-modules-changed/main.fmf index 84f82f2..b9115c7 100644 --- a/policycoreutils/semodule-rebuild-if-modules-changed/main.fmf +++ b/policycoreutils/semodule-rebuild-if-modules-changed/main.fmf @@ -15,7 +15,7 @@ require: duration: 15m tier: 2 enabled: true -adjust: +adjust+: - enabled: false when: distro < rhel-8 because: RHEL-7 and below are not expected to support this diff --git a/policycoreutils/sepolicy-generate/main.fmf b/policycoreutils/sepolicy-generate/main.fmf index 3bd18e5..fc31e47 100644 --- a/policycoreutils/sepolicy-generate/main.fmf +++ b/policycoreutils/sepolicy-generate/main.fmf @@ -29,7 +29,7 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=962752 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=924107 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=924121 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6 continue: false diff --git a/policycoreutils/sepolicy-manpage/main.fmf b/policycoreutils/sepolicy-manpage/main.fmf index 107bf51..ab89152 100644 --- a/policycoreutils/sepolicy-manpage/main.fmf +++ b/policycoreutils/sepolicy-manpage/main.fmf @@ -14,7 +14,7 @@ link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1416372 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1854639 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1989840 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6 because: the sepolicy command is not available there diff --git a/policycoreutils/sestatus/main.fmf b/policycoreutils/sestatus/main.fmf index 7f8d71c..436e656 100644 --- a/policycoreutils/sestatus/main.fmf +++ b/policycoreutils/sestatus/main.fmf @@ -21,7 +21,7 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=705027 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=705031 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1723859 -adjust: +adjust+: - enabled: false when: distro == rhel-4 continue: false diff --git a/policycoreutils/setfiles_binary/main.fmf b/policycoreutils/setfiles_binary/main.fmf index 0f46801..e00f7b1 100644 --- a/policycoreutils/setfiles_binary/main.fmf +++ b/policycoreutils/setfiles_binary/main.fmf @@ -16,7 +16,7 @@ tag: - targeted link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1973754 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 continue: false diff --git a/policycoreutils/setsebool/main.fmf b/policycoreutils/setsebool/main.fmf index 1d0b2b4..e12bcec 100644 --- a/policycoreutils/setsebool/main.fmf +++ b/policycoreutils/setsebool/main.fmf @@ -34,7 +34,7 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=825176 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=666365 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=998974 -adjust: +adjust+: - enabled: false when: distro == rhel-4 continue: false diff --git a/policycoreutils/spaces-in-fcontext-patterns/main.fmf b/policycoreutils/spaces-in-fcontext-patterns/main.fmf index 7537f7b..62bb7a3 100644 --- a/policycoreutils/spaces-in-fcontext-patterns/main.fmf +++ b/policycoreutils/spaces-in-fcontext-patterns/main.fmf @@ -29,7 +29,7 @@ tag: tier: 1 link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1893545 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 continue: false diff --git a/selinux-policy/ModemManager-and-similar/main.fmf b/selinux-policy/ModemManager-and-similar/main.fmf index 83674f3..aa1d8b5 100644 --- a/selinux-policy/ModemManager-and-similar/main.fmf +++ b/selinux-policy/ModemManager-and-similar/main.fmf @@ -51,7 +51,7 @@ link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2145005 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2149560 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2149954 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5 continue: false diff --git a/selinux-policy/abrt-services/main.fmf b/selinux-policy/abrt-services/main.fmf index 3cf58bb..31a4a38 100644 --- a/selinux-policy/abrt-services/main.fmf +++ b/selinux-policy/abrt-services/main.fmf @@ -39,7 +39,7 @@ tag: - NoRHIVOS link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2274709 -adjust: +adjust+: - enabled: false when: distro >= rhel-9 because: the abrt* packages are not available there diff --git a/selinux-policy/accounts-daemon-and-similar/main.fmf b/selinux-policy/accounts-daemon-and-similar/main.fmf index 320de21..b698587 100644 --- a/selinux-policy/accounts-daemon-and-similar/main.fmf +++ b/selinux-policy/accounts-daemon-and-similar/main.fmf @@ -62,7 +62,7 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1933842 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1934573 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1935232 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6 continue: false diff --git a/selinux-policy/acpid-and-similar/main.fmf b/selinux-policy/acpid-and-similar/main.fmf index 11de4a9..a5227cd 100644 --- a/selinux-policy/acpid-and-similar/main.fmf +++ b/selinux-policy/acpid-and-similar/main.fmf @@ -39,7 +39,7 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1623342 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1932294 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1919167 -adjust: +adjust+: - enabled: false when: distro == rhel-4 continue: false diff --git a/selinux-policy/anon_inode-and-similar/main.fmf b/selinux-policy/anon_inode-and-similar/main.fmf index c348cbb..08c5b28 100644 --- a/selinux-policy/anon_inode-and-similar/main.fmf +++ b/selinux-policy/anon_inode-and-similar/main.fmf @@ -42,7 +42,7 @@ link: - verifies: https://issues.redhat.com/browse/RHEL-11792 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2270895 - verifies: https://issues.redhat.com/browse/RHEL-60837 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8 because: the anon_inode class is not defined there diff --git a/selinux-policy/bgpd-and-similar/main.fmf b/selinux-policy/bgpd-and-similar/main.fmf index 218eef7..4d5fb79 100644 --- a/selinux-policy/bgpd-and-similar/main.fmf +++ b/selinux-policy/bgpd-and-similar/main.fmf @@ -36,7 +36,7 @@ tier: 2 link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1830170 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2055578 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 continue: false diff --git a/selinux-policy/blueman-and-similar/main.fmf b/selinux-policy/blueman-and-similar/main.fmf index 39bff7e..ff6b625 100644 --- a/selinux-policy/blueman-and-similar/main.fmf +++ b/selinux-policy/blueman-and-similar/main.fmf @@ -35,7 +35,7 @@ tag: link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1470501 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2027044 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7, rhel-8, rhel-9, centos-stream-8, centos-stream-9, rhel-10, centos-stream-10 because: the blueman package is not available there diff --git a/selinux-policy/boinc-and-similar/main.fmf b/selinux-policy/boinc-and-similar/main.fmf index 3d3bf7c..10b15e3 100644 --- a/selinux-policy/boinc-and-similar/main.fmf +++ b/selinux-policy/boinc-and-similar/main.fmf @@ -40,7 +40,7 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1618683 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1711682 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1779070 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6 continue: false diff --git a/selinux-policy/boltd-and-similar/main.fmf b/selinux-policy/boltd-and-similar/main.fmf index c1cb2fa..3bf9dca 100644 --- a/selinux-policy/boltd-and-similar/main.fmf +++ b/selinux-policy/boltd-and-similar/main.fmf @@ -42,7 +42,7 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1702243 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1704766 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1951114 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6 continue: false diff --git a/selinux-policy/boothd-and-similar/main.fmf b/selinux-policy/boothd-and-similar/main.fmf index 3e43139..658048a 100644 --- a/selinux-policy/boothd-and-similar/main.fmf +++ b/selinux-policy/boothd-and-similar/main.fmf @@ -37,7 +37,7 @@ link: - verifies: https://issues.redhat.com/browse/RHEL-57104 - verifies: https://issues.redhat.com/browse/RHEL-58060 - verifies: https://issues.redhat.com/browse/RHEL-75471 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 because: the booth package is not available there diff --git a/selinux-policy/bootupd-and-similar/main.fmf b/selinux-policy/bootupd-and-similar/main.fmf index d892f6e..caaeb12 100644 --- a/selinux-policy/bootupd-and-similar/main.fmf +++ b/selinux-policy/bootupd-and-similar/main.fmf @@ -39,7 +39,7 @@ link: - verifies: https://issues.redhat.com/browse/RHEL-39514 - verifies: https://issues.redhat.com/browse/RHEL-66584 - verifies: https://issues.redhat.com/browse/RHEL-70849 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8 because: the package is not available there diff --git a/selinux-policy/bz481628-send-msg-to-dbus/main.fmf b/selinux-policy/bz481628-send-msg-to-dbus/main.fmf index a85118a..bd4a4a3 100644 --- a/selinux-policy/bz481628-send-msg-to-dbus/main.fmf +++ b/selinux-policy/bz481628-send-msg-to-dbus/main.fmf @@ -41,7 +41,7 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1688671 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1727887 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1754476 -adjust: +adjust+: - enabled: false when: distro == rhel-4 continue: false diff --git a/selinux-policy/bz533007-unable-to-start-kdump-service/main.fmf b/selinux-policy/bz533007-unable-to-start-kdump-service/main.fmf index 02da87f..8200304 100644 --- a/selinux-policy/bz533007-unable-to-start-kdump-service/main.fmf +++ b/selinux-policy/bz533007-unable-to-start-kdump-service/main.fmf @@ -75,7 +75,7 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1934347 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=830822 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2236876 -adjust: +adjust+: - enabled: false when: distro == rhel-4 continue: false diff --git a/selinux-policy/bz538089-plymouth-operations-denied-during-boot/main.fmf b/selinux-policy/bz538089-plymouth-operations-denied-during-boot/main.fmf index 1fe7c6a..cb47c57 100644 --- a/selinux-policy/bz538089-plymouth-operations-denied-during-boot/main.fmf +++ b/selinux-policy/bz538089-plymouth-operations-denied-during-boot/main.fmf @@ -47,7 +47,7 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1871307 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2184803 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2256442 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5 continue: false diff --git a/selinux-policy/bz562833-chrooted-named-file-contexts/main.fmf b/selinux-policy/bz562833-chrooted-named-file-contexts/main.fmf index 5ecc85f..21eb7c2 100644 --- a/selinux-policy/bz562833-chrooted-named-file-contexts/main.fmf +++ b/selinux-policy/bz562833-chrooted-named-file-contexts/main.fmf @@ -56,7 +56,7 @@ link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2223725 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2224352 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2226703 -adjust: +adjust+: - enabled: false when: distro == rhel-4 continue: false diff --git a/selinux-policy/bz624405-pcsc-and-similar/main.fmf b/selinux-policy/bz624405-pcsc-and-similar/main.fmf index 55f68de..a02ba20 100644 --- a/selinux-policy/bz624405-pcsc-and-similar/main.fmf +++ b/selinux-policy/bz624405-pcsc-and-similar/main.fmf @@ -50,7 +50,7 @@ link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2355930 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2356058 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2357154 -adjust: +adjust+: - enabled: false when: arch == s390, s390x continue: false diff --git a/selinux-policy/bz733494-amanda-and-similar/main.fmf b/selinux-policy/bz733494-amanda-and-similar/main.fmf index 5f838a8..585ba2e 100644 --- a/selinux-policy/bz733494-amanda-and-similar/main.fmf +++ b/selinux-policy/bz733494-amanda-and-similar/main.fmf @@ -51,7 +51,7 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1960513 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1065002 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1572696 -adjust: +adjust+: - enabled: false when: distro >= rhel-9 because: the amanda package is not available there diff --git a/selinux-policy/caddy-and-similar/main.fmf b/selinux-policy/caddy-and-similar/main.fmf index 57f9b9c..29d7066 100644 --- a/selinux-policy/caddy-and-similar/main.fmf +++ b/selinux-policy/caddy-and-similar/main.fmf @@ -29,7 +29,7 @@ tag: - rhel9-epel - NoRHIVOS - avoidImageMode -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, centos-stream-10, rhel-10 because: the caddy package is not available there diff --git a/selinux-policy/capability2-class/main.fmf b/selinux-policy/capability2-class/main.fmf index b7a5cad..b26898a 100644 --- a/selinux-policy/capability2-class/main.fmf +++ b/selinux-policy/capability2-class/main.fmf @@ -21,7 +21,7 @@ duration: 15m enabled: true link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1915264 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8 continue: false diff --git a/selinux-policy/chronyd-and-similar/main.fmf b/selinux-policy/chronyd-and-similar/main.fmf index 5263193..4262523 100644 --- a/selinux-policy/chronyd-and-similar/main.fmf +++ b/selinux-policy/chronyd-and-similar/main.fmf @@ -86,7 +86,7 @@ link: - verifies: https://issues.redhat.com/browse/RHEL-18219 - verifies: https://issues.redhat.com/browse/RHEL-82299 - verifies: https://issues.redhat.com/browse/RHEL-82308 -adjust: +adjust+: - enabled: false when: distro == rhel-4 continue: false diff --git a/selinux-policy/cockpit-ws-and-similar/main.fmf b/selinux-policy/cockpit-ws-and-similar/main.fmf index f09482f..58c3e1a 100644 --- a/selinux-policy/cockpit-ws-and-similar/main.fmf +++ b/selinux-policy/cockpit-ws-and-similar/main.fmf @@ -53,7 +53,7 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1629678 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1718814 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1979182 -adjust: +adjust+: - enabled: false when: arch != x86_64 continue: false diff --git a/selinux-policy/colord-and-similar/main.fmf b/selinux-policy/colord-and-similar/main.fmf index 0fcf28b..9fe6b74 100644 --- a/selinux-policy/colord-and-similar/main.fmf +++ b/selinux-policy/colord-and-similar/main.fmf @@ -47,7 +47,7 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1951114 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1878094 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2259679 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6 continue: false diff --git a/selinux-policy/cups-browsed-and-similar/main.fmf b/selinux-policy/cups-browsed-and-similar/main.fmf index edef678..58f1e9a 100644 --- a/selinux-policy/cups-browsed-and-similar/main.fmf +++ b/selinux-policy/cups-browsed-and-similar/main.fmf @@ -39,7 +39,7 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1929329 - verifies: https://issues.redhat.com/browse/RHEL-47401 - verifies: https://issues.redhat.com/browse/RHEL-54579 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6 continue: false diff --git a/selinux-policy/cups-lpd-and-similar/main.fmf b/selinux-policy/cups-lpd-and-similar/main.fmf index d0c1613..312617e 100644 --- a/selinux-policy/cups-lpd-and-similar/main.fmf +++ b/selinux-policy/cups-lpd-and-similar/main.fmf @@ -49,7 +49,7 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2020531 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2039449 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1919173 -adjust: +adjust+: - enabled: false when: distro == rhel-4 continue: false diff --git a/selinux-policy/cups-pdf-and-similar/main.fmf b/selinux-policy/cups-pdf-and-similar/main.fmf index 2589357..e0c7321 100644 --- a/selinux-policy/cups-pdf-and-similar/main.fmf +++ b/selinux-policy/cups-pdf-and-similar/main.fmf @@ -48,7 +48,7 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1700442 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1832521 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2234765 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-alt-7, rhel-10, centos-stream-10 continue: false diff --git a/selinux-policy/deny-rules/main.fmf b/selinux-policy/deny-rules/main.fmf index 43b5448..d3774c7 100644 --- a/selinux-policy/deny-rules/main.fmf +++ b/selinux-policy/deny-rules/main.fmf @@ -29,7 +29,7 @@ tag: - NoRHEL8 - targeted - NoRHIVOS -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-8 because: deny rules are not recognized/implemented there diff --git a/selinux-policy/dhclient-and-similar/main.fmf b/selinux-policy/dhclient-and-similar/main.fmf index a359cd7..0b4d92d 100644 --- a/selinux-policy/dhclient-and-similar/main.fmf +++ b/selinux-policy/dhclient-and-similar/main.fmf @@ -26,7 +26,7 @@ link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2035117 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2093709 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2094155 -adjust: +adjust+: - when: trigger == build enabled: false because: the test may mess up the IP address diff --git a/selinux-policy/dhcpcd-and-similar/main.fmf b/selinux-policy/dhcpcd-and-similar/main.fmf index b2cbd84..ed382df 100644 --- a/selinux-policy/dhcpcd-and-similar/main.fmf +++ b/selinux-policy/dhcpcd-and-similar/main.fmf @@ -37,7 +37,7 @@ link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2270733 - verifies: https://issues.redhat.com/browse/RHEL-33081 - verifies: https://issues.redhat.com/browse/RHEL-43417 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7 because: the dhcpcd package is not available there diff --git a/selinux-policy/dmidecode-and-similar/main.fmf b/selinux-policy/dmidecode-and-similar/main.fmf index 515452e..c8f26f2 100644 --- a/selinux-policy/dmidecode-and-similar/main.fmf +++ b/selinux-policy/dmidecode-and-similar/main.fmf @@ -40,7 +40,7 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1608480 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1926696 - verifies: https://issues.redhat.com/browse/RHEL-16104 -adjust: +adjust+: - enabled: false when: distro == rhel-4 continue: false diff --git a/selinux-policy/exim-and-similar/main.fmf b/selinux-policy/exim-and-similar/main.fmf index e480e0a..7497f6d 100644 --- a/selinux-policy/exim-and-similar/main.fmf +++ b/selinux-policy/exim-and-similar/main.fmf @@ -46,7 +46,7 @@ link: - verifies: https://issues.redhat.com/browse/RHEL-21902 - verifies: https://issues.redhat.com/browse/RHEL-21903 - verifies: https://issues.redhat.com/browse/RHEL-94268 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-alt-7 continue: false diff --git a/selinux-policy/fapolicyd-and-similar/main.fmf b/selinux-policy/fapolicyd-and-similar/main.fmf index 30e15a7..f14bcde 100644 --- a/selinux-policy/fapolicyd-and-similar/main.fmf +++ b/selinux-policy/fapolicyd-and-similar/main.fmf @@ -39,7 +39,7 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1876538 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1932225 - verifies: https://issues.redhat.com/browse/RHEL-77071 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 continue: false diff --git a/selinux-policy/fedora-third-party-and-similar/main.fmf b/selinux-policy/fedora-third-party-and-similar/main.fmf index 96fb3e8..3e07be9 100644 --- a/selinux-policy/fedora-third-party-and-similar/main.fmf +++ b/selinux-policy/fedora-third-party-and-similar/main.fmf @@ -35,7 +35,7 @@ tag: tier: 2 link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2093453 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, rhel-9, centos-stream-8, centos-stream-9 because: the fedora-third-party package is not available there diff --git a/selinux-policy/firewalld-and-similar/main.fmf b/selinux-policy/firewalld-and-similar/main.fmf index fe87934..0412fab 100644 --- a/selinux-policy/firewalld-and-similar/main.fmf +++ b/selinux-policy/firewalld-and-similar/main.fmf @@ -60,7 +60,7 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1600903 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1759010 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1989641 -adjust: +adjust+: - enabled: false when: distro < rhel-7 continue: false diff --git a/selinux-policy/fwupd-and-similar/main.fmf b/selinux-policy/fwupd-and-similar/main.fmf index 6793750..f3172f0 100644 --- a/selinux-policy/fwupd-and-similar/main.fmf +++ b/selinux-policy/fwupd-and-similar/main.fmf @@ -42,7 +42,7 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1851932 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1860924 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1878094 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6 continue: false diff --git a/selinux-policy/getrlimit-permission/main.fmf b/selinux-policy/getrlimit-permission/main.fmf index 81ee08b..266586d 100644 --- a/selinux-policy/getrlimit-permission/main.fmf +++ b/selinux-policy/getrlimit-permission/main.fmf @@ -36,7 +36,7 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1549691 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1549772 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2008965 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7 continue: false diff --git a/selinux-policy/gnome-remote-desktop-and-similar/main.fmf b/selinux-policy/gnome-remote-desktop-and-similar/main.fmf index 07f2c6d..7f84971 100644 --- a/selinux-policy/gnome-remote-desktop-and-similar/main.fmf +++ b/selinux-policy/gnome-remote-desktop-and-similar/main.fmf @@ -33,7 +33,7 @@ tag: link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2321236 - verifies: https://issues.redhat.com/browse/RHEL-35877 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 continue: false diff --git a/selinux-policy/hostapd-and-similar/main.fmf b/selinux-policy/hostapd-and-similar/main.fmf index 8879021..ee86af2 100644 --- a/selinux-policy/hostapd-and-similar/main.fmf +++ b/selinux-policy/hostapd-and-similar/main.fmf @@ -49,7 +49,7 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2032277 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2064688 - verifies: https://issues.redhat.com/browse/RHEL-59683 -adjust: +adjust+: - enabled: false when: arch == s390x continue: false diff --git a/selinux-policy/icecast-and-similar/main.fmf b/selinux-policy/icecast-and-similar/main.fmf index bba9aef..19b7b42 100644 --- a/selinux-policy/icecast-and-similar/main.fmf +++ b/selinux-policy/icecast-and-similar/main.fmf @@ -34,7 +34,7 @@ tag: link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=894387 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2156763 -adjust: +adjust+: - enabled: false when: arch == i386, ppc, ppc64, s390 because: the icecast package is not available for all architectures diff --git a/selinux-policy/iio-sensor-proxy-and-similar/main.fmf b/selinux-policy/iio-sensor-proxy-and-similar/main.fmf index 633e118..d17b90f 100644 --- a/selinux-policy/iio-sensor-proxy-and-similar/main.fmf +++ b/selinux-policy/iio-sensor-proxy-and-similar/main.fmf @@ -36,7 +36,7 @@ link: - verifies: https://issues.redhat.com/browse/RHEL-17346 - verifies: https://issues.redhat.com/browse/RHEL-62355 - verifies: https://issues.redhat.com/browse/RHEL-70850 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 because: the iio-sensor-proxy package is not available there diff --git a/selinux-policy/install-uninstall-dsp-packages/main.fmf b/selinux-policy/install-uninstall-dsp-packages/main.fmf index 4943936..060b7f7 100644 --- a/selinux-policy/install-uninstall-dsp-packages/main.fmf +++ b/selinux-policy/install-uninstall-dsp-packages/main.fmf @@ -32,7 +32,7 @@ tag: - rhel10_broken - avoidImageMode link: -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 continue: false diff --git a/selinux-policy/interface-definitions/main.fmf b/selinux-policy/interface-definitions/main.fmf index b51e068..6bf6d98 100644 --- a/selinux-policy/interface-definitions/main.fmf +++ b/selinux-policy/interface-definitions/main.fmf @@ -26,7 +26,7 @@ link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2254206 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2277925 - verifies: https://issues.redhat.com/browse/RHEL-34769 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5 because: decision was made not to fix the problem there diff --git a/selinux-policy/journalctl-and-similar/main.fmf b/selinux-policy/journalctl-and-similar/main.fmf index f7aa19c..a2a3259 100644 --- a/selinux-policy/journalctl-and-similar/main.fmf +++ b/selinux-policy/journalctl-and-similar/main.fmf @@ -53,7 +53,7 @@ link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2152588 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2152823 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2153782 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6 continue: false diff --git a/selinux-policy/kerberos-and-similar/main.fmf b/selinux-policy/kerberos-and-similar/main.fmf index 95d3cd8..7ad2246 100644 --- a/selinux-policy/kerberos-and-similar/main.fmf +++ b/selinux-policy/kerberos-and-similar/main.fmf @@ -51,7 +51,7 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1619252 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1664983 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1669975 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5 continue: false diff --git a/selinux-policy/kernel-confined-exec/main.fmf b/selinux-policy/kernel-confined-exec/main.fmf index cb38a23..4c49618 100644 --- a/selinux-policy/kernel-confined-exec/main.fmf +++ b/selinux-policy/kernel-confined-exec/main.fmf @@ -17,7 +17,7 @@ environment: duration: 20m tier: 2 enabled: true -adjust: +adjust+: - enabled: false when: distro < fedora-38 because: This hardening applies only to F38+ diff --git a/selinux-policy/ksm-and-similar/main.fmf b/selinux-policy/ksm-and-similar/main.fmf index f0571ad..d5d42e7 100644 --- a/selinux-policy/ksm-and-similar/main.fmf +++ b/selinux-policy/ksm-and-similar/main.fmf @@ -34,7 +34,7 @@ link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2091416 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2091417 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2091418 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 continue: false diff --git a/selinux-policy/ladvd/main.fmf b/selinux-policy/ladvd/main.fmf index 78a3451..7a0b05c 100644 --- a/selinux-policy/ladvd/main.fmf +++ b/selinux-policy/ladvd/main.fmf @@ -29,7 +29,7 @@ tag: link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1834325 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1855163 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, rhel-9, centos-stream-8, centos-stream-9 because: the ladvd package is not available there diff --git a/selinux-policy/libvirt-dbus-and-similar/main.fmf b/selinux-policy/libvirt-dbus-and-similar/main.fmf index a039ecc..38c2d06 100644 --- a/selinux-policy/libvirt-dbus-and-similar/main.fmf +++ b/selinux-policy/libvirt-dbus-and-similar/main.fmf @@ -32,7 +32,7 @@ tag: link: - verifies: https://issues.redhat.com/browse/RHEL-46893 - verifies: https://issues.redhat.com/browse/RHEL-73914 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 because: the libvirt-dbus package is not available there diff --git a/selinux-policy/logwatch-and-similar/main.fmf b/selinux-policy/logwatch-and-similar/main.fmf index 011161c..4be331b 100644 --- a/selinux-policy/logwatch-and-similar/main.fmf +++ b/selinux-policy/logwatch-and-similar/main.fmf @@ -35,7 +35,7 @@ link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2183432 - verifies: https://issues.redhat.com/browse/RHEL-34135 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2270484 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8 because: the logwatch service is not available there diff --git a/selinux-policy/nasd-and-similar/main.fmf b/selinux-policy/nasd-and-similar/main.fmf index d29086e..40e2ecd 100644 --- a/selinux-policy/nasd-and-similar/main.fmf +++ b/selinux-policy/nasd-and-similar/main.fmf @@ -21,7 +21,7 @@ recommend: environment: AVC_ERROR: +no_avc_check duration: 10m -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8 because: the nas package is not available there diff --git a/selinux-policy/nfsdcld-and-similar/main.fmf b/selinux-policy/nfsdcld-and-similar/main.fmf index b53c0bb..d3cbb6e 100644 --- a/selinux-policy/nfsdcld-and-similar/main.fmf +++ b/selinux-policy/nfsdcld-and-similar/main.fmf @@ -32,7 +32,7 @@ tag: link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1834234 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2026588 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 continue: false diff --git a/selinux-policy/notself-other-keywords/main.fmf b/selinux-policy/notself-other-keywords/main.fmf index 6b4201a..c64df80 100644 --- a/selinux-policy/notself-other-keywords/main.fmf +++ b/selinux-policy/notself-other-keywords/main.fmf @@ -25,7 +25,7 @@ tag: - NoRHEL8 - targeted - NoRHIVOS -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-8 because: notself/other keywords are not recognized/implemented there diff --git a/selinux-policy/ntpsec-and-similar/main.fmf b/selinux-policy/ntpsec-and-similar/main.fmf index ba88066..98ad9c9 100644 --- a/selinux-policy/ntpsec-and-similar/main.fmf +++ b/selinux-policy/ntpsec-and-similar/main.fmf @@ -35,7 +35,7 @@ tier: '3' link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2246805 - verifies: https://issues.redhat.com/browse/RHEL-15085 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8, rhel-10, centos-stream-10 because: the ntpsec package is not available there diff --git a/selinux-policy/numad-and-similar/main.fmf b/selinux-policy/numad-and-similar/main.fmf index fe2c982..5519321 100644 --- a/selinux-policy/numad-and-similar/main.fmf +++ b/selinux-policy/numad-and-similar/main.fmf @@ -40,7 +40,7 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1118515 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2026968 - verifies: https://issues.redhat.com/browse/RHEL-2415 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5 continue: false diff --git a/selinux-policy/nvme-stas-and-similar/main.fmf b/selinux-policy/nvme-stas-and-similar/main.fmf index d8408e2..8e55c79 100644 --- a/selinux-policy/nvme-stas-and-similar/main.fmf +++ b/selinux-policy/nvme-stas-and-similar/main.fmf @@ -35,7 +35,7 @@ tag: link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2111414 - verifies: https://issues.redhat.com/browse/RHEL-1557 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8, rhel-10, centos-stream-10 because: the nvme-stas package is not available there diff --git a/selinux-policy/opensmtpd-and-similar/main.fmf b/selinux-policy/opensmtpd-and-similar/main.fmf index 36bf0e7..b87c25f 100644 --- a/selinux-policy/opensmtpd-and-similar/main.fmf +++ b/selinux-policy/opensmtpd-and-similar/main.fmf @@ -37,7 +37,7 @@ link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2208696 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2246115 - verifies: https://issues.redhat.com/browse/RHEL-15175 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 because: the opensmtpd package is not available there diff --git a/selinux-policy/pam_console-and-related/main.fmf b/selinux-policy/pam_console-and-related/main.fmf index 3428e12..61daebc 100644 --- a/selinux-policy/pam_console-and-related/main.fmf +++ b/selinux-policy/pam_console-and-related/main.fmf @@ -43,7 +43,7 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=204986 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=251104 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1817690 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6 or distro > fedora-38 continue: false diff --git a/selinux-policy/pam_limits-and-related/main.fmf b/selinux-policy/pam_limits-and-related/main.fmf index aecf466..e0aa4f4 100644 --- a/selinux-policy/pam_limits-and-related/main.fmf +++ b/selinux-policy/pam_limits-and-related/main.fmf @@ -40,7 +40,7 @@ tag: link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1958819 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2039453 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 continue: false diff --git a/selinux-policy/pam_timestamp-and-related/main.fmf b/selinux-policy/pam_timestamp-and-related/main.fmf index 62828c3..d7ac0e7 100644 --- a/selinux-policy/pam_timestamp-and-related/main.fmf +++ b/selinux-policy/pam_timestamp-and-related/main.fmf @@ -43,7 +43,7 @@ tag: - NoRHIVOS link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1791957 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6 continue: false diff --git a/selinux-policy/pcm-sensor-server-and-similar/main.fmf b/selinux-policy/pcm-sensor-server-and-similar/main.fmf index cea7e6f..46b8f75 100644 --- a/selinux-policy/pcm-sensor-server-and-similar/main.fmf +++ b/selinux-policy/pcm-sensor-server-and-similar/main.fmf @@ -36,7 +36,7 @@ tag: link: - verifies: https://issues.redhat.com/browse/RHEL-52838 - verifies: https://issues.redhat.com/browse/RHEL-80452 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, rhel-9 because: the pcm-sensor-server service is not available there diff --git a/selinux-policy/pcp-daemons-and-similar/main.fmf b/selinux-policy/pcp-daemons-and-similar/main.fmf index f03984c..1262ec9 100644 --- a/selinux-policy/pcp-daemons-and-similar/main.fmf +++ b/selinux-policy/pcp-daemons-and-similar/main.fmf @@ -60,7 +60,7 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1770123 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1886369 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1309454 -adjust: +adjust+: - enabled: false when: distro == rhel-4 continue: false diff --git a/selinux-policy/perf_event-and-related/main.fmf b/selinux-policy/perf_event-and-related/main.fmf index 256d414..43e2e78 100644 --- a/selinux-policy/perf_event-and-related/main.fmf +++ b/selinux-policy/perf_event-and-related/main.fmf @@ -37,7 +37,7 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2019929 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2070982 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2229936 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 continue: false diff --git a/selinux-policy/ping-and-similar/main.fmf b/selinux-policy/ping-and-similar/main.fmf index e6dcc63..150eced 100644 --- a/selinux-policy/ping-and-similar/main.fmf +++ b/selinux-policy/ping-and-similar/main.fmf @@ -38,7 +38,7 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1810403 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1848929 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2070870 -adjust: +adjust+: - enabled: false when: distro == rhel-4 continue: false diff --git a/selinux-policy/policy-rpm-macros/main.fmf b/selinux-policy/policy-rpm-macros/main.fmf index 05abb8b..261c287 100644 --- a/selinux-policy/policy-rpm-macros/main.fmf +++ b/selinux-policy/policy-rpm-macros/main.fmf @@ -32,7 +32,7 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1633198 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1631814 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1465824 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6 continue: false diff --git a/selinux-policy/policykit-general/main.fmf b/selinux-policy/policykit-general/main.fmf index cfe4971..2841a86 100644 --- a/selinux-policy/policykit-general/main.fmf +++ b/selinux-policy/policykit-general/main.fmf @@ -49,7 +49,7 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1727902 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1951114 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1878094 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5 continue: false diff --git a/selinux-policy/power-profiles-daemon-and-similar/main.fmf b/selinux-policy/power-profiles-daemon-and-similar/main.fmf index bb99a94..219e663 100644 --- a/selinux-policy/power-profiles-daemon-and-similar/main.fmf +++ b/selinux-policy/power-profiles-daemon-and-similar/main.fmf @@ -34,7 +34,7 @@ link: - verifies: https://issues.redhat.com/browse/RHEL-61117 - verifies: https://issues.redhat.com/browse/RHEL-62356 - verifies: https://issues.redhat.com/browse/RHEL-100718 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, rhel-10, centos-stream-10 because: the power-profiles-daemon package is not available there diff --git a/selinux-policy/restorecond-fcontext-equivalences/main.fmf b/selinux-policy/restorecond-fcontext-equivalences/main.fmf index 771533d..a568133 100644 --- a/selinux-policy/restorecond-fcontext-equivalences/main.fmf +++ b/selinux-policy/restorecond-fcontext-equivalences/main.fmf @@ -24,7 +24,7 @@ tag: - avoidImageMode link: - verifies: https://issues.redhat.com/browse/RHEL-5032 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 continue: false diff --git a/selinux-policy/rngd-and-similar/main.fmf b/selinux-policy/rngd-and-similar/main.fmf index 4a9c443..113804e 100644 --- a/selinux-policy/rngd-and-similar/main.fmf +++ b/selinux-policy/rngd-and-similar/main.fmf @@ -62,7 +62,7 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2058914 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2076641 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2076642 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6 continue: false diff --git a/selinux-policy/rpc.idmapd-and-similar/main.fmf b/selinux-policy/rpc.idmapd-and-similar/main.fmf index 446aba2..c2a96de 100644 --- a/selinux-policy/rpc.idmapd-and-similar/main.fmf +++ b/selinux-policy/rpc.idmapd-and-similar/main.fmf @@ -30,7 +30,7 @@ tag: - failinfedora - NoRHIVOS tier: 3 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 continue: false diff --git a/selinux-policy/rpm-suppress-stderr/main.fmf b/selinux-policy/rpm-suppress-stderr/main.fmf index b86deaa..baa0bfd 100644 --- a/selinux-policy/rpm-suppress-stderr/main.fmf +++ b/selinux-policy/rpm-suppress-stderr/main.fmf @@ -14,7 +14,7 @@ tag: - avoidImageMode link: - https://issues.redhat.com/browse/RHEL-59192 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 continue: false diff --git a/selinux-policy/rpmdb-and-similar/main.fmf b/selinux-policy/rpmdb-and-similar/main.fmf index af883fa..32ceece 100644 --- a/selinux-policy/rpmdb-and-similar/main.fmf +++ b/selinux-policy/rpmdb-and-similar/main.fmf @@ -36,7 +36,7 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1899548 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2023163 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2164752 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8 continue: false diff --git a/selinux-policy/rrdcached-service-and-related/main.fmf b/selinux-policy/rrdcached-service-and-related/main.fmf index b132e77..83c2714 100644 --- a/selinux-policy/rrdcached-service-and-related/main.fmf +++ b/selinux-policy/rrdcached-service-and-related/main.fmf @@ -33,7 +33,7 @@ tag: tier: 1 link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1726255 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 continue: false diff --git a/selinux-policy/rsyslog-and-similar/main.fmf b/selinux-policy/rsyslog-and-similar/main.fmf index e1e0924..0a33aec 100644 --- a/selinux-policy/rsyslog-and-similar/main.fmf +++ b/selinux-policy/rsyslog-and-similar/main.fmf @@ -35,7 +35,7 @@ tag: link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1823669 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1823672 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7 continue: false diff --git a/selinux-policy/rtkit-daemon-and-similar/main.fmf b/selinux-policy/rtkit-daemon-and-similar/main.fmf index 626d670..a794462 100644 --- a/selinux-policy/rtkit-daemon-and-similar/main.fmf +++ b/selinux-policy/rtkit-daemon-and-similar/main.fmf @@ -46,7 +46,7 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1760214 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1873658 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1910507 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5 continue: false diff --git a/selinux-policy/samba-bgqd-and-similar/main.fmf b/selinux-policy/samba-bgqd-and-similar/main.fmf index 9a8ed19..17d8035 100644 --- a/selinux-policy/samba-bgqd-and-similar/main.fmf +++ b/selinux-policy/samba-bgqd-and-similar/main.fmf @@ -40,7 +40,7 @@ link: - verifies: https://issues.redhat.com/browse/RHEL-72860 - verifies: https://issues.redhat.com/browse/RHEL-72861 - verifies: https://issues.redhat.com/browse/RHEL-93731 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 continue: false diff --git a/selinux-policy/smbcontrol-and-similar/main.fmf b/selinux-policy/smbcontrol-and-similar/main.fmf index d9d0478..083f638 100644 --- a/selinux-policy/smbcontrol-and-similar/main.fmf +++ b/selinux-policy/smbcontrol-and-similar/main.fmf @@ -42,7 +42,7 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2033873 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2038157 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2038963 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5 continue: false diff --git a/selinux-policy/snapd-and-similar/main.fmf b/selinux-policy/snapd-and-similar/main.fmf index 1507e52..23325b1 100644 --- a/selinux-policy/snapd-and-similar/main.fmf +++ b/selinux-policy/snapd-and-similar/main.fmf @@ -39,7 +39,7 @@ tag: - avoidImageMode link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2207725 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6 because: the snapd package is not available there diff --git a/selinux-policy/sslh-and-similar/main.fmf b/selinux-policy/sslh-and-similar/main.fmf index 4ba2649..10899bc 100644 --- a/selinux-policy/sslh-and-similar/main.fmf +++ b/selinux-policy/sslh-and-similar/main.fmf @@ -36,7 +36,7 @@ tag: - NoRHIVOS link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1534624 -adjust: +adjust+: - enabled: false when: distro >= rhel-9 because: the sslh package is not available there diff --git a/selinux-policy/stalld-and-similar/main.fmf b/selinux-policy/stalld-and-similar/main.fmf index 22ef9ba..a5fa786 100644 --- a/selinux-policy/stalld-and-similar/main.fmf +++ b/selinux-policy/stalld-and-similar/main.fmf @@ -39,7 +39,7 @@ link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2105038 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2140673 - verifies: https://issues.redhat.com/browse/RHEL-50356 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8 continue: false diff --git a/selinux-policy/sudo-and-dnf/main.fmf b/selinux-policy/sudo-and-dnf/main.fmf index 1309946..7112970 100644 --- a/selinux-policy/sudo-and-dnf/main.fmf +++ b/selinux-policy/sudo-and-dnf/main.fmf @@ -37,7 +37,7 @@ tag: link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2233065 - verifies: https://issues.redhat.com/browse/RHEL-1679 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 continue: false diff --git a/selinux-policy/sulogin-and-similar/main.fmf b/selinux-policy/sulogin-and-similar/main.fmf index d69933e..d2d64a0 100644 --- a/selinux-policy/sulogin-and-similar/main.fmf +++ b/selinux-policy/sulogin-and-similar/main.fmf @@ -29,7 +29,7 @@ tag: - NoRHIVOS link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2265391 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 continue: false diff --git a/selinux-policy/swap-file-and-systemd-access/main.fmf b/selinux-policy/swap-file-and-systemd-access/main.fmf index 2ffdf33..34b8c2d 100644 --- a/selinux-policy/swap-file-and-systemd-access/main.fmf +++ b/selinux-policy/swap-file-and-systemd-access/main.fmf @@ -41,7 +41,7 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1928539 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1968610 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1890884 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 continue: false diff --git a/selinux-policy/switcheroo-control-and-similar/main.fmf b/selinux-policy/switcheroo-control-and-similar/main.fmf index 4c8ed75..bf763f4 100644 --- a/selinux-policy/switcheroo-control-and-similar/main.fmf +++ b/selinux-policy/switcheroo-control-and-similar/main.fmf @@ -37,7 +37,7 @@ link: - verifies: https://issues.redhat.com/browse/RHEL-24268 - verifies: https://issues.redhat.com/browse/RHEL-93335 - verifies: https://issues.redhat.com/browse/RHEL-93535 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 because: the switcheroo-control package is not available there diff --git a/selinux-policy/synce4l-and-similar/main.fmf b/selinux-policy/synce4l-and-similar/main.fmf index 985b93f..170d141 100644 --- a/selinux-policy/synce4l-and-similar/main.fmf +++ b/selinux-policy/synce4l-and-similar/main.fmf @@ -31,7 +31,7 @@ tag: tier: 3 link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2158402 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 because: the synce4l package is not available there diff --git a/selinux-policy/systemd-bootchart-and-similar/main.fmf b/selinux-policy/systemd-bootchart-and-similar/main.fmf index 82ae6f6..6be6690 100644 --- a/selinux-policy/systemd-bootchart-and-similar/main.fmf +++ b/selinux-policy/systemd-bootchart-and-similar/main.fmf @@ -30,7 +30,7 @@ tag: link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1757050 