Recent virt-install testing with various USB devices revealed
SELinux denials which are triggered when the virtqemud process
executes the udevadm command. The TC reproduces the situation.
In order to support this functionality, I believe that SELinux
policy should allow the execution and transition to the udev_t
domain. The TC looks for appropriate policy rules and file
context patterns.
The TC covers RHEL-236185.
If CPU boost control is unavailable, the tuned-adm verify returns 1.
-i do not treat missing/non-supported tunings as errors
ERROR: verify: failed: device cpu0: 'boost' = 'None', expected '1'
WARNING: Unable to set boost on cpu 'cpu0'. Neither per-policy boost nor intel_pstate no_turbo is
available.
Add beakerlib/TMT coverage and fixtures for M4 preprocessing of modular
policy builds: .if to all_interfaces.conf, .te + interfaces to .tmp
(then checkmodule), and .fc to .mod.fc, using live support macros from a
selinux-policy checkout and a snapshotted modular M4 recipe.
33 test cases (42 harness pass steps) with minimal standalone fixtures.
Each case is its own rlRun phase in runtest.sh. Covers interface path
validation (including duplicates and broken gen_require), .te arity
edge cases, post-M4 checkmodule failures from bad interface expansion,
.fc path edge cases, M4-to-semodule_package E2E, and .fc content where
labeling validation is deferred to sefcontext_compile.
When SELINUX_POLICY_SRC is unset, clones fedora-selinux/selinux-policy
using a host-detected branch (f$VERSION_ID on Fedora, c${major}s
otherwise), overridable with SELINUX_POLICY_BRANCH.
Signed-off-by: Akhil Kohli <akkohli@redhat.com>
The restorecond service does not really need its PID file, which means
that neither the systemd process nor the restorecond process should
create it or remove it.
Removal attempts are detected, because the test sets the immutable
bit on the PID file and then it looks for timeout messages in journal.
The --call-graph dwarf argument requires hardware fetures that may not
be implemented on some platforms (e.g. aarch64 AWS Graviton3 CPUs). Use
just plain -g instead, which will hopefully work anywhere. The stack
trace doesn't really matter that much anyway, as we are just testing
that the tracepoint is available and working.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
The selinux-policy commit adding support for bind packages with suffixes
also changes default context for /var/named and adds a few more
explicit entries.
This test update makes an adjustment to the current state.
The bind package now provides executables with suffixes, e.g.
"/usr/bin/named-9.18". That includes the main daemon named, rndc and
other tools. Links to the actual executables are provided using the
alternatives tool.
Subsequently, the named test is now being updated using the readlink command
to get canonical file names.
Recently filed bug reports revealed that SELinux prevents the qat_init.sh
process from the following actions:
* accessing (syscall = newfstatat) the /dev/hugepages directory
* creating (syscall = mkdir) the /dev/hugepages/qat directory
* setting permissions/ownership (syscall = fchownat)
The TC reproduces the situation.
In order to support the qat service functionality, I believe that
SELinux policy should allow these actions. The TC looks for appropriate
policy rules and file context patterns.
The TC covers RHEL-211077 and RHEL-211089.
If a process crashes in an nspawn container started either via machinectl start or systemd-nspawn -bD ...
it triggers an AVC denial, even if the container is under /var/lib/machines/.
Tests RHEL-139983
Allow the sys_resource capability to each domain which is allowed to
execute generic programs in system bin directories without domain
transition when the coreutils_bin_sys_resource tunable is on. If the
tunable is off, which is the default state, the capability is
dontaudited instead.
This test was nout counting with dontaudit rule beforehand. No avc will be present if the tunable
is off.
A recently filed bug report revealed that SELinux prevents the
bootupd service and its children processes from talking to SSSD.
The TC reproduces the situation on machines created by bootc.
In order to support this scenario, I believe that SELinux policy
should allow the necessary access. The TC looks for appropriate
policy rules and file context patterns.
The TC covers RHEL-174888.
Verify that checkpolicy and checkmodule abort cleanly when memory is
exhausted during compilation, rather than producing a potentially
incorrect output binary.
The test constrains the virtual address space of the compiler subprocess
to 8 MB via ulimit -v, which is sufficient for process startup but not
for parsing a full targeted policy binary. Both compilers are exercised
using binary input (checkpolicy -b, checkmodule -b) against the active
policy store. Assertions: non-zero exit status and no output file
produced under OOM.
Tested on RHEL 9, RHEL 10, and RHIVOS 2.0 on x86_64 and aarch64.
VROOM-40721
The original CVE fix has a bug in that it incorrectly checks execmem
permission for the mounter domain. Test for the regression in the test
so that we can verify its fix.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
The following exception is raised when the cups* tests are executed
via 'wow --distro ... --case ...':
ERROR Failed to add <Task /CoreOS/selinux-policy/Regression/cups-lpd-and-similar [TC#305784]> due issue with TMT Metadata: Error in processing libraries from {'url': 'https://src.fedoraproject.org/tests/selinux.git', 'ref': 'main', 'name': '/selinux-policy/cups-lpd-and-similar'}. Raised exception was:
ERROR Unable to add one of testcases due to wrong metadata - See `--ignore-invalid` option
The checkpolicy source RPM contains not only checkpolicy sources but
also checkpolicy tests. Purpose of this automated test is to run them
with the current versions of libsepol and checkpolicy components.
The original library(foo/bar) syntax was used via RPM Provides
on old RHTS / Beaker infra, and tmt translates it to fetching
libraries from https://github.com/beakerlib/, ie.
https://github.com/beakerlib/selinux-policy
This location then contains a wrapper redirect back to this
repo with tests.
Let's avoid the external Github round-trip and just link to the
library directly via local references.
Also change the epel library link to the modern syntax.
Signed-off-by: Jiri Jaburek <jjaburek@redhat.com>
The README on
https://github.com/beakerlib/distribution/tree/master/epel
states that
This is a compatibility layer to overcome a transitional
phase from distribution/epel to epel/epel.
So use epel/epel instead.
Signed-off-by: Jiri Jaburek <jjaburek@redhat.com>
This fixes nearly all tmt lint errors, since plans cannot have
'test:' and other test-related keywords.
Signed-off-by: Jiri Jaburek <jjaburek@redhat.com>
The fmf metadata keyword is 'tag', so 'tags' did nothing.
To avoid changing the behavior (adding a 'generic' tag to all tests),
I simply removed the keyword.
Signed-off-by: Jiri Jaburek <jjaburek@redhat.com>
One of the reported selinux-policy bugs revealed that SELinux
prevents the power-profiles-daemon from watching the /sys/firmware/acpi
directory. The TC only reproduces the situation when the right HW
is available.
In order to support this functionality, I believe that SELinux
policy should allow this access. The TC looks for appropriate
policy rules and file context patterns.
The TC covers RHEL-105423.
Since systemd v260 [1], support for System V service scripts has been
removed. As a part of this change, systemd-rc-local-generator and
systemd-sysv-generator were also removed.
This commit makes the relevant test parts run only if the generators
executables exist.
[1] https://github.com/systemd/systemd/releases/tag/v260-rc1
After introducing the systemd_nfs_generator_t domain, a bug report was
filed which revealed that SELinux prevents the nfs-server-generator
from creating and controling its UDP sockets. The TC reproduces the
situation.
In order to support all functions of the nfs-server-generator program,
I believe that SELinux policy should allow these actions. The TC looks
for appropriate policy rules and file context patterns.
The TC covers RHEL-111556.
For a successful run of the /selinux-policy/systemd-oomd test we
need the Pressure Stall Information (PSI) to be available.
From now on, the test add the psi=1 parameter to the kernel
command line and reboots the machine. The test should pass after
a reboot.
The /selinux-policy/kernel-confined-exec test intentionally triggers
SELinux denials. TMT framework sees them as a problem unless told
otherwise. From now on, the TMT will expect them.
A recently reported customer case revealed that the restorecond
service occasionally fails to start because of a timeout. The
exact reproducer is unknown, but the TC reproduces a similar
situation (mislabeled /run/restorecond.pid file) which also leads
to timeouts.
In order to fix the problem, the restorecond service is no longer
a forking type of service. It is a single type of service. The TC
checks this parameter too.
The TC covers RHEL-142541 and RHEL-165247.
Recently filed report revealed that certain files are not owned by the selinux-policy package.
This situation is generally described in the following document and should be fixed:
https://docs.fedoraproject.org/en-US/packaging-guidelines/UnownedDirectories/
Purpose of this test is to find out if the issue is fixed or not.
TC coveres: RHEL-141659 + RHEL-157952 + FC-1681
Recent logwatch + selinux-policy testing revealed that SELinux
prevents one of the logwatch scripts from checking files labeled
nsfs_t located under /run/netns directory. The TC reproduces the
situation.
In order to support the 'df' command functionality (executed by
one of the scripts, syscall = newfstatat), I believe that SELinux
policy should allow this access. The TC looks for appropriate
policy rules and file context patterns.
The TC covers RHEL-160896 and RHEL-160897.
Recent valkey + selinux-policy testing revealed that SELinux prevents
the valkey-server processes from creating and manipulating of RDMA
sockets when the valkey-rdma package is installed. The TC reproduces
the situation.
In order to enable the functions brought by the valkey-rdma package,
I believe that SELinux policy should allow the access. The TC looks
for appropriate policy rules and file context patterns.
The TC covers RHEL-154814 and RHEL-161115.
TC covers RHEL-141858
The issue appears to be caused by the coreutils-single package, which introduces additional
prctl() system calls, that request sys_resource capability, leading to AVC denials.
A CentOS stream 10 user reported that SELinux denials are triggered
when their device with a running iio-sensor-proxy service is rotated.
Further analysis revealed that iio-sensor-proxy cannot perform the
following activities:
* read various character devices - /dev/iio:device*
* create a UDP socket
* write into in_accel_x_en, in_accel_y_en, in_accel_z_en files
stored under /sys
* add a new directory for a HID sensor device connected via PCI
The TC does not reproduce the situation.
In order to support the cooperation of iio-sensor-proxy and various
devices, I believe that SELinux policy should allow these actions.
The TC looks for appropriate policy rules and file context patterns.
The TC covers RHEL-110090.
TC covers RHEL-142548 and RHEL-147470
If the setroubleshoot-server package is installed then the SELinux denial appears each time
the setroubleshootd process analyzes any SELinux denial, because the setroubleshootd process
executes the rpm command to find out which package owns some file.
Recent selinux-policy + dhcpcd + systemd-resolved testing revealed
SELinux denials caused by dhcpc hooks running the resolvectl program.
The TC reproduces the situation.
In order to support the dhcpcd service and its hooks fully, I believe
that SELinux policy allow the necessary actions. The TC looks for
appropriate policy rules and file context patterns.
The TC covers RHEL-147153 and RHEL-147155.
On Fedora rawhide, the kdump service is no longer brought by
the kexec-tools package. The kdump-utils package is necessary
for a successful run of this test on Fedora rawhide.
Many tests contain test phases called "real scenario". Purpose of
these phases is usually to test a service which belongs to a particular
package. If the service (systemd unit file) is not available for any
reason, it makes no sense to run the test phase - it would fail.
Other test phases may still be worth running.
The original reproducer would break network traffic outside IPv6
localhost- make sure there are default rules for unlabeled traffic so
that the machine doesn't lose network connectivity during test.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
When tests run in image mode, it's impossible to modify files under
/usr/lib/systemd/system because the filesystem is read-only.
Unfortunately, some tests try to do that which leads to their failures.
In order to avoid these failures, any systemd service file which
requires a modification needs to be copied to /etc/systemd/system/
directory (read-write mode) and modified there.
Purpose of this change is to increase the number of passing tests
in image mode.
When python modules are imported, DeprecationWarning messages can
appear. They are caused by the Swig code used in those modules.
Purpose of this TC is to find them.
The TC covers RHEL-118812, RHEL-138405 and RHEL-138406.
Unfortunately, the test was merged even if some metadata was missing.
Additionally, the description and summary contains characters which
are not allowed based on the output of: tmt tests lint.
Both problems should be fixed now.
A recently reported customer case revealed that the restorecon
program produces error messages even if it was executed with
the '-i' option. In such case no error messages should appear
when the inspected filesystem objects are missing.
The TC reproduces the situation when old libselinux/policycoreutils
packages are installed.
The TC covers RHEL-110181 and RHEL-123884.
A recent dhcpcd + selinux-policy testing revealed that SELinux
prevents the running dhcpcd-run-hooks script from writing into
/etc/chrony.conf file on s390x machines. The TC reproduces the
situation, which is accompanied by the following error message:
dhcpcd[...]: /usr/libexec/dhcpcd-run-hooks: line 132: /etc/chrony.conf: Permission denied
In order to support the intended dhcpcd-run-hooks function and
to avoid such errors in the journal, I believe that SELinux
policy should allow the access. The TC looks for appropriate
policy rules and file context patterns.
The TC covers RHEL-113937 and RHEL-113941.
Recently, a regular kernel + stress-ng testing revealed that SELinux
prevents the stress-ng program from writing (syscall = ftruncate)
and reading (syscall = mmap) the /secretmem anon inodes. The TC
reproduces the situation.
In order to enable various stress-ng functions, I believe that SELinux
policy should allow the actions mentioned above. The TC looks for
appropriate policy rules and file context patterns.
The TC covers RHEL-116154 and RHELTEST-2022.
The automated test runs the following command which produces an error:
# targetctl clear
Traceback (most recent call last):
File "/usr/bin/targetctl", line 7, in <module>
sys.exit(main())
~~~~^^
File "/usr/lib/python3.14/site-packages/rtslib/targetctl.py", line 79, in main
funcs[sys.argv[1]](savefile)
~~~~~~~~~~~~~~~~~~^^^^^^^^^^
TypeError: clear() takes 0 positional arguments but 1 was given
# echo $?
1
#
Even though SELinux is not the cause, the test fails because of the error.
To work around that problem, the expected exit code is between 0 and 255 now.
On rhel9 there is a another type with this name so it is colliding,
so my_test_file_t will be used in this test futher.
Signed-off-byt: jan janasek <jjanasek@redhat.com>
Unknown permissions are now handled as errors in CIL.
With selinux >= 3.0: a CIL module, which contains unknown permissions,
cannot be inserted via semodule -i. Error messages appear.
Signed-off-by: jan janasek <janjanasek@redhat.com>
Whenever a key is defined in the tmt hierarchy and some child also
defines that key, the child's will overwrite the previous one. The "+"
changes the operation to "append", so the content of key+ in the child
is added to the existing key.
Meaning that any "adjust" statement in a test plan using a test that
defines it's own "adjust:" is ignored.
Since we are expecting other statements to be appended to the "adjust"
sections, the content of each section needs to be a single list item as
opposed to a set of key-value pairs (first line needs to start with a
hyphen).
- Replace all "adjust:" sections with "adjust+:" in order to honor any
adjustments further up the tree (parent tests, or test plans).
- Fix malformed "adjust" sections (sets of key-value pairs)
Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
The preload scripts cause all tests to take significantly longer than
usual, often triggering timeouts with current time limits.
Increase the time limit to 1500%.
https://issues.redhat.com/browse/VROOM-29315
Usage:
tmt -c rhivos_preload=true run
or
context:
rhivos_preload: true
A syntax error appears when the following test is executed:
* policycoreutils/semodule-rebuild-if-modules-changed
The problem is a missing "then" word in the test code.
Tests which are not suitable (various reasons) for image mode
testing will get the avoidImageMode tag. If their conditions improve,
the tag can be removed.
The newly added image-mode plan runs all relevant tests except for
those which:
* are broken
* require multiple hosts
* do reboots
* are not suitable for image mode environments
The image-mode test plan does not recognize tiers. That may change
in the future.
