public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
* [tests/selinux] pr775-checkpolicy-revdeps: kernel: Add selinux-testsuite test
@ 2026-09-11 13:17 Ondrej Mosnacek
0 siblings, 0 replies; only message in thread
From: Ondrej Mosnacek @ 2026-09-11 13:17 UTC (permalink / raw)
To: git-commits
A new commit has been pushed.
Repo : tests/selinux
Branch : pr775-checkpolicy-revdeps
Commit : 8d561265862d3c32320e1836da90167dd6fc6f7c
Author : Ondrej Mosnacek <omosnace@redhat.com>
Date : 2019-12-06T13:42:36+01:00
Stats : +414/-0 in 3 file(s)
URL : https://src.fedoraproject.org/tests/selinux/c/8d561265862d3c32320e1836da90167dd6fc6f7c?branch=pr775-checkpolicy-revdeps
Log:
kernel: Add selinux-testsuite test
Add the beakerlib wrapper for selinux-testuite so it can be used from
elsewhere.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
---
diff --git a/kernel/selinux-testsuite/main.fmf b/kernel/selinux-testsuite/main.fmf
new file mode 100644
index 0000000..f1f177f
--- /dev/null
+++ b/kernel/selinux-testsuite/main.fmf
@@ -0,0 +1,9 @@
+path: /kernel/selinux-testsuite
+
+summary: Wrapper for selinux-testuite
+description: |
+ This TC runs a functional test suite for the LSM-based SELinux security module.
+duration: 60m
+relevancy:
+ - "distro = rhel-4: False"
+tier: 1
diff --git a/kernel/selinux-testsuite/runtest.sh b/kernel/selinux-testsuite/runtest.sh
new file mode 100755
index 0000000..0f9151c
--- /dev/null
+++ b/kernel/selinux-testsuite/runtest.sh
@@ -0,0 +1,402 @@
+#!/bin/bash
+# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+# runtest.sh of /CoreOS/selinux-policy/Sanity/serge-testsuite
+# Description: functional test suite for the LSM-based SELinux security module
+# Author: Milos Malik <mmalik@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+# Copyright (c) 2014 Red Hat, Inc.
+#
+# This copyrighted material is made available to anyone wishing
+# to use, modify, copy, or redistribute it subject to the terms
+# and conditions of the GNU General Public License version 2.
+#
+# This program is distributed in the hope that it will be
+# useful, but WITHOUT ANY WARRANTY; without even the implied
+# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+# PURPOSE. See the GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public
+# License along with this program; if not, write to the Free
+# Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+# Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include Beaker environment
+. /usr/bin/rhts-environment.sh || exit 1
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGE="selinux-policy"
+
+# Default commit to checkout from the repo.
+# This should be updated as needed after verifying that the new version
+# doesn't break testing and after applying all necessary tweaks in the TC.
+# Run with GIT_BRANCH=master to run the latest upstream version.
+DEFAULT_COMMIT="b03e3453786cb20a16546d7743d31e5f26bfda3d"
+# Default pull requests to merge before running the test.
+# If non-empty, then after checking out GIT_BRANCH the listed upstream pull
+# requests (by number) are merged, creating a new temporary local branch.
+DEFAULT_PULLS=""
+# Default SELinux Patchwork series to apply before running the test.
+DEFAULT_PATCHES="208221 207155"
+
+# Optional test parameter - location of testuite git.
+GIT_URL=${GIT_URL:-"git://github.com/SELinuxProject/selinux-testsuite"}
+
+# Optional test parameter - branch containing tests.
+if [ -z "$GIT_BRANCH" ]; then
+ GIT_BRANCH="$DEFAULT_COMMIT"
+ # Use default cherries only if branch is default and they are not overriden
+ GIT_PULLS="${GIT_PULLS:-"$DEFAULT_PULLS"}"
+ GIT_PATCHES="${GIT_PATCHES:-"$DEFAULT_PATCHES"}"
+fi
+
+# Check if pipefail is enabled to restore original setting.