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1838163 -adjust: +adjust+: - enabled: true when: distro == fedora because: the systemd-bootchart package is not available elsewhere diff --git a/selinux-policy/systemd-creds/main.fmf b/selinux-policy/systemd-creds/main.fmf index 168e9a8..7aca3c5 100644 --- a/selinux-policy/systemd-creds/main.fmf +++ b/selinux-policy/systemd-creds/main.fmf @@ -25,7 +25,7 @@ tag: - NoRHIVOS - avoidImageMode tier: 2 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8 because: the systemd-creds program is not available there diff --git a/selinux-policy/systemd-generators/main.fmf b/selinux-policy/systemd-generators/main.fmf index a037266..7b8c9f4 100644 --- a/selinux-policy/systemd-generators/main.fmf +++ b/selinux-policy/systemd-generators/main.fmf @@ -39,7 +39,7 @@ link: - verifies: https://issues.redhat.com/browse/RHEL-98656 - verifies: https://issues.redhat.com/browse/RHEL-100415 - verifies: https://issues.redhat.com/browse/RHEL-100721 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 continue: false diff --git a/selinux-policy/systemd-homed/main.fmf b/selinux-policy/systemd-homed/main.fmf index ef2d162..66e9253 100644 --- a/selinux-policy/systemd-homed/main.fmf +++ b/selinux-policy/systemd-homed/main.fmf @@ -25,7 +25,7 @@ link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2315587 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2315812 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2316163 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, rhel-9, centos-stream-8, centos-stream-9, rhel-10, centos-stream-10 because: the systemd-homed program is not available there diff --git a/selinux-policy/systemd-importd-and-similar/main.fmf b/selinux-policy/systemd-importd-and-similar/main.fmf index e533f54..7865f66 100644 --- a/selinux-policy/systemd-importd-and-similar/main.fmf +++ b/selinux-policy/systemd-importd-and-similar/main.fmf @@ -34,7 +34,7 @@ tag: - NoRHIVOS link: - verifies: https://issues.redhat.com/browse/RHEL-98490 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7 because: the systemd-importd program is not available there diff --git a/selinux-policy/systemd-journal-upload/main.fmf b/selinux-policy/systemd-journal-upload/main.fmf index a134969..7a2c000 100644 --- a/selinux-policy/systemd-journal-upload/main.fmf +++ b/selinux-policy/systemd-journal-upload/main.fmf @@ -30,7 +30,7 @@ tag: link: - verifies: https://issues.redhat.com/browse/RHEL-57774 - verifies: https://issues.redhat.com/browse/RHEL-62196 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 continue: false diff --git a/selinux-policy/systemd-localed/main.fmf b/selinux-policy/systemd-localed/main.fmf index 32970a4..ef6fff0 100644 --- a/selinux-policy/systemd-localed/main.fmf +++ b/selinux-policy/systemd-localed/main.fmf @@ -31,7 +31,7 @@ link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2240159 - verifies: https://issues.redhat.com/browse/RHEL-16715 - verifies: https://issues.redhat.com/browse/RHEL-16716 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 continue: false diff --git a/selinux-policy/systemd-machined-and-similar/main.fmf b/selinux-policy/systemd-machined-and-similar/main.fmf index f76c62c..49352f7 100644 --- a/selinux-policy/systemd-machined-and-similar/main.fmf +++ b/selinux-policy/systemd-machined-and-similar/main.fmf @@ -43,7 +43,7 @@ link: - verifies: https://issues.redhat.com/browse/RHEL-86528 - verifies: https://issues.redhat.com/browse/RHEL-105966 - verifies: https://issues.redhat.com/browse/RHEL-108849 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7 because: the systemd-machined program is not available there diff --git a/selinux-policy/systemd-modules-load-and-similar/main.fmf b/selinux-policy/systemd-modules-load-and-similar/main.fmf index c4cf5f5..37ac696 100644 --- a/selinux-policy/systemd-modules-load-and-similar/main.fmf +++ b/selinux-policy/systemd-modules-load-and-similar/main.fmf @@ -55,7 +55,7 @@ link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2088257 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2088258 - verifies: https://issues.redhat.com/browse/RHEL-54591 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7 continue: false diff --git a/selinux-policy/systemd-mountfsd-and-similar/main.fmf b/selinux-policy/systemd-mountfsd-and-similar/main.fmf index a9f933f..bd6f636 100644 --- a/selinux-policy/systemd-mountfsd-and-similar/main.fmf +++ b/selinux-policy/systemd-mountfsd-and-similar/main.fmf @@ -32,7 +32,7 @@ tag: - NoRHEL9 - targeted - NoRHIVOS -adjust: +adjust+: - enabled: false when: distro <= fedora-40 continue: false diff --git a/selinux-policy/systemd-notify-and-similar/main.fmf b/selinux-policy/systemd-notify-and-similar/main.fmf index 294c863..aa40859 100644 --- a/selinux-policy/systemd-notify-and-similar/main.fmf +++ b/selinux-policy/systemd-notify-and-similar/main.fmf @@ -37,7 +37,7 @@ link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1903305 - verifies: https://issues.redhat.com/browse/RHEL-25514 - verifies: https://issues.redhat.com/browse/RHEL-25605 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 continue: false diff --git a/selinux-policy/systemd-nsresourced-and-similar/main.fmf b/selinux-policy/systemd-nsresourced-and-similar/main.fmf index 560b247..e289047 100644 --- a/selinux-policy/systemd-nsresourced-and-similar/main.fmf +++ b/selinux-policy/systemd-nsresourced-and-similar/main.fmf @@ -33,7 +33,7 @@ tag: - NoRHIVOS link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2290477 -adjust: +adjust+: - enabled: false when: distro <= fedora-40 continue: false diff --git a/selinux-policy/systemd-oomd/main.fmf b/selinux-policy/systemd-oomd/main.fmf index cd29105..149583d 100644 --- a/selinux-policy/systemd-oomd/main.fmf +++ b/selinux-policy/systemd-oomd/main.fmf @@ -33,7 +33,7 @@ tag: - TierCandidatesPASS - targeted - NoRHIVOS -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, rhel-9, rhel-10 continue: false diff --git a/selinux-policy/systemd-rfkill-and-similar/main.fmf b/selinux-policy/systemd-rfkill-and-similar/main.fmf index 963d8c6..ce773fb 100644 --- a/selinux-policy/systemd-rfkill-and-similar/main.fmf +++ b/selinux-policy/systemd-rfkill-and-similar/main.fmf @@ -45,7 +45,7 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1638981 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1661724 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2149390 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7 continue: false diff --git a/selinux-policy/systemd-run-and-similar/main.fmf b/selinux-policy/systemd-run-and-similar/main.fmf index e6419b4..ee20c01 100644 --- a/selinux-policy/systemd-run-and-similar/main.fmf +++ b/selinux-policy/systemd-run-and-similar/main.fmf @@ -37,7 +37,7 @@ link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2118784 - verifies: https://issues.redhat.com/browse/RHEL-61928 - verifies: https://issues.redhat.com/browse/RHEL-62185 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 continue: false diff --git a/selinux-policy/systemd-sysctl-and-similar/main.fmf b/selinux-policy/systemd-sysctl-and-similar/main.fmf index 8764793..e4ea8e8 100644 --- a/selinux-policy/systemd-sysctl-and-similar/main.fmf +++ b/selinux-policy/systemd-sysctl-and-similar/main.fmf @@ -32,7 +32,7 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2056999 - verifies: https://issues.redhat.com/browse/RHEL-56988 - verifies: https://issues.redhat.com/browse/RHEL-58380 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 continue: false diff --git a/selinux-policy/systemd-timesyncd-and-similar/main.fmf b/selinux-policy/systemd-timesyncd-and-similar/main.fmf index c4e8578..07b01b2 100644 --- a/selinux-policy/systemd-timesyncd-and-similar/main.fmf +++ b/selinux-policy/systemd-timesyncd-and-similar/main.fmf @@ -48,7 +48,7 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1949315 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1970865 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2175137 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7 because: the systemd-timesyncd service is not available there diff --git a/selinux-policy/systemd-tmpfiles-and-similar/main.fmf b/selinux-policy/systemd-tmpfiles-and-similar/main.fmf index 9b77f7b..c72634c 100644 --- a/selinux-policy/systemd-tmpfiles-and-similar/main.fmf +++ b/selinux-policy/systemd-tmpfiles-and-similar/main.fmf @@ -36,7 +36,7 @@ tier: 2 link: - verifies: https://issues.redhat.com/browse/RHEL-40374 - verifies: https://issues.redhat.com/browse/RHEL-44191 -adjust: +adjust+: - enabled: false when: distro < rhel-9.5 continue: false diff --git a/selinux-policy/systemd-userdbd-and-similar/main.fmf b/selinux-policy/systemd-userdbd-and-similar/main.fmf index 2b2ff9a..f65d9c2 100644 --- a/selinux-policy/systemd-userdbd-and-similar/main.fmf +++ b/selinux-policy/systemd-userdbd-and-similar/main.fmf @@ -37,7 +37,7 @@ tag: - NoRHIVOS link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1835630 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7, rhel-8, rhel-9, centos-stream-8, centos-stream-9 because: the systemd-userdbd program is not available there diff --git a/selinux-policy/targetd-and-similar/main.fmf b/selinux-policy/targetd-and-similar/main.fmf index df484b2..05813b9 100644 --- a/selinux-policy/targetd-and-similar/main.fmf +++ b/selinux-policy/targetd-and-similar/main.fmf @@ -47,7 +47,7 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2062183 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2203720 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2222199 -adjust: +adjust+: - enabled: true when: distro == rhel-7, rhel-8, centos-stream-8, fedora because: the targetd package is not available elsewhere diff --git a/selinux-policy/thttpd-and-similar/main.fmf b/selinux-policy/thttpd-and-similar/main.fmf index 4cef10b..0753ba6 100644 --- a/selinux-policy/thttpd-and-similar/main.fmf +++ b/selinux-policy/thttpd-and-similar/main.fmf @@ -37,7 +37,7 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1069843 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1087384 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1111581 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-alt-7, rhel-9, rhel-10 because: the thttpd package is not available there diff --git a/selinux-policy/tlp-and-similar/main.fmf b/selinux-policy/tlp-and-similar/main.fmf index b04f5e7..ed89652 100644 --- a/selinux-policy/tlp-and-similar/main.fmf +++ b/selinux-policy/tlp-and-similar/main.fmf @@ -42,7 +42,7 @@ tag: link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1460481 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2221019 -adjust: +adjust+: - enabled: false when: arch == s390x continue: false diff --git a/selinux-policy/tlshd-and-similar/main.fmf b/selinux-policy/tlshd-and-similar/main.fmf index a22b550..6fa7a6a 100644 --- a/selinux-policy/tlshd-and-similar/main.fmf +++ b/selinux-policy/tlshd-and-similar/main.fmf @@ -33,7 +33,7 @@ link: - verifies: https://issues.redhat.com/browse/RHEL-29439 - verifies: https://issues.redhat.com/browse/RHEL-42672 - verifies: https://issues.redhat.com/browse/RHEL-74424 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8 because: the ktls-utils package is not available there diff --git a/selinux-policy/tuned-ppd-and-similar/main.fmf b/selinux-policy/tuned-ppd-and-similar/main.fmf index 48fc7ba..b11bf1e 100644 --- a/selinux-policy/tuned-ppd-and-similar/main.fmf +++ b/selinux-policy/tuned-ppd-and-similar/main.fmf @@ -42,7 +42,7 @@ link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2367711 - verifies: https://issues.redhat.com/browse/RHEL-101686 - verifies: https://issues.redhat.com/browse/RHEL-101687 -adjust: +adjust+: - enabled: false when: distro < rhel-9.5 because: the tuned-ppd package is not available there diff --git a/selinux-policy/usbguard-daemon-and-similar/main.fmf b/selinux-policy/usbguard-daemon-and-similar/main.fmf index c5b5b64..8681ea0 100644 --- a/selinux-policy/usbguard-daemon-and-similar/main.fmf +++ b/selinux-policy/usbguard-daemon-and-similar/main.fmf @@ -36,7 +36,7 @@ tag: link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1808527 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1840265 -adjust: +adjust+: - enabled: false when: arch == s390x continue: false diff --git a/selinux-policy/usbmuxd-and-similar/main.fmf b/selinux-policy/usbmuxd-and-similar/main.fmf index 2f30ccd..4bfc421 100644 --- a/selinux-policy/usbmuxd-and-similar/main.fmf +++ b/selinux-policy/usbmuxd-and-similar/main.fmf @@ -40,7 +40,7 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1959747 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1965411 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1973886 -adjust: +adjust+: - enabled: false when: distro >= rhel-9 because: the usbmuxd package is not available there diff --git a/selinux-policy/valkey-and-similar/main.fmf b/selinux-policy/valkey-and-similar/main.fmf index 6fd1b47..a443dff 100644 --- a/selinux-policy/valkey-and-similar/main.fmf +++ b/selinux-policy/valkey-and-similar/main.fmf @@ -32,7 +32,7 @@ tag: - Tier3se - NoRHIVOS - avoidImageMode -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 because: the package is not available there diff --git a/selinux-policy/virt-install-additional/main.fmf b/selinux-policy/virt-install-additional/main.fmf index c0e5f85..7f9ace8 100644 --- a/selinux-policy/virt-install-additional/main.fmf +++ b/selinux-policy/virt-install-additional/main.fmf @@ -52,7 +52,7 @@ link: - verifies: https://issues.redhat.com/browse/RHEL-76104 - verifies: https://issues.redhat.com/browse/RHEL-98559 - verifies: https://issues.redhat.com/browse/RHEL-101417 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 because: the test is not relevant for these RHELs diff --git a/selinux-policy/virtualization-daemons/main.fmf b/selinux-policy/virtualization-daemons/main.fmf index f30e275..a22c362 100644 --- a/selinux-policy/virtualization-daemons/main.fmf +++ b/selinux-policy/virtualization-daemons/main.fmf @@ -49,7 +49,7 @@ tag: - failinfedora - NoRHIVOS - avoidImageMode -adjust: +adjust+: - enabled: false when: distro < centos-stream-9 because: the virtualization daemons are not available there diff --git a/selinux-policy/watch-permissions/main.fmf b/selinux-policy/watch-permissions/main.fmf index 1a6de54..a493394 100644 --- a/selinux-policy/watch-permissions/main.fmf +++ b/selinux-policy/watch-permissions/main.fmf @@ -21,7 +21,7 @@ duration: 15m enabled: true link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1915034 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8 because: the watch permission is not defined there diff --git a/setools/apol/main.fmf b/setools/apol/main.fmf index 7714c25..a169e33 100644 --- a/setools/apol/main.fmf +++ b/setools/apol/main.fmf @@ -27,7 +27,7 @@ tag: - targeted link: - relates: https://issues.redhat.com/browse/RHEL-29967 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-10 continue: false diff --git a/setools/rebuild-from-srpm/main.fmf b/setools/rebuild-from-srpm/main.fmf index 78a4763..ae3136d 100644 --- a/setools/rebuild-from-srpm/main.fmf +++ b/setools/rebuild-from-srpm/main.fmf @@ -25,7 +25,7 @@ tag: link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2251915 - verifies: https://issues.redhat.com/browse/RHEL-18067 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 continue: false diff --git a/setools/seinfo/main.fmf b/setools/seinfo/main.fmf index 3dee162..0803d4e 100644 --- a/setools/seinfo/main.fmf +++ b/setools/seinfo/main.fmf @@ -36,7 +36,7 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1581761 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=920981 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1581848 -adjust: +adjust+: - enabled: false when: distro == rhel-4 continue: false diff --git a/setools/sesearch/main.fmf b/setools/sesearch/main.fmf index 155469e..5ea16da 100644 --- a/setools/sesearch/main.fmf +++ b/setools/sesearch/main.fmf @@ -35,7 +35,7 @@ link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1595582 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=920981 - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1595572 -adjust: +adjust+: - enabled: false when: distro == rhel-4 continue: false diff --git a/setroubleshoot/independent-on-initscripts/main.fmf b/setroubleshoot/independent-on-initscripts/main.fmf index a5735d9..c1563a5 100644 --- a/setroubleshoot/independent-on-initscripts/main.fmf +++ b/setroubleshoot/independent-on-initscripts/main.fmf @@ -11,7 +11,7 @@ enabled: true link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2365614 - verifies: https://issues.redhat.com/browse/RHEL-90842 -adjust: +adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, rhel-9, centos-stream-8, centos-stream-9 From c04e1fa7a8ffada7bfc01d16d0896d418392e7c8 Mon Sep 17 00:00:00 2001 From: Stepan Broz Date: Tue, 14 Oct 2025 19:30:04 +0200 Subject: [PATCH 557/626] valkey-and-similar: Adjust relevancy This currently only verifies RHEL-108982 (should be fixed in RHEL-9.8) and RHEL-102631 (fixed in RHEL-10.1), disable the test anywhere else for now. --- selinux-policy/valkey-and-similar/main.fmf | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/selinux-policy/valkey-and-similar/main.fmf b/selinux-policy/valkey-and-similar/main.fmf index a443dff..af010b8 100644 --- a/selinux-policy/valkey-and-similar/main.fmf +++ b/selinux-policy/valkey-and-similar/main.fmf @@ -36,5 +36,11 @@ adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 because: the package is not available there + - enabled: false + when: distro ~< rhel-9.8 + because: RHEL-108982 was fixed only here in rhel-9 + - enabled: false + when: distro ~< rhel-10.1 + because: RHEL-102631 was fixed only here in rhel-10 extra-nitrate: TC#0619564 id: 337de041-c42f-4292-99d4-f687ec629fc9 From ec5c6a63063a08ed608e37a9d1d3fe7062c78a92 Mon Sep 17 00:00:00 2001 From: jan janasek Date: Thu, 16 Oct 2025 14:17:14 +0200 Subject: [PATCH 558/626] adding test coverage for unknown permissions Unknown permissions are now handled as errors in CIL. With selinux >= 3.0: a CIL module, which contains unknown permissions, cannot be inserted via semodule -i. Error messages appear. Signed-off-by: jan janasek --- .../unknown-permissions-cil/main.fmf | 19 +++ .../unknown-permissions-cil/runtest.sh | 152 ++++++++++++++++++ 2 files changed, 171 insertions(+) create mode 100644 selinux-policy/unknown-permissions-cil/main.fmf create mode 100755 selinux-policy/unknown-permissions-cil/runtest.sh diff --git a/selinux-policy/unknown-permissions-cil/main.fmf b/selinux-policy/unknown-permissions-cil/main.fmf new file mode 100644 index 0000000..405f5da --- /dev/null +++ b/selinux-policy/unknown-permissions-cil/main.fmf @@ -0,0 +1,19 @@ +summary: test coverage for Unknown permissions are now handled as errors in CIL +description: |+ + Unknown permissions are now handled as errors in CIL +contact: Jan Janasek +component: + - selinux-policy +require: + - libselinux + - libselinux-utils + - policycoreutils-devel + - selinux-policy + - selinux-policy-targeted +environment: + AVC_ERROR: +no_avc_check +duration: 20m +enabled: true +tier: 2 +link: + - verifies: https://issues.redhat.com/browse/SELINUX-2380 diff --git a/selinux-policy/unknown-permissions-cil/runtest.sh b/selinux-policy/unknown-permissions-cil/runtest.sh new file mode 100755 index 0000000..83b2b13 --- /dev/null +++ b/selinux-policy/unknown-permissions-cil/runtest.sh @@ -0,0 +1,152 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Description: Unknown permissions are now handled as errors in CIL +# Author: Jan Janasek +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2021 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +FILE="my_policy.cil" + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlRun "sestatus" + echo "(type test_domain_t)" > $FILE + echo "(type test_file_t)" >> $FILE + sleep 2 + rlPhaseEnd + + + rlPhaseStartTest "permission watch" + echo "(allow test_domain_t test_file_t (dir (watch)))" >> $FILE + rlRun "semodule -i $FILE" + head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE + echo "(allow test_domain_t test_file_t (dir (watching)))" >> $FILE + rlRun "semodule -i $FILE" 1 + head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE + rlPhaseEnd + + rlPhaseStartTest "permission that is not defined in a class" + echo "(allow test_domain_t test_file_t (dir (add_name)))" >> $FILE + rlRun "semodule -i $FILE" + head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE + echo "(allow test_domain_t test_file_t (file (add_name)))" >> $FILE + rlRun "semodule -i $FILE" 1 + head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE + rlPhaseEnd + + rlPhaseStartTest "permission sendto" + echo "(allow test_domain_t test_file_t (node (sendto)))" >> $FILE + rlRun "semodule -i $FILE" + head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE + echo "(allow test_domain_t test_file_t (node (sendsto)))" >> $FILE + rlRun "semodule -i $FILE" 1 + head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE + echo "(allow test_domain_t test_file_t (dir (sendto)))" >> $FILE + rlRun "semodule -i $FILE" 1 + head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE + rlPhaseEnd + + rlPhaseStartTest "permission stop" + echo "(allow test_domain_t test_file_t (system (stop)))" >> $FILE + rlRun "semodule -i $FILE" + head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE + echo "(allow test_domain_t test_file_t (system (stops)))" >> $FILE + rlRun "semodule -i $FILE" 1 + head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE + echo "(allow test_domain_t test_file_t (dir (stop)))" >> $FILE + rlRun "semodule -i $FILE" 1 + head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE + rlPhaseEnd + + rlPhaseStartTest "permission reload" + echo "(allow test_domain_t test_file_t (service (reload)))" >> $FILE + rlRun "semodule -i $FILE" + head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE + echo "(allow test_domain_t test_file_t (service (reloads)))" >> $FILE + rlRun "semodule -i $FILE" 1 + head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE + echo "(allow test_domain_t test_file_t (dir (reload)))" >> $FILE + rlRun "semodule -i $FILE" 1 + head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE + rlPhaseEnd + + rlPhaseStartTest "permission use" + echo "(allow test_domain_t test_file_t (fd (use)))" >> $FILE + rlRun "semodule -i $FILE" + head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE + echo "(allow test_domain_t test_file_t (fd (using)))" >> $FILE + rlRun "semodule -i $FILE" 1 + head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE + echo "(allow test_domain_t test_file_t (dir (use)))" >> $FILE + rlRun "semodule -i $FILE" 1 + head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE + rlPhaseEnd + + rlPhaseStartTest "permission flow_in" + echo "(allow test_domain_t test_file_t (packet (flow_in)))" >> $FILE + rlRun "semodule -i $FILE" + head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE + echo "(allow test_domain_t test_file_t (packet (flows_in)))" >> $FILE + rlRun "semodule -i $FILE" 1 + head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE + echo "(allow test_domain_t test_file_t (system (flow_in)))" >> $FILE + rlRun "semodule -i $FILE" 1 + head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE + rlPhaseEnd + + rlPhaseStartTest "permission contains" + echo "(allow test_domain_t test_file_t (context (contains)))" >> $FILE + rlRun "semodule -i $FILE" + head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE + echo "(allow test_domain_t test_file_t (context (contain)))" >> $FILE + rlRun "semodule -i $FILE" 1 + head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE + echo "(allow test_domain_t test_file_t (fd (contains)))" >> $FILE + rlRun "semodule -i $FILE" 1 + head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE + rlPhaseEnd + + rlPhaseStartTest "permission lock" + echo "(allow test_domain_t test_file_t (shm (lock)))" >> $FILE + rlRun "semodule -i $FILE" + head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE + echo "(allow test_domain_t test_file_t (shm (locked)))" >> $FILE + rlRun "semodule -i $FILE" 1 + head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE + echo "(allow test_domain_t test_file_t (system (lock)))" >> $FILE + rlRun "semodule -i $FILE" 1 + head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE + rlPhaseEnd + + rlPhaseStartCleanup + rm $FILE + rlRun "semodule -r my_policy" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd From ff7b5b91471b4e7267476045911d97bc66f4424f Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Sat, 25 Oct 2025 08:33:23 +0200 Subject: [PATCH 559/626] enable the systemd-oomd test for RHEL-10 Because the systemd-oomd package is available on RHEL-10, the TC is also relevant there. --- selinux-policy/systemd-oomd/Makefile | 3 ++- selinux-policy/systemd-oomd/main.fmf | 6 ++++-- selinux-policy/systemd-oomd/runtest.sh | 4 +++- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/selinux-policy/systemd-oomd/Makefile b/selinux-policy/systemd-oomd/Makefile index d8c2bcd..f1cb2e5 100644 --- a/selinux-policy/systemd-oomd/Makefile +++ b/selinux-policy/systemd-oomd/Makefile @@ -60,6 +60,7 @@ $(METADATA): Makefile @echo "Requires: policycoreutils" >> $(METADATA) @echo "Requires: selinux-policy" >> $(METADATA) @echo "Requires: selinux-policy-targeted" >> $(METADATA) + @echo "Requires: systemd-oomd" >> $(METADATA) @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @echo "License: GPLv2" >> $(METADATA) @@ -73,7 +74,7 @@ $(METADATA): Makefile @echo "Releases: -RHEL7" >> $(METADATA) @echo "Releases: -RHEL8" >> $(METADATA) @echo "Releases: -RHEL9" >> $(METADATA) - @echo "Releases: -RHEL10" >> $(METADATA) + @echo "Bug: RHEL-106998" >> $(METADATA) # RHEL-10 rhts-lint $(METADATA) diff --git a/selinux-policy/systemd-oomd/main.fmf b/selinux-policy/systemd-oomd/main.fmf index 149583d..3131c08 100644 --- a/selinux-policy/systemd-oomd/main.fmf +++ b/selinux-policy/systemd-oomd/main.fmf @@ -18,6 +18,7 @@ recommend: - selinux-policy - selinux-policy-targeted - setools-console + - systemd-oomd environment: AVC_ERROR: +no_avc_check duration: 5m @@ -29,11 +30,12 @@ tag: - NoRHEL7 - NoRHEL8 - NoRHEL9 - - NoRHEL10 - TierCandidatesPASS - targeted - NoRHIVOS +link: + - verifies: https://issues.redhat.com/browse/RHEL-106998 adjust+: - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, rhel-9, rhel-10 + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, rhel-9 continue: false diff --git a/selinux-policy/systemd-oomd/runtest.sh b/selinux-policy/systemd-oomd/runtest.sh index 6ab389b..dd3e54f 100755 --- a/selinux-policy/systemd-oomd/runtest.sh +++ b/selinux-policy/systemd-oomd/runtest.sh @@ -30,6 +30,7 @@ . /usr/share/beakerlib/beakerlib.sh || exit 1 PACKAGE="selinux-policy" +SERVICE_PACKAGE="systemd-oomd" SERVICE_NAME="systemd-oomd" FILE_PATH="/usr/lib/systemd/systemd-oomd" FILE_CONTEXT="systemd_oomd_exec_t" @@ -61,7 +62,7 @@ rlJournalStart rlSESetTimestamp rlRun "cat /etc/system-release" rlRun "uname -a" - rlRun "rpm -qa \"selinux-*\" \"systemd*\"|sort" + rlRun "rpm -qa | grep -e selinux-policy -e systemd | sort" rlPhaseEnd rlPhaseStartTest "SELinux contexts and rules" @@ -146,3 +147,4 @@ EOF rlPhaseEnd rlJournalPrintText rlJournalEnd + From d4ebe95f73e99408c076857f79b216e7e904409a Mon Sep 17 00:00:00 2001 From: jan janasek Date: Mon, 10 Nov 2025 13:09:08 +0100 Subject: [PATCH 560/626] renaming type test_file_t On rhel9 there is a another type with this name so it is colliding, so my_test_file_t will be used in this test futher. Signed-off-byt: jan janasek --- .../unknown-permissions-cil/runtest.sh | 54 +++++++++---------- 1 file changed, 27 insertions(+), 27 deletions(-) diff --git a/selinux-policy/unknown-permissions-cil/runtest.sh b/selinux-policy/unknown-permissions-cil/runtest.sh index 83b2b13..8bf258f 100755 --- a/selinux-policy/unknown-permissions-cil/runtest.sh +++ b/selinux-policy/unknown-permissions-cil/runtest.sh @@ -36,110 +36,110 @@ rlJournalStart rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted rlRun "sestatus" - echo "(type test_domain_t)" > $FILE - echo "(type test_file_t)" >> $FILE + echo "(type my_test_domain_t)" > $FILE + echo "(type my_test_file_t)" >> $FILE sleep 2 rlPhaseEnd rlPhaseStartTest "permission watch" - echo "(allow test_domain_t test_file_t (dir (watch)))" >> $FILE + echo "(allow my_test_domain_t my_test_file_t (dir (watch)))" >> $FILE rlRun "semodule -i $FILE" head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE - echo "(allow test_domain_t test_file_t (dir (watching)))" >> $FILE + echo "(allow my_test_domain_t my_test_file_t (dir (watching)))" >> $FILE rlRun "semodule -i $FILE" 1 head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE rlPhaseEnd rlPhaseStartTest "permission that is not defined in a class" - echo "(allow test_domain_t test_file_t (dir (add_name)))" >> $FILE + echo "(allow my_test_domain_t my_test_file_t (dir (add_name)))" >> $FILE rlRun "semodule -i $FILE" head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE - echo "(allow test_domain_t test_file_t (file (add_name)))" >> $FILE + echo "(allow my_test_domain_t my_test_file_t (file (add_name)))" >> $FILE rlRun "semodule -i $FILE" 1 head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE rlPhaseEnd rlPhaseStartTest "permission sendto" - echo "(allow test_domain_t test_file_t (node (sendto)))" >> $FILE + echo "(allow my_test_domain_t my_test_file_t (node (sendto)))" >> $FILE rlRun "semodule -i $FILE" head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE - echo "(allow test_domain_t test_file_t (node (sendsto)))" >> $FILE + echo "(allow my_test_domain_t my_test_file_t (node (sendsto)))" >> $FILE rlRun "semodule -i $FILE" 1 head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE - echo "(allow test_domain_t test_file_t (dir (sendto)))" >> $FILE + echo "(allow my_test_domain_t my_test_file_t (dir (sendto)))" >> $FILE rlRun "semodule -i $FILE" 1 head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE rlPhaseEnd rlPhaseStartTest "permission stop" - echo "(allow test_domain_t test_file_t (system (stop)))" >> $FILE + echo "(allow my_test_domain_t my_test_file_t (system (stop)))" >> $FILE rlRun "semodule -i $FILE" head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE - echo "(allow test_domain_t test_file_t (system (stops)))" >> $FILE + echo "(allow my_test_domain_t my_test_file_t (system (stops)))" >> $FILE rlRun "semodule -i $FILE" 1 head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE - echo "(allow test_domain_t test_file_t (dir (stop)))" >> $FILE + echo "(allow my_test_domain_t my_test_file_t (dir (stop)))" >> $FILE rlRun "semodule -i $FILE" 1 head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE rlPhaseEnd rlPhaseStartTest "permission reload" - echo "(allow test_domain_t test_file_t (service (reload)))" >> $FILE + echo "(allow my_test_domain_t my_test_file_t (service (reload)))" >> $FILE rlRun "semodule -i $FILE" head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE - echo "(allow test_domain_t test_file_t (service (reloads)))" >> $FILE + echo "(allow my_test_domain_t my_test_file_t (service (reloads)))" >> $FILE rlRun "semodule -i $FILE" 1 head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE - echo "(allow test_domain_t test_file_t (dir (reload)))" >> $FILE + echo "(allow my_test_domain_t my_test_file_t (dir (reload)))" >> $FILE rlRun "semodule -i $FILE" 1 head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE rlPhaseEnd rlPhaseStartTest "permission use" - echo "(allow test_domain_t test_file_t (fd (use)))" >> $FILE + echo "(allow my_test_domain_t my_test_file_t (fd (use)))" >> $FILE rlRun "semodule -i $FILE" head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE - echo "(allow test_domain_t test_file_t (fd (using)))" >> $FILE + echo "(allow my_test_domain_t my_test_file_t (fd (using)))" >> $FILE rlRun "semodule -i $FILE" 1 head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE - echo "(allow test_domain_t test_file_t (dir (use)))" >> $FILE + echo "(allow my_test_domain_t my_test_file_t (dir (use)))" >> $FILE rlRun "semodule -i $FILE" 1 head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE rlPhaseEnd rlPhaseStartTest "permission flow_in" - echo "(allow test_domain_t test_file_t (packet (flow_in)))" >> $FILE + echo "(allow my_test_domain_t my_test_file_t (packet (flow_in)))" >> $FILE rlRun "semodule -i $FILE" head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE - echo "(allow test_domain_t test_file_t (packet (flows_in)))" >> $FILE + echo "(allow my_test_domain_t my_test_file_t (packet (flows_in)))" >> $FILE rlRun "semodule -i $FILE" 1 head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE - echo "(allow test_domain_t test_file_t (system (flow_in)))" >> $FILE + echo "(allow my_test_domain_t my_test_file_t (system (flow_in)))" >> $FILE rlRun "semodule -i $FILE" 1 head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE rlPhaseEnd rlPhaseStartTest "permission contains" - echo "(allow test_domain_t test_file_t (context (contains)))" >> $FILE + echo "(allow my_test_domain_t my_test_file_t (context (contains)))" >> $FILE rlRun "semodule -i $FILE" head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE - echo "(allow test_domain_t test_file_t (context (contain)))" >> $FILE + echo "(allow my_test_domain_t my_test_file_t (context (contain)))" >> $FILE rlRun "semodule -i $FILE" 1 head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE - echo "(allow test_domain_t test_file_t (fd (contains)))" >> $FILE + echo "(allow my_test_domain_t my_test_file_t (fd (contains)))" >> $FILE rlRun "semodule -i $FILE" 1 head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE rlPhaseEnd rlPhaseStartTest "permission lock" - echo "(allow test_domain_t test_file_t (shm (lock)))" >> $FILE + echo "(allow my_test_domain_t my_test_file_t (shm (lock)))" >> $FILE rlRun "semodule -i $FILE" head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE - echo "(allow test_domain_t test_file_t (shm (locked)))" >> $FILE + echo "(allow my_test_domain_t my_test_file_t (shm (locked)))" >> $FILE rlRun "semodule -i $FILE" 1 head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE - echo "(allow test_domain_t test_file_t (system (lock)))" >> $FILE + echo "(allow my_test_domain_t my_test_file_t (system (lock)))" >> $FILE rlRun "semodule -i $FILE" 1 head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE rlPhaseEnd From 5842e540150649012aca404dff6233b92bb33fb2 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Fri, 7 Nov 2025 10:46:40 +0100 Subject: [PATCH 561/626] fix the targetd-and-similar test The automated test runs the following command which produces an error: # targetctl clear Traceback (most recent call last): File "/usr/bin/targetctl", line 7, in sys.exit(main()) ~~~~^^ File "/usr/lib/python3.14/site-packages/rtslib/targetctl.py", line 79, in main funcs[sys.argv[1]](savefile) ~~~~~~~~~~~~~~~~~~^^^^^^^^^^ TypeError: clear() takes 0 positional arguments but 1 was given # echo $? 1 # Even though SELinux is not the cause, the test fails because of the error. To work around that problem, the expected exit code is between 0 and 255 now. --- selinux-policy/targetd-and-similar/runtest.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/selinux-policy/targetd-and-similar/runtest.sh b/selinux-policy/targetd-and-similar/runtest.sh index c0530e8..2c11ecb 100755 --- a/selinux-policy/targetd-and-similar/runtest.sh +++ b/selinux-policy/targetd-and-similar/runtest.sh @@ -169,7 +169,7 @@ rlJournalStart rlPhaseStartTest "real scenario -- standalone service" rlRun "rm -f /etc/target/saveconfig.json" rlRun "rm -f /etc/target/targetd.yaml" - rlRun "targetctl clear" + rlRun "targetctl clear" 0-255 rlRun "targetctl save" rlRun "echo \"password: Str0nGp4ssw0rD\" > /etc/target/targetd.yaml" rlRun "sed -i \"s/use_lvmetad = 1/use_lvmetad = 0/\" /etc/lvm/lvm.conf" From 752ee72f5ab8a72cac9d3f2536806294eb187b96 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Fri, 7 Nov 2025 14:25:19 +0100 Subject: [PATCH 562/626] test if stress-ng can read+write+map /secretmem anon inodes Recently, a regular kernel + stress-ng testing revealed that SELinux prevents the stress-ng program from writing (syscall = ftruncate) and reading (syscall = mmap) the /secretmem anon inodes. The TC reproduces the situation. In order to enable various stress-ng functions, I believe that SELinux policy should allow the actions mentioned above. The TC looks for appropriate policy rules and file context patterns. The TC covers RHEL-116154 and RHELTEST-2022. --- selinux-policy/anon_inode-and-similar/Makefile | 2 ++ selinux-policy/anon_inode-and-similar/main.fmf | 2 ++ selinux-policy/anon_inode-and-similar/runtest.sh | 4 ++++ 3 files changed, 8 insertions(+) diff --git a/selinux-policy/anon_inode-and-similar/Makefile b/selinux-policy/anon_inode-and-similar/Makefile index 69a0f7f..80b8415 100644 --- a/selinux-policy/anon_inode-and-similar/Makefile +++ b/selinux-policy/anon_inode-and-similar/Makefile @@ -71,6 +71,8 @@ $(METADATA): Makefile @echo "Bug: RHEL-11792" >> $(METADATA) # RHEL-9 @echo "Bug: 2270895" >> $(METADATA) # Fedora 41 @echo "Bug: RHEL-60837" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-116154" >> $(METADATA) # RHEL-10 + @echo "Bug: RHELTEST-2022" >> $(METADATA) # RHEL-10 rhts-lint $(METADATA) diff --git a/selinux-policy/anon_inode-and-similar/main.fmf b/selinux-policy/anon_inode-and-similar/main.fmf index 08c5b28..7434a87 100644 --- a/selinux-policy/anon_inode-and-similar/main.fmf +++ b/selinux-policy/anon_inode-and-similar/main.fmf @@ -42,6 +42,8 @@ link: - verifies: https://issues.redhat.com/browse/RHEL-11792 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2270895 - verifies: https://issues.redhat.com/browse/RHEL-60837 + - verifies: https://issues.redhat.com/browse/RHEL-116154 + - verifies: https://issues.redhat.com/browse/RHELTEST-2022 adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8 diff --git a/selinux-policy/anon_inode-and-similar/runtest.sh b/selinux-policy/anon_inode-and-similar/runtest.sh index 8a506d3..0732ea1 100755 --- a/selinux-policy/anon_inode-and-similar/runtest.sh +++ b/selinux-policy/anon_inode-and-similar/runtest.sh @@ -107,6 +107,10 @@ rlJournalStart rlSESearchRule "type_transition sysadm_t sysadm_t : anon_inode secretmem_t [secretmem]" rlRun "stress-ng --resources 16 --timeout 5 --log-file /dev/null" rlPhaseEnd + + rlPhaseStartTest "RHEL-116154 + RHELTEST-2022" + rlSESearchRule "allow unconfined_t secretmem_t : anon_inode { map read write } [ ]" + rlPhaseEnd fi rlPhaseStartCleanup From 98bb59b1586d438257af93814806c9a231ba91e8 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 21 Oct 2025 11:25:05 +0200 Subject: [PATCH 563/626] test if dhcpcd-run-hooks can write into /etc/chrony.conf file A recent dhcpcd + selinux-policy testing revealed that SELinux prevents the running dhcpcd-run-hooks script from writing into /etc/chrony.conf file on s390x machines. The TC reproduces the situation, which is accompanied by the following error message: dhcpcd[...]: /usr/libexec/dhcpcd-run-hooks: line 132: /etc/chrony.conf: Permission denied In order to support the intended dhcpcd-run-hooks function and to avoid such errors in the journal, I believe that SELinux policy should allow the access. The TC looks for appropriate policy rules and file context patterns. The TC covers RHEL-113937 and RHEL-113941. --- selinux-policy/dhcpcd-and-similar/Makefile | 2 ++ selinux-policy/dhcpcd-and-similar/main.fmf | 2 ++ selinux-policy/dhcpcd-and-similar/runtest.sh | 9 +++++++++ 3 files changed, 13 insertions(+) diff --git a/selinux-policy/dhcpcd-and-similar/Makefile b/selinux-policy/dhcpcd-and-similar/Makefile index 4b3f11f..eb537ff 100644 --- a/selinux-policy/dhcpcd-and-similar/Makefile +++ b/selinux-policy/dhcpcd-and-similar/Makefile @@ -69,6 +69,8 @@ $(METADATA): Makefile @echo "Bug: 2270733" >> $(METADATA) # Fedora 41 @echo "Bug: RHEL-33081" >> $(METADATA) # RHEL-10 @echo "Bug: RHEL-43417" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-113937" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-113941" >> $(METADATA) # RHEL-9 rhts-lint $(METADATA) diff --git a/selinux-policy/dhcpcd-and-similar/main.fmf b/selinux-policy/dhcpcd-and-similar/main.fmf index ed382df..939e1cd 100644 --- a/selinux-policy/dhcpcd-and-similar/main.fmf +++ b/selinux-policy/dhcpcd-and-similar/main.fmf @@ -37,6 +37,8 @@ link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2270733 - verifies: https://issues.redhat.com/browse/RHEL-33081 - verifies: https://issues.redhat.com/browse/RHEL-43417 + - verifies: https://issues.redhat.com/browse/RHEL-113937 + - verifies: https://issues.redhat.com/browse/RHEL-113941 adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7 diff --git a/selinux-policy/dhcpcd-and-similar/runtest.sh b/selinux-policy/dhcpcd-and-similar/runtest.sh index c856c12..6fcebba 100755 --- a/selinux-policy/dhcpcd-and-similar/runtest.sh +++ b/selinux-policy/dhcpcd-and-similar/runtest.sh @@ -109,6 +109,15 @@ rlJournalStart rlPhaseEnd fi + if rlIsRHEL '> 9.7' || rlIsRHEL '> 10.1' ; then + rlPhaseStartTest "RHEL-113937 + RHEL-113941" + rlSEMatchPathCon "/usr/libexec/dhcpcd-run-hooks" "bin_t" + CONF_FILE_CONTEXT=`secon --type --file /etc/chrony.conf` + rlSESearchRule "allow dhcpc_t ${CONF_FILE_CONTEXT} : file { write } [ ]" + rlPhase + fi + + rlPhaseStartTest "real scenario -- standalone service" if ! rlIsRHEL "<9.5" ; then rlRun "ip netns add test-ns" From c49440dfb5d98b436ee0c38fbe55045b1cad3b26 Mon Sep 17 00:00:00 2001 From: Therese Cornell Date: Mon, 17 Nov 2025 11:14:54 -0500 Subject: [PATCH 564/626] cups-browsed-and-similar: Ignore specific AVC denial on RHEL/centos-9 due to RHEL-47401 --- selinux-policy/cups-browsed-and-similar/runtest.sh | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/selinux-policy/cups-browsed-and-similar/runtest.sh b/selinux-policy/cups-browsed-and-similar/runtest.sh index fc6e607..f6235dd 100755 --- a/selinux-policy/cups-browsed-and-similar/runtest.sh +++ b/selinux-policy/cups-browsed-and-similar/runtest.sh @@ -94,7 +94,12 @@ rlJournalStart rlPhaseStartCleanup sleep 2 - rlSECheckAVC + # Ignore specific avc denial on rhel-9 due to RHEL-47401 + if rlIsRHEL 9 || rlIsCentOS 9; then + rlSECheckAVC --ignore 'type=AVC.*comm=cups-browsed.*name=lpoptions.*scontext=.*:cupsd_t:.*tcontext=.*:admin_home_t:.*tclass=file' + else + rlSECheckAVC + fi rlFileRestore rlServiceRestore ${SERVICE_NAME} From 06e24b7df4781e130f96ea3a37d158b1e6c8aa07 Mon Sep 17 00:00:00 2001 From: Stepan Broz Date: Fri, 14 Nov 2025 19:46:36 +0100 Subject: [PATCH 565/626] power-profiles-daemon-and-similari: adjust RHEL-100718 relevancy Do not test this phase under RHEL-9.7 as it was only fixed there. --- .../runtest.sh | 22 ++++++++++++------- 1 file changed, 14 insertions(+), 8 deletions(-) diff --git a/selinux-policy/power-profiles-daemon-and-similar/runtest.sh b/selinux-policy/power-profiles-daemon-and-similar/runtest.sh index d2bd088..1a7b2b1 100755 --- a/selinux-policy/power-profiles-daemon-and-similar/runtest.sh +++ b/selinux-policy/power-profiles-daemon-and-similar/runtest.sh @@ -74,6 +74,7 @@ rlJournalStart rlPhaseEnd fi + if ! rlIsRHEL '<9.7'; then rlPhaseStartTest "RHEL-100718" if [ -d /sys/devices/system/cpu/cpufreq ] ; then for CUR_FILE in `find /sys/devices/system/cpu/cpufreq -type f -name energy_performance_preference` ; do @@ -83,6 +84,7 @@ rlJournalStart fi rlSESearchRule "allow powerprofiles_t fs_t : filesystem { getattr } [ ]" rlPhaseEnd + fi if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" @@ -92,16 +94,20 @@ rlJournalStart rlRun "powerprofilesctl version" rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status" 1 - ORIG_PROFILE=`powerprofilesctl get` - if echo ${ORIG_PROFILE} | grep -q balanced ; then - rlRun "powerprofilesctl set power-saver" 0,1 + if ! rlIsRHEL '<9.7' ; then + ORIG_PROFILE=`powerprofilesctl get` + if echo ${ORIG_PROFILE} | grep -q balanced ; then + rlRun "powerprofilesctl set power-saver" 0,1 + else + rlRun "powerprofilesctl set balanced" 0,1 + fi + sleep 2 + rlRun "powerprofilesctl get" + rlRun "powerprofilesctl set ${ORIG_PROFILE}" + sleep 2 else - rlRun "powerprofilesctl set balanced" 0,1 + rlRun "powerprofilesctl get" fi - sleep 2 - rlRun "powerprofilesctl get" - rlRun "powerprofilesctl set ${ORIG_PROFILE}" - sleep 2 rlRun "powerprofilesctl launch echo" 0,1 rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "stop status" 1 rlPhaseEnd From 4d5af50a2a53d3a26cc12c623145cd8059be6034 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Mon, 24 Nov 2025 08:29:41 +0100 Subject: [PATCH 566/626] fix few failing tests Package installation attempts may fail, but the rest of test code may still succeed. Expected exit codes were updated. --- selinux-policy/dhclient-and-similar/runtest.sh | 5 ++++- selinux-policy/iio-sensor-proxy-and-similar/runtest.sh | 2 +- selinux-policy/libvirt-dbus-and-similar/runtest.sh | 2 +- selinux-policy/systemd-rfkill-and-similar/runtest.sh | 4 ++-- 4 files changed, 8 insertions(+), 5 deletions(-) diff --git a/selinux-policy/dhclient-and-similar/runtest.sh b/selinux-policy/dhclient-and-similar/runtest.sh index 1c681c1..247727e 100755 --- a/selinux-policy/dhclient-and-similar/runtest.sh +++ b/selinux-policy/dhclient-and-similar/runtest.sh @@ -74,12 +74,15 @@ rlJournalStart if which dhclient >& /dev/null ; then rlPhaseStartTest "real scenario" rlRun "rm -rf /run/chrony-dhcp" - rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 + rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 rlRun "dhclient" DHCLIENT_PID=`pgrep dhclient` rlRun "ps -efZ | grep dhclient" rlRun "ps -efZ | grep ':dhcpc_t:.