Some tests intentionally trigger SELinux denials during their run
and there is no need to fail because of them. The default value
of avc check is not suitable for these tests.
Currently, the SELinux denial shown in RHEL-77071 is not reproducible
on RHEL-9 or CentOS stream 9. It makes no sense to check the SELinux
policy rule existence there. The test code relevancy was updated.
Recent systemd-machined + selinux-policy testing revealed that
SELinux prevents the systemd-machined processes from creating
and removing the following directories and files:
* /run/systemd/nspawn/
* /run/systemd/nspawn/locks/
* /run/systemd/nspawn/locks/inode-*
In order to support various systemd-machined and machinectl functions,
I believe that SELinux policy should allow above-mentioned actions.
The TC looks for appropriate policy rules and file context patterns.
The TC covers RHEL-105966 and RHEL-108849.
Adds documentation to the README file to explain the test tiering system and its role in our gating process.
This clarifies the meaning of 'tier: 1/2/3' metadata and explains that older tags (e.g., tag:Tier1) have been deprecated.
Signed-off-by: Jan Janasek <jjanasek@redhat.com>
Removed redundant tags (e.g., Tier2/Tier3 and Tier2se/Tier3se) from all tests
with "tier: 2" and "tier: 3" metadata. The "tier" metadata is used instead.
Signed-off-by: Jan Janasek <jjanasek@redhat.com>
all tests with CI-Tier-1 tag should have "tier: 1" in their metadata,
also removing tags Tier1 and Tier1se and lastly tests with "tier: 2"
and "tier: 3" should not have CI-Tier-1 tag.
Signed-off-by: Jan Janasek <jjanasek@redhat.com>
Several automated tests were updated, because they were failing on
RHEL-10 machines. The list of reasons follows:
* incorrect test relevancy
* unimportant SELinux denials
* newly defined SELinux labels
* missing metadata
A combined fapolicyd + systemd-machined + selinux-policy testing
revealed that SELinux prevents the fapolicyd processes from connecting
to the systemd-machined process via its UNIX socket located at:
/run/systemd/userdb/io.systemd.Machine. The TC reproduces the situation.
In order to support this behavior dictated by the nsswitch configuration,
I believe that SELinux policy should allow this action. The TC looks for
appropriate policy rules and file context patterns.
The TC covers RHEL-77071.
The valkey component is a replacement for the redis component. The
automated test covers basic functions of the valkey* services.
The TC covers RHEL-102631.
Do not check the type of /proc/pressure with matchpathcon because
the type is assigned using genfscon which is not recognised by
userspace tools.
Ensure that the /etc/systemd/system/-.slice.d and
/etc/systemd/system/user@.service.d directories exist before
creating files in them.
Recent selinux-policy testing revealed that policies for various systemd
generators are not complete. For example:
* SELinux prevented the vsftpd-generator program from executing commands
like mkdir, ls, ln, gawk etc.
* SELinux prevented systemd-cryptsetup-generator from creating files like
/run/systemd/generator/systemd-cryptsetup@luks*.service
In order to support the functionality of various systemd generators,
I believe that SELinux policy allow the actions mentioned above. The TC
looks for appropriate policy rules and file context patterns.
The TC covers RHEL-98656, RHEL-100415 and RHEL-100721.
Several recent bug reports revealed that SELinux prevents the tuned-ppd
processes from using the inotify_add_watch syscall on the following
directories:
* /sys/devices/system/cpu/intel_pstate (permission: watch)
* /sys/firmware/acpi (permission: watch_reads)
In order to support the expected tuned-ppd behavior, I believe that
SELinux policy should allow these actions. The TC looks for appropriate
policy rules and file context patterns.
The TC covers RHEL-101686, RHEL-101687, BZ#2358952 and their duplicates.
A recently reported bug revealed that SELinux prevents the
power-profiles-daemon processes from writing to the following file:
* /sys/devices/system/cpu/cpufreq/policy6/energy_performance_preference
The TC does not reproduce the situation usually.
In order to support the intentional behavior of the daemon when
power cable gets unplugged/plugged, I believe that SELinux policy
should allow the action. The TC looks for appropriate policy rules
and file context patterns.
The TC covers RHEL-100718.
To avoid running code from untrusted repositories, make the generation
of flamegraphs optional (via a test parameter) and disabled by default.
The test parameter should only be set to 1 as needed when running the
test manually and kept disabled in automated test runs.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
A recent libvirt testing of mediated devices revealed that SELinux
prevents the mdevctl process (executed by the virtnodedevd service)
from creating directories under /etc/mdevctl.d/. The TC reproduces
the situation.
In order to enable the expected mdevctl behavior, I believe that
SELinux policy should allow this action. The TC looks for appropriate
policy rules and file context patterns.
The TC covers RHEL-98559.
test if virtqemud can reset PCI devices
Recently, an experimental libvirt + selinux-policy testing that
SELinux prevents the rpc-virtqemud process from writing (syscall =
openat) into /sys/bus/pci/devices/0000:00:00.0/config file. The TC
reproduces the situation.
In order to support the nodedev-reset function and to avoid unnecessary
SELinux denials, I believe that SELinux policy should allow this
action. The TC looks for appropriate policy rules and file context
patterns.
The TC covers RHEL-101417.
The following tests are not relevant for RHEL-10 because the required
packages are not available for RHEL-10:
* /selinux-policy/caddy-and-similar
* /selinux-policy/cups-pdf-and-similar
* /selinux-policy/ntpsec-and-similar
Recently, exploratory systemd-importd + selinux-policy testing revealed
that SELinux prevents the systemd-importd service from creating and
deleting the /run/systemd/io.systemd.Import socket. The TC reproduces
the situation.
In order to support the systemd-importd service start with the default
configuration, I believe that SELinux policy should allow the actions
listed above. The TC looks for appropriate policy rules and file
context patterns.
The TC covers RHEL-98490.
The only important commit is 72e60b601832 ("policy/test_secretmem.te:
add anon_inode perms required in Linux v6.16-rc5"), which fixes the
testsuite to work on 6.16-rc5+ kernels.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Check if all tests tagged with rhel9_broken or rhel10_broken are
really broken. If not, remove the tag. If there are other broken
tests not yet tagged, assign them the relevant broken tag.
bootc-e2e tests requires specific environment related to image mode. The
image is prepared using buildah and later booted. This is not supported
in this test suite (yet)
Signed-off-by: Petr Lautrbach <lautrbach@redhat.com>
The rlSELibraryLoaded() now makes sure that the /etc directory and
its subdirectories are labeled correctly. If they are mislabeled,
a lot executed tests can trigger unnecessary SELinux denials.
Mainly to pull "tests/inet_socket: properly detect IPSEC support", which
makes the testsuite run successfully on automotive RHEL again.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Even though the RHEL-2616 bug was investigated on RHEL-9.x, it's
not fixed and it got auto-closed. Until a solution is found or the
bug is escalated, the automated test will skip the particular test
phase.
The upstream selinux-policy/deny-rules test suite failed during its run
on rhel-9. Cause of failure is an AVC denial triggered by modprobe
command while executing module_load. Fix the test code to address the
AVC & test failure.
Signed-off-by: Amith Kumar <apeetham@redhat.com>
Several reported BZs revealed that the tuned-ppd process can
create an incorrectly labeled ppd_base_profile file under the
/etc/tuned directory if the file does not exist. The TC reproduces
the situation.
In order to fix this issue, SELinux policy should define a filename
transition rule which ensures that the correct SELinux label is applied
when the file is created. The TC looks for appropriate policy rules
and file context patterns.
The TC covers bz#2359851, bz#2361423 and their duplicates.
A regular exim + selinux-policy testing performed on Testing Farm
machines revealed that SELinux prevents the exim processes from
searching the /proc/sys/net/ipv6/conf/all/disable_ipv6 file. The
TC reproduces the situation on TF machines.
In order to avoid unnecessary SELinux denials, I believe that
SELinux policy should allow this access. The TC looks for appropriate
policy rules and file context patterns.
The TC covers RHEL-94268.
Even though the tests require various selinux-policy-* packages,
some of packages may not be available on all platforms and
architectures. It can also happen that SELinux policy store is
installed in an unusual location. The tests should cope with both
situations.
We need to ensure that at least one cap2_userns permission has test
coverage to check a formal box somewhere. Apply an upstream patch series
that adds this coverage.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
A recently filed customer case revealed that SELinux prevents
dbus-broker processes (executed by GDM or gnome-shell) from
communicating to switcheroo-control processes. The TC reproduces
the situation.
In order to support various GNOME features, I believe that SELinux
policy should allow this action. The TC looks for appropriate
policy rules and file context patterns.
The TC covers RHEL-93335 and RHEL-93535.
Proper list of dependecies is necessary as not all distros
have every package preinstalled, for example on RHIVOS
we didn't have e2fsprogs in the system, while on more general use systems
it is included almost always, which is why it wasn't causing problems before
Recent selinux-policy + samba testing revealed that SELinux prevents
the samba-bgqd process from sending data into UNIX datagram sockets
located in the /var/lib/samba/private/msg.sock/ directory. The TC
reproduces the situation on ppc64le machines.
In order to support the intentional samba-bgqd behavior, I believe
that SELinux policy should allow this action. The TC looks for
appropriate policy rules and file context patterns.
The TC covers RHEL-93731.
Recently, a SSSD enabled machine which also runs the tuned-ppd service
revealed that SELinux prevents the tuned-ppd process from writing to
the /var/lib/sss/pipes/nss socket and then connecting to the sssd
process. The TC does not reproduce the situation.
In order to support the communication between tuned-ppd and SSSD
(tuned-ppd <-> nsswitch <-> SSSD), I believe that SELinux policy
should allow the actions. The TC looks for appropriate policy rules
and file context patterns.
The TC covers BZ#2367076.
In specific conditions, it was not possible to override default file
context using `semanage fcontext`. The test imitates the right condition
and checks whether it works as expected.
Related: https://bugzilla.redhat.com/show_bug.cgi?id=2360183
Not all tested services are available for all architectures. Some
tests fail when they try to start/stop service which is not present.
Let's make the tests more robust.
Scriptlets of the setroubleshoot package now run the auditctl program
directly instead of running the /sbin/service command which belongs
to the initscripts-service package. The TC checks if the dependency
was removed.
The TC covers BZ#2365614 and RHEL-90842.
The selinux-policy/deny-rules test suite failed during recent test runs
on Fedora-rawhide. The cause of failure seems to be missing deny rules
compatible to recent rawhide release. Fix the test code and address the
failures.
Signed-off-by: Amith Kumar <apeetham@redhat.com>
Enable test execution with different SELINXTYPE than 'targeted',
otherwise the test ends with failure due to hardcoded 'targeted' policy
and expected pki_tomcat_etc_rw_t type might not be present at current
policy
A customer case revealed that not all commands mentioned in the
RHEL-76352 bug were resolved in the selinux-policy component. The
TC executes the missed ones.
In order to support the journalctl ability to access virtual machines,
I believe that SELinux policy should allow the dbus-broker processes
to read the /var/lib/machine/<virtual-machine> directories. The TC
looks for appropriate policy rules and file context patterns.
The TC covers RHEL-85379 and RHEL-86528.
When the SELinux beaker library is imported, the auditd configuration
is modified and the auditd service is restarted. The audit-rules package
is necessary for success of the operation, because it brings the
auditctl command.
The selinux-policy/systemd-homed test suite failed during recent test
run on Fedora-rawhide. Root cause of failure appears to be changed
behavior of command "homectl passwd". Fix the test code to address the
failures. Couple of other ERRORs are due to import failure of
selinux-policy/common library which is out-of-scope of this fix.
Signed-off-by: Amith Kumar <apeetham@redhat.com>
Recent tuned-ppd + gdm + selinux-policy testing revealed that SELinux
prevents the D-bus communication between gdm and tuned-ppd. The TC
reproduces the situation which is accompanied by the following record
in the systemd journal:
test-vm dbus-broker[...]: A security policy denied :1.54 to send method call
/org/freedesktop/UPower/PowerProfiles:org.freedesktop.DBus.Properties.GetAll to :1.43.
In order to enable the bi-directional communication, I believe that
SELinux policy should allow sending D-bus messages between these
2 domains. The TC looks for appropriate policy rules and file context
patterns.
The TC covers RHEL-85849.
Recent pcscd + selinux-policy testing revealed SELinux denials which
are caused by the NoNewPrivileges=yes option present in the following
file:
* /usr/lib/systemd/system/pcscd.service
The SELinux denials are also accompanied by the following errors in
the systemd journal:
pcscd[...]: 00000000 ../src/pcscdaemon.c:704:main() cannot create /run/pcscd/pcscd.pid: Permission denied
pcscd[...]: 61013391 ../src/pcscdaemon.c:843:clean_temp_files() Cannot remove /run/pcscd/pcscd.pid: No such file or directory
In order to support the intentional changes and avoid these SELinux
denials, I believe that SELinux policy should allow the nnp_transition
for the pcscd_t domain. The TC looks for appropriate policy rules.
The TC covers BZ#2355930, BZ#2356058 and BZ#2357154.
Apply the failinfedora tag to the tests which fail on Fedora rawhide.
Add a special test plan for regular runs of these failing tests.
Make sure that the no-tier test plan contains tests which succeed on
Fedora rawhide.
Recent selinux-policy + pcm testing on machines with multiple CPUs
revealed that SELinux prevents the pcm-sensor-server process from
doing various operation. The TC reproduces that situation on the
right HW.
In order to support the expected functions of pcm-sensor-server,
I believe that SELinux policy should allow these actions. The TC
looks for appropriate policy rules and file context patterns.
The TC covers RHEL-80452.
Recent system roles testing revealed that SELinux prevents various
systemd generators from sending any data into /run/systemd/journal/socket.
The TC does not reproduce the situation.
In order to enable the use case in which systemd-journald is replaced
by rsyslog, I believe that SELinux policy should allow these actions.
The TC looks for appropriate policy rules and file context patterns.
The TC covers RHEL-75879.
Testing of various virtualization scenarios revealed that SELinux
prevents the virtqemud processes from writing into following files:
* /sys/bus/pci/devices/0000:00:05.0/driver_override
* /sys/class/net/virbr0/brif/vnet5/learning
The TC reproduces these situations.
In order to support the use cases described in the following bugs,
I believe that SELinux policy should allow the write actions. The
TC looks for appropriate policy rules and file context patterns.
The TC covers RHEL-65266 and RHEL-65385.
Recent selinux-policy + chrony testing revealed that SELinux prevents
communication between chronyc and the restricted chronyd service. The
TC reproduces the situation.
In order to enable this use case, I believe that SELinux policy
should allow the communcation in both directions. The TC looks
for appropriate policy rules.
The TC covers RHEL-82299 and RHEL-82308.
https://github.com/fedora-selinux/selinux-policy-macros has not been
touched for years and it will obsoleted soon.
With this update:
- add runtest.sh from fedora-selinux/selinux-policy-macros as this
repository and rename it to selinux-policy-macros.runtest.sh
- update selinux-policy-macros.runtest.sh to use MACRO_FILE env variable
if exists
- update runtest.sh to export MACRO_FILE variable so that both tests use
the same file
- use ssh_sysadm_login instead of zabbix_... boolean as zabbix is in
EPEL in RHEL like repositories
In CentOS Stream 10 some modules were moved from selinux-policy to
selinux-policy-epel which is available only in EPEL. It caused problem
with non-existing booleans and their aliases. With this change, an alias
is not checked when a new boolean does not exist.
