tests/selinux
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Compare commits

merge into: tests:main
Branches Tags
tests:main
tests:master
tests:real-main
...
pull from: tests:master
Branches Tags
tests:main
tests:master
tests:real-main
Sign in to create a new pull request.

2 commits
main ... master

Author SHA1 Message Date
Milos Malik
918af6a3fc add the numad test to upstream repo 
The numad component is used in various versions of RHEL and Fedora,
so it makes sense to run this TC in upstream testing too.
Moving the downstream TC to upstream repository.
There are some minor changes when comparing the upstream and downstream
versions of the TC.
 2021-03-03 09:32:11 +01:00
Amith Kumar
63bf841c3e pcp-daemons: Fix upstream failures 
One of the testcase failed due to absence of chkconfig and initrc
related files. Make existing code compatible with higher versions of
Fedora and fix the failures.

Signed-off-by: Amith Kumar <apeetham@redhat.com>
 2021-02-10 02:25:05 +05:30
5 changed files with 241 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

84
selinux-policy/numad-and-similar/Makefile Normal file
View file

@ -0,0 +1,84 @@
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#
# Makefile of /CoreOS/selinux-policy/Regression/numad-and-similar
# Description: SELinux interferes with numad and related programs
# Author: Milos Malik <mmalik@redhat.com>
#
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#
# Copyright (c) 2021 Red Hat, Inc. All rights reserved.
#
# This copyrighted material is made available to anyone wishing
# to use, modify, copy, or redistribute it subject to the terms
# and conditions of the GNU General Public License version 2.
#
# This program is distributed in the hope that it will be
# useful, but WITHOUT ANY WARRANTY; without even the implied
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
# PURPOSE. See the GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public
# License along with this program; if not, write to the Free
# Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
# Boston, MA 02110-1301, USA.
#
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
export TEST=/CoreOS/selinux-policy/Regression/numad-and-similar
export TESTVERSION=1.0
BUILT_FILES=
FILES=$(METADATA) runtest.sh Makefile PURPOSE
.PHONY: all install download clean
run: $(FILES) build
./runtest.sh
build: $(BUILT_FILES)
chmod a+x runtest.sh
chcon -t bin_t runtest.sh
clean:
rm -f *~ $(BUILT_FILES)
include /usr/share/rhts/lib/rhts-make.include
$(METADATA): Makefile
@echo "Owner: Milos Malik <mmalik@redhat.com>" > $(METADATA)
@echo "Name: $(TEST)" >> $(METADATA)
@echo "TestVersion: $(TESTVERSION)" >> $(METADATA)
@echo "Path: $(TEST_DIR)" >> $(METADATA)
@echo "Description: SELinux interferes with numad and related programs" >> $(METADATA)
@echo "Type: Regression" >> $(METADATA)
@echo "TestTime: 10m" >> $(METADATA)
@echo "RunFor: selinux-policy" >> $(METADATA)
@echo "RunFor: numad" >> $(METADATA)
@echo "Requires: audit" >> $(METADATA)
@echo "Requires: expect" >> $(METADATA)
@echo "Requires: grep" >> $(METADATA)
@echo "Requires: initscripts" >> $(METADATA)
@echo "Requires: libselinux" >> $(METADATA)
@echo "Requires: libselinux-utils" >> $(METADATA)
@echo "Requires: numad" >> $(METADATA)
@echo "Requires: policycoreutils" >> $(METADATA)
@echo "Requires: procps" >> $(METADATA)
@echo "Requires: selinux-policy" >> $(METADATA)
@echo "Requires: setools" >> $(METADATA)
@echo "Requires: setools-console" >> $(METADATA)
@echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA)
@echo "Priority: Normal" >> $(METADATA)
@echo "License: GPLv2" >> $(METADATA)
@echo "Confidential: no" >> $(METADATA)
@echo "Destructive: no" >> $(METADATA)
@echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA)
@echo "Architectures: i386 ppc64 x86_64" >> $(METADATA)
@echo "Releases: -RHEL4 -RHELServer5 -RHELClient5" >> $(METADATA)
@echo "Bug: 807157" >> $(METADATA) # RHEL-6
@echo "Bug: 857086" >> $(METADATA) # RHEL-7
@echo "Bug: 1074449" >> $(METADATA) # RHEL-7
@echo "Bug: 1118515" >> $(METADATA) # RHEL-7
rhts-lint $(METADATA)

5
selinux-policy/numad-and-similar/PURPOSE Normal file
View file

@ -0,0 +1,5 @@
PURPOSE of /CoreOS/selinux-policy/Regression/numad-and-similar
Author: Milos Malik <mmalik@redhat.com>
SELinux interferes with numad and related programs.