*dhclient'" if ! rlIsRHEL 8 && ! rlIsCentOS 8 ; then + rlRun "grep CHRONY_SOURCEDIR /etc/dhcp/dhclient.d/chrony.sh" + rlRun "grep sourcedir /etc/chrony.conf" + sleep 5 rlRun "ls -alZ /run/chrony-dhcp" fi rlPhaseEnd diff --git a/selinux-policy/iio-sensor-proxy-and-similar/runtest.sh b/selinux-policy/iio-sensor-proxy-and-similar/runtest.sh index 224e218..804509f 100755 --- a/selinux-policy/iio-sensor-proxy-and-similar/runtest.sh +++ b/selinux-policy/iio-sensor-proxy-and-similar/runtest.sh @@ -84,7 +84,7 @@ rlJournalStart rlRun "sed -i 's/^.*Environment=.*$/Environment=FAKE_LIGHT_SENSOR=1/' /etc/systemd/system/iio-sensor-proxy.service" rlRun "systemctl daemon-reload" rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status" 1 - rlRun "gdbus introspect --system --dest net.hadess.SensorProxy --object-path /net/hadess/SensorProxy" + rlRun "gdbus introspect --system --dest net.hadess.SensorProxy --object-path /net/hadess/SensorProxy" 0,1 rlWatchdog "monitor-sensor --all" 10 rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "stop status" 1 rlPhaseEnd diff --git a/selinux-policy/libvirt-dbus-and-similar/runtest.sh b/selinux-policy/libvirt-dbus-and-similar/runtest.sh index d6907cb..e0d9a7d 100755 --- a/selinux-policy/libvirt-dbus-and-similar/runtest.sh +++ b/selinux-policy/libvirt-dbus-and-similar/runtest.sh @@ -52,7 +52,7 @@ rlJournalStart rlAssertRpm ${SERVICE_PACKAGE} rlServiceStop ${SERVICE_NAME} - rlRun "yum -y install libvirt\* --skip-broken -x \*i686\* -x glibc32" + rlRun "yum -y install libvirt\* --skip-broken -x \*i686\* -x glibc32" 0,1 rlSESetEnforce rlSEStatus diff --git a/selinux-policy/systemd-rfkill-and-similar/runtest.sh b/selinux-policy/systemd-rfkill-and-similar/runtest.sh index 793993a..b92186f 100755 --- a/selinux-policy/systemd-rfkill-and-similar/runtest.sh +++ b/selinux-policy/systemd-rfkill-and-similar/runtest.sh @@ -48,9 +48,9 @@ rlJournalStart rlRun "rpm -qa kernel\*" rlRun "uname -r" if ! rlCheckRpm kernel-automotive ; then - rlRun "yum -y install kernel-modules-`uname -r`" + rlRun "yum -y install kernel-modules-`uname -r`" 0,1 else - rlRun "dnf -y install kernel-automotive-modules-`uname -r`" + rlRun "dnf -y install kernel-automotive-modules-`uname -r`" 0,1 fi rlServiceStop ${SERVICE_NAME} From 5f241c5352ae00434af443eb118b497fb9294727 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 25 Nov 2025 21:58:03 +0100 Subject: [PATCH 567/626] test if 'restorecon -i' ignores missing filesystem objects A recently reported customer case revealed that the restorecon program produces error messages even if it was executed with the '-i' option. In such case no error messages should appear when the inspected filesystem objects are missing. The TC reproduces the situation when old libselinux/policycoreutils packages are installed. The TC covers RHEL-110181 and RHEL-123884. --- .../restorecon-ignores-missing/main.fmf | 27 ++++++++++++ .../restorecon-ignores-missing/runtest.sh | 41 +++++++++++++++++++ 2 files changed, 68 insertions(+) create mode 100644 policycoreutils/restorecon-ignores-missing/main.fmf create mode 100755 policycoreutils/restorecon-ignores-missing/runtest.sh diff --git a/policycoreutils/restorecon-ignores-missing/main.fmf b/policycoreutils/restorecon-ignores-missing/main.fmf new file mode 100644 index 0000000..eaf0fcb --- /dev/null +++ b/policycoreutils/restorecon-ignores-missing/main.fmf @@ -0,0 +1,27 @@ +summary: 'restorecon -i' should ignore missing files/directories +description: Does 'restorecon -i' work as expected? +contact: Milos Malik +component: + - libselinux + - policycoreutils +recommend: + - libselinux + - policycoreutils +duration: 5m +enabled: true +tag: + - CI-Tier-1 + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - NoRHEL8 + - targeted +tier: 1 +link: + - verifies: https://issues.redhat.com/browse/RHEL-110181 + - verifies: https://issues.redhat.com/browse/RHEL-123884 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 + continue: false diff --git a/policycoreutils/restorecon-ignores-missing/runtest.sh b/policycoreutils/restorecon-ignores-missing/runtest.sh new file mode 100755 index 0000000..f7e0049 --- /dev/null +++ b/policycoreutils/restorecon-ignores-missing/runtest.sh @@ -0,0 +1,41 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +. /usr/share/beakerlib/beakerlib.sh + +rlJournalStart + rlPhaseStartSetup + rlRun "rpm -qa | grep -e libselinux -e policycoreutils | sort" + rlRun "man restorecon | col -b | grep -i 'ignore.*exist'" + rlRun "mkdir -p tmp" + OUTPUT_FILE=`mktemp` + rlPhaseEnd + + rlPhaseStartTest "RHEL-110181 + RHEL-123884" + rlRun "pushd tmp" + rlLog "starting the creator process" + ( while true ; do + mkdir dir + mkfifo fifo + touch file + chcon -t etc_t dir fifo file + rm -rf dir fifo file + done ) & + CREATOR_PID=$! + rlRun "popd" + + rlLog "starting the restorecon process" + ( while true ; do restorecon -RFivv tmp ; done ) >& ${OUTPUT_FILE} & + RESTORECON_PID=$! + + rlRun "sleep 30s" + rlRun "kill ${CREATOR_PID}" 0,1 + rlRun "kill ${RESTORECON_PID}" 0,1 + rlRun "ls -l ${OUTPUT_FILE}" + rlRun "grep -i -e 'no such file' -e 'not set context' ${OUTPUT_FILE}" 1 + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "rm -rf tmp ${OUTPUT_FILE}" + rlPhaseEnd +rlJournalEnd + From 54a83ea1e51554fef1bedd850f6baf04ace1158d Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Wed, 3 Dec 2025 13:32:10 +0100 Subject: [PATCH 568/626] add metadata and fix description+summary Unfortunately, the test was merged even if some metadata was missing. Additionally, the description and summary contains characters which are not allowed based on the output of: tmt tests lint. Both problems should be fixed now. --- policycoreutils/restorecon-ignores-missing/main.fmf | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/policycoreutils/restorecon-ignores-missing/main.fmf b/policycoreutils/restorecon-ignores-missing/main.fmf index eaf0fcb..f1fc727 100644 --- a/policycoreutils/restorecon-ignores-missing/main.fmf +++ b/policycoreutils/restorecon-ignores-missing/main.fmf @@ -1,5 +1,5 @@ -summary: 'restorecon -i' should ignore missing files/directories -description: Does 'restorecon -i' work as expected? +summary: restorecon -i should ignore missing files/directories +description: Does restorecon -i work as expected? contact: Milos Malik component: - libselinux @@ -25,3 +25,5 @@ adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 continue: false +extra-nitrate: TC#0619904 +id: baf5db72-ac2b-4d70-90a2-806073285d7c From 8e7a591a84ac7f07728906b7ddbe315d79f88960 Mon Sep 17 00:00:00 2001 From: Jan Onderka Date: Thu, 18 Dec 2025 14:45:32 +0100 Subject: [PATCH 569/626] libselinux/setenforce test update audit-rules package dependency for RHEL10+ and making test fail if 'auditctl' is not present on the system --- libselinux/setenforce/main.fmf | 4 ++++ libselinux/setenforce/runtest.sh | 1 + 2 files changed, 5 insertions(+) diff --git a/libselinux/setenforce/main.fmf b/libselinux/setenforce/main.fmf index 900021b..c45ed37 100644 --- a/libselinux/setenforce/main.fmf +++ b/libselinux/setenforce/main.fmf @@ -26,6 +26,10 @@ adjust+: - enabled: false when: distro == rhel-4, rhel-5 continue: false + - when: distro > rhel-9 + recommend+: + - audit-rules + because: since RHEL 10 package audit was split and early packages have wrong dependency extra-nitrate: TC#0543754 extra-summary: /CoreOS/libselinux/Sanity/setenforce extra-task: /CoreOS/libselinux/Sanity/setenforce diff --git a/libselinux/setenforce/runtest.sh b/libselinux/setenforce/runtest.sh index a4140d3..7bddb5d 100755 --- a/libselinux/setenforce/runtest.sh +++ b/libselinux/setenforce/runtest.sh @@ -50,6 +50,7 @@ rlJournalStart rlPhaseEnd rlPhaseStartTest "basic use" + rlRun "which auditctl" 0 "'auditctl' have to be present for proper functioning, failing test otherwise" START_DATE_TIME=`date "+%m/%d/%Y %T"` sleep 1 rlRun "setenforce 1" From 7ccb3c22cc047ccffc5b1a6dea8f1513b7e9ce7a Mon Sep 17 00:00:00 2001 From: Jan Onderka Date: Fri, 19 Dec 2025 11:47:50 +0100 Subject: [PATCH 570/626] setting additional audit-rules package as recommend for policycoreutils/load_policy --- libselinux/setenforce/main.fmf | 2 +- policycoreutils/load_policy/main.fmf | 4 ++++ 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/libselinux/setenforce/main.fmf b/libselinux/setenforce/main.fmf index c45ed37..7b178b8 100644 --- a/libselinux/setenforce/main.fmf +++ b/libselinux/setenforce/main.fmf @@ -26,7 +26,7 @@ adjust+: - enabled: false when: distro == rhel-4, rhel-5 continue: false - - when: distro > rhel-9 + - when: distro >= rhel-10 recommend+: - audit-rules because: since RHEL 10 package audit was split and early packages have wrong dependency diff --git a/policycoreutils/load_policy/main.fmf b/policycoreutils/load_policy/main.fmf index b4e572f..aae0df7 100644 --- a/policycoreutils/load_policy/main.fmf +++ b/policycoreutils/load_policy/main.fmf @@ -28,6 +28,10 @@ adjust+: - enabled: false when: distro == rhel-4, rhel-5 continue: false + - when: distro >= rhel-10 + recommend+: + - audit-rules + because: since RHEL 10 package audit was split and early packages have wrong dependency extra-nitrate: TC#0542457 extra-summary: /CoreOS/policycoreutils/Sanity/load_policy extra-task: /CoreOS/policycoreutils/Sanity/load_policy From 40243c00aae3816e7652ffba435628db4048ebfc Mon Sep 17 00:00:00 2001 From: Stepan Broz Date: Fri, 14 Nov 2025 18:17:28 +0100 Subject: [PATCH 571/626] systemd-journal-upload: Adjust test relevancy The only sub-test present currently is fixed in RHEL-9.7 and RHEL-10.0. Do not test below these versions. --- selinux-policy/systemd-journal-upload/main.fmf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/selinux-policy/systemd-journal-upload/main.fmf b/selinux-policy/systemd-journal-upload/main.fmf index 7a2c000..35dc2f4 100644 --- a/selinux-policy/systemd-journal-upload/main.fmf +++ b/selinux-policy/systemd-journal-upload/main.fmf @@ -32,7 +32,7 @@ link: - verifies: https://issues.redhat.com/browse/RHEL-62196 adjust+: - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + when: distro < rhel-9.7 continue: false extra-summary: /CoreOS/selinux-policy/Regression/systemd-journal-upload extra-task: /CoreOS/selinux-policy/Regression/systemd-journal-upload From 1402404f9d7b04b305823944f333b5c25ccd9e39 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Mon, 5 Jan 2026 15:47:09 +0100 Subject: [PATCH 572/626] test if python code produces deprecation messages related to SWIG When python modules are imported, DeprecationWarning messages can appear. They are caused by the Swig code used in those modules. Purpose of this TC is to find them. The TC covers RHEL-118812, RHEL-138405 and RHEL-138406. --- other/swig-deprecation-warnings/main.fmf | 32 ++++++++++++++++++ other/swig-deprecation-warnings/runtest.sh | 38 ++++++++++++++++++++++ 2 files changed, 70 insertions(+) create mode 100644 other/swig-deprecation-warnings/main.fmf create mode 100755 other/swig-deprecation-warnings/runtest.sh diff --git a/other/swig-deprecation-warnings/main.fmf b/other/swig-deprecation-warnings/main.fmf new file mode 100644 index 0000000..3517e20 --- /dev/null +++ b/other/swig-deprecation-warnings/main.fmf @@ -0,0 +1,32 @@ +summary: test if python code produces deprecation messages +contact: Milos Malik +test: ./runtest.sh +framework: beakerlib +component: + - libselinux + - libsemanage + - policycoreutils + - setools +recommend: + - python3 + - python3-libselinux + - python3-libsemanage + - python3-policycoreutils + - python3-setools +duration: 5m +enabled: true +link: + - verifies: https://issues.redhat.com/browse/RHEL-118812 + - verifies: https://issues.redhat.com/browse/RHEL-138405 + - verifies: https://issues.redhat.com/browse/RHEL-138406 +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - NoRHEL8 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 + continue: false + diff --git a/other/swig-deprecation-warnings/runtest.sh b/other/swig-deprecation-warnings/runtest.sh new file mode 100755 index 0000000..16af69a --- /dev/null +++ b/other/swig-deprecation-warnings/runtest.sh @@ -0,0 +1,38 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +rlJournalStart + rlPhaseStartSetup + rlRun "sestatus" + rlRun "rpm -qa | grep -e libsepol -e libselinux -e libsemanage -e selinux-policy -e policycoreutils -e setools | sort" + rlPhaseEnd + + rlPhaseStartTest "libselinux - RHEL-118812" + rlRun -s "python3 -c \"import warnings ; warnings.simplefilter('always') ; import selinux\"" + rlRun "grep -i deprecation $rlRun_LOG" 1 + rm -f $rlRun_LOG + rlPhaseEnd + + rlPhaseStartTest "libsemanage - RHEL-138405" + rlRun -s "python3 -c \"import warnings ; warnings.simplefilter('always') ; import semanage\"" + rlRun "grep -i deprecation $rlRun_LOG" 1 + rm -f $rlRun_LOG + rlPhaseEnd + + rlPhaseStartTest "policycoreutils - RHEL-138406" + rlRun -s "python3 -c \"import warnings ; warnings.simplefilter('always') ; import seobject ; import sepolgen ; import sepolicy\"" + rlRun "grep -i deprecation $rlRun_LOG" 1 + rm -f $rlRun_LOG + rlPhaseEnd + + rlPhaseStartTest "setools" + rlRun -s "python3 -c \"import warnings ; warnings.simplefilter('always') ; import setools\"" + rlRun "grep -i deprecation $rlRun_LOG" 1 + rm -f $rlRun_LOG + rlPhaseEnd + + rlPhaseStartCleanup + rlPhaseEnd +rlJournalEnd + From f3c03861940dd49c058fb3fbae68ab50d1b3e686 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Wed, 7 Jan 2026 11:22:15 +0100 Subject: [PATCH 573/626] improve the gnome-remote-desktop test The gnome-remote-desktop service was not configured properly and that's why the test failed for a long time. The issue should be fixed now. --- .../gnome-remote-desktop-and-similar/Makefile | 2 +- .../gnome-remote-desktop-and-similar/main.fmf | 2 ++ .../gnome-remote-desktop-and-similar/runtest.sh | 10 ++++++++++ 3 files changed, 13 insertions(+), 1 deletion(-) diff --git a/selinux-policy/gnome-remote-desktop-and-similar/Makefile b/selinux-policy/gnome-remote-desktop-and-similar/Makefile index bc72237..c68a44f 100644 --- a/selinux-policy/gnome-remote-desktop-and-similar/Makefile +++ b/selinux-policy/gnome-remote-desktop-and-similar/Makefile @@ -55,7 +55,7 @@ $(METADATA): Makefile @echo "TestTime: 10m" >> $(METADATA) @echo "RunFor: gnome-remote-desktop" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console /usr/sbin/service gnome-remote-desktop gdm" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console /usr/sbin/service gnome-remote-desktop gdm freerdp" >> $(METADATA) @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @echo "License: GPLv2" >> $(METADATA) diff --git a/selinux-policy/gnome-remote-desktop-and-similar/main.fmf b/selinux-policy/gnome-remote-desktop-and-similar/main.fmf index 7f84971..33cd021 100644 --- a/selinux-policy/gnome-remote-desktop-and-similar/main.fmf +++ b/selinux-policy/gnome-remote-desktop-and-similar/main.fmf @@ -4,6 +4,7 @@ description: |+ contact: Milos Malik component: + - gnome-remote-desktop - selinux-policy test: ./runtest.sh framework: beakerlib @@ -20,6 +21,7 @@ recommend: - /usr/sbin/service - gnome-remote-desktop - gdm + - freerdp environment: AVC_ERROR: +no_avc_check duration: 10m diff --git a/selinux-policy/gnome-remote-desktop-and-similar/runtest.sh b/selinux-policy/gnome-remote-desktop-and-similar/runtest.sh index 9c72937..2349eb1 100755 --- a/selinux-policy/gnome-remote-desktop-and-similar/runtest.sh +++ b/selinux-policy/gnome-remote-desktop-and-similar/runtest.sh @@ -73,6 +73,15 @@ rlJournalStart if [ -f /usr/lib/systemd/system/gnome-remote-desktop.service ] ; then rlPhaseStartTest "real scenario" + rlRun "rm -rf ~gnome-remote-desktop/.local/share/gnome-remote-desktop" + rlRun "sudo -u gnome-remote-desktop mkdir -p ~gnome-remote-desktop/.local/share/gnome-remote-desktop" + rlRun "sudo -u gnome-remote-desktop winpr-makecert -silent -rdp -path ~gnome-remote-desktop/.local/share/gnome-remote-desktop tls" + rlRun "grdctl --system rdp set-tls-key ~gnome-remote-desktop/.local/share/gnome-remote-desktop/tls.key" + rlRun "grdctl --system rdp set-tls-cert ~gnome-remote-desktop/.local/share/gnome-remote-desktop/tls.crt" + rlRun "grdctl --system rdp set-credentials nobody nothing" + rlRun "grdctl --system rdp enable" + rlRun "systemctl enable --now gdm" + sleep 2 rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 rlRun "grdctl --headless status" rlRun "grdctl --system status" @@ -81,6 +90,7 @@ rlJournalStart rlRun "grdctl --system status" rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 + rlRun "systemctl stop gdm" rlPhaseEnd fi From 79e29ad4216ccd322acb150b4cacf71f50c9b41f Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 27 Jan 2026 16:48:45 +0100 Subject: [PATCH 574/626] do not modify systemd services directly When tests run in image mode, it's impossible to modify files under /usr/lib/systemd/system because the filesystem is read-only. Unfortunately, some tests try to do that which leads to their failures. In order to avoid these failures, any systemd service file which requires a modification needs to be copied to /etc/systemd/system/ directory (read-write mode) and modified there. Purpose of this change is to increase the number of passing tests in image mode. --- selinux-policy/nvme-stas-and-similar/main.fmf | 4 +++- selinux-policy/nvme-stas-and-similar/runtest.sh | 14 ++++++++------ 2 files changed, 11 insertions(+), 7 deletions(-) diff --git a/selinux-policy/nvme-stas-and-similar/main.fmf b/selinux-policy/nvme-stas-and-similar/main.fmf index 8e55c79..4b7637b 100644 --- a/selinux-policy/nvme-stas-and-similar/main.fmf +++ b/selinux-policy/nvme-stas-and-similar/main.fmf @@ -32,12 +32,14 @@ tag: - targeted - failinfedora - NoRHIVOS + - epel + - rhel10-epel link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2111414 - verifies: https://issues.redhat.com/browse/RHEL-1557 adjust+: - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8, rhel-10, centos-stream-10 + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8 because: the nvme-stas package is not available there extra-summary: /CoreOS/selinux-policy/Regression/nvme-stas-and-similar extra-task: /CoreOS/selinux-policy/Regression/nvme-stas-and-similar diff --git a/selinux-policy/nvme-stas-and-similar/runtest.sh b/selinux-policy/nvme-stas-and-similar/runtest.sh index 029512f..ba83928 100755 --- a/selinux-policy/nvme-stas-and-similar/runtest.sh +++ b/selinux-policy/nvme-stas-and-similar/runtest.sh @@ -44,8 +44,6 @@ rlJournalStart rlServiceStart avahi-daemon rlServiceStop stacd stafd - rlFileBackup /usr/lib/systemd/system/stacd.service - rlFileBackup /usr/lib/systemd/system/stafd.service rlSESetEnforce rlSEStatus @@ -91,9 +89,11 @@ rlJournalStart for CUR_FILE in /usr/lib/systemd/system/stacd.service \ /usr/lib/systemd/system/stafd.service ; do if grep -q '^ExecStart=.*python' ${CUR_FILE} ; then - rlRun "sed -i 's|^ExecStart=.*python.* /|ExecStart=/|' ${CUR_FILE}" + rlRun "cp -f ${CUR_FILE} /etc/systemd/system/" + COPIED_FILE=`echo ${CUR_FILE} | sed 's|/usr/lib|/etc|'` + rlRun "sed -i 's|^ExecStart=.*python.* /|ExecStart=/|' ${COPIED_FILE}" rlRun "systemctl daemon-reload" - rlRun "grep '^ExecStart=' ${CUR_FILE}" + rlRun "grep '^ExecStart=' ${COPIED_FILE}" fi done if ! rlSEDefined ${PROCESS_CONTEXT} ; then @@ -112,7 +112,7 @@ rlJournalStart rlRun "stasadm -v" rlRun "stasadm hostid" rlRun "stasadm hostnqn" - rlRun "restorecon -Rv /var /run -e /var/ARTIFACTS" 0-255 + rlRun "restorecon -Rv /etc /var /run -e /var/ARTIFACTS" 0-255 rlSEService - stacd stacd ${PROCESS_CONTEXT} "restart status stop status" 1 rlSEService - stafd stafd ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd @@ -121,7 +121,9 @@ rlJournalStart sleep 2 rlSECheckAVC - rlFileRestore + rlRun "rm -f /etc/systemd/system/stacd.service" + rlRun "rm -f /etc/systemd/system/stafd.service" + rlRun "systemctl daemon-reload" rlServiceRestore stacd stafd rlPhaseEnd rlJournalPrintText From d8f25d24a7a0d2485d5d1dd088c5c47cddcbae94 Mon Sep 17 00:00:00 2001 From: Jan Onderka Date: Thu, 12 Feb 2026 14:05:39 +0100 Subject: [PATCH 575/626] TMT IDs added to few tests --- libselinux/selabel_lookup-and-local-changes/main.fmf | 1 + selinux-policy/unknown-permissions-cil/main.fmf | 1 + 2 files changed, 2 insertions(+) diff --git a/libselinux/selabel_lookup-and-local-changes/main.fmf b/libselinux/selabel_lookup-and-local-changes/main.fmf index 24a0713..ed09439 100644 --- a/libselinux/selabel_lookup-and-local-changes/main.fmf +++ b/libselinux/selabel_lookup-and-local-changes/main.fmf @@ -21,3 +21,4 @@ adjust+: continue: false link: - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2360183 +id: 586ca788-80fa-4ec6-8cea-36fe7520388b diff --git a/selinux-policy/unknown-permissions-cil/main.fmf b/selinux-policy/unknown-permissions-cil/main.fmf index 405f5da..3f49b3f 100644 --- a/selinux-policy/unknown-permissions-cil/main.fmf +++ b/selinux-policy/unknown-permissions-cil/main.fmf @@ -17,3 +17,4 @@ enabled: true tier: 2 link: - verifies: https://issues.redhat.com/browse/SELINUX-2380 +id: 707a837f-391b-4182-a150-e0f411afffd5 From dc54730c66a51fff4fc2b51a282cb0a1011a4043 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Mon, 16 Feb 2026 08:59:47 +0100 Subject: [PATCH 576/626] Add test for unexpected fanotify denials on anonymous pipes Signed-off-by: Ondrej Mosnacek --- kernel/fanotify-mark-anon-pipe/.gitignore | 1 + kernel/fanotify-mark-anon-pipe/main.fmf | 21 +++++++ kernel/fanotify-mark-anon-pipe/reproducer.c | 66 +++++++++++++++++++++ kernel/fanotify-mark-anon-pipe/runtest.sh | 25 ++++++++ 4 files changed, 113 insertions(+) create mode 100644 kernel/fanotify-mark-anon-pipe/.gitignore create mode 100644 kernel/fanotify-mark-anon-pipe/main.fmf create mode 100644 kernel/fanotify-mark-anon-pipe/reproducer.c create mode 100755 kernel/fanotify-mark-anon-pipe/runtest.sh diff --git a/kernel/fanotify-mark-anon-pipe/.gitignore b/kernel/fanotify-mark-anon-pipe/.gitignore new file mode 100644 index 0000000..6263bf3 --- /dev/null +++ b/kernel/fanotify-mark-anon-pipe/.gitignore @@ -0,0 +1 @@ +reproducer diff --git a/kernel/fanotify-mark-anon-pipe/main.fmf b/kernel/fanotify-mark-anon-pipe/main.fmf new file mode 100644 index 0000000..da7a540 --- /dev/null +++ b/kernel/fanotify-mark-anon-pipe/main.fmf @@ -0,0 +1,21 @@ +summary: Verify no invalid denials for fanotify_mark() on an anonymous pipe +description: | + Verify that calling fanotify_mark() on an anonymous pipe just fails + with EINVAL and doesn't fail on SELinux checks earlier. +contact: Ondrej Mosnacek +component: + - kernel +framework: beakerlib +require: + - gcc +duration: 5m +tier: 2 +check: + - how: avc +enabled: true +adjust+: + - enabled: false + when: distro < rhel-9 + because: On RHEL-8 fanotify mark is allowed on anonymous pipes. +link: + - verifies: https://issues.redhat.com/browse/RHEL-53850 diff --git a/kernel/fanotify-mark-anon-pipe/reproducer.c b/kernel/fanotify-mark-anon-pipe/reproducer.c new file mode 100644 index 0000000..c55b17d --- /dev/null +++ b/kernel/fanotify-mark-anon-pipe/reproducer.c @@ -0,0 +1,66 @@ +/* SPDX-License-Identifier: GPLv2 */ +/* Copyright (c) 2026 Red Hat, Inc. */ +/* Author: Ondrej Mosnacek */ + +#define _GNU_SOURCE + +#include +#include +#include + +#include +#include + +#include + +int main(int argc, char **argv) +{ + int ffd, ret, rc, pfd[2]; + + ret = pipe2(pfd, O_CLOEXEC); + if (ret == -1) { + perror("pipe2"); + rc = 2; + goto exit; + } + + ffd = fanotify_init(FAN_CLASS_NOTIF, O_RDONLY); + if (ffd == -1) { + perror("fanotify_init"); + rc = 2; + goto exit_close_pipes; + } + + rc = 0; + + ret = fanotify_mark(ffd, FAN_MARK_ADD | FAN_MARK_MOUNT, FAN_ACCESS, + pfd[0], NULL); + if (ret == 0) { + printf("FAIL: fanotify_mark() with FAN_MARK_MOUNT succeeded\n"); + rc = 1; + } else if (errno == EINVAL) { + printf("PASS: fanotify_mark() with FAN_MARK_MOUNT failed with EINVAL as expected\n"); + } else { + printf("FAIL: fanotify_mark() with FAN_MARK_MOUNT failed with %s\n", strerror(errno)); + rc = 1; + } + + ret = fanotify_mark(ffd, FAN_MARK_ADD | FAN_MARK_FILESYSTEM, FAN_ACCESS, + pfd[0], NULL); + if (ret == 0) { + printf("FAIL: fanotify_mark() with FAN_MARK_FILESYSTEM succeeded\n"); + rc = 1; + } else if (errno == EINVAL) { + printf("PASS: fanotify_mark() with FAN_MARK_FILESYSTEM failed with EINVAL as expected\n"); + } else { + printf("FAIL: fanotify_mark() with FAN_MARK_FILESYSTEM failed with %s\n", strerror(errno)); + rc = 1; + } + + close(ffd); +exit_close_pipes: + close(pfd[0]); + close(pfd[1]); +exit: + return rc; +} diff --git a/kernel/fanotify-mark-anon-pipe/runtest.sh b/kernel/fanotify-mark-anon-pipe/runtest.sh new file mode 100755 index 0000000..16075eb --- /dev/null +++ b/kernel/fanotify-mark-anon-pipe/runtest.sh @@ -0,0 +1,25 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# SPDX-License-Identifier: GPLv2 +# Copyright (c) 2026 Red Hat, Inc. +# Author: Ondrej Mosnacek + +# Include Beakerlib environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +rlJournalStart + rlPhaseStartSetup + rlRun "uname -r" 0 "Print kernel version" + + rlRun "gcc -o reproducer reproducer.c" 0 "Compile the reproducer" + rlPhaseEnd + + rlPhaseStartTest + rlRun "./reproducer" 0 "Run the reproducer" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "rm -f reproducer" 0 "Delete the reproducer binary" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd From 519738f7736d115cf2b5a50b35cc46fc0e5ede27 Mon Sep 17 00:00:00 2001 From: Stepan Broz Date: Tue, 17 Feb 2026 11:38:55 +0100 Subject: [PATCH 577/626] policycoreutils/restorecon-ignores-missing: Adjust relevancy RHEL-123885 fixed in RHEL-8.10 RHEL-110181 expected in RHEL-10.2 RHEL-123884 expected in RHEL-9.8 Do not test on lower versions. --- policycoreutils/restorecon-ignores-missing/main.fmf | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/policycoreutils/restorecon-ignores-missing/main.fmf b/policycoreutils/restorecon-ignores-missing/main.fmf index f1fc727..9c00dc1 100644 --- a/policycoreutils/restorecon-ignores-missing/main.fmf +++ b/policycoreutils/restorecon-ignores-missing/main.fmf @@ -15,15 +15,16 @@ tag: - NoRHEL5 - NoRHEL6 - NoRHEL7 - - NoRHEL8 - targeted tier: 1 link: - verifies: https://issues.redhat.com/browse/RHEL-110181 - verifies: https://issues.redhat.com/browse/RHEL-123884 + - verifies: https://issues.redhat.com/browse/RHEL-123885 adjust+: - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 + when: distro < rhel-8 or distro ~< rhel-9.8 or distro ~< rhel-10.2 continue: false + because: Fixed in RHEL-8.10, RHEL-10.2, RHEL-9 fix expected in RHEL-9.8 extra-nitrate: TC#0619904 id: baf5db72-ac2b-4d70-90a2-806073285d7c From 99d4f9ac36e6be6b4c1b1151509b73f02bb4026f Mon Sep 17 00:00:00 2001 From: Stepan Broz Date: Tue, 17 Feb 2026 12:08:27 +0100 Subject: [PATCH 578/626] selinux-policy/samba-bgqd-and-similar: Adjust subtest relevancy RHEL-95985 fix in RHEL-9.8 RHEL-93731 fix in RHEL-10.2 Do not test in lower versions. --- selinux-policy/samba-bgqd-and-similar/main.fmf | 3 ++- selinux-policy/samba-bgqd-and-similar/runtest.sh | 10 ++++++---- 2 files changed, 8 insertions(+), 5 deletions(-) diff --git a/selinux-policy/samba-bgqd-and-similar/main.fmf b/selinux-policy/samba-bgqd-and-similar/main.fmf index 17d8035..897c57c 100644 --- a/selinux-policy/samba-bgqd-and-similar/main.fmf +++ b/selinux-policy/samba-bgqd-and-similar/main.fmf @@ -40,9 +40,10 @@ link: - verifies: https://issues.redhat.com/browse/RHEL-72860 - verifies: https://issues.redhat.com/browse/RHEL-72861 - verifies: https://issues.redhat.com/browse/RHEL-93731 + - verifies: https://issues.redhat.com/browse/RHEL-95985 adjust+: - enabled: false - when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 + when: distro < rhel-9 continue: false extra-summary: /CoreOS/selinux-policy/Regression/samba-bgqd-and-similar extra-task: /CoreOS/selinux-policy/Regression/samba-bgqd-and-similar diff --git a/selinux-policy/samba-bgqd-and-similar/runtest.sh b/selinux-policy/samba-bgqd-and-similar/runtest.sh index e7d3fe7..71bae99 100755 --- a/selinux-policy/samba-bgqd-and-similar/runtest.sh +++ b/selinux-policy/samba-bgqd-and-similar/runtest.sh @@ -88,10 +88,12 @@ rlJournalStart rlSESearchRule "allow samba_bgqd_t cupsd_t : unix_stream_socket { connectto } [ ]" rlPhaseEnd - rlPhaseStartTest "RHEL-93731" - rlSEMatchPathCon "/var/lib/samba/private/msg.sock/668534" "samba_var_t" - rlSESearchRule "allow samba_bgqd_t smbd_t : unix_dgram_socket { sendto } [ ]" - rlPhaseEnd + if ! rlIsRHEL "<9.8" && ! ( rlIsRHEL 10 && rlIsRHEL "<10.2" ); then + rlPhaseStartTest "RHEL-93731 + RHEL-95985" + rlSEMatchPathCon "/var/lib/samba/private/msg.sock/668534" "samba_var_t" + rlSESearchRule "allow samba_bgqd_t smbd_t : unix_dgram_socket { sendto } [ ]" + rlPhaseEnd + fi fi if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then From ac9d3e14dd3dfa1fc93e93d1d6cda243d0eff37a Mon Sep 17 00:00:00 2001 From: Stepan Broz Date: Tue, 17 Feb 2026 12:18:25 +0100 Subject: [PATCH 579/626] selinux-policy/switcheroo-control-and-similar: Adjust subtest relevancy RHEL-93335 fixed in RHEL-9.7 RHEL-93535 fixed in RHEL-10.1 Do not test for lower versions. --- .../switcheroo-control-and-similar/runtest.sh | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/selinux-policy/switcheroo-control-and-similar/runtest.sh b/selinux-policy/switcheroo-control-and-similar/runtest.sh index f95007b..3d972e1 100755 --- a/selinux-policy/switcheroo-control-and-similar/runtest.sh +++ b/selinux-policy/switcheroo-control-and-similar/runtest.sh @@ -80,10 +80,12 @@ rlJournalStart rlSESearchRule "allow switcheroo_control_t unconfined_t : dbus { send_msg } [ ]" rlPhaseEnd - rlPhaseStartTest "RHEL-93335 + RHEL-93535" - rlSESearchRule "allow xdm_t switcheroo_control_t : dbus { send_msg } [ ]" - rlSESearchRule "allow switcheroo_control_t xdm_t : dbus { send_msg } [ ]" - rlPhaseEnd + if ! rlIsRHEL "<9.7" && ! ( rlIsRHEL 10 && rlIsRHEL "<10.1" ); then + rlPhaseStartTest "RHEL-93335 + RHEL-93535" + rlSESearchRule "allow xdm_t switcheroo_control_t : dbus { send_msg } [ ]" + rlSESearchRule "allow switcheroo_control_t xdm_t : dbus { send_msg } [ ]" + rlPhaseEnd + fi fi if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then From 0d794bfa99d37cd0be94d8186affa040bcfeedfd Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Thu, 19 Feb 2026 11:32:19 +0100 Subject: [PATCH 580/626] Add test for CVE-2025-71085 Signed-off-by: Ondrej Mosnacek --- kernel/CVE-2025-71085/.gitignore | 1 + kernel/CVE-2025-71085/main.fmf | 35 ++++++++++++++++++++++ kernel/CVE-2025-71085/reproducer.c | 48 ++++++++++++++++++++++++++++++ kernel/CVE-2025-71085/runtest.sh | 35 ++++++++++++++++++++++ 4 files changed, 119 insertions(+) create mode 100644 kernel/CVE-2025-71085/.gitignore create mode 100644 kernel/CVE-2025-71085/main.fmf create mode 100644 kernel/CVE-2025-71085/reproducer.c create mode 100755 kernel/CVE-2025-71085/runtest.sh diff --git a/kernel/CVE-2025-71085/.gitignore b/kernel/CVE-2025-71085/.gitignore new file mode 100644 index 0000000..6263bf3 --- /dev/null +++ b/kernel/CVE-2025-71085/.gitignore @@ -0,0 +1 @@ +reproducer diff --git a/kernel/CVE-2025-71085/main.fmf b/kernel/CVE-2025-71085/main.fmf new file mode 100644 index 0000000..69e25f5 --- /dev/null +++ b/kernel/CVE-2025-71085/main.fmf @@ -0,0 +1,35 @@ +summary: Test for CVE-2025-71085 +description: | + Runs the reproducer for CVE-2025-71085 (taken from the original commit + message). +contact: Ondrej Mosnacek +component: + - kernel +framework: beakerlib +require: + - netlabel_tools + - gcc +duration: 5m +tier: 2 +check: + # The reproducer triggers a kernel BUG when the bug is present, so turn + # on the dmesg check. + - dmesg +enabled: true +link: + - relates: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=58fc7342b529803d3c221101102fe913df7adb83 + - verifies: https://issues.redhat.com/browse/RHEL-143531 + - verifies: https://issues.redhat.com/browse/RHEL-143532 + - verifies: https://issues.redhat.com/browse/RHEL-143533 + - verifies: https://issues.redhat.com/browse/RHEL-143534 + - verifies: https://issues.redhat.com/browse/RHEL-143535 + - verifies: https://issues.redhat.com/browse/RHEL-143541 + - verifies: https://issues.redhat.com/browse/RHEL-143542 + - verifies: https://issues.redhat.com/browse/RHEL-143543 + - verifies: https://issues.redhat.com/browse/RHEL-143544 + - verifies: https://issues.redhat.com/browse/RHEL-143545 + - verifies: https://issues.redhat.com/browse/RHEL-143546 + - verifies: https://issues.redhat.com/browse/RHEL-143547 + - verifies: https://issues.redhat.com/browse/RHEL-143548 + - verifies: https://issues.redhat.com/browse/RHEL-143551 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2429026 diff --git a/kernel/CVE-2025-71085/reproducer.c b/kernel/CVE-2025-71085/reproducer.c new file mode 100644 index 0000000..29f0dae --- /dev/null +++ b/kernel/CVE-2025-71085/reproducer.c @@ -0,0 +1,48 @@ +/* SPDX-License-Identifier: GPLv2 */ +/* + * Copyright (c) 2026 Red Hat, Inc. + * Author: Ondrej Mosnacek + * Taken from: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=58fc7342b529803d3c221101102fe913df7adb83 + * (Additional copyright/authorship might apply.) + */ + +#include + +#include +#include + +int main(int argc, char **argv) +{ + int fd = socket(AF_INET6, SOCK_DGRAM, IPPROTO_UDP); + + // setup msghdr + int cmsg_size = 2; + int cmsg_len = 0x60; + struct msghdr msg; + struct sockaddr_in6 dest_addr; + struct cmsghdr * cmsg = (struct cmsghdr *) calloc(1, sizeof(struct cmsghdr) + cmsg_len); + msg.msg_name = &dest_addr; + msg.msg_namelen = sizeof(dest_addr); + msg.msg_iov = NULL; + msg.msg_iovlen = 0; + msg.msg_control = cmsg; + msg.msg_controllen = cmsg_len; + msg.msg_flags = 0; + + // setup sockaddr + dest_addr.sin6_family = AF_INET6; + dest_addr.sin6_port = htons(31337); + dest_addr.sin6_flowinfo = htonl(31337); + dest_addr.sin6_addr = in6addr_loopback; + dest_addr.sin6_scope_id = 31337; + + // setup cmsghdr + cmsg->cmsg_len = cmsg_len; + cmsg->cmsg_level = IPPROTO_IPV6; + cmsg->cmsg_type = IPV6_HOPOPTS; + char * hop_hdr = (char *)cmsg + sizeof(struct cmsghdr); + hop_hdr[1] = 0x9; //set hop size - (0x9 + 1) * 8 = 80 + + sendmsg(fd, &msg, 0); + return 0; +} diff --git a/kernel/CVE-2025-71085/runtest.sh b/kernel/CVE-2025-71085/runtest.sh new file mode 100755 index 0000000..0515868 --- /dev/null +++ b/kernel/CVE-2025-71085/runtest.sh @@ -0,0 +1,35 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# SPDX-License-Identifier: GPLv2 +# Copyright (c) 2026 Red Hat, Inc. +# Author: Ondrej Mosnacek + +# Include Beakerlib environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +rlJournalStart + rlPhaseStartSetup + rlRun "uname -r" 0 "Print kernel version" + + rlRun "gcc -o reproducer reproducer.c" 0 "Compile the reproducer" + + rlRun "netlabelctl map del default" 0 "Delete default netlabel map" + rlRun "netlabelctl calipso add pass doi:7" 0 "Set up CALIPSO" + rlRun "netlabelctl map add default address:0::1/128 protocol:calipso,7" 0 \ + "Set up CALIPSO netlabel map" + rlPhaseEnd + + rlPhaseStartTest + # Will trigger a kernel BUG in dmesg or panic when vulnerable + rlRun "./reproducer" 0 "Run the reproducer" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "netlabelctl map del default" 0 "Delete the CALIPSO map" + rlRun "netlabelctl calipso del doi:7" 0 "Unsetup CALIPSO" + rlRun "netlabelctl map add default protocol:unlbl" 0 "Re-add default netlabel map" + + rlRun "rm -f reproducer" 0 "Delete the reproducer binary" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd From 35144ba78dac0dcaf411cd0dca2474925c0b2f35 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Tue, 24 Feb 2026 11:26:37 +0100 Subject: [PATCH 581/626] kernel/CVE-2025-71085: fix netlabel setup The original reproducer would break network traffic outside IPv6 localhost- make sure there are default rules for unlabeled traffic so that the machine doesn't lose network connectivity during test. Signed-off-by: Ondrej Mosnacek --- kernel/CVE-2025-71085/runtest.sh | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/kernel/CVE-2025-71085/runtest.sh b/kernel/CVE-2025-71085/runtest.sh index 0515868..1835976 100755 --- a/kernel/CVE-2025-71085/runtest.sh +++ b/kernel/CVE-2025-71085/runtest.sh @@ -13,10 +13,14 @@ rlJournalStart rlRun "gcc -o reproducer reproducer.c" 0 "Compile the reproducer" - rlRun "netlabelctl map del default" 0 "Delete default netlabel map" rlRun "netlabelctl calipso add pass doi:7" 0 "Set up CALIPSO" + rlRun "netlabelctl map del default" 0 "Delete default netlabel map" + rlRun "netlabelctl map add default address:0.0.0.0/0 protocol:unlbl" 0 \ + "Set unlabeled traffic by default" + rlRun "netlabelctl map add default address:::/0 protocol:unlbl" 0 \ + "Set unlabeled traffic by default" rlRun "netlabelctl map add default address:0::1/128 protocol:calipso,7" 0 \ - "Set up CALIPSO netlabel map" + "Set up CALIPSO for localhost only" rlPhaseEnd rlPhaseStartTest From 2309f39aebad76b3642a4477a99e88ceb131e7ee Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Thu, 26 Feb 2026 13:26:38 +0100 Subject: [PATCH 582/626] do not test services which are not available Many tests contain test phases called "real scenario". Purpose of these phases is usually to test a service which belongs to a particular package. If the service (systemd unit file) is not available for any reason, it makes no sense to run the test phase - it would fail. Other test phases may still be worth running. --- selinux-policy/ModemManager-and-similar/runtest.sh | 10 ++++------ selinux-policy/accounts-daemon-and-similar/runtest.sh | 6 ++++-- selinux-policy/acpid-and-similar/runtest.sh | 2 ++ selinux-policy/blueman-and-similar/runtest.sh | 4 ++-- selinux-policy/boltd-and-similar/runtest.sh | 6 +++++- selinux-policy/bz481628-send-msg-to-dbus/runtest.sh | 2 ++ .../runtest.sh | 2 +- selinux-policy/bz733494-amanda-and-similar/runtest.sh | 2 ++ selinux-policy/caddy-and-similar/runtest.sh | 2 ++ selinux-policy/cockpit-ws-and-similar/runtest.sh | 4 ++++ selinux-policy/colord-and-similar/runtest.sh | 6 ++++-- selinux-policy/cups-browsed-and-similar/runtest.sh | 2 ++ selinux-policy/cups-lpd-and-similar/runtest.sh | 4 ++++ selinux-policy/dhcpcd-and-similar/runtest.sh | 3 ++- selinux-policy/fapolicyd-and-similar/runtest.sh | 4 ++++ .../fedora-third-party-and-similar/runtest.sh | 2 ++ selinux-policy/firewalld-and-similar/runtest.sh | 6 +++++- selinux-policy/fwupd-and-similar/runtest.sh | 6 ++++-- selinux-policy/hostapd-and-similar/runtest.sh | 2 ++ selinux-policy/icecast-and-similar/runtest.sh | 2 ++ selinux-policy/kerberos-and-similar/runtest.sh | 5 +++-- selinux-policy/logwatch-and-similar/runtest.sh | 2 ++ selinux-policy/nasd-and-similar/runtest.sh | 2 ++ selinux-policy/nfsdcld-and-similar/runtest.sh | 2 ++ selinux-policy/numad-and-similar/runtest.sh | 2 ++ selinux-policy/policykit-general/runtest.sh | 8 +++++--- selinux-policy/rngd-and-similar/runtest.sh | 2 ++ selinux-policy/rpc.idmapd-and-similar/runtest.sh | 2 ++ selinux-policy/rpmdb-and-similar/runtest.sh | 2 ++ .../rrdcached-service-and-related/runtest.sh | 2 ++ selinux-policy/rtkit-daemon-and-similar/runtest.sh | 6 +++--- selinux-policy/sslh-and-similar/runtest.sh | 2 ++ selinux-policy/stalld-and-similar/runtest.sh | 2 ++ selinux-policy/sulogin-and-similar/runtest.sh | 2 ++ selinux-policy/synce4l-and-similar/runtest.sh | 2 ++ .../systemd-bootchart-and-similar/runtest.sh | 2 ++ selinux-policy/systemd-localed/runtest.sh | 2 ++ selinux-policy/systemd-machined-and-similar/runtest.sh | 2 ++ .../systemd-modules-load-and-similar/runtest.sh | 2 ++ selinux-policy/systemd-rfkill-and-similar/runtest.sh | 2 ++ selinux-policy/systemd-sysctl-and-similar/runtest.sh | 2 ++ selinux-policy/systemd-userdbd-and-similar/runtest.sh | 4 ++++ selinux-policy/targetd-and-similar/runtest.sh | 2 ++ selinux-policy/thttpd-and-similar/runtest.sh | 2 ++ selinux-policy/usbguard-daemon-and-similar/runtest.sh | 2 ++ selinux-policy/usbmuxd-and-similar/runtest.sh | 2 ++ 46 files changed, 118 insertions(+), 26 deletions(-) diff --git a/selinux-policy/ModemManager-and-similar/runtest.sh b/selinux-policy/ModemManager-and-similar/runtest.sh index 4ad9eb0..266f354 100755 --- a/selinux-policy/ModemManager-and-similar/runtest.sh +++ b/selinux-policy/ModemManager-and-similar/runtest.sh @@ -76,13 +76,9 @@ rlJournalStart fi rlPhaseEnd - if ! rlIsRHEL 5 ; then + DESTINATION="org.freedesktop.ModemManager1" + if busctl | grep -iq ${DESTINATION} ; then rlPhaseStartTest "real scenario -- DBus service" - if rlIsRHEL 6 ; then - DESTINATION="org.freedesktop.ModemManager" - else - DESTINATION="org.freedesktop.ModemManager1" - fi rlRun "gdbus introspect --system --object-path / --dest ${DESTINATION} >& /dev/null" 0,1 sleep 1 rlRun "ps -efZ | grep -v grep | grep ${PROCESS_NAME}" @@ -108,7 +104,9 @@ rlJournalStart rlSEMatchPathCon "/usr/sbin/ModemManager" "modemmanager_exec_t" rlSESearchRule "allow modemmanager_t sysfs_t : file { append write } [ ]" rlPhaseEnd + fi + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 diff --git a/selinux-policy/accounts-daemon-and-similar/runtest.sh b/selinux-policy/accounts-daemon-and-similar/runtest.sh index 662d1c6..f658bad 100755 --- a/selinux-policy/accounts-daemon-and-similar/runtest.sh +++ b/selinux-policy/accounts-daemon-and-similar/runtest.sh @@ -102,9 +102,9 @@ rlJournalStart rlPhaseEnd fi - if ! rlIsRHEL 5 ; then + DESTINATION="org.freedesktop.Accounts" + if busctl | grep -iq ${DESTINATION} ; then rlPhaseStartTest "real scenario -- DBus service" - DESTINATION="org.freedesktop.Accounts" rlRun "gdbus introspect --system --object-path / --dest ${DESTINATION} >& /dev/null" sleep 1 rlRun "ps -efZ | grep -v grep | grep ${PROCESS_NAME}" @@ -127,6 +127,7 @@ rlJournalStart rlPhaseEnd fi + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario" rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" if ! rlSEDefined ${PROCESS_CONTEXT} ; then @@ -143,6 +144,7 @@ rlJournalStart rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd + fi rlPhaseStartCleanup sleep 2 diff --git a/selinux-policy/acpid-and-similar/runtest.sh b/selinux-policy/acpid-and-similar/runtest.sh index b24fa65..5059ee2 100755 --- a/selinux-policy/acpid-and-similar/runtest.sh +++ b/selinux-policy/acpid-and-similar/runtest.sh @@ -106,6 +106,7 @@ rlJournalStart rlPhaseEnd fi + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario" rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" if ! rlSEDefined ${PROCESS_CONTEXT} ; then @@ -119,6 +120,7 @@ rlJournalStart rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd + fi rlPhaseStartCleanup sleep 2 diff --git a/selinux-policy/blueman-and-similar/runtest.sh b/selinux-policy/blueman-and-similar/runtest.sh index ee32cbb..a5910b6 100755 --- a/selinux-policy/blueman-and-similar/runtest.sh +++ b/selinux-policy/blueman-and-similar/runtest.sh @@ -83,9 +83,9 @@ rlJournalStart rlSESearchRule "allow policykit_t blueman_t : dbus { send_msg }" rlPhaseEnd - if ! rlIsRHEL 5 ; then + DESTINATION="org.blueman.Mechanism" + if busctl | grep -iq ${DESTINATION} ; then rlPhaseStartTest "real scenario -- DBus service" - DESTINATION="org.blueman.Mechanism" rlRun "gdbus introspect --system --object-path / --dest ${DESTINATION} >& /dev/null" sleep 1 rlRun "ps -efZ | grep -v grep | grep ${PROCESS_NAME}" diff --git a/selinux-policy/boltd-and-similar/runtest.sh b/selinux-policy/boltd-and-similar/runtest.sh index 5e7ddb1..0115c59 100755 --- a/selinux-policy/boltd-and-similar/runtest.sh +++ b/selinux-policy/boltd-and-similar/runtest.sh @@ -109,14 +109,17 @@ rlJournalStart rlSESearchRule "allow boltd_t xguest_t : dbus { send_msg } [ ]" rlPhaseEnd + DESTINATION="org.freedesktop.bolt" + if busctl | grep -iq ${DESTINATION} ; then rlPhaseStartTest "real scenario -- system D-bus" - DESTINATION="org.freedesktop.bolt" rlRun "gdbus introspect --system --object-path / --dest ${DESTINATION} >& /dev/null" sleep 2 rlRun "ps -efZ | grep -v grep | grep ${PROCESS_NAME}" rlRun "ps -efZ | grep -v grep | grep \"${PROCESS_CONTEXT}.