Fixes:
Error getting active value for puppet_manage_all_files
[ PASS ] :: Command 'getsebool puppet_manage_all_files 2>&1 | tee /tmp/tmp.nx2NlWq1zd' (Expected 0, got 0)
[ BEGIN ] :: Running 'getsebool puppetagent_manage_all_files 2>&1 | tee -a /tmp/tmp.nx2NlWq1zd'
Error getting active value for puppetagent_manage_all_files
[ PASS ] :: Command 'getsebool puppetagent_manage_all_files 2>&1 | tee -a /tmp/tmp.nx2NlWq1zd' (Expected 0, got 0)
[ BEGIN ] :: Running 'uniq -c /tmp/tmp.nx2NlWq1zd | grep '2 ''
[ FAIL ] :: Command 'uniq -c /tmp/tmp.nx2NlWq1zd | grep '2 '' (Expected 0, got 1)
The modified tests used to fail on RHEL-10 or they caused other tests
to fail on RHEL-10. The reasons are various:
* dependency on SELinux types which are no longer defined
* insufficient test cleanup
* unexpected exit codes
* virtual vs. bare metal environment differences
These problems should be fixed now.
The modified tests were failing because:
* the running restorecond service causes problems to the subsequent tests
* an irrelevant bug was tested
* the bind component is available in multiple versions
* rpm output contained unnecessary whitespaces
These issues should be fixed now.
There are 2 tests which require conflicting packages. To run them
successfully, the conflicting packages need to installed/removed in
the right order.
2 additional tests got fixed too.
There are booth commands which may stall the automated test execution.
Let's run them with a 20 second deadline.
There are other tests which need more time to finish when executed
on slower machines. Their duration got extended.
Recent bootupd + bootupctl testing revealed that SELinux prevents
the bootupd processes from the following actions:
* removal of the /boot/bootupd-state.json file
* execution of findmnt, mount, udevadm, grub2-install, lsblk commands
* automatic transition into their SELinux domains
The TC reproduces the situation on EFI configured machines.
In order to support the adopt-and-update feature, I believe that
SELinux policy should allow these actions. The TC looks for
appropriate policy rules and file context patterns.
The TC covers RHEL-66584 and RHEL-70849.
Recent ktls-utils + NVME testing revealed that SELinux prevents
the tlshd processes from doing the following activities:
* reading the /etc/resolv.conf file
* creating and managing a UDP socket
* searching the /etc/pki/tls/certs directory
* reading the certificate files under /etc/pki/tls/certs/
* reading the /proc/sys/net/ipv6/conf/all/disable_ipv6 file
* searching the /proc/sys/net/ipv6 directory
* creating and managing a netlink route socket
The TC does not reproduce the situation. There is a dedicated
automated test for this purpose.
In order to enable the expected tlshd functionality, I believe that
SELinux policy should allow these actions. The TC looks for appropriate
policy rules and file context patterns.
The TC covers RHEL-74424.
Recent virtualization CI test runs discovered SELinux denials when
the virt-admin tool tries to connect to the virtqemud process. The
TC reproduces the situation via systemd-run.
In order to support the following scenario, I believe that SELinux
policy should allow the necessary operations:
* the virt-admin program is running as unconfined_service_t because
it was executed by a process running as unconfined_service_t and the
virt-admin process wants to talk to the virtqemud process
The TC looks for appropriate policy rules and file context patterns.
The TC covers RHEL-77620.
Recent virtualization + CD/DVD + selinux-policy testing revealed
that SELinux prevents the rpc-virtqemud processes from accessing
SCSI devices on the host. The TC reproduces the situation.
In order to enable this use case, I believe that SELinux policy
should allow the access. The TC looks for appropriate policy rules
and file context patterns.
The TC covers RHEL-76104.
Recent systemd-machined + selinux-policy testing revealed that SELinux
prevents the machinectl command (consequently the systemd-machined
process) from stopping, rebooting or powering off the VMs. The TC
reproduces the situation.
In order to support this documented functionality, I believe that
SELinux policy should allow these actions. The TC looks for appropriate
policy rules and file context patterns.
The TC covers RHEL-76352, RHEL-77087 and their duplicates.
With Unify_bin_and_sbin [1] in progres, majority of commands have
already been moved from /usr/sbin to /usr/bin in Fedora 42 and newer,
therefore the strings check in /usr/lib/systemd/systemd-sulogin-shell
should rather use bin/sulogin.
This commit fixes the following test failure:
[ FAIL ] :: Command 'strings /usr/lib/systemd/systemd-sulogin-shell | grep /sbin/sulogin' (Expected 0, got 1)
[1] https://fedoraproject.org/wiki/Changes/Unify_bin_and_sbin
Sooner or later, the tuned-ppd service will be confined by SELinux
policy and this automated test should find out if basic functions
of the program/service are affected or not.
The TC covers RHEL-69450 and RHEL-69526.
Several automated tests fail during gating because of:
* known test code issues
* too short duration
* additional SELinux policy changes
The identified problems should be fixed now.
'dnf download' does not download rpm files if joined with --installroot option.
Fixes:
[ BEGIN ] :: Running 'dnf download --installroot=/tmp/tmp.Bw3ejLevcz/lower rpm-plugin-selinux selinux-policy selinux-policy-targeted '
Updating Subscription Management repositories.
Unable to read consumer identity
This system is not registered with an entitlement server. You can use subscription-manager to register.
No package rpm-plugin-selinux available.
Exiting due to strict setting.
Error: No package rpm-plugin-selinux available.
[ FAIL ] :: Command 'dnf download --installroot=/tmp/tmp.Bw3ejLevcz/lower rpm-plugin-selinux selinux-policy selinux-policy-targeted ' (Expected 0, got 1)
SELinux denials recently found on Beaker machines revealed that
SELinux prevents the systemd-ssh-generator processes from reading
the /dev/vsock device. The TC reproduces the situation.
In order to enable the ssh-generator which belongs to new systemd
builds, I believe that SELinux policy should allow the access. The
TC looks for appropriate policy rules and file context patterns.
The TC covers RHEL-72549.
Recent selinux-policy + boothd + systemd-machined testing revealed
that SELinux prevents the boothd process from connecting to the
systemd-machined process via the /run/systemd/userdb/io.systemd.Machine
socket. The TC reproduces the situation.
In order to support the boothd and systemd-machined cooperation and
to avoid unnecessary SELinux denials, I believe that SELinux policy
should allow the access. The TC looks for appropriate policy rules
and file context patterns.
The TC covers RHEL-75471.
Recent virtualization + SELinux policy testing revealed that SELinux
prevents the virtqemud process from accessing the USB devices which
are attached to VMs. The TC reproduces the situation.
In order to support this use case and to avoid unnecessary SELinux
denials, I believe that SELinux policy should allow the access. The
TC looks for appropriate policy rules and file context patterns.
The TC covers RHEL-74230.
A recent cockpit-machines testing in SELinux enabled environments
revealed that SELinux prevents certain confined users from
communicating to the libvirt-dbus service. The TC reproduces the
situation for users derived from sysadm_u and staff_u.
In order to support the scenario, I believe that SELinux policy
should allow the D-bus communication in both directions. The TC
looks for appropriate policy rules and file context patterns.
The TC covers RHEL-73914.
Recent systemd-machined + selinux-policy testing revealed that
SELinux prevents the systemd-machined processes from accessing
the /dev/vsock device. The TC reproduces the situation.
In order to support the expected systemd-machined functionality,
I believe that SELinux policy should allow this access. The TC
looks for appropriate policy rules and file context patterns.
The TC covers RHEL-74280.
A recent podman + selinux-policy testing revealed too many
"Operation not supported" messages in a scenario which tries
to install selinux-policy packages inside a container. The TC
reproduces the situation.
In order to fix the problem, changes were made in both components:
libsemanage and selinux-policy. Purpose of the TC is to find out
if such error messages still appear or not.
The TC covers RHEL-70632.
Several automated tests had to be updated to reflect the latest
findings (new bugs, new rules because of denials) from testing on
various machines.
These tests also need to work in environments where the tested
services or their policies are not yet present. Test phases
relevancy is important.
1 test was failing because of a test code issue.
1 test was missing an important test phase.
The number of tests which are missing their nitrate metadata
should be again smaller.
Recent cups + samba + selinux-policy testing revealed SELinux
denials which appear when a samba-bgqd process communicates
with the cupsd process via the /run/cups/cups.sock file. The
TC reproduces the situation.
In order to support the use case and avoid these SELinux denials,
I believe that SELinux policy should allow the necessary actions.
The TC looks for appropriate policy rules and file context patterns.
The TC covers RHEL-72860 and RHEL-72861.
Recent gdm + iio-sensor-proxy + selinux-policy testing revealed that
SELinux prevents the D-bus communication between the gdm service
and the iio-sensor-proxy service. The TC reproduces the situation.
In order to support their intentional collaboration (for example:
net.hadess.SensorProxy.ClaimAccelerometer), I believe that SELinux
policy should allow the D-bus communication in both directions. The
TC looks for appropriate policy rules.
The TC covers RHEL-70850.
A recent virt* and selinux-policy testing revealed that rpc-virtqemud
process triggers SELinux denial as a reaction to the "virsh vcpuinfo"
command. The TC reproduces the situation.
In order to provide the detailed domain vcpu information successfully,
I believe that SELinux policy should allow this action. The TC looks
for appropriate policy rules.
The TC covers RHEL-69920.
It tests wrong behavior which is fixed in the latest libsemanage and
in order not to break test runs on older systems lets drop it.
Fixes:
semanage_handle_create(): 0x4f782c0
semanage_disconnect(0x4f782c0): 0
semanage_connect(0x4f782c0): 0
semanage_handle_destroy(0x4f782c0)
[ FAIL ] :: Command './test_connect handle reversed' (Expected 134, got 0)
Current decision on RHEL-47401 is not to fix it. In order to avoid
unnecessary failures (or waiving), the test scenario will not be
tested on RHEL-9 and CentOs stream 9 machines.
Recent selinux-policy + cups + samba-bgqd testing revealed SELinux
denials which are triggered when the samba-bgqd service is started
on a machine where cups* packages are installed. The TC reproduces
the situation.
In order to support the intended samba-bgqd functionality, I believe
that SELinux policy should allow these actions. The TC looks for
appropriate policy rules and file context patterns.
The TC covers RHEL-69512 and RHEL-69517.
test if memory device can be attached to a VM
TBA later
The TC covers RHEL-65038.
test if VM can start with multiqueue virtio interface
TBA later
The TC covers RHEL-65373.
test if VM can start with an isolated port
TBA later
The TC covers RHEL-65383.
test if VM with NUMA setting can start
TBA later
The TC covers RHEL-65789.
test if nbdkit enabled VM can start
TBA later
The TC covers RHEL-56029 and RHEL-69118.
The AVC subtest can be disabled, because all modified tests look for
SELinux denials directly.
At least 1 of the modified tests had an incorrect or incomplete list of
package requirements.
At least 1 of the modified tests had an incorrect relevancy.
A recent samba + selinux-policy testing revealed that SELinux
prevents the rpcclient command from enumerating printers. The
TC reproduces the situation.
A follow-up testing revealed that the samba-bgqd service, which
plays an important role in this scenario, is not confined by
SELinux.
In order to support the expected rpcclient + samba-bgqd functionality,
I believe that SELinux policy should allow the necessary actions.
The TC looks for policy rules and file context patterns which
reflect the fact that the samba-bgqd program is now confined
by SELinux.
The TC covers RHEL-53124 and RHEL-64908.
Some tests failed when executed on CentOS-stream machines because of
insufficient code conditions. From now on, this problem should not
happen anymore.
Sooner or later, the gnome-remote-desktop service will be confined
by SELinux policy and this automated test should find out if basic
functions of the program/service are affected or not.
The TC covers RHEL-35877.
During the development of the automated test, a new SELinux denial
was identified and reported. The reproducer is already part of this
test.
In order to support various functions of the grdctl program, I believe
that SELinux policy should allow the gnome-remote-desktop-daemon
processes to watch (syscall = inotify_add_watch) the
/etc/gnome-remote-desktop directory. The TC looks for appropriate
policy rules and file context patterns.
The TC covers BZ#2321236.
Recently, debugging of unrelated systemd issue revealed that SELinux
prevents a successful execution of systemd-run inside systemd-run
session. The TC reproduces the situation.
In order to support the above-mentioned scenario, I believe that
SELinux policy should allow the dbus-broker to read/write from/to
UNIX stream socket owned by the systemd session. The TC looks for
appropriate policy rules.
The TC covers RHEL-61928 and RHEL-62185.
Sooner or later, the tlshd service will be confined by SELinux
policy and this automated test should find out if basic functions
of the program/service are affected or not.
The TC covers RHEL-29439 and RHEL-42672.
In Fedora 41+, the timemaster_t type is available only when the
linuxptp-selinux package is installed. It is pulled in by linuxptp if
linuxptp-selinux exists, so linuxptp is a safe requirement working
for older releases, too.
Sooner or later, the pcm-sensor-server will be confined by SELinux
policy and this automated test should find out if basic functions
of the pcm-sensor-server program/service are affected or not.
The TC covers RHEL-52838.
Recently created tests were missing FMF ids and Nitrate ids.
Newly created SELinux types are slightly different from what I expected.
Both issues are solved now.
The test phase covers both BZ#2270895 and RHEL-60837 because they
the same. The test phase should not be executed in environments
where the following SELinux type is not defined:
* secretmem_t
Sooner or later, the power-profiles-daemon will be confined by SELinux
policy and this automated test should find out if basic functions
of the power-profiles-daemon program/service are affected or not.
The TC covers RHEL-61117.
Sooner or later, the switcheroo-control will be confined by SELinux
policy and this automated test should find out if basic functions
of the switcheroo-control program/service are affected or not.
The TC covers RHEL-24268.
Recently, the systemd-mountfsd program/service got confined by SELinux.
Purpose of this automated test is to cover the basic scenarios in
which the daemon is used. The systemd-mountfsd man page was used as
the source of test scenarios/ideas.
Sooner or later, the iio-sensor-proxy will be confined by SELinux
policy and this automated test should find out if basic functions
of the iio-sensor-proxy program/service are affected or not.
The TC covers RHEL-17346.
Several recent BZ reports revealed that SELinux prevents the
systemd-homed processes from reading the /var/cache/systemd/home/
directory. The TC reproduces the situation.
In order to support the expected systemd-homed functionality, I believe
that SELinux policy should allow the action. The TC looks for
appropriate policy rules and file context patterns.
The TC covers BZ#2036108 and its duplicates.
A recent cockpit CI + selinux-policy + FIPS testing revealed that
SELinux prevents the systemd-modules-load processes from reading
files stored in the /run/modprobe.d/ directory. The TC reproduces
the situation.
In order to support the documented locations for modprobe config
files, I believe that SELinux policy should allow the action. The
TC looks for appropriate policy rules and file context patterns.
The TC covers RHEL-54591.
A recent systemd + selinux-policy testing revealed that SELinux
prevents the systemd-journal-upload processes from reading the
the /run/systemd/journal-upload.conf.d/ directory. The TC reproduces
the situation.
In order to support the documented locations where systemd-journal-upload
configurations can be located, I believe that SELinux policy should
allow this action. The TC looks for appropriate policy rules and
file context patterns.
The TC covers RHEL-57774.
A recent testing of a documented hostapd + freeradius use case
revealed that SELinux prevents the hostapd processes from writing
to a control socket located in /tmp. The TC reproduces the situation.
In order to support the documented use case, I believe that SELinux
policy should allow the action. The TC looks for appropriate policy
rules and file context patterns.
The TC covers RHEL-59683.
