add the numad test to upstream repo

The numad component is used in various versions of RHEL and Fedora, so it makes sense to run this TC in upstream testing too. Moving the downstream TC to upstream repository. There are some minor changes when comparing the upstream and downstream versions of the TC.
pcp-daemons: Fix upstream failures
2021-03-03 09:32:11 +01:00 · 2021-02-10 02:25:05 +05:30
863 changed files with 849 additions and 39940 deletions
--- a/README.md
+++ b/README.md
@ -1,26 +0,0 @@
-# SELinux tests
-
-This repository contains set of test for SELinux kernel, userspace and policy.
-Tests are written using [beakerlib](https://github.com/beakerlib/beakerlib) with [TMT Metadata Specification](https://tmt.readthedocs.io/en/latest/spec.html).
-
-
-## Gating Guidelines
-Test tiers define a test's priority for our **gating process**.
-
-* **`tier: 1`**: Critical tests that must pass for any code merge. 
-* **`tier: 2`**: Important but non-critical tests.
-* **`tier: 3`**: Non-critical tests.
-
-All other tier metadata (e.g., `tag:Tier1`) is now deprecated.
-
-## Plans
-
-    $ tmt plans
-    Found 5 plans: /plans/ci, /plans/reboot, /plans/tier1, /plans/tier2 and /plans/tier3.
-
-## Usage
-
-Run `tier1` on `localhost`:
-
-    # tmt run provision -h local prepare plans -n /plans/tier1 discover execute
-    # tmt run -l report -h display -v
--- a/README.rst
+++ b/README.rst
--- a/checkpolicy/checkmodule/Makefile
+++ b/checkpolicy/checkmodule/Makefile
@ -53,17 +53,12 @@ $(METADATA): Makefile
 	@echo "Type:            Sanity" >> $(METADATA)
 	@echo "TestTime:        10m" >> $(METADATA)
 	@echo "RunFor:          checkpolicy" >> $(METADATA)
-	@echo "Requires:        checkpolicy man grep policycoreutils policycoreutils-devel" >> $(METADATA)
+	@echo "Requires:        checkpolicy man grep mktemp policycoreutils policycoreutils-devel" >> $(METADATA)
 	@echo "Priority:        Normal" >> $(METADATA)
 	@echo "License:         GPLv2" >> $(METADATA)
 	@echo "Confidential:    no" >> $(METADATA)
 	@echo "Destructive:     no" >> $(METADATA)
 	@echo "Releases:        -RHEL4" >> $(METADATA)
-	@echo "Bug:             533796" >> $(METADATA) # RHEL-5
-	@echo "Bug:             588294" >> $(METADATA) # RHEL-6
-	@echo "Bug:             1064603" >> $(METADATA) # RHEL-7
-	@echo "Bug:             1329217" >> $(METADATA) # RHEL-7
-	@echo "Bug:             1392394" >> $(METADATA) # RHEL-6

 	rhts-lint $(METADATA)

--- a/checkpolicy/checkmodule/main.fmf
+++ b/checkpolicy/checkmodule/main.fmf
@ -1,37 +1 @@
-summary: runs checkmodule with various options to find out if it behaves correctly
-description: |+
-    This TC runs checkmodule with various options to find out if it behaves correctly.
-
-contact: Milos Malik <mmalik@redhat.com>
-component:
-  - checkpolicy
-test: ./runtest.sh
-framework: beakerlib
-recommend:
-  - checkpolicy
-  - man
-  - grep
-  - policycoreutils
-  - policycoreutils-devel
-duration: 10m
-enabled: true
-tag:
-  - CI-Tier-1
-  - NoRHEL4
-  - f31friendly
-  - f32friendly
-  - targeted
-tier: 1
-link:
-  - relates: https://bugzilla.redhat.com/show_bug.cgi?id=533796
-  - relates: https://bugzilla.redhat.com/show_bug.cgi?id=588294
-  - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1064603
-  - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1329217
-  - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1392394
-adjust+:
-  - enabled: false
-    when: distro == rhel-4
-    continue: false
-extra-nitrate: TC#0062301
-extra-summary: /CoreOS/checkpolicy/Sanity/checkmodule
-extra-task: /CoreOS/checkpolicy/Sanity/checkmodule
+path: /checkpolicy/checkmodule
--- a/checkpolicy/checkmodule/runtest.sh
+++ b/checkpolicy/checkmodule/runtest.sh
@ -27,6 +27,7 @@
 # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 # Include rhts environment
+. /usr/bin/rhts-environment.sh
 . /usr/share/beakerlib/beakerlib.sh

 PACKAGE="checkpolicy"
@ -40,7 +41,7 @@ rlJournalStart
        rlRun "rpm -ql ${PACKAGE} | grep /usr/share/man/.*checkmodule"
    rlPhaseEnd

-    rlPhaseStartTest "bz#533796 + bz#588294"
+    rlPhaseStartTest
        rlRun "checkmodule >& ${TEST_FILE}" 1
        rlAssertGrep "unable to open policy.conf" ${TEST_FILE}
        rlRun "checkmodule -b >& ${TEST_FILE}" 1
@ -65,27 +66,23 @@ rlJournalStart
        rlRun "checkmodule ${TEST_FILE}" 1
        rlRun "checkmodule -b ${TEST_FILE}" 1
        if rlIsRHEL 5 ; then
-            if [ -e "/usr/share/man/man8/checkmodule.8.gz" ]; then
-                rlRun "man checkmodule | col -b | grep -- -d"
-            fi
+            rlRun "man checkmodule | col -b | grep -- -d"
            rlRun "checkmodule --help 2>&1 | grep -- -d"
        fi
-        if [ -e "/usr/share/man/man8/checkmodule.8.gz" ]; then
-            rlRun "man checkmodule | col -b | grep -- -h"
-            rlRun "man checkmodule | col -b | grep -- -U"
-        fi
+        rlRun "man checkmodule | col -b | grep -- -h"
+        rlRun "man checkmodule | col -b | grep -- -U"
        rlRun "checkmodule --help 2>&1 | grep -- -h"
        rlRun "checkmodule --help 2>&1 | grep -- -U"
    rlPhaseEnd

-    rlPhaseStartTest "bz#1064603 + bz#1392394"
+    rlPhaseStartTest
        for POLICY_KIND in minimum mls targeted ; do
            rlRun "checkmodule -M -m -b -o testmod.mod /etc/selinux/${POLICY_KIND}/policy/policy.* >& ${TEST_FILE}" 1
            rlRun "grep -i \"checkmodule.*-b and -m are incompatible with each other\" ${TEST_FILE}"
        done
    rlPhaseEnd

-    rlPhaseStartTest "bz#1329217"
+    rlPhaseStartTest
        INPUT_FILE="mypolicy.te"
        OUTPUT_FILE="mypolicy.output"
        rlRun "ls -l ${INPUT_FILE}"
@ -98,24 +95,6 @@ rlJournalStart
        fi
    rlPhaseEnd

-    if ! rlIsRHEL 5 6 ; then # semodule_unpackage is not available on RHEL-5 and RHEL-6
-    rlPhaseStartTest "handle unknown classes and perms"
-        rlRun "rm -f base.pp base.mod"
-        rlRun "semodule -E base"
-        rlRun "semodule_unpackage base.pp base.mod"
-        for ACTION in allow deny reject ; do
-            rlRun "checkmodule -b -o base.out -M -U ${ACTION} base.mod"
-            rlRun "echo -e 'u\nq\n' | sedismod base.out | grep -i \"${ACTION} unknown\""
-        done
-        rlRun "checkmodule -m -o mypolicy.out -M -U deny mypolicy.te"
-        rlRun "ls -l mypolicy.out"
-        for ACTION in allow reject ; do
-            rlRun "checkmodule -m -o mypolicy.out -M -U ${ACTION} mypolicy.te 2>&1 | grep -i 'only valid.*base module'"
-        done
-        rlRun "rm -f base.pp base.mod base.out mypolicy.out"
-    rlPhaseEnd
-    fi
-
    rlPhaseStartCleanup
        rlRun "rm -rf ${TEST_FILE} ${TEST_DIR} ${OUTPUT_FILE}"
    rlPhaseEnd
--- a/checkpolicy/checkpolicy-docs/Makefile
+++ b/checkpolicy/checkpolicy-docs/Makefile
@ -1,6 +1,6 @@
 # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 #
-#   Makefile of /CoreOS/checkpolicy/Sanity/checkpolicy-docs
+#   Makefile of /CoreOS/checkpolicy/Sanity/checkpolicy
 #   Description: covers an issue where manpage included an unsupported option.
 #   Author: Milos Malik <mmalik@redhat.com>
 #
@ -24,7 +24,7 @@
 #
 # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

-export TEST=/CoreOS/checkpolicy/Sanity/checkpolicy-docs
+export TEST=/CoreOS/checkpolicy/Sanity/checkpolicy
 export TESTVERSION=1.0

 BUILT_FILES=
--- a/checkpolicy/checkpolicy-docs/PURPOSE
+++ b/checkpolicy/checkpolicy-docs/PURPOSE
@ -1,4 +1,4 @@
-PURPOSE of /CoreOS/checkpolicy/Sanity/checkpolicy-docs
+PURPOSE of /CoreOS/checkpolicy/Sanity/checkpolicy

 Description: covers an issue where manpage included an unsupported option.

--- a/checkpolicy/checkpolicy-docs/main.fmf
+++ b/checkpolicy/checkpolicy-docs/main.fmf
@ -1,37 +1 @@
-summary: covers an issue where manpage included an unsupported option.
-description: |+
-    Description: covers an issue where manpage included an unsupported option.
-
-    Author: Milos Malik <mmalik@redhat.com>
-
-
-contact: Milos Malik <mmalik@redhat.com>
-component:
-  - setools
-  - checkpolicy
-recommend:
-  - checkpolicy
-duration: 1m
-enabled: true
-tag:
-  - CI-Tier-1
-  - NoRHEL4
-  - TIPpass_Security
-  - f31friendly
-  - f32friendly
-  - targeted
-  - NoRHIVOS
-tier: 1
-link:
-  - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1328966
-  - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1328979
-  - relates: https://bugzilla.redhat.com/show_bug.cgi?id=739866
-  - relates: https://bugzilla.redhat.com/show_bug.cgi?id=533790
-adjust+:
-  - enabled: false
-    when: distro == rhel-4
-    continue: false
-extra-nitrate: TC#00612804
-extra-summary: /CoreOS/checkpolicy/Sanity/checkpolicy-docs
-extra-task: /CoreOS/checkpolicy/Sanity/checkpolicy-docs
-id: 8e06af12-0434-448a-aa85-9ed5c854daf9
+path: /checkpolicy/checkpolicy-docs
--- a/checkpolicy/checkpolicy-docs/runtest.sh
+++ b/checkpolicy/checkpolicy-docs/runtest.sh
@ -27,6 +27,7 @@
 # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 # Include rhts environment
+. /usr/bin/rhts-environment.sh
 . /usr/share/beakerlib/beakerlib.sh

 PACKAGE="checkpolicy"
--- a/checkpolicy/checkpolicy/Makefile
+++ b/checkpolicy/checkpolicy/Makefile
@ -59,10 +59,6 @@ $(METADATA): Makefile
 	@echo "Confidential:    no" >> $(METADATA)
 	@echo "Destructive:     no" >> $(METADATA)
 	@echo "Releases:        -RHEL4" >> $(METADATA)
-	@echo "Bug:             533790" >> $(METADATA) # RHEL-5
-	@echo "Bug:             739866" >> $(METADATA) # RHEL-6
-	@echo "Bug:             1328966" >> $(METADATA) # RHEL-7
-	@echo "Bug:             1328979" >> $(METADATA) # RHEL-7

 	rhts-lint $(METADATA)

--- a/checkpolicy/checkpolicy/PURPOSE
+++ b/checkpolicy/checkpolicy/PURPOSE
@ -4,5 +4,4 @@ Description: runs checkpolicy with various options to find out if it behaves cor

 Author: Milos Malik <mmalik@redhat.com>

-This test also covers bz#533790 ( https://bugzilla.redhat.com/show_bug.cgi?id=533790 ).

--- a/checkpolicy/checkpolicy/main.fmf
+++ b/checkpolicy/checkpolicy/main.fmf
@ -1,41 +1,2 @@
-summary: runs checkpolicy with various options to find out if it behaves correctly
-description: |+
-    Description: runs checkpolicy with various options to find out if it behaves correctly
-
-    Author: Milos Malik <mmalik@redhat.com>
-
-    This test also covers bz#533790 ( https://bugzilla.redhat.com/show_bug.cgi?id=533790 ).
-
-contact: Milos Malik <mmalik@redhat.com>
-component:
-  - setools
-  - checkpolicy
-test: ./runtest.sh
-framework: beakerlib
-recommend:
-  - checkpolicy
-  - setools-console
-  - selinux-policy-minimum
-  - selinux-policy-mls
-  - selinux-policy-targeted
-duration: 10m
-enabled: true
-tag:
-  - CI-Tier-1
-  - NoRHEL4
-  - f31friendly
-  - f32friendly
-  - targeted
+path: /checkpolicy/checkpolicy
 tier: 1
-link:
-  - relates: https://bugzilla.redhat.com/show_bug.cgi?id=533790
-  - relates: https://bugzilla.redhat.com/show_bug.cgi?id=739866
-  - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1328966
-  - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1328979
-adjust+:
-  - enabled: false
-    when: distro == rhel-4
-    continue: false
-extra-nitrate: TC#0062302
-extra-summary: /CoreOS/checkpolicy/Sanity/checkpolicy
-extra-task: /CoreOS/checkpolicy/Sanity/checkpolicy
--- a/checkpolicy/checkpolicy/runtest.sh
+++ b/checkpolicy/checkpolicy/runtest.sh
@ -27,6 +27,7 @@
 # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 # Include rhts environment
+. /usr/bin/rhts-environment.sh
 . /usr/share/beakerlib/beakerlib.sh

 PACKAGE="checkpolicy"
@ -34,11 +35,9 @@ PACKAGE="checkpolicy"
 rlJournalStart
    rlPhaseStartSetup
        rlAssertRpm ${PACKAGE}
-        if rlIsRHEL "<9" ; then
-            rlAssertRpm selinux-policy-minimum
-        fi
-        rlRun "rpm -qa | grep selinux-policy"
-        rlRun "rpm -qa | grep kernel"
+        rlAssertRpm selinux-policy-minimum
+        rlAssertRpm selinux-policy-mls
+        rlAssertRpm selinux-policy-targeted
        rlRun "uname -a"
        TEST_FILE=`mktemp`
        TEST_DIR=`mktemp -d`
@ -53,7 +52,7 @@ rlJournalStart
        if rlIsRHEL 5 6 ; then
            VERSIONS=`seq ${MIN_VERSION} 1 ${MAX_VERSION}`
        else
-            # some versions are skipped because of BZ#1328979
+            # some versions are skipped because seinfo segfaults when inspecting binary policies between v.20 and v.23"
            VERSIONS=`seq ${MIN_VERSION} 1 ${MAX_VERSION} | grep -v -e 19 -e 20 -e 21 -e 22 -e 23`
        fi
        for CUR_VERSION in ${VERSIONS} ; do
@ -68,7 +67,7 @@ rlJournalStart
        done
    rlPhaseEnd

-    rlPhaseStartTest "bz#533790"
+    rlPhaseStartTest
        rlRun "checkpolicy >& ${TEST_FILE}" 1
        rlAssertGrep "unable to open policy.conf" ${TEST_FILE}
        rlRun "checkpolicy -b >& ${TEST_FILE}" 1
@ -99,13 +98,11 @@ rlJournalStart
        rlRun "checkpolicy -c 0 2>&1 | grep \"value 0 not in range\""
        rlRun "checkpolicy -t 2>&1 | grep \"option requires an argument\""
        rlRun "checkpolicy -t xyz 2>&1 | grep -i \"unknown target platform\""
-        if [ -e "/usr/share/man/man8/checkmodule.8.gz" ]; then
-            rlRun "man checkpolicy | col -b | grep -- '-m]'" 1
-        fi
+        rlRun "man checkpolicy | col -b | grep -- '-m]'" 1
        rlRun "checkpolicy --help 2>&1 | grep -- '-m]'" 1
    rlPhaseEnd

-    rlPhaseStartTest "bz#739866"
+    rlPhaseStartTest
        if rlIsRHEL 5 6 ; then
            ACTIVE_POLICY="/selinux/policy"
        else
@ -113,13 +110,8 @@ rlJournalStart
        fi
        rlRun "echo -e 'q\n' | checkpolicy -Mdb ${ACTIVE_POLICY} | tee ${OUTPUT_FILE}"
        rlRun "grep -qi -e error -e ebitmap -e 'not match' ${OUTPUT_FILE}" 1
-        if rlIsRHEL "<9" ; then
-            LIST="minimum mls targeted"
-        else
-            LIST="mls targeted"
-        fi
-        for POLICY_TYPE in $LIST ; do
-            if ! stat /etc/selinux/${POLICY_TYPE}/policy/policy.* >& /dev/null ; then
+        for POLICY_TYPE in minimum mls targeted ; do
+            if [ ! -e /etc/selinux/${POLICY_TYPE}/policy/policy.* ] ; then
                continue
            fi
            rlRun "echo -e 'q\n' | checkpolicy -Mdb /etc/selinux/${POLICY_TYPE}/policy/policy.* | tee ${OUTPUT_FILE}"
@ -127,7 +119,7 @@ rlJournalStart
        done
    rlPhaseEnd

-    rlPhaseStartTest "bz#1328966 + bz#1328979"
+    rlPhaseStartTest
        if rlIsRHEL 5 6 ; then
            ACTIVE_POLICY_TREE="/selinux"
        else # RHEL-7 and above
@ -135,20 +127,11 @@ rlJournalStart
        fi
        MIN_VERSION="15"
        MAX_VERSION=`find /etc/selinux/ -name policy.?? | cut -d / -f 6 | cut -d . -f 2 | head -n 1`
-        if rlIsRHEL "<9" ; then
-            LIST="minimum mls targeted"
-        else
-            LIST="mls targeted"
-        fi
-        for POLICY_TYPE in $LIST ; do
-            if ! stat /etc/selinux/${POLICY_TYPE}/policy/policy.* >& /dev/null ; then
-                rlLog "${POLICY_TYPE} policy file is not available, skipping"
-                continue
-            fi
+        for POLICY_TYPE in minimum mls targeted ; do
            if rlIsRHEL 5 6 ; then
                VERSIONS=`seq ${MIN_VERSION} 1 ${MAX_VERSION}`
            else
-                # some versions are skipped because of BZ#1328979
+                # some versions are skipped because seinfo segfaults when inspecting binary policies between v.20 and v.23"
                VERSIONS=`seq ${MIN_VERSION} 1 ${MAX_VERSION} | grep -v -e 19 -e 20 -e 21 -e 22 -e 23`
            fi
            for CUR_VERSION in ${VERSIONS} ; do
@ -164,75 +147,8 @@ rlJournalStart
        done
    rlPhaseEnd