*${PROCESS_NAME}\"" rlPhaseEnd + fi + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" if ! rlSEDefined ${PROCESS_CONTEXT} ; then @@ -130,6 +133,7 @@ rlJournalStart rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd + fi rlPhaseStartTest "real scenario -- confined users" CREATED_USERS="" diff --git a/selinux-policy/bz481628-send-msg-to-dbus/runtest.sh b/selinux-policy/bz481628-send-msg-to-dbus/runtest.sh index d5df5ec..80100e4 100755 --- a/selinux-policy/bz481628-send-msg-to-dbus/runtest.sh +++ b/selinux-policy/bz481628-send-msg-to-dbus/runtest.sh @@ -104,9 +104,11 @@ rlJournalStart rlPhaseEnd fi + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" rlSEService "nopassword" ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "reload status" 1 rlPhaseEnd + fi if ! rlIsRHEL 5 6 7 ; then rlPhaseStartTest "bz#1688671" diff --git a/selinux-policy/bz538089-plymouth-operations-denied-during-boot/runtest.sh b/selinux-policy/bz538089-plymouth-operations-denied-during-boot/runtest.sh index 8a67d47..e78bd69 100755 --- a/selinux-policy/bz538089-plymouth-operations-denied-during-boot/runtest.sh +++ b/selinux-policy/bz538089-plymouth-operations-denied-during-boot/runtest.sh @@ -159,7 +159,7 @@ rlJournalStart rlPhaseEnd fi - if ! rlIsRHEL 5 6 ; then + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" if ! rlSEDefined ${PROCESS_CONTEXT} ; then diff --git a/selinux-policy/bz733494-amanda-and-similar/runtest.sh b/selinux-policy/bz733494-amanda-and-similar/runtest.sh index 8360689..10c06e4 100755 --- a/selinux-policy/bz733494-amanda-and-similar/runtest.sh +++ b/selinux-policy/bz733494-amanda-and-similar/runtest.sh @@ -226,6 +226,7 @@ rlJournalStart rlPhaseEnd fi + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.socket ] ; then rlPhaseStartTest "real scenario -- xinetd service" HOST_ADDRESS="127.0.0.1" PORT_NUMBER="10080" # number or socket path @@ -258,6 +259,7 @@ rlJournalStart rlRun "systemctl disable ${SERVICE_NAME}.socket" fi rlPhaseEnd + fi rlPhaseStartCleanup sleep 2 diff --git a/selinux-policy/caddy-and-similar/runtest.sh b/selinux-policy/caddy-and-similar/runtest.sh index ca34360..b970b6a 100755 --- a/selinux-policy/caddy-and-similar/runtest.sh +++ b/selinux-policy/caddy-and-similar/runtest.sh @@ -69,6 +69,7 @@ rlJournalStart rlSESearchRule "allow httpd_t sysctl_net_t : file { getattr open read } [ ]" rlPhaseEnd + if ls /usr/lib/systemd/system/caddy*.service ; then rlPhaseStartTest "real scenario -- standalone service" rlRun "semanage fcontext -l -C | grep caddy" for SERVICE_NAME in caddy caddy-api ; do @@ -77,6 +78,7 @@ rlJournalStart rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 done rlPhaseEnd + fi rlPhaseStartCleanup sleep 2 diff --git a/selinux-policy/cockpit-ws-and-similar/runtest.sh b/selinux-policy/cockpit-ws-and-similar/runtest.sh index e111a41..4bb6c98 100755 --- a/selinux-policy/cockpit-ws-and-similar/runtest.sh +++ b/selinux-policy/cockpit-ws-and-similar/runtest.sh @@ -143,6 +143,7 @@ rlJournalStart fi fi + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" if ! rlSEDefined ${PROCESS_CONTEXT} ; then @@ -156,6 +157,7 @@ rlJournalStart rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd + fi rlPhaseStartTest "bz#1402316 + bz#1402495" rlSEMatchPathCon "/usr/libexec/cockpit-session" "cockpit_session_exec_t" @@ -190,6 +192,7 @@ rlJournalStart rlPhaseEnd fi + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.socket ] ; then rlPhaseStartTest "real scenario -- xinetd service" HOST_ADDRESS="127.0.0.1" # IP address or nothing PORT_NUMBER="9090" # number or socket path @@ -221,6 +224,7 @@ rlJournalStart rlRun "systemctl disable ${SERVICE_NAME}.socket" fi rlPhaseEnd + fi rlPhaseStartCleanup sleep 2 diff --git a/selinux-policy/colord-and-similar/runtest.sh b/selinux-policy/colord-and-similar/runtest.sh index ff2ced5..4d6970d 100755 --- a/selinux-policy/colord-and-similar/runtest.sh +++ b/selinux-policy/colord-and-similar/runtest.sh @@ -62,9 +62,9 @@ rlJournalStart rlSESearchRule "allow colord_t systemd_hwdb_etc_t : file { getattr open read } [ ]" rlPhaseEnd - if ! rlIsRHEL 5 ; then + DESTINATION="org.freedesktop.ColorManager" + if busctl | grep -iq ${DESTINATION} ; then rlPhaseStartTest "real scenario -- DBus service" - DESTINATION="org.freedesktop.ColorManager" rlRun "gdbus introspect --system --object-path / --dest ${DESTINATION} >& /dev/null" sleep 1 rlRun "ps -efZ | grep -v grep | grep ${PROCESS_NAME}" @@ -128,6 +128,7 @@ rlJournalStart rlPhaseEnd fi + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario" rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" if ! rlSEDefined ${PROCESS_CONTEXT} ; then @@ -141,6 +142,7 @@ rlJournalStart rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd + fi if rlIsFedora ; then rlPhaseStartTest "bz#2259679" diff --git a/selinux-policy/cups-browsed-and-similar/runtest.sh b/selinux-policy/cups-browsed-and-similar/runtest.sh index f6235dd..0877fdc 100755 --- a/selinux-policy/cups-browsed-and-similar/runtest.sh +++ b/selinux-policy/cups-browsed-and-similar/runtest.sh @@ -71,6 +71,7 @@ rlJournalStart rlSESearchRule "allow cupsd_t cupsd_tmp_t : lnk_file { create unlink } [ ]" rlPhaseEnd + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario" rlRun "echo -en '\nBrowsePoll localhost\n' >> /etc/cups/cups-browsed.conf" rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" @@ -91,6 +92,7 @@ rlJournalStart fi rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd + fi rlPhaseStartCleanup sleep 2 diff --git a/selinux-policy/cups-lpd-and-similar/runtest.sh b/selinux-policy/cups-lpd-and-similar/runtest.sh index ede77b9..10aa060 100755 --- a/selinux-policy/cups-lpd-and-similar/runtest.sh +++ b/selinux-policy/cups-lpd-and-similar/runtest.sh @@ -102,6 +102,7 @@ rlJournalStart rlPhaseEnd fi + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.socket ] ; then rlPhaseStartTest "real scenario -- bz#1919399 + bz#1947397" rlRun "systemctl start cups.service" rlRun "systemctl enable cups-lpd.socket" @@ -115,7 +116,9 @@ rlJournalStart rlRun "systemctl disable cups-lpd.socket" rlRun "systemctl stop cups.service" rlPhaseEnd + fi + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.socket ] ; then rlPhaseStartTest "real scenario -- xinetd service" HOST_ADDRESS="127.0.0.1" # IP address or nothing PORT_NUMBER="515" # number or socket path @@ -147,6 +150,7 @@ rlJournalStart rlRun "systemctl disable ${SERVICE_NAME}.socket" fi rlPhaseEnd + fi rlPhaseStartCleanup sleep 2 diff --git a/selinux-policy/dhcpcd-and-similar/runtest.sh b/selinux-policy/dhcpcd-and-similar/runtest.sh index 6fcebba..2b532ad 100755 --- a/selinux-policy/dhcpcd-and-similar/runtest.sh +++ b/selinux-policy/dhcpcd-and-similar/runtest.sh @@ -117,7 +117,7 @@ rlJournalStart rlPhase fi - + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" if ! rlIsRHEL "<9.5" ; then rlRun "ip netns add test-ns" @@ -136,6 +136,7 @@ rlJournalStart rlRun "restorecon -Rv /etc /var /run -e /var/ARTIFACTS" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd + fi rlPhaseStartCleanup sleep 2 diff --git a/selinux-policy/fapolicyd-and-similar/runtest.sh b/selinux-policy/fapolicyd-and-similar/runtest.sh index 8b359e8..21e183b 100755 --- a/selinux-policy/fapolicyd-and-similar/runtest.sh +++ b/selinux-policy/fapolicyd-and-similar/runtest.sh @@ -102,6 +102,7 @@ rlJournalStart rlPhaseEnd fi + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" if ! rlSEDefined ${PROCESS_CONTEXT} ; then @@ -112,7 +113,9 @@ rlJournalStart rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd + fi + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "RHEL-77071" if rlIsCentOS 10 || rlIsRHEL 10 ; then rlSESearchRule "allow fapolicyd_t systemd_machined_t : unix_stream_socket { connectto } [ ]" @@ -125,6 +128,7 @@ rlJournalStart rlRun "service fapolicyd stop" rlRun "service systemd-machined stop" rlPhaseEnd + fi rlPhaseStartCleanup sleep 2 diff --git a/selinux-policy/fedora-third-party-and-similar/runtest.sh b/selinux-policy/fedora-third-party-and-similar/runtest.sh index 7c136a9..bc6e4a3 100755 --- a/selinux-policy/fedora-third-party-and-similar/runtest.sh +++ b/selinux-policy/fedora-third-party-and-similar/runtest.sh @@ -70,6 +70,7 @@ rlJournalStart rlSESearchRule "allow ${PROCESS_CONTEXT} passwd_file_t : file { getattr open read } [ ]" rlPhaseEnd + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" if ! rlSEDefined ${PROCESS_CONTEXT} ; then # for OSes where the SELinux domain does not exist yet @@ -81,6 +82,7 @@ rlJournalStart rlRun "fedora-third-party list" rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd + fi rlPhaseStartCleanup sleep 2 diff --git a/selinux-policy/firewalld-and-similar/runtest.sh b/selinux-policy/firewalld-and-similar/runtest.sh index df7586f..496e8d0 100755 --- a/selinux-policy/firewalld-and-similar/runtest.sh +++ b/selinux-policy/firewalld-and-similar/runtest.sh @@ -183,15 +183,18 @@ rlJournalStart rlRun "firewall-cmd --remove-port 1234/tcp --permanent" rlPhaseEnd + DESTINATION="org.fedoraproject.FirewallD1" + if busctl | grep -iq ${DESTINATION} ; then rlPhaseStartTest "real scenario -- DBus service" - DESTINATION="org.fedoraproject.FirewallD1" rlRun "gdbus introspect --system --object-path / --dest ${DESTINATION} >& /dev/null" sleep 1 rlRun "ps -efZ | grep -v grep | grep ${PROCESS_NAME}" rlRun "ps -efZ | grep -v grep | grep \"${PROCESS_CONTEXT}.*${PROCESS_NAME}\"" rlServiceStop "firewalld" rlPhaseEnd + fi + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario" rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" rlRun "rm -rf /run/firewalld" @@ -218,6 +221,7 @@ rlJournalStart rlRun "ls -Z /run/xtables.lock | grep :iptables_var_run_t" fi rlPhaseEnd + fi rlPhaseStartCleanup sleep 2 diff --git a/selinux-policy/fwupd-and-similar/runtest.sh b/selinux-policy/fwupd-and-similar/runtest.sh index 7881022..eaf601a 100755 --- a/selinux-policy/fwupd-and-similar/runtest.sh +++ b/selinux-policy/fwupd-and-similar/runtest.sh @@ -75,9 +75,9 @@ rlJournalStart rlPhaseEnd fi - if ! rlIsRHEL 5 ; then + DESTINATION="org.freedesktop.fwupd" + if busctl | grep -iq ${DESTINATION} ; then rlPhaseStartTest "real scenario -- DBus service" - DESTINATION="org.freedesktop.fwupd" if ! rlSEDefined ${PROCESS_CONTEXT} ; then # RHEL-4, RHEL-5, RHEL-6 is excluded PROCESS_CONTEXT="unconfined_service_t" @@ -89,6 +89,7 @@ rlJournalStart rlPhaseEnd fi + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" if ! rlSEDefined ${PROCESS_CONTEXT} ; then @@ -99,6 +100,7 @@ rlJournalStart rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd + fi if rlSEDefined "fwupd_t" ; then rlPhaseStartTest "bz#1772619" diff --git a/selinux-policy/hostapd-and-similar/runtest.sh b/selinux-policy/hostapd-and-similar/runtest.sh index c36d878..1ed5ed0 100755 --- a/selinux-policy/hostapd-and-similar/runtest.sh +++ b/selinux-policy/hostapd-and-similar/runtest.sh @@ -97,6 +97,7 @@ rlJournalStart rlPhaseEnd fi + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" rlRun "modprobe mac80211_hwsim" @@ -119,6 +120,7 @@ rlJournalStart sleep 5 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd + fi rlPhaseStartCleanup sleep 2 diff --git a/selinux-policy/icecast-and-similar/runtest.sh b/selinux-policy/icecast-and-similar/runtest.sh index bbfa4d4..bcce208 100755 --- a/selinux-policy/icecast-and-similar/runtest.sh +++ b/selinux-policy/icecast-and-similar/runtest.sh @@ -95,6 +95,7 @@ rlJournalStart rlPhaseEnd fi + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- bz#894387" if rlIsRHEL 5 6 ; then rlRun "setsebool icecast_connect_any on" @@ -123,6 +124,7 @@ rlJournalStart rlRun "setsebool icecast_use_any_tcp_ports off" fi rlPhaseEnd + fi rlPhaseStartCleanup sleep 2 diff --git a/selinux-policy/kerberos-and-similar/runtest.sh b/selinux-policy/kerberos-and-similar/runtest.sh index c8b16a2..e306888 100755 --- a/selinux-policy/kerberos-and-similar/runtest.sh +++ b/selinux-policy/kerberos-and-similar/runtest.sh @@ -38,8 +38,7 @@ rlJournalStart rlSESatisfyRequires rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted - rlAssertRpm krb5-libs - rlAssertRpm krb5-server + rlRun "rpm -qa | grep krb | sort" rlServiceStop kprop kadmin rlFileBackup /etc/shadow @@ -197,6 +196,7 @@ rlJournalStart rlPhaseEnd fi + if [ -f /usr/lib/systemd/system/kprop.service ] ; then rlPhaseStartTest "real scenario for kpropd" rlRun "mkdir -p /var/kerberos/krb5kdc" rlRun "touch /var/kerberos/krb5kdc/kpropd.acl" @@ -207,6 +207,7 @@ rlJournalStart rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 rlSEService ${ROOT_PASSWORD} kprop kpropd kpropd_t "restart status stop status" 1 rlPhaseEnd + fi rlPhaseStartCleanup sleep 2 diff --git a/selinux-policy/logwatch-and-similar/runtest.sh b/selinux-policy/logwatch-and-similar/runtest.sh index bb60374..a7dadf8 100755 --- a/selinux-policy/logwatch-and-similar/runtest.sh +++ b/selinux-policy/logwatch-and-similar/runtest.sh @@ -74,6 +74,7 @@ rlJournalStart rlPhaseEnd fi + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" rlRun "mkdir -p /var/cache/logwatch" if ! rlSEDefined ${PROCESS_CONTEXT} ; then @@ -84,6 +85,7 @@ rlJournalStart rlRun "restorecon -Rv /etc /var /run -e /var/ARTIFACTS" 0-255 rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd + fi if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.timer ] ; then rlPhaseStartTest "real scenario -- timer" diff --git a/selinux-policy/nasd-and-similar/runtest.sh b/selinux-policy/nasd-and-similar/runtest.sh index 8f312ca..fe86100 100755 --- a/selinux-policy/nasd-and-similar/runtest.sh +++ b/selinux-policy/nasd-and-similar/runtest.sh @@ -80,6 +80,7 @@ rlJournalStart rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" rlPhaseEnd + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" if ! rlSEDefined ${PROCESS_CONTEXT} ; then @@ -92,6 +93,7 @@ rlJournalStart rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd + fi rlPhaseStartCleanup sleep 2 diff --git a/selinux-policy/nfsdcld-and-similar/runtest.sh b/selinux-policy/nfsdcld-and-similar/runtest.sh index 51b1b9f..b6e8ad4 100755 --- a/selinux-policy/nfsdcld-and-similar/runtest.sh +++ b/selinux-policy/nfsdcld-and-similar/runtest.sh @@ -63,6 +63,7 @@ rlJournalStart rlSESearchRule "allow rpcd_t nfsd_fs_t : file { getattr open read } [ ]" rlPhaseEnd + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" if ! rlSEDefined ${PROCESS_CONTEXT} ; then @@ -72,6 +73,7 @@ rlJournalStart rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd + fi rlPhaseStartCleanup sleep 2 diff --git a/selinux-policy/numad-and-similar/runtest.sh b/selinux-policy/numad-and-similar/runtest.sh index 77c1b8e..52cbe64 100755 --- a/selinux-policy/numad-and-similar/runtest.sh +++ b/selinux-policy/numad-and-similar/runtest.sh @@ -104,6 +104,7 @@ rlJournalStart rlPhaseEnd fi + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario" rlRun "mkdir -p ${MOUNT_POINT}" if ! mount | grep -q "cgroup.*cpuset" ; then @@ -117,6 +118,7 @@ rlJournalStart rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd + fi rlPhaseStartCleanup sleep 2 diff --git a/selinux-policy/policykit-general/runtest.sh b/selinux-policy/policykit-general/runtest.sh index 32a2c6b..79fa26e 100755 --- a/selinux-policy/policykit-general/runtest.sh +++ b/selinux-policy/policykit-general/runtest.sh @@ -95,11 +95,13 @@ rlJournalStart rlSEMatchPathCon "/usr/libexec/polkit-1/polkitd" "policykit_exec_t" rlSESearchRule "allow policykit_t fs_t : filesystem { getattr }" rlPhaseEnd + fi + DESTINATION="org.freedesktop.PolicyKit1" + if busctl | grep -iq ${DESTINATION} ; then rlPhaseStartTest "real scenario -- DBus service" rlRun "killall polkitd" 0,1 sleep 1 - DESTINATION="org.freedesktop.PolicyKit1" rlRun "gdbus introspect --system --object-path / --dest ${DESTINATION} >& /dev/null" sleep 1 rlRun "ps -efZ | grep -v grep | grep ${PROCESS_NAME}" @@ -133,7 +135,7 @@ rlJournalStart rlPhaseEnd fi - if ! rlIsRHEL 5 6 ; then + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" if ! rlSEDefined ${PROCESS_CONTEXT} ; then @@ -147,6 +149,7 @@ rlJournalStart rlRun "restorecon -Rv /var /run -e /var/ARTIFACTS" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd + fi rlPhaseStartTest "real scenario -- confined users" CREATED_USERS="" @@ -166,7 +169,6 @@ rlJournalStart rlRun "userdel -rfZ ${USER_NAME}" done rlPhaseEnd - fi rlPhaseStartCleanup sleep 2 diff --git a/selinux-policy/rngd-and-similar/runtest.sh b/selinux-policy/rngd-and-similar/runtest.sh index ca55d19..1987510 100755 --- a/selinux-policy/rngd-and-similar/runtest.sh +++ b/selinux-policy/rngd-and-similar/runtest.sh @@ -155,6 +155,7 @@ rlJournalStart rlPhaseEnd fi + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario" rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" rlRun "modprobe tpm-rng" 0,1 @@ -183,6 +184,7 @@ rlJournalStart rlRun "grep ^RNGD_ARGS= /etc/sysconfig/rngd" rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 2 rlPhaseEnd + fi rlPhaseStartCleanup sleep 2 diff --git a/selinux-policy/rpc.idmapd-and-similar/runtest.sh b/selinux-policy/rpc.idmapd-and-similar/runtest.sh index e79d688..10fed7c 100755 --- a/selinux-policy/rpc.idmapd-and-similar/runtest.sh +++ b/selinux-policy/rpc.idmapd-and-similar/runtest.sh @@ -70,6 +70,7 @@ rlJournalStart rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" rlPhaseEnd + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" if ! rlSEDefined ${PROCESS_CONTEXT} ; then @@ -80,6 +81,7 @@ rlJournalStart rlRun "restorecon -Rv /var /run -e /var/ARTIFACTS" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd + fi rlPhaseStartCleanup sleep 2 diff --git a/selinux-policy/rpmdb-and-similar/runtest.sh b/selinux-policy/rpmdb-and-similar/runtest.sh index dda6a92..e0c0b55 100755 --- a/selinux-policy/rpmdb-and-similar/runtest.sh +++ b/selinux-policy/rpmdb-and-similar/runtest.sh @@ -66,6 +66,7 @@ rlJournalStart rlSESearchRule "allow rpmdb_t user_devpts_t : chr_file { read write } [ ]" rlPhaseEnd + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" rlRun "touch /var/lib/rpm/.rebuilddb" rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "start status" 1 @@ -73,6 +74,7 @@ rlJournalStart rlRun "touch /var/lib/rpm/.rebuilddb" rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd + fi rlPhaseStartTest "rpmdb executed by root/unconfined_t" rlRun "restorecon -Rv /var/lib/rpm" diff --git a/selinux-policy/rrdcached-service-and-related/runtest.sh b/selinux-policy/rrdcached-service-and-related/runtest.sh index b6dfec0..aa774dd 100755 --- a/selinux-policy/rrdcached-service-and-related/runtest.sh +++ b/selinux-policy/rrdcached-service-and-related/runtest.sh @@ -84,11 +84,13 @@ rlJournalStart rlSESearchRule "typeattribute ${PROCESS_CONTEXT} syslog_client_type" rlPhaseEnd + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario" rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 2 rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 2 rlPhaseEnd + fi # TODO: add test scenario for rrdcached.socket diff --git a/selinux-policy/rtkit-daemon-and-similar/runtest.sh b/selinux-policy/rtkit-daemon-and-similar/runtest.sh index b618d26..855902c 100755 --- a/selinux-policy/rtkit-daemon-and-similar/runtest.sh +++ b/selinux-policy/rtkit-daemon-and-similar/runtest.sh @@ -76,9 +76,9 @@ rlJournalStart rlPhaseEnd fi - if ! rlIsRHEL 5 ; then + DESTINATION="org.freedesktop.RealtimeKit1" + if busctl | grep -iq ${DESTINATION} ; then rlPhaseStartTest "real scenario -- DBus service" - DESTINATION="org.freedesktop.RealtimeKit1" rlRun "gdbus introspect --system --object-path / --dest ${DESTINATION} >& /dev/null" sleep 1 rlRun "ps -efZ | grep -v grep | grep ${PROCESS_NAME}" @@ -97,7 +97,7 @@ rlJournalStart rlPhaseEnd fi - if ! rlIsRHEL 5 6 ; then + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" if ! rlSEDefined ${PROCESS_CONTEXT} ; then diff --git a/selinux-policy/sslh-and-similar/runtest.sh b/selinux-policy/sslh-and-similar/runtest.sh index 0ff50e0..90a231a 100755 --- a/selinux-policy/sslh-and-similar/runtest.sh +++ b/selinux-policy/sslh-and-similar/runtest.sh @@ -88,6 +88,7 @@ rlJournalStart rlPhaseEnd fi + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" rlRun "sed -i 's/thelonious/localhost/' /etc/sslh.cfg" @@ -99,6 +100,7 @@ rlJournalStart rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd + fi rlPhaseStartCleanup sleep 2 diff --git a/selinux-policy/stalld-and-similar/runtest.sh b/selinux-policy/stalld-and-similar/runtest.sh index 4f712cb..eebb2dd 100755 --- a/selinux-policy/stalld-and-similar/runtest.sh +++ b/selinux-policy/stalld-and-similar/runtest.sh @@ -117,6 +117,7 @@ rlJournalStart rlPhaseEnd fi + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" if ! rlSEDefined ${PROCESS_CONTEXT} ; then PROCESS_CONTEXT="unconfined_service_t" @@ -134,6 +135,7 @@ rlJournalStart rlRun "setsebool domain_can_write_kmsg off" rlRun "diff before.txt after.txt | grep -i -e 'operation not permitted' -e 'permission denied'" 1 rlPhaseEnd + fi rlPhaseStartCleanup sleep 2 diff --git a/selinux-policy/sulogin-and-similar/runtest.sh b/selinux-policy/sulogin-and-similar/runtest.sh index 073d423..2a52952 100755 --- a/selinux-policy/sulogin-and-similar/runtest.sh +++ b/selinux-policy/sulogin-and-similar/runtest.sh @@ -23,6 +23,7 @@ rlJournalStart rlPhaseEnd fi + if [ -f /usr/lib/systemd/system/rescue.service ] ; then rlPhaseStartTest "real scenario -- standalone service" rlRun "grep ExecStart= /usr/lib/systemd/system/rescue.service" rlRun "strings /usr/lib/systemd/systemd-sulogin-shell | grep bin/sulogin" @@ -33,6 +34,7 @@ rlJournalStart sleep 2 rlRun "service rescue status" 3 rlPhaseEnd + fi rlPhaseStartCleanup sleep 2 diff --git a/selinux-policy/synce4l-and-similar/runtest.sh b/selinux-policy/synce4l-and-similar/runtest.sh index a0be444..fefa8f7 100755 --- a/selinux-policy/synce4l-and-similar/runtest.sh +++ b/selinux-policy/synce4l-and-similar/runtest.sh @@ -63,6 +63,7 @@ rlJournalStart rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS" rlPhaseEnd + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" if grep -q _cmd /etc/synce4l.conf ; then rlRun "sed -i 's/^\(.*_cmd\) .*$/\1 echo 0/' /etc/synce4l.conf" @@ -76,6 +77,7 @@ rlJournalStart rlRun "restorecon -Rv /var /run -e /var/ARTIFACTS" 0-255 rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd + fi rlPhaseStartCleanup sleep 2 diff --git a/selinux-policy/systemd-bootchart-and-similar/runtest.sh b/selinux-policy/systemd-bootchart-and-similar/runtest.sh index 7c41cc4..c650b15 100755 --- a/selinux-policy/systemd-bootchart-and-similar/runtest.sh +++ b/selinux-policy/systemd-bootchart-and-similar/runtest.sh @@ -75,6 +75,7 @@ rlJournalStart rlSESearchRule "allow syslogd_t systemd_bootchart_tmpfs_t : file { getattr read write map } [ ]" rlPhaseEnd + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" if ! rlSEDefined ${PROCESS_CONTEXT} ; then @@ -84,6 +85,7 @@ rlJournalStart rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd + fi rlPhaseStartCleanup sleep 2 diff --git a/selinux-policy/systemd-localed/runtest.sh b/selinux-policy/systemd-localed/runtest.sh index 5292292..579438d 100755 --- a/selinux-policy/systemd-localed/runtest.sh +++ b/selinux-policy/systemd-localed/runtest.sh @@ -27,7 +27,9 @@ rlJournalStart rlSEMatchPathCon "/etc/X11/xorg.conf.d" "xserver_etc_t" rlSESearchRule "allow systemd_localed_t xserver_etc_t : dir { create } [ ]" rlPhaseEnd + fi + if [ -f /usr/lib/systemd/system/systemd-localed.service ] ; then rlPhaseStartTest "real scenario -- bz#2240159" if [ -d /etc/X11/xorg.conf.d ] ; then rlRun "rpm -qf /etc/X11/xorg.conf.d" 0,1 diff --git a/selinux-policy/systemd-machined-and-similar/runtest.sh b/selinux-policy/systemd-machined-and-similar/runtest.sh index 0894522..4fa2ecf 100755 --- a/selinux-policy/systemd-machined-and-similar/runtest.sh +++ b/selinux-policy/systemd-machined-and-similar/runtest.sh @@ -128,6 +128,7 @@ rlJournalStart rlPhaseEnd fi + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" if ! rlSEDefined ${PROCESS_CONTEXT} ; then PROCESS_CONTEXT="unconfined_service_t" @@ -136,6 +137,7 @@ rlJournalStart rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd + fi rlPhaseStartTest "real scenario -- bz#1900869 + bz#1900888" rlRun "mkdir -pZ /var/lib/machines/test" diff --git a/selinux-policy/systemd-modules-load-and-similar/runtest.sh b/selinux-policy/systemd-modules-load-and-similar/runtest.sh index 616028f..455b6b1 100755 --- a/selinux-policy/systemd-modules-load-and-similar/runtest.sh +++ b/selinux-policy/systemd-modules-load-and-similar/runtest.sh @@ -104,6 +104,7 @@ rlJournalStart rlSESearchRule "allow systemd_resolved_t efivarfs_t : file { getattr open read } [ ]" rlPhaseEnd + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" if ! rlIsRHEL "<9.6" ; then rlRun "mkdir -p /run/modprobe.d" @@ -121,6 +122,7 @@ rlJournalStart rlRun "rm -f /etc/modules-load.d/${KERNEL_MODULE}.conf" rlRun "rm -f /run/modprobe.d/test.conf" rlPhaseEnd + fi if modinfo `grep ^ib /etc/rdma/modules/rdma.conf` >& /dev/null ; then rlPhaseStartTest "bz#1942267" diff --git a/selinux-policy/systemd-rfkill-and-similar/runtest.sh b/selinux-policy/systemd-rfkill-and-similar/runtest.sh index b92186f..bfdc75c 100755 --- a/selinux-policy/systemd-rfkill-and-similar/runtest.sh +++ b/selinux-policy/systemd-rfkill-and-similar/runtest.sh @@ -112,6 +112,7 @@ rlJournalStart rlPhaseEnd fi + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" if ! rlSEDefined ${PROCESS_CONTEXT} ; then @@ -125,6 +126,7 @@ rlJournalStart rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd + fi rlPhaseStartCleanup sleep 2 diff --git a/selinux-policy/systemd-sysctl-and-similar/runtest.sh b/selinux-policy/systemd-sysctl-and-similar/runtest.sh index 3cec638..5fd8104 100755 --- a/selinux-policy/systemd-sysctl-and-similar/runtest.sh +++ b/selinux-policy/systemd-sysctl-and-similar/runtest.sh @@ -75,11 +75,13 @@ rlJournalStart fi fi + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario" rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "start status" 1 rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd + fi rlPhaseStartCleanup sleep 2 diff --git a/selinux-policy/systemd-userdbd-and-similar/runtest.sh b/selinux-policy/systemd-userdbd-and-similar/runtest.sh index 3120cf3..764eb6b 100755 --- a/selinux-policy/systemd-userdbd-and-similar/runtest.sh +++ b/selinux-policy/systemd-userdbd-and-similar/runtest.sh @@ -100,6 +100,7 @@ rlJournalStart rlRun "setsebool ssh_sysadm_login off" rlPhaseEnd + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" if ! rlSEDefined ${PROCESS_CONTEXT} ; then @@ -109,7 +110,9 @@ rlJournalStart rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd + fi + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.socket ] ; then rlPhaseStartTest "real scenario -- ${SERVICE_NAME}.socket" rlRun "systemctl stop systemd-userdbd.socket" rlRun "systemctl status systemd-userdbd.socket" 3 @@ -118,6 +121,7 @@ rlJournalStart rlRun "ls -dZ /run/systemd/userdb | grep :systemd_userdbd_runtime_t" rlRun "ls -Z /run/systemd/userdb/io.systemd.Multiplexer | grep :systemd_userdbd_runtime_t" rlPhaseEnd + fi rlPhaseStartCleanup sleep 2 diff --git a/selinux-policy/targetd-and-similar/runtest.sh b/selinux-policy/targetd-and-similar/runtest.sh index 2c11ecb..ff7dc99 100755 --- a/selinux-policy/targetd-and-similar/runtest.sh +++ b/selinux-policy/targetd-and-similar/runtest.sh @@ -166,6 +166,7 @@ rlJournalStart rlSESearchRule "allow targetd_t sysctl_net_t : file { getattr open read } [ ]" rlPhaseEnd + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" rlRun "rm -f /etc/target/saveconfig.json" rlRun "rm -f /etc/target/targetd.yaml" @@ -194,6 +195,7 @@ rlJournalStart rlRun "losetup -d ${LOOP_DEVICE}" rlRun "rm -f ${LOOP_FILE}" rlPhaseEnd + fi rlPhaseStartCleanup sleep 2 diff --git a/selinux-policy/thttpd-and-similar/runtest.sh b/selinux-policy/thttpd-and-similar/runtest.sh index 860d5c7..dcd0776 100755 --- a/selinux-policy/thttpd-and-similar/runtest.sh +++ b/selinux-policy/thttpd-and-similar/runtest.sh @@ -84,6 +84,7 @@ rlJournalStart rlPhaseEnd fi + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" # because of the fowner capability rlRun "setsebool httpd_run_stickshift on" @@ -97,6 +98,7 @@ rlJournalStart rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlRun "setsebool httpd_run_stickshift off" rlPhaseEnd + fi rlPhaseStartCleanup sleep 2 diff --git a/selinux-policy/usbguard-daemon-and-similar/runtest.sh b/selinux-policy/usbguard-daemon-and-similar/runtest.sh index e50df2c..94fc163 100755 --- a/selinux-policy/usbguard-daemon-and-similar/runtest.sh +++ b/selinux-policy/usbguard-daemon-and-similar/runtest.sh @@ -77,6 +77,7 @@ rlJournalStart rlPhaseEnd fi + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" rlRun "semodule -lfull | grep usbguard" @@ -88,6 +89,7 @@ rlJournalStart rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd + fi rlPhaseStartCleanup sleep 2 diff --git a/selinux-policy/usbmuxd-and-similar/runtest.sh b/selinux-policy/usbmuxd-and-similar/runtest.sh index 57bd228..76928a7 100755 --- a/selinux-policy/usbmuxd-and-similar/runtest.sh +++ b/selinux-policy/usbmuxd-and-similar/runtest.sh @@ -99,6 +99,7 @@ rlJournalStart rlPhaseEnd fi + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario" rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root" if ! rlSEDefined ${PROCESS_CONTEXT} ; then @@ -108,6 +109,7 @@ rlJournalStart rlRun "restorecon -Rv /var /run -e /var/ARTIFACTS" 0-255 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1 rlPhaseEnd + fi rlPhaseStartCleanup sleep 2 From 58e1983bb7ac11853b374bb633f98951c0be9ddd Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Thu, 5 Mar 2026 13:39:18 +0100 Subject: [PATCH 583/626] install the package which brings the kdump service On Fedora rawhide, the kdump service is no longer brought by the kexec-tools package. The kdump-utils package is necessary for a successful run of this test on Fedora rawhide. --- selinux-policy/bz533007-unable-to-start-kdump-service/main.fmf | 1 + 1 file changed, 1 insertion(+) diff --git a/selinux-policy/bz533007-unable-to-start-kdump-service/main.fmf b/selinux-policy/bz533007-unable-to-start-kdump-service/main.fmf index 8200304..6b03c5c 100644 --- a/selinux-policy/bz533007-unable-to-start-kdump-service/main.fmf +++ b/selinux-policy/bz533007-unable-to-start-kdump-service/main.fmf @@ -14,6 +14,7 @@ recommend: - expect - /usr/sbin/service - kexec-tools + - kdump-utils - grubby - libselinux - libselinux-utils From 321b81e7174966b265c67834a3e066abd158e4f0 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Fri, 6 Mar 2026 13:41:31 +0100 Subject: [PATCH 584/626] test if dhcpc hook can execute resolvectl Recent selinux-policy + dhcpcd + systemd-resolved testing revealed SELinux denials caused by dhcpc hooks running the resolvectl program. The TC reproduces the situation. In order to support the dhcpcd service and its hooks fully, I believe that SELinux policy allow the necessary actions. The TC looks for appropriate policy rules and file context patterns. The TC covers RHEL-147153 and RHEL-147155. --- selinux-policy/dhcpcd-and-similar/Makefile | 4 +++- selinux-policy/dhcpcd-and-similar/main.fmf | 4 ++++ selinux-policy/dhcpcd-and-similar/runtest.sh | 15 ++++++++++++--- 3 files changed, 19 insertions(+), 4 deletions(-) diff --git a/selinux-policy/dhcpcd-and-similar/Makefile b/selinux-policy/dhcpcd-and-similar/Makefile index eb537ff..5ed2841 100644 --- a/selinux-policy/dhcpcd-and-similar/Makefile +++ b/selinux-policy/dhcpcd-and-similar/Makefile @@ -54,7 +54,7 @@ $(METADATA): Makefile @echo "Type: Regression" >> $(METADATA) @echo "TestTime: 10m" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console dhcpcd /usr/sbin/service iproute" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console dhcpcd /usr/sbin/service iproute systemd-resolved" >> $(METADATA) @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @@ -71,6 +71,8 @@ $(METADATA): Makefile @echo "Bug: RHEL-43417" >> $(METADATA) # RHEL-10 @echo "Bug: RHEL-113937" >> $(METADATA) # RHEL-10 @echo "Bug: RHEL-113941" >> $(METADATA) # RHEL-9 + @echo "Bug: RHEL-147153" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-147155" >> $(METADATA) # RHEL-9 rhts-lint $(METADATA) diff --git a/selinux-policy/dhcpcd-and-similar/main.fmf b/selinux-policy/dhcpcd-and-similar/main.fmf index 939e1cd..d9f21eb 100644 --- a/selinux-policy/dhcpcd-and-similar/main.fmf +++ b/selinux-policy/dhcpcd-and-similar/main.fmf @@ -18,6 +18,7 @@ recommend: - dhcpcd - /usr/sbin/service - iproute + - systemd-resolved environment: AVC_ERROR: +no_avc_check duration: 10m @@ -26,6 +27,7 @@ tag: - NoRHEL4 - NoRHEL5 - NoRHEL6 + - NoRHEL7 - targeted - NoRHIVOS - avoidImageMode @@ -39,6 +41,8 @@ link: - verifies: https://issues.redhat.com/browse/RHEL-43417 - verifies: https://issues.redhat.com/browse/RHEL-113937 - verifies: https://issues.redhat.com/browse/RHEL-113941 + - verifies: https://issues.redhat.com/browse/RHEL-147153 + - verifies: https://issues.redhat.com/browse/RHEL-147155 adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7 diff --git a/selinux-policy/dhcpcd-and-similar/runtest.sh b/selinux-policy/dhcpcd-and-similar/runtest.sh index 2b532ad..37583a1 100755 --- a/selinux-policy/dhcpcd-and-similar/runtest.sh +++ b/selinux-policy/dhcpcd-and-similar/runtest.sh @@ -51,6 +51,7 @@ rlJournalStart rlAssertRpm ${PACKAGE} rlAssertRpm ${PACKAGE}-targeted rlAssertRpm ${SERVICE_PACKAGE} + rlRun "rpm -qa | grep systemd | sort" rlServiceStop ${SERVICE_NAME} rlFileBackup /etc/shadow @@ -111,10 +112,18 @@ rlJournalStart if rlIsRHEL '> 9.7' || rlIsRHEL '> 10.1' ; then rlPhaseStartTest "RHEL-113937 + RHEL-113941" - rlSEMatchPathCon "/usr/libexec/dhcpcd-run-hooks" "bin_t" + rlSEMatchPathCon "/usr/libexec/dhcpcd-run-hooks" "dhcpc_hook_exec_t" CONF_FILE_CONTEXT=`secon --type --file /etc/chrony.conf` - rlSESearchRule "allow dhcpc_t ${CONF_FILE_CONTEXT} : file { write } [ ]" - rlPhase + rlSESearchRule "allow dhcpc_hook_t ${CONF_FILE_CONTEXT} : file { write } [ ]" + rlPhaseEnd + fi + + if rlIsRHEL '> 9.8' || rlIsRHEL '> 10.2' ; then + rlPhaseStartTest "RHEL-147153 + RHEL-147155" + rlSEMatchPathCon "/usr/bin/resolvectl" "bin_t" + rlSESearchRule "allow dhcpc_hook_t dhcpc_hook_t : unix_dgram_socket { create ioctl } [ ]" + rlSESearchRule "allow dhcpc_hook_t init_t : unix_stream_socket { getattr } [ ]" + rlPhaseEnd fi if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then From c628fff62211567648739e5e3b6dd6b5b96a9e7f Mon Sep 17 00:00:00 2001 From: Veronika Syncakova Date: Wed, 4 Mar 2026 16:32:52 +0100 Subject: [PATCH 585/626] test if setroubleshootd process does not cause an AVC when trying to read /root/.rpmmacros TC covers RHEL-142548 and RHEL-147470 If the setroubleshoot-server package is installed then the SELinux denial appears each time the setroubleshootd process analyzes any SELinux denial, because the setroubleshootd process executes the rpm command to find out which package owns some file. --- .../rpm-cant-read-rpmmacros/main.fmf | 40 ++++++++++++ .../rpm-cant-read-rpmmacros/runtest.sh | 61 +++++++++++++++++++ 2 files changed, 101 insertions(+) create mode 100644 selinux-policy/rpm-cant-read-rpmmacros/main.fmf create mode 100755 selinux-policy/rpm-cant-read-rpmmacros/runtest.sh diff --git a/selinux-policy/rpm-cant-read-rpmmacros/main.fmf b/selinux-policy/rpm-cant-read-rpmmacros/main.fmf new file mode 100644 index 0000000..45e948e --- /dev/null +++ b/selinux-policy/rpm-cant-read-rpmmacros/main.fmf @@ -0,0 +1,40 @@ +summary: setroubleshootd process should not cause an AVC when trying to read /root/.rpmmacros +description: |+ + setroubleshootd process should not cause an AVC when trying to read /root/.rpmmacros + +contact: Veronika Syncakova +component: + - selinux-policy +test: ./runtest.sh +framework: beakerlib +require: + - library(selinux-policy/common) + - setroubleshoot-server +recommend: + - audit + - libselinux + - selinux-policy + - selinux-policy-targeted +environment: + AVC_ERROR: +no_avc_check +check: + - how: avc + result: xfail +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - targeted + - NoRHIVOS +tier: 2 +link: + - verifies: https://issues.redhat.com/browse/RHEL-147470 + - verifies: https://issues.redhat.com/browse/RHEL-142548 +adjust+: + - enabled: false + when: distro < rhel-9.9 + continue: false + because: RHEL-147470 is fixed in RHEL-9.9 and RHEL-142548 in RHEL-10.3 diff --git a/selinux-policy/rpm-cant-read-rpmmacros/runtest.sh b/selinux-policy/rpm-cant-read-rpmmacros/runtest.sh new file mode 100755 index 0000000..2f75068 --- /dev/null +++ b/selinux-policy/rpm-cant-read-rpmmacros/runtest.sh @@ -0,0 +1,61 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of selinux-policy/rpm-cant-read-rpmmacros +# Description: setroubleshootd process should not cause an AVC when trying to read /root/.rpmmacros +# Author: Veronika Syncakova +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2026 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="setroubleshoot-server" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlAssertRpm ${PACKAGE} + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + rlRun "rlFileBackup --clean /root/.rpmmacros" + rlPhaseEnd + + rlPhaseStartTest "RHEL-142548 + RHEL-147470" + # check that sedispatch is running and therefore setroubleshoot-server is installed + rlRun "ps -efZ | grep sedispatch" + rlSESearchRule "dontaudit setroubleshootd_t admin_home_t : file { read } [ ]" + rlRun "touch /root/.rpmmacros" + # trigger selinux denial + rlRun "passwd --help >& /root/output.txt" + sleep 5 + rlPhaseEnd + + rlPhaseStartCleanup + rlSECheckAVC --ignore 'type=AVC .* denied { write } .*:passwd_t.* ' \ + --ignore '.*passwd.*' + rlRun "rlFileRestore" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd \ No newline at end of file From a011b35f3677adb559bc205cfc7829d28563d404 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Thu, 15 Jan 2026 15:46:03 +0100 Subject: [PATCH 586/626] Add a test for unexpected denials from sysctl -a Signed-off-by: Ondrej Mosnacek --- kernel/sysctl-avcs/main.fmf | 22 ++++++++++++++++++ kernel/sysctl-avcs/runtest.sh | 32 ++++++++++++++++++++++++++ kernel/sysctl-avcs/test_policy.te | 37 +++++++++++++++++++++++++++++++ 3 files changed, 91 insertions(+) create mode 100644 kernel/sysctl-avcs/main.fmf create mode 100755 kernel/sysctl-avcs/runtest.sh create mode 100644 kernel/sysctl-avcs/test_policy.te diff --git a/kernel/sysctl-avcs/main.fmf b/kernel/sysctl-avcs/main.fmf new file mode 100644 index 0000000..968e37e --- /dev/null +++ b/kernel/sysctl-avcs/main.fmf @@ -0,0 +1,22 @@ +summary: Test for unexpected denials from sysctl -a +description: | + Verifes that running sysctl -a doesn't trigger unexpected capability + checks that would result in AVC denials even when access is allowed. +contact: Ondrej Mosnacek +component: + - kernel +framework: beakerlib +require: + - selinux-policy-devel +duration: 10m +tier: 2 +check: + - avc +enabled: true +adjust+: + - enabled: false + when: distro < rhel-9 + because: RHEL-8 and below are not worth supporting by this test +link: + - verifies: https://issues.redhat.com/browse/RHEL-135610 + - verifies: https://issues.redhat.com/browse/RHEL-145590 diff --git a/kernel/sysctl-avcs/runtest.sh b/kernel/sysctl-avcs/runtest.sh new file mode 100755 index 0000000..b8129a9 --- /dev/null +++ b/kernel/sysctl-avcs/runtest.sh @@ -0,0 +1,32 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# SPDX-License-Identifier: GPLv2 +# Copyright (c) 2026 Red Hat, Inc. +# Author: Ondrej Mosnacek + +# Include Beakerlib environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +rlJournalStart + rlPhaseStartSetup + rlRun "uname -r" + + SE_ROLE="$(secon -r --pid $$)" + SE_TYPE="$(secon -t --pid $$)" + + rlRun "make -f /usr/share/selinux/devel/Makefile test_policy.pp M4PARAM='-D TEST_ROLE=$SE_ROLE -D TEST_TYPE=$SE_TYPE'" 0 \ + "Build the test policy" + rlRun "semodule -i test_policy.pp" 0 "Load test policy" + rlPhaseEnd + + rlPhaseStartTest + rlRun "runcon -t test_domain_t sysctl -a" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "semodule -r test_policy" 0 "Unload test policy" + rlRun "make -f /usr/share/selinux/devel/Makefile clean" 0 \ + "Clean the test policy" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/kernel/sysctl-avcs/test_policy.te b/kernel/sysctl-avcs/test_policy.te new file mode 100644 index 0000000..bf53caa --- /dev/null +++ b/kernel/sysctl-avcs/test_policy.te @@ -0,0 +1,37 @@ +policy_module(test_policy,1.0.0) + +type test_domain_t; +domain_type(test_domain_t) + +corecmd_bin_entry_type(test_domain_t) +kernel_read_all_sysctls(test_domain_t) +kernel_read_security_state(test_domain_t) +fs_read_binfmt_misc(test_domain_t) +fs_search_auto_mountpoints(test_domain_t) + +# No interface for this in policy: +require { + type binfmt_misc_fs_t; +} +list_dirs_pattern(test_domain_t, binfmt_misc_fs_t, binfmt_misc_fs_t) + +# Some BPF sysctls can only be read with CAP_SYS_ADMIN, so we need to silence +# it. +dontaudit test_domain_t self:capability sys_admin; + +require { + type TEST_TYPE; + role TEST_ROLE; +} +allow TEST_TYPE test_domain_t:process transition; +role TEST_ROLE types test_domain_t; + +allow test_domain_t TEST_TYPE:fd use; +allow test_domain_t TEST_TYPE:fifo_file rw_inherited_fifo_file_perms; +allow test_domain_t TEST_TYPE:process { sigchld }; + +files_search_tmp(test_domain_t) + +term_use_all_terms(test_domain_t) + +userdom_search_user_tmp_dirs(test_domain_t) From eb4ef74ed863c36fce382c5a75af525c6aec7aaa Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 20 Jan 2026 13:49:42 +0100 Subject: [PATCH 587/626] test if iio-sensor-proxy can read iio:devices A CentOS stream 10 user reported that SELinux denials are triggered when their device with a running iio-sensor-proxy service is rotated. Further analysis revealed that iio-sensor-proxy cannot perform the following activities: * read various character devices - /dev/iio:device* * create a UDP socket * write into in_accel_x_en, in_accel_y_en, in_accel_z_en files stored under /sys * add a new directory for a HID sensor device connected via PCI The TC does not reproduce the situation. In order to support the cooperation of iio-sensor-proxy and various devices, I believe that SELinux policy should allow these actions. The TC looks for appropriate policy rules and file context patterns. The TC covers RHEL-110090. --- selinux-policy/iio-sensor-proxy-and-similar/Makefile | 1 + selinux-policy/iio-sensor-proxy-and-similar/main.fmf | 1 + selinux-policy/iio-sensor-proxy-and-similar/runtest.sh | 9 +++++++++ 3 files changed, 11 insertions(+) diff --git a/selinux-policy/iio-sensor-proxy-and-similar/Makefile b/selinux-policy/iio-sensor-proxy-and-similar/Makefile index 1de229f..d79e134 100644 --- a/selinux-policy/iio-sensor-proxy-and-similar/Makefile +++ b/selinux-policy/iio-sensor-proxy-and-similar/Makefile @@ -66,6 +66,7 @@ $(METADATA): Makefile @echo "Bug: RHEL-17346" >> $(METADATA) # RHEL-9 @echo "Bug: RHEL-62355" >> $(METADATA) # RHEL-10 @echo "Bug: RHEL-70850" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-110090" >> $(METADATA) # RHEL-10 rhts-lint $(METADATA) diff --git a/selinux-policy/iio-sensor-proxy-and-similar/main.fmf b/selinux-policy/iio-sensor-proxy-and-similar/main.fmf index d17b90f..5d6fd94 100644 --- a/selinux-policy/iio-sensor-proxy-and-similar/main.fmf +++ b/selinux-policy/iio-sensor-proxy-and-similar/main.fmf @@ -36,6 +36,7 @@ link: - verifies: https://issues.redhat.com/browse/RHEL-17346 - verifies: https://issues.redhat.com/browse/RHEL-62355 - verifies: https://issues.redhat.com/browse/RHEL-70850 + - verifies: https://issues.redhat.com/browse/RHEL-110090 adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 diff --git a/selinux-policy/iio-sensor-proxy-and-similar/runtest.sh b/selinux-policy/iio-sensor-proxy-and-similar/runtest.sh index 804509f..c89bd18 100755 --- a/selinux-policy/iio-sensor-proxy-and-similar/runtest.sh +++ b/selinux-policy/iio-sensor-proxy-and-similar/runtest.sh @@ -72,6 +72,15 @@ rlJournalStart rlSESearchRule "allow iiosensorproxy_t xdm_t : dbus { send_msg } [ ]" rlSESearchRule "allow iiosensorproxy_t iiosensorproxy_t : capability2 { bpf } [ ]" rlPhaseEnd + + rlPhaseStartTest "RHEL-110090" + rlRun "semanage fcontext -l | grep '/dev/iio:device.*character.