A recent booth + selinux-policy testing revealed that SELinux
prevents the boothd processes from reading the /run/systemd/userdb/
directory and connecting through the io.systemd.DynamicUser socket
stored in it. The TC reproduces the situation.
In order to support the intended boothd functionality, I believe that
SELinux policy should allow these actions. The TC looks for appropriate
policy rules and file context patterns.
The TC covers RHEL-57104 and RHEL-58060.
A recently filed issue revealed that SELinux prevents the
systemd-sysctl from reading the files stored under the /run/sysctl.d/
directory. The TC reproduces the situation.
In order to support this documented sysctl specific location,
I believe that SELinux policy should allow the action. The TC
looks for SELinux denials that may appear when reproducing the
scenario.
The TC covers RHEL-56988 and RHEL-58380.
Because the ISC dhcp is no longer maintained by upstream, the dhcpcd
package is used as a replacement. Unfortunately, SELinux prevents
a new dhcpcd instance from communicating to and terminating the old one.
The TC does not reproduce the situation.
In order to support the intented dhcpcd functionality, I believe that
SELinux policy should allow these actions. The TC looks for appropriate
policy rules and file context patterns.
The TC covers RHEL-33081 and RHEL-43417.
Recently, the automated test started failing because the following
file was not present: /etc/firewalld/lockdown-whitelist.xml.
From now on, the test should not fail because of this.
When kernel-uk-virt is installed, the rpm query returns more than one
result, leading to (non-fatal) errors in the Setup phase. Query for the
kernel image path instead to avoid this.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Recently, the boothd program got confined by SELinux. Purpose of
this automated test is to find out if basic scenarios work as
expected under the current SELinux policy.
The TC covers RHEL-45907.
Fedora ELN / RHEL-10 has disabled CONFIG_NET_KEY, so apply a patch that
allows the testsuite to succeed by skipping the key_socket test when it
is not supported.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Commit ab42eb93 added the change to another test by mistake.
Fixes:
# cd libselinux/setfiles-in-chroot-env
# 1minutetip 1MT-CentOS-Stream-9
# ./runtest.sh
yum -y install filesystem libselinux libselinux-utils python3-libselinux policycoreutils --installroot=/tmp/tmp.WhKcf2BrOe --skip-broken'
Unable to detect release version (use '--releasever' to specify release version)
Error: Failed to download metadata for repo 'epel': Cannot prepare internal mirrorlist: Status code: 404
[ FAIL ]
Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
A recent cups + selinux-policy testing revealed that SELinux prevents
the cups-browsed processes from accessing the /root/.cups/lpoptions
file. The TC reproduces the situation.
In order to support the cups-browsed ability to access the lpoptions
file, I believe that SELinux policy should allow the access. Either
file context patterns need to change or an appropriate policy rule
need to be added. The TC looks for these changes.
The TC covers RHEL-47401.
Recent changes (BPF code that is involved in the queue_track
backend) in the stalld component trigger SELinux denials because
SELinux policy does not expect such a behavior. The TC reproduces
the situation.
In order to support this new feature, I believe that SELinux policy
should allow the necessary actions. The TC looks for appropriate
policy rules and file context patterns.
The TC covers RHEL-50356.
Instead of checking Fedora or CentOS or RHEL version, the decision
to adapt should be made according to the defined SELinux policy types
or attributes.
The TC also covers RHEL-40834.
If required packages are not installed, the tests will try to install
them (only 1 attempt per test will be done).
Certain test phases may not be relevant if:
* required SELinux types/attributes are not defined
* required programs/files are not installed
* required packages are not available
Recent cockpit + systemd + selinux-policy testing revealed that
SELinux prevents the systemd-machined process (started by the
machinectl command) from doing the following actions:
* creating the /run/systemd/machine directory
* creating the /run/systemd/machine/io.systemd.Machine socket
* unlinking the /run/systemd/machine/io.systemd.Machine socket
The TC reproduces the situation.
In order to support the basic machinectl functions, I believe that
SELinux policy allow these actions. The TC looks for appropriate
policy rules and file context patterns.
The TC covers RHEL-49567.
A recent cockpit + selinux-policy testing revealed that SELinux
prevents libvirt-dbus processes from connecting to virtqemud
processes. The TC reproduces the situation.
The libvirt-dbus service is confined by SELinux now. The TC covers
basic scenarios in which the service is used. The TC looks for
appropriate policy rules and file context patterns.
The TC covers RHEL-46893.
Package installations via yum can fail for many reasons. For example:
* unsatisfied package dependencies
* repository availability problems
* unrecognized command line options
Hopefully, this change helps the yum command to run successfully
when such issues occur.
Make sure the upstream and downstream version of the rlSETranslateBoolean
function is the same. Otherwise, differences can cause problems
when running tests which use the function.
A recent anaconda testing on Fedora rawhide machines revealed a
regression in the libselinux code which leads to segfaults. The TC
reproduces the situation.
The TC uses 2 reproducers (python code, binary command) to find out
if the problem is present or not. Both of them should pass when the
problem is fixed.
The TC covers BZ#2295428 and RHEL-46558.
A recently filed Jira issue revealed that SELinux prevents staff_u
users from executing the systemd-tmpfiles program (via the following
service: /usr/lib/systemd/user/systemd-tmpfiles-setup.service).
The TC reproduces the situation.
In order to support the systemd-tmpfiles-setup.service functions
for confined users, I believe that SELinux policy should allow
the access described above. The TC looks for appropriate policy
rules and file context patterns.
The TC covers RHEL-40374 and RHEL-44191.
Recently, the systemd-nsresourced program became confined by SELinux.
Purpose of this TC is to test the basic systemd-nsresourced scenarios.
The TC looks for appropriate policy rules and file context patterns.
The TC covers BZ#2290477.
Change context check from "${PREFIX}/var/run/named" to
"${PREFIX}/run/named" which matches the actual filesystem state
created and used by the bind-chroot service.
The bootupd package is built for the following architectures:
* aarch64
* ppc64le
* s390x
* x86_64
The automated TC should be executed on these architectures too.
A recently filed bug report revealed that SELinux prevents the
virt-admin command from connecting to various virtualization sub-daemons
using the admin connection. The TC reproduces the situation.
In order to support this virt-admin feature, I believe that SELinux
policy should allow the access. The TC looks for appropriate policy
rules.
The TC covers BZ#2291273.
Do it the same way as in commit 3e8824e0aa ("kernel/selinux-testsuite:
fix kernel pkg name detection").
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
The detection of this flag is broken with DNF5, because it now only
appears under `dnf install --help`. Also, DNF5 now implements the logic
we want (skipping packages that are not available, rather than "broken")
under a new --skip-unavailable flag.
Therefore, detect both using `dnf install --help` and also check for
--skip-unavailable first.
Without this fix the tests try to install each package one by one with
DNF5, which is suboptimal.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Tests which depend on EPEL packages should be tagged properly.
Such tests should not be executed in environments where the EPEL
repository is not available.
A recent bootupd + selinux-policy testing revealed that SELinux
prevents the bootupd daemon from getattr/search-ing (syscall=statx)
the /sys/firmware/efi/efivars directory. The TC reproduces the
situation on machines equipped by EFI system partition.
In order to support the bootupd functions on EFI machines, I believe
that SELinux policy should allow this access. The TC looks for
appropriate policy rules and file context patterns.
The TC covers RHEL-36289.
The /policycoreutils/setfiles_binary test: the --downloaddir option
is not recognized by the latest version of DNF. The option is removed
now.
The /other/update-packages test: the --skip-broken option is not
recognized by the latest version of DNF. The option is removed now.
The /selinux-policy/install-uninstall-dsp-packages test: let's not
run this test together with other tests, because it often finds
a problem that brakes the environment for the following tests.
Main purpose of the automated test is to find out if the apol tool
can read and analyze the SELinux policies currently installed on
the system.
Because the apol tool is a graphical one, a working X session is
needed to conduct the testing procedure.
Removing selinux-policy-targeted is actually not caused by particular
packages, but it is rather an effect of current usage of conditional
dependencies in DSP packages:
Requires: (%{name}-selinux if selinux-policy-%{selinuxtype})
which can lead to uninstallation of selinux-policy-targeted when both
selinux-policy-targeted and selinux-policy-mls are installed.
Several bug reports pointed out that the installation, reinstallation
or upgrade of the selinux-policy-devel package produces the following
error message:
Illegal character '"'
Further investigation revealed that there are unexpected/redundant
parentheses in the /usr/share/selinux/devel/include/contrib/virt.if
file, which also cause the following error messages when the
sepolgen-ifgen command is executed:
Missing interface definition for virt_pid_filetrans
Missing interface definition for virt_systemctl
The TC is able to reproduces the problem when executed on a not yet
fixed package. The TC passes when the problem is fixed.
The TC covers BZ#2254169, BZ#2254206, BZ#2277925.
A recent SELinux policy + logwatch testing revealed that SELinux
prevents the sendmail process (executed by the logwatch timer) from
searching the /proc/sys/net/ipv6/conf/all/ directory and finding
the disable_ipv6 file. The TC reproduces the situation on machines
with special IPv6 configuration.
In order to avoid unnecessary SELinux denials being triggered during
the situation, I believe that SELinux policy should allow the access.
The TC looks for appropriate rules and file context patterns.
The TC covers BZ#2183432 and RHEL-34135.
Automated tests which break the machines where they run should not
be executed via tier plans. Test results coming from broken machines
have little value to reviewers.
When NetLabel is configured to send unlabeled traffic, it should fully
remove CIPSO options from the IP packets. This test verifies that they
are indeed removed (and not just replaced with IPOPT_NOP or IPOPT_END).
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
A lot of recently filed BZs revealed and confirmed that SELinux
prevents the abrt-dump-journal-core processes from:
* writing to /run/systemd/userdb/io.systemd.* sockets
* connecting to various UNIX streams owned by systemd* processes
The TC reproduces the situation.
In order to support the expected ABRT functions, I believe that
SELinux policy should allow above-mentioned actions. The TC looks
for appropriate SELinux policy rules and file context patterns.
The TC covers BZ#2274709 and other duplicates.
Some components/packages are not available on CentOS-stream-10,
which leads to conclusion not to run the affected tests/phases there.
The /var and /run directories very often contain mislabeled files
and directories. In order to find discrepancies between file context
patterns and type_transition rules defined in the SELinux policy,
the restorecon command is needed.
The cups-browsed service does not start with the default configuration.
In order to perform a basic SELinux testing, the cups-browsed
configuration needs to be modified (for example: BrowsePoll).
The rlImport command fails in many tests because the epel-release
package is not available for RHEL-10 or CentOS-stream-10 yet.
As a workaround, an additional exit code 1 is accepted now.
A recently filed Fedora bug revealed that SELinux prevents the
stress-ng processes from creating anon_inode objects via the
memfd_secret syscall. The TC reproduces the situation.
In order to support the expected stress-ng functonality, I believe
that SELinux policy should allow the action. The TC looks for
appropriate policy rules.
The TC covers BZ#2270895.
I wrote certain io_uring checks incorrectly, because I misunderstood
the comments in the RHEL-11792 ticket. They should be correct now.
In order to properly test the io_uring feature, the feature needs to
be enabled (it is by default on Fedora). If the kernel command line
does not contain the "io_uring" string, the automated test adds the
necessary options and reboots the machine.
A recent selinux-policy + logwatch testing revealed that SELinux
prevents the uptime process (executed by the logwatch service)
from reading the /run/systemd/sessions/ directory. The TC reproduces
the situation.
In order to avoid unnecessary SELinux denials, I believe that SELinux
policy should allow this access. The TC looks for appropriate policy
rules and file context patterns.
The TC covers BZ#2270484.
A recently filed Fedora bug revealed that SELinux prevents the
sulogin processes from using:
* the fsetxattr syscall (relabelfrom+relabelto) on /dev/tty*
* the ioctl syscall (checkpoint_restore capability)
The TC reproduces the situation.
Because the relabel* permissions seem to be necessary for a successful
run of the sulogin command, SELinux policy should allow them.
On the other hand, the checkpoint_restore capability does not seem
to be necessary, which means that SELinux policy should dontaudit it.
The TC covers BZ#2265391.
A recent dhcpcd + selinux-policy testing revealed that SELinux
prevents the dhcpcd processes from reading the /run/netns directory
when it exists. The TC reproduces the situation.
In order to support the expected dhcpcd functionality, I believe
that SELinux policy should allow the access. The TC looks for
appropriate policy rules and file context patterns.
The TC covers BZ#2269708 and BZ#2270733.
Recent testing revealed that SELinux prevents the plymouthd processes
from accessing the /dev/kmsg device. The TC reproduces the situation.
In order to support the expected plymouthd functionality, I believe
that SELinux policy should allow the access. The TC looks for
appropriate policy rules and file context patterns.
The TC covers BZ#2256442.
Metadata of certain tests became outdated. Purpose of this change is:
* include the rest of components into main.fmf
* remove the failinfedora tag from tests which pass on Fedora
* add the failinfedora tag to tests which fail on Fedora or
which should not be executed
Particular changes:
- install also DSP packages which do not distribute its custom SELinux
module in a subpackage with the "-selinux" suffix (Fedora only)
- use rlLogWarning to display warnings
- list /var/run entries not having an equivalent rule in /run
- make use of the DEBUG variable to keep output files
with various data after the test finishes:
-- list files in /run which have incorrect context
-- list installed packages
-- list SELinux modules, permissive and unconfined domains
-- check if dbus communication is defined bidirectionally
I can't believe I got it wrong AGAIN... I missed the ! operator.... Now
it should be correct, as was finally able to test it.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
The version comparison is wrong. Fix it.
Fixes: 485e8279b7 ("kernel/selinux-testsuite: remove install_t references on RHEL6")
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
SELinux userspace 3.6 recognizes new keywords: notself, other.
* https://github.com/SELinuxProject/selinux/releases/tag/3.6
Purpose of this automated test is to find out whether their
implementation matches the expected functionality.
The directory may also be owned by <name>-modules-core rather than
<name>-core in some cases. Use the "config" file as the reference
instead.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
A recently filed customer case revealed that SELinux prevents the
systemd-notify processes from sending data into UDP socket (to a
process waiting on the other side of /run/systemd/notify socket).
The TC reproduces the situation.
In order to support the expected functions of systemd services
(especially type=notify), I believe that SELinux policy should
allow the actions. The TC looks for appropriate policy rules and
file context patterns.
The TC covers RHEL-25514 and RHEL-25605.
The install_t workaround for rpm-ostree doesn't work on RHEL-6, so make
it conditional on /run/ostree-booted, so that it is only applied when
necessary.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
The semanage command from older policycoreutils versions (<= 3.6-1.el9)
behaves in a certain way when a duplicated port context pattern is added.
It does not add the pattern but produces the following message:
ValueError: Port <protocol>/<number> already defined
The semanage command from new policycoreutils versions (>= 3.6-2.el9)
behaves differently when a duplicated port context pattern is added.
It adds the pattern and produces the following message:
Port <protocol>/<number> already defined, modifying instead
Above-mentioned differences in behavior have some consequences for the
automated test when removing a duplicated port context pattern. If the
automated test should pass, it needs to anticipate both possibilities.
The test plan covers the following actions:
* update packages to the latest versions available
* reboot
* collect SELinux denials that appeared since reboot
Recently, openQA testing of new colord version (1.4.7-1) revealed
that SELinux prevents the colord process transition from init_t
to colord_t domain. The TC reproduces the situation.
In order to support the existing colord functionality together with
the newly added systemd unit option (NoNewPrivileges=true), I believe
that SELinux policy should allow the action. The TC looks for
appropriate policy rules and file context patterns.
The TC covers BZ#2259679.