-    rlPhaseStartTest "handle unknown classes and perms"
-        for ACTION in allow deny reject ; do
-            rlRun "rm -f policy.out"
-            rlWatchdog "checkpolicy -M -U ${ACTION} -o policy.out policy.conf.from.secilc" 15
-            if [ -s policy.out ] ; then
-                rlRun "echo -e 'U\nq\n' | sedispol policy.out 2>&1 | tee ${OUTPUT_FILE}"
-                rlRun "grep -i \"${ACTION} unknown\" ${OUTPUT_FILE}"
-            else
-                rlFail "policy.out is empty or was not created"
-            fi
-        done
-    rlPhaseEnd
-
-    if ! rlIsRHEL '<=8.1'; then
-    rlPhaseStartTest "sorting ocontexts"
-        # check -S option in --help
-        rlRun "checkpolicy --help >$OUTPUT_FILE" 0,1
-        rlRun "cat $OUTPUT_FILE"
-        rlAssertGrep "\[-S\]" $OUTPUT_FILE
-
-        if [ -e "/usr/share/man/man8/checkmodule.8.gz" ];then
-            # check -S option in man page
-            rlRun "PAGER=cat man checkpolicy >$OUTPUT_FILE"
-            rlRun "cat $OUTPUT_FILE"
-            rlAssertGrep "\[-S\]" $OUTPUT_FILE
-        fi
-
-        # run checkpolicy with the -S option
-        rlWatchdog "checkpolicy -S -M -o policy.out policy.conf.from.secilc" 15
-        rlRun "seinfo policy.out"
-    rlPhaseEnd
-    fi
-
-    rlPhaseStartTest "Test checkpolicy cil option"
-        # check -C option without input file
-        rlRun "checkpolicy -C 2>&1 | grep \"unable to open policy.conf\""
-        # check -C option with policy.conf file
-        rlRun "checkpolicy -C -M -o policy.cil policy.conf.from.secilc"
-        rlAssertGrep "(allow [a-z]*_.* [a-z]*_.* ([a-z]* ([a-z]*)))" policy.cil
-        # check -C option with policy binary file
-        rlRun "checkpolicy -C -M -o policy.cil2 -b /sys/fs/selinux/policy"
-        rlAssertGrep "(allow [a-z]*_.* [a-z]*_.* ([a-z]* ([a-z]*)))" policy.cil2
-    rlPhaseEnd
-
-    if rlIsRHEL '>=9' ; then
-    rlPhaseStartTest "Test checkpolicy optimize option"
-        # check -O option without input file
-        rlRun "checkpolicy -O 2>&1 | grep \"unable to open policy.conf\""
-        # Create optimized -O binary with policy.conf file
-        rlRun "checkpolicy -O -M -o policy.opt policy.conf.from.secilc"
-        rlRun "seinfo policy.opt"
-        # Create regular binary with policy.conf file
-        rlRun "checkpolicy -M -o policy.reg policy.conf.from.secilc"
-        rlRun "seinfo policy.reg"
-        # Compare size of optimized and regular binary
-        OPT1=`stat -c %s policy.opt`
-        REG1=`stat -c %s policy.reg`
-        rlAssertGreater "Test if regular file size is higher than optimized file" $REG1 $OPT1
-        # Compare allow rule counts between optimized and regular binary
-        rlRun "seinfo policy.opt > /tmp/optfile"
-        OPT_CNT=`grep Allow: /tmp/optfile | tr -s ' ' | sed 's/^ //' | cut -d ' ' -f2`
-        rlRun "seinfo policy.reg > /tmp/regfile"
-        REG_CNT=`grep Allow: /tmp/regfile | tr -s ' ' | sed 's/^ //' | cut -d ' ' -f2`
-        rlAssertGreater "Regular file has higher allow rule than optimized file" $REG_CNT $OPT_CNT
-    rlPhaseEnd
-    fi
-
    rlPhaseStartCleanup
-        rm -f ${OUTPUT_FILE} policy.out policy.cil policy.cil2 policy.opt policy.reg /tmp/optfile /tmp/regfile
+        rm -f ${OUTPUT_FILE} policy.out
    rlPhaseEnd
 rlJournalPrintText
 rlJournalEnd
--- a/checkpolicy/internal-tests/main.fmf
+++ b/checkpolicy/internal-tests/main.fmf
@ -1,28 +0,0 @@
-summary: Run internal checkpolicy tests
-contact: Milos Malik <mmalik@redhat.com>
-component:
-  - checkpolicy
-require:
-  - bison
-  - checkpolicy
-  - flex
-  - gcc
-  - libsepol-devel
-  - make
-recommend:
-  - libsepol-static
-duration: 5m
-enabled: true
-tag:
-  - NoRHEL4
-  - NoRHEL5
-  - NoRHEL6
-  - NoRHEL7
-  - targeted
-  - avoidImageMode
-adjust+:
-  - enabled: false
-    when: distro == rhel-4, rhel-5, rhel-6, rhel-7
-    because: the test is not relevant there
-extra-nitrate: TC#0620041
-id: 3df4f40d-61a0-4267-b7db-6ff9f5254406
--- a/checkpolicy/internal-tests/runtest.sh
+++ b/checkpolicy/internal-tests/runtest.sh
@ -1,58 +0,0 @@
-#!/bin/bash
-# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-#
-#   runtest.sh of /CoreOS/checkpolicy/internal-tests
-#   Description: Run internal checkpolicy tests
-#   Author: Milos Malik <mmalik@redhat.com>
-#
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-#
-#   Copyright (c) 2026 Red Hat, Inc.
-#
-#   This copyrighted material is made available to anyone wishing
-#   to use, modify, copy, or redistribute it subject to the terms
-#   and conditions of the GNU General Public License version 2.
-#
-#   This program is distributed in the hope that it will be
-#   useful, but WITHOUT ANY WARRANTY; without even the implied
-#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
-#   PURPOSE. See the GNU General Public License for more details.
-#
-#   You should have received a copy of the GNU General Public
-#   License along with this program; if not, write to the Free
-#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-#   Boston, MA 02110-1301, USA.
-#
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-# Include Beaker environment
-. /usr/share/beakerlib/beakerlib.sh || exit 1
-
-PACKAGE="checkpolicy"
-
-rlJournalStart
-    rlPhaseStartSetup
-        rlAssertRpm ${PACKAGE}
-        if ! rpm -q libsepol-static >& /dev/null ; then
-            rlRun "dnf install -y libsepol-static --enablerepo '*'"
-        fi
-        rlRun "rpm -qa | grep libsepol | sort"
-    rlPhaseEnd
-
-    rlPhaseStartTest "non-fuzzing tests"
-        rlRun "dnf download --source ${PACKAGE}"
-        rlRun "rpm -ivh ${PACKAGE}-*.src.rpm"
-        rlRun "rm -f ${PACKAGE}-*.src.rpm"
-        rlRun "tar zxf ~/rpmbuild/SOURCES/${PACKAGE}-*.tar.gz"
-        rlRun "pushd ${PACKAGE}-*"
-        rlRun "make test"
-        rlRun "popd"
-    rlPhaseEnd
-
-    rlPhaseStartCleanup
-        rlRun "rm -rf ~/rpmbuild ${PACKAGE}-*"
-    rlPhaseEnd
-rlJournalPrintText
-rlJournalEnd
-
--- a/checkpolicy/oom-compiler-failure/PURPOSE
+++ b/checkpolicy/oom-compiler-failure/PURPOSE
@ -1,21 +0,0 @@
-PURPOSE of /CoreOS/checkpolicy/Regression/oom-compiler-failure
-Author: Petr Matyas <pmatyas@redhat.com>
-
-Description: checkpolicy and checkmodule must fail cleanly under OOM conditions
-
-When a policy compiler (checkpolicy, checkmodule) encounters a memory
-allocation failure mid-compilation it must abort and return a non-zero exit
-status.  It must not write a partial or otherwise incorrect output binary,
-which could be silently loaded by semodule and corrupt the running policy.
-
-The test constrains the virtual address space of the compiler subprocess to
-8 MB using "ulimit -v", which is below the minimum required to compile a real
-targeted policy binary but above the threshold needed to load shared libraries
-and start execution.  Two compilers are exercised:
-
-  checkpolicy -b  (recompiling the active kernel policy binary)
-  checkmodule -b  (recompiling the base module extracted from the policy store)
-
-Assertions for each compiler:
-  1. Exit status is non-zero.
-  2. The output file was not created or is empty.
--- a/checkpolicy/oom-compiler-failure/main.fmf
+++ b/checkpolicy/oom-compiler-failure/main.fmf
@ -1,18 +0,0 @@
-summary: checkpolicy and checkmodule must fail cleanly under OOM conditions
-description: |+
-    Simulate an out-of-memory condition by capping the virtual address space of
-    the compiler subprocess with ulimit -v.  Verify that both checkpolicy and
-    checkmodule exit with a non-zero status and do not produce an output binary
-    when memory is exhausted during compilation.
-
-contact: Petr Matyas <pmatyas@redhat.com>
-component:
-  - checkpolicy
-test: ./runtest.sh
-framework: beakerlib
-require:
-  - checkpolicy
-  - policycoreutils
-enabled: true
-tier: 2
-id: 4afebe54-b8f3-41d0-b9bc-91d46d436236
--- a/checkpolicy/oom-compiler-failure/runtest.sh
+++ b/checkpolicy/oom-compiler-failure/runtest.sh
@ -1,86 +0,0 @@
-#!/bin/bash
-# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-#
-#   runtest.sh of /CoreOS/checkpolicy/Regression/oom-compiler-failure
-#   Description: checkpolicy and checkmodule must fail cleanly under OOM
-#   Author: Petr Matyas <pmatyas@redhat.com>
-#
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-#
-#   Copyright (c) 2026 Red Hat, Inc. All rights reserved.
-#
-#   This copyrighted material is made available to anyone wishing
-#   to use, modify, copy, or redistribute it subject to the terms
-#   and conditions of the GNU General Public License version 2.
-#
-#   This program is distributed in the hope that it will be
-#   useful, but WITHOUT ANY WARRANTY; without even the implied
-#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
-#   PURPOSE. See the GNU General Public License for more details.
-#
-#   You should have received a copy of the GNU General Public
-#   License along with this program; if not, write to the Free
-#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-#   Boston, MA 02110-1301, USA.
-#
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-. /usr/share/beakerlib/beakerlib.sh
-
-PACKAGE="checkpolicy"
-
-# Virtual memory limit in KB applied to each compiler subprocess.
-# 8 MB is below the minimum needed to parse a real targeted policy binary
-# but above the minimum for the process to load its shared libraries and
-# start executing.  Validated against checkpolicy 3.x on RHEL-10.
-MEM_LIMIT_KB=8192
-
-rlJournalStart
-    rlPhaseStartSetup
-        rlAssertRpm ${PACKAGE}
-        rlAssertRpm policycoreutils
-        rlAssertExists "/usr/bin/checkpolicy"
-        rlAssertExists "/usr/bin/checkmodule"
-        rlAssertExists "/usr/bin/semodule_unpackage"
-
-        # Locate the active compiled policy on disk.
-        POLICY_BINARY=$(find /etc/selinux/ -name "policy.*" -type f | head -1)
-        rlAssertExists "${POLICY_BINARY}"
-        rlLog "Using policy binary: ${POLICY_BINARY}"
-
-        # Extract the base module binary so checkmodule can compile it back.
-        # semodule_unpackage accepts .pp and writes separate .mod and .fc files.
-        rlRun "semodule -E base" 0 "Extract base.pp from the active policy store"
-        rlAssertExists "base.pp"
-        rlRun "semodule_unpackage base.pp base.mod base.fc" 0 "Unpack base.pp into base.mod"
-        rlAssertExists "base.mod"
-        rlLog "base.mod size: $(stat -c %s base.mod) bytes"
-    rlPhaseEnd
-
-    rlPhaseStartTest "checkpolicy fails without producing output under OOM"
-        rlRun "rm -f policy.oom"
-        # Run checkpolicy in a child process whose virtual address space is
-        # capped.  exec replaces the shell so ulimit applies only to checkpolicy
-        # itself, leaving the test harness unaffected.
-        rlRun -s "bash -c 'ulimit -v ${MEM_LIMIT_KB}; exec checkpolicy -b -M -o policy.oom ${POLICY_BINARY}'" 1-255 \
-            "checkpolicy must exit non-zero when memory is exhausted"
-        rlLog "checkpolicy output: $(cat ${rlRun_LOG})"
-        rlRun "test ! -s policy.oom" 0 \
-            "checkpolicy must not produce an output binary under OOM"
-    rlPhaseEnd
-
-    rlPhaseStartTest "checkmodule fails without producing output under OOM"
-        rlRun "rm -f base.oom"
-        rlRun -s "bash -c 'ulimit -v ${MEM_LIMIT_KB}; exec checkmodule -b -M -o base.oom base.mod'" 1-255 \
-            "checkmodule must exit non-zero when memory is exhausted"
-        rlLog "checkmodule output: $(cat ${rlRun_LOG})"
-        rlRun "test ! -s base.oom" 0 \
-            "checkmodule must not produce an output binary under OOM"
-    rlPhaseEnd
-
-    rlPhaseStartCleanup
-        rlRun "rm -f policy.oom base.oom base.pp base.mod base.fc"
-    rlPhaseEnd
-rlJournalPrintText
-rlJournalEnd
--- a/checkpolicy/sedismod/main.fmf
+++ b/checkpolicy/sedismod/main.fmf
@ -1,31 +1 @@
-summary: Does sedismod work correctly?
-description: |+
-    Does sedismod work correctly?
-
-contact: Milos Malik <mmalik@redhat.com>
-component:
-  - checkpolicy
-recommend:
-  - checkpolicy
-  - selinux-policy-targeted
-  - expect
-  - policycoreutils
-  - psmisc
-duration: 10m
-enabled: true
-tag:
-  - NoRHEL4
-  - NoRHEL5
-  - TIPpass_Security
-  - TierCandidatesPASS
-  - f31friendly
-  - f32friendly
-  - targeted
-tier: 2
-adjust+:
-  - enabled: false
-    when: distro == rhel-4, rhel-5
-    continue: false
-extra-nitrate: TC#0518635
-extra-summary: /CoreOS/checkpolicy/Sanity/sedismod
-extra-task: /CoreOS/checkpolicy/Sanity/sedismod
+path: /checkpolicy/sedismod
--- a/checkpolicy/sedismod/runtest.sh
+++ b/checkpolicy/sedismod/runtest.sh
@ -27,11 +27,12 @@
 # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 # Include Beaker environment
+. /usr/bin/rhts-environment.sh || exit 1
 . /usr/share/beakerlib/beakerlib.sh || exit 1

 PACKAGE="checkpolicy"
 # TODO: repeat for all policy modules that are installed under /etc/selinux
-if rlIsFedora || rlIsCentOS ; then
+if rlIsFedora ; then
    POLICY_FILE="`find /var/lib/selinux/targeted -type d -name base`/hll"
 elif rlIsRHEL '<7.3' ; then
    POLICY_FILE=`find /etc/selinux/targeted -type f -name base.pp`
@ -43,7 +44,7 @@ rlJournalStart
    rlPhaseStartSetup
        rlAssertRpm ${PACKAGE}
        OUTPUT_FILE=`mktemp`
-        if rlIsRHEL '>=7.3' || rlIsCentOS || rlIsFedora ; then
+        if rlIsRHEL '>=7.3' || rlIsFedora ; then
            rlRun "semodule -H -E base"
        else
            rlRun "cp ${POLICY_FILE} ./base.pp.bz2"
@ -74,18 +75,6 @@ rlJournalStart
        done
    rlPhaseEnd

-    if sedismod --help | grep -q actions ; then
-    rlPhaseStartTest "test the non-interactive actions"
-        rlLog "introduced in version 3.6"
-        for ACTION in 1 2 3 4 5 6 7 8 9 0 a b c u F v ; do
-            rlRun "sedismod -a ${ACTION} ${POLICY_FILE} > ${ACTION}.txt"
-            rlRun "ls -l ${ACTION}.txt"
-            rlRun "test -s ${ACTION}.txt"
-            rlRun "rm -f ${ACTION}.txt"
-        done
-    rlPhaseEnd
-    fi
-
    rlPhaseStartCleanup
        rlRun "rm -f ${OUTPUT_FILE} ${POLICY_FILE}"
    rlPhaseEnd
--- a/checkpolicy/sedispol/main.fmf
+++ b/checkpolicy/sedispol/main.fmf
@ -1,31 +1 @@
-summary: Does sedispol work correctly?
-description: |+
-    Does sedispol work correctly?
-
-contact: Milos Malik <mmalik@redhat.com>
-component:
-  - checkpolicy
-recommend:
-  - checkpolicy
-  - selinux-policy
-  - expect
-duration: 10m
-enabled: true
-tag:
-  - NoRHEL4
-  - NoRHEL5
-  - f31friendly
-  - f32friendly
-  - targeted
-tier: 2
-link:
-  - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1303696
-  - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1337890
-adjust+:
-  - enabled: false
-    when: distro == rhel-4, rhel-5
-    continue: false
-extra-nitrate: TC#0518626
-extra-summary: /CoreOS/checkpolicy/Sanity/sedispol
-extra-task: /CoreOS/checkpolicy/Sanity/sedispol
-id: bbeea40d-d503-4862-91ee-3bb1b71b7baa
+path: /checkpolicy/sedispol
--- a/checkpolicy/sedispol/runtest.sh
+++ b/checkpolicy/sedispol/runtest.sh
@ -27,6 +27,7 @@
 # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 # Include Beaker environment
+. /usr/bin/rhts-environment.sh || exit 1
 . /usr/share/beakerlib/beakerlib.sh || exit 1

 PACKAGE="checkpolicy"
@ -64,23 +65,10 @@ rlJournalStart
        rlRun "grep AVTAB ${OUTPUT_FILE}"
        rlRun "grep AVTAG ${OUTPUT_FILE}" 1
        rlRun "echo -en 'u\nq\n' | sedispol ${POLICY_FILE} >& ${OUTPUT_FILE}"
-        rlRun "grep permisions ${OUTPUT_FILE}" 1
-        rlRun "echo -en 'U\nq\n' | sedispol ${POLICY_FILE} >& ${OUTPUT_FILE}"
+        rlRun "grep permissions ${OUTPUT_FILE}"
        rlRun "grep permisions ${OUTPUT_FILE}" 1
    rlPhaseEnd