*iio_device_t'" + rlSEMatchPathCon "/dev/iio:device3" "iio_device_t" + rlSESearchRule "allow iiosensorproxy_t sysfs_t : dir { write } [ ]" + rlSESearchRule "allow iiosensorproxy_t sysfs_t : file { write } [ ]" + rlSESearchRule "allow iiosensorproxy_t iiosensorproxy_t : unix_dgram_socket { create } [ ]" + rlSESearchRule "allow iiosensorproxy_t iio_device_t : chr_file { read } [ ]" + rlPhaseEnd fi if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then From 5caabc667c5540fbcf3e6c5d9f3ef1e4834b4ae5 Mon Sep 17 00:00:00 2001 From: Veronika Syncakova Date: Wed, 18 Mar 2026 15:00:19 +0100 Subject: [PATCH 588/626] Test that the corecmd_bin_sys_resource permits sys_resource capability request when turned on. TC covers RHEL-141858 The issue appears to be caused by the coreutils-single package, which introduces additional prctl() system calls, that request sys_resource capability, leading to AVC denials. --- selinux-policy/coreutils-single/main.fmf | 38 ++++++++++++++++ selinux-policy/coreutils-single/runtest.sh | 52 ++++++++++++++++++++++ 2 files changed, 90 insertions(+) create mode 100644 selinux-policy/coreutils-single/main.fmf create mode 100755 selinux-policy/coreutils-single/runtest.sh diff --git a/selinux-policy/coreutils-single/main.fmf b/selinux-policy/coreutils-single/main.fmf new file mode 100644 index 0000000..26e8e7e --- /dev/null +++ b/selinux-policy/coreutils-single/main.fmf @@ -0,0 +1,38 @@ +summary: Test that the corecmd_bin_sys_resource permits sys_resource capability request when turned on. +description: |+ + Test that the corecmd_bin_sys_resource permits sys_resource capability request when turned on. + +contact: Veronika Syncakova +test: ./runtest.sh +framework: beakerlib +component: + - selinux-policy +require: + - library(selinux-policy/common) +recommend: + - audit + - libselinux + - policycoreutils + - selinux-policy + - selinux-policy-targeted +environment: + AVC_ERROR: +no_avc_check +check: + - how: avc + result: xfail +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - NoRHEL8 + - NoRHIVOS +link: + - verifies: https://redhat.atlassian.net/browse/RHEL-141858 +adjust+: + - enabled: false + when: distro < rhel-10.3 + continue: false + because: RHEL-141858 is fixed in RHEL-10.3 diff --git a/selinux-policy/coreutils-single/runtest.sh b/selinux-policy/coreutils-single/runtest.sh new file mode 100755 index 0000000..5db41ac --- /dev/null +++ b/selinux-policy/coreutils-single/runtest.sh @@ -0,0 +1,52 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="coreutils-single" +BOOLEAN="corecmd_bin_sys_resource" +INSTALLED_VARIANT="" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + if rpm -q coreutils-single > /dev/null 2>&1; then + INSTALLED_VARIANT="single" + else + INSTALLED_VARIANT="regular" + rlRun "yum -y install ${PACKAGE} --allowerasing" + fi + rlAssertRpm ${PACKAGE} + rlSESetEnforce + rlSEStatus + rlSESetTimestamp "General" + rlPhaseEnd + + rlPhaseStartTest "RHEL-141858" + rlSESetTimestamp "No_AVC" + # Boolean and rule exists + rlRun "getsebool -a | grep ${BOOLEAN}" + rlSESearchRule "allow NetworkManager_dispatcher_chronyc_t self:capability {sys_resource} [ ${BOOLEAN} ]" + INTERFACE_NAME="$(ip link show | head -n 1 | awk -F': ' '/^[0-9]+:/ {print $2}')" + + # No AVC when the boolean is turned on + rlSEBooleanOn ${BOOLEAN} + rlRun "nmcli connection up ${INTERFACE_NAME}" + sleep 5 + rlSECheckAVC "No_AVC" + + # AVC present when boolean is off + rlSESetTimestamp "Trigger_AVC" + rlRun "setsebool ${BOOLEAN} off" + rlRun "nmcli connection up ${INTERFACE_NAME}" + sleep 5 + rlRun 'rlSEAVCCheck "Trigger_AVC"' 1 + rlPhaseEnd + + rlPhaseStartCleanup + rlSECheckAVC --ignore "type=AVC .* denied .* sys_resource .*:NetworkManager_dispatcher.* " "General" + rlSEBooleanRestore ${BOOLEAN} + if [ "$INSTALLED_VARIANT" = "regular" ]; then + rlRun "yum -y install coreutils --allowerasing" + fi + rlPhaseEnd +rlJournalEnd \ No newline at end of file From a47e7720466068f760bf56d6faee29ad812c39e1 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Thu, 26 Mar 2026 18:04:17 +0100 Subject: [PATCH 589/626] test if valkey service can manage RDMA sockets Recent valkey + selinux-policy testing revealed that SELinux prevents the valkey-server processes from creating and manipulating of RDMA sockets when the valkey-rdma package is installed. The TC reproduces the situation. In order to enable the functions brought by the valkey-rdma package, I believe that SELinux policy should allow the access. The TC looks for appropriate policy rules and file context patterns. The TC covers RHEL-154814 and RHEL-161115. --- selinux-policy/valkey-and-similar/Makefile | 4 +++- selinux-policy/valkey-and-similar/main.fmf | 3 +++ selinux-policy/valkey-and-similar/runtest.sh | 6 ++++++ 3 files changed, 12 insertions(+), 1 deletion(-) diff --git a/selinux-policy/valkey-and-similar/Makefile b/selinux-policy/valkey-and-similar/Makefile index 2e576bf..e194474 100644 --- a/selinux-policy/valkey-and-similar/Makefile +++ b/selinux-policy/valkey-and-similar/Makefile @@ -55,7 +55,7 @@ $(METADATA): Makefile @echo "TestTime: 10m" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) @echo "RunFor: valkey" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console valkey /usr/sbin/service" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console valkey /usr/sbin/service valkey-rdma" >> $(METADATA) @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @echo "License: GPLv2" >> $(METADATA) @@ -65,6 +65,8 @@ $(METADATA): Makefile @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA) @echo "Bug: RHEL-102631" >> $(METADATA) # RHEL-10 @echo "Bug: RHEL-108982" >> $(METADATA) # RHEL-9 + @echo "Bug: RHEL-154814" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-161115" >> $(METADATA) # RHEL-9 rhts-lint $(METADATA) diff --git a/selinux-policy/valkey-and-similar/main.fmf b/selinux-policy/valkey-and-similar/main.fmf index af010b8..16ddad7 100644 --- a/selinux-policy/valkey-and-similar/main.fmf +++ b/selinux-policy/valkey-and-similar/main.fmf @@ -18,6 +18,7 @@ recommend: - selinux-policy-targeted - setools-console - valkey + - valkey-rdma - /usr/sbin/service environment: AVC_ERROR: +no_avc_check @@ -27,6 +28,8 @@ tier: '3' link: - verifies: https://issues.redhat.com/browse/RHEL-102631 - verifies: https://issues.redhat.com/browse/RHEL-108982 + - verifies: https://issues.redhat.com/browse/RHEL-154814 + - verifies: https://issues.redhat.com/browse/RHEL-161115 tag: - Tier3 - Tier3se diff --git a/selinux-policy/valkey-and-similar/runtest.sh b/selinux-policy/valkey-and-similar/runtest.sh index 4a356ed..8b2830d 100755 --- a/selinux-policy/valkey-and-similar/runtest.sh +++ b/selinux-policy/valkey-and-similar/runtest.sh @@ -66,6 +66,12 @@ rlJournalStart rlSEMatchPathCon "/usr/lib/systemd/system/valkey.service" "redis_unit_file_t" rlPhaseEnd + if rpm -q valkey-rdma >& /dev/null ; then + rlPhaseStartTest "RHEL-154814 + RHEL-161115" + rlSESearchRule "allow redis_t redis_t : netlink_rdma_socket { getattr create setopt bind } [ ]" + rlPhaseEnd + fi + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- ${SERVICE_NAME} service" if ! rlSEDefined ${PROCESS_CONTEXT} ; then From 4df7f3f7162314d809fc3e636eb045b88000d9d1 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Thu, 26 Mar 2026 13:03:04 +0100 Subject: [PATCH 590/626] test if logwatch scripts can check files in /run/netns Recent logwatch + selinux-policy testing revealed that SELinux prevents one of the logwatch scripts from checking files labeled nsfs_t located under /run/netns directory. The TC reproduces the situation. In order to support the 'df' command functionality (executed by one of the scripts, syscall = newfstatat), I believe that SELinux policy should allow this access. The TC looks for appropriate policy rules and file context patterns. The TC covers RHEL-160896 and RHEL-160897. --- selinux-policy/logwatch-and-similar/Makefile | 4 +++- selinux-policy/logwatch-and-similar/main.fmf | 3 +++ selinux-policy/logwatch-and-similar/runtest.sh | 12 ++++++++++++ 3 files changed, 18 insertions(+), 1 deletion(-) diff --git a/selinux-policy/logwatch-and-similar/Makefile b/selinux-policy/logwatch-and-similar/Makefile index 2c3dd3b..3292741 100644 --- a/selinux-policy/logwatch-and-similar/Makefile +++ b/selinux-policy/logwatch-and-similar/Makefile @@ -54,7 +54,7 @@ $(METADATA): Makefile @echo "Type: Regression" >> $(METADATA) @echo "TestTime: 15m" >> $(METADATA) @echo "RunFor: selinux-policy" >> $(METADATA) - @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console logwatch sendmail /usr/sbin/service" >> $(METADATA) + @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console logwatch sendmail /usr/sbin/service iproute" >> $(METADATA) @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA) @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) @echo "Priority: Normal" >> $(METADATA) @@ -65,6 +65,8 @@ $(METADATA): Makefile @echo "Bug: 2183432" >> $(METADATA) # Fedora 38 @echo "Bug: 2270484" >> $(METADATA) # Fedora 40 @echo "Bug: RHEL-34135" >> $(METADATA) # RHEL-9 + @echo "Bug: RHEL-160896" >> $(METADATA) # RHEL-9 + @echo "Bug: RHEL-160897" >> $(METADATA) # RHEL-10 rhts-lint $(METADATA) diff --git a/selinux-policy/logwatch-and-similar/main.fmf b/selinux-policy/logwatch-and-similar/main.fmf index 4be331b..d4d765a 100644 --- a/selinux-policy/logwatch-and-similar/main.fmf +++ b/selinux-policy/logwatch-and-similar/main.fmf @@ -18,6 +18,7 @@ recommend: - logwatch - sendmail - /usr/sbin/service + - iproute environment: AVC_ERROR: +no_avc_check duration: 15m @@ -35,6 +36,8 @@ link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2183432 - verifies: https://issues.redhat.com/browse/RHEL-34135 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2270484 + - verifies: https://issues.redhat.com/browse/RHEL-160896 + - verifies: https://issues.redhat.com/browse/RHEL-160897 adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8 diff --git a/selinux-policy/logwatch-and-similar/runtest.sh b/selinux-policy/logwatch-and-similar/runtest.sh index a7dadf8..2c06f96 100755 --- a/selinux-policy/logwatch-and-similar/runtest.sh +++ b/selinux-policy/logwatch-and-similar/runtest.sh @@ -74,9 +74,19 @@ rlJournalStart rlPhaseEnd fi + if rlIsRHEL '>= 9.8' || rlIsRHEL '>= 10.2' ; then + rlPhaseStartTest "RHEL-160896 + RHEL-160897" + rlSESearchRule "allow logwatch_t nsfs_t : file { getattr } [ ]" + rlPhaseEnd + fi + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" rlRun "mkdir -p /var/cache/logwatch" + NS_NAME="test-ns-${RANDOM}" + rlRun "ip netns add ${NS_NAME}" + rlRun "ip netns list | grep ${NS_NAME}" + rlRun "ls -lZ /run/netns/ | grep :nsfs_t" if ! rlSEDefined ${PROCESS_CONTEXT} ; then # for environments where the SELinux domain does not exist yet PROCESS_CONTEXT="unconfined_service_t" @@ -84,6 +94,8 @@ rlJournalStart rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "start status" 1 rlRun "restorecon -Rv /etc /var /run -e /var/ARTIFACTS" 0-255 rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "restart status stop status" 1 + rlRun "ip netns del ${NS_NAME}" + rlRun "ip netns list | grep ${NS_NAME}" 1 rlPhaseEnd fi From ed43635ec86fbdcef4b8350f6bb20593e222b8bc Mon Sep 17 00:00:00 2001 From: Veronika Syncakova Date: Thu, 26 Mar 2026 12:31:42 +0000 Subject: [PATCH 591/626] Test that seunshare/sandbox doesn't execute shell commands when given filenames with special characters. The test was co-authored by Gemini and Claude. TC coveres: RHEL-144055 --- .../seunshare-drop-system-calls/main.fmf | 24 +++++++++++++ .../seunshare-drop-system-calls/runtest.sh | 34 +++++++++++++++++++ 2 files changed, 58 insertions(+) create mode 100644 policycoreutils/seunshare-drop-system-calls/main.fmf create mode 100755 policycoreutils/seunshare-drop-system-calls/runtest.sh diff --git a/policycoreutils/seunshare-drop-system-calls/main.fmf b/policycoreutils/seunshare-drop-system-calls/main.fmf new file mode 100644 index 0000000..db2e2a7 --- /dev/null +++ b/policycoreutils/seunshare-drop-system-calls/main.fmf @@ -0,0 +1,24 @@ +summary: Test that seunshare/sandbox doesn't execute shell commands when given + filenames with special characters. +contact: Veronika Syncakova + +component: + - policycoreutils +require: + - policycoreutils + - policycoreutils-sandbox +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - NoRHEL8 +link: + - verifies: https://redhat.atlassian.net/browse/RHEL-144055 + - verifies: https://redhat.atlassian.net/browse/RHEL-144041 +adjust+: + - enabled: false + when: distro < rhel-8 + continue: false diff --git a/policycoreutils/seunshare-drop-system-calls/runtest.sh b/policycoreutils/seunshare-drop-system-calls/runtest.sh new file mode 100755 index 0000000..79cfb87 --- /dev/null +++ b/policycoreutils/seunshare-drop-system-calls/runtest.sh @@ -0,0 +1,34 @@ +#!/bin/bash + +# Include beakerlib environment +. /usr/share/beakerlib/beakerlib.sh + +PACKAGE="policycoreutils-sandbox" +TEST_DIR="/tmp/mytest" + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm ${PACKAGE} + rlRun "mkdir -p ${TEST_DIR}" + rlPhaseEnd + + rlPhaseStartTest "RHEL-144055 + RHEL-144041" + # Create a file with malicious name + rlRun -s "seunshare -Z unconfined_u:unconfined_r:sandbox_x_t:s0 \ + -t ${TEST_DIR} \ + -- /bin/bash -c \"touch \\\"/tmp/' ; id -Z ; '\\\"\"" + rlRun "ls ${TEST_DIR} | grep '; id -Z ;' " + # Trigger rsync which processes filenames + rlRun -s "seunshare -Z unconfined_u:unconfined_r:sandbox_x_t:s0 \ + -t ${TEST_DIR} \ + -- /bin/bash -c \"touch \\\"/tmp/' ; id -Z ; '\\\"\" " + rlAssertNotGrep "command not found" $rlRun_LOG + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "rm -rf ${TEST_DIR}" + rlRun "rm -f $rlRun_LOG" + rlPhaseEnd + + rlJournalPrintText +rlJournalEnd From fdcacccc89cedef323f2188c59f2b6f615b236fd Mon Sep 17 00:00:00 2001 From: Veronika Syncakova Date: Fri, 20 Mar 2026 16:18:26 +0100 Subject: [PATCH 592/626] Test if selinux-policy owns tree with interface files Recently filed report revealed that certain files are not owned by the selinux-policy package. This situation is generally described in the following document and should be fixed: https://docs.fedoraproject.org/en-US/packaging-guidelines/UnownedDirectories/ Purpose of this test is to find out if the issue is fixed or not. TC coveres: RHEL-141659 + RHEL-157952 + FC-1681 --- selinux-policy/files-ownership/main.fmf | 25 ++++++++++++ selinux-policy/files-ownership/runtest.sh | 47 +++++++++++++++++++++++ 2 files changed, 72 insertions(+) create mode 100644 selinux-policy/files-ownership/main.fmf create mode 100755 selinux-policy/files-ownership/runtest.sh diff --git a/selinux-policy/files-ownership/main.fmf b/selinux-policy/files-ownership/main.fmf new file mode 100644 index 0000000..9808d2d --- /dev/null +++ b/selinux-policy/files-ownership/main.fmf @@ -0,0 +1,25 @@ +summary: test if selinux-policy owns tree with interface files +contact: Veronika Syncakova +test: ./runtest.sh +duration: 5m +enabled: true +require: + - selinux-policy +recommend: + - selinux-policy-targeted + - selinux-policy-mls + - selinux-policy-minimum +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - NoRHEL8 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8 + continue: false +link: + - verifies: https://redhat.atlassian.net/browse/RHEL-141659 + - verifies: https://redhat.atlassian.net/browse/RHEL-157952 + - verifies: https://redhat.atlassian.net/browse/FC-1681 \ No newline at end of file diff --git a/selinux-policy/files-ownership/runtest.sh b/selinux-policy/files-ownership/runtest.sh new file mode 100755 index 0000000..d5e79f1 --- /dev/null +++ b/selinux-policy/files-ownership/runtest.sh @@ -0,0 +1,47 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of selinux-policy/files-ownership/runtest.sh +# Description: test if selinux-policy owns tree with interface files +# Author: Veronika Syncakova +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2026 Red Hat, Inc. +# +# This program is free software: you can redistribute it and/or +# modify it under the terms of the GNU General Public License as +# published by the Free Software Foundation, either version 2 of +# the License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see http://www.gnu.org/licenses/. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm selinux-policy + rlPhaseEnd + + rlPhaseStartTest "RHEL-141659 + RHEL-157952 + FC-1681" + for LOCATION in devel devel/include devel/include/distributed \ + packages/targeted packages/minimum packages/mls; do + rlRun -s "rpm -qf /usr/share/selinux/${LOCATION}" + rlAssertGrep "selinux-policy-" $rlRun_LOG -i + rm -f $rlRun_LOG + done + rlPhaseEnd + + rlPhaseStartCleanup + rlPhaseEnd +rlJournalEnd \ No newline at end of file From 337204b766028f111f16d89ba8c4649e09bde18a Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Wed, 8 Apr 2026 23:31:04 +0200 Subject: [PATCH 593/626] test if restorecond service times out occasionally A recently reported customer case revealed that the restorecond service occasionally fails to start because of a timeout. The exact reproducer is unknown, but the TC reproduces a similar situation (mislabeled /run/restorecond.pid file) which also leads to timeouts. In order to fix the problem, the restorecond service is no longer a forking type of service. It is a single type of service. The TC checks this parameter too. The TC covers RHEL-142541 and RHEL-165247. --- .../restorecond-service-timeouts/main.fmf | 30 ++++++++++++++++ .../restorecond-service-timeouts/runtest.sh | 34 +++++++++++++++++++ 2 files changed, 64 insertions(+) create mode 100644 policycoreutils/restorecond-service-timeouts/main.fmf create mode 100755 policycoreutils/restorecond-service-timeouts/runtest.sh diff --git a/policycoreutils/restorecond-service-timeouts/main.fmf b/policycoreutils/restorecond-service-timeouts/main.fmf new file mode 100644 index 0000000..bd454be --- /dev/null +++ b/policycoreutils/restorecond-service-timeouts/main.fmf @@ -0,0 +1,30 @@ +summary: the restorecond service fails to start because of timeout +description: the restorecond service fails to start because of timeout +contact: Milos Malik +component: + - policycoreutils +recommend: + - policycoreutils + - policycoreutils-restorecond +duration: 5m +enabled: true +tag: + - CI-Tier-1 + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - NoRHEL8 + - targeted +tier: 1 +link: + - verifies: https://issues.redhat.com/browse/RHEL-142541 + - verifies: https://issues.redhat.com/browse/RHEL-165247 +adjust: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + because: the test is not relevant there + - enabled: false + when: distro == rhel-8, centos-stream-8 + because: the bug is not yet fixed there + diff --git a/policycoreutils/restorecond-service-timeouts/runtest.sh b/policycoreutils/restorecond-service-timeouts/runtest.sh new file mode 100755 index 0000000..0857ea2 --- /dev/null +++ b/policycoreutils/restorecond-service-timeouts/runtest.sh @@ -0,0 +1,34 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +. /usr/share/beakerlib/beakerlib.sh + +rlJournalStart + rlPhaseStartSetup + rlRun "rpm -qa | grep policycoreutils | sort" + rlServiceStop restorecond + rlRun "rm -f /run/restorecond.pid" + rlPhaseEnd + + rlPhaseStartTest "RHEL-142541 + RHEL-165247" + rlRun "grep ^Type=simple /usr/lib/systemd/system/restorecond.service" + rlRun "touch /run/restorecond.pid" + rlRun "ls -lZ /run/restorecond.pid" + rlRun "ls -lZ /run/restorecond.pid | grep :var_run_t" + rlRun "systemctl start restorecond.service" + sleep 2 + rlRun -s "systemctl status restorecond.service -l" + rlRun "grep -i -e '/run/restorecond.pid' -e 'failed.*timeout' $rlRun_LOG" 1 + rm -f $rlRun_LOG + rlRun "systemctl restart restorecond.service" + sleep 2 + rlRun -s "systemctl status restorecond.service -l" + rlRun "grep -i -e '/run/restorecond.pid' -e 'failed.*timeout' $rlRun_LOG" 1 + rm -f $rlRun_LOG + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "rm -f /run/restorecond.pid" + rlServiceRestore restorecond + rlPhaseEnd +rlJournalEnd + From 53baf4175fa3b28cdc3fbbfb50cfc63606db0f46 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 7 Apr 2026 13:32:40 +0200 Subject: [PATCH 594/626] instruct TMT to expect SELinux denials The /selinux-policy/kernel-confined-exec test intentionally triggers SELinux denials. TMT framework sees them as a problem unless told otherwise. From now on, the TMT will expect them. --- selinux-policy/kernel-confined-exec/main.fmf | 3 +++ 1 file changed, 3 insertions(+) diff --git a/selinux-policy/kernel-confined-exec/main.fmf b/selinux-policy/kernel-confined-exec/main.fmf index 4c49618..2a4a76e 100644 --- a/selinux-policy/kernel-confined-exec/main.fmf +++ b/selinux-policy/kernel-confined-exec/main.fmf @@ -14,6 +14,9 @@ require: - gcc environment: AVC_ERROR: +no_avc_check +check: + - how: avc + result: xfail duration: 20m tier: 2 enabled: true From 8b6da4df0e33306be152b66be3618cc6f742b376 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 7 Apr 2026 14:28:49 +0200 Subject: [PATCH 595/626] add psi=1 to the kernel command line For a successful run of the /selinux-policy/systemd-oomd test we need the Pressure Stall Information (PSI) to be available. From now on, the test add the psi=1 parameter to the kernel command line and reboots the machine. The test should pass after a reboot. --- selinux-policy/systemd-oomd/runtest.sh | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/selinux-policy/systemd-oomd/runtest.sh b/selinux-policy/systemd-oomd/runtest.sh index dd3e54f..e7f74e9 100755 --- a/selinux-policy/systemd-oomd/runtest.sh +++ b/selinux-policy/systemd-oomd/runtest.sh @@ -26,6 +26,12 @@ # # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +if ! grep psi=1 /proc/cmdline ; then + grubby --update-kernel ALL --args psi=1 + sync + tmt-reboot +fi + # Include rhts environment . /usr/share/beakerlib/beakerlib.sh || exit 1 From 5e3d738a08460a00399211c537c9a0a68a1a9e67 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Tue, 20 Jan 2026 15:06:01 +0100 Subject: [PATCH 596/626] test if nfs-server-generator can create/control its UDP sockets After introducing the systemd_nfs_generator_t domain, a bug report was filed which revealed that SELinux prevents the nfs-server-generator from creating and controling its UDP sockets. The TC reproduces the situation. In order to support all functions of the nfs-server-generator program, I believe that SELinux policy should allow these actions. The TC looks for appropriate policy rules and file context patterns. The TC covers RHEL-111556. --- selinux-policy/systemd-generators/Makefile | 2 ++ selinux-policy/systemd-generators/main.fmf | 2 ++ selinux-policy/systemd-generators/runtest.sh | 10 ++++++++++ 3 files changed, 14 insertions(+) diff --git a/selinux-policy/systemd-generators/Makefile b/selinux-policy/systemd-generators/Makefile index aab82d9..f2b644f 100644 --- a/selinux-policy/systemd-generators/Makefile +++ b/selinux-policy/systemd-generators/Makefile @@ -56,6 +56,7 @@ $(METADATA): Makefile @echo "RunFor: selinux-policy" >> $(METADATA) @echo "Requires: audit" >> $(METADATA) @echo "Requires: libselinux-utils" >> $(METADATA) + @echo "Requires: nfs-utils" >> $(METADATA) @echo "Requires: policycoreutils" >> $(METADATA) @echo "Requires: selinux-policy" >> $(METADATA) @echo "Requires: selinux-policy-targeted" >> $(METADATA) @@ -78,6 +79,7 @@ $(METADATA): Makefile @echo "Bug: RHEL-98656" >> $(METADATA) # RHEL-10 @echo "Bug: RHEL-100415" >> $(METADATA) # RHEL-10 @echo "Bug: RHEL-100721" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-111556" >> $(METADATA) # RHEL-10 rhts-lint $(METADATA) diff --git a/selinux-policy/systemd-generators/main.fmf b/selinux-policy/systemd-generators/main.fmf index 7b8c9f4..4062447 100644 --- a/selinux-policy/systemd-generators/main.fmf +++ b/selinux-policy/systemd-generators/main.fmf @@ -13,6 +13,7 @@ require: recommend: - audit - libselinux-utils + - nfs-utils - policycoreutils - selinux-policy - selinux-policy-targeted @@ -39,6 +40,7 @@ link: - verifies: https://issues.redhat.com/browse/RHEL-98656 - verifies: https://issues.redhat.com/browse/RHEL-100415 - verifies: https://issues.redhat.com/browse/RHEL-100721 + - verifies: https://issues.redhat.com/browse/RHEL-111556 adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 diff --git a/selinux-policy/systemd-generators/runtest.sh b/selinux-policy/systemd-generators/runtest.sh index d52e632..0deeac8 100755 --- a/selinux-policy/systemd-generators/runtest.sh +++ b/selinux-policy/systemd-generators/runtest.sh @@ -225,6 +225,16 @@ EOF rlPhaseEnd fi + if seinfo -a | grep -q systemd_generator ; then + rlPhaseStartTest "RHEL-111556" + rlSEMatchPathCon "/usr/lib/systemd/system-generators/nfs-server-generator" "systemd_nfs_generator_exec_t" + rlSESearchRule "allow init_t systemd_nfs_generator_exec_t : file { getattr open read map execute } [ ]" + rlSESearchRule "type_transition init_t systemd_nfs_generator_exec_t : process systemd_nfs_generator_t" + rlSESearchRule "allow init_t systemd_nfs_generator_t : process { transition } [ ]" + rlSESearchRule "allow systemd_nfs_generator_t systemd_nfs_generator_t : udp_socket { getattr create setopt connect } [ ]" + rlPhaseEnd + fi + ### generators from other packages: install them all? # dnf install "/usr/lib/systemd/system-generators/*" # cloud-init-generator nfs-server-generator rpc-pipefs-generator selinux-autorelabel-generator.sh zram-generator From 0badb50946d3a0f6e777037f6444efa1c6c3cf13 Mon Sep 17 00:00:00 2001 From: Zdenek Pytela Date: Thu, 12 Mar 2026 18:18:47 +0100 Subject: [PATCH 597/626] systemd-generators test: do not execute test for 2 generators Since systemd v260 [1], support for System V service scripts has been removed. As a part of this change, systemd-rc-local-generator and systemd-sysv-generator were also removed. This commit makes the relevant test parts run only if the generators executables exist. [1] https://github.com/systemd/systemd/releases/tag/v260-rc1 --- selinux-policy/systemd-generators/runtest.sh | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/selinux-policy/systemd-generators/runtest.sh b/selinux-policy/systemd-generators/runtest.sh index 0deeac8..e6a2405 100755 --- a/selinux-policy/systemd-generators/runtest.sh +++ b/selinux-policy/systemd-generators/runtest.sh @@ -165,6 +165,7 @@ rlJournalStart # the generator just creates # /run/systemd/generator/multi-user.target.wants/rc-local.service symlink rlPhaseStartTest "systemd-rc-local-generator" + if [ -x /usr/lib/systemd/system-generators/systemd-rc-local-generator ]; then cat > /etc/rc.d/rc.local << EOF #!/bin/bash echo "This is a script to check rc-local generator." @@ -177,6 +178,7 @@ EOF rlRun "systemctl start rc-local.service" rlRun "systemctl status rc-local.service" rlRun "systemctl stop rc-local.service" + fi rlPhaseEnd ### sysv-generator @@ -184,6 +186,7 @@ EOF # for SysV init[1] scripts in /etc/init.d/* at boot and when configuration # of the system manager is reloaded. rlPhaseStartTest "systemd-sysv-generator" + if [ -x /usr/lib/systemd/system-generators/systemd-sysv-generator ]; then cat > /etc/rc.d/init.d/sysv-generator-test.sh << EOF #!/bin/bash echo "This is a script to check sysv generator." @@ -196,6 +199,7 @@ EOF rlRun "systemctl start sysv-generator-test.service" rlRun "systemctl status sysv-generator-test.service" rlRun "systemctl stop sysv-generator-test.service" + fi rlPhaseEnd if rlIsCentOS 10 || rlIsRHEL 10 ; then From 18274abc2a426a37c2bff003bd4821a7fdf01dd8 Mon Sep 17 00:00:00 2001 From: Veronika Syncakova Date: Wed, 21 Jan 2026 16:25:43 +0100 Subject: [PATCH 598/626] test if systemd-tmpfiles-clean.service triggers an AVC denial --- .../systemd-tmpfiles-and-similar/Makefile | 1 + .../systemd-tmpfiles-and-similar/main.fmf | 1 + .../systemd-tmpfiles-and-similar/runtest.sh | 21 +++++++++++++++++++ 3 files changed, 23 insertions(+) diff --git a/selinux-policy/systemd-tmpfiles-and-similar/Makefile b/selinux-policy/systemd-tmpfiles-and-similar/Makefile index fd16134..e30c908 100644 --- a/selinux-policy/systemd-tmpfiles-and-similar/Makefile +++ b/selinux-policy/systemd-tmpfiles-and-similar/Makefile @@ -64,6 +64,7 @@ $(METADATA): Makefile @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA) @echo "Bug: RHEL-40374" >> $(METADATA) # RHEL-9 @echo "Bug: RHEL-44191" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-139855" >> $(METADATA) # RHEL-10 rhts-lint $(METADATA) diff --git a/selinux-policy/systemd-tmpfiles-and-similar/main.fmf b/selinux-policy/systemd-tmpfiles-and-similar/main.fmf index c72634c..6741bc4 100644 --- a/selinux-policy/systemd-tmpfiles-and-similar/main.fmf +++ b/selinux-policy/systemd-tmpfiles-and-similar/main.fmf @@ -36,6 +36,7 @@ tier: 2 link: - verifies: https://issues.redhat.com/browse/RHEL-40374 - verifies: https://issues.redhat.com/browse/RHEL-44191 + - verifies: https://issues.redhat.com/browse/RHEL-139855 adjust+: - enabled: false when: distro < rhel-9.5 diff --git a/selinux-policy/systemd-tmpfiles-and-similar/runtest.sh b/selinux-policy/systemd-tmpfiles-and-similar/runtest.sh index 6c28056..a4fd928 100755 --- a/selinux-policy/systemd-tmpfiles-and-similar/runtest.sh +++ b/selinux-policy/systemd-tmpfiles-and-similar/runtest.sh @@ -76,6 +76,27 @@ rlJournalStart done rlPhaseEnd + rlPhaseStartTest "RHEL-139855" + SOFT_LIMIT=1000 + HARD_LIMIT=1500 + LIMIT_NOFILE="$(systemctl show --value --property DefaultLimitNOFILE)" + LIMIT_NOFILE_SOFT="$(systemctl show --value --property DefaultLimitNOFILESoft)" + rlAssertNotEquals "DefaultLimitNOFILE is set to: ${LIMIT_NOFILE}" $HARD_LIMIT $LIMIT_NOFILE + rlAssertNotEquals "DefaultLimitNOFILESoft is set to: ${LIMIT_NOFILE_SOFT}" $SOFT_LIMIT $LIMIT_NOFILE_SOFT + rlRun "mkdir /run/systemd/system.conf.d/" + rlRun "cat >/run/systemd/system.conf.d/99-NOFILE.conf < Date: Tue, 11 Nov 2025 10:46:40 +0100 Subject: [PATCH 599/626] test if power-profiles-daemon can watch /sys/firmware/acpi/ One of the reported selinux-policy bugs revealed that SELinux prevents the power-profiles-daemon from watching the /sys/firmware/acpi directory. The TC only reproduces the situation when the right HW is available. In order to support this functionality, I believe that SELinux policy should allow this access. The TC looks for appropriate policy rules and file context patterns. The TC covers RHEL-105423. --- selinux-policy/power-profiles-daemon-and-similar/Makefile | 1 + selinux-policy/power-profiles-daemon-and-similar/main.fmf | 1 + .../power-profiles-daemon-and-similar/runtest.sh | 8 ++++++++ 3 files changed, 10 insertions(+) diff --git a/selinux-policy/power-profiles-daemon-and-similar/Makefile b/selinux-policy/power-profiles-daemon-and-similar/Makefile index e69ab07..430f31e 100644 --- a/selinux-policy/power-profiles-daemon-and-similar/Makefile +++ b/selinux-policy/power-profiles-daemon-and-similar/Makefile @@ -66,6 +66,7 @@ $(METADATA): Makefile @echo "Bug: RHEL-61117" >> $(METADATA) # RHEL-9 @echo "Bug: RHEL-62356" >> $(METADATA) # RHEL-10 @echo "Bug: RHEL-100718" >> $(METADATA) # RHEL-9 + @echo "Bug: RHEL-105423" >> $(METADATA) # RHEL-9 rhts-lint $(METADATA) diff --git a/selinux-policy/power-profiles-daemon-and-similar/main.fmf b/selinux-policy/power-profiles-daemon-and-similar/main.fmf index 219e663..1764e87 100644 --- a/selinux-policy/power-profiles-daemon-and-similar/main.fmf +++ b/selinux-policy/power-profiles-daemon-and-similar/main.fmf @@ -34,6 +34,7 @@ link: - verifies: https://issues.redhat.com/browse/RHEL-61117 - verifies: https://issues.redhat.com/browse/RHEL-62356 - verifies: https://issues.redhat.com/browse/RHEL-100718 + - verifies: https://issues.redhat.com/browse/RHEL-105423 adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, rhel-10, centos-stream-10 diff --git a/selinux-policy/power-profiles-daemon-and-similar/runtest.sh b/selinux-policy/power-profiles-daemon-and-similar/runtest.sh index 1a7b2b1..692df51 100755 --- a/selinux-policy/power-profiles-daemon-and-similar/runtest.sh +++ b/selinux-policy/power-profiles-daemon-and-similar/runtest.sh @@ -86,6 +86,14 @@ rlJournalStart rlPhaseEnd fi + rlPhaseStartTest "RHEL-105423" + if [ -d /sys/firmware/acpi ] ; then + rlRun "ls -dZ /sys/firmware/acpi | grep :sysfs_t" + rlRun "ls -lZ /sys/firmware/acpi" + fi + rlSESearchRule "allow powerprofiles_t sysfs_t : dir { watch } [ ]" + rlPhaseEnd + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then rlPhaseStartTest "real scenario -- standalone service" rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1 From 714022cf54333b46ffe5916c43e3e813c13b4681 Mon Sep 17 00:00:00 2001 From: Jiri Jaburek Date: Mon, 11 May 2026 17:03:01 +0200 Subject: [PATCH 600/626] remove top-level main.fmf typo: tags The fmf metadata keyword is 'tag', so 'tags' did nothing. To avoid changing the behavior (adding a 'generic' tag to all tests), I simply removed the keyword. Signed-off-by: Jiri Jaburek --- main.fmf | 2 -- 1 file changed, 2 deletions(-) diff --git a/main.fmf b/main.fmf index 94ef62f..0af284f 100644 --- a/main.fmf +++ b/main.fmf @@ -6,8 +6,6 @@ framework: beakerlib #contact: Petr Lautrbach #requires: [policycoreutils, libselinux-utils] -tags: [generic] - /checkpolicy: component: checkpolicy From f9bd3e27eaee41bf7999a55f4b16cb64564254e8 Mon Sep 17 00:00:00 2001 From: Jiri Jaburek Date: Mon, 11 May 2026 17:04:54 +0200 Subject: [PATCH 601/626] avoid inheriting top-level main.fmf metadata into plans This fixes nearly all tmt lint errors, since plans cannot have 'test:' and other test-related keywords. Signed-off-by: Jiri Jaburek --- plans/main.fmf | 3 +++ 1 file changed, 3 insertions(+) create mode 100644 plans/main.fmf diff --git a/plans/main.fmf b/plans/main.fmf new file mode 100644 index 0000000..9459ca0 --- /dev/null +++ b/plans/main.fmf @@ -0,0 +1,3 @@ +# do not inherit test-specific metadata from toplevel +/: + inherit: false From 45f0c8b29553245b62ccd9af25a975e4850cb9bf Mon Sep 17 00:00:00 2001 From: Jiri Jaburek Date: Mon, 11 May 2026 17:10:30 +0200 Subject: [PATCH 602/626] fix recommends/requires typos, remove empty link This fixes additional tmt lint issues. Signed-off-by: Jiri Jaburek --- libselinux/getpolicyload/main.fmf | 2 +- libsemanage/semanage-root-on-nfs/main.fmf | 2 +- selinux-policy/install-uninstall-dsp-packages/main.fmf | 1 - 3 files changed, 2 insertions(+), 3 deletions(-) diff --git a/libselinux/getpolicyload/main.fmf b/libselinux/getpolicyload/main.fmf index 5ac18eb..0c19ee2 100644 --- a/libselinux/getpolicyload/main.fmf +++ b/libselinux/getpolicyload/main.fmf @@ -3,7 +3,7 @@ test: ./runtest.sh framework: beakerlib component: - libselinux -recommends: +recommend: - libselinux - libselinux-utils - policycoreutils diff --git a/libsemanage/semanage-root-on-nfs/main.fmf b/libsemanage/semanage-root-on-nfs/main.fmf index e4bf5a7..e115bf3 100644 --- a/libsemanage/semanage-root-on-nfs/main.fmf +++ b/libsemanage/semanage-root-on-nfs/main.fmf @@ -2,7 +2,7 @@ summary: Test semanage operation with /var/lib/selinux on NFS test: ./test.sh framework: beakerlib component: libsemanage -requires: +require: - nfs-utils - policycoreutils-python-utils duration: 10m diff --git a/selinux-policy/install-uninstall-dsp-packages/main.fmf b/selinux-policy/install-uninstall-dsp-packages/main.fmf index 060b7f7..22e7e61 100644 --- a/selinux-policy/install-uninstall-dsp-packages/main.fmf +++ b/selinux-policy/install-uninstall-dsp-packages/main.fmf @@ -31,7 +31,6 @@ tag: - rhel9_broken - rhel10_broken - avoidImageMode -link: adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 From 8e93cd9553955a3a48663854ec2b24cfba14196e Mon Sep 17 00:00:00 2001 From: jan janasek Date: Tue, 12 May 2026 08:59:38 +0200 Subject: [PATCH 603/626] fix: replace rlCheckMakefileRequires with rlCheckDependencies Signed-off-by: jjanasek --- libsemanage/sanity-tests/runtest.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libsemanage/sanity-tests/runtest.sh b/libsemanage/sanity-tests/runtest.sh index ba1931e..b615086 100755 --- a/libsemanage/sanity-tests/runtest.sh +++ b/libsemanage/sanity-tests/runtest.sh @@ -34,7 +34,7 @@ rlJournalStart rlPhaseStartSetup rlRun "rlImport --all" || rlDie - rlRun "rlCheckMakefileRequires" || rlDie + rlRun "rlCheckDependencies" || rlDie VERS=$(rpm -q $PACKAGE | cut -f 2 -d '-') VERS_MAJOR=$(echo $VERS | cut -f 1 -d '.') From affc7c2cfc4faabc2d1e868f7aedaf79f7f31d26 Mon Sep 17 00:00:00 2001 From: Jiri Jaburek Date: Tue, 12 May 2026 13:09:29 +0200 Subject: [PATCH 604/626] use epel/epel instead of distribution/epel library The README on https://github.com/beakerlib/distribution/tree/master/epel states that This is a compatibility layer to overcome a transitional phase from distribution/epel to epel/epel. So use epel/epel instead. Signed-off-by: Jiri Jaburek --- kernel/synflood/main.fmf | 2 +- kernel/synflood/runtest.sh | 2 +- selinux-policy/Library/common/Makefile | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/kernel/synflood/main.fmf b/kernel/synflood/main.fmf index 76a24ee..23b49cb 100644 --- a/kernel/synflood/main.fmf +++ b/kernel/synflood/main.fmf @@ -8,7 +8,7 @@ component: - kernel framework: beakerlib require: -- library(distribution/epel) +- library(epel/epel) - /usr/bin/nc - perf - git diff --git a/kernel/synflood/runtest.sh b/kernel/synflood/runtest.sh index 7a4327c..8e33ceb 100755 --- a/kernel/synflood/runtest.sh +++ b/kernel/synflood/runtest.sh @@ -29,7 +29,7 @@ if [ $(nproc) -lt 64 ]; then rlPhaseEnd else rlPhaseStartSetup - rlImport "distribution/epel" + rlImport "epel/epel" rlRun "command -v hping3 || epelyum install -y hping3" 0 \ "Make sure hping3 is installed (EPEL-only on RHEL)" diff --git a/selinux-policy/Library/common/Makefile b/selinux-policy/Library/common/Makefile index b274700..eecb818 100644 --- a/selinux-policy/Library/common/Makefile +++ b/selinux-policy/Library/common/Makefile @@ -55,7 +55,7 @@ $(METADATA): Makefile @echo "Requires: yum-utils" >> $(METADATA) @echo "Requires: python3 sqlite" >> $(METADATA) @echo "Provides: library(selinux-policy/common)" >> $(METADATA) - @echo "RhtsRequires: library(distribution/epel)" >> $(METADATA) + @echo "RhtsRequires: library(epel/epel)" >> $(METADATA) @echo "License: GPLv2" >> $(METADATA) @echo "Destructive: no" >> $(METADATA) @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA) From c8430211e00df25e3ca8b8eea64234882e8a1439 Mon Sep 17 00:00:00 2001 From: Jiri Jaburek Date: Tue, 12 May 2026 16:28:27 +0200 Subject: [PATCH 605/626] make tests use the selinux-policy library directly The original library(foo/bar) syntax was used via RPM Provides on old RHTS / Beaker infra, and tmt translates it to fetching libraries from https://github.com/beakerlib/, ie. https://github.com/beakerlib/selinux-policy This location then contains a wrapper redirect back to this repo with tests. Let's avoid the external Github round-trip and just link to the library directly via local references. Also change the epel library link to the modern syntax. Signed-off-by: Jiri Jaburek --- kernel/avc_log_actual_context_if_invalid/main.fmf | 4 +++- kernel/synflood/main.fmf | 4 +++- libselinux/validatetrans/main.fmf | 4 +++- selinux-policy/Library/common/main.fmf | 15 +++++++++++++++ selinux-policy/ModemManager-and-similar/main.fmf | 4 +++- selinux-policy/abrt-services/main.fmf | 4 +++- .../accounts-daemon-and-similar/main.fmf | 4 +++- selinux-policy/acpid-and-similar/main.fmf | 4 +++- selinux-policy/anon_inode-and-similar/main.fmf | 4 +++- selinux-policy/bgpd-and-similar/main.fmf | 4 +++- selinux-policy/blueman-and-similar/main.fmf | 4 +++- selinux-policy/boinc-and-similar/main.fmf | 4 +++- selinux-policy/boltd-and-similar/main.fmf | 4 +++- selinux-policy/boothd-and-similar/main.fmf | 4 +++- selinux-policy/bootupd-and-similar/main.fmf | 4 +++- selinux-policy/bz481628-send-msg-to-dbus/main.fmf | 4 +++- .../main.fmf | 4 +++- .../main.fmf | 4 +++- .../main.fmf | 4 +++- selinux-policy/bz624405-pcsc-and-similar/main.fmf | 4 +++- .../bz733494-amanda-and-similar/main.fmf | 4 +++- selinux-policy/caddy-and-similar/main.fmf | 4 +++- selinux-policy/capability2-class/main.fmf | 4 +++- selinux-policy/chronyd-and-similar/main.fmf | 4 +++- selinux-policy/cockpit-ws-and-similar/main.fmf | 4 +++- selinux-policy/colord-and-similar/main.fmf | 4 +++- selinux-policy/coreutils-single/main.fmf | 4 +++- selinux-policy/cups-browsed-and-similar/main.fmf | 4 +++- selinux-policy/cups-lpd-and-similar/main.fmf | 4 +++- selinux-policy/cups-pdf-and-similar/main.fmf | 4 +++- selinux-policy/dhclient-and-similar/main.fmf | 4 +++- selinux-policy/dhcpcd-and-similar/main.fmf | 4 +++- selinux-policy/dmidecode-and-similar/main.fmf | 4 +++- selinux-policy/exim-and-similar/main.fmf | 4 +++- selinux-policy/fapolicyd-and-similar/main.fmf | 4 +++- .../fedora-third-party-and-similar/main.fmf | 4 +++- selinux-policy/firewalld-and-similar/main.fmf | 4 +++- selinux-policy/fwupd-and-similar/main.fmf | 4 +++- selinux-policy/getrlimit-permission/main.fmf | 4 +++- .../gnome-remote-desktop-and-similar/main.fmf | 4 +++- selinux-policy/hostapd-and-similar/main.fmf | 4 +++- selinux-policy/icecast-and-similar/main.fmf | 4 +++- .../iio-sensor-proxy-and-similar/main.fmf | 4 +++- .../install-uninstall-dsp-packages/main.fmf | 4 +++- selinux-policy/journalctl-and-similar/main.fmf | 4 +++- selinux-policy/kerberos-and-similar/main.fmf | 4 +++- selinux-policy/kernel-confined-exec/main.fmf | 4 +++- selinux-policy/ksm-and-similar/main.fmf | 4 +++- selinux-policy/ladvd/main.fmf | 4 +++- selinux-policy/libvirt-dbus-and-similar/main.fmf | 4 +++- selinux-policy/logwatch-and-similar/main.fmf | 4 +++- selinux-policy/nasd-and-similar/main.fmf | 4 +++- selinux-policy/nfsdcld-and-similar/main.fmf | 4 +++- selinux-policy/ntpsec-and-similar/main.fmf | 4 +++- selinux-policy/numad-and-similar/main.fmf | 4 +++- selinux-policy/nvme-stas-and-similar/main.fmf | 4 +++- selinux-policy/opensmtpd-and-similar/main.fmf | 4 +++- selinux-policy/pam_console-and-related/main.fmf | 4 +++- selinux-policy/pam_limits-and-related/main.fmf | 4 +++- selinux-policy/pam_timestamp-and-related/main.fmf | 4 +++- .../pcm-sensor-server-and-similar/main.fmf | 4 +++- selinux-policy/pcp-daemons-and-similar/main.fmf | 4 +++- selinux-policy/perf_event-and-related/main.fmf | 4 +++- selinux-policy/ping-and-similar/main.fmf | 4 +++- selinux-policy/policykit-general/main.fmf | 4 +++- .../power-profiles-daemon-and-similar/main.fmf | 4 +++- selinux-policy/rngd-and-similar/main.fmf | 4 +++- selinux-policy/rpc.idmapd-and-similar/main.fmf | 4 +++- selinux-policy/rpm-cant-read-rpmmacros/main.fmf | 4 +++- selinux-policy/rpmdb-and-similar/main.fmf | 4 +++- .../rrdcached-service-and-related/main.fmf | 4 +++- selinux-policy/rsyslog-and-similar/main.fmf | 4 +++- selinux-policy/rtkit-daemon-and-similar/main.fmf | 4 +++- selinux-policy/samba-bgqd-and-similar/main.fmf | 4 +++- selinux-policy/smbcontrol-and-similar/main.fmf | 4 +++- selinux-policy/snapd-and-similar/main.fmf | 4 +++- selinux-policy/sslh-and-similar/main.fmf | 4 +++- selinux-policy/stalld-and-similar/main.fmf | 4 +++- selinux-policy/sudo-and-dnf/main.fmf | 4 +++- selinux-policy/sulogin-and-similar/main.fmf | 4 +++- .../swap-file-and-systemd-access/main.fmf | 4 +++- .../switcheroo-control-and-similar/main.fmf | 4 +++- selinux-policy/synce4l-and-similar/main.fmf | 4 +++- .../systemd-bootchart-and-similar/main.fmf | 4 +++- selinux-policy/systemd-creds/main.fmf | 4 +++- selinux-policy/systemd-generators/main.fmf | 4 +++- selinux-policy/systemd-homed/main.fmf | 4 +++- .../systemd-importd-and-similar/main.fmf | 4 +++- selinux-policy/systemd-journal-upload/main.fmf | 4 +++- selinux-policy/systemd-localed/main.fmf | 4 +++- .../systemd-machined-and-similar/main.fmf | 4 +++- .../systemd-modules-load-and-similar/main.fmf | 4 +++- .../systemd-mountfsd-and-similar/main.fmf | 4 +++- .../systemd-notify-and-similar/main.fmf | 4 +++- .../systemd-nsresourced-and-similar/main.fmf | 4 +++- selinux-policy/systemd-oomd/main.fmf | 4 +++- .../systemd-rfkill-and-similar/main.fmf | 4 +++- selinux-policy/systemd-run-and-similar/main.fmf | 4 +++- .../systemd-sysctl-and-similar/main.fmf | 4 +++- .../systemd-timesyncd-and-similar/main.fmf | 4 +++- .../systemd-tmpfiles-and-similar/main.fmf | 4 +++- .../systemd-userdbd-and-similar/main.fmf | 4 +++- selinux-policy/targetd-and-similar/main.fmf | 4 +++- selinux-policy/thttpd-and-similar/main.fmf | 4 +++- selinux-policy/tlp-and-similar/main.fmf | 4 +++- selinux-policy/tlshd-and-similar/main.fmf | 4 +++- selinux-policy/tuned-ppd-and-similar/main.fmf | 4 +++- .../usbguard-daemon-and-similar/main.fmf | 4 +++- selinux-policy/usbmuxd-and-similar/main.fmf | 4 +++- selinux-policy/valkey-and-similar/main.fmf | 4 +++- selinux-policy/virt-install-additional/main.fmf | 4 +++- selinux-policy/virtualization-daemons/main.fmf | 4 +++- selinux-policy/watch-permissions/main.fmf | 4 +++- setools/apol/main.fmf | 4 +++- 114 files changed, 354 insertions(+), 113 deletions(-) create mode 100644 selinux-policy/Library/common/main.fmf diff --git a/kernel/avc_log_actual_context_if_invalid/main.fmf b/kernel/avc_log_actual_context_if_invalid/main.fmf index 7826746..222785b 100644 --- a/kernel/avc_log_actual_context_if_invalid/main.fmf +++ b/kernel/avc_log_actual_context_if_invalid/main.fmf @@ -7,7 +7,9 @@ component: - kernel framework: beakerlib require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy - attr - audit - libselinux-utils diff --git a/kernel/synflood/main.fmf b/kernel/synflood/main.fmf index 23b49cb..a0304ef 100644 --- a/kernel/synflood/main.fmf +++ b/kernel/synflood/main.fmf @@ -8,7 +8,9 @@ component: - kernel framework: beakerlib