2
selinux-policy/numad-and-similar/main.fmf Normal file
View file

@ -0,0 +1,2 @@
path: /selinux-policy/numad-and-similar
tier: 2

125
selinux-policy/numad-and-similar/runtest.sh Normal file
View file

@ -0,0 +1,125 @@
#!/bin/bash
# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#
# runtest.sh of /CoreOS/selinux-policy/Regression/numad-and-similar
# Description: SELinux interferes with numad and related programs
# Author: Milos Malik <mmalik@redhat.com>
#
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#
# Copyright (c) 2021 Red Hat, Inc. All rights reserved.
#
# This copyrighted material is made available to anyone wishing
# to use, modify, copy, or redistribute it subject to the terms
# and conditions of the GNU General Public License version 2.
#
# This program is distributed in the hope that it will be
# useful, but WITHOUT ANY WARRANTY; without even the implied
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
# PURPOSE. See the GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public
# License along with this program; if not, write to the Free
# Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
# Boston, MA 02110-1301, USA.
#
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
# Include rhts environment
. /usr/bin/rhts-environment.sh
. /usr/share/beakerlib/beakerlib.sh
PACKAGE="selinux-policy"
ROOT_PASSWORD="redhat"
SERVICE_NAME="numad"
PROCESS_NAME="numad"
PROCESS_CONTEXT="numad_t"
rlJournalStart
rlPhaseStartSetup
rlRun "rlImport 'selinux-policy/common'"
rlSESatisfyRequires
rlAssertRpm ${PACKAGE}
rlAssertRpm ${PACKAGE}-targeted
rlAssertRpm numad
rlServiceStop ${SERVICE_NAME}
rlFileBackup /etc/shadow
rlSESetEnforce
rlSEStatus
rlSESetTimestamp
sleep 2
rlPhaseEnd
if rlSEDefined "numad_t numad_exec_t" ; then
rlPhaseStartTest "bz#807157"
rlSEMatchPathCon "/usr/bin/numad" "numad_exec_t"
rlSESearchRule "allow initrc_t numad_t : process { transition }"
rlPhaseEnd
fi
if rlSEDefined "numad_exec_t cgroup_t numad_t" ; then
rlPhaseStartTest "bz#857086"
rlSEMatchPathCon "/usr/bin/numad" "numad_exec_t"
if rlIsRHEL 6 ; then
MOUNT_POINT="/cgroup/cpuset"
rlSEMatchPathCon "${MOUNT_POINT}" "cgroup_t"
else
MOUNT_POINT="/sys/fs/cgroup/cpuset"
if [ -d ${MOUNT_POINT} ] ; then
rlRun "ls -dZ ${MOUNT_POINT} | grep :cgroup_t"
else
rlSEMatchPathCon "/sys/fs/cgroup" "cgroup_t"
fi
fi
rlSESearchRule "allow numad_t cgroup_t : dir { getattr search }"
rlSESearchRule "allow numad_t numad_t : msg { send receive }"
rlPhaseEnd
fi
if ! rlIsRHEL 5 6 ; then
rlPhaseStartTest "bz#1074449"
rlSEMatchPathCon "/usr/bin/numad" "numad_exec_t"
rlSESearchRule "allow numad_t sysfs_t : file { write }"
rlPhaseEnd
rlPhaseStartTest "bz#1118515"
rlSEMatchPathCon "/usr/bin/numad" "numad_exec_t"
rlSEMatchPathCon "/var/log/numad.log" "numad_var_log_t"
rlSEMatchPathCon "/var/run/numad.pid" "numad_var_run_t"
rlSESearchRule "allow virtd_t numad_exec_t : file { getattr open read execute }"
rlSESearchRule "type_transition virtd_t numad_exec_t : process numad_t"
rlSESearchRule "allow virtd_t numad_t : process { transition }"
rlSESearchRule "allow numad_t numad_var_log_t : file { open }"
rlSESearchRule "allow numad_t numad_t : msg { send receive }"
rlSESearchRule "allow numad_t numad_t : msgq { associate unix_read unix_write read write }"
rlSESearchRule "allow numad_t numad_var_run_t : file { getattr open read }"
rlPhaseEnd
fi
rlPhaseStartTest "real scenario"
rlRun "mkdir -p ${MOUNT_POINT}"
if ! mount | grep -q "cgroup.*cpuset" ; then
rlRun "mount cgroup -t cgroup -o cpuset ${MOUNT_POINT}" 0,32
fi
rlRun "semodule -l | grep numad"
rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root"
rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1
rlRun "numad -S 0"
rlRun "numad -S 1"
rlRun "restorecon -Rv /run /var"
rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1
rlPhaseEnd
rlPhaseStartCleanup
sleep 2
rlSECheckAVC
rlFileRestore
rlServiceRestore ${SERVICE_NAME}
rlPhaseEnd
rlJournalPrintText
rlJournalEnd