-    if sedispol --help | grep -q actions ; then
-    rlPhaseStartTest "test the non-interactive actions"
-        rlLog "introduced in version 3.6"
-        for ACTION in 1 2 3 4 5 6 8 c b C r t a p u U F ; do
-            rlRun "sedispol -a ${ACTION} ${POLICY_FILE} > ${ACTION}.txt"
-            rlRun "ls -l ${ACTION}.txt"
-            rlRun "test -s ${ACTION}.txt"
-            rlRun "rm -f ${ACTION}.txt"
-        done
-    rlPhaseEnd
-    fi
-
    rlPhaseStartCleanup
        rlRun "rm -f ${OUTPUT_FILE}"
    rlPhaseEnd
--- a/kernel/CVE-2025-71085/.gitignore
+++ b/kernel/CVE-2025-71085/.gitignore
@ -1 +0,0 @@
-reproducer
--- a/kernel/CVE-2025-71085/main.fmf
+++ b/kernel/CVE-2025-71085/main.fmf
@ -1,35 +0,0 @@
-summary: Test for CVE-2025-71085
-description: |
-    Runs the reproducer for CVE-2025-71085 (taken from the original commit
-    message).
-contact: Ondrej Mosnacek <omosnace@redhat.com>
-component:
-  - kernel
-framework: beakerlib
-require:
-  - netlabel_tools
-  - gcc
-duration: 5m
-tier: 2
-check:
-  # The reproducer triggers a kernel BUG when the bug is present, so turn
-  # on the dmesg check.
-  - dmesg
-enabled: true
-link:
-  - relates: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=58fc7342b529803d3c221101102fe913df7adb83
-  - verifies: https://issues.redhat.com/browse/RHEL-143531
-  - verifies: https://issues.redhat.com/browse/RHEL-143532
-  - verifies: https://issues.redhat.com/browse/RHEL-143533
-  - verifies: https://issues.redhat.com/browse/RHEL-143534
-  - verifies: https://issues.redhat.com/browse/RHEL-143535
-  - verifies: https://issues.redhat.com/browse/RHEL-143541
-  - verifies: https://issues.redhat.com/browse/RHEL-143542
-  - verifies: https://issues.redhat.com/browse/RHEL-143543
-  - verifies: https://issues.redhat.com/browse/RHEL-143544
-  - verifies: https://issues.redhat.com/browse/RHEL-143545
-  - verifies: https://issues.redhat.com/browse/RHEL-143546
-  - verifies: https://issues.redhat.com/browse/RHEL-143547
-  - verifies: https://issues.redhat.com/browse/RHEL-143548
-  - verifies: https://issues.redhat.com/browse/RHEL-143551
-  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2429026
--- a/kernel/CVE-2025-71085/reproducer.c
+++ b/kernel/CVE-2025-71085/reproducer.c
@ -1,48 +0,0 @@
-/* SPDX-License-Identifier: GPLv2 */
-/* 
- * Copyright (c) 2026 Red Hat, Inc.
- * Author: Ondrej Mosnacek <omosnace@redhat.com>
- * Taken from: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=58fc7342b529803d3c221101102fe913df7adb83
- * (Additional copyright/authorship might apply.)
- */
-
-#include <stdlib.h>
-
-#include <arpa/inet.h>
-#include <sys/socket.h>
-
-int main(int argc, char **argv)
-{
-	int fd = socket(AF_INET6, SOCK_DGRAM, IPPROTO_UDP);
-
-	// setup msghdr
-	int cmsg_size = 2;
-	int cmsg_len = 0x60;
-	struct msghdr msg;
-	struct sockaddr_in6 dest_addr;
-	struct cmsghdr * cmsg = (struct cmsghdr *) calloc(1, sizeof(struct cmsghdr) + cmsg_len);
-	msg.msg_name = &dest_addr;
-	msg.msg_namelen = sizeof(dest_addr);
-	msg.msg_iov = NULL;
-	msg.msg_iovlen = 0;
-	msg.msg_control = cmsg;
-	msg.msg_controllen = cmsg_len;
-	msg.msg_flags = 0;
-
-	// setup sockaddr
-	dest_addr.sin6_family = AF_INET6;
-	dest_addr.sin6_port = htons(31337);
-	dest_addr.sin6_flowinfo = htonl(31337);
-	dest_addr.sin6_addr = in6addr_loopback;
-	dest_addr.sin6_scope_id = 31337;
-
-	// setup cmsghdr
-	cmsg->cmsg_len = cmsg_len;
-	cmsg->cmsg_level = IPPROTO_IPV6;
-	cmsg->cmsg_type = IPV6_HOPOPTS;
-	char * hop_hdr = (char *)cmsg + sizeof(struct cmsghdr);
-	hop_hdr[1] = 0x9; //set hop size - (0x9 + 1) * 8 = 80
-
-	sendmsg(fd, &msg, 0);
-	return 0;
-}
--- a/kernel/CVE-2025-71085/runtest.sh
+++ b/kernel/CVE-2025-71085/runtest.sh
@ -1,39 +0,0 @@
-#!/bin/bash
-# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
-# SPDX-License-Identifier: GPLv2
-# Copyright (c) 2026 Red Hat, Inc.
-# Author: Ondrej Mosnacek <omosnace@redhat.com>
-
-# Include Beakerlib environment
-. /usr/share/beakerlib/beakerlib.sh || exit 1
-
-rlJournalStart
-    rlPhaseStartSetup
-        rlRun "uname -r" 0 "Print kernel version"
-
-        rlRun "gcc -o reproducer reproducer.c" 0 "Compile the reproducer"
-
-        rlRun "netlabelctl calipso add pass doi:7" 0 "Set up CALIPSO"
-        rlRun "netlabelctl map del default" 0 "Delete default netlabel map"
-        rlRun "netlabelctl map add default address:0.0.0.0/0 protocol:unlbl" 0 \
-            "Set unlabeled traffic by default"
-        rlRun "netlabelctl map add default address:::/0 protocol:unlbl" 0 \
-            "Set unlabeled traffic by default"
-        rlRun "netlabelctl map add default address:0::1/128 protocol:calipso,7" 0 \
-            "Set up CALIPSO for localhost only"
-    rlPhaseEnd
-
-    rlPhaseStartTest
-        # Will trigger a kernel BUG in dmesg or panic when vulnerable
-        rlRun "./reproducer" 0 "Run the reproducer"
-    rlPhaseEnd
-
-    rlPhaseStartCleanup
-        rlRun "netlabelctl map del default" 0 "Delete the CALIPSO map"
-        rlRun "netlabelctl calipso del doi:7" 0 "Unsetup CALIPSO"
-        rlRun "netlabelctl map add default protocol:unlbl" 0 "Re-add default netlabel map"
-
-        rlRun "rm -f reproducer" 0 "Delete the reproducer binary"
-    rlPhaseEnd
-rlJournalPrintText
-rlJournalEnd
--- a/kernel/avc_corrupted_context/main.fmf
+++ b/kernel/avc_corrupted_context/main.fmf
@ -1,18 +0,0 @@
-summary: Test SELinux labeling before initial policy load
-description: |
-  Regression test for a bug where SELinux may have printed uninitialized
-  kernel memory instead of a valid source/target context in AVC denials.
-contact: Ondrej Mosnacek <omosnace@redhat.com>
-component:
-  - kernel
-framework: beakerlib
-require:
-  - memcached
-  - policycoreutils
-duration: 5m
-tier: 2
-enabled: true
-link:
-  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1758086
-environment:
-  AVC_ERROR: +no_avc_check
--- a/kernel/avc_corrupted_context/runtest.sh
+++ b/kernel/avc_corrupted_context/runtest.sh
@ -1,35 +0,0 @@
-#!/bin/bash
-# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
-# SPDX-License-Identifier: GPLv2
-# Copyright (c) 2022 Red Hat, Inc.
-# Author: Ondrej Mosnacek <omosnace@redhat.com>
-
-# Include Beakerlib environment
-. /usr/share/beakerlib/beakerlib.sh || exit 1
-
-rlJournalStart
-    rlPhaseStartSetup
-        rlRun "uname -r" 0 "Print running kernel version"
-        rlServiceStart memcached
-    rlPhaseEnd
-
-    rlPhaseStartTest
-        rlRun "semodule -d memcached" 0
-        rlRun "ps -Zp \$(pidof memcached) | grep unlabeled_t" 0 \
-            "The service should be unlabeled now"
-        rlRun "load_policy" 0
-        rlRun "semodule -e memcached" 0
-        rlRun "ps -Zp \$(pidof memcached) | grep unlabeled_t" 1 \
-            "The service shouldn't stay unlabeled"
-        rlRun "ps -Zp \$(pidof memcached) | grep system_r:memcached_t:s0" 0 \
-            "The service should have the correct label"
-    rlPhaseEnd
-
-    rlPhaseStartCleanup
-        rlRun "setenforce 0" 0 # service may be unlabeled
-        rlServiceStop memcached
-        rlRun "setenforce 1" 0
-        rlServiceRestore memcached
-    rlPhaseEnd
-rlJournalPrintText
-rlJournalEnd
--- a/kernel/avc_log_actual_context_if_invalid/main.fmf
+++ b/kernel/avc_log_actual_context_if_invalid/main.fmf
@ -1,32 +0,0 @@
-summary: Test logging of actual context in AVCs if it is invalid
-description: |
-  Verify that SELinux logs the actual source/target context in a separate
-  AVC record field in case it is invalid.
-contact: Ondrej Mosnacek <omosnace@redhat.com>
-component:
-  - kernel
-framework: beakerlib
-require:
-  - type: library
-    name: /selinux-policy/Library/common
-    nick: selinux-policy
-  - attr
-  - audit
-  - libselinux-utils
-  - policycoreutils
-  - selinux-policy
-duration: 15m
-tier: 2
-enabled: true
-adjust+:
-  - enabled: false
-    when: distro < rhel-8.1
-    because: RHEL-8.0 and below is not expected to support this
-link:
-  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1670039
-  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1719666
-environment:
-  AVC_ERROR: +no_avc_check
-check:
-  - how: avc
-    result: xfail
--- a/kernel/avc_log_actual_context_if_invalid/runtest.sh
+++ b/kernel/avc_log_actual_context_if_invalid/runtest.sh
@ -1,101 +0,0 @@
-# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
-# SPDX-License-Identifier: GPLv2
-# Copyright (c) 2022 Red Hat, Inc.
-# Author: Ondrej Mosnacek <omosnace@redhat.com>
-
-# Include Beakerlib environment
-. /usr/share/beakerlib/beakerlib.sh || exit 1
-
-EXE4="reproducer4"
-EXE6="reproducer6"
-PORT=8000
-
-UNLABELED_CONTEXT="system_u:object_r:unlabeled_t:s0"
-INVALID_TCONTEXT="system_u:object_r:banana_t:s0"
-INVALID_SCONTEXT="system_u:system_r:tor_t:s0"
-INVALID_SCONTEXT_MODULE="tor"
-
-GARBAGE_TCONTEXT="kuřecí řízek"
-GARBAGE_TCONTEXT_AUDIT="6B75C5996563C3AD20C599C3AD7A656B"
-
-rlJournalStart
-    rlPhaseStartSetup
-        rlImport "selinux-policy/common" # for audit daemon handling
-
-        rlRun "uname -r" 0 "Print running kernel version"
-
-        rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
-        rlRun "pushd $TmpDir"
-        old_enforce=$(getenforce)
-        rlLog "Backing up SELinux status: $old_enforce"
-        rlRun "setenforce 0" 0 "Switching to permissive"
-    rlPhaseEnd
-
-    # helper function for subtests:
-    function check_avcs() {
-        local field_main="$1"
-        local field_raw="$2"
-        local invalid_ctx="$3"
-
-        rlRun "LANG=en_US ausearch --input-logs -ts $audit_ts --raw -m AVC | \
-            grep -E '^type=AVC .* $field_main=$UNLABELED_CONTEXT' \
-            >tmpavcs" 0 "Collect AVCs"
-
-        unlabeled_avcs=$(cat tmpavcs | wc -l)
-        unlabeled_avcs_with_rawcon=$(cat tmpavcs | \
-            grep " $field_raw=$invalid_ctx" | wc -l)
-        rlAssertEquals "Check that all AVCs with $field_main=unlabeled have $field_raw= with the correct label" \
-            $unlabeled_avcs $unlabeled_avcs_with_rawcon
-        rlRun "cat tmpavcs" 0 "Print checked AVCs"
-    }
-
-    rlPhaseStartTest "trawcon"
-        rlRun "touch foo" 0 "Creating the foo test file"
-        rlRun "setfattr -n security.selinux -v $INVALID_TCONTEXT foo" 0 \
-            "Setting SELinux xattr of foo to an invalid value"
-
-        audit_ts="$(date +'%x %T')"; sleep 1.1
-        rlRun "runcon system_u:system_r:sshd_t:s0 cat foo" 0 \
-            "Generating AVCs with invalid tcontext"
-        check_avcs tcontext trawcon "\"$INVALID_TCONTEXT\""
-    rlPhaseEnd
-
-    rlPhaseStartTest "trawcon-garbage"
-        rlRun "touch foo" 0 "Creating the foo test file"
-        rlRun "setfattr -n security.selinux -v '$GARBAGE_TCONTEXT' foo" 0 \
-            "Setting SELinux xattr of foo to a garbage value"
-
-        sleep 1.1; audit_ts="$(date +'%x %T')"; sleep 1.1
-        rlRun "runcon system_u:system_r:sshd_t:s0 cat foo" 0 \
-            "Generating AVCs with invalid tcontext"
-        check_avcs tcontext trawcon "$GARBAGE_TCONTEXT_AUDIT"
-    rlPhaseEnd
-
-    rlPhaseStartTest "srawcon"
-        function gen_scontext_unlabeled_avc() {
-            local fifo="$1"
-
-            # Start bash with tor label, then make it invalid,
-            # and try to do something under the invalid label:
-            runcon "$INVALID_SCONTEXT" \
-                bash -c "cat $fifo > /dev/null; </usr/bin/echo >/dev/null" &
-            semodule -d "$INVALID_SCONTEXT_MODULE"
-            echo go! >$fifo
-            wait %1
-            semodule -e "$INVALID_SCONTEXT_MODULE"
-        }
-
-        sleep 1.1; audit_ts="$(date +'%x %T')"; sleep 1.1
-        rlRun "mkfifo tmpfifo" 0
-        rlRun "gen_scontext_unlabeled_avc tmpfifo" 0 \
-            "Generating AVCs with invalid scontext"
-        check_avcs scontext srawcon "\"$INVALID_SCONTEXT\""
-    rlPhaseEnd
-
-    rlPhaseStartCleanup
-        rlRun "setenforce $old_enforce" 0 "Restoring SELinux status"
-        rlRun "popd"
-        rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
-    rlPhaseEnd
-rlJournalPrintText
-rlJournalEnd
--- a/kernel/avc_tracepoint/Makefile
+++ b/kernel/avc_tracepoint/Makefile
@ -1,7 +0,0 @@
-# Minimal Makefile for standard-test-roles-beakerlib
-
-R="RhtsRequires: perf"
-
-run:
-	chmod +x runtest.sh
-	./runtest.sh
--- a/kernel/avc_tracepoint/main.fmf
+++ b/kernel/avc_tracepoint/main.fmf
@ -1,30 +0,0 @@
-summary: Basic test for SELinux AVC tracepoint support
-description: |
-  Tests basic functionality of the built-in kernel tracepoint for audited
-  SELinux denials that has been introduced in kernel v5.10.
-
-  See also:
-  https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=dd8166212d9a2eca3181567c953d5687aea4d7dc
-contact: Ondrej Mosnacek <omosnace@redhat.com>
-component:
- kernel
-framework: beakerlib
-require:
- perf
-duration: 5m
-tier: 2
-enabled: true
-adjust+:
- enabled: false
-  when: distro < rhel-8.5
-  because: RHEL-8.5 and below are not expected to support this
- enabled: false
-  when: distro < fedora-35
-  because: This feature may not be available in kernels in F34 and below
-link:
- verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1954024
-environment:
-  AVC_ERROR: +no_avc_check
-check:
-  - how: avc
-    result: xfail
--- a/kernel/avc_tracepoint/runtest.sh
+++ b/kernel/avc_tracepoint/runtest.sh
@ -1,29 +0,0 @@
-#!/bin/bash
-# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
-# SPDX-License-Identifier: GPLv2
-# Copyright (c) 2021 Red Hat, Inc.
-# Author: Ondrej Mosnacek <omosnace@redhat.com>
-
-# Include Beakerlib environment
-. /usr/share/beakerlib/beakerlib.sh || exit 1
-
-rlJournalStart
-    rlPhaseStartSetup
-        rlRun "uname -r"
-    rlPhaseEnd
-
-    rlPhaseStartTest
-        rlAssertExists /sys/kernel/tracing/events/avc/selinux_audited/enable
-        rlRun "perf list | grep avc:selinux_audited"
-        rlRun "perf record -o perf.data -e avc:selinux_audited -g \
-            runcon system_u:system_r:kernel_t:s0 echo" 0-255
-        rlRun "perf script -i perf.data"
-        rlAssertGreater "'perf script' output should have more than 0 lines" \
-            "$(perf script -i perf.data | wc -l)" "0"
-    rlPhaseEnd
-
-    rlPhaseStartCleanup
-        rlRun "rm -f perf.data"
-    rlPhaseEnd
-rlJournalPrintText
-rlJournalEnd
--- a/kernel/bogus-warning-in-selinux_ima_measure_state/main.fmf
+++ b/kernel/bogus-warning-in-selinux_ima_measure_state/main.fmf
@ -1,22 +0,0 @@
-summary: Regression test for bogus WARNING in SELinux
-description: |
-    Verify that selinux_ima_measure_state() doesn't trigger a bogus
-    lock-related WARN_ON() when the mutex is held by another task.
-contact: Ondrej Mosnacek <omosnace@redhat.com>
-component:
- kernel
-framework: beakerlib
-require:
- policycoreutils
-duration: 5m
-tier: 2
-enabled: true
-adjust+:
- enabled: false
-  when: distro < fedora-36
-  because: some kernels on Fedora 35 and below don't have the fix
- enabled: false
-  when: distro < rhel-9.1
-  because: not expected to be fixed earlier than RHEL-9.1
-link:
- verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2050966
--- a/kernel/bogus-warning-in-selinux_ima_measure_state/runtest.sh
+++ b/kernel/bogus-warning-in-selinux_ima_measure_state/runtest.sh
@ -1,32 +0,0 @@
-#!/bin/bash
-# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
-# SPDX-License-Identifier: GPLv2
-# Copyright (c) 2022 Red Hat, Inc.
-# Author: Ondrej Mosnacek <omosnace@redhat.com>
-
-# Include Beakerlib environment
-. /usr/share/beakerlib/beakerlib.sh || exit 1
-
-function trigger_the_bug() {
-    while true; do echo 0 > /sys/fs/selinux/checkreqprot; done &
-    while true; do load_policy; done &
-
-    sleep 15s
-
-    kill $(jobs -p)
-    wait $(jobs -p)
-    return 0
-}
-
-rlJournalStart
-    rlPhaseStartSetup
-        rlRun "uname -r" 0 "Show the running kernel version"
-    rlPhaseEnd
-
-    rlPhaseStartTest
-        rlRun "trigger_the_bug" 0 "Run the reproducer"
-        rlRun "dmesg | grep -E 'WARNING:.*selinux_ima_measure_state'" 1 \
-            "Check that dmesg doesn't contain relevant WARNING lines"
-    rlPhaseEnd
-rlJournalPrintText
-rlJournalEnd
--- a/kernel/connect_AF_UNSPEC/main.fmf
+++ b/kernel/connect_AF_UNSPEC/main.fmf
@ -1,25 +0,0 @@
-summary: Test connect(AF_UNSPEC) behavior
-description: |
-  Ensure that connect(AF_UNSPEC) (should disconnect a connected socket)
-  works correctly under SELinux.
-contact: Ondrej Mosnacek <omosnace@redhat.com>
-component:
-  - kernel
-framework: beakerlib
-require:
-  - gcc
-  - nc
-  - strace
-duration: 5m
-tier: 2
-enabled: true
-adjust+:
-  - enabled: false
-    when: distro ~< rhel-8.1
-    because: RHEL-8.0 is not expected to have the bug fixed
-  - enabled: false
-    when: distro ~< rhel-7.9
-    because: RHEL-7.8 and below are not expected to have the bug fixed
-link:
-  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1707828
-  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1886305
--- a/kernel/connect_AF_UNSPEC/reproducer4.c
+++ b/kernel/connect_AF_UNSPEC/reproducer4.c
@ -1,46 +0,0 @@
-#include <sys/types.h>
-#include <sys/socket.h>
-
-#include <netinet/in.h>
-
-#include <unistd.h>
-#include <stdlib.h>
-#include <string.h>
-#include <stdio.h>
-
-int main(int argc, char **argv)
-{
-	int fd;
-	struct sockaddr_in addr;
-	struct sockaddr addr_unspec;
-
-	if (argc < 2)
-		return 2;
-
-	fd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
-	if (fd < 0) {
-		perror(argv[0]);
-		return 1;
-	}
-
-	addr.sin_family = AF_INET;
-	addr.sin_port = htons(atoi(argv[1]));
-	addr.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
-
-	if (connect(fd, (struct sockaddr *)&addr, sizeof(addr)) < 0) {
-		perror(argv[0]);
-		close(fd);
-		return 1;
-	}
-
-	memset(&addr_unspec, 0, sizeof(addr_unspec));
-	addr_unspec.sa_family = AF_UNSPEC;
-	if (connect(fd, (struct sockaddr *)&addr_unspec, sizeof(addr_unspec)) < 0) {
-		perror(argv[0]);
-		close(fd);
-		return 1;
-	}
-
-	close(fd);
-	return 0;
-}
--- a/kernel/connect_AF_UNSPEC/reproducer6.c
+++ b/kernel/connect_AF_UNSPEC/reproducer6.c
@ -1,47 +0,0 @@
-#include <sys/types.h>
-#include <sys/socket.h>
-
-#include <netinet/in.h>
-
-#include <unistd.h>
-#include <stdlib.h>
-#include <string.h>
-#include <stdio.h>
-
-int main(int argc, char **argv)
-{
-	int fd;
-	struct sockaddr_in6 addr;
-	struct sockaddr addr_unspec;
-
-	if (argc < 2)
-		return 2;
-
-	fd = socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP);
-	if (fd < 0) {
-		perror(argv[0]);
-		return 1;
-	}
-
-	memset(&addr, 0, sizeof(addr));
-	addr.sin6_family = AF_INET6;
-	addr.sin6_port = htons(atoi(argv[1]));
-	addr.sin6_addr = (struct in6_addr)IN6ADDR_LOOPBACK_INIT;
-
-	if (connect(fd, (struct sockaddr *)&addr, sizeof(addr)) < 0) {
-		perror(argv[0]);
-		close(fd);
-		return 1;
-	}
-
-	memset(&addr_unspec, 0, sizeof(addr_unspec));
-	addr_unspec.sa_family = AF_UNSPEC;
-	if (connect(fd, (struct sockaddr *)&addr_unspec, sizeof(addr_unspec)) < 0) {
-		perror(argv[0]);
-		close(fd);
-		return 1;
-	}
-
-	close(fd);
-	return 0;
-}
--- a/kernel/connect_AF_UNSPEC/runtest.sh
+++ b/kernel/connect_AF_UNSPEC/runtest.sh
@ -1,39 +0,0 @@
-# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
-# SPDX-License-Identifier: GPLv2
-# Copyright (c) 2022 Red Hat, Inc.
-# Author: Ondrej Mosnacek <omosnace@redhat.com>
-
-# Include Beakerlib environment
-. /usr/share/beakerlib/beakerlib.sh || exit 1
-
-EXE4="reproducer4"
-EXE6="reproducer6"
-PORT=8000
-
-rlJournalStart
-    rlPhaseStartSetup
-        rlRun "uname -r" 0 "Print running kernel version"
-
-        rlRun "gcc -o $EXE4 reproducer4.c" 0 "Compile the IPv4 reproducer"
-        rlRun "gcc -o $EXE6 reproducer6.c" 0 "Compile the IPv6 reproducer"
-        rlRun "nc -4lk $PORT &" 0 "Start IPv4 server"
-        rlRun "nc -6lk $PORT &" 0 "Start IPv6 server"
-    rlPhaseEnd
-
-    rlPhaseStartTest "IPv4"
-        rlRun "strace ./$EXE4 $PORT" 0 "Run the IPv4 reproducer"
-    rlPhaseEnd
-
-    rlPhaseStartTest "IPv6"
-        rlRun "strace ./$EXE6 $PORT" 0 "Run the IPv6 reproducer"
-    rlPhaseEnd
-
-    rlPhaseStartCleanup
-        rlRun "rm -f $EXE4" 0 "Removing the IPv4 reproducer binary"
-        rlRun "rm -f $EXE6" 0 "Removing the IPv6 reproducer binary"
-        rlRun "kill %1" 0 "Kill the IPv4 server"
-        rlRun "kill %2" 0 "Kill the IPv6 server"
-        rlRun "wait $(jobs -p | tr '\n' ' ')" 0,143 "Wait for the servers to terminate"
-    rlPhaseEnd
-rlJournalPrintText
-rlJournalEnd
--- a/kernel/fanotify-mark-anon-pipe/.gitignore
+++ b/kernel/fanotify-mark-anon-pipe/.gitignore
@ -1 +0,0 @@
-reproducer
--- a/kernel/fanotify-mark-anon-pipe/main.fmf
+++ b/kernel/fanotify-mark-anon-pipe/main.fmf
@ -1,21 +0,0 @@
-summary: Verify no invalid denials for fanotify_mark() on an anonymous pipe
-description: |
-    Verify that calling fanotify_mark() on an anonymous pipe just fails
-    with EINVAL and doesn't fail on SELinux checks earlier.
-contact: Ondrej Mosnacek <omosnace@redhat.com>
-component:
-  - kernel
-framework: beakerlib
-require:
-  - gcc
-duration: 5m
-tier: 2
-check:
-  - how: avc
-enabled: true
-adjust+:
-  - enabled: false
-    when: distro < rhel-9
-    because: On RHEL-8 fanotify mark is allowed on anonymous pipes.
-link:
-  - verifies: https://issues.redhat.com/browse/RHEL-53850
--- a/kernel/fanotify-mark-anon-pipe/reproducer.c
+++ b/kernel/fanotify-mark-anon-pipe/reproducer.c
@ -1,66 +0,0 @@
-/* SPDX-License-Identifier: GPLv2 */
-/* Copyright (c) 2026 Red Hat, Inc. */
-/* Author: Ondrej Mosnacek <omosnace@redhat.com> */
-
-#define _GNU_SOURCE
-
-#include <errno.h>
-#include <string.h>
-#include <stdio.h>
-
-#include <fcntl.h>
-#include <unistd.h>
-
-#include <sys/fanotify.h>
-
-int main(int argc, char **argv)
-{
-	int ffd, ret, rc, pfd[2];
-
-	ret = pipe2(pfd, O_CLOEXEC);
-	if (ret == -1) {
-		perror("pipe2");
-		rc = 2;
-		goto exit;
-	}
-
-	ffd = fanotify_init(FAN_CLASS_NOTIF, O_RDONLY);
-	if (ffd == -1) {
-		perror("fanotify_init");
-		rc = 2;
-		goto exit_close_pipes;
-	}
-
-	rc = 0;
-
-	ret = fanotify_mark(ffd, FAN_MARK_ADD | FAN_MARK_MOUNT, FAN_ACCESS,
-			    pfd[0], NULL);
-	if (ret == 0) {
-		printf("FAIL: fanotify_mark() with FAN_MARK_MOUNT succeeded\n");
-		rc = 1;
-	} else if (errno == EINVAL) {
-		printf("PASS: fanotify_mark() with FAN_MARK_MOUNT failed with EINVAL as expected\n");
-	} else {
-		printf("FAIL: fanotify_mark() with FAN_MARK_MOUNT failed with %s\n", strerror(errno));
-		rc = 1;
-	}
-
-	ret = fanotify_mark(ffd, FAN_MARK_ADD | FAN_MARK_FILESYSTEM, FAN_ACCESS,
-			    pfd[0], NULL);
-	if (ret == 0) {
-		printf("FAIL: fanotify_mark() with FAN_MARK_FILESYSTEM succeeded\n");
-		rc = 1;
-	} else if (errno == EINVAL) {
-		printf("PASS: fanotify_mark() with FAN_MARK_FILESYSTEM failed with EINVAL as expected\n");
-	} else {
-		printf("FAIL: fanotify_mark() with FAN_MARK_FILESYSTEM failed with %s\n", strerror(errno));
-		rc = 1;
-	}
-
-	close(ffd);
-exit_close_pipes:
-	close(pfd[0]);
-	close(pfd[1]);
-exit:
-	return rc;
-}
--- a/kernel/fanotify-mark-anon-pipe/runtest.sh
+++ b/kernel/fanotify-mark-anon-pipe/runtest.sh
@ -1,25 +0,0 @@
-#!/bin/bash
-# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
-# SPDX-License-Identifier: GPLv2
-# Copyright (c) 2026 Red Hat, Inc.
-# Author: Ondrej Mosnacek <omosnace@redhat.com>
-
-# Include Beakerlib environment
-. /usr/share/beakerlib/beakerlib.sh || exit 1
-
-rlJournalStart
-    rlPhaseStartSetup
-        rlRun "uname -r" 0 "Print kernel version"
-
-        rlRun "gcc -o reproducer reproducer.c" 0 "Compile the reproducer"
-    rlPhaseEnd
-
-    rlPhaseStartTest
-        rlRun "./reproducer" 0 "Run the reproducer"
-    rlPhaseEnd
-
-    rlPhaseStartCleanup
-        rlRun "rm -f reproducer" 0 "Delete the reproducer binary"
-    rlPhaseEnd
-rlJournalPrintText
-rlJournalEnd
--- a/kernel/genfs_fallback/Makefile
+++ b/kernel/genfs_fallback/Makefile
@ -1,7 +0,0 @@
-# Minimal Makefile for standard-test-roles-beakerlib
-
-R="RhtsRequires: policycoreutils"
-
-run:
-	chmod +x runtest.sh
-	./runtest.sh
--- a/kernel/genfs_fallback/main.fmf
+++ b/kernel/genfs_fallback/main.fmf
@ -1,29 +0,0 @@
-summary: Test genfscon fallback for fs_use_xattr when no xattr support