require: -- library(epel/epel) +- type: library + url: https://github.com/beakerlib/epel.git + name: /epel - /usr/bin/nc - perf - git diff --git a/libselinux/validatetrans/main.fmf b/libselinux/validatetrans/main.fmf index b8eef52..08b1b92 100644 --- a/libselinux/validatetrans/main.fmf +++ b/libselinux/validatetrans/main.fmf @@ -6,7 +6,9 @@ contact: Milos Malik component: - libselinux require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/Library/common/main.fmf b/selinux-policy/Library/common/main.fmf new file mode 100644 index 0000000..e7dfd5f --- /dev/null +++ b/selinux-policy/Library/common/main.fmf @@ -0,0 +1,15 @@ +summary: selinux-policy Beakerlib library +require: +- type: library + url: https://github.com/beakerlib/epel.git + name: /epel +recommend: +- audit +- setools-console +- expect +- policycoreutils +- /usr/sbin/semanage +- selinux-policy-devel +- yum-utils +- python3 +- sqlite diff --git a/selinux-policy/ModemManager-and-similar/main.fmf b/selinux-policy/ModemManager-and-similar/main.fmf index aa1d8b5..3157e2f 100644 --- a/selinux-policy/ModemManager-and-similar/main.fmf +++ b/selinux-policy/ModemManager-and-similar/main.fmf @@ -8,7 +8,9 @@ component: test: ./runtest.sh framework: beakerlib require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/abrt-services/main.fmf b/selinux-policy/abrt-services/main.fmf index 31a4a38..d58ecaf 100644 --- a/selinux-policy/abrt-services/main.fmf +++ b/selinux-policy/abrt-services/main.fmf @@ -7,7 +7,9 @@ component: - abrt - selinux-policy require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/accounts-daemon-and-similar/main.fmf b/selinux-policy/accounts-daemon-and-similar/main.fmf index b698587..0a9bd58 100644 --- a/selinux-policy/accounts-daemon-and-similar/main.fmf +++ b/selinux-policy/accounts-daemon-and-similar/main.fmf @@ -8,7 +8,9 @@ component: test: ./runtest.sh framework: beakerlib require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/acpid-and-similar/main.fmf b/selinux-policy/acpid-and-similar/main.fmf index a5227cd..21a6880 100644 --- a/selinux-policy/acpid-and-similar/main.fmf +++ b/selinux-policy/acpid-and-similar/main.fmf @@ -7,7 +7,9 @@ component: - selinux-policy - acpid require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/anon_inode-and-similar/main.fmf b/selinux-policy/anon_inode-and-similar/main.fmf index 7434a87..47dbdcf 100644 --- a/selinux-policy/anon_inode-and-similar/main.fmf +++ b/selinux-policy/anon_inode-and-similar/main.fmf @@ -5,7 +5,9 @@ contact: Milos Malik component: - selinux-policy require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - libselinux - policycoreutils diff --git a/selinux-policy/bgpd-and-similar/main.fmf b/selinux-policy/bgpd-and-similar/main.fmf index 4d5fb79..7524230 100644 --- a/selinux-policy/bgpd-and-similar/main.fmf +++ b/selinux-policy/bgpd-and-similar/main.fmf @@ -6,7 +6,9 @@ contact: Milos Malik component: - selinux-policy require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/blueman-and-similar/main.fmf b/selinux-policy/blueman-and-similar/main.fmf index ff6b625..11d9759 100644 --- a/selinux-policy/blueman-and-similar/main.fmf +++ b/selinux-policy/blueman-and-similar/main.fmf @@ -6,7 +6,9 @@ contact: Milos Malik component: - selinux-policy require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/boinc-and-similar/main.fmf b/selinux-policy/boinc-and-similar/main.fmf index 10b15e3..5c18c33 100644 --- a/selinux-policy/boinc-and-similar/main.fmf +++ b/selinux-policy/boinc-and-similar/main.fmf @@ -8,7 +8,9 @@ component: test: ./runtest.sh framework: beakerlib require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/boltd-and-similar/main.fmf b/selinux-policy/boltd-and-similar/main.fmf index 3bf9dca..9cb811e 100644 --- a/selinux-policy/boltd-and-similar/main.fmf +++ b/selinux-policy/boltd-and-similar/main.fmf @@ -6,7 +6,9 @@ contact: Milos Malik component: - selinux-policy require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - /usr/sbin/service diff --git a/selinux-policy/boothd-and-similar/main.fmf b/selinux-policy/boothd-and-similar/main.fmf index 658048a..45244b4 100644 --- a/selinux-policy/boothd-and-similar/main.fmf +++ b/selinux-policy/boothd-and-similar/main.fmf @@ -6,7 +6,9 @@ contact: Milos Malik component: - selinux-policy require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/bootupd-and-similar/main.fmf b/selinux-policy/bootupd-and-similar/main.fmf index caaeb12..6f814d7 100644 --- a/selinux-policy/bootupd-and-similar/main.fmf +++ b/selinux-policy/bootupd-and-similar/main.fmf @@ -6,7 +6,9 @@ contact: Milos Malik component: - selinux-policy require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/bz481628-send-msg-to-dbus/main.fmf b/selinux-policy/bz481628-send-msg-to-dbus/main.fmf index bd4a4a3..d2dae9e 100644 --- a/selinux-policy/bz481628-send-msg-to-dbus/main.fmf +++ b/selinux-policy/bz481628-send-msg-to-dbus/main.fmf @@ -7,7 +7,9 @@ component: - dbus - selinux-policy require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/bz533007-unable-to-start-kdump-service/main.fmf b/selinux-policy/bz533007-unable-to-start-kdump-service/main.fmf index 6b03c5c..9104410 100644 --- a/selinux-policy/bz533007-unable-to-start-kdump-service/main.fmf +++ b/selinux-policy/bz533007-unable-to-start-kdump-service/main.fmf @@ -8,7 +8,9 @@ component: test: ./runtest.sh framework: beakerlib require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - expect diff --git a/selinux-policy/bz538089-plymouth-operations-denied-during-boot/main.fmf b/selinux-policy/bz538089-plymouth-operations-denied-during-boot/main.fmf index cb47c57..6ce929e 100644 --- a/selinux-policy/bz538089-plymouth-operations-denied-during-boot/main.fmf +++ b/selinux-policy/bz538089-plymouth-operations-denied-during-boot/main.fmf @@ -8,7 +8,9 @@ component: test: ./runtest.sh framework: beakerlib require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - /usr/sbin/service diff --git a/selinux-policy/bz562833-chrooted-named-file-contexts/main.fmf b/selinux-policy/bz562833-chrooted-named-file-contexts/main.fmf index 21eb7c2..3228e5d 100644 --- a/selinux-policy/bz562833-chrooted-named-file-contexts/main.fmf +++ b/selinux-policy/bz562833-chrooted-named-file-contexts/main.fmf @@ -8,7 +8,9 @@ component: test: ./runtest.sh framework: beakerlib require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - bind diff --git a/selinux-policy/bz624405-pcsc-and-similar/main.fmf b/selinux-policy/bz624405-pcsc-and-similar/main.fmf index a02ba20..eccec8d 100644 --- a/selinux-policy/bz624405-pcsc-and-similar/main.fmf +++ b/selinux-policy/bz624405-pcsc-and-similar/main.fmf @@ -7,7 +7,9 @@ component: - pcsc-lite - selinux-policy require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - expect diff --git a/selinux-policy/bz733494-amanda-and-similar/main.fmf b/selinux-policy/bz733494-amanda-and-similar/main.fmf index 585ba2e..fe87add 100644 --- a/selinux-policy/bz733494-amanda-and-similar/main.fmf +++ b/selinux-policy/bz733494-amanda-and-similar/main.fmf @@ -7,7 +7,9 @@ component: - amanda - selinux-policy require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - amanda - amanda-client diff --git a/selinux-policy/caddy-and-similar/main.fmf b/selinux-policy/caddy-and-similar/main.fmf index 29d7066..b6fe343 100644 --- a/selinux-policy/caddy-and-similar/main.fmf +++ b/selinux-policy/caddy-and-similar/main.fmf @@ -6,7 +6,9 @@ contact: Milos Malik component: - selinux-policy require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/capability2-class/main.fmf b/selinux-policy/capability2-class/main.fmf index b26898a..a53e8a0 100644 --- a/selinux-policy/capability2-class/main.fmf +++ b/selinux-policy/capability2-class/main.fmf @@ -5,7 +5,9 @@ framework: beakerlib component: - selinux-policy require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - git diff --git a/selinux-policy/chronyd-and-similar/main.fmf b/selinux-policy/chronyd-and-similar/main.fmf index 4262523..3aee74a 100644 --- a/selinux-policy/chronyd-and-similar/main.fmf +++ b/selinux-policy/chronyd-and-similar/main.fmf @@ -9,7 +9,9 @@ component: test: ./runtest.sh framework: beakerlib require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/cockpit-ws-and-similar/main.fmf b/selinux-policy/cockpit-ws-and-similar/main.fmf index 58c3e1a..a386b3a 100644 --- a/selinux-policy/cockpit-ws-and-similar/main.fmf +++ b/selinux-policy/cockpit-ws-and-similar/main.fmf @@ -6,7 +6,9 @@ contact: Milos Malik component: - selinux-policy require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/colord-and-similar/main.fmf b/selinux-policy/colord-and-similar/main.fmf index 9fe6b74..d3bca10 100644 --- a/selinux-policy/colord-and-similar/main.fmf +++ b/selinux-policy/colord-and-similar/main.fmf @@ -6,7 +6,9 @@ contact: Milos Malik component: - selinux-policy require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/coreutils-single/main.fmf b/selinux-policy/coreutils-single/main.fmf index 26e8e7e..76b94bd 100644 --- a/selinux-policy/coreutils-single/main.fmf +++ b/selinux-policy/coreutils-single/main.fmf @@ -8,7 +8,9 @@ framework: beakerlib component: - selinux-policy require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/cups-browsed-and-similar/main.fmf b/selinux-policy/cups-browsed-and-similar/main.fmf index 58f1e9a..9c91bf0 100644 --- a/selinux-policy/cups-browsed-and-similar/main.fmf +++ b/selinux-policy/cups-browsed-and-similar/main.fmf @@ -7,7 +7,9 @@ component: - cups - selinux-policy require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/cups-lpd-and-similar/main.fmf b/selinux-policy/cups-lpd-and-similar/main.fmf index 312617e..5bdcf1c 100644 --- a/selinux-policy/cups-lpd-and-similar/main.fmf +++ b/selinux-policy/cups-lpd-and-similar/main.fmf @@ -7,7 +7,9 @@ component: - cups - selinux-policy require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - expect diff --git a/selinux-policy/cups-pdf-and-similar/main.fmf b/selinux-policy/cups-pdf-and-similar/main.fmf index e0c7321..259cede 100644 --- a/selinux-policy/cups-pdf-and-similar/main.fmf +++ b/selinux-policy/cups-pdf-and-similar/main.fmf @@ -6,7 +6,9 @@ contact: Milos Malik component: - selinux-policy require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/dhclient-and-similar/main.fmf b/selinux-policy/dhclient-and-similar/main.fmf index 0b4d92d..909d0a7 100644 --- a/selinux-policy/dhclient-and-similar/main.fmf +++ b/selinux-policy/dhclient-and-similar/main.fmf @@ -6,7 +6,9 @@ contact: Milos Malik component: - selinux-policy require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/dhcpcd-and-similar/main.fmf b/selinux-policy/dhcpcd-and-similar/main.fmf index d9f21eb..1f828c1 100644 --- a/selinux-policy/dhcpcd-and-similar/main.fmf +++ b/selinux-policy/dhcpcd-and-similar/main.fmf @@ -6,7 +6,9 @@ contact: Milos Malik component: - selinux-policy require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/dmidecode-and-similar/main.fmf b/selinux-policy/dmidecode-and-similar/main.fmf index c8f26f2..2a1b60d 100644 --- a/selinux-policy/dmidecode-and-similar/main.fmf +++ b/selinux-policy/dmidecode-and-similar/main.fmf @@ -7,7 +7,9 @@ component: - selinux-policy - dmidecode require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/exim-and-similar/main.fmf b/selinux-policy/exim-and-similar/main.fmf index 7497f6d..de59c51 100644 --- a/selinux-policy/exim-and-similar/main.fmf +++ b/selinux-policy/exim-and-similar/main.fmf @@ -8,7 +8,9 @@ component: test: ./runtest.sh framework: beakerlib require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/fapolicyd-and-similar/main.fmf b/selinux-policy/fapolicyd-and-similar/main.fmf index f14bcde..e4e8de2 100644 --- a/selinux-policy/fapolicyd-and-similar/main.fmf +++ b/selinux-policy/fapolicyd-and-similar/main.fmf @@ -7,7 +7,9 @@ component: - fapolicyd - selinux-policy require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - /usr/sbin/service diff --git a/selinux-policy/fedora-third-party-and-similar/main.fmf b/selinux-policy/fedora-third-party-and-similar/main.fmf index 3e07be9..e1a16d5 100644 --- a/selinux-policy/fedora-third-party-and-similar/main.fmf +++ b/selinux-policy/fedora-third-party-and-similar/main.fmf @@ -8,7 +8,9 @@ component: test: ./runtest.sh framework: beakerlib require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/firewalld-and-similar/main.fmf b/selinux-policy/firewalld-and-similar/main.fmf index 0412fab..ec559bc 100644 --- a/selinux-policy/firewalld-and-similar/main.fmf +++ b/selinux-policy/firewalld-and-similar/main.fmf @@ -7,7 +7,9 @@ component: - selinux-policy - firewalld require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/fwupd-and-similar/main.fmf b/selinux-policy/fwupd-and-similar/main.fmf index f3172f0..237d4da 100644 --- a/selinux-policy/fwupd-and-similar/main.fmf +++ b/selinux-policy/fwupd-and-similar/main.fmf @@ -7,7 +7,9 @@ contact: Milos Malik component: - selinux-policy require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/getrlimit-permission/main.fmf b/selinux-policy/getrlimit-permission/main.fmf index 266586d..6c545f7 100644 --- a/selinux-policy/getrlimit-permission/main.fmf +++ b/selinux-policy/getrlimit-permission/main.fmf @@ -6,7 +6,9 @@ contact: Milos Malik component: - selinux-policy require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/gnome-remote-desktop-and-similar/main.fmf b/selinux-policy/gnome-remote-desktop-and-similar/main.fmf index 33cd021..362abd7 100644 --- a/selinux-policy/gnome-remote-desktop-and-similar/main.fmf +++ b/selinux-policy/gnome-remote-desktop-and-similar/main.fmf @@ -9,7 +9,9 @@ component: test: ./runtest.sh framework: beakerlib require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/hostapd-and-similar/main.fmf b/selinux-policy/hostapd-and-similar/main.fmf index ee86af2..a99ac23 100644 --- a/selinux-policy/hostapd-and-similar/main.fmf +++ b/selinux-policy/hostapd-and-similar/main.fmf @@ -7,7 +7,9 @@ component: - hostapd - selinux-policy require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/icecast-and-similar/main.fmf b/selinux-policy/icecast-and-similar/main.fmf index 19b7b42..5a60241 100644 --- a/selinux-policy/icecast-and-similar/main.fmf +++ b/selinux-policy/icecast-and-similar/main.fmf @@ -8,7 +8,9 @@ component: test: ./runtest.sh framework: beakerlib require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/iio-sensor-proxy-and-similar/main.fmf b/selinux-policy/iio-sensor-proxy-and-similar/main.fmf index 5d6fd94..691dbb8 100644 --- a/selinux-policy/iio-sensor-proxy-and-similar/main.fmf +++ b/selinux-policy/iio-sensor-proxy-and-similar/main.fmf @@ -7,7 +7,9 @@ component: - iio-sensor-proxy - selinux-policy require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/install-uninstall-dsp-packages/main.fmf b/selinux-policy/install-uninstall-dsp-packages/main.fmf index 22e7e61..cd594e9 100644 --- a/selinux-policy/install-uninstall-dsp-packages/main.fmf +++ b/selinux-policy/install-uninstall-dsp-packages/main.fmf @@ -9,7 +9,9 @@ component: test: ./runtest.sh framework: beakerlib require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - selinux-policy - selinux-policy-targeted diff --git a/selinux-policy/journalctl-and-similar/main.fmf b/selinux-policy/journalctl-and-similar/main.fmf index a2a3259..0205049 100644 --- a/selinux-policy/journalctl-and-similar/main.fmf +++ b/selinux-policy/journalctl-and-similar/main.fmf @@ -7,7 +7,9 @@ component: - selinux-policy - systemd require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/kerberos-and-similar/main.fmf b/selinux-policy/kerberos-and-similar/main.fmf index 7ad2246..a06bb2f 100644 --- a/selinux-policy/kerberos-and-similar/main.fmf +++ b/selinux-policy/kerberos-and-similar/main.fmf @@ -7,7 +7,9 @@ component: - selinux-policy - krb5 require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - selinux-policy diff --git a/selinux-policy/kernel-confined-exec/main.fmf b/selinux-policy/kernel-confined-exec/main.fmf index 2a4a76e..3d1594f 100644 --- a/selinux-policy/kernel-confined-exec/main.fmf +++ b/selinux-policy/kernel-confined-exec/main.fmf @@ -9,7 +9,9 @@ component: - selinux-policy framework: beakerlib require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy - policycoreutils - gcc environment: diff --git a/selinux-policy/ksm-and-similar/main.fmf b/selinux-policy/ksm-and-similar/main.fmf index d5d42e7..03a19db 100644 --- a/selinux-policy/ksm-and-similar/main.fmf +++ b/selinux-policy/ksm-and-similar/main.fmf @@ -6,7 +6,9 @@ contact: Milos Malik component: - selinux-policy require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/ladvd/main.fmf b/selinux-policy/ladvd/main.fmf index 7a0b05c..4bba87f 100644 --- a/selinux-policy/ladvd/main.fmf +++ b/selinux-policy/ladvd/main.fmf @@ -6,7 +6,9 @@ contact: Amith Kumar component: - selinux-policy require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - initscripts diff --git a/selinux-policy/libvirt-dbus-and-similar/main.fmf b/selinux-policy/libvirt-dbus-and-similar/main.fmf index 38c2d06..0b16766 100644 --- a/selinux-policy/libvirt-dbus-and-similar/main.fmf +++ b/selinux-policy/libvirt-dbus-and-similar/main.fmf @@ -6,7 +6,9 @@ contact: Milos Malik component: - selinux-policy require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/logwatch-and-similar/main.fmf b/selinux-policy/logwatch-and-similar/main.fmf index d4d765a..e2ba6c5 100644 --- a/selinux-policy/logwatch-and-similar/main.fmf +++ b/selinux-policy/logwatch-and-similar/main.fmf @@ -6,7 +6,9 @@ contact: Milos Malik component: - selinux-policy require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/nasd-and-similar/main.fmf b/selinux-policy/nasd-and-similar/main.fmf index 40e2ecd..7ba0e30 100644 --- a/selinux-policy/nasd-and-similar/main.fmf +++ b/selinux-policy/nasd-and-similar/main.fmf @@ -6,7 +6,9 @@ contact: Milos Malik component: - nas require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/nfsdcld-and-similar/main.fmf b/selinux-policy/nfsdcld-and-similar/main.fmf index d3cbb6e..c371bdb 100644 --- a/selinux-policy/nfsdcld-and-similar/main.fmf +++ b/selinux-policy/nfsdcld-and-similar/main.fmf @@ -6,7 +6,9 @@ contact: Milos Malik component: - selinux-policy require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - /usr/sbin/service diff --git a/selinux-policy/ntpsec-and-similar/main.fmf b/selinux-policy/ntpsec-and-similar/main.fmf index 98ad9c9..8fe3341 100644 --- a/selinux-policy/ntpsec-and-similar/main.fmf +++ b/selinux-policy/ntpsec-and-similar/main.fmf @@ -6,7 +6,9 @@ contact: Milos Malik component: - selinux-policy require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/numad-and-similar/main.fmf b/selinux-policy/numad-and-similar/main.fmf index 5519321..8a0faa1 100644 --- a/selinux-policy/numad-and-similar/main.fmf +++ b/selinux-policy/numad-and-similar/main.fmf @@ -6,7 +6,9 @@ contact: Milos Malik component: - selinux-policy require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - expect diff --git a/selinux-policy/nvme-stas-and-similar/main.fmf b/selinux-policy/nvme-stas-and-similar/main.fmf index 4b7637b..277ee8e 100644 --- a/selinux-policy/nvme-stas-and-similar/main.fmf +++ b/selinux-policy/nvme-stas-and-similar/main.fmf @@ -7,7 +7,9 @@ component: - nvme-stas - selinux-policy require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - avahi - audit diff --git a/selinux-policy/opensmtpd-and-similar/main.fmf b/selinux-policy/opensmtpd-and-similar/main.fmf index b87c25f..ba8c289 100644 --- a/selinux-policy/opensmtpd-and-similar/main.fmf +++ b/selinux-policy/opensmtpd-and-similar/main.fmf @@ -6,7 +6,9 @@ contact: Milos Malik component: - selinux-policy require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/pam_console-and-related/main.fmf b/selinux-policy/pam_console-and-related/main.fmf index 61daebc..986021c 100644 --- a/selinux-policy/pam_console-and-related/main.fmf +++ b/selinux-policy/pam_console-and-related/main.fmf @@ -12,7 +12,9 @@ component: - pam - selinux-policy require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/pam_limits-and-related/main.fmf b/selinux-policy/pam_limits-and-related/main.fmf index e0aa4f4..cce5bcb 100644 --- a/selinux-policy/pam_limits-and-related/main.fmf +++ b/selinux-policy/pam_limits-and-related/main.fmf @@ -12,7 +12,9 @@ component: - pam - selinux-policy require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/pam_timestamp-and-related/main.fmf b/selinux-policy/pam_timestamp-and-related/main.fmf index d7ac0e7..5e7a835 100644 --- a/selinux-policy/pam_timestamp-and-related/main.fmf +++ b/selinux-policy/pam_timestamp-and-related/main.fmf @@ -13,7 +13,9 @@ component: - pam - selinux-policy require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/pcm-sensor-server-and-similar/main.fmf b/selinux-policy/pcm-sensor-server-and-similar/main.fmf index 46b8f75..1e1f63a 100644 --- a/selinux-policy/pcm-sensor-server-and-similar/main.fmf +++ b/selinux-policy/pcm-sensor-server-and-similar/main.fmf @@ -7,7 +7,9 @@ component: - pcm - selinux-policy require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/pcp-daemons-and-similar/main.fmf b/selinux-policy/pcp-daemons-and-similar/main.fmf index 1262ec9..7e65b9b 100644 --- a/selinux-policy/pcp-daemons-and-similar/main.fmf +++ b/selinux-policy/pcp-daemons-and-similar/main.fmf @@ -7,7 +7,9 @@ component: - selinux-policy - pcp require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/perf_event-and-related/main.fmf b/selinux-policy/perf_event-and-related/main.fmf index 43e2e78..dbeb291 100644 --- a/selinux-policy/perf_event-and-related/main.fmf +++ b/selinux-policy/perf_event-and-related/main.fmf @@ -6,7 +6,9 @@ contact: Milos Malik component: - selinux-policy require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/ping-and-similar/main.fmf b/selinux-policy/ping-and-similar/main.fmf index 150eced..7f8098f 100644 --- a/selinux-policy/ping-and-similar/main.fmf +++ b/selinux-policy/ping-and-similar/main.fmf @@ -6,7 +6,9 @@ contact: Milos Malik component: - selinux-policy require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/policykit-general/main.fmf b/selinux-policy/policykit-general/main.fmf index 2841a86..897de7c 100644 --- a/selinux-policy/policykit-general/main.fmf +++ b/selinux-policy/policykit-general/main.fmf @@ -7,7 +7,9 @@ component: - polkit - selinux-policy require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - selinux-policy diff --git a/selinux-policy/power-profiles-daemon-and-similar/main.fmf b/selinux-policy/power-profiles-daemon-and-similar/main.fmf index 1764e87..e028f53 100644 --- a/selinux-policy/power-profiles-daemon-and-similar/main.fmf +++ b/selinux-policy/power-profiles-daemon-and-similar/main.fmf @@ -7,7 +7,9 @@ component: - selinux-policy - power-profiles-daemon require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/rngd-and-similar/main.fmf b/selinux-policy/rngd-and-similar/main.fmf index 113804e..3afd2ad 100644 --- a/selinux-policy/rngd-and-similar/main.fmf +++ b/selinux-policy/rngd-and-similar/main.fmf @@ -8,7 +8,9 @@ component: test: ./runtest.sh framework: beakerlib require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/rpc.idmapd-and-similar/main.fmf b/selinux-policy/rpc.idmapd-and-similar/main.fmf index c2a96de..8a84ff9 100644 --- a/selinux-policy/rpc.idmapd-and-similar/main.fmf +++ b/selinux-policy/rpc.idmapd-and-similar/main.fmf @@ -6,7 +6,9 @@ contact: Milos Malik component: - selinux-policy require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/rpm-cant-read-rpmmacros/main.fmf b/selinux-policy/rpm-cant-read-rpmmacros/main.fmf index 45e948e..db0b6eb 100644 --- a/selinux-policy/rpm-cant-read-rpmmacros/main.fmf +++ b/selinux-policy/rpm-cant-read-rpmmacros/main.fmf @@ -8,7 +8,9 @@ component: test: ./runtest.sh framework: beakerlib require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy - setroubleshoot-server recommend: - audit diff --git a/selinux-policy/rpmdb-and-similar/main.fmf b/selinux-policy/rpmdb-and-similar/main.fmf index 32ceece..5bb99a6 100644 --- a/selinux-policy/rpmdb-and-similar/main.fmf +++ b/selinux-policy/rpmdb-and-similar/main.fmf @@ -7,7 +7,9 @@ contact: Milos Malik component: - selinux-policy require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/rrdcached-service-and-related/main.fmf b/selinux-policy/rrdcached-service-and-related/main.fmf index 83c2714..d310cd8 100644 --- a/selinux-policy/rrdcached-service-and-related/main.fmf +++ b/selinux-policy/rrdcached-service-and-related/main.fmf @@ -4,7 +4,9 @@ contact: Milos Malik component: - selinux-policy require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - initscripts diff --git a/selinux-policy/rsyslog-and-similar/main.fmf b/selinux-policy/rsyslog-and-similar/main.fmf index 0a33aec..34fd90d 100644 --- a/selinux-policy/rsyslog-and-similar/main.fmf +++ b/selinux-policy/rsyslog-and-similar/main.fmf @@ -7,7 +7,9 @@ component: - rsyslog - selinux-policy require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - /usr/sbin/service diff --git a/selinux-policy/rtkit-daemon-and-similar/main.fmf b/selinux-policy/rtkit-daemon-and-similar/main.fmf index a794462..161244b 100644 --- a/selinux-policy/rtkit-daemon-and-similar/main.fmf +++ b/selinux-policy/rtkit-daemon-and-similar/main.fmf @@ -6,7 +6,9 @@ contact: Milos Malik component: - selinux-policy require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - /usr/sbin/service diff --git a/selinux-policy/samba-bgqd-and-similar/main.fmf b/selinux-policy/samba-bgqd-and-similar/main.fmf index 897c57c..956c2eb 100644 --- a/selinux-policy/samba-bgqd-and-similar/main.fmf +++ b/selinux-policy/samba-bgqd-and-similar/main.fmf @@ -6,7 +6,9 @@ contact: Milos Malik component: - selinux-policy require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/smbcontrol-and-similar/main.fmf b/selinux-policy/smbcontrol-and-similar/main.fmf index 083f638..b7eae14 100644 --- a/selinux-policy/smbcontrol-and-similar/main.fmf +++ b/selinux-policy/smbcontrol-and-similar/main.fmf @@ -6,7 +6,9 @@ contact: Milos Malik component: - selinux-policy require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/snapd-and-similar/main.fmf b/selinux-policy/snapd-and-similar/main.fmf index 23325b1..db9a930 100644 --- a/selinux-policy/snapd-and-similar/main.fmf +++ b/selinux-policy/snapd-and-similar/main.fmf @@ -6,7 +6,9 @@ contact: Milos Malik component: - selinux-policy require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/sslh-and-similar/main.fmf b/selinux-policy/sslh-and-similar/main.fmf index 10899bc..fae3684 100644 --- a/selinux-policy/sslh-and-similar/main.fmf +++ b/selinux-policy/sslh-and-similar/main.fmf @@ -6,7 +6,9 @@ contact: Milos Malik component: - selinux-policy require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/stalld-and-similar/main.fmf b/selinux-policy/stalld-and-similar/main.fmf index a5fa786..bb3e31f 100644 --- a/selinux-policy/stalld-and-similar/main.fmf +++ b/selinux-policy/stalld-and-similar/main.fmf @@ -6,7 +6,9 @@ contact: Milos Malik component: - selinux-policy require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/sudo-and-dnf/main.fmf b/selinux-policy/sudo-and-dnf/main.fmf index 7112970..53ec209 100644 --- a/selinux-policy/sudo-and-dnf/main.fmf +++ b/selinux-policy/sudo-and-dnf/main.fmf @@ -8,7 +8,9 @@ component: test: ./runtest.sh framework: beakerlib require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/sulogin-and-similar/main.fmf b/selinux-policy/sulogin-and-similar/main.fmf index d2d64a0..4412192 100644 --- a/selinux-policy/sulogin-and-similar/main.fmf +++ b/selinux-policy/sulogin-and-similar/main.fmf @@ -5,7 +5,9 @@ contact: Milos Malik component: - selinux-policy require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - binutils diff --git a/selinux-policy/swap-file-and-systemd-access/main.fmf b/selinux-policy/swap-file-and-systemd-access/main.fmf index 34b8c2d..bf8ed59 100644 --- a/selinux-policy/swap-file-and-systemd-access/main.fmf +++ b/selinux-policy/swap-file-and-systemd-access/main.fmf @@ -7,7 +7,9 @@ component: - selinux-policy - systemd require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux-utils diff --git a/selinux-policy/switcheroo-control-and-similar/main.fmf b/selinux-policy/switcheroo-control-and-similar/main.fmf index bf763f4..6db9ecc 100644 --- a/selinux-policy/switcheroo-control-and-similar/main.fmf +++ b/selinux-policy/switcheroo-control-and-similar/main.fmf @@ -9,7 +9,9 @@ component: test: ./runtest.sh framework: beakerlib require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/synce4l-and-similar/main.fmf b/selinux-policy/synce4l-and-similar/main.fmf index 170d141..e8a6dda 100644 --- a/selinux-policy/synce4l-and-similar/main.fmf +++ b/selinux-policy/synce4l-and-similar/main.fmf @@ -6,7 +6,9 @@ contact: Milos Malik component: - selinux-policy require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/systemd-bootchart-and-similar/main.fmf b/selinux-policy/systemd-bootchart-and-similar/main.fmf index 6be6690..ca2e193 100644 --- a/selinux-policy/systemd-bootchart-and-similar/main.fmf +++ b/selinux-policy/systemd-bootchart-and-similar/main.fmf @@ -6,7 +6,9 @@ contact: Milos Malik component: - selinux-policy require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - initscripts diff --git a/selinux-policy/systemd-creds/main.fmf b/selinux-policy/systemd-creds/main.fmf index 7aca3c5..79d9e67 100644 --- a/selinux-policy/systemd-creds/main.fmf +++ b/selinux-policy/systemd-creds/main.fmf @@ -6,7 +6,9 @@ contact: Milos Malik component: - selinux-policy require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/systemd-generators/main.fmf b/selinux-policy/systemd-generators/main.fmf index 4062447..f1e9d66 100644 --- a/selinux-policy/systemd-generators/main.fmf +++ b/selinux-policy/systemd-generators/main.fmf @@ -9,7 +9,9 @@ component: test: ./runtest.sh framework: beakerlib require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux-utils diff --git a/selinux-policy/systemd-homed/main.fmf b/selinux-policy/systemd-homed/main.fmf index 66e9253..e726217 100644 --- a/selinux-policy/systemd-homed/main.fmf +++ b/selinux-policy/systemd-homed/main.fmf @@ -3,7 +3,9 @@ contact: Amith Kumar component: - selinux-policy require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - expect diff --git a/selinux-policy/systemd-importd-and-similar/main.fmf b/selinux-policy/systemd-importd-and-similar/main.fmf index 7865f66..5754646 100644 --- a/selinux-policy/systemd-importd-and-similar/main.fmf +++ b/selinux-policy/systemd-importd-and-similar/main.fmf @@ -7,7 +7,9 @@ component: - selinux-policy - systemd require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/systemd-journal-upload/main.fmf b/selinux-policy/systemd-journal-upload/main.fmf index 35dc2f4..d286ba5 100644 --- a/selinux-policy/systemd-journal-upload/main.fmf +++ b/selinux-policy/systemd-journal-upload/main.fmf @@ -5,7 +5,9 @@ contact: Milos Malik component: - selinux-policy require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/systemd-localed/main.fmf b/selinux-policy/systemd-localed/main.fmf index ef6fff0..5b5fa64 100644 --- a/selinux-policy/systemd-localed/main.fmf +++ b/selinux-policy/systemd-localed/main.fmf @@ -5,7 +5,9 @@ contact: Milos Malik component: - selinux-policy require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/systemd-machined-and-similar/main.fmf b/selinux-policy/systemd-machined-and-similar/main.fmf index 49352f7..b6f7ebe 100644 --- a/selinux-policy/systemd-machined-and-similar/main.fmf +++ b/selinux-policy/systemd-machined-and-similar/main.fmf @@ -7,7 +7,9 @@ component: - selinux-policy - systemd require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/systemd-modules-load-and-similar/main.fmf b/selinux-policy/systemd-modules-load-and-similar/main.fmf index 37ac696..47cfd95 100644 --- a/selinux-policy/systemd-modules-load-and-similar/main.fmf +++ b/selinux-policy/systemd-modules-load-and-similar/main.fmf @@ -6,7 +6,9 @@ contact: Milos Malik component: - selinux-policy require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - /usr/sbin/service diff --git a/selinux-policy/systemd-mountfsd-and-similar/main.fmf b/selinux-policy/systemd-mountfsd-and-similar/main.fmf index bd6f636..35fd694 100644 --- a/selinux-policy/systemd-mountfsd-and-similar/main.fmf +++ b/selinux-policy/systemd-mountfsd-and-similar/main.fmf @@ -6,7 +6,9 @@ contact: Milos Malik component: - selinux-policy require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/systemd-notify-and-similar/main.fmf b/selinux-policy/systemd-notify-and-similar/main.fmf index aa40859..1e90e1c 100644 --- a/selinux-policy/systemd-notify-and-similar/main.fmf +++ b/selinux-policy/systemd-notify-and-similar/main.fmf @@ -8,7 +8,9 @@ component: test: ./runtest.sh framework: beakerlib require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - expect diff --git a/selinux-policy/systemd-nsresourced-and-similar/main.fmf b/selinux-policy/systemd-nsresourced-and-similar/main.fmf index e289047..62b0f5e 100644 --- a/selinux-policy/systemd-nsresourced-and-similar/main.fmf +++ b/selinux-policy/systemd-nsresourced-and-similar/main.fmf @@ -6,7 +6,9 @@ contact: Milos Malik component: - selinux-policy require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/systemd-oomd/main.fmf b/selinux-policy/systemd-oomd/main.fmf index 3131c08..239bb8e 100644 --- a/selinux-policy/systemd-oomd/main.fmf +++ b/selinux-policy/systemd-oomd/main.fmf @@ -9,7 +9,9 @@ component: test: ./runtest.sh framework: beakerlib require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - expect diff --git a/selinux-policy/systemd-rfkill-and-similar/main.fmf b/selinux-policy/systemd-rfkill-and-similar/main.fmf index ce773fb..31eac8d 100644 --- a/selinux-policy/systemd-rfkill-and-similar/main.fmf +++ b/selinux-policy/systemd-rfkill-and-similar/main.fmf @@ -7,7 +7,9 @@ component: - selinux-policy - systemd require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/systemd-run-and-similar/main.fmf b/selinux-policy/systemd-run-and-similar/main.fmf index ee20c01..5d8cff0 100644 --- a/selinux-policy/systemd-run-and-similar/main.fmf +++ b/selinux-policy/systemd-run-and-similar/main.fmf @@ -8,7 +8,9 @@ component: test: ./runtest.sh framework: beakerlib require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/systemd-sysctl-and-similar/main.fmf b/selinux-policy/systemd-sysctl-and-similar/main.fmf index e4ea8e8..96aa578 100644 --- a/selinux-policy/systemd-sysctl-and-similar/main.fmf +++ b/selinux-policy/systemd-sysctl-and-similar/main.fmf @@ -7,7 +7,9 @@ component: - selinux-policy - systemd require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux-utils diff --git a/selinux-policy/systemd-timesyncd-and-similar/main.fmf b/selinux-policy/systemd-timesyncd-and-similar/main.fmf index 07b01b2..29a8118 100644 --- a/selinux-policy/systemd-timesyncd-and-similar/main.fmf +++ b/selinux-policy/systemd-timesyncd-and-similar/main.fmf @@ -7,7 +7,9 @@ component: - selinux-policy - systemd require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/systemd-tmpfiles-and-similar/main.fmf b/selinux-policy/systemd-tmpfiles-and-similar/main.fmf index 6741bc4..21cebdf 100644 --- a/selinux-policy/systemd-tmpfiles-and-similar/main.fmf +++ b/selinux-policy/systemd-tmpfiles-and-similar/main.fmf @@ -8,7 +8,9 @@ component: test: ./runtest.sh framework: beakerlib require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - expect diff --git a/selinux-policy/systemd-userdbd-and-similar/main.fmf b/selinux-policy/systemd-userdbd-and-similar/main.fmf index f65d9c2..42c56e6 100644 --- a/selinux-policy/systemd-userdbd-and-similar/main.fmf +++ b/selinux-policy/systemd-userdbd-and-similar/main.fmf @@ -7,7 +7,9 @@ component: - selinux-policy - systemd require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/targetd-and-similar/main.fmf b/selinux-policy/targetd-and-similar/main.fmf index 05813b9..4e536e1 100644 --- a/selinux-policy/targetd-and-similar/main.fmf +++ b/selinux-policy/targetd-and-similar/main.fmf @@ -9,7 +9,9 @@ component: test: ./runtest.sh framework: beakerlib require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/thttpd-and-similar/main.fmf b/selinux-policy/thttpd-and-similar/main.fmf index 0753ba6..d90db9b 100644 --- a/selinux-policy/thttpd-and-similar/main.fmf +++ b/selinux-policy/thttpd-and-similar/main.fmf @@ -8,7 +8,9 @@ component: test: ./runtest.sh framework: beakerlib require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/tlp-and-similar/main.fmf b/selinux-policy/tlp-and-similar/main.fmf index ed89652..182f8b6 100644 --- a/selinux-policy/tlp-and-similar/main.fmf +++ b/selinux-policy/tlp-and-similar/main.fmf @@ -6,7 +6,9 @@ contact: Milos Malik component: - selinux-policy require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/tlshd-and-similar/main.fmf b/selinux-policy/tlshd-and-similar/main.fmf index 6fa7a6a..79d03bc 100644 --- a/selinux-policy/tlshd-and-similar/main.fmf +++ b/selinux-policy/tlshd-and-similar/main.fmf @@ -6,7 +6,9 @@ contact: Milos Malik component: - selinux-policy require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/tuned-ppd-and-similar/main.fmf b/selinux-policy/tuned-ppd-and-similar/main.fmf index b11bf1e..e0593a8 100644 --- a/selinux-policy/tuned-ppd-and-similar/main.fmf +++ b/selinux-policy/tuned-ppd-and-similar/main.fmf @@ -6,7 +6,9 @@ contact: Milos Malik component: - selinux-policy require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/usbguard-daemon-and-similar/main.fmf b/selinux-policy/usbguard-daemon-and-similar/main.fmf index 8681ea0..0b882ca 100644 --- a/selinux-policy/usbguard-daemon-and-similar/main.fmf +++ b/selinux-policy/usbguard-daemon-and-similar/main.fmf @@ -7,7 +7,9 @@ component: - usbguard - selinux-policy require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/usbmuxd-and-similar/main.fmf b/selinux-policy/usbmuxd-and-similar/main.fmf index 4bfc421..c3e9fe8 100644 --- a/selinux-policy/usbmuxd-and-similar/main.fmf +++ b/selinux-policy/usbmuxd-and-similar/main.fmf @@ -6,7 +6,9 @@ contact: Milos Malik component: - selinux-policy require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/valkey-and-similar/main.fmf b/selinux-policy/valkey-and-similar/main.fmf index 16ddad7..6a1b18b 100644 --- a/selinux-policy/valkey-and-similar/main.fmf +++ b/selinux-policy/valkey-and-similar/main.fmf @@ -8,7 +8,9 @@ component: test: ./runtest.sh framework: beakerlib require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/virt-install-additional/main.fmf b/selinux-policy/virt-install-additional/main.fmf index 7f9ace8..38032e7 100644 --- a/selinux-policy/virt-install-additional/main.fmf +++ b/selinux-policy/virt-install-additional/main.fmf @@ -8,7 +8,9 @@ component: test: ./runtest.sh framework: beakerlib require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/virtualization-daemons/main.fmf b/selinux-policy/virtualization-daemons/main.fmf index a22c362..73b3f8c 100644 --- a/selinux-policy/virtualization-daemons/main.fmf +++ b/selinux-policy/virtualization-daemons/main.fmf @@ -8,7 +8,9 @@ component: test: ./runtest.sh framework: beakerlib require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - libselinux diff --git a/selinux-policy/watch-permissions/main.fmf b/selinux-policy/watch-permissions/main.fmf index a493394..ad23040 100644 --- a/selinux-policy/watch-permissions/main.fmf +++ b/selinux-policy/watch-permissions/main.fmf @@ -5,7 +5,9 @@ framework: beakerlib component: - selinux-policy require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - audit - git diff --git a/setools/apol/main.fmf b/setools/apol/main.fmf index a169e33..43a9e88 100644 --- a/setools/apol/main.fmf +++ b/setools/apol/main.fmf @@ -8,7 +8,9 @@ component: test: ./runtest.sh framework: beakerlib require: - - library(selinux-policy/common) + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy recommend: - gnome-shell - gnome-session-xsession From 9a7d3d69fb0bf1dd81ec4aab9aba66d2423e2230 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Tue, 2 Dec 2025 10:17:56 +0100 Subject: [PATCH 606/626] Add a test for overlayfs mmap bugs (CVE-2026-46054) Signed-off-by: Ondrej Mosnacek --- kernel/overlayfs-mmap-bugs/main.fmf | 22 +++++ kernel/overlayfs-mmap-bugs/map_access.c | 70 +++++++++++++++ kernel/overlayfs-mmap-bugs/runtest.sh | 79 +++++++++++++++++ kernel/overlayfs-mmap-bugs/test_policy.te | 100 ++++++++++++++++++++++ 4 files changed, 271 insertions(+) create mode 100644 kernel/overlayfs-mmap-bugs/main.fmf create mode 100644 kernel/overlayfs-mmap-bugs/map_access.c create mode 100755 kernel/overlayfs-mmap-bugs/runtest.sh create mode 100644 kernel/overlayfs-mmap-bugs/test_policy.te diff --git a/kernel/overlayfs-mmap-bugs/main.fmf b/kernel/overlayfs-mmap-bugs/main.fmf new file mode 100644 index 0000000..dddb9db --- /dev/null +++ b/kernel/overlayfs-mmap-bugs/main.fmf @@ -0,0 +1,22 @@ +summary: Regression test for overlayfs mmap/mprotect bugs +description: | + Tests various scenarios with overlayfs and mmap/mprotect syscalls. + This also covers CVE-2026-46054. +contact: Ondrej Mosnacek +component: + - kernel +framework: beakerlib +require: + - selinux-policy-devel + - gcc +duration: 5m +tier: 2 +enabled: true +link: + - verifies: https://issues.redhat.com/browse/RHEL-127505 + - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2026-46054 +environment: + AVC_ERROR: +no_avc_check +check: + - how: avc + result: xfail diff --git a/kernel/overlayfs-mmap-bugs/map_access.c b/kernel/overlayfs-mmap-bugs/map_access.c new file mode 100644 index 0000000..9300365 --- /dev/null +++ b/kernel/overlayfs-mmap-bugs/map_access.c @@ -0,0 +1,70 @@ +#include +#include + +#include + +#include +#include +#include + +int main(int argc, const char **argv) +{ + const char *file, *context; + void *ptr; + int rdonly, fd, ctxfd, ret; + + if (argc < 3 || argc > 4 || (strcmp(argv[2], "RDONLY") && strcmp(argv[2], "RDWR"))) { + fprintf(stderr, "Usage %s RDONLY|RDWR\n", argv[0]); + return EINVAL; + } + + file = argv[1]; + rdonly = strcmp(argv[2], "RDONLY") == 0; + context = argc >= 4 ? argv[3] : NULL; + + fd = open(file, rdonly ? O_RDONLY : O_RDWR); + if (fd == -1) { + perror("open"); + return 2; + } + + /* try direct mmap */ + ptr = mmap(NULL, 1, rdonly ? PROT_READ : PROT_READ|PROT_WRITE, + MAP_SHARED, fd, 0); + if (ptr == MAP_FAILED) { + perror("mmap"); + return 3; + } + munmap(ptr, 1); + + /* try mmap with PROT_NONE followed by mprotect with full access */ + ptr = mmap(NULL, 1, PROT_NONE, MAP_SHARED, fd, 0); + if (ptr == MAP_FAILED) { + perror("mmap PROT_NONE"); + return 4; + } + + if (context) { + ctxfd = open("/proc/self/attr/current", O_RDWR); + if (ctxfd == -1) { + perror("open"); + return 6; + } + ret = write(ctxfd, context, strlen(context)); + if (ret == -1) { + perror("write"); + return 7; + } + close(ctxfd); + } + + ret = mprotect(ptr, 1, rdonly ? PROT_READ : PROT_READ|PROT_WRITE); + if (ret == -1) { + perror("mprotect"); + return 5; + } + + munmap(ptr, 1); + close(fd); + return 0; +} diff --git a/kernel/overlayfs-mmap-bugs/runtest.sh b/kernel/overlayfs-mmap-bugs/runtest.sh new file mode 100755 index 0000000..3d15777 --- /dev/null +++ b/kernel/overlayfs-mmap-bugs/runtest.sh @@ -0,0 +1,79 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# SPDX-License-Identifier: GPL-2.0 +# Copyright (c) 2025 Red Hat, Inc. +# Author: Ondrej Mosnacek + +# Include Beakerlib environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +rlJournalStart + rlPhaseStartSetup + rlRun "uname -r" 0 "Print current running kernel version" + + SE_USER="$(secon -u --pid $$)" + SE_ROLE="$(secon -r --pid $$)" + SE_TYPE="$(secon -t --pid $$)" + SE_MLS="$(secon -m --pid $$)" + + OVERLAYCON="$SE_USER:object_r:test_mountedfile_t:s0" + DYNTRANSCON="$SE_USER:$SE_ROLE:test_access_exploit_t:$SE_MLS" + + rlRun "gcc -o map_access map_access.c" 0 \ + "Build the test program" + rlRun "chcon -t bin_t map_access" 0 "Relabel the test program" + rlRun "make -f /usr/share/selinux/devel/Makefile test_policy.pp M4PARAM='-D TEST_ROLE=$SE_ROLE -D TEST_TYPE=$SE_TYPE'" 0 \ + "Build the test policy" + rlRun "semodule -i test_policy.pp" 0 "Load test policy" + + rlRun "mkdir lowerdir upperdir workdir mountpoint" 0 "Create test dirs" + rlRun "touch lowerdir/file_ok lowerdir/file_no_map lowerdir/file_no_read lowerdir/file_no_write" 0 \ + "Create test files" + rlRun "chcon -R -t test_lowerfile_t lowerdir workdir upperdir" + rlRun "chcon -t test_lowerfile_no_map_t lowerdir/file_no_map" + rlRun "chcon -t test_lowerfile_no_write_t lowerdir/file_no_write" + rlRun "chcon -t test_lowerfile_no_read_t lowerdir/file_no_read" + + rlRun "runcon -t test_mounter_t mount -t overlay none -o 'context=$OVERLAYCON,lowerdir=./lowerdir,upperdir=./upperdir,workdir=./workdir' ./mountpoint" 0 \ + "Mount the overlay filesystem" + + rlRun ":>/var/log/audit/audit.log; rm -f /var/log/audit/audit.log.