A recently filed customer case revealed that SELinux prevents the
sysadm_u users from running the dmidecode command via sudo which
has the input/output logging enabled. The following error message
appears during the action:
sudo: unable to open /var: Permission denied
The TC reproduces the situation.
In order to support the above-mentioned configuration, I believe that
SELinux policy should allow the necessary actions. The TC looks for
appropriate policy rules and file context patterns.
The TC covers RHEL-16104.
The chrony component is frequently used by various users on Fedora
and RHEL, so it makes sense to run this TC in upstream testing too.
There are no changes in the TC functionality.
Moving the downstream TC to upstream repo.
The TC covers RHEL-18219.
A recent exim testing on RHEL-8 and RHEL-9 revealed that SELinux
prevents the exim processes from sending data into the abstract
socket: /var/spool/exim/exim_daemon_notify. The TC reproduces the
situation when executed in the right environment.
In order to support all the expected actions over the daemon
notifier socket, I believe that SELinux policy should allow the
sendto permission. The TC looks for appropriate policy rules and
file context patterns.
The TC covers RHEL-21902 and RHEL-21903.
Display some basic system information and list generators which are
confined and which are not, then run particular tests with some
adjustments for:
- systemd-network-generator
- systemd-fstab-generator
- systemd-rc-local-generator
- systemd-sysv-generator
- selinux-autorelabel-generator
and finally run again all generators with default settings as an effect
of "systemctl daemon-reload".
1) opensmtpd-and-similar test:
The opensmtpd service needs to be started before an email can be sent
via the mailx command. The original order led to the following error:
/root/dead.letter 17/564
s-nail: ... message not sent
2) deny-rules test:
The deny-rules test intentionally triggers SELinux denials. These
SELinux denials should not be reported as errors or warnings.
3) systemd-modules-load-and-similar test:
Not all kernel modules required by the RDMA services are available
on all machines. To avoid unnecessary failures, the test phase
devoted to bz#1942267 will be skipped on such machines.
The automated tests should be fixed now.
The lockdown SELinux class was removed from kernel and no check is now
performed in the SELinux lockdown hook as a comprehensive fix for all
the SELinux lockdown-class related problems class was rejected, so no
test checks using the lockdown class are now pertinent.
The lockdown-class checks are now not in any supported systems kernels.
Related: https://bugzilla.redhat.com/show_bug.cgi?id=2017848
The root user on a system is usually not confined by SELinux (context:
unconfined_u:unconfined_r:unconfined_t), but there are security
standarts which require the root user to be confined by SELinux
(context: sysadm_u:sysadm_r:sysadm_t).
In order to use this automated test on such systems, certain code
changes were necessary.
The sedispol tool recognizes several commands. Before the checkpolicy
version 3.6 was introduced, one of the commands was 'u' which displayed
unknown handling setting. With the new version, the 'u' command prints
SELinux users which are defined and the 'U' command displays the unknown
handling setting.
The version 3.6 of SELinux userspace brings a new policy feature
called deny rules. Purpose of this basic test is to find out if
the deny rules function as expected.
The automated test covers the following scenarios:
* file read prevention
* file execution prevention
* file removal prevention
* directory search prevention
* process ptrace prevention
* kernel module load prevention
A recent opensmtpd testing revealed that SELinux prevents the smtpd
process from creating and manipulating the /run/smtpd.pid file. The
TC reproduces the situation.
In order to successfully start and run the opensmtpd service, I believe
that SELinux policy should allow these actions. The TC looks for
appropriate policy rules.
The TC covers RHEL-15175.
A recent rebuild testing in COPR revealed that the setools package
cannot be built with the latest SELinux userspace (version 3.6).
The TC reproduces the situation.
In order to have a well-functioning set of tools for SELinux policy
analysis which works together with the new version of SELinux
userspace, I believe that the problem needs to be fixed.
The TC covers BZ#2251915 and RHEL-18067.
Since SELinux user-space 3.6 was introduced, the sedismod and sedispol
programs are able to perform various actions non-interactively when
the following options are supplied: -a, --actions. In previous versions,
these actions were only usable in the interactive mode.
From now on, the automated test also covers these options.
SELinux user-space version 3.6 introduced a new program called
getpolicyload. Unfortunately, there is no man page which would
describe the program.
Purpose of this automated test is to test the basic function of
the getpolicyload program that is obvious from its behavior.
Certain automated tests do not have Makefiles, which prevents them
from being executed by STI means. The situation leads to error messages
like this one:
FAIL test selinux/selinux-policy/... do not know how to run test
In order to successfully execute them, appropriate Makefiles will
be added.
A recent testing of the sepolgen-ifgen tool revealed that certain
policy interface definitions are not correct. The TC reproduces
the situation.
Even though the problem exists (unnoticed) for some time already,
I believe that we should ship valid and correctly defined policy
interfaces.
The TC covers RHEL-2616.
A recent dhcpcd testing revealed that SELinux denials appear when
the dhcpcd service (in default configuration) is started on RHEL-9.
The TC reproduces the situation.
In order to avoid such SELinux denials, I believe that SELinux policy
should either allow or dontaudit them. The TC looks for appropriate
policy rules.
The TC covers RHEL-15326.
A recent bug report revealed that the restorecond service (after its
start) mislabels files in the /usr/bin/ directory when its configuration
file (/etc/selinux/restorecond.conf) contains the following line:
/bin/*
Further investigation revealed that the problem is caused by the
selinux-policy component which does not define a file context
equivalency between /bin and /usr/bin (/bin is a symlink to /usr/bin).
The TC reproduces the situation and it also tests other symlinks which
are present in /. The restorecond service behaved correctly the whole
time.
The TC covers RHEL-5032.
A lot of reported BZs revealed that SELinux prevents the tlp processes
from searching (syscall = newfstatat) under the /var/lib/snapd directory
when the snapd package is installed. The TC reproduces the situation.
Based on the last comment in BZ#1888699, I believe that SELinux policy
should dontaudit the access. The TC looks for appropriate policy rules.
The TC covers BZ#2221019 and its duplicates.
Apparently, the first attempt to adjust the relevancy was not
complete. So here is another one.
Certain tests should not be executed on centos-stream 8 or 9 at all,
because packages required by those tests are not available there.
Certain tests need to reflect the fact that SELinux policies which
confine the tested programs are not present on all versions of RHEL,
CentOS or Fedora.
A recently filed BZ report revealed that SELinux prevents the ntpd
service (which belongs to the ntpsec package) from connecting to
the 4460/tcp port when it is configured to use the NTS servers. The
TC reproduces the situation.
In order to support the NTS standart for the ntpd service, I believe
that SELinux policy should allow the action. The TC looks for appropriate
policy rules, port context and file context patterns.
The TC covers BZ#2246805 and RHEL-15085.
A recent opensmtpd testing revealed that SELinux prevents the smtpctl
processes from connecting to the /run/smtpd.sock socket. The TC
reproduces the situation.
In order to support the basic function of sending emails via opensmtpd
means, I believe that SELinux policy should allow the above-mentioned
action. The TC looks for appropriate policy rules and file context
patterns.
The TC covers BZ#2246115.
Certain tests should not be executed on centos-stream 8 or 9 at all,
because packages required by those tests are not available there.
Certain tests need to reflect the fact that SELinux policies which
confine the tested programs are not present on all versions of RHEL,
CentOS or Fedora.
A recently filed customer report revealed that SELinux prevents the
confined administrator (derived from sysadm_u, having sysadm_r role)
from running the "sudo dnf update" command. The TC reproduces the
situation.
Because BZ#1910077 was not fixed on the sudo side, various commands
end up triggering SELinux denials and consequently, they need to be
fixed on the selinux-policy side. It is an unfortunate solution, but
a necessary one if we want to achieve a successful run of such commands.
The TC covers BZ#2233065 and RHEL-1679.
A recently filed BZ report revealed that SELinux prevents the spamd
processes from searching (syscall = newfstatat) the /var/lib/snapd
directory when the snapd package is installed. The TC reproduces
the situation.
Because the spamassassin service logs indicate that the spamd functions
are not affected by the denied access, I believe that SELinux policy
should dontaudit the action. The TC looks for appropriate policy rules
and file context patterns.
The TC covers BZ#2207725.
When the `tmt test export` command is used on a test, a unique id
is generated for the test and the id is added into the main.fmf file
of the test. More information about these ids can be found at:
* https://tmt.readthedocs.io/en/stable/spec/core.html#spec-core-id
From now on, all tests in the selinux-policy directory will have
their ids present.
Add testcode to selinux-policy/install-uninstall-dsp-packages test suite
to discover conflicts during third-party or dsp selinux package
installations. The code installs-uninstalls relevant packages collected
from all the available repos and checks for failures / AVC errors.
Signed-off-by: Amith Kumar <apeetham@redhat.com>
A recently filed customer report revealed that SELinux prevents
the exim's sendmail program from creating new directories under the
/var/spool/exim/input/ directory. The TC reproduces the situation.
In order to support the whole functionality of exim (especially the
split_spool_directory configuration option), I believe that SELinux
policy should allow the action. The TC looks for appropriate policy
rules and file context patterns.
The TC covers RHEL-14110 and RHEL-14186.
A recent fio testing performed on machines which have NVME devices
revealed that SELinux prevents the fio processes from using the cmd
permission of the io_uring class. The TC reproduces the situation
on such machines.
In order to support the io_uring functionality of the fio utility,
I believe that SELinux policy should allow this action. The TC
looks for appropriate policy rules and file context patterns.
The TC covers RHEL-11792.
As pointed out in BZ#1900869, some of the machinectl commands still
do not work as expected. As a result of manual testing, I added more
policy rules to the testpolicy module which, hopefully, improves the
situation.
Since the ba723f4941 (Update test for virtualization daemons) commit,
the virtualization daemons test branches based on Fedora version, but
rlIsFedora was used incorrectly, making the condition always succeed.
Since Fedora 40, virt policy has been split into 2 modules.
There are new types for hypervisor drivers in the main policy module and
also new types for secondary drivers in the virt_supplementary module.
A scenario which combines the numad service, a libvirt VM and the
following libvirt configuration option revealed that SELinux prevents
the numad processes from using the ipc_owner capability:
<vcpu placement="auto" />
In order to support the whole numad functionality, I believe that
SELinux policy should allow the action. The TC looks for appropriate
policy rule.
The TC covers BZ#2026968 and RHEL-2415.
Previously, selinux-policy allowed all operations on anonymous inodes
for all domains. Since F40, individual types for each anon inode type
(userfaultfd and io_uring for the moment) were defined and common
userfaultfd/io_uring usage was allowed to individual domains.
This test was adjusted to align with the new F40 state.
A recently filed bug report revealed that SELinux prevents the
systemd-localed processes from creating the /etc/X11/xorg.conf.d
directory if it does not exist. The TC reproduces the situation.
In order to enable the legacy systemd-localed functionality,
I believe that SELinux policy should allow the action. The TC
looks for appropriate policy rules and file context patterns.
The TC covers BZ#2240159.
Even though the new policy for nvme-stas component was tested
multiple times (as can be seen in BZ#2111414 and RHEL-1557),
a SELinux type naming problem was introduced by various selinux-policy
builds. For example:
* stas_t vs. nvme_stas_t
* stas_exec_t vs. nvme_stas_exec_t
* stas_var_run_t vs. nvme_stas_var_run_t
* stas_cache_t vs. nvme_stas_cache_t
In order to make the automated test correct and reliable, the SELinux
policy checks executed by the test will use the nvme_* prefixed types,
because they are present in the latest selinux-policy builds.
The kexec-tools component is frequently used by various users on Fedora
and RHEL, so it makes sense to run this TC in upstream testing too.
There are no changes in the TC functionality.
Moving the downstream TC to upstream repo.
The TC covers BZ#2236876.
A recent testing of new policy for the stacd and stafd services
revealed that SELinux prevents the stacctl and stafctl programs
from communicating with the daemons via D-bus (send_msg permission).
The TC reproduces the situation.
In order to support the D-bus communication in both directions
(unconfined -> stas_t, stas_t -> unconfined_t), I believe that
SELinux policy should allow the action. The TC looks for appropriate
policy rules.
The TC covers RHEL-1557.
Certain test phases are not relevant for RHEL-8 and they fail because
of that fact.
Certain tests still require the setools package, which
is not really needed for their successful run.
Many tests lack the FMF (generated) ID.
Several tests still contain the TIPfail tags (related to the Test
Improvement Project which was discontinued a long time ago).
These issues should be fixed now.
The pam_console module was removed from pam in favor of a more complex
solution in systemd-logind in Fedora 39 [1], therefore the test is not
applicable there and will not be in the future releases.
[1] https://fedoraproject.org/wiki/Changes/RemovePamConsole
/home/zpytela/devel/tests-fedora/selinux
The following tests were failing on RHEL-9 because some of their
test phases were executed even if they were not relevant:
* selinux-policy/bootupd-and-similar
* selinux-policy/bz562833-chrooted-named-file-contexts
* selinux-policy/systemd-machined-and-similar
The issues should be fixed now.
A recent samba and cups-pdf testing revealed that SELinux prevents
the cups-pdf processes from connecting to UNIX stream socket:
* /run/systemd/userdb/io.systemd.DynamicUser (kernel_t)
The TC reproduces the situation.
In order to support the whole cups-pdf functionality, I believe that
SELinux policy should allow the action. The TC looks for appropriate
policy rules.
The TC covers BZ#2234765.
The cups-pdf package is available in the EPEL repository for RHEL-8
and RHEL-9. The test should NOT finish prematurely if the cups-pdf
package is installed. The test should fail if the cups-pdf package
cannot be installed even if the test tried to install it from EPEL.
The abrt* packages are not available on RHEL-9, which means that
one of the test phases would fail if this change was not done.
The test phase dedicated to /usr/sbin/abrtd will be executed only
if the file is present.
The journalctl command usually runs the less command as a pager.
The less command usually saves the performed actions in a history
file called ~/.lesshs*.
This sequence of commands can produce SELinux denials when executed
under the root user, because the less' history file is located in
the /root directory.
We believe that the number of programs (SELinux domains) which have
write access to the /root directory should be kept limited.
In order to avoid SELinux denials related to /root/.lesshs* files,
the journalctl command will be executed with the --no-pager option.
The bind component is frequently used by various users on Fedora
and RHEL, so it makes sense to run this TC in upstream testing too.
There are no changes in the TC functionality.
Moving the downstream TC to upstream repo.
A recent perf + perf_event testing revealed that SELinux prevents the
sysadm_u user from using the bpf syscall (permission: prog_run, class:
bpf) when running the perf program. The TC reproduces the situation.
In order to enable the sysadm_u user to use all perf features, I believe
that SELinux policy should allow this action. The TC looks for
appropriate policy rules.
The TC covers BZ#2229936.
There is no /lib/modules/.../vmlinuz file on RHEL-7 kernels, so just use
the parent directory, which should be owned by the same package.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
There are environments where yum is not present. The epelyum function
is based on the yum command and if the yum command is not present,
it makes no sense to call the epelyum function.
Instead of relying on the existing kernel package naming and versioning
conventions, which are subject to change in RHEL, determine the main
kernel package name via `rpm -qf "/lib/modules/$(uname -r)/vmlinuz"` and
derive the rest from that.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Recent targetd testing revealed that SELinux prevents the targetd
process from searching under the /proc/sys/net/ directory and reading
the /proc/sys/net/ipv6/conf/all/disable_ipv6 file. The TC reproduces
the situation.
In order to support the expected functionality of the targetd service,
I believe that SELinux policy should allow above-mentioned actions.
The TC looks for appropriate policy rules and file context patterns.
The TC covers BZ#2222199.