-description: |
-    Test that a fs_use_xattr filesystem mount falls back to genfscon when it
-    doesn't have xattr support.
-
-    See also:
-    https://lore.kernel.org/selinux/CAFqZXNsGabHBfV36nNAVLJgEzjkBev-O3YZ1vnmXyVoaDdjiHQ@mail.gmail.com/T/
-    https://lore.kernel.org/selinux/20210113123802.63563-1-omosnace@redhat.com/
-contact: Ondrej Mosnacek <omosnace@redhat.com>
-component:
- kernel
-framework: beakerlib
-require:
- policycoreutils
- dosfstools
-duration: 5m
-tier: 2
-enabled: true
-adjust+:
- -  enabled: false
-    when: distro < rhel-8.5
-    because: RHEL-8.5 and below are not expected to support this
- -  enabled: false
-    when: distro < fedora-35
-    because: This feature may not be supported on kernels in F34 and below
-link:
- verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1899703
- verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1915825
- verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1937297
--- a/kernel/genfs_fallback/runtest.sh
+++ b/kernel/genfs_fallback/runtest.sh
@ -1,39 +0,0 @@
-#!/bin/bash
-# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
-# SPDX-License-Identifier: GPLv2
-# Copyright (c) 2021 Red Hat, Inc.
-# Author: Ondrej Mosnacek <omosnace@redhat.com>
-
-# Include Beakerlib environment
-. /usr/share/beakerlib/beakerlib.sh || exit 1
-
-rlJournalStart
-    rlPhaseStartSetup
-        rlRun "uname -r"
-
-        rlRun "dd if=/dev/zero of=diskfile bs=4M count=1"
-        rlRun "mkfs.vfat diskfile"
-        DEVICE="$(losetup -f)"
-        rlRun "losetup $DEVICE diskfile"
-
-        rlRun "echo '(fsuse xattr vfat (system_u object_r fs_t ((s0) (s0))))' >vfat_xattr.cil"
-        rlRun "semodule -i vfat_xattr.cil"
-        rlRun "mkdir /mnt/test-vfat"
-    rlPhaseEnd
-
-    rlPhaseStartTest
-        rlRun "mount -t vfat $DEVICE /mnt/test-vfat"
-        rlRun "[ \"\$(secon -t -f /mnt/test-vfat)\" = dosfs_t ]"
-    rlPhaseEnd
-
-    rlPhaseStartCleanup
-        rlRun "umount /mnt/test-vfat" 0-1
-        rlRun "rmdir /mnt/test-vfat"
-        rlRun "semodule -r vfat_xattr" 0-1
-        rlRun "rm -f vfat_xattr.cil"
-
-        rlRun "losetup -d $DEVICE" 0-1
-        rlRun "rm -f diskfile"
-    rlPhaseEnd
-rlJournalPrintText
-rlJournalEnd
--- a/kernel/getxattr_read_out_of_bounds/main.fmf
+++ b/kernel/getxattr_read_out_of_bounds/main.fmf
@ -1,26 +0,0 @@
-summary: Reproducer for an out-of-bounds read on getxattr(2)
-description: |
-  Verifies that it is not possible to trigger an out-of-bounds read by
-  setting the security.selinux xattr to a value containing a null character
-  and then trying to read back the xattr.
-
-  See also: https://git.kernel.org/torvalds/c/efe3de79e0b5
-contact: Ondrej Mosnacek <omosnace@redhat.com>
-component:
-  - kernel
-framework: beakerlib
-require:
-  - coreutils
-  - policycoreutils
-  - attr
-duration: 5m
-tier: 2
-enabled: true
-link:
-  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1584307
-  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1595706
-environment:
-  AVC_ERROR: +no_avc_check
-check:
-  - how: avc
-    result: xfail
--- a/kernel/getxattr_read_out_of_bounds/runtest.sh
+++ b/kernel/getxattr_read_out_of_bounds/runtest.sh
@ -1,36 +0,0 @@
-#!/bin/bash
-# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
-# SPDX-License-Identifier: GPLv2
-# Copyright (c) 2018-2022 Red Hat, Inc.
-# Author: Ondrej Mosnacek <omosnace@redhat.com>
-
-# Include Beakerlib environment
-. /usr/share/beakerlib/beakerlib.sh || exit 1
-
-rlJournalStart
-    rlPhaseStartSetup
-        rlRun "uname -r" 0 "Print running kernel version"
-        rlRun "touch testfile"
-        reset_enforcing=0
-        if [ "$(getenforce)" = "Enforcing" ]; then
-            rlRun "setenforce 0" 0 "Switch to permissive"
-            reset_enforcing=1
-        fi
-    rlPhaseEnd
-
-    rlPhaseStartTest
-        rlRun "setfattr -n security.selinux -v 'a\\0aaaaaaaaaaaaaaaa' testfile" 0 \
-            "Try to set a label with a null char in it"
-        rlRun "getfattr -e hex -n security.selinux testfile"
-        rlRun "getfattr -e hex -n security.selinux testfile | grep -E '0x6100[0-9a-f]+'" 1 \
-            "Check for junk in the output of getfattr"
-    rlPhaseEnd
-
-    rlPhaseStartCleanup
-        if [ "$reset_enforcing" -eq 1 ]; then
-            rlRun "setenforce 1" 0 "Switch back to enforcing"
-        fi
-        rlRun "rm -f testfile"
-    rlPhaseEnd
-rlJournalPrintText
-rlJournalEnd
--- a/kernel/journald_performance/main.fmf
+++ b/kernel/journald_performance/main.fmf
@ -1,26 +0,0 @@
-summary: Test journald performance under SELinux
-description: |
-  Regression test for a bug where systemd-journald suffered a terrible
-  performance overhead due to SELinux.
-contact: Ondrej Mosnacek <omosnace@redhat.com>
-component:
-  - kernel
-framework: beakerlib
-require:
-  - perf
-  - util-linux
-  - coreutils
-  - perl-interpreter
-  - perl-open
-  - git-core
-duration: 30m
-tier: 2
-enabled: true
-adjust+:
-  - enabled: false
-    when: distro < rhel-8.3
-    because: RHEL-8.2 and below are not expected to have the bug fixed
-link:
-  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1733259
-tag:
-  - failinfedora
--- a/kernel/journald_performance/runtest.sh
+++ b/kernel/journald_performance/runtest.sh
@ -1,60 +0,0 @@
-#!/bin/bash
-# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
-# SPDX-License-Identifier: GPLv2
-# Copyright (c) 2022 Red Hat, Inc.
-# Author: Ondrej Mosnacek <omosnace@redhat.com>
-
-# Include Beakerlib environment
-. /usr/share/beakerlib/beakerlib.sh || exit 1
-
-# Set this parameter to 1 to also generate a flamegraph.
-GENERATE_FLAMEGRAPH="${GENERATE_FLAMEGRAPH:-0}"
-
-FG_URL="https://github.com/brendangregg/FlameGraph"
-FG_DIR="FlameGraph"
-
-TARGET_SYMBOL="security_secid_to_secctx"
-LIMIT="10.00%"
-
-rlJournalStart
-    rlPhaseStartSetup
-        rlRun "uname -r" 0 "Print running kernel version"
-
-        if [ "$GENERATE_FLAMEGRAPH" != 0 ]; then
-            rlRun "git clone $FG_URL $FG_DIR"
-        fi
-    rlPhaseEnd
-
-    rlPhaseStartTest
-        JOURNALD_PID=$(pidof systemd-journald)
-        rlLog "PID of systemd-journald is $JOURNALD_PID"
-
-        rlRun "cat /dev/urandom | base64 | logger &" 0 \
-            "Flood systemd-journald with data"
-        rlRun "timeout 30s perf record -o perf.data -p $(pidof systemd-journald) -g --call-graph dwarf" 124 \
-            "Capture perf data on systemd-journald"
-        rlRun "kill %1"
-
-        if [ "$GENERATE_FLAMEGRAPH" != 0 ]; then
-            rlRun "perf script -i perf.data | $FG_DIR/stackcollapse-perf.pl | $FG_DIR/flamegraph.pl > flamegraph.svg"
-        fi
-
-        rlRun "perf report -i perf.data -g none --pretty raw | grep $TARGET_SYMBOL"
-        PERCENT="$(perf report -g none --pretty raw | grep $TARGET_SYMBOL | \
-            grep -Eo '[0-9]+\.[0-9]+%' | head -n 1)"
-        rlLog "Detected that $TARGET_SYMBOL took up $PERCENT of time (limit $LIMIT)."
-        rlRun "{ echo \$PERCENT; echo \$LIMIT; } | sort -n | tail -n 1 | grep \$LIMIT" 0 \
-            "Check that time usage is within limit"
-    rlPhaseEnd
-
-    rlPhaseStartCleanup
-        rlFileSubmit "perf.data"
-        if [ "$GENERATE_FLAMEGRAPH" != 0 ]; then
-            rlFileSubmit "flamegraph.svg"
-
-            rlRun "rm -rf $FG_DIR flamegraph.svg"
-        fi
-        rlRun "rm -f perf.data"
-    rlPhaseEnd
-rlJournalPrintText
-rlJournalEnd
--- a/kernel/keycreate_empty_value/main.fmf
+++ b/kernel/keycreate_empty_value/main.fmf
@ -1,20 +0,0 @@
-summary: Test writing empty value into /proc/self/attr/keycreate
-description: |
-  Verifies that writing an empty value into /proc/<PID>/attr/keycreate
-  is allowed.
-contact: Ondrej Mosnacek <omosnace@redhat.com>
-component:
-  - kernel
-framework: beakerlib
-require:
-  - policycoreutils
-  - gcc
-duration: 5m
-tier: 2
-enabled: true
-adjust+:
-  - enabled: false
-    when: distro < rhel-8.1
-    because: RHEL-8.0 and below are not expected to have the bug fixed
-link:
-  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1719067
--- a/kernel/keycreate_empty_value/reproducer.c
+++ b/kernel/keycreate_empty_value/reproducer.c
@ -1,22 +0,0 @@
-#include <sys/types.h>
-#include <sys/stat.h>
-#include <fcntl.h>
-#include <unistd.h>
-#include <stdio.h>
-
-int main(void)
-{
-	int fd, r;
-
-	fd = open("/proc/self/attr/keycreate", O_WRONLY);
-	if (fd < 0) {
-		perror("open");
-	}
-
-	r = write(fd, "", 0);
-	if (r < 0) {
-		perror("write");
-	}
-
-	return !!r;
-}
--- a/kernel/keycreate_empty_value/runtest.sh
+++ b/kernel/keycreate_empty_value/runtest.sh
@ -1,37 +0,0 @@
-#!/bin/bash
-# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
-# SPDX-License-Identifier: GPLv2
-# Copyright (c) 2022 Red Hat, Inc.
-# Author: Ondrej Mosnacek <omosnace@redhat.com>
-
-# Include Beakerlib environment
-. /usr/share/beakerlib/beakerlib.sh || exit 1
-
-EXE="reproducer"
-
-rlJournalStart
-    rlPhaseStartSetup
-        rlRun "uname -r" 0 "Print running kernel version"
-
-        enable_container=0
-        if semodule -l | grep -q container; then
-            rlRun "semodule -d container" 0 "Disable the container module"
-            enable_container=1
-        fi
-
-        rlRun "gcc -o $EXE reproducer.c" 0 "Compile the reproducer"
-    rlPhaseEnd
-
-    rlPhaseStartTest
-        rlRun "./$EXE" 0 "Run the reproducer"
-    rlPhaseEnd
-
-    rlPhaseStartCleanup
-        rlRun "rm -f $EXE" 0 "Remove the reproducer binary"
-
-        if [ "$enable_container" -eq 1 ]; then
-            rlRun "semodule -e container" 0 "Re-enable the container module"
-        fi
-    rlPhaseEnd
-rlJournalPrintText
-rlJournalEnd
--- a/kernel/labeled-cephfs/main.fmf
+++ b/kernel/labeled-cephfs/main.fmf
@ -5,9 +5,6 @@ description: |
    This TC verifies that CephFS security label support works as expected.
 duration: 30m
 tier: 2
-tag:
-  - failinfedora
-  - avoidImageMode
-adjust+:
+adjust:
 -   enabled: false
    when: distro < rhel-8
--- a/kernel/labeling_before_policy_load/labeldump-expected.txt
+++ b/kernel/labeling_before_policy_load/labeldump-expected.txt
@ -1,3 +0,0 @@
-system_u:object_r:etc_t:s0
-
-system_u:object_r:etc_t:s0
--- a/kernel/labeling_before_policy_load/main.fmf
+++ b/kernel/labeling_before_policy_load/main.fmf
@ -1,29 +0,0 @@
-summary: Test SELinux labeling before initial policy load
-description: |
-  Verifies that reading/writing SELinux labels works before the first policy
-  load.
-
-  See also:
-  https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3e3e24b42043eceb97ed834102c2d094dfd7aaa6
-  https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c8e222616c7e98305bdc861db3ccac520bc29921
-  https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9530a3e00459cd6eabf050133205e0e8fecbdfc7
-contact: Ondrej Mosnacek <omosnace@redhat.com>
-component:
-  - kernel
-framework: beakerlib
-require:
-  - dracut
-  - coreutils
-  - policycoreutils
-  - attr
-duration: 30m
-tier: 2
-enabled: true
-adjust+:
-  - enabled: false
-    when: distro < rhel-8.3
-    because: RHEL-8.2 and below are not expected to support this
-link:
-  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1777525
-tag:
-  - reboot
--- a/kernel/labeling_before_policy_load/module-setup.sh
+++ b/kernel/labeling_before_policy_load/module-setup.sh
@ -1,17 +0,0 @@
-#!/bin/bash
-
-# called by dracut
-check() {
-    return 0
-}
-
-# called by dracut
-depends() {
-    return 0
-}
-
-# called by dracut
-install() {
-    inst_hook pre-pivot 50 "$moddir/relabel.sh"
-    inst_multiple setfiles getfattr
-}
--- a/kernel/labeling_before_policy_load/relabel.sh
+++ b/kernel/labeling_before_policy_load/relabel.sh
@ -1,15 +0,0 @@
-#!/bin/bash
-
-function dumpcon() {
-	getfattr --only-values -n security.selinux "$@" | tr -d '\000'
-	echo
-}
-
-mount -o remount,rw /sysroot
-dumpcon /sysroot/etc >/sysroot/etc/labeldump
-echo test > /sysroot/etc/testfile
-dumpcon /sysroot/etc/testfile >>/sysroot/etc/labeldump
-setfiles -vF -r /sysroot \
-	/sysroot/etc/selinux/targeted/contexts/files/file_contexts \
-	/sysroot/etc
-dumpcon /sysroot/etc/testfile >>/sysroot/etc/labeldump
--- a/kernel/labeling_before_policy_load/runtest.sh
+++ b/kernel/labeling_before_policy_load/runtest.sh
@ -1,60 +0,0 @@
-#!/bin/bash
-# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
-# SPDX-License-Identifier: GPLv2
-# Copyright (c) 2022 Red Hat, Inc.
-# Author: Ondrej Mosnacek <omosnace@redhat.com>
-
-# Include Beakerlib environment
-. /usr/share/beakerlib/beakerlib.sh || exit 1
-
-# Beaker compat
-if [ -n "$JOBID" ] && [ -n "$TESTID" ]; then
-    function tmt-reboot() { rstrnt-reboot; }
-    TMT_REBOOT_COUNT="$REBOOTCOUNT"
-fi
-
-rlJournalStart
-if [ $TMT_REBOOT_COUNT -lt 1 ]; then
-    rlPhaseStartSetup "Setup"
-        rlRun "uname -r" 0 "Kernel version before reboot"
-
-        rlRun "install -d /usr/lib/dracut/modules.d/97bz1777525" 0 \
-            "Install dracut plugin directory for testing"
-        rlRun "install module-setup.sh relabel.sh /usr/lib/dracut/modules.d/97bz1777525" 0 \
-            "Install dracut plugin for testing"
-        rlRun "dracut -f" 0 "Rebuild the initramfs"
-        rlRun "grubby --set-default /boot/vmlinuz-$(uname -r)" 0 \
-            "Ensure the current booted kernel is the default"
-        if command -v zipl >/dev/null; then
-            rlRun "zipl" 0 "Run zipl"
-        fi
-    rlPhaseEnd
-
-    rlPhaseStartSetup "Reboot"
-        tmt-reboot
-fi
-        rlRun "uname -r" 0 "Kernel version after reboot"
-    rlPhaseEnd
-
-    rlPhaseStartTest "Test"
-        rlLog "Test writing labels (BZ 1777525)"
-        rlRun "ls -lZ /etc/testfile"
-        rlRun "ls -lZ /etc/testfile | grep -qF ':etc_t:'" 0 \
-            "Test that /etc/testfile is labeled correctly"
-
-        rlLog "Test reading labels (BZ 1839819)"
-        rlRun "cat /etc/labeldump"
-        rlAssertNotDiffer "/etc/labeldump" labeldump-expected.txt
-    rlPhaseEnd
-
-    rlPhaseStartCleanup
-        rlRun "rm -f /etc/labeldump /etc/testfile" 0 "Remove test files"
-        rlRun "rm -rf /usr/lib/dracut/modules.d/97bz1777525" 0 \
-            "Remove the dracut plugin"
-        rlRun "dracut -f" 0 "Rebuild the initramfs again"
-        if command -v zipl >/dev/null; then
-            rlRun "zipl" 0 "Run zipl"
-        fi
-    rlPhaseEnd
-rlJournalPrintText
-rlJournalEnd
--- a/kernel/mount-options-memleak/main.fmf
+++ b/kernel/mount-options-memleak/main.fmf
@ -1,19 +0,0 @@
-summary: Mount options memory leak test
-description: |
-    Test that mounting with SELinux mount options doesn't leave behind
-    memory leaks.
-contact: Ondrej Mosnacek <omosnace@redhat.com>
-component:
- kernel
-framework: beakerlib
-duration: 1h
-tier: 2
-enabled: true
-adjust+:
-  - enabled: false
-    when: distro < rhel-7
-    because: RHEL-6 and below are not worth supporting by this test
-link:
-  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2187402
-tag:
-  - reboot
--- a/kernel/mount-options-memleak/runtest.sh
+++ b/kernel/mount-options-memleak/runtest.sh
@ -1,115 +0,0 @@
-#!/bin/bash
-# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
-# SPDX-License-Identifier: GPLv2
-# Copyright (c) 2023 Red Hat, Inc.
-# Author: Ondrej Mosnacek <omosnace@redhat.com>
-
-# Include Beakerlib environment
-. /usr/share/beakerlib/beakerlib.sh || exit 1
-
-# Beaker compat
-if [ -n "$JOBID" ] && [ -n "$TESTID" ]; then
-    function tmt-reboot() { rstrnt-reboot; }
-    TMT_REBOOT_COUNT="$REBOOTCOUNT"
-fi
-
-function installDepsYum() {
-    local yum="$1"; shift
-
-    if "$yum" install --help | grep -q -- --skip-unavailable; then
-        "$yum" install -y --skip-unavailable $*
-    elif "$yum" install --help | grep -q -- --skip-broken; then
-        "$yum" install -y --skip-broken $*
-    else
-        for req in $*; do
-            if ! rpm -q --quiet --whatprovides "$req"; then
-                "$yum" install -y "$req" || true
-            fi
-        done
-    fi
-}
-
-function installDeps() {
-    if type yum >/dev/null; then
-        installDepsYum yum "$@"
-    elif type dnf >/dev/null; then
-        installDepsYum dnf "$@"
-    fi
-}
-
-rlJournalStart
-if [ $TMT_REBOOT_COUNT -lt 1 ]; then
-    rlPhaseStartSetup
-        rlRun "uname -r" 0 "Print initial running kernel version"
-
-        uname="$(uname -r)"
-        raw_uname="${uname%+*}"
-        debug_uname="${raw_uname}+debug"
-        echo "$uname" >"$BEAKERLIB_DIR/orig_uname"
-        echo "$debug_uname" >"$BEAKERLIB_DIR/debug_uname"
-        if [ "$uname" = "$debug_uname" ]; then
-            rlLog "Already running the debug kernel, nice!"
-        else
-            rlLog "Install and boot the debug kernel"
-
-            rlRun "installDeps kernel-debug-$raw_uname"
-            rlRun "grubby --set-default /boot/vmlinuz-$debug_uname"
-        fi
-
-        rlRun "grubby --update-kernel /boot/vmlinuz-$debug_uname --args kmemleak=on" 0 \
-            "Enable kmemleak on the debug kernel"
-        if command -v zipl >/dev/null; then
-            rlRun "zipl" 0 "Run zipl"
-        fi
-        tmt-reboot
-fi
-if [ $TMT_REBOOT_COUNT -lt 2 ]; then
-        rlRun "uname -r" 0 "Print running kernel version after reboot"
-        rlRun "cat /proc/cmdline" 0 "Print kernel cmdline after reboot"
-
-        rlRun "mkdir -p /mnt/test_mount" 0 \
-            "Create a directory for the test mount"
-    rlPhaseEnd
-
-    rlPhaseStartTest
-        rlRun "echo clear > /sys/kernel/debug/kmemleak" 0 \
-            "Clear the kmemleak buffer"
-
-        rlRun "mount -t tmpfs -o context=system_u:object_r:user_tmp_t:s0 tmpfs /mnt/test_mount" 0 \
-            "Do a context mount"
-        rlRun "umount /mnt/test_mount" 0 \
-            "Unmount the context mount"
-
-        # For whatever reason this needs to be run twice...
-        rlRun "echo scan > /sys/kernel/debug/kmemleak" 0 \
-            "Trigger a kmemleak scan"
-        rlRun "cat /sys/kernel/debug/kmemleak >/dev/null" 0 \
-            "Dump the kmemleak buffer once"
-        rlRun "echo scan > /sys/kernel/debug/kmemleak" 0 \
-            "Trigger a second kmemleak scan"
-
-        rlLog "Check that /sys/kernel/debug/kmemleak is empty"
-        rlAssertNotDiffer /sys/kernel/debug/kmemleak /dev/null
-        rlRun "cat /sys/kernel/debug/kmemleak" 0 \
-            "Dump the kmemleak buffer"
-    rlPhaseEnd
-
-    rlPhaseStartCleanup
-        rlRun "rmdir /mnt/test_mount" 0 \
-            "Remove the directory for the test mount"
-        uname="$(cat "$BEAKERLIB_DIR/orig_uname")"
-        debug_uname="$(cat "$BEAKERLIB_DIR/debug_uname")"
-        rlRun "grubby --update-kernel /boot/vmlinuz-$debug_uname --remove-args kmemleak=on" 0 \
-            "Undo kmemleak enabling"
-        rlRun "grubby --set-default /boot/vmlinuz-$uname" 0 \
-            "Switch the default back to the initial kernel version"
-        if command -v zipl >/dev/null; then
-            rlRun "zipl" 0 "Run zipl"
-        fi
-        tmt-reboot
-fi
-        rlRun "uname -r" 0 \
-            "Print running kernel version after cleanup reboot"
-    rlPhaseEnd
-rlJournalPrintText
-rlJournalEnd
--- a/kernel/netlabel-leaves-nops-in-packets/main.fmf
+++ b/kernel/netlabel-leaves-nops-in-packets/main.fmf
@ -1,21 +0,0 @@
-summary: Netlabel shouldn't leave NOPs in IP options when removing the CIPSO option
-description: |
-    Test that seeting netlabel to unlabeled doesn't just overwrite CIPSO
-    options with NOPs, but actually removes them. Some routers may drop
-    packets with IP options, so this is important.
-contact: Ondrej Mosnacek <omosnace@redhat.com>
-component:
-  - kernel
-framework: beakerlib
-duration: 15m
-tier: 2
-require:
-  - gcc
-  - netlabel_tools
-enabled: true
-adjust+:
-  - enabled: false
-    when: distro < rhel-7
-    because: RHEL-6 and below are not worth supporting by this test
-link:
-  - verifies: https://issues.redhat.com/browse/RHEL-30904
--- a/kernel/netlabel-leaves-nops-in-packets/reproducer.c
+++ b/kernel/netlabel-leaves-nops-in-packets/reproducer.c
@ -1,179 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0
-/*
- * A reproducer that checks that CIPSO options are cleared properly
- * by NetLabel when it is configured to send unabeled traffic.
- *
- * Copyright (c) 2024 Red Hat, Inc.
- * Author: Ondrej Mosnacek <omosnace@redhat.com>
- */
-#include <stdlib.h>
-#include <stdio.h>
-#include <string.h>
-
-#include <sys/types.h>
-#include <sys/socket.h>
-#include <netdb.h>
-
-int run_test(int csock, int ssock, const struct addrinfo *clientinfo,
-	     int tnum, size_t expected_opt_length)
-{
-	char byte;
-	struct iovec iov;
-	struct msghdr msg;
-	struct cmsghdr *cmsg;
-	union {
-		struct cmsghdr cmsghdr;
-		char buf[CMSG_SPACE(256)];
-	} control;
-	int ret, i, result;
-
-	printf("TEST #%i\n", tnum);
-
-	byte = 0;
-	ret = sendto(csock, &byte, 1, 0, clientinfo->ai_addr, clientinfo->ai_addrlen);
-	if (ret < 0) {
-		perror("sendto");
-		exit(2);
-	}
-
-	memset(&iov, 0, sizeof(iov));
-	iov.iov_base = &byte;
-	iov.iov_len = 1;
-	memset(&msg, 0, sizeof(msg));
-	msg.msg_iov = &iov;
-	msg.msg_iovlen = 1;
-	msg.msg_control = &control;
-	msg.msg_controllen = sizeof(control);
-	ret = recvmsg(ssock, &msg, 0);
-	if (ret < 0) {
-		perror("recvmsg");
-		exit(2);
-	}
-	for (cmsg = CMSG_FIRSTHDR(&msg); cmsg;
-	     cmsg = CMSG_NXTHDR(&msg, cmsg)) {
-		if (cmsg->cmsg_level != SOL_IP ||
-		    cmsg->cmsg_type != IP_RECVOPTS)
-			continue;
-
-		if (cmsg->cmsg_len - sizeof(struct cmsghdr) > 0) {
-			printf("  options: ");
-			for (i = 0; i < cmsg->cmsg_len - sizeof(struct cmsghdr); i++) {
-				printf("%02x ", (unsigned)(CMSG_DATA(cmsg)[i]));
-			}
-			printf("\n");
-			result = expected_opt_length == cmsg->cmsg_len - sizeof(struct cmsghdr);
-			goto done;
-		}
-	}
-	printf("  no IP options\n");
-	result = expected_opt_length == 0;
-
-done:
-	if (result)
-		printf("  PASS\n");
-	else
-		printf("  FAIL\n");
-	return result;
-}
-
-int main(int argc, char **argv)
-{
-	static const unsigned char TEST_OPTION[] = {
-		1,           // NOP
-		158,         // option type - Experimental
-		5,           // option length
-		0x12, 0x34, 0x56, // dummy data
-		1,           // NOP
-		134,         // option type - CIPSO
-		11,          // option length
-		0, 0, 0, 16, // DOI
-		1,           // tag type 1
-		5,           // tag length
-		0,           // alignment octet
-		1,           // sensitivity
-		0xff,        // bitmap of categories
-		1,           // NOP
-		158,         // option type - Experimental
-		5,           // option length
-		0x12, 0x34, 0x56, // dummy data
-	};
-	static const size_t TEST_OPTION_CIPSO_OFF = 7;
-	static const size_t TEST_OPTION_CIPSO_LEN = 11;
-
-	int ret, result, csock, ssock, on = 1;
-	struct addrinfo hints, *serverinfo, *clientinfo;
-
-	if (argc != 3) {
-		fprintf(stderr, "need 2 arguments!\n");
-		exit(2);
-	}
-
-	memset(&hints, 0, sizeof(struct addrinfo));
-
-	hints.ai_family = AF_INET;
-	hints.ai_socktype = SOCK_DGRAM;
-	hints.ai_protocol = IPPROTO_UDP;
-
-	ret = getaddrinfo(argv[1], argv[2], &hints, &clientinfo);
-	if (ret < 0) {
-		fprintf(stderr, "getaddrinfo: %s\n", gai_strerror(ret));
-		exit(2);
-	}
-
-	ret = getaddrinfo(NULL, argv[2], &hints, &serverinfo);
-	if (ret < 0) {
-		fprintf(stderr, "getaddrinfo: %s\n", gai_strerror(ret));
-		exit(2);
-	}
-
-	csock = socket(clientinfo->ai_family, clientinfo->ai_socktype,
-		       IPPROTO_UDP);
-	if (csock < 0) {
-		perror("client socket");
-		exit(2);
-	}
-
-	ssock = socket(serverinfo->ai_family, serverinfo->ai_socktype,
-		       IPPROTO_UDP);
-	if (ssock < 0) {
-		perror("server socket");
-		exit(2);
-	}
-
-	ret = setsockopt(ssock, SOL_IP, IP_RECVOPTS, &on, sizeof(on));
-	if (ret < 0) {
-		perror("server setsockopt: IP_RECVOPTS");
-		exit(2);
-	}
-
-	if (bind(ssock, serverinfo->ai_addr, serverinfo->ai_addrlen) < 0) {
-		perror("server bind");
-		exit(2);
-	}
-
-	result = 1;
-
-	/* TEST 1 - only CIPSO */
-	ret = setsockopt(csock, SOL_IP, IP_OPTIONS,
-			 TEST_OPTION + TEST_OPTION_CIPSO_OFF,
-			 TEST_OPTION_CIPSO_LEN);
-	if (ret < 0) {
-		perror("client setsockopt: IP_OPTIONS");
-		exit(2);
-	}
-	if (!run_test(csock, ssock, clientinfo, 1, 0))
-		result = 0;
-