*" 0 \ + "Clear the audit log" + rlPhaseEnd + + rlPhaseStartTest + # Bug 1 + # Should get below AVC: + # avc: denied { map } for scontext=...test_mounter_t... tcontext=...test_lowerfile_no_map_t... tclass=file + rlRun "runcon -t test_access_full_t ./map_access ./mountpoint/file_no_map RDONLY" 3 "Test Bug 1" + + # Bug 2, result 1 + # Shouldn't get below AVC: + # avc: denied { use } for scontext=...test_access_full_t... tcontext=...test_mounter_t... tclass=fd + rlRun "setsebool domain_fd_use 0" + rlRun "runcon -t test_access_full_t ./map_access ./mountpoint/file_ok RDONLY" 0 "Test Bug 2, result 1" + rlRun "setsebool domain_fd_use 1" + + # Bug 2, result 2 + # Shouldn't get below AVC: + # avc: denied { read } for scontext=...test_access_full_t... tcontext=...test_lowerfile_t... tclass=file + rlRun "runcon -t test_access_full_t ./map_access ./mountpoint/file_ok RDONLY" 0 "Test Bug 2, result 2" + + # Bug 2, result 3 + # Should get below AVC: + # avc: denied { read } for scontext=...test_access_exploit_t... tcontext=...test_mountedfile_t... tclass=file + rlRun "runcon -t test_access_full_t ./map_access ./mountpoint/file_ok RDONLY $DYNTRANSCON" 5 "Test Bug 2, result 3" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "ausearch -i -m avc" 0 "Show AVC denials" + + rlRun "umount ./mountpoint" + rlRun "rm -rf lowerdir upperdir workdir mountpoint" + rlRun "semodule -r test_policy" 0 "Unload test policy" + rlRun "make -f /usr/share/selinux/devel/Makefile clean" 0 \ + "Clean the test policy" + rlRun "rm -f map_access" 0 "Remove the test program" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/kernel/overlayfs-mmap-bugs/test_policy.te b/kernel/overlayfs-mmap-bugs/test_policy.te new file mode 100644 index 0000000..5260f28 --- /dev/null +++ b/kernel/overlayfs-mmap-bugs/test_policy.te @@ -0,0 +1,100 @@ +policy_module(test_policy,1.0.0) + +type test_lowerfile_t; +files_type(test_lowerfile_t) + +type test_lowerfile_no_map_t; +files_type(test_lowerfile_no_map_t) + +type test_lowerfile_no_write_t; +files_type(test_lowerfile_no_write_t) + +type test_lowerfile_no_read_t; +files_type(test_lowerfile_no_read_t) + +type test_mountedfile_t; +files_type(test_mountedfile_t) + +type test_mounter_t; +domain_type(test_mounter_t) + +allow test_mounter_t self:capability { sys_admin dac_read_search dac_override }; + +# test_mounter_t has full access to test_lowerfile_t +manage_dirs_pattern(test_mounter_t, test_lowerfile_t, test_lowerfile_t) +manage_files_pattern(test_mounter_t, test_lowerfile_t, test_lowerfile_t) +manage_chr_files_pattern(test_mounter_t, test_lowerfile_t, test_lowerfile_t) +allow test_mounter_t test_lowerfile_t:file map; + +# test_mounter_t can't map test_lowerfile_t +rw_files_pattern(test_mounter_t, test_lowerfile_no_map_t, test_lowerfile_no_map_t) + +# test_mounter_t can't write test_lowerfile_no_write_t +read_files_pattern(test_mounter_t, test_lowerfile_no_write_t, test_lowerfile_no_write_t) +allow test_mounter_t test_lowerfile_no_write_t:file map; + +# test_mounter_t can't read test_lowerfile_no_read_t +write_files_pattern(test_mounter_t, test_lowerfile_no_read_t, test_lowerfile_no_read_t) +allow test_mounter_t test_lowerfile_no_read_t:file map; + +allow test_mounter_t test_mountedfile_t:dir { getattr setattr }; +allow test_mounter_t test_mountedfile_t:filesystem { relabelfrom relabelto mount }; + +kernel_read_system_state(test_mounter_t) +kernel_read_proc_symlinks(test_mounter_t) +kernel_request_load_module(test_mounter_t) +kernel_search_proc(test_mounter_t) + +fs_getattr_xattr_fs(test_mounter_t) +fs_relabelfrom_xattr_fs(test_mounter_t) + +mount_entry_type(test_mounter_t) +mount_rw_pid_files(test_mounter_t) + +selinux_getattr_fs(test_mounter_t) + +files_mounton_all_mountpoints(test_mounter_t) + +# Domain with full mountedfile access +type test_access_full_t; +domain_type(test_access_full_t) + +manage_dirs_pattern(test_access_full_t, test_mountedfile_t, test_mountedfile_t) +manage_files_pattern(test_access_full_t, test_mountedfile_t, test_mountedfile_t) +allow test_access_full_t test_mountedfile_t:file map; + +corecmd_bin_entry_type(test_access_full_t) + +# Domain with lowerfile access, but no mountedfile access (exploiting Bug 2) +type test_access_exploit_t; +domain_type(test_access_exploit_t) + +manage_files_pattern(test_access_exploit_t, test_lowerfile_t, test_lowerfile_t) + +corecmd_bin_entry_type(test_access_exploit_t) + +# for dyntransition test_access_full_t -> test_access_exploit_t +allow test_access_full_t self:process { setcurrent }; +allow test_access_full_t test_access_exploit_t:process { dyntransition }; + +attribute test_domain; +typeattribute test_mounter_t test_domain; +typeattribute test_access_full_t test_domain; +typeattribute test_access_exploit_t test_domain; + +require { + type TEST_TYPE; + role TEST_ROLE; +} +allow TEST_TYPE test_domain:process transition; +role TEST_ROLE types test_domain; + +allow test_domain TEST_TYPE:fd use; +allow test_domain TEST_TYPE:fifo_file rw_inherited_fifo_file_perms; +allow test_domain TEST_TYPE:process { sigchld }; + +files_search_tmp(test_domain) + +term_use_all_terms(test_domain) + +userdom_search_user_tmp_dirs(test_domain) From 50869431bb49cf359a34352fb3ead93bc761ecd7 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Thu, 28 May 2026 09:58:39 +0200 Subject: [PATCH 607/626] run the internal checkpolicy tests The checkpolicy source RPM contains not only checkpolicy sources but also checkpolicy tests. Purpose of this automated test is to run them with the current versions of libsepol and checkpolicy components. --- checkpolicy/internal-tests/main.fmf | 28 +++++++++++++ checkpolicy/internal-tests/runtest.sh | 58 +++++++++++++++++++++++++++ 2 files changed, 86 insertions(+) create mode 100644 checkpolicy/internal-tests/main.fmf create mode 100755 checkpolicy/internal-tests/runtest.sh diff --git a/checkpolicy/internal-tests/main.fmf b/checkpolicy/internal-tests/main.fmf new file mode 100644 index 0000000..437b964 --- /dev/null +++ b/checkpolicy/internal-tests/main.fmf @@ -0,0 +1,28 @@ +summary: Run internal checkpolicy tests +contact: Milos Malik +component: + - checkpolicy +require: + - bison + - checkpolicy + - flex + - gcc + - libsepol-devel + - make +recommend: + - libsepol-static +duration: 5m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - targeted + - avoidImageMode +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + because: the test is not relevant there +extra-nitrate: TC#0620041 +id: 3df4f40d-61a0-4267-b7db-6ff9f5254406 diff --git a/checkpolicy/internal-tests/runtest.sh b/checkpolicy/internal-tests/runtest.sh new file mode 100755 index 0000000..2977950 --- /dev/null +++ b/checkpolicy/internal-tests/runtest.sh @@ -0,0 +1,58 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/checkpolicy/internal-tests +# Description: Run internal checkpolicy tests +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2026 Red Hat, Inc. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="checkpolicy" + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm ${PACKAGE} + if ! rpm -q libsepol-static >& /dev/null ; then + rlRun "dnf install -y libsepol-static --enablerepo '*'" + fi + rlRun "rpm -qa | grep libsepol | sort" + rlPhaseEnd + + rlPhaseStartTest "non-fuzzing tests" + rlRun "dnf download --source ${PACKAGE}" + rlRun "rpm -ivh ${PACKAGE}-*.src.rpm" + rlRun "rm -f ${PACKAGE}-*.src.rpm" + rlRun "tar zxf ~/rpmbuild/SOURCES/${PACKAGE}-*.tar.gz" + rlRun "pushd ${PACKAGE}-*" + rlRun "make test" + rlRun "popd" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "rm -rf ~/rpmbuild ${PACKAGE}-*" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + From 62e5369698ec86df09cdeb18cec00ddaaff36a5d Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Thu, 4 Jun 2026 10:13:54 +0200 Subject: [PATCH 608/626] add missing IDs to recently created tests Ideally, each test should have a unique ID. These IDs can then be used by various test case management and/or reporting tools. --- policycoreutils/seunshare-drop-system-calls/main.fmf | 5 +++-- selinux-policy/files-ownership/main.fmf | 4 +++- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/policycoreutils/seunshare-drop-system-calls/main.fmf b/policycoreutils/seunshare-drop-system-calls/main.fmf index db2e2a7..2dbcac1 100644 --- a/policycoreutils/seunshare-drop-system-calls/main.fmf +++ b/policycoreutils/seunshare-drop-system-calls/main.fmf @@ -1,7 +1,6 @@ -summary: Test that seunshare/sandbox doesn't execute shell commands when given +summary: Test that seunshare/sandbox doesn't execute shell commands when given filenames with special characters. contact: Veronika Syncakova - component: - policycoreutils require: @@ -22,3 +21,5 @@ adjust+: - enabled: false when: distro < rhel-8 continue: false +id: cd507040-e105-4873-972b-7fe10bb597fa + diff --git a/selinux-policy/files-ownership/main.fmf b/selinux-policy/files-ownership/main.fmf index 9808d2d..302f725 100644 --- a/selinux-policy/files-ownership/main.fmf +++ b/selinux-policy/files-ownership/main.fmf @@ -22,4 +22,6 @@ adjust+: link: - verifies: https://redhat.atlassian.net/browse/RHEL-141659 - verifies: https://redhat.atlassian.net/browse/RHEL-157952 - - verifies: https://redhat.atlassian.net/browse/FC-1681 \ No newline at end of file + - verifies: https://redhat.atlassian.net/browse/FC-1681 +id: ee9a0250-4a0a-4c56-bf4e-15228324dbc5 + From 56b168c4ace3c0f2bfb930b0eec364242844b171 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Fri, 12 Jun 2026 15:16:19 +0200 Subject: [PATCH 609/626] add SELinux beaker library URL to the cups* tests The following exception is raised when the cups* tests are executed via 'wow --distro ... --case ...': ERROR Failed to add due issue with TMT Metadata: Error in processing libraries from {'url': 'https://src.fedoraproject.org/tests/selinux.git', 'ref': 'main', 'name': '/selinux-policy/cups-lpd-and-similar'}. Raised exception was: ERROR Unable to add one of testcases due to wrong metadata - See `--ignore-invalid` option --- selinux-policy/cups-browsed-and-similar/main.fmf | 1 + selinux-policy/cups-lpd-and-similar/main.fmf | 1 + selinux-policy/cups-pdf-and-similar/main.fmf | 1 + 3 files changed, 3 insertions(+) diff --git a/selinux-policy/cups-browsed-and-similar/main.fmf b/selinux-policy/cups-browsed-and-similar/main.fmf index 9c91bf0..ca03382 100644 --- a/selinux-policy/cups-browsed-and-similar/main.fmf +++ b/selinux-policy/cups-browsed-and-similar/main.fmf @@ -10,6 +10,7 @@ require: - type: library name: /selinux-policy/Library/common nick: selinux-policy + url: https://src.fedoraproject.org/tests/selinux.git recommend: - audit - libselinux diff --git a/selinux-policy/cups-lpd-and-similar/main.fmf b/selinux-policy/cups-lpd-and-similar/main.fmf index 5bdcf1c..cd7d489 100644 --- a/selinux-policy/cups-lpd-and-similar/main.fmf +++ b/selinux-policy/cups-lpd-and-similar/main.fmf @@ -10,6 +10,7 @@ require: - type: library name: /selinux-policy/Library/common nick: selinux-policy + url: https://src.fedoraproject.org/tests/selinux.git recommend: - audit - expect diff --git a/selinux-policy/cups-pdf-and-similar/main.fmf b/selinux-policy/cups-pdf-and-similar/main.fmf index 259cede..7b86822 100644 --- a/selinux-policy/cups-pdf-and-similar/main.fmf +++ b/selinux-policy/cups-pdf-and-similar/main.fmf @@ -9,6 +9,7 @@ require: - type: library name: /selinux-policy/Library/common nick: selinux-policy + url: https://src.fedoraproject.org/tests/selinux.git recommend: - audit - libselinux From bcf00d44c6262a160a2ba67805542dfe260a7119 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Tue, 16 Jun 2026 08:49:35 +0200 Subject: [PATCH 610/626] kernel/overlayfs-mmap-bugs: test for execmem regression The original CVE fix has a bug in that it incorrectly checks execmem permission for the mounter domain. Test for the regression in the test so that we can verify its fix. Signed-off-by: Ondrej Mosnacek --- kernel/overlayfs-mmap-bugs/main.fmf | 13 +++++++++---- kernel/overlayfs-mmap-bugs/map_access.c | 19 ++++++++++++------- kernel/overlayfs-mmap-bugs/runtest.sh | 14 +++++++++----- kernel/overlayfs-mmap-bugs/test_policy.te | 6 ++++++ 4 files changed, 36 insertions(+), 16 deletions(-) diff --git a/kernel/overlayfs-mmap-bugs/main.fmf b/kernel/overlayfs-mmap-bugs/main.fmf index dddb9db..8ff2402 100644 --- a/kernel/overlayfs-mmap-bugs/main.fmf +++ b/kernel/overlayfs-mmap-bugs/main.fmf @@ -1,7 +1,7 @@ summary: Regression test for overlayfs mmap/mprotect bugs description: | - Tests various scenarios with overlayfs and mmap/mprotect syscalls. - This also covers CVE-2026-46054. + Tests various scenarios with overlayfs and mmap/mprotect syscalls. + This also covers CVE-2026-46054. contact: Ondrej Mosnacek component: - kernel @@ -13,10 +13,15 @@ duration: 5m tier: 2 enabled: true link: - - verifies: https://issues.redhat.com/browse/RHEL-127505 + - verifies: https://redhat.atlassian.net/browse/RHEL-127505 - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2026-46054 + - verifies: https://redhat.atlassian.net/browse/RHEL-185115 + - verifies: https://redhat.atlassian.net/browse/RHEL-185117 + - verifies: https://redhat.atlassian.net/browse/RHEL-185118 environment: - AVC_ERROR: +no_avc_check + AVC_ERROR: +no_avc_check check: - how: avc result: xfail +extra-nitrate: TC#0620043 +id: 2ee56bc8-01f3-4b77-8cdb-494ad9a12451 diff --git a/kernel/overlayfs-mmap-bugs/map_access.c b/kernel/overlayfs-mmap-bugs/map_access.c index 9300365..0bd4530 100644 --- a/kernel/overlayfs-mmap-bugs/map_access.c +++ b/kernel/overlayfs-mmap-bugs/map_access.c @@ -11,16 +11,22 @@ int main(int argc, const char **argv) { const char *file, *context; void *ptr; - int rdonly, fd, ctxfd, ret; + int rdonly, execmem, flags, prot, fd, ctxfd, ret; - if (argc < 3 || argc > 4 || (strcmp(argv[2], "RDONLY") && strcmp(argv[2], "RDWR"))) { + if (argc < 4 || argc > 5 || + (strcmp(argv[2], "RDONLY") && strcmp(argv[2], "RDWR")) || + (strcmp(argv[3], "SHARED") && strcmp(argv[3], "PRIVATE")) + ) { fprintf(stderr, "Usage %s RDONLY|RDWR\n", argv[0]); return EINVAL; } file = argv[1]; rdonly = strcmp(argv[2], "RDONLY") == 0; - context = argc >= 4 ? argv[3] : NULL; + execmem = strcmp(argv[3], "PRIVATE") == 0; + flags = strcmp(argv[3], "PRIVATE") == 0 ? MAP_PRIVATE : MAP_SHARED; + prot = PROT_READ | (!rdonly || execmem ? PROT_WRITE : 0) | (execmem ? PROT_EXEC : 0); + context = argc >= 5 ? argv[4] : NULL; fd = open(file, rdonly ? O_RDONLY : O_RDWR); if (fd == -1) { @@ -29,8 +35,7 @@ int main(int argc, const char **argv) } /* try direct mmap */ - ptr = mmap(NULL, 1, rdonly ? PROT_READ : PROT_READ|PROT_WRITE, - MAP_SHARED, fd, 0); + ptr = mmap(NULL, 1, prot, flags, fd, 0); if (ptr == MAP_FAILED) { perror("mmap"); return 3; @@ -38,7 +43,7 @@ int main(int argc, const char **argv) munmap(ptr, 1); /* try mmap with PROT_NONE followed by mprotect with full access */ - ptr = mmap(NULL, 1, PROT_NONE, MAP_SHARED, fd, 0); + ptr = mmap(NULL, 1, PROT_NONE, flags, fd, 0); if (ptr == MAP_FAILED) { perror("mmap PROT_NONE"); return 4; @@ -58,7 +63,7 @@ int main(int argc, const char **argv) close(ctxfd); } - ret = mprotect(ptr, 1, rdonly ? PROT_READ : PROT_READ|PROT_WRITE); + ret = mprotect(ptr, 1, prot); if (ret == -1) { perror("mprotect"); return 5; diff --git a/kernel/overlayfs-mmap-bugs/runtest.sh b/kernel/overlayfs-mmap-bugs/runtest.sh index 3d15777..1cb3ab0 100755 --- a/kernel/overlayfs-mmap-bugs/runtest.sh +++ b/kernel/overlayfs-mmap-bugs/runtest.sh @@ -41,28 +41,32 @@ rlJournalStart "Clear the audit log" rlPhaseEnd - rlPhaseStartTest + rlPhaseStartTest "CVE-2026-46054" # Bug 1 # Should get below AVC: # avc: denied { map } for scontext=...test_mounter_t... tcontext=...test_lowerfile_no_map_t... tclass=file - rlRun "runcon -t test_access_full_t ./map_access ./mountpoint/file_no_map RDONLY" 3 "Test Bug 1" + rlRun "runcon -t test_access_full_t ./map_access ./mountpoint/file_no_map RDONLY SHARED" 3 "Test Bug 1" # Bug 2, result 1 # Shouldn't get below AVC: # avc: denied { use } for scontext=...test_access_full_t... tcontext=...test_mounter_t... tclass=fd rlRun "setsebool domain_fd_use 0" - rlRun "runcon -t test_access_full_t ./map_access ./mountpoint/file_ok RDONLY" 0 "Test Bug 2, result 1" + rlRun "runcon -t test_access_full_t ./map_access ./mountpoint/file_ok RDONLY SHARED" 0 "Test Bug 2, result 1" rlRun "setsebool domain_fd_use 1" # Bug 2, result 2 # Shouldn't get below AVC: # avc: denied { read } for scontext=...test_access_full_t... tcontext=...test_lowerfile_t... tclass=file - rlRun "runcon -t test_access_full_t ./map_access ./mountpoint/file_ok RDONLY" 0 "Test Bug 2, result 2" + rlRun "runcon -t test_access_full_t ./map_access ./mountpoint/file_ok RDONLY SHARED" 0 "Test Bug 2, result 2" # Bug 2, result 3 # Should get below AVC: # avc: denied { read } for scontext=...test_access_exploit_t... tcontext=...test_mountedfile_t... tclass=file - rlRun "runcon -t test_access_full_t ./map_access ./mountpoint/file_ok RDONLY $DYNTRANSCON" 5 "Test Bug 2, result 3" + rlRun "runcon -t test_access_full_t ./map_access ./mountpoint/file_ok RDONLY SHARED $DYNTRANSCON" 5 "Test Bug 2, result 3" + rlPhaseEnd + + rlPhaseStartTest "execmem regression" + rlRun "runcon -t test_access_full_t ./map_access ./mountpoint/file_ok RDONLY PRIVATE" 0 "Verify no execmem denied" rlPhaseEnd rlPhaseStartCleanup diff --git a/kernel/overlayfs-mmap-bugs/test_policy.te b/kernel/overlayfs-mmap-bugs/test_policy.te index 5260f28..73f05cc 100644 --- a/kernel/overlayfs-mmap-bugs/test_policy.te +++ b/kernel/overlayfs-mmap-bugs/test_policy.te @@ -25,6 +25,8 @@ manage_dirs_pattern(test_mounter_t, test_lowerfile_t, test_lowerfile_t) manage_files_pattern(test_mounter_t, test_lowerfile_t, test_lowerfile_t) manage_chr_files_pattern(test_mounter_t, test_lowerfile_t, test_lowerfile_t) allow test_mounter_t test_lowerfile_t:file map; +# extra permission for execmem regression test +allow test_mounter_t test_lowerfile_t:file { execute }; # test_mounter_t can't map test_lowerfile_t rw_files_pattern(test_mounter_t, test_lowerfile_no_map_t, test_lowerfile_no_map_t) @@ -77,6 +79,10 @@ corecmd_bin_entry_type(test_access_exploit_t) allow test_access_full_t self:process { setcurrent }; allow test_access_full_t test_access_exploit_t:process { dyntransition }; +# extra permissions for execmem regression test +allow test_access_full_t test_mountedfile_t:file { execute }; +allow test_access_full_t self:process { execmem }; + attribute test_domain; typeattribute test_mounter_t test_domain; typeattribute test_access_full_t test_domain; From 6f2828a4315e09be9f753d8d7ba160e59e70de99 Mon Sep 17 00:00:00 2001 From: Petr Matyas Date: Mon, 29 Jun 2026 10:41:26 +0200 Subject: [PATCH 611/626] Move oom-compiler-failure from gitlab Verify that checkpolicy and checkmodule abort cleanly when memory is exhausted during compilation, rather than producing a potentially incorrect output binary. The test constrains the virtual address space of the compiler subprocess to 8 MB via ulimit -v, which is sufficient for process startup but not for parsing a full targeted policy binary. Both compilers are exercised using binary input (checkpolicy -b, checkmodule -b) against the active policy store. Assertions: non-zero exit status and no output file produced under OOM. Tested on RHEL 9, RHEL 10, and RHIVOS 2.0 on x86_64 and aarch64. VROOM-40721 --- checkpolicy/oom-compiler-failure/PURPOSE | 21 +++++ checkpolicy/oom-compiler-failure/main.fmf | 18 +++++ checkpolicy/oom-compiler-failure/runtest.sh | 86 +++++++++++++++++++++ 3 files changed, 125 insertions(+) create mode 100644 checkpolicy/oom-compiler-failure/PURPOSE create mode 100644 checkpolicy/oom-compiler-failure/main.fmf create mode 100755 checkpolicy/oom-compiler-failure/runtest.sh diff --git a/checkpolicy/oom-compiler-failure/PURPOSE b/checkpolicy/oom-compiler-failure/PURPOSE new file mode 100644 index 0000000..2c3a537 --- /dev/null +++ b/checkpolicy/oom-compiler-failure/PURPOSE @@ -0,0 +1,21 @@ +PURPOSE of /CoreOS/checkpolicy/Regression/oom-compiler-failure +Author: Petr Matyas + +Description: checkpolicy and checkmodule must fail cleanly under OOM conditions + +When a policy compiler (checkpolicy, checkmodule) encounters a memory +allocation failure mid-compilation it must abort and return a non-zero exit +status. It must not write a partial or otherwise incorrect output binary, +which could be silently loaded by semodule and corrupt the running policy. + +The test constrains the virtual address space of the compiler subprocess to +8 MB using "ulimit -v", which is below the minimum required to compile a real +targeted policy binary but above the threshold needed to load shared libraries +and start execution. Two compilers are exercised: + + checkpolicy -b (recompiling the active kernel policy binary) + checkmodule -b (recompiling the base module extracted from the policy store) + +Assertions for each compiler: + 1. Exit status is non-zero. + 2. The output file was not created or is empty. diff --git a/checkpolicy/oom-compiler-failure/main.fmf b/checkpolicy/oom-compiler-failure/main.fmf new file mode 100644 index 0000000..bbc0491 --- /dev/null +++ b/checkpolicy/oom-compiler-failure/main.fmf @@ -0,0 +1,18 @@ +summary: checkpolicy and checkmodule must fail cleanly under OOM conditions +description: |+ + Simulate an out-of-memory condition by capping the virtual address space of + the compiler subprocess with ulimit -v. Verify that both checkpolicy and + checkmodule exit with a non-zero status and do not produce an output binary + when memory is exhausted during compilation. + +contact: Petr Matyas +component: + - checkpolicy +test: ./runtest.sh +framework: beakerlib +require: + - checkpolicy + - policycoreutils +enabled: true +tier: 2 +id: 4afebe54-b8f3-41d0-b9bc-91d46d436236 diff --git a/checkpolicy/oom-compiler-failure/runtest.sh b/checkpolicy/oom-compiler-failure/runtest.sh new file mode 100755 index 0000000..46c242e --- /dev/null +++ b/checkpolicy/oom-compiler-failure/runtest.sh @@ -0,0 +1,86 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/checkpolicy/Regression/oom-compiler-failure +# Description: checkpolicy and checkmodule must fail cleanly under OOM +# Author: Petr Matyas +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2026 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +. /usr/share/beakerlib/beakerlib.sh + +PACKAGE="checkpolicy" + +# Virtual memory limit in KB applied to each compiler subprocess. +# 8 MB is below the minimum needed to parse a real targeted policy binary +# but above the minimum for the process to load its shared libraries and +# start executing. Validated against checkpolicy 3.x on RHEL-10. +MEM_LIMIT_KB=8192 + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm ${PACKAGE} + rlAssertRpm policycoreutils + rlAssertExists "/usr/bin/checkpolicy" + rlAssertExists "/usr/bin/checkmodule" + rlAssertExists "/usr/bin/semodule_unpackage" + + # Locate the active compiled policy on disk. + POLICY_BINARY=$(find /etc/selinux/ -name "policy.*" -type f | head -1) + rlAssertExists "${POLICY_BINARY}" + rlLog "Using policy binary: ${POLICY_BINARY}" + + # Extract the base module binary so checkmodule can compile it back. + # semodule_unpackage accepts .pp and writes separate .mod and .fc files. + rlRun "semodule -E base" 0 "Extract base.pp from the active policy store" + rlAssertExists "base.pp" + rlRun "semodule_unpackage base.pp base.mod base.fc" 0 "Unpack base.pp into base.mod" + rlAssertExists "base.mod" + rlLog "base.mod size: $(stat -c %s base.mod) bytes" + rlPhaseEnd + + rlPhaseStartTest "checkpolicy fails without producing output under OOM" + rlRun "rm -f policy.oom" + # Run checkpolicy in a child process whose virtual address space is + # capped. exec replaces the shell so ulimit applies only to checkpolicy + # itself, leaving the test harness unaffected. + rlRun -s "bash -c 'ulimit -v ${MEM_LIMIT_KB}; exec checkpolicy -b -M -o policy.oom ${POLICY_BINARY}'" 1-255 \ + "checkpolicy must exit non-zero when memory is exhausted" + rlLog "checkpolicy output: $(cat ${rlRun_LOG})" + rlRun "test ! -s policy.oom" 0 \ + "checkpolicy must not produce an output binary under OOM" + rlPhaseEnd + + rlPhaseStartTest "checkmodule fails without producing output under OOM" + rlRun "rm -f base.oom" + rlRun -s "bash -c 'ulimit -v ${MEM_LIMIT_KB}; exec checkmodule -b -M -o base.oom base.mod'" 1-255 \ + "checkmodule must exit non-zero when memory is exhausted" + rlLog "checkmodule output: $(cat ${rlRun_LOG})" + rlRun "test ! -s base.oom" 0 \ + "checkmodule must not produce an output binary under OOM" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "rm -f policy.oom base.oom base.pp base.mod base.fc" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd From f03d5ff12b0f0e7e13043e356919290493839d48 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Thu, 18 Jun 2026 09:24:17 +0200 Subject: [PATCH 612/626] test if the bootupd service can talk to SSSD A recently filed bug report revealed that SELinux prevents the bootupd service and its children processes from talking to SSSD. The TC reproduces the situation on machines created by bootc. In order to support this scenario, I believe that SELinux policy should allow the necessary access. The TC looks for appropriate policy rules and file context patterns. The TC covers RHEL-174888. --- selinux-policy/bootupd-and-similar/Makefile | 1 + selinux-policy/bootupd-and-similar/main.fmf | 1 + selinux-policy/bootupd-and-similar/runtest.sh | 12 ++++++++++++ 3 files changed, 14 insertions(+) diff --git a/selinux-policy/bootupd-and-similar/Makefile b/selinux-policy/bootupd-and-similar/Makefile index 2134c06..68ea1c9 100644 --- a/selinux-policy/bootupd-and-similar/Makefile +++ b/selinux-policy/bootupd-and-similar/Makefile @@ -69,6 +69,7 @@ $(METADATA): Makefile @echo "Bug: RHEL-39514" >> $(METADATA) # RHEL-10 @echo "Bug: RHEL-66584" >> $(METADATA) # RHEL-9 @echo "Bug: RHEL-70849" >> $(METADATA) # RHEL-9 + @echo "Bug: RHEL-174888" >> $(METADATA) # RHEL-9 rhts-lint $(METADATA) diff --git a/selinux-policy/bootupd-and-similar/main.fmf b/selinux-policy/bootupd-and-similar/main.fmf index 6f814d7..52e576e 100644 --- a/selinux-policy/bootupd-and-similar/main.fmf +++ b/selinux-policy/bootupd-and-similar/main.fmf @@ -41,6 +41,7 @@ link: - verifies: https://issues.redhat.com/browse/RHEL-39514 - verifies: https://issues.redhat.com/browse/RHEL-66584 - verifies: https://issues.redhat.com/browse/RHEL-70849 + - verifies: https://issues.redhat.com/browse/RHEL-174888 adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8 diff --git a/selinux-policy/bootupd-and-similar/runtest.sh b/selinux-policy/bootupd-and-similar/runtest.sh index 73e5322..f2b2767 100755 --- a/selinux-policy/bootupd-and-similar/runtest.sh +++ b/selinux-policy/bootupd-and-similar/runtest.sh @@ -123,6 +123,18 @@ rlJournalStart rlSESearchRule "type_transition bootupd_t bootloader_exec_t : process bootloader_t" rlSESearchRule "allow bootupd_t bootloader_t : process { transition } [ ]" rlPhaseEnd + + rlPhaseStartTest "RHEL-174888" + rlSEMatchPathCon "/usr/bin/lsblk" "bin_t" + rlSEMatchPathCon "/etc/passwd" "passwd_file_t" + rlSEMatchPathCon "/run/mount/utab" "mount_var_run_t" + rlSEMatchPathCon "/var/lib/sss/mc/passwd" "sssd_public_t" + rlSEMatchPathCon "/var/lib/sss" "sssd_var_lib_t" + rlSESearchRule "allow bootupd_t mount_var_run_t : dir { search } [ ]" + rlSESearchRule "allow bootupd_t passwd_file_t : file { getattr open read } [ ]" + rlSESearchRule "allow bootupd_t sssd_public_t : dir { search } [ ]" + rlSESearchRule "allow bootupd_t sssd_var_lib_t : dir { search } [ ]" + rlPhaseEnd fi if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then From e62cab0e38df14d02c3c7b0134752509a5aeab7d Mon Sep 17 00:00:00 2001 From: Veronika Syncakova Date: Mon, 20 Jul 2026 11:01:31 +0200 Subject: [PATCH 613/626] Fix for /libselinux/matchpathcon-in-chroot-env If epel repo was installed, the release version was not recognized. --- libselinux/matchpathcon-in-chroot-env/runtest.sh | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) diff --git a/libselinux/matchpathcon-in-chroot-env/runtest.sh b/libselinux/matchpathcon-in-chroot-env/runtest.sh index 5e74132..5a98804 100755 --- a/libselinux/matchpathcon-in-chroot-env/runtest.sh +++ b/libselinux/matchpathcon-in-chroot-env/runtest.sh @@ -40,13 +40,10 @@ fi if yum install --help | grep -q skip-unavailable ; then INSTALL_OPTION="${INSTALL_OPTION} --skip-unavailable" fi -# yum sometimes fails to detect the release version on CentOS 9 -if rlIsCentOS 9 ; then - INSTALL_OPTION="${INSTALL_OPTION} --releasever 9" -elif rlIsFedora ; then - RELEASEVER=`grep VERSION_ID /etc/os-release | cut -d = -f 2` - INSTALL_OPTION="${INSTALL_OPTION} --releasever ${RELEASEVER}" -fi +# detect release version +test -e /etc/os-release && os_release='/etc/os-release' || os_release='/usr/lib/os-release' +. "${os_release}" +INSTALL_OPTION="${INSTALL_OPTION} --releasever ${VERSION_ID}" rlJournalStart rlPhaseStartSetup From 1213f7b91d59c29e91d91a5f2b35d66823561270 Mon Sep 17 00:00:00 2001 From: Veronika Syncakova Date: Mon, 20 Jul 2026 11:09:39 +0200 Subject: [PATCH 614/626] Fix fail during install in /libselinux/setfiles-in-chroot-env If epel is present, the release version was not detected. --- libselinux/setfiles-in-chroot-env/runtest.sh | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) diff --git a/libselinux/setfiles-in-chroot-env/runtest.sh b/libselinux/setfiles-in-chroot-env/runtest.sh index a7ecb83..0ddda9b 100755 --- a/libselinux/setfiles-in-chroot-env/runtest.sh +++ b/libselinux/setfiles-in-chroot-env/runtest.sh @@ -40,13 +40,10 @@ fi if yum install --help | grep -q skip-unavailable ; then INSTALL_OPTION="${INSTALL_OPTION} --skip-unavailable" fi -# yum sometimes fails to detect the release version on CentOS 9 -if rlIsCentOS 9 ; then - INSTALL_OPTION="${INSTALL_OPTION} --releasever 9" -elif rlIsFedora ; then - RELEASEVER=`grep VERSION_ID /etc/os-release | cut -d = -f 2` - INSTALL_OPTION="${INSTALL_OPTION} --releasever ${RELEASEVER}" -fi +# detect release version +test -e /etc/os-release && os_release='/etc/os-release' || os_release='/usr/lib/os-release' +. "${os_release}" +INSTALL_OPTION="${INSTALL_OPTION} --releasever ${VERSION_ID}" rlJournalStart rlPhaseStartSetup From 39d1965d56a2fca530f3cdc4bbd46c03e8d7320d Mon Sep 17 00:00:00 2001 From: Veronika Syncakova Date: Mon, 15 Jun 2026 15:32:47 +0200 Subject: [PATCH 615/626] Fix to accommodate the new attribute sys_resource_type Allow the sys_resource capability to each domain which is allowed to execute generic programs in system bin directories without domain transition when the coreutils_bin_sys_resource tunable is on. If the tunable is off, which is the default state, the capability is dontaudited instead. This test was nout counting with dontaudit rule beforehand. No avc will be present if the tunable is off. --- selinux-policy/coreutils-single/main.fmf | 3 --- selinux-policy/coreutils-single/runtest.sh | 13 ++----------- 2 files changed, 2 insertions(+), 14 deletions(-) diff --git a/selinux-policy/coreutils-single/main.fmf b/selinux-policy/coreutils-single/main.fmf index 76b94bd..4c4188f 100644 --- a/selinux-policy/coreutils-single/main.fmf +++ b/selinux-policy/coreutils-single/main.fmf @@ -19,9 +19,6 @@ recommend: - selinux-policy-targeted environment: AVC_ERROR: +no_avc_check -check: - - how: avc - result: xfail duration: 10m enabled: true tag: diff --git a/selinux-policy/coreutils-single/runtest.sh b/selinux-policy/coreutils-single/runtest.sh index 5db41ac..743b295 100755 --- a/selinux-policy/coreutils-single/runtest.sh +++ b/selinux-policy/coreutils-single/runtest.sh @@ -18,11 +18,10 @@ rlJournalStart rlAssertRpm ${PACKAGE} rlSESetEnforce rlSEStatus - rlSESetTimestamp "General" + rlSESetTimestamp rlPhaseEnd rlPhaseStartTest "RHEL-141858" - rlSESetTimestamp "No_AVC" # Boolean and rule exists rlRun "getsebool -a | grep ${BOOLEAN}" rlSESearchRule "allow NetworkManager_dispatcher_chronyc_t self:capability {sys_resource} [ ${BOOLEAN} ]" @@ -32,18 +31,10 @@ rlJournalStart rlSEBooleanOn ${BOOLEAN} rlRun "nmcli connection up ${INTERFACE_NAME}" sleep 5 - rlSECheckAVC "No_AVC" - - # AVC present when boolean is off - rlSESetTimestamp "Trigger_AVC" - rlRun "setsebool ${BOOLEAN} off" - rlRun "nmcli connection up ${INTERFACE_NAME}" - sleep 5 - rlRun 'rlSEAVCCheck "Trigger_AVC"' 1 rlPhaseEnd rlPhaseStartCleanup - rlSECheckAVC --ignore "type=AVC .* denied .* sys_resource .*:NetworkManager_dispatcher.* " "General" + rlSECheckAVC rlSEBooleanRestore ${BOOLEAN} if [ "$INSTALLED_VARIANT" = "regular" ]; then rlRun "yum -y install coreutils --allowerasing" From d5072cf5edd612760c73364cf7c33d2930b61473 Mon Sep 17 00:00:00 2001 From: Veronika Syncakova Date: Thu, 28 May 2026 15:20:38 +0200 Subject: [PATCH 616/626] Test if crashing process in a nspawn container triggers an AVC denial. If a process crashes in an nspawn container started either via machinectl start or systemd-nspawn -bD ... it triggers an AVC denial, even if the container is under /var/lib/machines/. Tests RHEL-139983 --- .../systemd-nspawn-coredump/main.fmf | 26 ++++++++ .../systemd-nspawn-coredump/runtest.sh | 59 +++++++++++++++++++ 2 files changed, 85 insertions(+) create mode 100644 selinux-policy/systemd-nspawn-coredump/main.fmf create mode 100755 selinux-policy/systemd-nspawn-coredump/runtest.sh diff --git a/selinux-policy/systemd-nspawn-coredump/main.fmf b/selinux-policy/systemd-nspawn-coredump/main.fmf new file mode 100644 index 0000000..b183587 --- /dev/null +++ b/selinux-policy/systemd-nspawn-coredump/main.fmf @@ -0,0 +1,26 @@ +summary: SELinux interferes with coredump access in systemd-nspawn containers +description: |+ + Test for RHEL-139983 - coredump directory access in systemd-nspawn containers + +contact: Veronika Syncakova +component: + - selinux-policy +require: + - library(selinux-policy/common) + - systemd + - systemd-container +recommend: + - audit + - libselinux + - setools-console +environment: + AVC_ERROR: +no_avc_check +duration: 15m +enabled: true +tag: + - NoRHEL8 +link: + - verifies: https://redhat.atlassian.net/browse/RHEL-139983 +adjust+: + - enabled: false + when: distro < rhel-9 diff --git a/selinux-policy/systemd-nspawn-coredump/runtest.sh b/selinux-policy/systemd-nspawn-coredump/runtest.sh new file mode 100755 index 0000000..f59d945 --- /dev/null +++ b/selinux-policy/systemd-nspawn-coredump/runtest.sh @@ -0,0 +1,59 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k + +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +INSTALL_OPTION="" +if dnf --help | grep -q use-host-config ; then + INSTALL_OPTION="${INSTALL_OPTION} --use-host-config" +fi +if dnf install --help | grep -q skip-broken ; then + INSTALL_OPTION="${INSTALL_OPTION} --skip-broken" +fi +if dnf install --help | grep -q skip-unavailable ; then + INSTALL_OPTION="${INSTALL_OPTION} --skip-unavailable" +fi + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlAssertRpm ${PACKAGE} + rlAssertRpm systemd-container + rlSESetEnforce + rlSESetTimestamp + rlPhaseEnd + + rlPhaseStartTest "RHEL-139983" + rlRun "mkdir -p /var/lib/machines/foo" + rlRun "dnf install -y --installroot /var/lib/machines/foo --nogpgcheck systemd-udev ${INSTALL_OPTION}" + + rlRun "systemd-nspawn -bD /var/lib/machines/foo >/dev/null 2>&1 &" + sleep 2 + rlRun -s "systemd-run -q --wait --pipe -M foo ls -lZ /run/systemd/coredump 2>&1" + rlAssertNotGrep "user_tmp_t" "$rlRun_LOG" -i + # Crash should not cause coredump avc + rlRun "systemd-run -q --wait --pipe -M foo bash -xc 'kill -SEGV \$\$\$\$'" 1-255 + rlRun "machinectl terminate foo" + sleep 2 + rlRun "rm -f /run/systemd/machines/foo" + sleep 2 + + # Same scenario but container started with machinectl + rlRun "machinectl start foo" + sleep 2 + rlRun -s "systemd-run -q --wait --pipe -M foo ls -lZ /run/systemd/coredump 2>&1" + rlAssertNotGrep "tmpfs_t" "$rlRun_LOG" -i + rlRun "systemd-run -q --wait --pipe -M foo bash -xc 'kill -SEGV \$\$\$\$'" 1-255 + rlRun "machinectl terminate foo" + sleep 2 + rlRun "rm -f /run/systemd/machines/foo" + rlRun "rm -rf /var/lib/machines/foo" + rm -f $rlRun_LOG + rlPhaseEnd + + rlPhaseStartCleanup + rlSECheckAVC + rlPhaseEnd +rlJournalPrintText +rlJournalEnd From 5cc4776f3bd646657718ba6d4af2c4ab5b9075d8 Mon Sep 17 00:00:00 2001 From: Veronika Syncakova Date: Thu, 14 May 2026 14:06:00 +0200 Subject: [PATCH 617/626] Test that rhsmcertd have access to gconf_home_t site-packages Test case for RHEL-106483 --- selinux-policy/rhsmcertd-and-similar/main.fmf | 28 +++++++++++++ .../rhsmcertd-and-similar/runtest.sh | 41 +++++++++++++++++++ 2 files changed, 69 insertions(+) create mode 100644 selinux-policy/rhsmcertd-and-similar/main.fmf create mode 100755 selinux-policy/rhsmcertd-and-similar/runtest.sh diff --git a/selinux-policy/rhsmcertd-and-similar/main.fmf b/selinux-policy/rhsmcertd-and-similar/main.fmf new file mode 100644 index 0000000..283c71f --- /dev/null +++ b/selinux-policy/rhsmcertd-and-similar/main.fmf @@ -0,0 +1,28 @@ +summary: Test that rhsmcertd have access to gconf_home_t site-packages +description: |+ + rhsmcertd is denied read access to /root/.local/lib/pythonX.Y/site-packages/ + which has gconf_home_t context. This occurs when user runs 'pip install --user' from root. + +contact: Veronika Syncakova +component: + - selinux-policy +require: + - library(selinux-policy/common) +recommend: + - audit + - selinux-policy + - python3 + - python3-pip +duration: 15m +enabled: true +tag: + - NoRHEL7 + - NoRHEL8 +environment: + AVC_ERROR: +no_avc_check +link: + - verifies: https://redhat.atlassian.net/browse/RHEL-106483 +adjust+: + - enabled: false + when: distro < rhel-9 + continue: false diff --git a/selinux-policy/rhsmcertd-and-similar/runtest.sh b/selinux-policy/rhsmcertd-and-similar/runtest.sh new file mode 100755 index 0000000..82942d5 --- /dev/null +++ b/selinux-policy/rhsmcertd-and-similar/runtest.sh @@ -0,0 +1,41 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k + +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0 + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + + rlSESetTimestamp + + # Install required packages + rlRun "dnf install -y python3-pip" 0 + rlFileBackup --clean /root/.local + rlPhaseEnd + + rlPhaseStartTest "RHEL-106483" + # Create /root/.local/lib/pythonX.Y/site-packages/ with gconf_home_t context + rlRun "pip3 install --user abcd" 0 "pip install creates site-packages" + SITE_PACKAGES=$(find /root/.local/lib -type d -name "site-packages" 2>/dev/null | head -1) + rlAssertExists "${SITE_PACKAGES}" + + # Set SELinux to permissive to log AVCs without blocking + rlRun "setenforce 0" 0 "Set SELinux to permissive mode" + rlRun "runcon -t rhsmcertd_t -r system_r -u system_u -- /usr/bin/python3 -c 'import sys'" 0 + rlPhaseEnd + + rlPhaseStartCleanup + # Restore backed up files (removes /root/.local if it didn't exist before) + rlFileRestore + rlSECheckAVC --ignore 'type=AVC .* entrypoint .*runcon .