34
selinux-policy/pcp-daemons-and-similar/runtest.sh
View file

@ -394,12 +394,20 @@ rlJournalStart
rlRun "semodule -l | grep pcp"
rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root"
for SERVICE_NAME in pmcd pmie pmlogger pmproxy ; do
rlRun "chkconfig ${SERVICE_NAME} on"
if rlIsFedora '>=33' || rlIsRHEL ">=8.1" ; then
rlRun "systemctl enable ${SERVICE_NAME}"
else
rlRun "chkconfig ${SERVICE_NAME} on"
fi
done
for TRIPLET in ${TRIPLETSLIST} ; do
if ! rlSEDefined "${SEDEFINED}" ; then
# for RHELs where the SELinux domain does not exist yet
PROCESS_CONTEXT="initrc_t"
if rlIsFedora '<33' || rlIsRHEL "<8" ; then
if ! rlSEDefined "${SEDEFINED}" ; then
# for RHELs where the SELinux domain does not exist yet
PROCESS_CONTEXT="initrc_t"
else
PROCESS_CONTEXT=`echo ${TRIPLET} | cut -d : -f 3`
fi
else
PROCESS_CONTEXT=`echo ${TRIPLET} | cut -d : -f 3`
fi
@ -411,11 +419,15 @@ rlJournalStart
rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status restart status" 1
done
for TRIPLET in ${TRIPLETSLIST} ; do
if ! rlSEDefined "${SEDEFINED}" ; then
# for RHELs where the SELinux domain does not exist yet
PROCESS_CONTEXT="initrc_t"
if rlIsFedora '<33' || rlIsRHEL "<8" ; then
if ! rlSEDefined "${SEDEFINED}" ; then
# for RHELs where the SELinux domain does not exist yet
PROCESS_CONTEXT="initrc_t"
else
PROCESS_CONTEXT=`echo ${TRIPLET} | cut -d : -f 3`
fi
else
PROCESS_CONTEXT=`echo ${TRIPLET} | cut -d : -f 3`
PROCESS_CONTEXT=`echo ${TRIPLET} | cut -d : -f 3`
fi
PROCESS_NAME=`echo ${TRIPLET} | cut -d : -f 4`
SERVICE_NAME=${PROCESS_NAME}
@ -425,7 +437,11 @@ rlJournalStart
rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "stop" 1
done
for SERVICE_NAME in pmcd pmie pmlogger pmproxy ; do
rlRun "chkconfig ${SERVICE_NAME} off"
if rlIsFedora '>=33' || rlIsRHEL ">=8.1" ; then
rlRun "systemctl disable ${SERVICE_NAME}"
else
rlRun "chkconfig ${SERVICE_NAME} off"
fi
done
rlPhaseEnd