-	/* TEST 2 - CIPSO surrounded by other options */
-	ret = setsockopt(csock, SOL_IP, IP_OPTIONS,
-			 TEST_OPTION, sizeof(TEST_OPTION));
-	if (ret < 0) {
-		perror("client setsockopt: IP_OPTIONS");
-		exit(2);
-	}
-	if (!run_test(csock, ssock, clientinfo, 2,
-		      (sizeof(TEST_OPTION) - TEST_OPTION_CIPSO_LEN) + 3) & 3)
-		result = 0;
-
-	return result ? 0 : 1;
-}
--- a/kernel/netlabel-leaves-nops-in-packets/runtest.sh
+++ b/kernel/netlabel-leaves-nops-in-packets/runtest.sh
@ -1,32 +0,0 @@
-#!/bin/bash
-# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
-# SPDX-License-Identifier: GPL-2.0
-# Copyright (c) 2024 Red Hat, Inc.
-# Author: Ondrej Mosnacek <omosnace@redhat.com>
-
-# Include Beakerlib environment
-. /usr/share/beakerlib/beakerlib.sh || exit 1
-
-rlJournalStart
-    rlPhaseStartSetup
-        rlRun "gcc -o reproducer reproducer.c" 0 "Build the reproducer"
-
-        rlRun "netlabelctl cipsov4 add pass doi:16 tags:1" 0
-        rlRun "netlabelctl map del default" 0
-        rlRun "netlabelctl map add default address:0.0.0.0/0 protocol:unlbl" 0
-        rlRun "netlabelctl map add default address:::/0 protocol:unlbl" 0
-    rlPhaseEnd
-
-    rlPhaseStartTest
-        rlRun "./reproducer 127.0.0.1 9999" 0 "Run the reproducer"
-    rlPhaseEnd
-
-    rlPhaseStartCleanup
-        rlRun "rm -f reproducer" 0  "Remove the reproducer binary"
-
-        rlRun "netlabelctl map del default" 0
-        rlRun "netlabelctl cipsov4 del doi:16" 0
-        rlRun "netlabelctl map add default protocol:unlbl" 0
-    rlPhaseEnd
-rlJournalPrintText
-rlJournalEnd
--- a/kernel/netlabel_many_ifaces/main.fmf
+++ b/kernel/netlabel_many_ifaces/main.fmf
@ -12,7 +12,7 @@ require:
 duration: 5m
 tier: 2
 enabled: true
-adjust+:
-  - enabled: false
-    when: distro < rhel-8.4
-    because: not fixed below RHEL 8.4...
+adjust:
+    enabled: false
+    when: distro < rhel-7
+    because: RHEL-6 and below is too old...
--- a/kernel/ocontext-race/Makefile
+++ b/kernel/ocontext-race/Makefile
@ -1,6 +0,0 @@
-# Minimal Makefile for standard-test-roles-beakerlib
-
-R="RhtsRequires: attr"
-run:
-	chmod +x runtest.sh
-	./runtest.sh
--- a/kernel/ocontext-race/main.fmf
+++ b/kernel/ocontext-race/main.fmf
@ -1,27 +0,0 @@
-summary: Regression test for ocontext kernel structure race condition
-description: |
-    Test that a race condition around the kernel's ocontext structures
-    doesn't cause an incorrect label to be assigned to files/mounts.
-contact: Ondrej Mosnacek <omosnace@redhat.com>
-component:
- kernel
-framework: beakerlib
-require:
- attr
-duration: 15m
-tier: 2
-enabled: true
-adjust+:
- enabled: false
-  when: distro < rhel-7
-  because: RHEL-6 and below are not worth supporting by this test
- enabled: false
-  when: arch = s390x
-  because: No machines likely available with required HW configuration
-extra-hardware: |
-    keyvalue = PROCESSORS >= 4
-link:
- verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1969344
- verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2040196
-tag:
-  - avoidImageMode
--- a/kernel/ocontext-race/runtest.sh
+++ b/kernel/ocontext-race/runtest.sh
@ -1,74 +0,0 @@
-#!/bin/bash
-# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
-# SPDX-License-Identifier: GPLv2
-# Copyright (c) 2022 Red Hat, Inc.
-# Author: Ondrej Mosnacek <omosnace@redhat.com>
-
-# Include Beakerlib environment
-. /usr/share/beakerlib/beakerlib.sh || exit 1
-
-PREFIX=/tmp/repro-
-NTHREADS=8
-TRIALS=20
-
-function get_file_con() {
-    getfattr -h --absolute-names --only-values -n security.selinux "$1" | tr -d '\000'
-}
-
-function strip_mls() {
-    # strip the MLS -- mcstrans might be running, leading to different MLS
-    # fields than expected
-    sed 's/\([^:]*:[^:]*:[^:]*\):.*$/\1/g'
-}
-
-function check_file_con() {
-    rlAssertEquals "Check expected context of $1" \
-        "$(get_file_con "$1" | strip_mls)" \
-        "$(echo "$2" | strip_mls)"
-}
-
-rlJournalStart
-    rlPhaseStartSetup
-        rlRun "uname -r"
-
-        rlRun "test \$(nproc) -ge 4" 0 "Test needs an SMP machine, otherwise it may pass regardless of the bug"
-
-        rlRun "tmpdir=\$(mktemp -d)" 0 "Create a temporary directory"
-
-        prefix="$tmpdir/repro-"
-
-        for (( i = 0; i < $NTHREADS; i++ )); do
-            rlRun "mkdir -p \"\${PREFIX}$i\"" 0 "Create subdirectory #$i"
-        done
-    rlPhaseEnd
-
-for (( k = 0; k < $TRIALS; k++ )); do
-    rlPhaseStartTest "Trial #$k"
-        rlRun "load_policy" 0 "Reload SELinux policy to reset internal state"
-
-        # NOTE: this must be ran in a single rlRun, otherwise beakerlib
-        # overhead decreases the chance of a race condition 
-        rlRun "
-            for (( i = 0; i < $NTHREADS; i++)); do
-                mount -t tmpfs tmpfs \"\${PREFIX}\$i\" &
-            done
-            wait
-        " 0 "Create $NTHREADS tmpfs mounts at once"
-
-        for (( i = 0; i < $NTHREADS; i++)); do
-            rlRun "touch \"\${PREFIX}$i/file\"" 0 "Create a file in dir #$i"
-            check_file_con "$PREFIX$i" "unconfined_u:object_r:user_tmp_t"
-            check_file_con "$PREFIX$i/file" "unconfined_u:object_r:user_tmp_t"
-        done
-
-        for (( i = 0; i < $NTHREADS; i++)); do
-            rlRun "umount \"\${PREFIX}$i\" &" 0 "Unmount dir #$i"
-        done
-    rlPhaseEnd
-done
-
-    rlPhaseStartCleanup
-        rlRun "rm -rf \$tmpdir" 0 "Clean up the temporary directory"
-    rlPhaseEnd
-rlJournalPrintText
-rlJournalEnd
--- a/kernel/overlayfs-mmap-bugs/main.fmf
+++ b/kernel/overlayfs-mmap-bugs/main.fmf
@ -1,27 +0,0 @@
-summary: Regression test for overlayfs mmap/mprotect bugs
-description: |
-    Tests various scenarios with overlayfs and mmap/mprotect syscalls.
-    This also covers CVE-2026-46054.
-contact: Ondrej Mosnacek <omosnace@redhat.com>
-component:
-  - kernel
-framework: beakerlib
-require:
-  - selinux-policy-devel
-  - gcc
-duration: 5m
-tier: 2
-enabled: true
-link:
-  - verifies: https://redhat.atlassian.net/browse/RHEL-127505
-  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2026-46054
-  - verifies: https://redhat.atlassian.net/browse/RHEL-185115
-  - verifies: https://redhat.atlassian.net/browse/RHEL-185117
-  - verifies: https://redhat.atlassian.net/browse/RHEL-185118
-environment:
-    AVC_ERROR: +no_avc_check
-check:
-  - how: avc
-    result: xfail
-extra-nitrate: TC#0620043
-id: 2ee56bc8-01f3-4b77-8cdb-494ad9a12451
--- a/kernel/overlayfs-mmap-bugs/map_access.c
+++ b/kernel/overlayfs-mmap-bugs/map_access.c
@ -1,75 +0,0 @@
-#include <unistd.h>
-#include <fcntl.h>
-
-#include <sys/mman.h>
-
-#include <stdio.h>
-#include <string.h>
-#include <errno.h>
-
-int main(int argc, const char **argv)
-{
-	const char *file, *context;
-	void *ptr;
-	int rdonly, execmem, flags, prot, fd, ctxfd, ret;
-
-	if (argc < 4  || argc > 5 ||
-	    (strcmp(argv[2], "RDONLY") && strcmp(argv[2], "RDWR")) ||
-	    (strcmp(argv[3], "SHARED") && strcmp(argv[3], "PRIVATE"))
-	   ) {
-		fprintf(stderr, "Usage %s <file> RDONLY|RDWR\n", argv[0]);
-		return EINVAL;
-	}
-
-	file = argv[1];
-	rdonly = strcmp(argv[2], "RDONLY") == 0;
-	execmem = strcmp(argv[3], "PRIVATE") == 0;
-	flags = strcmp(argv[3], "PRIVATE") == 0 ? MAP_PRIVATE : MAP_SHARED;
-	prot = PROT_READ | (!rdonly || execmem ? PROT_WRITE : 0) | (execmem ? PROT_EXEC : 0);
-	context = argc >= 5 ? argv[4] : NULL;
-
-	fd = open(file, rdonly ? O_RDONLY : O_RDWR);
-	if (fd == -1) {
-		perror("open");
-		return 2;
-	}
-
-	/* try direct mmap */
-	ptr = mmap(NULL, 1, prot, flags, fd, 0);
-	if (ptr == MAP_FAILED) {
-		perror("mmap");
-		return 3;
-	}
-	munmap(ptr, 1);
-
-	/* try mmap with PROT_NONE followed by mprotect with full access */
-	ptr = mmap(NULL, 1, PROT_NONE, flags, fd, 0);
-	if (ptr == MAP_FAILED) {
-		perror("mmap PROT_NONE");
-		return 4;
-	}
-
-	if (context) {
-		ctxfd = open("/proc/self/attr/current", O_RDWR);
-		if (ctxfd == -1) {
-			perror("open");
-			return 6;
-		}
-		ret = write(ctxfd, context, strlen(context));
-		if (ret == -1) {
-			perror("write");
-			return 7;
-		}
-		close(ctxfd);
-	}
-
-	ret = mprotect(ptr, 1, prot);
-	if (ret == -1) {
-		perror("mprotect");
-		return 5;
-	}
-
-	munmap(ptr, 1);
-	close(fd);
-	return 0;
-}
--- a/kernel/overlayfs-mmap-bugs/runtest.sh
+++ b/kernel/overlayfs-mmap-bugs/runtest.sh
@ -1,83 +0,0 @@
-#!/bin/bash
-# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
-# SPDX-License-Identifier: GPL-2.0
-# Copyright (c) 2025 Red Hat, Inc.
-# Author: Ondrej Mosnacek <omosnace@redhat.com>
-
-# Include Beakerlib environment
-. /usr/share/beakerlib/beakerlib.sh || exit 1
-
-rlJournalStart
-    rlPhaseStartSetup
-        rlRun "uname -r" 0 "Print current running kernel version"
-
-        SE_USER="$(secon -u --pid $$)"
-        SE_ROLE="$(secon -r --pid $$)"
-        SE_TYPE="$(secon -t --pid $$)"
-        SE_MLS="$(secon -m --pid $$)"
-
-        OVERLAYCON="$SE_USER:object_r:test_mountedfile_t:s0"
-        DYNTRANSCON="$SE_USER:$SE_ROLE:test_access_exploit_t:$SE_MLS"
-
-        rlRun "gcc -o map_access map_access.c" 0 \
-            "Build the test program"
-        rlRun "chcon -t bin_t map_access" 0 "Relabel the test program"
-        rlRun "make -f /usr/share/selinux/devel/Makefile test_policy.pp M4PARAM='-D TEST_ROLE=$SE_ROLE -D TEST_TYPE=$SE_TYPE'" 0 \
-            "Build the test policy"
-        rlRun "semodule -i test_policy.pp" 0 "Load test policy"
-
-        rlRun "mkdir lowerdir upperdir workdir mountpoint" 0 "Create test dirs"
-        rlRun "touch lowerdir/file_ok lowerdir/file_no_map lowerdir/file_no_read lowerdir/file_no_write" 0 \
-            "Create test files"
-        rlRun "chcon -R -t test_lowerfile_t lowerdir workdir upperdir"
-        rlRun "chcon -t test_lowerfile_no_map_t lowerdir/file_no_map"
-        rlRun "chcon -t test_lowerfile_no_write_t lowerdir/file_no_write"
-        rlRun "chcon -t test_lowerfile_no_read_t lowerdir/file_no_read"
-
-        rlRun "runcon -t test_mounter_t mount -t overlay none -o 'context=$OVERLAYCON,lowerdir=./lowerdir,upperdir=./upperdir,workdir=./workdir' ./mountpoint" 0 \
-            "Mount the overlay filesystem"
-
-        rlRun ":>/var/log/audit/audit.log; rm -f /var/log/audit/audit.log.*" 0 \
-            "Clear the audit log"
-    rlPhaseEnd
-
-    rlPhaseStartTest "CVE-2026-46054"
-        # Bug 1
-        # Should get below AVC:
-        # avc:  denied  { map } for scontext=...test_mounter_t... tcontext=...test_lowerfile_no_map_t... tclass=file
-        rlRun "runcon -t test_access_full_t ./map_access ./mountpoint/file_no_map RDONLY SHARED" 3 "Test Bug 1"
-
-        # Bug 2, result 1
-        # Shouldn't get below AVC:
-        # avc:  denied  { use } for scontext=...test_access_full_t... tcontext=...test_mounter_t... tclass=fd
-        rlRun "setsebool domain_fd_use 0"
-        rlRun "runcon -t test_access_full_t ./map_access ./mountpoint/file_ok RDONLY SHARED" 0 "Test Bug 2, result 1"
-        rlRun "setsebool domain_fd_use 1"
-
-        # Bug 2, result 2
-        # Shouldn't get below AVC:
-        # avc:  denied  { read } for scontext=...test_access_full_t... tcontext=...test_lowerfile_t... tclass=file
-        rlRun "runcon -t test_access_full_t ./map_access ./mountpoint/file_ok RDONLY SHARED" 0 "Test Bug 2, result 2"
-
-        # Bug 2, result 3
-        # Should get below AVC:
-        # avc:  denied  { read } for scontext=...test_access_exploit_t... tcontext=...test_mountedfile_t... tclass=file
-        rlRun "runcon -t test_access_full_t ./map_access ./mountpoint/file_ok RDONLY SHARED $DYNTRANSCON" 5 "Test Bug 2, result 3"
-    rlPhaseEnd
-
-    rlPhaseStartTest "execmem regression"
-        rlRun "runcon -t test_access_full_t ./map_access ./mountpoint/file_ok RDONLY PRIVATE" 0 "Verify no execmem denied"
-    rlPhaseEnd
-
-    rlPhaseStartCleanup
-        rlRun "ausearch -i -m avc" 0 "Show AVC denials"
-
-        rlRun "umount ./mountpoint"
-        rlRun "rm -rf lowerdir upperdir workdir mountpoint"
-        rlRun "semodule -r test_policy" 0 "Unload test policy"
-        rlRun "make -f /usr/share/selinux/devel/Makefile clean" 0 \
-            "Clean the test policy"
-        rlRun "rm -f map_access" 0 "Remove the test program"
-    rlPhaseEnd
-rlJournalPrintText
-rlJournalEnd
--- a/kernel/overlayfs-mmap-bugs/test_policy.te
+++ b/kernel/overlayfs-mmap-bugs/test_policy.te
@ -1,106 +0,0 @@
-policy_module(test_policy,1.0.0)
-
-type test_lowerfile_t;
-files_type(test_lowerfile_t)
-
-type test_lowerfile_no_map_t;
-files_type(test_lowerfile_no_map_t)
-
-type test_lowerfile_no_write_t;
-files_type(test_lowerfile_no_write_t)
-
-type test_lowerfile_no_read_t;
-files_type(test_lowerfile_no_read_t)
-
-type test_mountedfile_t;
-files_type(test_mountedfile_t)
-
-type test_mounter_t;
-domain_type(test_mounter_t)
-
-allow test_mounter_t self:capability { sys_admin dac_read_search dac_override };
-
-# test_mounter_t has full access to test_lowerfile_t
-manage_dirs_pattern(test_mounter_t, test_lowerfile_t, test_lowerfile_t)
-manage_files_pattern(test_mounter_t, test_lowerfile_t, test_lowerfile_t)
-manage_chr_files_pattern(test_mounter_t, test_lowerfile_t, test_lowerfile_t)
-allow test_mounter_t test_lowerfile_t:file map;
-# extra permission for execmem regression test
-allow test_mounter_t test_lowerfile_t:file { execute };
-
-# test_mounter_t can't map test_lowerfile_t
-rw_files_pattern(test_mounter_t, test_lowerfile_no_map_t, test_lowerfile_no_map_t)
-
-# test_mounter_t can't write test_lowerfile_no_write_t
-read_files_pattern(test_mounter_t, test_lowerfile_no_write_t, test_lowerfile_no_write_t)
-allow test_mounter_t test_lowerfile_no_write_t:file map;
-
-# test_mounter_t can't read test_lowerfile_no_read_t
-write_files_pattern(test_mounter_t, test_lowerfile_no_read_t, test_lowerfile_no_read_t)
-allow test_mounter_t test_lowerfile_no_read_t:file map;
-
-allow test_mounter_t test_mountedfile_t:dir { getattr setattr };
-allow test_mounter_t test_mountedfile_t:filesystem { relabelfrom relabelto mount };
-
-kernel_read_system_state(test_mounter_t)
-kernel_read_proc_symlinks(test_mounter_t)
-kernel_request_load_module(test_mounter_t)
-kernel_search_proc(test_mounter_t)
-
-fs_getattr_xattr_fs(test_mounter_t)
-fs_relabelfrom_xattr_fs(test_mounter_t)
-
-mount_entry_type(test_mounter_t)
-mount_rw_pid_files(test_mounter_t)
-
-selinux_getattr_fs(test_mounter_t)
-
-files_mounton_all_mountpoints(test_mounter_t)
-
-# Domain with full mountedfile access
-type test_access_full_t;
-domain_type(test_access_full_t)
-
-manage_dirs_pattern(test_access_full_t, test_mountedfile_t, test_mountedfile_t)
-manage_files_pattern(test_access_full_t, test_mountedfile_t, test_mountedfile_t)
-allow test_access_full_t test_mountedfile_t:file map;
-
-corecmd_bin_entry_type(test_access_full_t)
-
-# Domain with lowerfile access, but no mountedfile access (exploiting Bug 2)
-type test_access_exploit_t;
-domain_type(test_access_exploit_t)
-
-manage_files_pattern(test_access_exploit_t, test_lowerfile_t, test_lowerfile_t)
-
-corecmd_bin_entry_type(test_access_exploit_t)
-
-# for dyntransition test_access_full_t -> test_access_exploit_t
-allow test_access_full_t self:process { setcurrent };
-allow test_access_full_t test_access_exploit_t:process { dyntransition };
-
-# extra permissions for execmem regression test
-allow test_access_full_t test_mountedfile_t:file { execute };
-allow test_access_full_t self:process { execmem };
-
-attribute test_domain;
-typeattribute test_mounter_t test_domain;
-typeattribute test_access_full_t test_domain;
-typeattribute test_access_exploit_t test_domain;
-
-require {
-	type TEST_TYPE;
-	role TEST_ROLE;
-}
-allow TEST_TYPE test_domain:process transition;
-role TEST_ROLE types test_domain;
-
-allow test_domain TEST_TYPE:fd use;
-allow test_domain TEST_TYPE:fifo_file rw_inherited_fifo_file_perms;
-allow test_domain TEST_TYPE:process { sigchld };
-
-files_search_tmp(test_domain)
-
-term_use_all_terms(test_domain)
-
-userdom_search_user_tmp_dirs(test_domain)
--- a/kernel/policy_load_enomem_on_new_context/main.fmf
+++ b/kernel/policy_load_enomem_on_new_context/main.fmf
@ -1,17 +0,0 @@
-summary: Test that creating a new SELinux context doesn't fail during policy load
-description: |
-  Verifies that there are no ENOMEM errors when the kernel encounters a new
-  SELinux context during a policy load.
-contact: Ondrej Mosnacek <omosnace@redhat.com>
-component:
-  - kernel
-framework: beakerlib
-require:
-  - policycoreutils
-  - diffutils
-duration: 10m
-tier: 2
-enabled: true
-link:
-  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1335986
-  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1656787
--- a/kernel/policy_load_enomem_on_new_context/runtest.sh
+++ b/kernel/policy_load_enomem_on_new_context/runtest.sh
@ -1,36 +0,0 @@
-#!/bin/bash
-# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
-# SPDX-License-Identifier: GPLv2
-# Copyright (c) 2019-2022 Red Hat, Inc.
-# Author: Milos Malik <mmalik@redhat.com>
-
-# Include Beakerlib environment
-. /usr/share/beakerlib/beakerlib.sh || exit 1
-
-rlJournalStart
-    rlPhaseStartSetup
-        rlRun "uname -r" 0 "Print running kernel version"
-    rlPhaseEnd
-
-    rlPhaseStartTest "bz#1335986 + bz#1656787"
-        rlRun "dmesg > before.txt"
-        rlRun "while true; do load_policy; sleep 0.1; done &" 0 \
-            "Start reloading the policy in a loop"
-
-        function runcon_loop() {
-            for (( i = 0; i < 1024; i++ )); do
-                runcon -l s0:c$i true || return 1
-            done
-            return 0
-        }
-        rlRun "runcon_loop" 0 "Run runcon in a loop with varying contexts"
-        rlRun "dmesg > after.txt"
-        rlRun "diff before.txt after.txt | grep -e inode_doinit_with_dentry -e context_to_sid" 1
-    rlPhaseEnd
-
-    rlPhaseStartCleanup
-        rlRun "kill \$(jobs -p)" 0 "Terminate background jobs"
-        rlRun "wait" 0 "Wait for background jobs to terminate"
-    rlPhaseEnd
-rlJournalPrintText
-rlJournalEnd
--- a/kernel/sctp_peeloff_corner_case/main.fmf
+++ b/kernel/sctp_peeloff_corner_case/main.fmf
@ -1,25 +0,0 @@
-summary: Verify that two-way SCTP association setup doesn't trigger AVCs
-description: |
-    When two SCTP endpoints try to initiate an association
-    simultaneously with each other, they may hit various corner cases.
-    This test verifies that this scenario works correctly and that the
-    resulting association is properly labeled (by peeling it off, which
-    transfers the label onto the new socket).
-contact: Ondrej Mosnacek <omosnace@redhat.com>
-component:
-  - kernel
-framework: beakerlib
-require:
-  - make
-  - gcc
-  - lksctp-tools-devel
-  - audit
-duration: 10m
-tier: 2
-enabled: true
-adjust+:
-  - enabled: false
-    when: distro < rhel-8
-    because: RHEL-7 and below don't have SCTP SELinux support
-link:
-  - verifies: https://issues.redhat.com/browse/RHEL-48647
--- a/kernel/sctp_peeloff_corner_case/reproducer.c
+++ b/kernel/sctp_peeloff_corner_case/reproducer.c
@ -1,187 +0,0 @@
-// SPDX-License-Identifier: GPLv2
-/*
- * Copyright (c) 2024 Red Hat, Inc.
- * Author: Ondrej Mosnacek <omosnace@redhat.com>
- */
-
-#include <netinet/in.h>
-#include <netinet/ip.h>
-#include <netinet/sctp.h>
-#include <sys/types.h>
-#include <sys/socket.h>
-#include <sys/wait.h>
-#include <unistd.h>
-#include <netdb.h>
-
-#include <stdlib.h>
-#include <stddef.h>
-#include <string.h>
-#include <stdio.h>
-#include <errno.h>
-
-static const char * const TEST_PORTS[] = { "9998", "9999" };
-
-#define ITERATIONS 1000
-
-#define member_size(type, member) sizeof(((type *)0)->member)
-#define sizeof_up_to(type, member) (offsetof(type, member) + member_size(type, member))
-
-enum {
-	PIPE_R = 0,
-	PIPE_W,
-};
-
-int main(int argc, char **argv)
-{
-	int sock, psock, result, flags, index, i, pipefd[2], pipes[2][2];
-	struct addrinfo hints, *info;
-	struct sctp_event_subscribe subscr_events;
-	pid_t fork_pid;
-	char byte = 0x41, data[1024];
-	sctp_assoc_t assoc_id;
-	union sctp_notification *notif;
-
-	result = pipe(pipefd);
-	if (result < 0) {
-		perror("pipe");
-		return 1;
-	}
-	pipes[0][PIPE_R] = pipefd[0];
-	pipes[1][PIPE_W] = pipefd[1];
-
-	result = pipe(pipefd);
-	if (result < 0) {
-		perror("pipe");
-		return 1;
-	}
-	pipes[1][PIPE_R] = pipefd[0];
-	pipes[0][PIPE_W] = pipefd[1];
-
-	fork_pid = fork();
-	if (fork_pid < 0) {
-		perror("fork");
-		return 1;
-	}
-
-	index = !!fork_pid;
-	close(pipes[!index][PIPE_R]);
-	close(pipes[!index][PIPE_W]);
-
-	memset(&hints, 0, sizeof(struct addrinfo));
-	hints.ai_flags = AI_PASSIVE;
-	hints.ai_protocol = IPPROTO_SCTP;
-	hints.ai_family = AF_INET;
-	hints.ai_socktype = SOCK_SEQPACKET;
-
-	result = getaddrinfo(NULL, TEST_PORTS[index], &hints, &info);
-	if (result < 0) {
-		fprintf(stderr, "getaddrinfo: %s\n", gai_strerror(result));
-		return 1;
-	}
-
-	sock = socket(info->ai_family, info->ai_socktype, info->ai_protocol);
-	if (sock < 0) {
-		perror("socket");
-		return 1;
-	}
-
-	result = bind(sock, info->ai_addr, info->ai_addrlen);
-	if (result < 0) {
-		perror("bind");
-		return 1;
-	}
-
-	if (listen(sock, SOMAXCONN)) {
-		perror("listen");
-		return 1;
-	}
-
-	memset(&subscr_events, 0, sizeof(subscr_events));
-	subscr_events.sctp_association_event = 1;
-	result = setsockopt(sock, IPPROTO_SCTP, SCTP_EVENTS, &subscr_events,
-			    sizeof_up_to(struct sctp_event_subscribe,
-					 sctp_association_event));
-
-	memset(&hints, 0, sizeof(struct addrinfo));
-	hints.ai_protocol = IPPROTO_SCTP;
-	hints.ai_socktype = SOCK_SEQPACKET;
-
-	result = getaddrinfo("127.0.0.1", TEST_PORTS[!index], &hints, &info);
-	if (result < 0) {
-		fprintf(stderr, "getaddrinfo: %s\n", gai_strerror(result));
-		return 1;
-	}
-
-	for (i = 0; i < ITERATIONS; i++) {
-		printf("[%i] ITERATION %i...\n", index, i);
-
-		/* synchronize */
-		result = write(pipes[index][PIPE_W], &byte, 1);
-		if (result < 0) {
-			perror("pipe");
-			return 1;
-		}
-		result = read(pipes[index][PIPE_R], &byte, 1);
-		if (result < 0) {
-			perror("pipe");
-			return 1;
-		}
-
-		result = connect(sock, info->ai_addr, info->ai_addrlen);
-		if (result < 0 && errno != EISCONN) {
-			perror("connect");
-			return 1;
-		}
-
-		/* Get assoc_id for sctp_peeloff() */
-		flags = 0;
-		result = sctp_recvmsg(sock, data, sizeof(data),
-				NULL, 0, NULL, &flags);
-		if (result < 0) {
-			perror("sctp_recvmsg");
-			return 1;
-		}
-
-		if ((flags & (MSG_NOTIFICATION | MSG_EOR)) != (MSG_NOTIFICATION | MSG_EOR)) {
-			fprintf(stderr, "[%i] Invalid sctp_recvmsg response FLAGS: %x\n", index, flags);
-			return 1;
-		}
-
-		notif = (union sctp_notification *)data;
-		if (notif->sn_header.sn_type != SCTP_ASSOC_CHANGE) {
-			fprintf(stderr, "[%i] Invalid sctp_recvmsg response type: %x\n", index, notif->sn_header.sn_type);
-			return 1;
-		}
-		assoc_id = notif->sn_assoc_change.sac_assoc_id;
-		psock = sctp_peeloff(sock, assoc_id);
-		if (psock < 0) {
-			perror("sctp_peeloff");
-			return 1;
-		}
-
-		data[0] = 42;
-		result = sctp_sendmsg(psock, data, 1, NULL, 0,
-				      0, 0, 0, 0, 0);
-		if (result < 0) {
-			perror("sctp_sendmsg");
-			return 1;
-		}
-
-		result = sctp_recvmsg(psock, data, sizeof(data),
-				      NULL, 0, NULL, NULL);
-		if (result < 0) {
-			perror("sctp_recvmsg");
-			return 1;
-		}
-
-		if (data[0] != 42) {
-			fprintf(stderr, "[%i] Invalid sctp_recvmsg response: %d\n", index, (int)data[0]);
-			return 1;
-		}
-
-		close(psock);
-		printf("[%i] ITERATION %i SUCCESS!\n", index, i);
-	}
-	close(sock);
-	return 0;
-}
--- a/kernel/sctp_peeloff_corner_case/runtest.sh
+++ b/kernel/sctp_peeloff_corner_case/runtest.sh
@ -1,100 +0,0 @@
-#!/bin/bash
-# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
-# SPDX-License-Identifier: GPLv2
-# Copyright (c) 2024 Red Hat, Inc.
-# Author: Ondrej Mosnacek <omosnace@redhat.com>
-
-# Include Beakerlib environment
-. /usr/share/beakerlib/beakerlib.sh || exit 1
-
-function installDepsYum() {
-    local yum="$1"; shift
-
-    if "$yum" install --help | grep -q -- --skip-unavailable; then
-        "$yum" install -y --skip-unavailable $*
-    elif "$yum" install --help | grep -q -- --skip-broken; then
-        "$yum" install -y --skip-broken $*