*:rhsmcertd_t:' + # Restore SELinux to enforcing mode + rlRun "setenforce 1" 0 "Restore SELinux to enforcing mode" + + rlPhaseEnd + +rlJournalEnd From e5badb50c67376aa32c227fbeee67e00e9202c42 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Thu, 23 Jul 2026 17:40:46 +0200 Subject: [PATCH 618/626] add a new basic test which covers the qat service Recently filed bug reports revealed that SELinux prevents the qat_init.sh process from the following actions: * accessing (syscall = newfstatat) the /dev/hugepages directory * creating (syscall = mkdir) the /dev/hugepages/qat directory * setting permissions/ownership (syscall = fchownat) The TC reproduces the situation. In order to support the qat service functionality, I believe that SELinux policy should allow these actions. The TC looks for appropriate policy rules and file context patterns. The TC covers RHEL-211077 and RHEL-211089. --- .../qat-service-and-similar/main.fmf | 49 +++++++++++ .../qat-service-and-similar/runtest.sh | 88 +++++++++++++++++++ 2 files changed, 137 insertions(+) create mode 100644 selinux-policy/qat-service-and-similar/main.fmf create mode 100755 selinux-policy/qat-service-and-similar/runtest.sh diff --git a/selinux-policy/qat-service-and-similar/main.fmf b/selinux-policy/qat-service-and-similar/main.fmf new file mode 100644 index 0000000..0accdbb --- /dev/null +++ b/selinux-policy/qat-service-and-similar/main.fmf @@ -0,0 +1,49 @@ +summary: SELinux interferes with qatlib and related programs +description: |+ + SELinux interferes with qatlib and related programs. + +contact: Milos Malik +component: + - qatlib + - selinux-policy +test: ./runtest.sh +framework: beakerlib +require: + - type: library + name: /selinux-policy/Library/common + nick: selinux-policy +recommend: + - audit + - libselinux + - libselinux-utils + - policycoreutils + - selinux-policy + - selinux-policy-targeted + - setools-console + - qatlib + - qatlib-service + - /usr/sbin/service +environment: + AVC_ERROR: +no_avc_check +duration: 10m +enabled: true +tag: + - NoRHEL4 + - NoRHEL5 + - NoRHEL6 + - NoRHEL7 + - targeted + - NoRHIVOS +link: + - verifies: https://issues.redhat.com/browse/RHEL-211077 + - verifies: https://issues.redhat.com/browse/RHEL-211089 +adjust+: + - enabled: false + when: distro == rhel-4, rhel-5, rhel-6, rhel-7 + because: the qatlib package is not available there + - enabled: false + when: arch == aarch64, ppc64le, s390x + because: the qatlib package is not available there +extra-summary: /CoreOS/selinux-policy/Regression/qat-service-and-similar +extra-task: /CoreOS/selinux-policy/Regression/qat-service-and-similar + diff --git a/selinux-policy/qat-service-and-similar/runtest.sh b/selinux-policy/qat-service-and-similar/runtest.sh new file mode 100755 index 0000000..f52788b --- /dev/null +++ b/selinux-policy/qat-service-and-similar/runtest.sh @@ -0,0 +1,88 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Regression/qat-service-and-similar +# Description: SELinux interferes qatlib and related programs +# Author: Milos Malik +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2026 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, see +# . +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +FILE_PATH="/usr/bin/qat_init.sh" +SERVICE_NAME="qat" +PROCESS_NAME="qat_init.sh" +if seinfo -t | grep -q qatlib ; then + FILE_CONTEXT="qatlib_exec_t" + PROCESS_CONTEXT="qatlib_t" +else + FILE_CONTEXT="bin_t" + PROCESS_CONTEXT="unconfined_service_t" +fi + +rlJournalStart + rlPhaseStartSetup + rlRun "rlImport 'selinux-policy/common'" 0,1 + rlAssertRpm ${PACKAGE} + rlAssertRpm ${PACKAGE}-targeted + rlRun "rpm -qf ${FILE_PATH}" + + rlServiceStop ${SERVICE_NAME} + + rlSESetEnforce + rlSEStatus + rlSESetTimestamp + sleep 2 + rlPhaseEnd + + if rlSEDefined ${PROCESS_CONTEXT} ; then + rlPhaseStartTest "RHEL-211077" + rlSEMatchPathCon ${FILE_PATH} ${FILE_CONTEXT} + rlSEMatchPathCon "/dev/hugepages" "hugetlbfs_t" + rlSESearchRule "allow qatlib_t hugetlbfs_t : dir { getattr } [ ]" + rlPhaseEnd + + rlPhaseStartTest "RHEL-211089" + rlSEMatchPathCon "/dev/hugepages/qat" "hugetlbfs_t" + rlSESearchRule "allow qatlib_t hugetlbfs_t : dir { search create add_name write setattr } [ ]" + rlPhaseEnd + fi + + if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then + rlPhaseStartTest "real scenario -- standalone service" + rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "start status" 1 + rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255 + rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "restart status" 1 + rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "stop status" 1 + rlPhaseEnd + fi + + rlPhaseStartCleanup + sleep 2 + rlSECheckAVC + + rlServiceRestore ${SERVICE_NAME} + rlPhaseEnd +rlJournalPrintText +rlJournalEnd + From 6235e6ffdd3296ffcb482559a8b865a1c4d47270 Mon Sep 17 00:00:00 2001 From: Zdenek Pytela Date: Mon, 27 Jul 2026 11:50:36 +0200 Subject: [PATCH 619/626] Changes adapting to bind packages with suffixes The bind package now provides executables with suffixes, e.g. "/usr/bin/named-9.18". That includes the main daemon named, rndc and other tools. Links to the actual executables are provided using the alternatives tool. Subsequently, the named test is now being updated using the readlink command to get canonical file names. --- .../runtest.sh | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/selinux-policy/bz562833-chrooted-named-file-contexts/runtest.sh b/selinux-policy/bz562833-chrooted-named-file-contexts/runtest.sh index 074f2bb..bb3a8d5 100755 --- a/selinux-policy/bz562833-chrooted-named-file-contexts/runtest.sh +++ b/selinux-policy/bz562833-chrooted-named-file-contexts/runtest.sh @@ -50,7 +50,7 @@ rlJournalStart rlPhaseEnd rlPhaseStartTest "bz#451970" - rlSEMatchPathCon "/usr/sbin/named" "named_exec_t" + rlSEMatchPathCon "$(readlink -en /usr/sbin/named)" "named_exec_t" rlSESearchRule "allow named_t port_t : udp_socket { name_bind }" rlPhaseEnd @@ -70,7 +70,7 @@ rlJournalStart rlPhaseEnd rlPhaseStartTest "bz#578187" - rlSEMatchPathCon "/usr/sbin/named" "named_exec_t" + rlSEMatchPathCon "$(readlink -en /usr/sbin/named)" "named_exec_t" for PREFIX in "" "/var/named/chroot" ; do rlSEMatchPathCon "${PREFIX}/var/named/dynamic" "named_cache_t" done @@ -78,7 +78,7 @@ rlJournalStart rlPhaseEnd rlPhaseStartTest "bz#698257" - rlSEMatchPathCon "/usr/sbin/named" "named_exec_t" + rlSEMatchPathCon "$(readlink -en /usr/sbin/named)" "named_exec_t" if rlIsRHEL 5 ; then rlSEMatchPathCon "/var/named/chroot/var/log/update-debug.log" "named_log_t" fi @@ -87,7 +87,7 @@ rlJournalStart if ! rlIsRHEL 5 ; then rlPhaseStartTest "bz#739886" - rlSEMatchPathCon "/usr/sbin/rndc" "ndc_exec_t" + rlSEMatchPathCon "$(readlink -en /usr/sbin/rndc)" "ndc_exec_t" rlRun "ls -Z /proc/loadavg | grep :proc_t" rlSESearchRule "allow ndc_t proc_t : file { getattr open read }" rlPhaseEnd @@ -103,7 +103,7 @@ rlJournalStart rlPhaseEnd rlPhaseStartTest "bz#1110397 + bz#1166281" - rlSEMatchPathCon "/usr/sbin/rndc" "ndc_exec_t" + rlSEMatchPathCon "$(readlink -en /usr/sbin/rndc)" "ndc_exec_t" rlSEMatchPathCon "/dev/random" "random_device_t" rlSEMatchPathCon "/dev/urandom" "urandom_device_t" rlSESearchRule "allow ndc_t random_device_t : chr_file { getattr open read }" @@ -117,7 +117,7 @@ rlJournalStart rlPhaseEnd rlPhaseStartTest "bz#1103439 + bz#1199473" - rlSEMatchPathCon "/usr/sbin/named" "named_exec_t" + rlSEMatchPathCon "$(readlink -en /usr/sbin/named)" "named_exec_t" rlSEMatchPortCon udp 1935 flash_port_t rlSEMatchPortCon udp 2605 bgp_port_t rlSEMatchPortCon udp 4321 whois_port_t @@ -141,7 +141,7 @@ rlJournalStart if ! rlIsRHEL 5 6 ; then rlPhaseStartTest "bz#1012051" - rlSEMatchPathCon "/usr/sbin/named" "named_exec_t" + rlSEMatchPathCon "$(readlink -en /usr/sbin/named)" "named_exec_t" rlSESearchRule "allow named_t named_t : key { read write }" rlPhaseEnd @@ -203,7 +203,7 @@ rlJournalStart if ! rlIsRHEL 5 6 7 8 && ! rlIsCentOS 5 6 7 8 ; then rlPhaseStartTest "bz#1827591 + bz#1923929" - rlSEMatchPathCon "/usr/sbin/rndc" "ndc_exec_t" + rlSEMatchPathCon "$(readlink -en /usr/sbin/rndc)" "ndc_exec_t" rlSESearchRule "dontaudit ndc_t ndc_t : process { setsched } [ ]" rlPhaseEnd fi From b1a11e8d06d27adb4a9347c852a6bbcad8891530 Mon Sep 17 00:00:00 2001 From: Zdenek Pytela Date: Mon, 27 Jul 2026 13:20:18 +0200 Subject: [PATCH 620/626] Change default context for /var/named The selinux-policy commit adding support for bind packages with suffixes also changes default context for /var/named and adds a few more explicit entries. This test update makes an adjustment to the current state. --- .../runtest.sh | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/selinux-policy/bz562833-chrooted-named-file-contexts/runtest.sh b/selinux-policy/bz562833-chrooted-named-file-contexts/runtest.sh index bb3a8d5..7df24ef 100755 --- a/selinux-policy/bz562833-chrooted-named-file-contexts/runtest.sh +++ b/selinux-policy/bz562833-chrooted-named-file-contexts/runtest.sh @@ -55,6 +55,20 @@ rlJournalStart rlPhaseEnd rlPhaseStartTest "bz#562833" + if rlIsRHEL ">=11.0" || rlIsCentOS ">=11.0" || rlIsFedora ">=45" ; then + for PREFIX in "" "/var/named/chroot" ; do + rlSEMatchPathCon "${PREFIX}/dev/null" "null_device_t" + rlSEMatchPathCon "${PREFIX}/dev/random" "random_device_t" + rlSEMatchPathCon "${PREFIX}/dev/zero" "zero_device_t" + rlSEMatchPathCon "${PREFIX}/etc/named.conf" "named_conf_t" + rlSEMatchPathCon "${PREFIX}/run/named" "named_var_run_t" + rlSEMatchPathCon "${PREFIX}/var/log" "var_log_t" + rlSEMatchPathCon "${PREFIX}/var/log/named.log" "named_log_t" + rlSEMatchPathCon "${PREFIX}/var/named/data" "named_cache_t" + rlSEMatchPathCon "${PREFIX}/var/named/slaves" "named_cache_t" + rlSEMatchPathCon "${PREFIX}/var/named" "named_cache_t" + done + else for PREFIX in "" "/var/named/chroot" ; do rlSEMatchPathCon "${PREFIX}/dev/null" "null_device_t" rlSEMatchPathCon "${PREFIX}/dev/random" "random_device_t" @@ -67,6 +81,7 @@ rlJournalStart rlSEMatchPathCon "${PREFIX}/var/named/slaves" "named_cache_t" rlSEMatchPathCon "${PREFIX}/var/named" "named_zone_t" done + fi rlPhaseEnd rlPhaseStartTest "bz#578187" From e7ec6c814805663203a45a0431e9ed8f9679e778 Mon Sep 17 00:00:00 2001 From: Ondrej Mosnacek Date: Mon, 10 Aug 2026 12:04:35 +0200 Subject: [PATCH 621/626] kernel/avc_tracepoint: fix to work on AWS Graviton3 CPUs The --call-graph dwarf argument requires hardware fetures that may not be implemented on some platforms (e.g. aarch64 AWS Graviton3 CPUs). Use just plain -g instead, which will hopefully work anywhere. The stack trace doesn't really matter that much anyway, as we are just testing that the tracepoint is available and working. Signed-off-by: Ondrej Mosnacek --- kernel/avc_tracepoint/runtest.sh | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/kernel/avc_tracepoint/runtest.sh b/kernel/avc_tracepoint/runtest.sh index d5f292f..2700548 100755 --- a/kernel/avc_tracepoint/runtest.sh +++ b/kernel/avc_tracepoint/runtest.sh @@ -15,8 +15,7 @@ rlJournalStart rlPhaseStartTest rlAssertExists /sys/kernel/tracing/events/avc/selinux_audited/enable rlRun "perf list | grep avc:selinux_audited" - rlRun "perf record -o perf.data -e avc:selinux_audited \ - -g --call-graph dwarf \ + rlRun "perf record -o perf.data -e avc:selinux_audited -g \ runcon system_u:system_r:kernel_t:s0 echo" 0-255 rlRun "perf script -i perf.data" rlAssertGreater "'perf script' output should have more than 0 lines" \ From 712c3f71d38b5d25b2a7a76c820d4c113aa4bb28 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Fri, 7 Aug 2026 16:19:43 +0200 Subject: [PATCH 622/626] set immutable bit on the restorecond PID file The restorecond service does not really need its PID file, which means that neither the systemd process nor the restorecond process should create it or remove it. Removal attempts are detected, because the test sets the immutable bit on the PID file and then it looks for timeout messages in journal. --- policycoreutils/restorecond-service-timeouts/main.fmf | 2 ++ policycoreutils/restorecond-service-timeouts/runtest.sh | 7 +++++-- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/policycoreutils/restorecond-service-timeouts/main.fmf b/policycoreutils/restorecond-service-timeouts/main.fmf index bd454be..64b970e 100644 --- a/policycoreutils/restorecond-service-timeouts/main.fmf +++ b/policycoreutils/restorecond-service-timeouts/main.fmf @@ -4,6 +4,7 @@ contact: Milos Malik component: - policycoreutils recommend: + - e2fsprogs - policycoreutils - policycoreutils-restorecond duration: 5m @@ -27,4 +28,5 @@ adjust: - enabled: false when: distro == rhel-8, centos-stream-8 because: the bug is not yet fixed there +id: 24e8b000-43ab-4db7-8066-502cfc6ec48a diff --git a/policycoreutils/restorecond-service-timeouts/runtest.sh b/policycoreutils/restorecond-service-timeouts/runtest.sh index 0857ea2..d0e2058 100755 --- a/policycoreutils/restorecond-service-timeouts/runtest.sh +++ b/policycoreutils/restorecond-service-timeouts/runtest.sh @@ -12,18 +12,21 @@ rlJournalStart rlPhaseStartTest "RHEL-142541 + RHEL-165247" rlRun "grep ^Type=simple /usr/lib/systemd/system/restorecond.service" rlRun "touch /run/restorecond.pid" - rlRun "ls -lZ /run/restorecond.pid" - rlRun "ls -lZ /run/restorecond.pid | grep :var_run_t" + rlRun "chattr +i /run/restorecond.pid" rlRun "systemctl start restorecond.service" sleep 2 rlRun -s "systemctl status restorecond.service -l" rlRun "grep -i -e '/run/restorecond.pid' -e 'failed.*timeout' $rlRun_LOG" 1 rm -f $rlRun_LOG + + rlRun "chattr -i /run/restorecond.pid" + rlRun "rm -f /run/restorecond.pid" rlRun "systemctl restart restorecond.service" sleep 2 rlRun -s "systemctl status restorecond.service -l" rlRun "grep -i -e '/run/restorecond.pid' -e 'failed.*timeout' $rlRun_LOG" 1 rm -f $rlRun_LOG + rlAssertNotExists /run/restorecond.pid rlPhaseEnd rlPhaseStartCleanup From 6ed096cf7f92ee789974f23f209c07348039cea3 Mon Sep 17 00:00:00 2001 From: Akhil Kohli Date: Tue, 11 Aug 2026 11:39:26 +0000 Subject: [PATCH 623/626] selinux-policy/m4-bad-data: add M4 bad-data tests for modular policy builds Add beakerlib/TMT coverage and fixtures for M4 preprocessing of modular policy builds: .if to all_interfaces.conf, .te + interfaces to .tmp (then checkmodule), and .fc to .mod.fc, using live support macros from a selinux-policy checkout and a snapshotted modular M4 recipe. 33 test cases (42 harness pass steps) with minimal standalone fixtures. Each case is its own rlRun phase in runtest.sh. Covers interface path validation (including duplicates and broken gen_require), .te arity edge cases, post-M4 checkmodule failures from bad interface expansion, .fc path edge cases, M4-to-semodule_package E2E, and .fc content where labeling validation is deferred to sefcontext_compile. When SELINUX_POLICY_SRC is unset, clones fedora-selinux/selinux-policy using a host-detected branch (f$VERSION_ID on Fedora, c${major}s otherwise), overridable with SELINUX_POLICY_BRANCH. Signed-off-by: Akhil Kohli --- selinux-policy/m4-bad-data/PURPOSE | 10 + .../fixtures/file_contexts/bad_context.fc | 1 + .../fixtures/file_contexts/bad_fields.fc | 1 + .../fixtures/file_contexts/bad_m4_syntax.fc | 1 + .../fixtures/file_contexts/bad_no_context.fc | 1 + .../fixtures/file_contexts/bad_regex.fc | 1 + .../fixtures/file_contexts/good.fc | 1 + .../fixtures/interfaces/bad_duplicate.if | 6 + .../fixtures/interfaces/bad_empty_ifname.if | 3 + .../fixtures/interfaces/bad_garbage.if | 3 + .../fixtures/interfaces/bad_gen_if_build.if | 3 + .../fixtures/interfaces/bad_gen_require.if | 4 + .../fixtures/interfaces/bad_m4_syntax.if | 1 + .../fixtures/interfaces/bad_module_line.if | 3 + .../fixtures/interfaces/bad_trunc.if | 3 + .../fixtures/interfaces/bad_unclosed.if | 3 + .../fixtures/interfaces/bad_unknown_perm.if | 4 + .../fixtures/interfaces/bad_unknown_type.if | 3 + .../m4-bad-data/fixtures/interfaces/good.if | 4 + .../fixtures/interfaces/needs_arg.if | 4 + .../fixtures/modules/te_bad_module_line.te | 8 + .../fixtures/modules/te_few_args.te | 8 + .../fixtures/modules/te_garbage.te | 8 + .../fixtures/modules/te_gen_require.te | 8 + .../m4-bad-data/fixtures/modules/te_good.te | 8 + .../fixtures/modules/te_many_args.te | 8 + .../m4-bad-data/fixtures/modules/te_trunc.te | 8 + .../fixtures/modules/te_unknown_perm.te | 8 + .../fixtures/modules/te_unknown_type.te | 8 + selinux-policy/m4-bad-data/main.fmf | 18 + selinux-policy/m4-bad-data/runtest.sh | 379 ++++++++++++++++++ 31 files changed, 529 insertions(+) create mode 100644 selinux-policy/m4-bad-data/PURPOSE create mode 100644 selinux-policy/m4-bad-data/fixtures/file_contexts/bad_context.fc create mode 100644 selinux-policy/m4-bad-data/fixtures/file_contexts/bad_fields.fc create mode 100644 selinux-policy/m4-bad-data/fixtures/file_contexts/bad_m4_syntax.fc create mode 100644 selinux-policy/m4-bad-data/fixtures/file_contexts/bad_no_context.fc create mode 100644 selinux-policy/m4-bad-data/fixtures/file_contexts/bad_regex.fc create mode 100644 selinux-policy/m4-bad-data/fixtures/file_contexts/good.fc create mode 100644 selinux-policy/m4-bad-data/fixtures/interfaces/bad_duplicate.if create mode 100644 selinux-policy/m4-bad-data/fixtures/interfaces/bad_empty_ifname.if create mode 100644 selinux-policy/m4-bad-data/fixtures/interfaces/bad_garbage.if create mode 100644 selinux-policy/m4-bad-data/fixtures/interfaces/bad_gen_if_build.if create mode 100644 selinux-policy/m4-bad-data/fixtures/interfaces/bad_gen_require.if create mode 100644 selinux-policy/m4-bad-data/fixtures/interfaces/bad_m4_syntax.if create mode 100644 selinux-policy/m4-bad-data/fixtures/interfaces/bad_module_line.if create mode 100644 selinux-policy/m4-bad-data/fixtures/interfaces/bad_trunc.if create mode 100644 selinux-policy/m4-bad-data/fixtures/interfaces/bad_unclosed.if create mode 100644 selinux-policy/m4-bad-data/fixtures/interfaces/bad_unknown_perm.if create mode 100644 selinux-policy/m4-bad-data/fixtures/interfaces/bad_unknown_type.if create mode 100644 selinux-policy/m4-bad-data/fixtures/interfaces/good.if create mode 100644 selinux-policy/m4-bad-data/fixtures/interfaces/needs_arg.if create mode 100644 selinux-policy/m4-bad-data/fixtures/modules/te_bad_module_line.te create mode 100644 selinux-policy/m4-bad-data/fixtures/modules/te_few_args.te create mode 100644 selinux-policy/m4-bad-data/fixtures/modules/te_garbage.te create mode 100644 selinux-policy/m4-bad-data/fixtures/modules/te_gen_require.te create mode 100644 selinux-policy/m4-bad-data/fixtures/modules/te_good.te create mode 100644 selinux-policy/m4-bad-data/fixtures/modules/te_many_args.te create mode 100644 selinux-policy/m4-bad-data/fixtures/modules/te_trunc.te create mode 100644 selinux-policy/m4-bad-data/fixtures/modules/te_unknown_perm.te create mode 100644 selinux-policy/m4-bad-data/fixtures/modules/te_unknown_type.te create mode 100644 selinux-policy/m4-bad-data/main.fmf create mode 100755 selinux-policy/m4-bad-data/runtest.sh diff --git a/selinux-policy/m4-bad-data/PURPOSE b/selinux-policy/m4-bad-data/PURPOSE new file mode 100644 index 0000000..ea14daa --- /dev/null +++ b/selinux-policy/m4-bad-data/PURPOSE @@ -0,0 +1,10 @@ +PURPOSE of /CoreOS/selinux-policy/Sanity/m4-bad-data +Author: Akhil Kohli + +Description: Negative bad-data tests for the M4 preprocessing stage of modular +SELinux policy builds (.if, .te, and .fc inputs before checkmodule). + +Execution is via FMF/TMT (main.fmf -> runtest.sh) using beakerlib rlRun +phases. Support macros prefer SELINUX_POLICY_SRC, else installed +selinux-policy-devel (/usr/share/selinux/devel/include/support), else a +git clone (Fedora falls back to rawhide when f$N is missing). diff --git a/selinux-policy/m4-bad-data/fixtures/file_contexts/bad_context.fc b/selinux-policy/m4-bad-data/fixtures/file_contexts/bad_context.fc new file mode 100644 index 0000000..06aec43 --- /dev/null +++ b/selinux-policy/m4-bad-data/fixtures/file_contexts/bad_context.fc @@ -0,0 +1 @@ +/usr/bin/bad not_a_valid_selinux_context diff --git a/selinux-policy/m4-bad-data/fixtures/file_contexts/bad_fields.fc b/selinux-policy/m4-bad-data/fixtures/file_contexts/bad_fields.fc new file mode 100644 index 0000000..13821d6 --- /dev/null +++ b/selinux-policy/m4-bad-data/fixtures/file_contexts/bad_fields.fc @@ -0,0 +1 @@ +only_one_field_on_this_line diff --git a/selinux-policy/m4-bad-data/fixtures/file_contexts/bad_m4_syntax.fc b/selinux-policy/m4-bad-data/fixtures/file_contexts/bad_m4_syntax.fc new file mode 100644 index 0000000..7f4dca9 --- /dev/null +++ b/selinux-policy/m4-bad-data/fixtures/file_contexts/bad_m4_syntax.fc @@ -0,0 +1 @@ +divert(-1 diff --git a/selinux-policy/m4-bad-data/fixtures/file_contexts/bad_no_context.fc b/selinux-policy/m4-bad-data/fixtures/file_contexts/bad_no_context.fc new file mode 100644 index 0000000..7c14f2e --- /dev/null +++ b/selinux-policy/m4-bad-data/fixtures/file_contexts/bad_no_context.fc @@ -0,0 +1 @@ +/usr/bin/foo_only_path_no_context diff --git a/selinux-policy/m4-bad-data/fixtures/file_contexts/bad_regex.fc b/selinux-policy/m4-bad-data/fixtures/file_contexts/bad_regex.fc new file mode 100644 index 0000000..7c122e4 --- /dev/null +++ b/selinux-policy/m4-bad-data/fixtures/file_contexts/bad_regex.fc @@ -0,0 +1 @@ +/usr/bin/[unclosed(regex -- system_u:object_r:test_good_exec_t:s0 diff --git a/selinux-policy/m4-bad-data/fixtures/file_contexts/good.fc b/selinux-policy/m4-bad-data/fixtures/file_contexts/good.fc new file mode 100644 index 0000000..12b26ca --- /dev/null +++ b/selinux-policy/m4-bad-data/fixtures/file_contexts/good.fc @@ -0,0 +1 @@ +/usr/bin/test_good -- system_u:object_r:test_good_exec_t:s0 diff --git a/selinux-policy/m4-bad-data/fixtures/interfaces/bad_duplicate.if b/selinux-policy/m4-bad-data/fixtures/interfaces/bad_duplicate.if new file mode 100644 index 0000000..1e887a5 --- /dev/null +++ b/selinux-policy/m4-bad-data/fixtures/interfaces/bad_duplicate.if @@ -0,0 +1,6 @@ +interface(`dup_iface',` + type dup_t; +') +interface(`dup_iface',` + type dup2_t; +') diff --git a/selinux-policy/m4-bad-data/fixtures/interfaces/bad_empty_ifname.if b/selinux-policy/m4-bad-data/fixtures/interfaces/bad_empty_ifname.if new file mode 100644 index 0000000..536347f --- /dev/null +++ b/selinux-policy/m4-bad-data/fixtures/interfaces/bad_empty_ifname.if @@ -0,0 +1,3 @@ +interface(``,` + type empty_name_t; +') diff --git a/selinux-policy/m4-bad-data/fixtures/interfaces/bad_garbage.if b/selinux-policy/m4-bad-data/fixtures/interfaces/bad_garbage.if new file mode 100644 index 0000000..bbfd2f6 --- /dev/null +++ b/selinux-policy/m4-bad-data/fixtures/interfaces/bad_garbage.if @@ -0,0 +1,3 @@ +interface(`bad_garbage',` + @@@not_valid_selinux_or_m4@@@ +') diff --git a/selinux-policy/m4-bad-data/fixtures/interfaces/bad_gen_if_build.if b/selinux-policy/m4-bad-data/fixtures/interfaces/bad_gen_if_build.if new file mode 100644 index 0000000..02c4e15 --- /dev/null +++ b/selinux-policy/m4-bad-data/fixtures/interfaces/bad_gen_if_build.if @@ -0,0 +1,3 @@ +interface(`bad_gen_if_build',` + gen_require(`type $1 +') diff --git a/selinux-policy/m4-bad-data/fixtures/interfaces/bad_gen_require.if b/selinux-policy/m4-bad-data/fixtures/interfaces/bad_gen_require.if new file mode 100644 index 0000000..bbfa3a8 --- /dev/null +++ b/selinux-policy/m4-bad-data/fixtures/interfaces/bad_gen_require.if @@ -0,0 +1,4 @@ +interface(`bad_gen_require',` + gen_require(`type $1 class file { read };') + allow $1 self:file read; +') diff --git a/selinux-policy/m4-bad-data/fixtures/interfaces/bad_m4_syntax.if b/selinux-policy/m4-bad-data/fixtures/interfaces/bad_m4_syntax.if new file mode 100644 index 0000000..1d9bc85 --- /dev/null +++ b/selinux-policy/m4-bad-data/fixtures/interfaces/bad_m4_syntax.if @@ -0,0 +1 @@ +define(`broken_define' diff --git a/selinux-policy/m4-bad-data/fixtures/interfaces/bad_module_line.if b/selinux-policy/m4-bad-data/fixtures/interfaces/bad_module_line.if new file mode 100644 index 0000000..0111414 --- /dev/null +++ b/selinux-policy/m4-bad-data/fixtures/interfaces/bad_module_line.if @@ -0,0 +1,3 @@ +interface(`bad_module_line',` + module duplicate_module_line 1.0; +') diff --git a/selinux-policy/m4-bad-data/fixtures/interfaces/bad_trunc.if b/selinux-policy/m4-bad-data/fixtures/interfaces/bad_trunc.if new file mode 100644 index 0000000..8f5ed17 --- /dev/null +++ b/selinux-policy/m4-bad-data/fixtures/interfaces/bad_trunc.if @@ -0,0 +1,3 @@ +interface(`bad_trunc',` + gen_require(`type $1; class file { read };') + allow $1 self:file { diff --git a/selinux-policy/m4-bad-data/fixtures/interfaces/bad_unclosed.if b/selinux-policy/m4-bad-data/fixtures/interfaces/bad_unclosed.if new file mode 100644 index 0000000..7c377dd --- /dev/null +++ b/selinux-policy/m4-bad-data/fixtures/interfaces/bad_unclosed.if @@ -0,0 +1,3 @@ +interface(`bad_unclosed',` + gen_require(`type $1;') + allow $1 self:file read; diff --git a/selinux-policy/m4-bad-data/fixtures/interfaces/bad_unknown_perm.if b/selinux-policy/m4-bad-data/fixtures/interfaces/bad_unknown_perm.if new file mode 100644 index 0000000..94b83de --- /dev/null +++ b/selinux-policy/m4-bad-data/fixtures/interfaces/bad_unknown_perm.if @@ -0,0 +1,4 @@ +interface(`bad_unknown_perm',` + gen_require(`type $1; class file { read };') + allow $1 self:file circular_ref; +') diff --git a/selinux-policy/m4-bad-data/fixtures/interfaces/bad_unknown_type.if b/selinux-policy/m4-bad-data/fixtures/interfaces/bad_unknown_type.if new file mode 100644 index 0000000..710f141 --- /dev/null +++ b/selinux-policy/m4-bad-data/fixtures/interfaces/bad_unknown_type.if @@ -0,0 +1,3 @@ +interface(`bad_unknown_type',` + allow undeclared_type_t self:file read; +') diff --git a/selinux-policy/m4-bad-data/fixtures/interfaces/good.if b/selinux-policy/m4-bad-data/fixtures/interfaces/good.if new file mode 100644 index 0000000..bc5261d --- /dev/null +++ b/selinux-policy/m4-bad-data/fixtures/interfaces/good.if @@ -0,0 +1,4 @@ +interface(`test_good_iface',` + gen_require(`type $1; class file { read };') + allow $1 self:file read; +') diff --git a/selinux-policy/m4-bad-data/fixtures/interfaces/needs_arg.if b/selinux-policy/m4-bad-data/fixtures/interfaces/needs_arg.if new file mode 100644 index 0000000..00b619e --- /dev/null +++ b/selinux-policy/m4-bad-data/fixtures/interfaces/needs_arg.if @@ -0,0 +1,4 @@ +interface(`needs_arg',` + gen_require(`type $1; class file { read };') + allow $1 self:file read; +') diff --git a/selinux-policy/m4-bad-data/fixtures/modules/te_bad_module_line.te b/selinux-policy/m4-bad-data/fixtures/modules/te_bad_module_line.te new file mode 100644 index 0000000..c33368a --- /dev/null +++ b/selinux-policy/m4-bad-data/fixtures/modules/te_bad_module_line.te @@ -0,0 +1,8 @@ +module te_bad_mod 1.0; + +require { + type foo_t; + class file { read }; +} + +bad_module_line() diff --git a/selinux-policy/m4-bad-data/fixtures/modules/te_few_args.te b/selinux-policy/m4-bad-data/fixtures/modules/te_few_args.te new file mode 100644 index 0000000..7ac9436 --- /dev/null +++ b/selinux-policy/m4-bad-data/fixtures/modules/te_few_args.te @@ -0,0 +1,8 @@ +module te_few 1.0; + +require { + type foo_t; + class file { read }; +} + +needs_arg() diff --git a/selinux-policy/m4-bad-data/fixtures/modules/te_garbage.te b/selinux-policy/m4-bad-data/fixtures/modules/te_garbage.te new file mode 100644 index 0000000..cb7daf4 --- /dev/null +++ b/selinux-policy/m4-bad-data/fixtures/modules/te_garbage.te @@ -0,0 +1,8 @@ +module te_garbage 1.0; + +require { + type foo_t; + class file { read }; +} + +bad_garbage() diff --git a/selinux-policy/m4-bad-data/fixtures/modules/te_gen_require.te b/selinux-policy/m4-bad-data/fixtures/modules/te_gen_require.te new file mode 100644 index 0000000..8c84961 --- /dev/null +++ b/selinux-policy/m4-bad-data/fixtures/modules/te_gen_require.te @@ -0,0 +1,8 @@ +module te_gen_require 1.0; + +require { + type foo_t; + class file { read }; +} + +bad_gen_require(foo_t) diff --git a/selinux-policy/m4-bad-data/fixtures/modules/te_good.te b/selinux-policy/m4-bad-data/fixtures/modules/te_good.te new file mode 100644 index 0000000..753237a --- /dev/null +++ b/selinux-policy/m4-bad-data/fixtures/modules/te_good.te @@ -0,0 +1,8 @@ +module te_good 1.0; + +require { + type foo_t; + class file { read }; +} + +test_good_iface(foo_t) diff --git a/selinux-policy/m4-bad-data/fixtures/modules/te_many_args.te b/selinux-policy/m4-bad-data/fixtures/modules/te_many_args.te new file mode 100644 index 0000000..e481b8a --- /dev/null +++ b/selinux-policy/m4-bad-data/fixtures/modules/te_many_args.te @@ -0,0 +1,8 @@ +module te_many 1.0; + +require { + type foo_t; + class file { read }; +} + +needs_arg(foo_t, extra_unused) diff --git a/selinux-policy/m4-bad-data/fixtures/modules/te_trunc.te b/selinux-policy/m4-bad-data/fixtures/modules/te_trunc.te new file mode 100644 index 0000000..4f56f72 --- /dev/null +++ b/selinux-policy/m4-bad-data/fixtures/modules/te_trunc.te @@ -0,0 +1,8 @@ +module te_trunc 1.0; + +require { + type foo_t; + class file { read }; +} + +bad_trunc(foo_t) diff --git a/selinux-policy/m4-bad-data/fixtures/modules/te_unknown_perm.te b/selinux-policy/m4-bad-data/fixtures/modules/te_unknown_perm.te new file mode 100644 index 0000000..03dd324 --- /dev/null +++ b/selinux-policy/m4-bad-data/fixtures/modules/te_unknown_perm.te @@ -0,0 +1,8 @@ +module te_unknown_perm 1.0; + +require { + type foo_t; + class file { read }; +} + +bad_unknown_perm(foo_t) diff --git a/selinux-policy/m4-bad-data/fixtures/modules/te_unknown_type.te b/selinux-policy/m4-bad-data/fixtures/modules/te_unknown_type.te new file mode 100644 index 0000000..ea4724c --- /dev/null +++ b/selinux-policy/m4-bad-data/fixtures/modules/te_unknown_type.te @@ -0,0 +1,8 @@ +module te_unknown_type 1.0; + +require { + type foo_t; + class file { read }; +} + +bad_unknown_type() diff --git a/selinux-policy/m4-bad-data/main.fmf b/selinux-policy/m4-bad-data/main.fmf new file mode 100644 index 0000000..7ecf218 --- /dev/null +++ b/selinux-policy/m4-bad-data/main.fmf @@ -0,0 +1,18 @@ +summary: M4 bad-data tests for modular policy preprocessing +contact: Akhil Kohli +test: ./runtest.sh +framework: beakerlib +component: + - selinux-policy + - checkpolicy +require: + - checkpolicy + - m4 + - git + - policycoreutils + - selinux-policy-devel +recommend: + - selinux-policy + - selinux-policy-targeted +duration: 15m +enabled: true diff --git a/selinux-policy/m4-bad-data/runtest.sh b/selinux-policy/m4-bad-data/runtest.sh new file mode 100755 index 0000000..8a3ee22 --- /dev/null +++ b/selinux-policy/m4-bad-data/runtest.sh @@ -0,0 +1,379 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/selinux-policy/Sanity/m4-bad-data +# Description: M4 bad-data tests for modular policy preprocessing +# Author: Akhil Kohli +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGE="selinux-policy" +POLICY_GIT="${SELINUX_POLICY_GIT:-https://github.com/fedora-selinux/selinux-policy.git}" +POLICY_DIR="${SELINUX_POLICY_SRC:-}" + +BASEDIR="$(cd "$(dirname "$0")" && pwd)" +FIXTURES="${BASEDIR}/fixtures" + +M4=${M4:-m4} +CHECKMODULE=${CHECKMODULE:-checkmodule} +SEMODULE_PACKAGE=${SEMODULE_PACKAGE:-semodule_package} + +# Prefer explicit override; otherwise pick a clone branch for local/fallback use. +# Fedora Rawhide may report VERSION_ID=rawhide or a numeric ID ahead of any fN +# branch (e.g. 45 while only rawhide/f44 exist). Clone falls back to rawhide. +if [ -n "${SELINUX_POLICY_BRANCH:-}" ]; then + POLICY_BRANCH="${SELINUX_POLICY_BRANCH}" +else + test -e /etc/os-release && os_release='/etc/os-release' || os_release='/usr/lib/os-release' + # shellcheck disable=SC1090 + . "${os_release}" + if rlIsOSLike fedora; then + fedora_rel="" + if [[ "${VERSION_ID}" =~ ^[0-9]+$ ]]; then + fedora_rel="${VERSION_ID}" + elif [[ "${REDHAT_BUGZILLA_PRODUCT_VERSION:-}" =~ ^[0-9]+$ ]]; then + fedora_rel="${REDHAT_BUGZILLA_PRODUCT_VERSION}" + elif [[ "${REDHAT_SUPPORT_PRODUCT_VERSION:-}" =~ ^[0-9]+$ ]]; then + fedora_rel="${REDHAT_SUPPORT_PRODUCT_VERSION}" + fi + if [ -n "${fedora_rel}" ]; then + POLICY_BRANCH="f${fedora_rel}" + else + POLICY_BRANCH="rawhide" + fi + else + VERSION="${VERSION_ID%.*}" + POLICY_BRANCH="c${VERSION}s" + fi +fi + +DEVEL_SUPPORT="/usr/share/selinux/devel/include/support" + +# Configure M4SUPPORT/IFERROR from a selinux-policy git checkout layout. +setup_m4_from_git_tree() { + local root="$1" + M4SUPPORT="${root}/support/divert.m4 \ + ${root}/policy/support/misc_macros.spt \ + ${root}/policy/support/mls_mcs_macros.spt \ + ${root}/policy/support/loadable_module.spt \ + ${root}/policy/support/obj_perm_sets.spt \ + ${root}/support/undivert.m4" + IFERROR="${root}/support/iferror.m4" + POLICY_ROOT="${root}" +} + +# Configure M4SUPPORT from installed selinux-policy-devel (flat support/). +setup_m4_from_devel() { + local support="$1" + M4SUPPORT="${support}/divert.m4 \ + ${support}/misc_macros.spt \ + ${support}/mls_mcs_macros.spt \ + ${support}/loadable_module.spt \ + ${support}/obj_perm_sets.spt \ + ${support}/undivert.m4" + # iferror.m4 is build-tree only; recreate the upstream one-liner when absent. + if [ -f "${support}/iferror.m4" ]; then + IFERROR="${support}/iferror.m4" + else + IFERROR="${OUTDIR}/iferror.m4" + cat >"${IFERROR}" <<'EOF' +ifdef(`__if_error',`m4exit(1)') +EOF + fi + POLICY_ROOT="${support}" +} + +# Build all_interfaces.conf from one or more .if files (usual modular M4 recipe). +build_all_interfaces() { + local out="$1" + shift + + echo 'divert(-1)' >"${out}" + # shellcheck disable=SC2086 + ${M4} ${M4PARAM} ${M4SUPPORT} "$@" "${IFERROR}" >"${out}.tmp" 2>"${out}.err" + local rc=$? + sed -e 's/dollarsstar/$*/g' "${out}.tmp" >>"${out}" + echo 'divert' >>"${out}" + return "${rc}" +} + +# Expand a module .te with interfaces (usual modular M4 recipe; /dev/null for gen defs). +expand_module_te() { + local interfaces="$1" + local te="$2" + local out="$3" + + # shellcheck disable=SC2086 + ${M4} ${M4PARAM} -s ${M4SUPPORT} "${EMPTY_GEN_DEF}" "${interfaces}" "${te}" \ + >"${out}" 2>"${out}.err" + return $? +} + +# Expand file_contexts (usual modular M4 recipe for .fc -> .mod.fc). +expand_fc() { + local fc="$1" + local out="$2" + + # shellcheck disable=SC2086 + ${M4} ${M4PARAM} ${M4SUPPORT} "${fc}" >"${out}" 2>"${out}.err" + return $? +} + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm checkpolicy + rlRun "command -v m4" + rlRun "command -v checkmodule" + rlRun "command -v semodule_package" + + OUTDIR=$(mktemp -d "${TMPDIR:-/var/tmp}/selinux-policy-m4-bad-data.XXXXXX") + rlRun "test -d ${OUTDIR}" + CLONED_POLICY_DIR="" + + # Macro source priority (Petr): explicit checkout > installed devel > git clone. + if [ -n "${POLICY_DIR}" ]; then + rlAssertExists "${POLICY_DIR}/Rules.modular" + setup_m4_from_git_tree "${POLICY_DIR}" + rlLog "Using SELINUX_POLICY_SRC=${POLICY_DIR}" + elif [ -f "${DEVEL_SUPPORT}/loadable_module.spt" ]; then + rlAssertRpm selinux-policy-devel + setup_m4_from_devel "${DEVEL_SUPPORT}" + rlLog "Using selinux-policy-devel support macros from ${DEVEL_SUPPORT}" + else + CLONED_POLICY_DIR="$(mktemp -d /var/tmp/selinux-policy-src.XXXXXX)" + rlLog "Cloning ${POLICY_GIT} branch ${POLICY_BRANCH}" + if rlIsOSLike fedora && [ "${POLICY_BRANCH}" != "rawhide" ]; then + # fN may not exist yet on Rawhide (e.g. f45); allow failure then retry. + rlRun "git clone --depth=1 -b ${POLICY_BRANCH} ${POLICY_GIT} ${CLONED_POLICY_DIR}" 0-255 + if [ ! -f "${CLONED_POLICY_DIR}/Rules.modular" ]; then + rlLog "Branch ${POLICY_BRANCH} unavailable; falling back to rawhide" + rlRun "rm -rf ${CLONED_POLICY_DIR}" + CLONED_POLICY_DIR="$(mktemp -d /var/tmp/selinux-policy-src.XXXXXX)" + rlRun "git clone --depth=1 -b rawhide ${POLICY_GIT} ${CLONED_POLICY_DIR}" + fi + else + rlRun "git clone --depth=1 -b ${POLICY_BRANCH} ${POLICY_GIT} ${CLONED_POLICY_DIR}" + fi + rlAssertExists "${CLONED_POLICY_DIR}/Rules.modular" + setup_m4_from_git_tree "${CLONED_POLICY_DIR}" + fi + + # shellcheck disable=SC2086 + rlRun "test -f $(echo ${M4SUPPORT} | awk '{print $1}')" + rlRun "test -f ${IFERROR}" + + M4PARAM="-D enable_mcs -D distro_redhat -D hide_broken_symptoms -D mls_num_sens=16 -D mls_num_cats=1024 -D mcs_num_cats=1024" + EMPTY_GEN_DEF=/dev/null + + rlRun "ln -sf /nonexistent/test_good.if ${OUTDIR}/broken_symlink.if" + rlRun "ln -sf /nonexistent/test_good.mod.fc ${OUTDIR}/broken_symlink.fc" + rlRun "printf '' > ${OUTDIR}/empty.fc" + rlPhaseEnd + + # --- .if -> all_interfaces.conf --- + rlPhaseStartTest "unclosed interface definition" + rlRun "build_all_interfaces ${OUTDIR}/b1_unclosed.interfaces ${FIXTURES}/interfaces/bad_unclosed.if" 1-255 + rlPhaseEnd + + rlPhaseStartTest "broken M4 syntax in interface file" + rlRun "build_all_interfaces ${OUTDIR}/b1_m4_syntax.interfaces ${FIXTURES}/interfaces/bad_m4_syntax.if" 1-255 + rlPhaseEnd + + rlPhaseStartTest "duplicate interface definition" + rlRun "build_all_interfaces ${OUTDIR}/b1_duplicate.interfaces ${FIXTURES}/interfaces/bad_duplicate.if" 1-255 + rlPhaseEnd + + rlPhaseStartTest "broken gen_require block in interface file" + rlRun "build_all_interfaces ${OUTDIR}/b1_bad_gen_if.interfaces ${FIXTURES}/interfaces/bad_gen_if_build.if" 1-255 + rlPhaseEnd + + rlPhaseStartTest "empty interface template name" + rlRun "build_all_interfaces ${OUTDIR}/b1_empty_ifname.interfaces ${FIXTURES}/interfaces/bad_empty_ifname.if" 1-255 + rlPhaseEnd + + rlPhaseStartTest "missing .if path" + rlRun "build_all_interfaces ${OUTDIR}/b1_missing.interfaces ${OUTDIR}/does_not_exist.if" 1-255 + rlPhaseEnd + + rlPhaseStartTest "directory instead of .if file" + rlRun "build_all_interfaces ${OUTDIR}/b1_directory.interfaces ${BASEDIR}" 1-255 + rlPhaseEnd + + rlPhaseStartTest "broken symlink for .if" + rlRun "build_all_interfaces ${OUTDIR}/b1_symlink.interfaces ${OUTDIR}/broken_symlink.if" 1-255 + rlPhaseEnd + + rlPhaseStartTest "unreadable .if file" + if [ "$(id -u)" -eq 0 ]; then + rlLog "SKIP: root can read mode 000 files; unreadable check is non-root only" + else + rlRun "cp ${FIXTURES}/interfaces/good.if ${OUTDIR}/unreadable.if" + rlRun "chmod 000 ${OUTDIR}/unreadable.if" + rlRun "build_all_interfaces ${OUTDIR}/unreadable_if.interfaces ${OUTDIR}/unreadable.if" 1-255 + fi + rlPhaseEnd + + rlPhaseStartTest "control good interface" + rlRun "build_all_interfaces ${OUTDIR}/b1_good.interfaces ${FIXTURES}/interfaces/good.if" + rlRun "test -s ${OUTDIR}/b1_good.interfaces" + rlPhaseEnd + + GOOD_IF="${OUTDIR}/b1_good.interfaces" + + # --- .te + M4 with interfaces --- + rlPhaseStartTest "control good .if + .te through M4 and checkmodule" + rlRun "expand_module_te ${GOOD_IF} ${FIXTURES}/modules/te_good.te ${OUTDIR}/b2_good.tmp" + rlRun "test -s ${OUTDIR}/b2_good.tmp" + rlRun "${CHECKMODULE} -M -m -o ${OUTDIR}/te_good.mod ${OUTDIR}/b2_good.tmp" + rlRun "test -s ${OUTDIR}/te_good.mod" + rlPhaseEnd + + rlPhaseStartTest "missing .te path at M4 expand" + rlRun "expand_module_te ${GOOD_IF} ${OUTDIR}/does_not_exist.te ${OUTDIR}/b2_missing_te.tmp" 1-255 + rlPhaseEnd + + NEEDS_ARG_IF="${OUTDIR}/needs_arg.interfaces" + + rlPhaseStartTest "interface called with too few arguments" + rlRun "build_all_interfaces ${NEEDS_ARG_IF} ${FIXTURES}/interfaces/needs_arg.if" + rlRun "expand_module_te ${NEEDS_ARG_IF} ${FIXTURES}/modules/te_few_args.te ${OUTDIR}/b2_few_args.tmp" + rlRun "test -s ${OUTDIR}/b2_few_args.tmp" + rlRun "${CHECKMODULE} -M -m -o ${OUTDIR}/te_few.mod ${OUTDIR}/b2_few_args.tmp" 1-255 + rlPhaseEnd + + rlPhaseStartTest "interface called with too many arguments" + rlLog "DOCUMENT: extra interface args are ignored by M4" + rlRun "test -s ${NEEDS_ARG_IF}" + rlRun "expand_module_te ${NEEDS_ARG_IF} ${FIXTURES}/modules/te_many_args.te ${OUTDIR}/b2_many_args.tmp" + rlRun "test -s ${OUTDIR}/b2_many_args.tmp" + rlRun "${CHECKMODULE} -M -m -o ${OUTDIR}/te_many.mod ${OUTDIR}/b2_many_args.tmp" + rlRun "test -s ${OUTDIR}/te_many.mod" + rlPhaseEnd + + # --- M4 OK, bad expanded TE -> checkmodule fails --- + # bad_trunc.if is unclosed at the M4 interface stage (EOF in string), so it is + # rejected before module expand — same class of failure as other broken .if files. + rlPhaseStartTest "truncated allow from interface expansion" + rlRun "build_all_interfaces ${OUTDIR}/bad_trunc.interfaces ${FIXTURES}/interfaces/bad_trunc.if" 1-255 + rlPhaseEnd + + rlPhaseStartTest "broken gen_require expanded from interface" + rlRun "build_all_interfaces ${OUTDIR}/bad_gen_require.interfaces ${FIXTURES}/interfaces/bad_gen_require.if" + rlRun "expand_module_te ${OUTDIR}/bad_gen_require.interfaces ${FIXTURES}/modules/te_gen_require.te ${OUTDIR}/b5_gen_require.tmp" + rlRun "test -s ${OUTDIR}/b5_gen_require.tmp" + rlRun "${CHECKMODULE} -M -m -o ${OUTDIR}/te_gen_require.mod ${OUTDIR}/b5_gen_require.tmp" 1-255 + rlPhaseEnd + + rlPhaseStartTest "unknown type from interface expansion" + rlRun "build_all_interfaces ${OUTDIR}/bad_unknown_type.interfaces ${FIXTURES}/interfaces/bad_unknown_type.if" + rlRun "expand_module_te ${OUTDIR}/bad_unknown_type.interfaces ${FIXTURES}/modules/te_unknown_type.te ${OUTDIR}/b5_unknown_type.tmp" + rlRun "test -s ${OUTDIR}/b5_unknown_type.tmp" + rlRun "${CHECKMODULE} -M -m -o ${OUTDIR}/te_unknown_type.mod ${OUTDIR}/b5_unknown_type.tmp" 1-255 + rlPhaseEnd + + rlPhaseStartTest "unknown permission from interface expansion" + rlRun "build_all_interfaces ${OUTDIR}/bad_unknown_perm.interfaces ${FIXTURES}/interfaces/bad_unknown_perm.if" + rlRun "expand_module_te ${OUTDIR}/bad_unknown_perm.interfaces ${FIXTURES}/modules/te_unknown_perm.te ${OUTDIR}/b5_unknown_perm.tmp" + rlRun "test -s ${OUTDIR}/b5_unknown_perm.tmp" + rlRun "${CHECKMODULE} -M -m -o ${OUTDIR}/te_unknown_perm.mod ${OUTDIR}/b5_unknown_perm.tmp" 1-255 + rlPhaseEnd + + rlPhaseStartTest "garbage token from interface expansion" + rlRun "build_all_interfaces ${OUTDIR}/bad_garbage.interfaces ${FIXTURES}/interfaces/bad_garbage.if" + rlRun "expand_module_te ${OUTDIR}/bad_garbage.interfaces ${FIXTURES}/modules/te_garbage.te ${OUTDIR}/b5_garbage.tmp" + rlRun "test -s ${OUTDIR}/b5_garbage.tmp" + rlRun "${CHECKMODULE} -M -m -o ${OUTDIR}/te_garbage.mod ${OUTDIR}/b5_garbage.tmp" 1-255 + rlPhaseEnd + + rlPhaseStartTest "invalid module line from interface expansion" + rlRun "build_all_interfaces ${OUTDIR}/bad_module_line.interfaces ${FIXTURES}/interfaces/bad_module_line.if" + rlRun "expand_module_te ${OUTDIR}/bad_module_line.interfaces ${FIXTURES}/modules/te_bad_module_line.te ${OUTDIR}/b5_module_line.tmp" + rlRun "test -s ${OUTDIR}/b5_module_line.tmp" + rlRun "${CHECKMODULE} -M -m -o ${OUTDIR}/te_bad_mod.mod ${OUTDIR}/b5_module_line.tmp" 1-255 + rlPhaseEnd + + # --- .fc -> M4 -> .mod.fc --- + rlPhaseStartTest "control good .fc through M4" + rlRun "expand_fc ${FIXTURES}/file_contexts/good.fc ${OUTDIR}/b3_good.mod.fc" + rlRun "test -s ${OUTDIR}/b3_good.mod.fc" + rlPhaseEnd + + rlPhaseStartTest "invalid context survives M4" + rlLog "DOCUMENT: labeling validation deferred to sefcontext_compile" + rlRun "expand_fc ${FIXTURES}/file_contexts/bad_context.fc ${OUTDIR}/b3_bad_context.mod.fc" + rlRun "test -s ${OUTDIR}/b3_bad_context.mod.fc" + rlPhaseEnd + + rlPhaseStartTest "wrong field count in .fc" + rlLog "DOCUMENT: labeling validation deferred to sefcontext_compile" + rlRun "expand_fc ${FIXTURES}/file_contexts/bad_fields.fc ${OUTDIR}/b3_bad_fields.mod.fc" + rlRun "test -s ${OUTDIR}/b3_bad_fields.mod.fc" + rlPhaseEnd + + rlPhaseStartTest "empty .fc file" + rlLog "DOCUMENT: labeling validation deferred to sefcontext_compile" + rlRun "expand_fc ${OUTDIR}/empty.fc ${OUTDIR}/b3_empty_fc.mod.fc" + rlPhaseEnd + + rlPhaseStartTest "path-only line without context in .fc" + rlLog "DOCUMENT: labeling validation deferred to sefcontext_compile" + rlRun "expand_fc ${FIXTURES}/file_contexts/bad_no_context.fc ${OUTDIR}/b3_no_context.mod.fc" + rlRun "test -s ${OUTDIR}/b3_no_context.mod.fc" + rlPhaseEnd + + rlPhaseStartTest "invalid regex metacharacters in .fc path" + rlLog "DOCUMENT: labeling validation deferred to sefcontext_compile" + rlRun "expand_fc ${FIXTURES}/file_contexts/bad_regex.fc ${OUTDIR}/b3_bad_regex.mod.fc" + rlRun "test -s ${OUTDIR}/b3_bad_regex.mod.fc" + rlPhaseEnd + + rlPhaseStartTest "missing .fc path" + rlRun "expand_fc ${OUTDIR}/does_not_exist.fc ${OUTDIR}/b3_missing.mod.fc" 1-255 + rlPhaseEnd + + rlPhaseStartTest "directory instead of .fc file" + rlRun "expand_fc ${BASEDIR} ${OUTDIR}/b3_directory.mod.fc" 1-255 + rlPhaseEnd + + rlPhaseStartTest "broken symlink for .fc" + rlRun "expand_fc ${OUTDIR}/broken_symlink.fc ${OUTDIR}/b3_symlink.mod.fc" 1-255 + rlPhaseEnd + + rlPhaseStartTest "unreadable .fc file" + if [ "$(id -u)" -eq 0 ]; then + rlLog "SKIP: root can read mode 000 files; unreadable check is non-root only" + else + rlRun "cp ${FIXTURES}/file_contexts/good.fc ${OUTDIR}/unreadable.fc" + rlRun "chmod 000 ${OUTDIR}/unreadable.fc" + rlRun "expand_fc ${OUTDIR}/unreadable.fc ${OUTDIR}/unreadable_fc.mod.fc" 1-255 + fi + rlPhaseEnd + + rlPhaseStartTest "broken M4 syntax in .fc" + rlRun "expand_fc ${FIXTURES}/file_contexts/bad_m4_syntax.fc ${OUTDIR}/b3_bad_m4.mod.fc" 1-255 + rlPhaseEnd + + # --- M4-expanded .mod.fc through semodule_package (E2E; labeling deferred) --- + rlPhaseStartTest "bad M4-expanded .mod.fc packaged with good .mod" + rlLog "DOCUMENT: M4 to package E2E; labeling validation deferred to sefcontext_compile" + rlRun "mkdir -p ${OUTDIR}/b6_e2e_build" + rlRun "expand_module_te ${GOOD_IF} ${FIXTURES}/modules/te_good.te ${OUTDIR}/b6_e2e.tmp" + rlRun "${CHECKMODULE} -M -m -o ${OUTDIR}/b6_e2e_build/te_good.mod ${OUTDIR}/b6_e2e.tmp" + rlRun "expand_fc ${FIXTURES}/file_contexts/bad_context.fc ${OUTDIR}/b6_e2e.mod.fc" + rlRun "${SEMODULE_PACKAGE} -o ${OUTDIR}/b6_e2e.pp -m ${OUTDIR}/b6_e2e_build/te_good.mod -f ${OUTDIR}/b6_e2e.mod.fc" + rlRun "test -s ${OUTDIR}/b6_e2e.pp" + rlPhaseEnd + + rlPhaseStartCleanup + if [ -n "${OUTDIR:-}" ] && [ -d "${OUTDIR}" ]; then + rlRun "rm -rf ${OUTDIR}" + fi + if [ -n "${CLONED_POLICY_DIR:-}" ] && [ -d "${CLONED_POLICY_DIR}" ]; then + rlRun "rm -rf ${CLONED_POLICY_DIR}" + fi + rlPhaseEnd +rlJournalPrintText +rlJournalEnd From 194bac23dfc378cbd1e582fa91de30279c61c7b5 Mon Sep 17 00:00:00 2001 From: Veronika Syncakova Date: Wed, 12 Aug 2026 13:32:34 +0200 Subject: [PATCH 624/626] Adujst test to hardware limitations. If CPU boost control is unavailable, the tuned-adm verify returns 1. -i do not treat missing/non-supported tunings as errors ERROR: verify: failed: device cpu0: 'boost' = 'None', expected '1' WARNING: Unable to set boost on cpu 'cpu0'. Neither per-policy boost nor intel_pstate no_turbo is available. --- selinux-policy/tuned-ppd-and-similar/runtest.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/selinux-policy/tuned-ppd-and-similar/runtest.sh b/selinux-policy/tuned-ppd-and-similar/runtest.sh index cde5383..1efe029 100755 --- a/selinux-policy/tuned-ppd-and-similar/runtest.sh +++ b/selinux-policy/tuned-ppd-and-similar/runtest.sh @@ -136,7 +136,7 @@ rlJournalStart rlRun "ls -lZ /etc/tuned/ppd_base_profile" rlRun "tuned-adm auto_profile" rlRun "ls -lZ /etc/tuned/ppd_base_profile" - rlRun "tuned-adm verify" + rlRun "tuned-adm verify -i" rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "stop status" 1 if [ -f /usr/lib/systemd/system/gdm.service ] ; then sleep 2 From 332b82ec4eb44edcdd4d628a95787e82438d7db8 Mon Sep 17 00:00:00 2001 From: Veronika Syncakova Date: Wed, 12 Aug 2026 13:06:56 +0200 Subject: [PATCH 625/626] Skip the RHEL 110090 phase if iio_device_t is not defined. The test phase is specifically looking for iio_device_t. --- selinux-policy/iio-sensor-proxy-and-similar/runtest.sh | 2 ++ 1 file changed, 2 insertions(+) diff --git a/selinux-policy/iio-sensor-proxy-and-similar/runtest.sh b/selinux-policy/iio-sensor-proxy-and-similar/runtest.sh index c89bd18..d4b6599 100755 --- a/selinux-policy/iio-sensor-proxy-and-similar/runtest.sh +++ b/selinux-policy/iio-sensor-proxy-and-similar/runtest.sh @@ -72,7 +72,9 @@ rlJournalStart rlSESearchRule "allow iiosensorproxy_t xdm_t : dbus { send_msg } [ ]" rlSESearchRule "allow iiosensorproxy_t iiosensorproxy_t : capability2 { bpf } [ ]" rlPhaseEnd + fi + if seinfo -t | grep -q iio_device_t ; then rlPhaseStartTest "RHEL-110090" rlRun "semanage fcontext -l | grep '/dev/iio:device.*character.*iio_device_t'" rlSEMatchPathCon "/dev/iio:device3" "iio_device_t" From 534e38f96fde1c88ae9881ffea6c9fc592e82c71 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Thu, 13 Aug 2026 16:59:24 +0200 Subject: [PATCH 626/626] test if virtqemud can execute udevadm Recent virt-install testing with various USB devices revealed SELinux denials which are triggered when the virtqemud process executes the udevadm command. The TC reproduces the situation. In order to support this functionality, I believe that SELinux policy should allow the execution and transition to the udev_t domain. The TC looks for appropriate policy rules and file context patterns. The TC covers RHEL-236185. --- selinux-policy/virt-install-additional/Makefile | 1 + selinux-policy/virt-install-additional/main.fmf | 1 + selinux-policy/virt-install-additional/runtest.sh | 9 +++++++++ 3 files changed, 11 insertions(+) diff --git a/selinux-policy/virt-install-additional/Makefile b/selinux-policy/virt-install-additional/Makefile index 20b3ae0..1a55b01 100644 --- a/selinux-policy/virt-install-additional/Makefile +++ b/selinux-policy/virt-install-additional/Makefile @@ -76,6 +76,7 @@ $(METADATA): Makefile @echo "Bug: RHEL-76104" >> $(METADATA) # RHEL-10 @echo "Bug: RHEL-98559" >> $(METADATA) # RHEL-10 @echo "Bug: RHEL-101417" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-236185" >> $(METADATA) # RHEL-10 rhts-lint $(METADATA) diff --git a/selinux-policy/virt-install-additional/main.fmf b/selinux-policy/virt-install-additional/main.fmf index 38032e7..cdd36ae 100644 --- a/selinux-policy/virt-install-additional/main.fmf +++ b/selinux-policy/virt-install-additional/main.fmf @@ -54,6 +54,7 @@ link: - verifies: https://issues.redhat.com/browse/RHEL-76104 - verifies: https://issues.redhat.com/browse/RHEL-98559 - verifies: https://issues.redhat.com/browse/RHEL-101417 + - verifies: https://issues.redhat.com/browse/RHEL-236185 adjust+: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 diff --git a/selinux-policy/virt-install-additional/runtest.sh b/selinux-policy/virt-install-additional/runtest.sh index 313e7a4..35afc89 100755 --- a/selinux-policy/virt-install-additional/runtest.sh +++ b/selinux-policy/virt-install-additional/runtest.sh @@ -367,6 +367,15 @@ rlJournalStart rlRun "service virtqemud stop" rlPhaseEnd + rlPhaseStartTest "RHEL-236185" + rlSEMatchPathCon "/usr/bin/udevadm" "udev_exec_t" + if seinfo -a | grep -q virt_driver_domain ; then + rlSESearchRule "allow virtqemud_t udev_exec_t : file { execute map } [ ]" + rlSESearchRule "type_transition virtqemud_t udev_exec_t : process udev_t" + rlSESearchRule "allow virtqemud_t udev_t : process { transition } [ ]" + fi + rlPhaseEnd + rlPhaseStartCleanup sleep 2 rlSECheckAVC