+# See: https://unix.stackexchange.com/a/73180
+if false | true; then
+ PIPEFAIL_ENABLE="set -o pipefail"
+ PIPEFAIL_DISABLE="set +o pipefail"
+else
+ PIPEFAIL_ENABLE=""
+ PIPEFAIL_DISABLE=""
+fi
+
+if rlIsRHEL 5 ; then
+ # On RHEL-5 sort -V doesn't work, so just pretend we have the oldest kernel
+ function kver_ge() { false; }
+ function kver_lt() { true; }
+ function kver_le() { true; }
+ function kver_gt() { false; }
+else
+ function version_le() {
+ { echo "$1"; echo "$2"; } | sort -V | tail -n 1 | grep -qx "$2"
+ }
+
+ function kver_ge() { version_le "$1" "$(uname -r)"; }
+ function kver_lt() { ! kver_ge "$1"; }
+ function kver_le() { version_le "$(uname -r)" "$1"; }
+ function kver_gt() { ! kver_le "$1"; }
+fi
+
+function installDepsYum() {
+ local yum="$1"; shift
+
+ if "$yum" --help | grep -q -- --skip-broken; then
+ "$yum" install -y --skip-broken $*
+ else
+ for req in $*; do
+ if ! rpm -q --quiet --whatprovides "$req"; then
+ "$yum" install -y "$req" || true
+ fi
+ done
+ fi
+}
+
+function installDeps() {
+ if type yum >/dev/null; then
+ installDepsYum yum "$@"
+ elif type dnf >/dev/null; then
+ installDepsYum dnf "$@"
+ fi
+}
+
+function boolGet() {
+ getsebool "$1" | cut -d ' ' -f 3
+}
+function boolSet() {
+ getsebool -a | cut -d ' ' -f 1 | grep "^$1\$" || return 0
+ setsebool "$1" "$2" || return 1
+ [ "$(boolGet "$1")" == "$2" ]
+}
+
+
+rlJournalStart
+ rlPhaseStartSetup "Install"
+ # We need to install the kernel-* packages by ourselves, since we need
+ # the same versions as the running kernel. And since we already need a
+ # reliable package install function, let's just install all the
+ # dependencies here. Thus we don't need to maintain duplicate lists of
+ # package requirements in many places (RH repo, Fedora kernel dist-git,
+ # CKI).
+ PKG_SUFFIX=""
+ KERNEL_VERSION="$(uname -r)"
+ PKG_VERSION="${KERNEL_VERSION%+debug}"
+ if [ "$PKG_VERSION" != "$KERNEL_VERSION" ]; then
+ rlLog "Detected debug kernel running."
+ PKG_SUFFIX="-debug"
+ fi
+
+ REQUIRES="
+ kernel$PKG_SUFFIX-modules-extra-$PKG_VERSION
+ kernel-rt$PKG_SUFFIX-modules-extra-$PKG_VERSION
+ kernel$PKG_SUFFIX-devel-$PKG_VERSION
+ kernel-rt$PKG_SUFFIX-devel-$PKG_VERSION
+ /usr/bin/unbuffer
+ attr
+ audit
+ checkpolicy
+ curl
+ elfutils-libelf-devel
+ expect
+ gcc
+ git
+ grep
+ ipsec-tools
+ keyutils-libs-devel
+ libbpf-devel
+ libibverbs-devel
+ libselinux
+ libselinux-devel
+ libselinux-utils
+ libsemanage
+ libsepol-devel
+ lksctp-tools-devel
+ mktemp
+ nc
+ netlabel_tools
+ net-tools
+ nmap-ncat
+ perl-Test
+ perl-Test-Harness
+ perl-Test-Simple
+ platform-python
+ policycoreutils
+ policycoreutils-devel
+ policycoreutils-python
+ python3
+ python2-lxml
+ python3-lxml
+ rdma-core-devel
+ selinux-policy
+ selinux-policy-devel
+ setools-console
+ which
+ "
+ rlRun "installDeps \$REQUIRES" 0 "Install requires"
+ rlPhaseEnd
+
+ rlPhaseStartSetup
+ rlAssertRpm ${PACKAGE}
+ rlAssertRpm audit
+ rlAssertRpm kernel
+ rlFileBackup /etc/selinux/semanage.conf