-    else
-        for req in $*; do
-            if ! rpm -q --quiet --whatprovides "$req"; then
-                "$yum" install -y "$req" || true
-            fi
-        done
-    fi
-}
-
-function installDeps() {
-    if [ -e /run/ostree-booted ]; then
-        for item in "$@"; do
-            if ! rpm -q --quiet --whatprovides "$item"; then
-                rpm-ostree --apply-live -y install "$item"
-            fi
-        done
-    elif type yum >/dev/null; then
-        installDepsYum yum "$@"
-    elif type dnf >/dev/null; then
-        installDepsYum dnf "$@"
-    fi
-}
-
-function check_avc_begin() {
-    sleep 1.1
-    date +'%x %T'
-    sleep 1.1
-}
-
-function check_avc_end() {
-    marker="marker-$RANDOM"
-
-    auditctl -m "$marker"
-
-    for (( i = 0; i < 100; i++ )); do
-        if ausearch -i -m user -ts $1 2>/dev/null </dev/null | \
-            grep -q "$marker"
-        then
-            echo $i
-            break
-        fi
-        sleep 0.1
-    done
-
-    ausearch -i -m avc -ts $1 </dev/null
-}
-
-rlJournalStart
-    rlPhaseStartSetup
-        rlRun "uname -r" 0 "Print kernel version"
-        # Determine the base kernel package name and version corresponding
-        # to the currently running kernel. Use this information to derive
-        # the correct kernel subpackages to install.
-        if KERNEL_CORE_NVRA="$(rpm -qf "/boot/vmlinuz-$(uname -r)")"; then
-            KERNEL_CORE_NV="${KERNEL_CORE_NVRA%-*}"
-            KERNEL_CORE_N="${KERNEL_CORE_NV%-*}"
-
-            KERNEL_PKG_VRA="${KERNEL_CORE_NVRA#$KERNEL_CORE_N-}"
-            KERNEL_PKG_BASE="${KERNEL_CORE_N%-core}"
-
-            rlLog "Detected kernel package base name '$KERNEL_PKG_BASE' and version-release.arch '$KERNEL_PKG_VRA'"
-            rlRun "installDeps  $KERNEL_PKG_BASE-modules-extra-$KERNEL_PKG_VRA" 0 "Install extra kernel modules"
-        else
-            rlLog "Detected non-RPM running kernel - no extra kernel packages will be installed"
-        fi
-
-        rlRun "gcc -O2 -Wall -o reproducer reproducer.c -lsctp" 0 \
-                "Compile the reproducer"
-        rlRun "modprobe sctp" 0 "Ensure SCTP module is loaded"
-    rlPhaseEnd
-
-    rlPhaseStartTest
-        rlRun "audit_ts=\"\$(check_avc_begin)\""
-
-        rlRun "./reproducer" 0 "Run the reproducer"
-
-        rlRun "check_avc_end \"\$audit_ts\"" 1 "Check if there are AVC denials"
-    rlPhaseEnd
-
-    rlPhaseStartCleanup
-        rlRun "rm -f reproducer"
-    rlPhaseEnd
-rlJournalPrintText
-rlJournalEnd
--- a/kernel/sctp_peer_label_bug/Makefile
+++ b/kernel/sctp_peer_label_bug/Makefile
@ -1,8 +0,0 @@
-# Minimal Makefile for standard-test-roles-beakerlib
-
-R="Requires: kernel-modules-extra"
-R="RhtsRequires: make gcc lksctp-tools-devel audit kernel-modules"
-
-run:
-	chmod +x runtest.sh
-	./runtest.sh
--- a/kernel/sctp_peer_label_bug/main.fmf
+++ b/kernel/sctp_peer_label_bug/main.fmf
@ -1,25 +0,0 @@
-summary: Verify that two-way SCTP association setup doesn't trigger AVCs
-description: |
-    Verify that two-way SCTP association setup doesn't trigger AVCs.
-contact: Ondrej Mosnacek <omosnace@redhat.com>
-component:
-  - kernel
-framework: beakerlib
-require:
-  - make
-  - gcc
-  - lksctp-tools-devel
-  - audit
-  - kernel-modules
-recommend:
-  - kernel-modules-extra
-duration: 10m
-tier: 2
-enabled: true
-adjust+:
-  - enabled: false
-    when: distro < rhel-8
-    because: RHEL-7 and below don't have SCTP SELinux support
-link:
-  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2048251
-  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2015525
--- a/kernel/sctp_peer_label_bug/runtest.sh
+++ b/kernel/sctp_peer_label_bug/runtest.sh
@ -1,61 +0,0 @@
-#!/bin/bash
-# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
-# SPDX-License-Identifier: GPLv2
-# Copyright (c) 2022 Red Hat, Inc.
-# Author: Ondrej Mosnacek <omosnace@redhat.com>
-
-# Include Beakerlib environment
-. /usr/share/beakerlib/beakerlib.sh || exit 1
-
-function check_avc_begin() {
-    sleep 1.1
-    date +'%x %T'
-    sleep 1.1
-}
-
-function check_avc_end() {
-    marker="marker-$RANDOM"
-
-    auditctl -m "$marker"
-
-    for (( i = 0; i < 100; i++ )); do
-        if ausearch -i -m user -ts $1 2>/dev/null </dev/null | \
-            grep -q "$marker"
-        then
-            echo $i
-            break
-        fi
-        sleep 0.1
-    done
-
-    ausearch -i -m avc -ts $1 </dev/null
-}
-
-rlJournalStart
-    rlPhaseStartSetup
-        rlRun "uname -r" 0 "Print kernel version"
-
-        for prog in sctp_bz2048251_client sctp_bz2048251_server; do
-            rlRun "gcc -O2 -Wall -o $prog sctp_common.c $prog.c -lsctp" 0 \
-                "Compile $prog"
-        done
-        rlRun "modprobe sctp" 0 "Ensure SCTP module is loaded"
-        rlRun "mkfifo flag" 0 "Create a fifo file for test"
-    rlPhaseEnd
-
-    rlPhaseStartTest
-        rlRun "audit_ts=\"\$(check_avc_begin)\""
-
-        rlRun "timeout 30 ./sctp_bz2048251_server -f flag -4 9999 &" 0 "Start the server"
-        rlRun "read -t 5 <>flag" 0 "Wait for the server to start listening"
-        rlRun "./sctp_bz2048251_client 127.0.0.1 9999" 0 "Run the client"
-        rlRun "wait" 0 "Wait for the server to exit"
-
-        rlRun "check_avc_end \"\$audit_ts\"" 1 "Check if there are AVC denials"
-    rlPhaseEnd
-
-    rlPhaseStartCleanup
-        rlRun "rm -f sctp_bz2048251_client sctp_bz2048251_server flag"
-    rlPhaseEnd
-rlJournalPrintText
-rlJournalEnd
--- a/kernel/sctp_peer_label_bug/sctp_bz2048251_client.c
+++ b/kernel/sctp_peer_label_bug/sctp_bz2048251_client.c
@ -1,109 +0,0 @@
-#include "sctp_common.h"
-
-static void usage(char *progname)
-{
-	fprintf(stderr,
-		"usage:  %s [-v] addr port\n"
-		"\nWhere:\n\t"
-
-		"-v      Print context and ip options information.\n\t"
-		"addr    IPv4 or IPv6 address (e.g. 127.0.0.1 or ::1).\n\t"
-		"port    Port for accessing server.\n", progname);
-	exit(1);
-}
-
-int main(int argc, char **argv)
-{
-	int opt, sock, result;
-	struct addrinfo hints, *serverinfo;
-	bool verbose = false;
-	struct timeval tm;
-	socklen_t sinlen;
-	struct sockaddr_storage sin;
-
-	while ((opt = getopt(argc, argv, "v")) != -1) {
-		switch (opt) {
-		case 'v':
-			verbose = true;
-			break;
-		default:
-			usage(argv[0]);
-		}
-	}
-
-	if ((argc - optind) != 2)
-		usage(argv[0]);
-
-	memset(&hints, 0, sizeof(struct addrinfo));
-	hints.ai_protocol = IPPROTO_SCTP;
-	hints.ai_socktype = SOCK_SEQPACKET;
-
-	result = getaddrinfo(argv[optind], argv[optind + 1], &hints,
-			     &serverinfo);
-	if (result < 0) {
-		fprintf(stderr, "Client getaddrinfo: %s\n",
-			gai_strerror(result));
-		exit(2);
-	}
-
-	sock = socket(serverinfo->ai_family, serverinfo->ai_socktype,
-		      serverinfo->ai_protocol);
-	if (sock < 0) {
-		perror("Client socket");
-		exit(3);
-	}
-
-	/*
-	 * These timeouts are set to test whether the peer { recv } completes
-	 * or not when the permission is denied.
-	 */
-	tm.tv_sec = 4;
-	tm.tv_usec = 0;
-	result = setsockopt(sock, SOL_SOCKET, SO_SNDTIMEO, &tm, sizeof(tm));
-	if (result < 0) {
-		perror("Client setsockopt: SO_SNDTIMEO");
-		exit(4);
-	}
-
-	result = setsockopt(sock, SOL_SOCKET, SO_RCVTIMEO, &tm, sizeof(tm));
-	if (result < 0) {
-		perror("Client setsockopt: SO_RCVTIMEO");
-		exit(5);
-	}
-
-	if (listen(sock, SOMAXCONN)) {
-		perror("Client listen");
-		close(sock);
-		exit(1);
-	}
-
-	/* Subscribe to assoc_id events */
-	result = set_subscr_events(sock, off, on, off, off);
-	if (result < 0) {
-		perror("Client setsockopt: SCTP_EVENTS");
-		return 1;
-	}
-
-	result = open_assoc(sock, serverinfo->ai_addr, serverinfo->ai_addrlen,
-			    verbose);
-	if (result) {
-		close(sock);
-		exit(result);
-	}
-
-	result = receive_assoc(sock, &sin, &sinlen, verbose);
-	if (result) {
-		close(sock);
-		exit(result);
-	}
-
-	result = open_assoc(sock, serverinfo->ai_addr, serverinfo->ai_addrlen,
-			    verbose);
-	if (result) {
-		close(sock);
-		exit(result);
-	}
-
-	close(sock);
-	exit(0);
-}
--- a/kernel/sctp_peer_label_bug/sctp_bz2048251_server.c
+++ b/kernel/sctp_peer_label_bug/sctp_bz2048251_server.c
@ -1,132 +0,0 @@
-#include "sctp_common.h"
-
-static void usage(char *progname)
-{
-	fprintf(stderr,
-		"usage:  %s [-4] [-f file] [-v] port\n"
-		"\nWhere:\n\t"
-		"-4      Listen on IPv4 addresses only.\n\t"
-		"-f      Write a line to the file when listening starts.\n\t"
-		"        \"nopeer\" message to client, otherwise the peer context\n\t"
-		"        will be retrieved and sent to client.\n\t"
-		"-v      Print context and ip options information.\n\t"
-		"port    Listening port.\n", progname);
-	exit(1);
-}
-
-int main(int argc, char **argv)
-{
-	int opt, sock, result;
-	socklen_t sinlen;
-	struct sockaddr_storage sin;
-	struct addrinfo hints, *res;
-	char *flag_file = NULL;
-	bool verbose = false, ipv4 = false;
-	unsigned short port;
-
-	while ((opt = getopt(argc, argv, "4f:v")) != -1) {
-		switch (opt) {
-		case '4':
-			ipv4 = true;
-			break;
-		case 'f':
-			flag_file = optarg;
-			break;
-		case 'v':
-			verbose = true;
-			break;
-		default:
-			usage(argv[0]);
-		}
-	}
-
-	if ((argc - optind) != 1)
-		usage(argv[0]);
-
-	port = atoi(argv[optind]);
-	if (!port)
-		usage(argv[0]);
-
-	memset(&hints, 0, sizeof(struct addrinfo));
-	hints.ai_flags = AI_PASSIVE;
-	hints.ai_protocol = IPPROTO_SCTP;
-
-	if (ipv4)
-		hints.ai_family = AF_INET;
-	else
-		hints.ai_family = AF_INET6;
-
-	/* sctp_peeloff(3) must be from 1 to Many style socket */
-	hints.ai_socktype = SOCK_SEQPACKET;
-
-	result = getaddrinfo(NULL, argv[optind], &hints, &res);
-	if (result < 0) {
-		fprintf(stderr, "Server getaddrinfo: %s\n",
-			gai_strerror(result));
-		exit(1);
-	}
-
-	sock = socket(res->ai_family, res->ai_socktype, res->ai_protocol);
-	if (sock < 0) {
-		perror("Server socket");
-		exit(1);
-	}
-
-	result = setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on));
-	if (result < 0) {
-		perror("Server setsockopt: SO_REUSEADDR");
-		close(sock);
-		exit(1);
-	}
-
-	result = bind(sock, res->ai_addr, res->ai_addrlen);
-	if (result < 0) {
-		perror("Server bind");
-		close(sock);
-		exit(1);
-	}
-
-	if (listen(sock, SOMAXCONN)) {
-		perror("Server listen");
-		close(sock);
-		exit(1);
-	}
-
-	/* Subscribe to assoc_id events */
-	result = set_subscr_events(sock, off, on, off, off);
-	if (result < 0) {
-		perror("Client setsockopt: SCTP_EVENTS");
-		return 1;
-	}
-
-	if (flag_file) {
-		FILE *f = fopen(flag_file, "w");
-		if (!f) {
-			perror("Flag file open");
-			exit(1);
-		}
-		fprintf(f, "listening\n");
-		fclose(f);
-	}
-
-	result = receive_assoc(sock, &sin, &sinlen, verbose);
-	if (result) {
-		close(sock);
-		exit(result);
-	}
-
-	result = open_assoc(sock, (struct sockaddr *)&sin, sinlen, verbose);
-	if (result) {
-		close(sock);
-		exit(result);
-	}
-
-	result = receive_assoc(sock, &sin, &sinlen, verbose);
-	if (result) {
-		close(sock);
-		exit(result);
-	}
-
-	close(sock);
-	exit(0);
-}
--- a/kernel/sctp_peer_label_bug/sctp_common.c
+++ b/kernel/sctp_peer_label_bug/sctp_common.c
@ -1,384 +0,0 @@
-#include "sctp_common.h"
-
-#define member_size(type, member) sizeof(((type *)0)->member)
-#define sizeof_up_to(type, member) (offsetof(type, member) + member_size(type, member))
-
-void print_addr_info(struct sockaddr *sin, char *text)
-{
-	struct sockaddr_in *addr4;
-	struct sockaddr_in6 *addr6;
-	char addr_str[INET6_ADDRSTRLEN + 1];
-
-	switch (sin->sa_family) {
-	case AF_INET:
-		addr4 = (struct sockaddr_in *)sin;
-		inet_ntop(sin->sa_family,
-			  (void *)&addr4->sin_addr,
-			  addr_str, INET6_ADDRSTRLEN + 1);
-		printf("%s IPv4 addr %s\n", text, addr_str);
-		break;
-	case AF_INET6:
-		addr6 = (struct sockaddr_in6 *)sin;
-		if (IN6_IS_ADDR_V4MAPPED(&addr6->sin6_addr)) {
-			inet_ntop(AF_INET,
-				  (void *)&addr6->sin6_addr.s6_addr32[3],
-				  addr_str, INET6_ADDRSTRLEN + 1);
-			printf("%s IPv6->IPv4 MAPPED addr %s\n",
-			       text, addr_str);
-		} else if (IN6_IS_ADDR_LINKLOCAL(&addr6->sin6_addr)) {
-			inet_ntop(sin->sa_family,
-				  (void *)&addr6->sin6_addr,
-				  addr_str, INET6_ADDRSTRLEN + 1);
-			printf("%s IPv6 local link addr %s scope_id %d\n",
-			       text, addr_str,
-			       ((struct sockaddr_in6 *)addr6)->sin6_scope_id);
-		} else {
-			inet_ntop(sin->sa_family,
-				  (void *)&addr6->sin6_addr,
-				  addr_str, INET6_ADDRSTRLEN + 1);
-			printf("%s IPv6 addr %s\n", text,
-			       addr_str);
-		}
-		break;
-	default:
-		printf("%s Unknown IP family %d\n", text, sin->sa_family);
-		break;
-	}
-}
-
-int set_subscr_events(int fd, int data_io, int assoc, int addr, int shutd)
-{
-	struct sctp_event_subscribe subscr_events;
-
-	memset(&subscr_events, 0, sizeof(subscr_events));
-	subscr_events.sctp_data_io_event = data_io;
-	subscr_events.sctp_association_event = assoc;
-	subscr_events.sctp_address_event = addr;
-	subscr_events.sctp_shutdown_event = shutd;
-
-	/*
-	 * Truncate optlen to just the fields we touch to avoid errors when
-	 * the uapi headers are newer than the running kernel.
-	 */
-	return setsockopt(fd, IPPROTO_SCTP, SCTP_EVENTS, &subscr_events,
-			  sizeof_up_to(struct sctp_event_subscribe,
-				       sctp_shutdown_event));
-}
-
-/*
- * Currently only SCTP_ASSOC_CHANGE, SCTP_PEER_ADDR_CHANGE and
- * SCTP_SHUTDOWN_EVENT are enabled via set_subscr_events().
- */
-int handle_event(void *buf, char *cmp_addr, sctp_assoc_t *assoc_id,
-		 bool verbose, char *text)
-{
-	union sctp_notification *snp = buf;
-	char addrbuf[INET6_ADDRSTRLEN];
-	struct sockaddr_in *sin;
-	struct sockaddr_in6 *sin6;
-	const char *ap;
-	struct sctp_paddr_change *spc;
-	struct sctp_assoc_change *sac;
-	struct sctp_remote_error *sre;
-	struct sctp_send_failed *ssf;
-	struct sctp_authkey_event *auth_event;
-
-	switch (snp->sn_header.sn_type) {
-	case SCTP_ASSOC_CHANGE:
-		sac = &snp->sn_assoc_change;
-
-		if (verbose)
-			printf("%s SCTP_ASSOC_CHANGE event for assoc_id: %d ERR: 0x%x\n",
-			       text, sac->sac_assoc_id, sac->sac_error);
-
-		if (assoc_id)
-			*assoc_id = sac->sac_assoc_id;
-		break;
-	case SCTP_PEER_ADDR_CHANGE:
-		spc = &snp->sn_paddr_change;
-
-		if (verbose)
-			/*
-			 * Not all spc_error codes are errors - linux/sctp.h
-			 * (e.g. SCTP_HEARTBEAT_SUCCESS = 0x02)
-			 */
-			printf("%s SCTP_PEER_ADDR_CHANGE event for assoc_id: %d ERR: 0x%x\n",
-			       text, spc->spc_assoc_id, spc->spc_error);
-
-		if (spc->spc_aaddr.ss_family == AF_INET) {
-			sin = (struct sockaddr_in *) &spc->spc_aaddr;
-			ap = inet_ntop(AF_INET, &sin->sin_addr, addrbuf,
-				       INET6_ADDRSTRLEN);
-		} else {
-			sin6 = (struct sockaddr_in6 *) &spc->spc_aaddr;
-			ap = inet_ntop(AF_INET6, &sin6->sin6_addr, addrbuf,
-				       INET6_ADDRSTRLEN);
-		}
-		if (verbose) /* Print additional address details */
-			print_addr_info((struct sockaddr *)&spc->spc_aaddr,
-					"Peer Address change:\n\t");
-
-		switch (spc->spc_state) {
-		case SCTP_ADDR_AVAILABLE:
-			if (verbose)
-				printf("\t%s is available\n", text);
-			break;
-		case SCTP_ADDR_UNREACHABLE:
-			if (verbose)
-				printf("\t%s is not available - Error: 0x%x\n",
-				       text, spc->spc_error);
-			break;
-		case SCTP_ADDR_REMOVED:
-			if (verbose)
-				printf("\t%s was removed\n", text);
-			break;
-		case SCTP_ADDR_ADDED:
-			if (verbose)
-				printf("\t%s was added\n", text);
-			break;
-		case SCTP_ADDR_MADE_PRIM:
-			if (verbose)
-				printf("\t%s is primary\n", text);
-			if (cmp_addr) {
-				if (!strcmp(ap, cmp_addr)) {
-					if (verbose)
-						printf("\t%s and is now the new primary\n", text);
-
-					return EVENT_ADDR_MATCH;
-				}
-			}
-			break;
-		case SCTP_ADDR_CONFIRMED:
-			if (verbose)
-				printf("\t%s is confirmed\n", text);
-			break;
-		default:
-			if (verbose)
-				printf("%s unknown state: %d\n", text,
-				       spc->spc_state);
-			break;
-		}
-		break;
-	case SCTP_SEND_FAILED:
-		ssf = &snp->sn_send_failed;
-
-		if (verbose)
-			printf("%s SCTP_SEND_FAILED event assoc_id: %d ERR: 0x%x\n",
-			       text, ssf->ssf_assoc_id, ssf->ssf_error);
-		break;
-	case SCTP_REMOTE_ERROR:
-		sre = &snp->sn_remote_error;
-		if (verbose) /* Error in network byte order - linux/sctp.h */
-			printf("%s SCTP_REMOTE_ERROR event ERR: 0x%x\n",
-			       text, ntohs(sre->sre_error));
-		break;
-	case SCTP_SHUTDOWN_EVENT:
-		if (verbose)
-			printf("%s SCTP_SHUTDOWN_EVENT\n", text);
-
-		return EVENT_SHUTDOWN;
-	case SCTP_PARTIAL_DELIVERY_EVENT:
-		if (verbose)
-			printf("%s SCTP_PARTIAL_DELIVERY_EVENT\n", text);
-		break;
-	case SCTP_ADAPTATION_INDICATION:
-		if (verbose)
-			printf("%s SCTP_ADAPTATION_INDICATION event\n", text);
-		break;
-	case SCTP_AUTHENTICATION_INDICATION:
-		auth_event = &snp->sn_authkey_event;
-
-		if (verbose) {
-			printf("%s SCTP_AUTHENTICATION_INDICATION event\n"
-			       "\tauth_event->auth_type:       0x%x\n"
-			       "\tauth_event->auth_flags:      0x%x\n"
-			       "\tauth_event->auth_length:     0x%x\n"
-			       "\tauth_event->auth_keynumber:  0x%x\n"
-			       "\tauth_event->auth_indication: 0x%x\n"
-			       "\tauth_event->auth_assoc_id:   %d\n",
-			       text, auth_event->auth_type,
-			       auth_event->auth_flags,
-			       auth_event->auth_length,
-			       auth_event->auth_keynumber,
-			       auth_event->auth_indication,
-			       auth_event->auth_assoc_id);
-		}
-		/* SCTP_AUTH_NO_AUTH defined in linux/sctp.h */
-		if (auth_event->auth_indication == SCTP_AUTH_NO_AUTH)
-			return EVENT_NO_AUTH;
-		break;
-	case SCTP_SENDER_DRY_EVENT:
-		if (verbose)
-			printf("%s SCTP_SENDER_DRY_EVENT\n", text);
-		break;
-	case SCTP_STREAM_RESET_EVENT:
-		if (verbose)
-			printf("%s SCTP_STREAM_RESET_EVENT\n", text);
-		break;
-	case SCTP_ASSOC_RESET_EVENT:
-		if (verbose)
-			printf("%s SCTP_ASSOC_RESET_EVENT\n", text);
-		break;
-	case SCTP_STREAM_CHANGE_EVENT:
-		if (verbose)
-			printf("%s SCTP_STREAM_CHANGE_EVENT\n", text);
-		break;
-	case SCTP_SEND_FAILED_EVENT:
-		if (verbose)
-			printf("%s SCTP_SEND_FAILED_EVENT\n", text);
-		break;
-	default:
-		fprintf(stderr, "%s unknown event: 0x%x\n", text,
-			snp->sn_header.sn_type);
-		break;
-	}
-
-	return EVENT_OK;
-}
-
-int receive_assoc(int sock, struct sockaddr_storage *sin, socklen_t *sinlen,
-		  int verbose)
-{
-	int result, peeloff_sk = 0, flags;
-	sctp_assoc_t assoc_id = 0;
-	char *peerlabel, msglabel[256];
-
-	*sinlen = sizeof(*sin);
-	flags = 0;
-
-	result = sctp_recvmsg(sock, msglabel, sizeof(msglabel),
-			      (struct sockaddr *)sin, sinlen,
-			      NULL, &flags);
-	if (result < 0) {
-		perror("Server sctp_recvmsg-1");
-		return 1;
-	}
-
-	if (verbose)
-		print_addr_info((struct sockaddr *)sin,
-				"Server SEQPACKET recvmsg");
-
-	if (!(flags & MSG_NOTIFICATION) || !(flags & MSG_EOR)) {
-		printf("Invalid sctp_recvmsg response FLAGS: %x\n",
-		       flags);
-		return 1;
-	}
-
-	handle_event(msglabel, NULL, &assoc_id,
-		     verbose, "Peeloff Server");
-	if (assoc_id <= 0) {
-		printf("Server Invalid association ID: %d\n",
-		       assoc_id);
-		return 1;
-	}
-	peeloff_sk = sctp_peeloff(sock, assoc_id);
-	if (peeloff_sk < 0) {
-		perror("Server sctp_peeloff");
-		return 1;
-	}
-	if (verbose) {
-		printf("Server sctp_peeloff(3) on sk: %d with association ID: %d\n",
-		       peeloff_sk, assoc_id);
-	}
-
-	/* Now get the client msg on peeloff socket */
-	result = sctp_recvmsg(peeloff_sk, msglabel, sizeof(msglabel),
-			      (struct sockaddr *)sin, sinlen,
-			      NULL, &flags);
-	if (result < 0) {
-		perror("Server sctp_recvmsg-2");
-		close(peeloff_sk);
-		return 1;
-	}
-
-	if (verbose) {
-		print_addr_info((struct sockaddr *)sin,
-				"Server SEQPACKET peeloff recvmsg");
-		printf("peeloff association ID: %d\n",
-		       assoc_id);
-	}
-
-	peerlabel = strdup("nopeer");
-
-	printf("Server PEELOFF peer label: %s\n", peerlabel);
-
-	result = sctp_sendmsg(peeloff_sk, peerlabel,
-			      strlen(peerlabel),
-			      NULL, 0,
-			      0, 0, 0, 0, 0);
-	if (result < 0) {
-		perror("Server sctp_sendmsg");
-		close(peeloff_sk);
-		close(sock);
-		exit(1);
-	}
-
-	if (verbose)
-		printf("Server PEELOFF sent: %s\n", peerlabel);
-
-	free(peerlabel);
-
-	close(peeloff_sk);
-	return 0;
-}
-
-int open_assoc(int sock, struct sockaddr *sin, socklen_t sinlen,
-	       int verbose)
-{
-	int result, peeloff_sk = 0, flags;
-	sctp_assoc_t assoc_id = 0;
-	char byte = 0x41, label[1024];
-
-	/* otherwise we might connect too fast */
-	sleep(1);
-
-	result = connect(sock, sin, sinlen);
-	if (result < 0) {
-		perror("Client connect");
-		return 1;
-	}
-
-	/* Get assoc_id for sctp_peeloff() */
-	flags = 0;
-	result = sctp_recvmsg(sock, label, sizeof(label),
-			      NULL, 0, NULL, &flags);
-	if (result < 0) {
-		perror("Client sctp_recvmsg-1");
-		return 1;
-	}
-
-	if ((flags & (MSG_NOTIFICATION | MSG_EOR)) != (MSG_NOTIFICATION | MSG_EOR)) {
-		printf("Invalid sctp_recvmsg response FLAGS: %x\n", flags);
-		return 1;
-	}
-	handle_event(label, NULL, &assoc_id, verbose, "Peeloff Client");
-	if (assoc_id <= 0) {
-		printf("Client Invalid association ID: %d\n", assoc_id);
-		return 1;
-	}
-
-	peeloff_sk = sctp_peeloff(sock, assoc_id);
-	if (peeloff_sk < 0) {
-		perror("Client sctp_peeloff");
-		return 1;
-	}
-
-	result = sctp_sendmsg(peeloff_sk, &byte, 1, NULL, 0,
-			      0, 0, 0, 0, 0);
-	if (result < 0) {
-		perror("Client sctp_sendmsg");
-		close(peeloff_sk);
-		return 1;
-	}
-
-	result = sctp_recvmsg(peeloff_sk, label, sizeof(label),
-			      NULL, 0, NULL, NULL);
-	if (result < 0) {
-		perror("Client sctp_recvmsg");
-		close(peeloff_sk);
-		return 1;
-	}
-
-	close(peeloff_sk);
-	return 0;
-}
--- a/kernel/sctp_peer_label_bug/sctp_common.h
+++ b/kernel/sctp_peer_label_bug/sctp_common.h
@ -1,38 +0,0 @@
-#ifndef _GNU_SOURCE
-#define _GNU_SOURCE /* For poll(2) POLLRDHUP - Detect client close(2) */
-#endif
-
-#include <arpa/inet.h>
-#include <sys/poll.h>
-#include <sys/types.h>
-#include <sys/socket.h>
-#include <net/if.h>
-#include <netdb.h>
-#include <netinet/in.h>
-#include <netinet/ip.h>
-#include <netinet/sctp.h>
-#include <stdlib.h>
-#include <stddef.h>
-#include <string.h>
-#include <unistd.h>
-#include <stdio.h>
-#include <stdbool.h>
-#include <errno.h>
-
-enum event_ret {
-	EVENT_OK,
-	EVENT_ADDR_MATCH,
-	EVENT_SHUTDOWN,
-	EVENT_NO_AUTH
-};
-
-void print_addr_info(struct sockaddr *sin, char *text);
-int set_subscr_events(int fd, int data_io, int assoc, int addr, int shutd);
-int handle_event(void *buf, char *cmp_addr, sctp_assoc_t *assoc_id,
-		 bool verbose, char *text);
-
-static const int on = 1, off = 0;
-
-int receive_assoc(int sock, struct sockaddr_storage *sin, socklen_t *sinlen,
-		  int verbose);
-int open_assoc(int sock, struct sockaddr *sin, socklen_t sinlen, int verbose);
--- a/kernel/selinux-testsuite/main.fmf
+++ b/kernel/selinux-testsuite/main.fmf
@ -1,24 +1,10 @@
+path: /kernel/selinux-testsuite
+
 summary: Wrapper for selinux-testuite
 description: |
    This TC runs a functional test suite for the LSM-based SELinux security module.
-contact: Milos Malik <mmalik@redhat.com>
-component:
-  - kernel
-  - selinux-policy
-framework: beakerlib
-duration: 1h
-tier: 1
-enabled: true
-tag:
-  - fusa
-adjust+:
-  - enabled: false
-    when: distro < rhel-6
-  - enabled: false
-    when: arch = i386
-environment:
-    AVC_ERROR: +no_avc_check
-check:
-  - how: avc
-    result: xfail
-id: f491d519-a7cd-4acf-8405-67a6afcc678a
+duration: 60m
+tier: 2
+adjust:
+-   enabled: false
+    when: distro < rhel-5
--- a/kernel/selinux-testsuite/runtest.sh
+++ b/kernel/selinux-testsuite/runtest.sh
@ -35,7 +35,7 @@ PACKAGE="selinux-policy"
 # This should be updated as needed after verifying that the new version
 # doesn't break testing and after applying all necessary tweaks in the TC.
 # Run with GIT_BRANCH=master to run the latest upstream version.
-DEFAULT_COMMIT="72e60b6018321a3da9d5e328477e29ee7366e498"
+DEFAULT_COMMIT="24bb5c0090710767ff187f1682e5bf355166caa3"
 # Default pull requests to merge before running the test.
 # If non-empty, then after checking out GIT_BRANCH the listed upstream pull
 # requests (by number) are merged, creating a new temporary local branch.
@ -44,7 +44,7 @@ DEFAULT_PULLS=""
 DEFAULT_PATCHES=""