The targetd component is also used by various users on Fedora
and RHEL, so it makes sense to run this TC in upstream testing too.
There are no changes in the TC functionality.
Moving the downstream TC to upstream repo.
This mainly pulls in the new inet_socket/mptcp subtest that provides
coverage for the MPTCP protocol.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Recent bootupd testing revealed SELinux denials which were triggered
because the bootupd process wanted to use the following access:
* getattr (syscall=statx) on /boot/efi directory (dosfs_t)
* search (syscall=openat) on /boot/efi/EFI directory (dosfs_t)
The TC reproduces the situation on machines where /boot/efi/EFI is
mounted accordingly.
In order to enable the expected functionality of the bootupd service,
I believe that SELinux policy should allow the accesses mentioned
above. The TC looks for appropriate policy rules.
The TC covers BZ#2218106.
The SELinux beaker library calls the yum/dnf command and the
"--skip-broken" option is placed before the "install" word on the
command line. Such command line executed on Fedora rawhide leads to
the following error message:
Unknown argument "--skip-broken" for command "dnf5". Add "--help" for
more information about the arguments.
In order to work around this issue, the "install" word was moved before
the rest of options. Manual testing revealed that this approach works
on Fedora rawhide.
The boinc-client component is also used by various users on Fedora
and RHEL, so it makes sense to run this TC in upstream testing too.
There are no changes in the TC functionality.
Moving the downstream TC to upstream repo.
The thttpd component is frequently used by various users on Fedora
and RHEL, so it makes sense to run this TC in upstream testing too.
There are no changes in the TC functionality.
Moving the downstream TC to upstream repo.
The exim component is frequently used by various users on Fedora
and RHEL, so it makes sense to run this TC in upstream testing too.
There are no changes in the TC functionality.
Moving the downstream TC to upstream repo.
New version of SELinux user-space (3.4) brought a change that affects
this automated test. Functions like lgetxattr and lsetxattr were replaced
by functions getxattr and setxattr.
TBA
In comparison to kernel, which recognizes various watch permissions,
SELinux policy does not recognize them yet. But that situation should
change soon.
Purpose of the TC is to find out if the same watch* permissions recognized
by kernel are also recognized by SELinux policy.
The TC covers BZ#1915034.
In comparison to kernel, which recognizes capabilities like perfmon,
bpf and checkpoint_restore, SELinux policy does not recognize them yet.
But that situation should change soon.
Purpose of the TC is to find out if these capabilities recognized
by kernel are also recognized by SELinux policy.
The TC covers BZ#1915264.
A recently filed BZ revealed that SELinux prevents the opensmptd
service from starting. The TC reproduces the situation. Here is
a short of summary of smptd actions that were denied:
* chroot syscall on /var/empty/smtpd (sys_chroot permission)
* chmod syscall on /var/spool/smtpd/temporary (fowner permission)
* bind syscall on /var/run/smtpd.sock (create permission)
* chmod syscall on /var/run/smtpd.sock (setattr permission)
In order to enable the expected functionality of the opensmtpd service,
I believe that SELinux policy should allow these actions. The TC looks
for appropriate policy rules and file context patterns.
The TC covers BZ#2208696.
Restore the restorecond service to its original state.
The restorecond service should not stay running if it was not
running before execution of the test.
Certain tests end up with a timeout because they run the ncat
program in the background and they do not stop it. The framework
which runs the tests apparently cannot cope with this fact.
As many reported BZs confirm, various QEMU related programs use
the io_uring interface, but SELinux prevents them from using the
mmap syscall on it. The TC reproduces a similar situation.
In order to support the io_uring interface fully, I believe that
SELinux policy should allow the map permission on the anon_inode
class. The TC looks for appropriate policy rules.
The TC covers BZ#2025714, BZ#2187745 and their duplicates.
- ensure the current booted kernel is set as default
(fixes the case where a newer kernel package has been installed since
boot)
- add Beaker compat workaround
- add descriptions to most rlRun asserts
- run zipl also after the cleanup `dracut -f` invocation
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Systemd may disable coredumps by setting kernel.core_pattern to
"|/usr/bin/false", so this needs to work.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
The systemd-homed service is not confined yet so no particular type
is assigned to the executable and the process, neither there are rules
in place to make the service run successfully.
The rlSEConfigureSSH function produced the following error message:
/usr/share/beakerlib/testing.sh: line 896: /etc/ssh/sshd_config.d/001-enable-password.conf: No such file or directory
when the /etc/ssh/sshd_config.d directory did not exist.
To avoid such situations in the future, the 001-enable-password.conf
file will be created only if the /etc/ssh/sshd_config.d/ directory
exists.
Packages which belong to non-usual repositories may be installed
during the Setup phase, but not sooner because the framework running
the tests does not know the repositories. It makes no sense to run
the following command before the program is installed:
* rpm -qf /path/to/program
All the required packages should be installed after finish of the
rlSESatisfyRequires function.
Recently, the libvirt daemon was restructured into several smaller
daemons. Each of them will be confined by SELinux. This test
case should test if these smaller daemons cooperate with SELinux
policy and looks for any SELinux denials.
This TC runs only basic scenarios like start, restart, stop on
various virtualization services. It also tests SELinux contexts of
those virtualization processes and their file context patterns.
Some of the automated tests require the SSH password authentication
to be enabled in order to succeed. The following file is added into
/etc/ssh/sshd_config.d/ directory to enable it:
* /etc/ssh/sshd_config.d/001-enable-password.conf
The rpmdb-migrate service is not available on all RHELs or Fedoras.
To avoid unnecessary failures, the rpmdb-migrate test phases will
be skipped if the service is not installed.
Rework the conditional so that the new part of the test runs everywhere
except specified old version cases. Before this it wouldn't be run on
Fedora, CentOS, or RHEL>=10.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
The bulk of the logic is implemented inside libsemanage, so add to the
component list, so that the test is run also on changes in libsemanage.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Some packages are only available for Fedora or for older RHELs.
It makes no sense to run certain tests in environments where their
required packages are not unavailable.
In order to allow a running systemd service to print an output onto
console, the daemons_use_tty boolean needs to be enabled. Otherwise
the following error message appears:
Failed to start transient service unit: Connection reset by peer
The daemons_use_tty boolean is disabled by default.
The use of the systemd-timesyncd service revealed that SELinux
prevents the systemd-timesyncd processes from watching (syscall =
inotify_add_watch) the /run/systemd/ directory. The TC reproduces
the situation.
In order to successfully start the systemd-timesyncd service in
enforcing mode, I believe that this access should be allowed in
SELinux policy. The TC looks for appropriate policy rules and
file context patterns.
The TC covers BZ#2175137.
Notable changes:
- fixed DH prime format in 'keys' test
- native quota support now used for ext4 when available
- needs special exception on RHEL-7 where it is broken
- fixed stderr noise from 'yes' command
- fixed SIGIO tests to work under CONFIG_LEGACY_TIOCSTI=n
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
When a program is moved from one package to another package,
automated tests which require the first package may fail. In order
to improve the situation, it's safer to require the full program
location instead of a package name, that may change over time.
This TC covers the bootupd service and its basic scenario with
default configuration.
Purpose of this TC is to find any SELinux interferences with the
bootupd service.
The TC covers BZ#2029478 and BZ#2044508.
This TC covers the synce4l service and its basic scenario with
default configuration.
Purpose of this TC is to find any SELinux interferences with the
synce4l service.
The TC covers BZ#2158402.
Recently, various modem users reported that SELinux prevents the
ModemManager service from working with netlink route sockets and
from creating the /sys/class/net/*/qmi/pass_through file. The TC
does not reproduce the situation.
In order to support the full functionality of ModemManager service,
I believe that SELinux policy should allow these actions. The TC
looks for appropriate policy rules.
The TC covers BZ#2145005, BZ#2149560 and BZ#2149954.
This TC covers the nfs-idmapd service and its basic scenario with
default configuration.
Purpose of this TC is to find any SELinux interferences with the
nfs-idmapd service.
The upgrade procedure from Fedora 36 to Fedora 37 revealed that
SELinux prevents the rpmdb-migrate service from executing the
bash, rpm and rm programs. The TC reproduces the situation
without performing the upgrade.
In order to support the functionality of the rpmdb-migrate service,
I believe that SELinux policy should allow these actions. The TC
looks for appropriate policy rules and file context patterns.
The TC covers BZ#2164752.
Don't be strict about the 'execute' permission and instead check for
[the lack of] transitions. Also drop entrypoint checking as it's not
really relevant.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
A lot of running services create various FS objects under the
/var or the /run directories. These objects may get SELinux
labels which are different than what file context database specifies.
To reveal such discrepancies, many automated tests run the
"restorecon -Rv /run /var" command.
Unfortunately, the command affects SELinux contexts of files
and directories stored under /var/ARTIFACTS/. For example:
the rlFileBackup function uses this location as storage.
To avoid unpleasant effects of the restorecon command on anything
stored under /var/ARTIFACTS, the restorecon command intentionally
excluded that directory.
Not all packages required by the tests were installed. The issue
should be fixed now.
Relevancy of certain tests was set incorrectly. The issue should
be fixed now.
At least 1 test runs longer than its specified duration. The issue
should be fixed now.
When the icecast service is running for a long time, its log files
become large enough so that they will be rotated. Unfortunately,
SELinux prevents the rename of old log files. The TC reproduces
the situation.
In order to support the functionality of `logsize` and `logarchive`
options, I believe that SELinux policy should allow the actions.
The TC looks for appropriate policy rules and file context patterns.
The TC covers BZ#2156763.
The existing icecast test is being moved from the downstream repository
to the upstream repository.
There are few changes in the test, for example: required packages,
relevant architectures, supported distros.
The systemd-notify binary was not expected to use as a separate service,
but rather a helper to notify PID 1 about some particular service state.
This includes user services.
Calling sd_notify API is also supported from running services.
A new test phase was added. Purpose of the test phase is to find
out whether the `sepolicy manpage` command can generate man pages
for all SELinux domains without triggering an error or traceback.
The TC covers BZ#1416372.
The sepolicy tool can generate man pages for specific SELinux domains.
When the sepolicy tool was instructed to generate man pages in HTML
form (--web), the generated HTML files were very incomplete. The TC
reproduces the situation.
The newly added TC checks if the sepolicy manpage command works
correctly. The checks related to the sepolicy manpage command
were removed from the sepolicy-generate TC.
The TC covers BZ#1989840.
Recently, the new versions of systemd component revealed that SELinux
prevents the journal-offline command from relabeling (syscall=fsetxattr)
the systemd journal files. The TC reproduces the situation.
Because the relabeling of journal files is an intentional operation,
which happens when the systemd journal is rotated, I believe that
SELinux policy should allow it. The TC looks for appropriate policy
rules.
The TC covers BZ#2075527 and BZ#2152823 and their duplicates.
Effective changes:
- fix the policy to allow the new user_namespace::create permission
where needed
- fix the code to build without warnings with latest SELinux userspace
The rest is various cleanups or changes not affecting Fedora/RHEL.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
SELinux policy now contains a new policy module which confines the
stacd and stafd services, which belong to the nvme-stas package.
This TC covers basic scenarios of running the services in default
configuration. The TC also looks for appropriate policy rules and
file context patterns.
The TC covers BZ#2111414.
Recent RHEL-9.2 instalation testing revealed that SELinux prevents
the systemd-rfkill processes from using the bpf capability. The TC
does not reproduce the situation unless the right HW is available.
In order to support the full functionality of the systemd-rfkill
program, I believe that SELinux policy should allow this action.
The TC looks for appropriate policy rule.
The TC covers BZ#2149390.
The use of systemd-machined and systemd-nspawn services revealed that
SELinux still prevents various actions they do. The TC reproduces the
situation.
In order to support the documented functionality of systemd-machine,
I believe that SELinux policy should allow these actions. The TC
looks for appropriate policy rules and file context patterns.
The TC covers BZ#1847545, BZ#1900869, BZ#1900888 and their duplicates.
Some tests were ending prematurely because their required packages
were not available. Fortunately, more and more packages are available
in the EPEL repository now and the situation has changed.
Some tests require packages which are not available on any RHEL and
most likely will not be available there at all.
If the framework which runs the automated tests does not install
all required packages (listed in Makefile) before the tests are
started, then rlSESatisfyRequires() installs the required packages
during the run of the tests.
Recent stalld testing identified the following error messages in the
systemd journal:
stalld[...]: stalld: Permission denied
Deeper investigation revealed that SELinux prevents the stalld
processes from reading the /sys/kernel/security/lockdown file. The
TC reproduces the situation.
In order to avoid the error messages, I believe that SELinux policy
should allow the access. The TC looks for appropriate policy rules
and file context patterns.
The TC covers BZ#2140673.
Purpose of the Tier1 test plan is to gather all Tier1 tests in this
repository.
Purpose of the Tier2 test plan is to gather all Tier2 tests in this
repository.
Purpose of the Tier3 test plan is to gather all Tier3 tests in this
repository.
Add test to policycoreutils/Regression suite which verifies bug 2128976
and ensures that irrelevant python scripts are not given precedence over
tools like semanage.
Signed-off-by: Amith Kumar <apeetham@redhat.com>
The automated test used to work with 100MB files. Unfortunately,
the mkfs.xfs program started to complain recently:
Filesystem must be larger than 300MB.
In order to use the automated test successfully in the future,
the allocated space was increased to 400MB.
The use of DynamicUser and StateDirectory features of systemd
in customer environments revealed that SELinux prevents the systemd
processes from reading the symbolic links under /var/lib directory.
The TC reproduces the situation.
Detailed information can be found at:
* https://www.redhat.com/sysadmin/systemd-secure-services
In order to fully support the systemd secure services feature,
I believe that SELinux policy should allow this access. The TC
looks for appropriate policy rules and file context patterns.
The TC covers BZ#2118784.
The use of blueman-mechanism service revealed that SELinux prevents
the blueman-mechanism process from reading the content of
/root/.local/lib/python3.10/site-packages/ directory. The TC reproduces
the situation.
Because the blueman-mechanism program is written in Python, it makes
sense to look for locally installed Python modules. In order to
support the basic Python principles, I believe that SELinux policy
should allow this access. The TC looks for appropriate policy rules
and file context patterns.
The TC covers BZ#2027044.
This TC covers the caddy service and its basic scenario with
default configuration.
Purpose of this TC is to find any SELinux interferences with the
caddy service.
The TC covers BZ#1706651 and BZ#2122886.
Otheriwse older kernel entries would still have our injected scripts in
the initramfs after test execution.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Forward-port of downstream kernel tests that haven't been upstreamed
yet, manually converted to TMT.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
ramfs is now treated as an xattr-supporting filesystem and has the
fs_use_trans directive in the base policy. Thus switch to vfat, which is
still genfs.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Replace the current soft fallback to raw GIT_BRANCH when a required PR
or Patchwork patch fails to merge/apply with a hoard failure, similar to
what we do when cloning the repo fails.
The main motivation is to not have CKI treat this situation as a
failure, but it also a good practice to ensure we either run the
intended version of the test or no test at all.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
For unknown reasons, selinux-policy-{minimum,mls,targeted} packages
are not installed or their available versions differ from each other.
Let's work around the issue.
Recent RDMA testing revealed that systemd-modules-load processes
cannot use openat syscall on /dev/kmsg and cannot use connect syscall
on /run/systemd/journal/socket because SELinux denies that. The
TC reproduces the situation when executed on a machine equipped
with RDMA (Infiniband) HW.
Because this scenario should work, I believe that SELinux policy
should allow above-mentioned actions. The TC looks for appropriate
policy rules and file context patterns.
The TC covers BZ#2088257 and BZ#2088258.
Extend the test to verify correct behavior when a boolean setting
override is injected. Also add auto-detection of the --refresh /
--rebuild-if-modules-changed command-line option support, which
indicates the expected level of functionality. (And we also need to
ensure that --refresh is used when supported because the other option
may be removed in the future.)
Additionally, we need to work around the fact that the exact binary
policy content can now be different depending on if the optimized code
path has been taken. Do this by toggling a boolean before introducing
injected customizations, thus obtaining the expected policy content for
the case after `semodule --refresh`.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Some CI frameworks still use STI which depends on existence of the
Makefile. In order to run this TC successfully in such frameworks,
the Makefile was added. Test description was also improved.
Recent testing revealed that `semanage import` cannot import
SELinux port definitions correctly if `port -D` is present
among them. The TC reproduces the situation.
The TC covers BZ#2063353 and BZ#2108174.
The semanage tool refuses (for some time already) fcontext patterns
which contain spaces. The TC checks if other whitespace characters
are treated the same way.
The TC covers BZ#1893545.
SELinux policy confines the bgpd program (the bgpd service as well).
This TC covers basic scenarios of running the service in default
configuration. The TC also looks for appropriate policy rules and
file context patterns.
The TC covers BZ#2055578.
Recent stalld testing revealed that SELinux prevents the stalld
processes from using the sched_setattr syscall on the running
kernel threads. The TC does not reproduce the situation.
In order to avoid the SELinux denials and support all functions
of the stalld service, SELinux policy should allow the use of
sched_setattr syscall. The TC looks for appropriate policy rules.
The TC covers BZ#2102224.
Frequent use of the dhclient program in various environments revealed
that SELinux prevents the /etc/dhcp/dhclient.d/chrony.sh script from
appending to files stored in the /run/chrony-dhcp/ directory. The TC
reproduces the situation.
Because the /etc/dhcp/dhclient.d/chrony.sh script is brought by the
chrony package and the scripts in the /etc/dhcp/dhclient.d/ directory
are by default executed by the dhclient-script program, I believe that
SELinux policy should allow the access. The TC looks for appropriate
policy rules and file context patterns.
The TC covers BZ#2035117, BZ#2093709 and BZ#2094155.
One of the new systemd features allows passing secret credentials
to various services, but SELinux prevents all sd-mkdcreds processes
running as init_t from accessing all /dev/shm/.#cred* files. The
TC reproduces the situation.
In order to support this systemd feature, SELinux policy should allow
these actions. The TC looks for appropriate policy rules and file
context patterns.
The TC covers BZ#2096857 and BZ#2097681.
Recent use of the setfiles program in chroot-ed environment revealed
the following error messages:
/usr/sbin/setfiles: Could not set context for /usr/include: No such file or directory
The problem was identified and fixed in the libselinux code. Purpose
of this TC is to test whether the fixfiles behaves correctly in such
environments.
The TC covers BZ#2094683.
Recent manual testing of the fedora-third-party-refresh service
revealed that SELinux prevents the fedora-third-party process from
reading the /etc/passwd file. The TC reproduces the situation.
Interestingly, the fedora-third-party-refresh service starts and
succeeds even if the access is denied, which means that SELinux
policy can either allow or dontaudit the access. The TC looks for
appropriate policy rules and file context patterns.
The TC covers BZ#2093453.
Recent stalld testing revealed that SELinux prevents the stalld processes
from using the sched_getattr syscall on the running kernel. The TC
does not reproduce the situation.
In order to fix the SELinux denials, SELinux policy should either
allow or dontaudit the use of sched_getattr syscall. The TC looks
for appropriate policy rules.
The TC covers BZ#2096776.
Recent use of the ksm service revealed that SELinux prevents the
ksmctl process from creating the run file in the /sys/kernel/mm/ksm/
directory. The TC reproduces the situation.
The ksmctl binary contains the following locations (the strings command
found them):
* /sys/kernel/mm/ksm/run
* /sys/kernel/mm/ksm/max_kernel_pages
In order to make the ksm service fully functional, I believe that
SELinux policy should allow the create access to these files. The
TC looks for appropriate policy rules and file context patterns.
The TC covers BZ#2091416, BZ#2091417 and BZ#2091418.
The only effective difference is that the broken SCTP ASCONF tests will
now be skipped, see:
3e93ece73d
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
SELinux user-space version 3.3 and higher does not support loading
of empty CIL modules. If such version is installed, one of the test
phases will be skipped. This commit changes existing code to using
rlTestVersion.
The following messages found in the systemd journal revealed that
the stalld service cannot perform all operations it wants:
stalld[...]: boost_with_deadline failed to boost pid 0: Operation not permitted
stalld[...]: boost_with_fifo failed to boost pid 0: Operation not permitted
stalld[...]: boost_with_deadline failed to boost pid 0: Permission denied
stalld[...]: boost_with_fifo failed to boost pid 0: Permission denied
Unfortunately, SELinux policy contains a dontaudit rule which hides
SELinux denials triggered by the stalld service in this situation.
In order to fix the issue, SELinux policy should allow the sys_nice
capability and the setsched permission to the stalld_t labeled processes.
The TC runs the stalld service and looks for such rules.
The TC covers BZ#2092864.
The ksm service will be sooner of later confined by SELinux.
Purpose of this automated test is to find out whether the SELinux
policy does not prevent the ksm service from doing what is
expected.
The TC covers BZ#2021131.
New automated test which covers basic functions of the systemd-run program.
Based on bugs filed in the past, SELinux interferes with systemd-run
often, which indicates that such an automated test is definitely needed.
The TC covers BZ#1647162 and BZ#1980241.
Automated tests executed via TMT/FMF are failing due to absence of relevant packages.
Fix the main.fmf file to match the list of required packages/programs in `Makefile`.
Signed-off-by: Amith Kumar <apeetham@redhat.com>
The systemd-notify program is confined by SELinux, but there was no
SELinux related test coverage sofar. This automated TC will contain
some basic scenarios and should improve this situation.
As described in BZ#1903106, current SELinux policy is one of the
factors which prevent systemd from proper notify handling. Missing
rules in SELinux policy lead to the following error message:
Failed to invoke barrier: Connection timed out
The TC covers BZ#1903305, looks for appropriate SELinux policy rules
and it also reproduces the scenario.
What if an unconfined service tries to use the systemd-notify?
Will it work successfully without SELinux denials?
Following error messages appeared when 2 containers (one derived
the other) both manipulate the SELinux policy store:
libsemanage.semanage_commit_sandbox: Error while renaming
/var/lib/selinux/targeted/active to /var/lib/selinux/targeted/previous.
(Invalid cross-device link).
semodule: Failed!
Error: error building at STEP "RUN semodule -B": error while running
runtime: exit status 1
Purpose of this automated test is to find out if this situation still
happens or not.
The TC covers BZ#2068085.
Add AVC_ERROR=+no_avc_check into test environment to disable Beaker's
AVC check, as this test produces s lot of expected AVC denials.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
The test doesn't detect the presence of the performance issue reliably
across machines and architectures, so disable it for now.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
The ModemManager component is frequently used by various users on
Fedora and RHEL, so it makes sense to run this TC in upstream testing
too.
There are no changes in the TC functionality.
Moving the downstream TC to upstream repo.
Many automated tests run the "restorecon -Rv /run /var" command
to ensure that file-system objects stored in these locations are
labeled correctly. Unfortunately, the command affects SELinux
contexts of files/directories stored under /var/ARTIFACTS/. For
example: the rlFileBackup function uses this location as well.
To avoid such unpleasant effects, the default SELinux context for
/var/ARTIFACTS directory is now set to /proc equivalent (meaning:
no default context).
Many automated tests use various expect scripts. Some of these scripts
were not executable, which means that they did not work successfully.
Now, all expect scripts have the UNIX permissions set to be executable.
The dhcpcd component is frequently used by various users on Fedora
and RHEL, so it makes sense to run this TC in upstream testing too.
There are no changes in the TC functionality.
Moving the downstream TC to upstream repo.
The blueman component is used by various users on Fedora, so it
makes sense to run this TC in upstream testing too.
There are no changes in the TC functionality.
Moving the downstream TC to upstream repo.
SELinux policy now contains a new policy module which confines the
stalld service. This TC covers basic scenarios of running the service
in default configuration. The TC also looks for appropriate policy
rules and file context patterns.
The TC covers BZ#2042614.
The ioctl number is not consistent across arches. The fix adds the
numbers for other arches to make the test work on all arches again.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Running in paths containing ':' or in /tmp doesn't work, so make sure
that the testsuite is run in /root.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
...and remove some workarounds that are no longer needed. Also add code
to enable/disable SCTP client peeloff tests based on where SCTP client
peeloff is currently fixed in RHEL.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
The nas package is available for various versions of Fedora, but it's
not available for any RHEL. The automated test will exit immediately
if executed on RHEL.
The firewalld component is frequently used by various users on Fedora
and RHEL, so it makes sense to run this TC in upstream testing too.
There are no changes in the TC functionality.
Moving the downstream TC to upstream repo.
The hostapd component is frequently used by various users on Fedora
and RHEL, so it makes sense to run this TC in upstream testing too.
There are no changes in the TC functionality.
Moving the downstream TC to upstream repo.
Sometimes the userdel commands end up with the following error:
userdel: user <username> is currently used by process <PID>
which leads to a situation where the subsequent useradd commands
(which use the same username) also end up with an error:
useradd: user <username> already exists
To avoid such errors, the '-f' option was added to all userdel
commands.
For unknown reason, the selinux-policy-mls package is not installed
before execution of the TC, even though it it a required package.
From now on, the TC will install the package explicitely.
Recent systemd-sysctl testing revealed that the systemd-sysctl process
wants to read certain files located under /proc/sys/ directory, but
SELinux denies that access. The TC reproduces the situation.
Because the systemd-sysctl service is executed by default during each
reboot, I believe that SELinux policy should allow the service to
work successfully. The TC looks for appropriate policy rules and file
context patterns.
The TC covers BZ#2056207 and BZ#2056999.
It seems none of the attempts to synchronize before connecting are good
enough - add some extra sleep time to the beginning of open_assoc().
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
In case of a bug/error, the server may end up hanging, so make sure it
terminates in some reasonable time.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
This test reproduces a bug that may cause an AVC with sctp_socket,
association, unlabeled_t, unlabeled_t (and also another bug related to
SCTP peeloff on the client side).
SCTP code taken and modified from selinux-testsuite's sctp subtest.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Add a variant of the selinux-testsuite test that adds a patch adding
coverage for SCTP client peeloff so that we can conveniently verify
related bugs until the fix and testsuite coverage are merged upstream.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
The lockdown class was removed from SELinux policy in BZ#2017848.
There are test phases in various automated tests which look for
policy rules related to the lockdown class. These tests were failing.
From now on, they should not fail because the problematic test phases
are skipped.
With the fix for bz#1822131, the default file context for
/run/systemd/timesync and /run/systemd/timesync/synchronized
changed to systemd_timedated_var_run_t, so the test requires
to be updated, too.
Additionally, rules for checking access to the directory and file
for systemd-timesyncd need to be updated.
The amanda component is frequently used by various users on Fedora
and RHEL, so it makes sense to run this TC in upstream testing too.
There are no changes in the TC functionality.
Moving the downstream TC to upstream repo.
When the first user is deleted before the second user is created,
they will have the same UID and the systemd processes will be
confused. The confusion leads to incorrect SELinux labels on
subdirectories of /run/user/<UID>/.
By deleting all users at the end, we ensure that each of
them will have a different UID and their directories will be
labeled correctly.
Only at most 2-CPU s390x machines are available in Beaker and the bug is
not reproducible on them, so just disable the test on s390x.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
The cockpit* services are frequently used by various users on Fedora
and RHEL, so it makes sense to run this TC in upstream testing too.
There are no changes in the TC functionality.
Moving the downstream TC to upstream repo.
While the filesystem name for efi variables is efivarfs and the relevant
type efivarfs_t, the path for the variables list reads just efivars, so
rlSEMatchPathCon needs to be used with the correct path.
With the selinux-policy fix for bz#1972372 in RHEL 9, the efivarfs_t
type is assigned to /sys/firmware/efi/efivars instead of
/sys/firmware/efi as such label should presumably be only on the
efivarfs filesystem, not the entire /sys/firmware/efi.
Services like systemd-homed and systemd-userdbd are available on Fedora,
but they are not available on RHEL. It makes no sense to run their tests
in environments, where the services are not available. Without these
services being present the tests would fail.
Recently GitHub has deprecated the git:// protocol and cloning now fails
with this message:
```
fatal: remote error:
The unauthenticated git protocol on port 9418 is no longer supported.
Please see https://github.blog/2021-09-01-improving-git-protocol-security-github/ for more information.
```
The only reason that git:// was being used instead of https:// was
allowing the test to run on RHEL-5, which has problems with accessing
GitHub via HTTPS due to protocol disparity. By now it should be okay to
throw RHEL-5 under the bus and use the https:// URL.
Since we are definitely making this test unable to run on RHEL-5, also
remove all RHEL-5-specific hacks from the code.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
The test phase failed because the following command returned <<none>>:
matchpathcon /proc/net/unix
SELinux policy does not define a default label for the /proc/net/unix
file. The file inherits its SELinux context from the /proc filesystem.
As a fix, a simple 'ls -Z' command is used to check the SELinux context.
The test phase also covers BZ#2038963 and BZ#2038157, because the same
issue appears on RHEL-8 and Fedora 35.
Recent smbcontrol testing in certain environments revealed that
the smbcontrol process wants to read the /proc/net/unix file, but
SELinux denies that access. The TC reproduces the situation.
Not sure why the smbcontrol process wants to access the /proc/net/unix
file, but current SELinux policy allows a lot of SELinux domains to
read that file, which means that the behavior is pretty common.
The TC looks for appropriate allow rule.
The TC covers BZ#2033873.
Recent confined users testing revealed that SELinux prevents the
user_u user from checking the status of its user@<UID> service.
The TC reproduces the scenario.
The TC checks the related file context patterns and looks for
appropriate policy rules which make this scenario working again.
The TC covers BZ#2017838.
The downstream version of the automated test covers more bugs than
the upstream version. Before the downstream test can be replaced by
a wrapper that calls the upstream one, both versions should be in
sync.
Recent smbcontrol testing revealed that SELinux prevents the program
from creating and using netlink_route sockets and UDP sockets. The TC
reproduces the situation.
Even though the smbcontrol program did not require such permissions
in previous versions, I believe that SELinux policy should allow the
program to do these actions. Otherwise, the following error messages
will keep on appearing:
ERROR: Could not determine network interfaces, you must use a interfaces config line
The TC covers BZ#2025931, BZ#2027740, BZ#2027751.
The smbcontrol program is frequently used by various users on Fedora
and RHEL, so it makes sense to run this TC in upstream testing too.
There are no changes in the TC functionality.
Moving the downstream TC to upstream repo.
Test phase devoted to BZ#1614236 looked for getattr and open permissions,
but they are not listed in the bug report. The only permission mentioned
in the bug report is read and that will be tested from now on.
Because BZ#1878094 is not yet fixed, the cleanup phase finds certain
SELinux denials that appeared during the run of the automated test.
These SELinux denials are related to the way systemd and SELinux policy
handle the creation of objects under /run/user/<UID>/ directory.
Because they are not related to D-bus services, they will be ignored
from now on.
Pull in a fix that allows the testsuite to succeed on kernels with
CONFIG_IP_TABLES=n (e.g. Fedora ELN kernels; future RHEL 10+ kernels).
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Recently, the service command was moved from the initscripts package
to the initscripts-service package. The service command is necessary
for operations with audit daemon, because it's not possible to
restart the audit daemon using the systemctl command.