 # Optional test parameter - location of testuite git.
-GIT_URL=${GIT_URL:-"https://github.com/SELinuxProject/selinux-testsuite"}
+GIT_URL=${GIT_URL:-"git://github.com/SELinuxProject/selinux-testsuite"}

 # Optional test parameter - timeout for detecting lost packets
 NETWORK_TIMEOUT=${NETWORK_TIMEOUT:-4}
@ -70,21 +70,27 @@ else
    PIPEFAIL_DISABLE=""
 fi

-function version_le() {
-    { echo "$1"; echo "$2"; } | sort -V | tail -n 1 | grep -qx "$2"
-}
+if rlIsRHEL 5 ; then
+    # On RHEL-5 sort -V doesn't work, so just pretend we have the oldest kernel
+    function kver_ge() { false; }
+    function kver_lt() { true;  }
+    function kver_le() { true;  }
+    function kver_gt() { false; }
+else
+    function version_le() {
+        { echo "$1"; echo "$2"; } | sort -V | tail -n 1 | grep -qx "$2"
+    }

-function kver_ge() { version_le "$1" "$(uname -r)"; }
-function kver_lt() { ! kver_ge "$1"; }
-function kver_le() { version_le "$(uname -r)" "$1"; }
-function kver_gt() { ! kver_le "$1"; }
+    function kver_ge() { version_le "$1" "$(uname -r)"; }
+    function kver_lt() { ! kver_ge "$1"; }
+    function kver_le() { version_le "$(uname -r)" "$1"; }
+    function kver_gt() { ! kver_le "$1"; }
+fi

 function installDepsYum() {
    local yum="$1"; shift

-    if "$yum" install --help | grep -q -- --skip-unavailable; then
-        "$yum" install -y --skip-unavailable $*
-    elif "$yum" install --help | grep -q -- --skip-broken; then
+    if "$yum" --help | grep -q -- --skip-broken; then
        "$yum" install -y --skip-broken $*
    else
        for req in $*; do
@ -96,13 +102,7 @@ function installDepsYum() {
 }

 function installDeps() {
-    if [ -e /run/ostree-booted ]; then
-        for item in "$@"; do
-            if ! rpm -q --quiet --whatprovides "$item"; then
-                rpm-ostree --apply-live -y install "$item"
-            fi
-        done
-    elif type yum >/dev/null; then
+    if type yum >/dev/null; then
        installDepsYum yum "$@"
    elif type dnf >/dev/null; then
        installDepsYum dnf "$@"
@ -121,34 +121,25 @@ function boolSet() {

 rlJournalStart
    rlPhaseStartSetup "Install"
-        # Determine the base kernel package name and version corresponding
-        # to the currently running kernel. Use this information to derive
-        # the correct kernel subpackages to install.
-        if KERNEL_CORE_NVRA="$(rpm -qf "/boot/vmlinuz-$(uname -r)")"; then
-            KERNEL_CORE_NV="${KERNEL_CORE_NVRA%-*}"
-            KERNEL_CORE_N="${KERNEL_CORE_NV%-*}"
-
-            KERNEL_PKG_VRA="${KERNEL_CORE_NVRA#$KERNEL_CORE_N-}"
-            KERNEL_PKG_BASE="${KERNEL_CORE_N%-core}"
-
-            rlLog "Detected kernel package base name '$KERNEL_PKG_BASE' and version-release.arch '$KERNEL_PKG_VRA'"
-            KERNEL_PKGS="
-                $KERNEL_PKG_BASE-modules-extra-$KERNEL_PKG_VRA
-                $KERNEL_PKG_BASE-devel-$KERNEL_PKG_VRA
-            "
-        else
-            rlLog "Detected non-RPM running kernel - no extra kernel packages will be installed"
-            KERNEL_PKGS=""
-        fi
-
        # We need to install the kernel-* packages by ourselves, since we need
        # the same versions as the running kernel. And since we already need a
        # reliable package install function, let's just install all the
        # dependencies here. Thus we don't need to maintain duplicate lists of
        # package requirements in many places (RH repo, Fedora kernel dist-git,
        # CKI).
+        PKG_SUFFIX=""
+        KERNEL_VERSION="$(uname -r)"
+        PKG_VERSION="${KERNEL_VERSION%+debug}"
+        if [ "$PKG_VERSION" != "$KERNEL_VERSION" ]; then
+            rlLog "Detected debug kernel running."
+            PKG_SUFFIX="-debug"
+        fi
+
        REQUIRES="
-            $KERNEL_PKGS
+            kernel$PKG_SUFFIX-modules-extra-$PKG_VERSION
+            kernel-rt$PKG_SUFFIX-modules-extra-$PKG_VERSION
+            kernel$PKG_SUFFIX-devel-$PKG_VERSION
+            kernel-rt$PKG_SUFFIX-devel-$PKG_VERSION
            /usr/bin/unbuffer
            attr
            audit
@ -189,12 +180,13 @@ rlJournalStart
            rdma-core-devel
            selinux-policy-devel
            setools-console
+            which
            xfsprogs-devel
        "
        rlRun "installDeps \$REQUIRES" 0 "Install requires"

        # The CRB repo with libbpf-devel might not be enabled on RHEL
-        if rlIsRHEL '>=8' && ! [ -e /run/ostree-booted ]; then
+        if rlIsRHEL '>=8'; then
            for repo in "rhel-CRB" "beaker-CRB"; do
                rpm -q libbpf-devel &>/dev/null && break
                rlRun "dnf install --enablerepo $repo -y libbpf-devel" 0-255
@ -206,15 +198,18 @@ rlJournalStart
        rlAssertRpm ${PACKAGE}
        rlAssertRpm audit
        rlFileBackup /etc/selinux/semanage.conf
-        # run the testsuite in /root to avoid problems with other paths
-        rlRun "pushd /root"
+        # running the testsuite in /tmp causes permission denied messages
+        # rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
+        # rlRun "pushd $TmpDir"

-        # version_le() sanity check:
-        rlRun "version_le 4.10 4.10"
-        rlRun "version_le 4.10 4.10.0"
-        rlRun "version_le 4.10 4.10.1"
-        rlRun "! version_le 4.10 4.9"
-        rlRun "! version_le 4.10.0 4.10"
+        if ! rlIsRHEL 5 ; then
+            # version_le() sanity check:
+            rlRun "version_le 4.10 4.10"
+            rlRun "version_le 4.10 4.10.0"
+            rlRun "version_le 4.10 4.10.1"
+            rlRun "! version_le 4.10 4.9"
+            rlRun "! version_le 4.10.0 4.10"
+        fi

        if [ -d /sys/fs/selinux ]; then
            selinuxfs=/sys/fs/selinux
@ -263,23 +258,24 @@ rlJournalStart
            for pull in $GIT_PULLS; do
                ref="refs/pull/$pull/head"
                if ! rlRun "git fetch origin $ref:$ref" 0; then
-                    rlLogFatal "PR merge failed!"
-                    rlPhaseEnd
-                    exit 127
+                    rlRun "git checkout $GIT_BRANCH" 0
+                    rlLogWarning "PR merge failed, falling back to GIT_BRANCH"
+                    break
                fi
                if ! rlRun "git merge --no-edit $ref" 0; then
-                    rlLogFatal "PR merge failed!"
-                    rlPhaseEnd
-                    exit 127
+                    rlRun "git merge --abort" 0
+                    rlRun "git checkout $GIT_BRANCH" 0
+                    rlLogWarning "PR merge failed, falling back to GIT_BRANCH"
+                    break
                fi
            done
            $PIPEFAIL_ENABLE
            for pwseries in $GIT_PATCHES; do
                url="https://patchwork.kernel.org/series/$pwseries/mbox/"
                if ! rlRun "curl $url | git am -"; then
-                    rlLogFatal "Applying patch failed!"
-                    rlPhaseEnd
-                    exit 127
+                    rlRun "git checkout $GIT_BRANCH" 0
+                    rlLogWarning "Applying patch failed, falling back to GIT_BRANCH"
+                    break
                fi
            done
            $PIPEFAIL_DISABLE
@ -309,49 +305,34 @@ rlJournalStart
        } | rlRun "tee -a tests/tun_tap/tun_common.h" 0 \
            "Harden tun_tap test against missing defs"

-        # needed to avoid a flood of AVCs when run via restraint
-        # (RHEL-6 doesn't have unconfined_service_t)
-        if ! rlIsRHEL '<7'; then
-            rlRun "sed -i 's/type unconfined_t;/type unconfined_t, unconfined_service_t;/' policy/test_policy.if" 0
-            rlRun "sed -i 's/\\(allow \\\$1 initrc_t:fd use;\\)/\\1 allow \$1 unconfined_service_t:fd use;/' policy/test_policy.if" 0
-        else
-            rlRun "sed -i '/install_t/d' policy/test_policy.if" 0
-                "RHEL 6 doesn't have install_t"
-        fi
-
        exclude_tests=""
        force_tests=""
        for file in ./tests/nnp*/execnnp.c; do
-            rlRun "sed -i 's/3\.18/3.9/' $file" 0 \
+            rlRun "sed -i 's/3.18/3.9/' $file" 0 \
                "Fix up kernel version in nnp test"
        done
+        if rlIsRHEL 5 ; then
+            rlRun "sed -i '/unconfined_devpts_t/d' policy/test_policy.if" 0
+
+            rlRun "sed -i 's/read_file_perms/r_file_perms/'  policy/*.te" 0
+            rlRun "sed -i 's/mmap_file_perms/rx_file_perms/' policy/*.te" 0
+            rlRun "sed -i 's/list_dir_perms/r_dir_perms/'    policy/*.te" 0
+            rlRun "sed -i 's/ open / /'                      policy/*.te" 0
+
+            rlRun "sed -i 's/^sysadm_bin_spec_domtrans_to/userdom_sysadm_bin_spec_domtrans_to/' policy/*.te" 0
+
+            rlRun "sed -i 's/^corecmd_exec_bin(\(.*\))$/corecmd_exec_bin(\1)\ncorecmd_exec_sbin(\1)/' policy/*.te" 0
+            rlRun "sed -i 's/^corecmd_bin_entry_type(\(.*\))$/corecmd_bin_entry_type(\1)\ncorecmd_sbin_entry_type(\1)/' policy/*.te" 0
+            rlRun "sed -i 's/^userdom_search_user_home_dirs(\(.*\))$/userdom_search_user_home_dirs(user, \1)/' policy/*.te" 0
+        fi
        if rlIsRHEL "<8.2"; then
            rlRun "sed -i '/SUBDIRS += bpf/d;/export CFLAGS += -DHAVE_BPF/d' tests/Makefile" 0 \
                "RHEL < 8.2 doesn't ship libbpf => disable BPF subtests"
        fi
-        if rlIsRHEL "<9"; then
-            # CONFIG_KEY_DH_OPERATIONS not enabled on RHEL-8 :(
-            # on RHEL-7, KEYCTL_DH_COMPUTE is not defined in the header
-            exclude_tests+=" keys"
-        fi

        rlRun "sed -i 's/tm\.tv_sec = [0-9]*;/tm.tv_sec = $NETWORK_TIMEOUT;/' ./tests/*/*.c" 0 \
            "Tweak timeout in networking tests" # 2 secs is too little for SCTP test

-        if [ -e /run/ostree-booted ]; then
-            # Fixed by https://github.com/fedora-selinux/selinux-policy/pull/2029,
-            # but may not be in all distro streams.
-            rlRun "tee -a policy/test_global.te" 0  \
-                "Work around missing policy rules" <<EOF
-
-                gen_require(\`
-                    attribute domain;
-                    type install_t;
-                ')
-                allow domain install_t:fd use;
-EOF
-        fi
-
        if rlIsRHEL; then
            if kver_lt "3.10.0-349"; then
                # c4684bbdac07 [security] selinux: Permit bounded transitions under NO_NEW_PRIVS or NOSUID
@ -362,7 +343,7 @@ EOF
            if kver_lt "3.10.0-693"; then
                # I don't know when exactly these tests start passing, so I'm just
                # disabling them for anything below the RHEL-7.4 kernel...
-                exclude_tests+=" inet_socket/tcp inet_socket/udp"
+                exclude_tests+=" inet_socket"
                exclude_tests+=" filesystem/ext4 filesystem/xfs filesystem/jfs filesystem/vfat"
            fi

@ -381,12 +362,6 @@ EOF
                rlRun "cat >>policy/test_mmap.te <<<'allow_map(test_no_execmem_t, tmpfs_t, file)'"
            fi

-            # work around non-functional ext4 native quota support on
-            # RHEL-7
-            if kver_lt 4.18; then
-                rlRun "sed -i 's/3.6/4.18/g' tests/{fs_,}filesystem/test"
-            fi
-
            if kver_ge 4.18; then
                force_tests+=" sctp"
            fi
@ -401,61 +376,18 @@ EOF
                rlRun "sed -i 's/SCTP_SEND_FAILED_EVENT/SCTP_STREAM_CHANGE_EVENT + 1/g' tests/sctp/*.c" 0 \
                    "Fix SCTP test compilation on old RHEL kernels"
            fi
-            if kver_lt 4.18.0-252; then
-                # 8a4d5985551b [security] selinux: Add xfs quota command types
-                script1='s/\$test_count += 62;/$test_count = 55;/g'
-                script2='s/\$quota_checks += 1;/$quota_checks = 0;/g'
-                # for some reason this is needed for older RHEL 7 versions...
-                script3='s/\$test_count += 69;/$test_count = 55;/g'
-                rlRun "sed -i -E -e '$script1' -e '$script2' -e '$script3' tests/filesystem/test" 0 \
-                    "Apply workaround for missing XFS quota checks"
-            fi
-            if kver_lt 4.18.0-314; then
-                # a17f0671017f selinux: vsock: Set SID for socket returned by accept()
-                exclude_tests+=" vsock_socket"
-            fi
+            # CONFIG_KEYS_DH_COMPUTE not enabled on RHEL-8 :(
+            exclude_tests+=" keys"

-            sctp_client_peeloff=0
-            if kver_ge 4.18.0-305.39.1 && kver_lt 4.18.0-306; then
-                sctp_client_peeloff=1
-            fi
-            if kver_ge 4.18.0-348.19.1 && kver_lt 4.18.0-349; then
-                sctp_client_peeloff=1
-            fi
-            if kver_ge 4.18.0-372.1.1 && kver_lt 5.14; then
-                sctp_client_peeloff=1
-            fi
-            if kver_ge 5.14.0-70.15.1 && kver_lt 5.14.0-71; then
-                sctp_client_peeloff=1
-            fi
-            if kver_ge 5.14.0-84; then
-                sctp_client_peeloff=1
-            fi
-            if [ "$sctp_client_peeloff" -eq 1 ]; then
-                rlRun "sed -i 's/5\.18/4.18/g' tests/sctp/test" 0 \
-                    "Fix up kernel version in sctp test"
-            fi
-
-            # TODO: wait for 786fc12457268cc9b555dde6c22ae7300d4b40e1
-            # to be backported
-            #if kver_ge 5.14.0-326; then
-            #    force_tests+=" inet_socket/mptcp"
-            #fi
-
-            if ! grep -q 'CONFIG_SCSI_ISCSI_ATTRS=y' "/lib/modules/$(uname -r)/config"; then
-                rlRun "sed -i -e 's/runcon -t test_netlink_iscsi_socket_t/true/' \
-                    -e 's/runcon -t test_no_netlink_iscsi_socket_t/false/' \
-                    tests/netlink_socket/test" 0 \
-                    "Apply workaround for disabled CONFIG_SCSI_ISCSI_ATTRS"
-            fi
-
-            if ! grep -q 'CONFIG_QFMT_V2=y' "/lib/modules/$(uname -r)/config"; then
-                # patch the filesystem tests to not do quota tests on ext4
-                rlRun "sed -i -e 's/\`uname -r\`/\"3.0\"/' \
-                    -e 's/\\(elsif ( \$fs_type eq \"nfs4\" or \$fs_type eq \"nfs\"\\)/\\1 or \$fs_type eq \"ext4\"/' \
-                    tests/filesystem/test tests/fs_filesystem/test" 0 \
-                    "Apply workaround for disabled CONFIG_QFMT_V2"
-            fi
+            # Needs:
+            # e4cfa05e9bfe ("selinux: Add xfs quota command types")
+            # (not backported to any RHEL at this point - TODO update the check once it is)
+            script1='s/\$test_count += 62;/$test_count = 55;/g'
+            script2='s/\$quota_checks += 1;/$quota_checks = 0;/g'
+            # for some reason this is needed for older RHEL 7 versions...
+            script3='s/\$test_count += 69;/$test_count = 55;/g'
+            rlRun "sed -i -E -e '$script1' -e '$script2' -e '$script3' tests/filesystem/test" 0 \
+                "Apply workaround for missing XFS quota checks"
        fi

        # CKI mainline kernels don't ship with module build infrastructure
@ -483,6 +415,24 @@ EOF
                "Force applicable tests: $force_tests"
        fi

+        if ! modprobe sctp 2>/dev/null; then
+            script1='s/runcon -t test_sctp_socket_t/true/g'
+            script2='s/runcon -t test_no_sctp_socket_t/false/g'
+            rlRun "sed -i -e '$script1' -e '$script2' ./tests/extended_socket_class/test" 0 \
+                "No SCTP support => fix up extended_socket_class test"
+        fi
+
+        # on aarch64 and s390x the kernel support for Bluetooth is turned
+        # off so we disable the Bluetooth socket tests there
+        case "$(rlGetPrimaryArch)" in
+            aarch64|s390x)
+                script1='s/runcon -t test_bluetooth_socket_t/true/g'
+                script2='s/runcon -t test_no_bluetooth_socket_t/false/g'
+                rlRun "sed -i -e '$script1' -e '$script2' ./tests/extended_socket_class/test" 0 \
+                    "No Bluetooth support => fix up extended_socket_class test"
+                ;;
+        esac
+
        # Initialize report.
        rlRun "echo 'Remote: $GIT_URL' >results.log" 0
        rlRun "echo 'Branch: $GIT_BRANCH' >>results.log" 0
@ -533,8 +483,6 @@ EOF

        rlRun "sleep 5" 0
        rlRun "dmesg | grep -i \"rcu_sched detected stalls\"" 1
-
-        rlRun "popd" 0 "Leave /root"
        rlFileRestore
    rlPhaseEnd
 rlJournalPrintText
--- a/kernel/selinuxfs_dentry_softlockup/main.fmf
+++ b/kernel/selinuxfs_dentry_softlockup/main.fmf
@ -1,18 +0,0 @@
-summary: Test soft lockup on selinuxfs dentry lookup
-description: |
-  Verifies that traversing selinuxfs while policy is being reloaded doesn't
-  cause a deadlock in the kernel.
-contact: Ondrej Mosnacek <omosnace@redhat.com>
-component:
-  - kernel
-framework: beakerlib
-require:
-  - policycoreutils
-  - findutils
-duration: 5m
-tier: 2
-enabled: true
-link:
-  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1510603
-extra-hardware: |
-    keyvalue = PROCESSORS >= 2
--- a/kernel/selinuxfs_dentry_softlockup/runtest.sh
+++ b/kernel/selinuxfs_dentry_softlockup/runtest.sh
@ -1,37 +0,0 @@
-#!/bin/bash
-# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
-# SPDX-License-Identifier: GPLv2
-# Copyright (c) 2022 Red Hat, Inc.
-# Author: Ondrej Mosnacek <omosnace@redhat.com>
-
-# Include Beakerlib environment
-. /usr/share/beakerlib/beakerlib.sh || exit 1
-
-rlJournalStart
-    rlPhaseStartSetup
-        rlRun "uname -r" 0 "Print running kernel version"
-    rlPhaseEnd
-
-    rlPhaseStartTest
-        rlAssertGreaterOrEqual "Ensure the machine has at least two cores" \
-            "$(nproc)" 2
-
-        rlRun "(cd /sys/fs/selinux; while true; do find >/dev/null 2>&1; done) &"
-        rlRun "while true; do load_policy; sleep 0.1; done &"
-
-        function check_soft_lockup() {
-            for (( i = 0; i < 60; i++ )); do
-                dmesg | grep 'BUG: soft lockup' && return 1
-                sleep 1
-            done
-            return 0
-        }
-        rlRun "check_soft_lockup" 0 "Wait and see if soft lockup appears in dmesg"
-    rlPhaseEnd
-
-    rlPhaseStartCleanup
-        rlRun "kill \$(jobs -p)" 0 "Terminate background jobs"
-        rlRun "wait" 0 "Wait for background jobs to terminate"
-    rlPhaseEnd
-rlJournalPrintText
-rlJournalEnd
--- a/kernel/setsebool-deadlock/Makefile
+++ b/kernel/setsebool-deadlock/Makefile
@ -1,7 +0,0 @@
-# Minimal Makefile for standard-test-roles-beakerlib
-
-R="RhtsRequires: audit policycoreutils"
-
-run:
-	chmod +x runtest.sh
-	TEST=/SELinux/kernel/setsebool-deadlock ./runtest.sh
--- a/kernel/setsebool-deadlock/main.fmf
+++ b/kernel/setsebool-deadlock/main.fmf
@ -1,23 +0,0 @@
-summary: Regression test for deadlock when changing booleans
-description: |
-    Verify that setting booleans with SELinux audit exclude rules present
-    doesn't deadlock itself.
-    WARNING: This test will lockup the machine if the bug is present!
-    https://bugzilla.redhat.com/show_bug.cgi?id=1924230
-contact: Ondrej Mosnacek <omosnace@redhat.com>
-component:
- kernel
-framework: beakerlib
-require:
- audit
- policycoreutils
-duration: 5m
-tier: 3
-enabled: true
-adjust+:
- -  enabled: false
-    when: distro < fedora-34
-    because: some kernels on Fedora 33 and below don't have the fix
- -  enabled: false
-    when: distro ~< rhel-8.4
-    because: not expected to be fixed in RHEL-8 below 8.4
--- a/kernel/setsebool-deadlock/runtest.sh
+++ b/kernel/setsebool-deadlock/runtest.sh
@ -1,43 +0,0 @@
-#!/bin/bash
-# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
-# SPDX-License-Identifier: GPLv2
-# Copyright (c) 2021 Red Hat, Inc.
-# Author: Ondrej Mosnacek <omosnace@redhat.com>
-
-# Include Beakerlib environment
-. /usr/share/beakerlib/beakerlib.sh || exit 1
-
-function boolGet() {
-    getsebool "$1" | cut -d ' ' -f 3
-}
-function boolSet() {
-    getsebool "$1" &>/dev/null || return 0
-    setsebool "$1" "$2" || return 1
-    [ "$(boolGet "$1")" == "$2" ]
-}
-
-TEST_BOOLEAN="domain_can_mmap_files"
-
-rlJournalStart
-    rlPhaseStartSetup
-        rlRun "bool_default=\$(boolGet domain_can_mmap_files)" 0 \
-            "Get the initial boolean value"
-        rlRun "auditctl -a exclude,never -F subj_user=sysadm_u" 0 \
-            "Add an audit rule that triggers the bug"
-    rlPhaseEnd
-
-    rlPhaseStartTest
-        rlRun "setsebool domain_can_mmap_files $(( 1 - $bool_default )) &" 0 \
-            "Start setsebool in the background (it may hang)"
-        rlRun "sleep 5s" 0 "Give it a grace period of 5 seconds"
-        rlRun "test \$(jobs -r | wc -l) -eq 0" 0 "Check that it has exited"
-    rlPhaseEnd
-
-    rlPhaseStartCleanup
-        rlRun "auditctl -d exclude,never -F subj_user=sysadm_u" 0 \
-            "Remove the audit rule"
-        rlRun "boolSet domain_can_mmap_files $bool_default" 0 \
-            "Restore the boolean value"
-    rlPhaseEnd
-rlJournalPrintText
-rlJournalEnd
--- a/kernel/synflood/main.fmf
+++ b/kernel/synflood/main.fmf
@ -8,9 +8,7 @@ component:
 - kernel
 framework: beakerlib
 require:
- type: library
-  url: https://github.com/beakerlib/epel.git
-  name: /epel
+- library(distribution/epel)
 - /usr/bin/nc
 - perf
 - git
@ -20,16 +18,12 @@ require:
 recommend:
 - /usr/sbin/hping3
 duration: 1h
-# currently disabled due to being unreliable
-enabled: false
+enabled: true
 tier: 3
-adjust+:
-  - enabled: false
+adjust:
+    enabled: false
    when: distro < rhel-8
    because: The test doesn't work well on RHEL-7
-  - enabled: false
-    when: arch = s390x
-    because: No machines likely available with required HW configuration
 extra-hardware: |
    keyvalue = PROCESSORS >= 64
    hostrequire = <system><numanodes op="&gt;" value="1"/></system>
--- a/kernel/synflood/runtest.sh
+++ b/kernel/synflood/runtest.sh
@ -7,9 +7,6 @@
 # Include Beakerlib environment
 . /usr/share/beakerlib/beakerlib.sh || exit 1

-# Set this parameter to 1 to also generate a flamegraph.
-GENERATE_FLAMEGRAPH="${GENERATE_FLAMEGRAPH:-0}"
-
 TEST_PORT=8080

 FG_URL="https://github.com/brendangregg/FlameGraph"
@ -29,15 +26,13 @@ if [ $(nproc) -lt 64 ]; then
    rlPhaseEnd
 else
    rlPhaseStartSetup
-        rlImport "epel/epel"
+        rlImport "distribution/epel"
        rlRun "command -v hping3 || epelyum install -y hping3" 0 \
            "Make sure hping3 is installed (EPEL-only on RHEL)"

        rlRun "uname -r"

-        if [ "$GENERATE_FLAMEGRAPH" != 0 ]; then
-            rlRun "git clone $FG_URL $FG_DIR"
-        fi
+        rlRun "git clone $FG_URL $FG_DIR"
    rlPhaseEnd

    rlPhaseStartTest
@ -69,14 +64,10 @@ else
    rlPhaseEnd

    rlPhaseStartCleanup
-        if [ "$GENERATE_FLAMEGRAPH" != 0 ]; then
-            rlRun "perf script -i perf.data | $FG_DIR/stackcollapse-perf.pl | $FG_DIR/flamegraph.pl > flamegraph.svg"
-            rlFileSubmit "flamegraph.svg"
-            rlRun "rm -f flamegraph.svg"
-        fi
+        rlRun "perf script -i perf.data | $FG_DIR/stackcollapse-perf.pl | $FG_DIR/flamegraph.pl > flamegraph.svg"
        rlRun "xz -T0 perf.data"

-        for file in "perf.data.xz" "perf-report.txt"; do
+        for file in "perf.data.xz" "flamegraph.svg" "perf-report.txt"; do
            rlFileSubmit "$file"
            rlRun "rm -f $file"
        done
--- a/kernel/sysctl-avcs/main.fmf
+++ b/kernel/sysctl-avcs/main.fmf
@ -1,22 +0,0 @@
-summary: Test for unexpected denials from sysctl -a
-description: |
-    Verifes that running sysctl -a doesn't trigger unexpected capability
-    checks that would result in AVC denials even when access is allowed.
-contact: Ondrej Mosnacek <omosnace@redhat.com>
-component:
-  - kernel
-framework: beakerlib
-require:
-  - selinux-policy-devel
-duration: 10m
-tier: 2
-check:
-  - avc
-enabled: true
-adjust+:
-  - enabled: false
-    when: distro < rhel-9
-    because: RHEL-8 and below are not worth supporting by this test
-link:
-  - verifies: https://issues.redhat.com/browse/RHEL-135610
-  - verifies: https://issues.redhat.com/browse/RHEL-145590
--- a/kernel/sysctl-avcs/runtest.sh
+++ b/kernel/sysctl-avcs/runtest.sh
@ -1,32 +0,0 @@
-#!/bin/bash
-# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
-# SPDX-License-Identifier: GPLv2
-# Copyright (c) 2026 Red Hat, Inc.
-# Author: Ondrej Mosnacek <omosnace@redhat.com>
-
-# Include Beakerlib environment
-. /usr/share/beakerlib/beakerlib.sh || exit 1
-
-rlJournalStart
-    rlPhaseStartSetup
-        rlRun "uname -r"
-
-        SE_ROLE="$(secon -r --pid $$)"
-        SE_TYPE="$(secon -t --pid $$)"
-
-        rlRun "make -f /usr/share/selinux/devel/Makefile test_policy.pp M4PARAM='-D TEST_ROLE=$SE_ROLE -D TEST_TYPE=$SE_TYPE'" 0 \
-            "Build the test policy"
-        rlRun "semodule -i test_policy.pp" 0 "Load test policy"
-    rlPhaseEnd
-
-    rlPhaseStartTest
-        rlRun "runcon -t test_domain_t sysctl -a"
-    rlPhaseEnd
-
-    rlPhaseStartCleanup
-        rlRun "semodule -r test_policy" 0 "Unload test policy"
-        rlRun "make -f /usr/share/selinux/devel/Makefile clean" 0 \
-            "Clean the test policy"
-    rlPhaseEnd
-rlJournalPrintText
-rlJournalEnd
--- a/kernel/sysctl-avcs/test_policy.te
+++ b/kernel/sysctl-avcs/test_policy.te
@ -1,37 +0,0 @@
-policy_module(test_policy,1.0.0)
-
-type test_domain_t;
-domain_type(test_domain_t)
-
-corecmd_bin_entry_type(test_domain_t)
-kernel_read_all_sysctls(test_domain_t)
-kernel_read_security_state(test_domain_t)
-fs_read_binfmt_misc(test_domain_t)
-fs_search_auto_mountpoints(test_domain_t)
-
-# No interface for this in policy:
-require {
-	type binfmt_misc_fs_t;
-}
-list_dirs_pattern(test_domain_t, binfmt_misc_fs_t, binfmt_misc_fs_t)
-
-# Some BPF sysctls can only be read with CAP_SYS_ADMIN, so we need to silence
-# it.
-dontaudit test_domain_t self:capability sys_admin;
-
-require {
-	type TEST_TYPE;
-	role TEST_ROLE;
-}
-allow TEST_TYPE test_domain_t:process transition;
-role TEST_ROLE types test_domain_t;
-
-allow test_domain_t TEST_TYPE:fd use;
-allow test_domain_t TEST_TYPE:fifo_file rw_inherited_fifo_file_perms;
-allow test_domain_t TEST_TYPE:process { sigchld };
-
-files_search_tmp(test_domain_t)
-
-term_use_all_terms(test_domain_t)
-
-userdom_search_user_tmp_dirs(test_domain_t)
--- a/kernel/wrong-rules-after-setsebool/Makefile
+++ b/kernel/wrong-rules-after-setsebool/Makefile
@ -1,7 +0,0 @@
-# Minimal Makefile for standard-test-roles-beakerlib
-
-R="RhtsRequires: policycoreutils setools-console"
-
-run:
-	chmod +x runtest.sh
-	./runtest.sh
--- a/kernel/wrong-rules-after-setsebool/main.fmf
+++ b/kernel/wrong-rules-after-setsebool/main.fmf
@ -1,20 +0,0 @@
-summary: Regression test for broken rules after setting booleans
-description: |
-    Test that conditional rules are not broken after changing SELinux booleans.
-
-    Originally discovered in:
-    https://src.fedoraproject.org/tests/selinux/pull-request/203#comment-71053
-contact: Ondrej Mosnacek <omosnace@redhat.com>
-component:
- kernel
-framework: beakerlib
-require:
- policycoreutils
- setools-console
-duration: 5m
-tier: 2
-enabled: true
-adjust+:
-  - enabled: false
-    when: distro < rhel-7
-    because: RHEL-6 and below are not worth supporting by this test
--- a/kernel/wrong-rules-after-setsebool/runtest.sh
+++ b/kernel/wrong-rules-after-setsebool/runtest.sh
@ -1,29 +0,0 @@
-#!/bin/bash
-# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
-# SPDX-License-Identifier: GPLv2
-# Copyright (c) 2021 Red Hat, Inc.
-# Author: Ondrej Mosnacek <omosnace@redhat.com>
-
-# Include Beakerlib environment
-. /usr/share/beakerlib/beakerlib.sh || exit 1
-
-rlJournalStart
-    rlPhaseStartSetup
-        rlRun "uname -r"
-    rlPhaseEnd
-
-    rlPhaseStartTest
-        rlRun "sesearch -s ftpd_t -t public_content_rw_t -c dir -p create -A | \
-            tee sesearch-before.txt"
-        rlRun "setsebool ftpd_anon_write=off ftpd_connect_all_unreserved=off \
-            ftpd_connect_db=off ftpd_full_access=off"
-        rlRun "sesearch -s ftpd_t -t public_content_rw_t -c dir -p create -A | \
-            tee sesearch-after.txt"
-        rlAssertNotDiffer "sesearch-before.txt" "sesearch-after.txt"
-    rlPhaseEnd
-
-    rlPhaseStartCleanup
-        rlRun "rm -f sesearch-before.txt sesearch-after.txt"
-    rlPhaseEnd
-rlJournalPrintText
-rlJournalEnd
--- a/kernel/xfrm-refcount-underflow/main.fmf
+++ b/kernel/xfrm-refcount-underflow/main.fmf
@ -1,22 +0,0 @@
-summary: XFRM refcount underflow test
-description: |
-    Test that allocating and deallocating XFRM state and/or policy
-    structures doesn't lead to selinux_xfrm_refcount imbalance and
-    underflow.
-contact: Ondrej Mosnacek <omosnace@redhat.com>
-component:
-  - kernel
-framework: beakerlib
-recommend:
-  - systemtap
-duration: 15m
-tier: 2
-enabled: true
-adjust+:
-  - enabled: false
-    when: distro < rhel-7
-    because: RHEL-6 and below are not worth supporting by this test
-link:
-  - verifies: https://issues.redhat.com/browse/RHEL-27751
-extra-nitrate: TC#0617218
-id: d2bfb49c-fe12-48b5-8f17-8edf6f93810a
--- a/Show more
+++ b/Show more