Now, the SELinux beaker library requires the /usr/sbin/service command
instead of a package name.
This pulls in the lockdown test removal, which will be needed for
successful testing of new kernels.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
SELinux user-space of version 3.3 and higher does not support loading
of empty CIL modules. If such version is installed, one of the test
phases will be skipped.
Add a new selinux-policy testsuite to address issues related to tclass
anon_inode and also verifies bug 1974559. In this case, selinux policy
denies write permissons to userfaultfd syscall.
Signed-off-by: Amith Kumar <apeetham@redhat.com>
Some machines do not survive the start of systemd-hybrid-sleep or
systemd-hibernate services, even though their configuration contains
PrivateDevices=yes. They simply do not wake up.
To avoid such problems, one of the test phases will not be executed
unless the environment variable REAL_SCENARIOS is set to true.
When this test in run via restraint (e.g. on Beaker), it inherits some
file descriptors originating from it, labeled unconfined_service_t. This
leads to a huge amount of denials when test programs are exectuted.
To work around this, add a rule to the policy that allows the test
domains to inherit these descriptors from unconfined_service_t.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Kernels before 4.18.0-314.el8 lack the bugfix that is required for this
test to pass, so exclude it on these kernels.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
On RHEL-7.2, also the vsock_socket class is missing from the policy -
update the patch to v2, which also checks for the presence of the class.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
I missed that the new vsock_socket subtest fails to build on RHEL-7.
Apply a patch that excludes it when the necessary header/definition is
not available.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
CKI is running the testsuite also on clang-built kernels, which need the
modules to be built using clang, too. Apply pending patches from
upstream to make the testsuite work on these kernels.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
The automated tests also contain test phases which cover Fedora bugs.
These test phases should not be executed on RHEL-8, because they are
not relevant there.
The watch permissions are present only in RHEL 9 and Fedora,
so the subtests for watch should not be executed in the systemd-timesyncd
test on a system with RHEL up to version 8.
The capable_sys test is failing on F35 without his patch, because BTRFS
doesn't support the FIBMAP ioctl.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Sometimes ansible is not available as rpm in repositories, but it should
be possible to install ansible using pip3
Fixes:
[ FAIL ] :: Checking for the presence of ansible rpm
[ FAIL ] :: Command 'ansible-playbook -i localhost, -c local -v tests_all_purge.yml' (Expected 0, got 127)
When enforcing is switched to permissive and back to enforcing before
the status is updated, the SETENFORCE callback is not called as the state is
same as before.
Also avc_init is deprecated:
test_callback.c:62:5: warning: ‘avc_init’ is deprecated: Use avc_open and selinux_set_callback [-Wdeprecated-declarations]
- fixed indentation
- the test requires python3-pip
Fixes:
Running 'PipVersion=$(pip3 show selinux | grep Version)'
/usr/share/beakerlib/testing.sh: line 891: pip3: command not found
- import sys
Fixes:
Running 'python3 -c 'import selinux; rc = selinux.is_selinux_enabled(); sys.exit(rc)''
Traceback (most recent call last):
File "<string>", line 1, in <module>
NameError: name 'sys' is not defined
setfiles didn't allow using "-c" parameter (binary policy) when path was
specified. Verify that setfiles now gives the same results regardless of
weather binary policy was provided.
The TC covers BZ#1973754
Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
One policy rule check related to BZ#1968610 was incorrect,
because it assumed that the /sys/power/state is a directory,
but it is a file.
Now, it is correct.
Recent testing of the hybrid-sleep service on RHEL-8 revealed that
SELinux prevents the systemd-sleep process from creating the state
file in /sys/power/ directory.
I believe this action should be allowed, because the behavior is
expected, the scenario is supported and security is not violated.
Unfortunately, the TC cannot reproduce the scenario because it's
difficult to wake up the machine after invoking the hybrid-sleep
service.
The TC looks for appropriate policy rules and file context patterns.
The TC covers BZ#1968610.
The systemd-timesyncd service is present on both RHEL-8 and Fedora,
but may not be present on other RHELs, even though the policy which
confines the systemd-timesyncd program is present there.
If the systemd-timesyncd service is not present then the TC checks
policy definitions only (types, rules, file context patterns etc.)
If the systemd-timesyncd service is present then the TC will also
test basic actions of the service (start, restart, status etc.)
The pam_limits.so module can apply various limits on users, groups
and other domains. Purpose of this TC is to find out if these limits
do not interfere with current SELinux policy.
If nonewprivs limit is used on confined or unconfined users, SELinux
denials with { nnp_transition } appear when users log in. The TC
reproduces the situation.
I believe this operation should be allowed to make the security feature
work. The TC looks for appropriate SELinux policy rules.
The TC covers BZ#1958819.
...to allow switching the TCMS entry to refer directly here via a FMF
link. Note: I'm not adding the tags, as most of those is
RHEL/RH-specific and they can be maintained just in TCMS.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Several TCs rely on the fact that tested users can login via SSH
using a password, but this option is disabled by default. If the
TCs should succeed the option must be enabled at least temporarily,
which is done in this change.
Since kernel commit 3836a03d978e ("anon_inodes: mark the anon inode
private") - i.e. for over 10 years ago (!) - anon_inodefs inodes are no
longer exposed to LSMs so all rules containing reference to the
anon_inodefs_t type were removed from selinux-policy.
Recent testing of fapolicyd with the latest SELinux policy, which
introduced various watch* permission, revealed that SELinux prevents
the fapolicyd from using fanotify_mark syscall on various mount
points like /dev/shm, /boot etc. The TC reproduces the situation
and it also looks for appropriate policy rules.
I believe these actions should be allowed, because they are expected
from the fapolicyd process.
The TC covers BZ#1932225.
The accountsservice package is available in various versions of
RHEL and Fedora. The accounts-daemon service is also used in these
environments, so it makes sense to run this TC in upstream testing
too.
Moving the downstream TC to upstream repository.
There are only slight changes when comparing the upstream and
downstream version of this TC.
The cups-lpd package is available in various versions of RHEL
and Fedora. The cups-lpd service is also used in these
environments, so it makes sense to run this TC in upstream
testing too.
Moving the downstream TC to upstream repository.
There are only slight changes when comparing the upstream and
downstream version of this TC.
The acpid component is used in various versions of RHEL and Fedora,
so it makes sense to run this TC in upstream testing too.
Moving the downstream TC to upstream repository.
There are slight changes in the TC functionality when comparing
the downstream and the upstream version.
The polkit component is used in various versions of RHEL and Fedora,
so it makes sense to run this TC in upstream testing too.
There are no changes in the TC functionality.
Moving the downstream TC to upstream repository.
The sslh package is available in various versions of Fedora,
so it makes sense to run this TC in upstream testing.
Moving the downstream TC to upstream repository.
There are only slight changes when comparing the upstream and
downstream version of this TC.
The cups-filters package is available in various versions of
RHEL and Fedora. The cups-browsed service is also used in these
environments, so it makes sense to run this TC in upstream testing
too.
Moving the downstream TC to upstream repository.
There are only slight changes when comparing the upstream and
downstream version of this TC.
The pcsc-lite package is available in various versions of RHEL
and Fedora. The pcscd service is also used in these environments,
so it makes sense to run this TC in upstream testing too.
Moving the downstream TC to upstream repository.
There are only slight changes when comparing the upstream and
downstream version of this TC.
Recent testing revealed that the usbmuxd service triggers SELinux
denials during its start. SELinux prevented the usbmuxd process
from accessing the /proc/1/environ file. The TC reproduces the
situation.
I believe this access should be dontaudited in SELinux policy,
because it is not necessary. The TC looks for appropriate policy
rules.
The TC covers BZ#1959747.
Recent testing revealed that the usbmuxd service triggers SELinux
denials during its start, because SELinux prevents the usbmuxd
process from accessing the /sys/fs/cgroup filesystem. The TC is
able to reproduces the situation.
I believe this access should be allowed in SELinux policy. The TC
looks for appropriate policy rules.
The TC covers BZ#1936705.
Recent testing revealed that the usbmuxd service triggers SELinux
denials during its start. SELinux prevented the usbmuxd process
from accessing the /sys filesystem. The TC reproduces the situation.
I believe this access should be allowed in SELinux policy. The TC
looks for appropriate policy rules.
The TC covers BZ#1930992.
The TC expected that all SELinux policies are installed before the
TC is executed. If some of them is not installed, one of the test
phases failed.
Now, the test phase checks if particular policy is installed before
calling the D-bus interface on it.
SELinux policy recently introduced a new lockdown class which contains
2 permissions: integrity and confidentiality.
As you know, processes labeled as unconfined_t should be allowed to
use all permissions from all classes, because they are not confined.
Unfortunately, our internal testing revealed that processes running
as unconfined_t are not allowed to use integrity permission.
The TC does not reproduce the scenario, it only checks the existence
of appropriate allow rules.
The TC covers BZ#1929332 and BZ#1933134.
In comparison to kernel, which recognizes the lockdown class and its
permissions, SELinux policy does not recognize them yet. But that
situation should change soon.
Purpose of the TC is to find out if the same lockdown class and its
permissions recognized by kernel are also recognized by SELinux policy.
The TC covers BZ#1915184.
The usbmuxd component is used in various versions of RHEL and Fedora,
so it makes sense to run this TC in upstream testing too.
Moving the downstream TC to upstream repository.
There are only slight changes when comparing the upstream and
downstream version of this TC.
It actually doesn't work (and doesn't get excluded automatically) on
RHEL-7 either, so change the condition to rhel < 9.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
The bugfix has been backported in RHEL-8.4, so we can now replace this
with a kernel version check, increasing the coverage on RHEL-8.4 and
above.
Verified that the testsuite still passes on RHEL-8.3, 8.4, and RHEL-9.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
The relevant config option is now enabled on RHEL-9, so we can skip it
on RHEL-8 only to get coverage on RHEL-9 and above.
Tested on latest RHEL-9 VM image.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Set AVC_ERROR=+no_avc_check in environment to disable restraint's
built-in AVC check so that it doesn't interpret the (expected) AVCs as
failure.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Recent testing revealed, that systemd-timesyncd service wants to
use the inotify_add_watch syscall on the root directory during boot.
Unfortunately, SELinux policy denies that access.
I believe that the access is harmless and should be allowed.
The TC looks for appropriate policy rule.
The TC covers BZ#1949315.
It doesn't have a bugzilla, but better to have a regression test for it.
It's a very low-effort test, but still better than nothing :)
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Some tests are not relevant for certain versions of RHEL.
Their execution leads to failures there. After this change,
they will exit quickly and print a short message explaining why.
Add a sanity test suite which verifies but 1838257. The fix evaluates
the rpm scripts for components libsepol, libsemanage and libselinux.
It looks for obsolete commands like telinit.
Signed-off-by: Amith Kumar <apeetham@redhat.com>
According to several BZ reports, the systemd-modules-load program
wants to read /sys/firmware/efi/efivars/SecureBoot-* files.
Unfortunately, SELinux policy denies that access.
The TC reproduces the issue on machines where the EFI variable FS
is mounted (the /sys/firmware/efi/efivars/ directory exists).
I believe the access is needed for correct function of the
systemd-modules-load service. The TC looks for appropriate
policy rule.
The TC covers BZ#1819161 and its duplicates.
...to pull in two fixes for the userfaultfd test so it builds
sucessfully on RHEL-7 and remove the associated workaround from the
wrapper.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Add an semanage case to file-contexts test suite which verifies bug
1822100. The fix checks for the broken pipe error generated by the
'semanage fcontext -l | egrep ..' command.
Signed-off-by: Amith Kumar <apeetham@redhat.com>
Many changes were done in downstream SELinux beakerlib library and
they were not propagated to upstream. Now, it's fixed.
The audit daemon is restarted everytime the SELinux beakerlib library
is loaded, which usually happens once at the beginning of each test.
This change is necessary because the audit daemon sometimes dies and
gathering of SELinux denials via ausearch relies on fact that audit
daemon is running and logging them. Without a running audit daemon
many tests can pass (false positive) because no SELinux denials were
found.
This feature is required for proper support of virtiofs with SELinux.
Add a trivial test that verifies that this feature works via a dummy
SELinux module and ramfs mount.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
The fapolicyd test causes that dnf/yum hangs, which blocks the whole
gating process for 4 hours.
The test will be temporarily disabled so that new selinux-policy
builds could go through gating.
Hibernation which uses a swap partition instead of a swap file fails
because SELinux prevents systemd-sleep from getattr operation on the
swap partition. This is a common configuration, which means that
SELinux policy should allow it.
The TC does not reproduce the scenario, it only looks for appropriate
policy rules.
The TC covers BZ#1928539, BZ#1912385, BZ#1926536.
On RHEL-7 (and other old kernels), __NR_userfaultfd may not be defined
on some arches, so add a kernel version check for now to exclude
userfaultfd test when it would be skipped anyway.
I'll fix this more nicely in upstream, this is just a temporary solution
until that gets merged.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
The rng-tools component is used in various versions of RHEL and Fedora,
so it makes sense to run this TC in upstream testing too.
There are no changes in the TC functionality.
Moving the downstream TC to upstream repository.
Highlights:
- fixed lockdown and perf_event tests to work with latest Fedora policy
- userfaultfd test added
- removed dependency on `which`
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
The boltd service is available in various Fedoras and RHELs,
so it makes sense to run the TC in upstream testing too.
There are no changes in the TC functionality.
Moving the downstream TC to upstream repo.
The journalctl command is frequently used by various users on Fedora
and RHEL, so it makes sense to run this TC in upstream testing too.
There are no changes in the TC functionality.
Moving the downstream TC to upstream repo.
The fwupd service is available in various Fedoras and RHELs,
so it makes sense to run the TC in upstream testing too.
There are no changes in the TC functionality.
Moving the downstream TC to upstream repo.
The colord service is available in various Fedoras and RHELs,
so it makes sense to run the TC in upstream testing too.
There are no changes in the TC functionality.
Moving the downstream TC to upstream repo.
The numad component is used in various versions of RHEL and Fedora,
so it makes sense to run this TC in upstream testing too.
Moving the downstream TC to upstream repository.
There are some minor changes when comparing the upstream and downstream
versions of the TC.
There are no s390x machines with enough cores to run this test in RH's
Beaker and likely won't be available in any CI system in the near
future. Thus, exclude the test from this arch so that testing doesn't
fail due to lack of matching hardware.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
The dmidecode component is also used by various users on Fedora
and RHEL, so it makes sense to run this TC in upstream testing too.
There are no changes in the TC functionality.
Moving the downstream TC to upstream repository.
One of the testcase failed due to absence of chkconfig and initrc
related files. Make existing code compatible with higher versions of
Fedora and fix the failures.
Signed-off-by: Amith Kumar <apeetham@redhat.com>
This repository contains set of test for SELinux kernel, userspace and policy.
Tests are written using [beakerlib](https://github.com/beakerlib/beakerlib) with [TMT Metadata Specification](https://tmt.readthedocs.io/en/latest/spec.html).
## Gating Guidelines
Test tiers define a test's priority for our **gating process**.
* **`tier: 1`**: Critical tests that must pass for any code merge.
* **`tier: 2`**: Important but non-critical tests.
* **`tier: 3`**: Non-critical tests.
All other tier metadata (e.g., `tag:Tier1`) is now deprecated.
## Plans
$ tmt plans
Found 5 plans: /plans/ci, /plans/reboot, /plans/tier1, /plans/tier2 and /plans/tier3.
## Usage
Run `tier1` on `localhost`:
# tmt run provision -h local prepare plans -n /plans/tier1 discover execute