+ # running the testsuite in /tmp causes permission denied messages
+ # rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
+ # rlRun "pushd $TmpDir"
+
+ if ! rlIsRHEL 5 ; then
+ # version_le() sanity check:
+ rlRun "version_le 4.10 4.10"
+ rlRun "version_le 4.10 4.10.0"
+ rlRun "version_le 4.10 4.10.1"
+ rlRun "! version_le 4.10 4.9"
+ rlRun "! version_le 4.10.0 4.10"
+ fi
+
+ # test turns this boolean off
+ rlRun "BACKUP_allow_domain_fd_use=\$(boolGet allow_domain_fd_use)"
+ rlRun "BACKUP_domain_can_mmap_files=\$(boolGet domain_can_mmap_files)"
+ # test expects that domains cannot map files by default
+ rlRun "boolSet domain_can_mmap_files off"
+
+ rlRun "setenforce 1"
+ rlRun "sestatus"
+ if grep 'expand-check' /etc/selinux/semanage.conf; then
+ rlRun "sed -i 's/^expand-check[ ]*=.*$/expand-check = 0/' /etc/selinux/semanage.conf"
+ else
+ rlRun "echo 'expand-check = 0' >>/etc/selinux/semanage.conf"
+ fi
+ if [ ! -d selinux-testsuite ] && rlRun "git clone $GIT_URL" 0; then
+ rlRun "pushd selinux-testsuite"
+ rlRun "git checkout $GIT_BRANCH" 0
+ for _ in $GIT_PULLS $GIT_PATCHES; do
+ rlRun "git config --global user.email nobody@redhat.com"
+ rlRun "git config --global user.name 'Nemo Nobody'"
+ rlRun "git checkout -b testing-cherry-picks" 0
+ break
+ done
+ for pull in $GIT_PULLS; do
+ ref="refs/pull/$pull/head"
+ if ! rlRun "git fetch origin $ref:$ref" 0; then
+ rlRun "git checkout $GIT_BRANCH" 0
+ rlWarn "PR merge failed, falling back to GIT_BRANCH"
+ break
+ fi
+ if ! rlRun "git merge --no-edit $ref" 0; then
+ rlRun "git merge --abort" 0
+ rlRun "git checkout $GIT_BRANCH" 0
+ rlWarn "PR merge failed, falling back to GIT_BRANCH"
+ break
+ fi
+ done
+ for pwseries in $GIT_PATCHES; do
+ url="https://patchwork.kernel.org/series/$pwseries/mbox/"
+ if ! rlRun "curl $url | git am -"; then
+ rlRun "git checkout $GIT_BRANCH" 0
+ rlWarn "Applying patch failed, falling back to GIT_BRANCH"
+ break
+ fi
+ done
+ rlRun "popd"
+ fi
+
+ if [ -d selinux-testsuite ]; then
+ rlRun "pushd selinux-testsuite"
+
+ # backup code before making tweaks
+ rlFileBackup "."
+
+ if [ "$VERBOSE" = "1" ]; then
+ rlRun "sed -i 's/\(use Test::Harness;\)/\1 \$Test::Harness::verbose = TRUE;/' tests/runtests.pl" 0 \
+ "Enable verbose output"
+ fi
+
+ exclude_tests=""
+ for file in ./tests/nnp*/execnnp.c; do
+ rlRun "sed -i 's/3.18/3.9/' $file" 0 \
+ "Fix up kernel version in nnp test"
+ done
+ if rlIsRHEL ; then
+ rlRun "sed -i 's/4.20.17/4.18/' tests/Makefile" 0 \
+ "Fix up kernel version for sctp test"
+ rlRun "sed -i 's/5.2/4.18.0-80.19/' tests/Makefile" 0 \
+ "Fix up kernel version for cgroupfs_label test"
+ # CONFIG_KEYS_DH_COMPUTE not enabled on RHEL-8 :(
+ exclude_tests+=" keys"
+ fi
+ if rlIsRHEL 5 ; then
+ rlRun "sed -i '/unconfined_devpts_t/d' policy/test_policy.if" 0
+
+ rlRun "sed -i 's/read_file_perms/r_file_perms/' policy/*.te" 0
+ rlRun "sed -i 's/mmap_file_perms/rx_file_perms/' policy/*.te" 0
+ rlRun "sed -i 's/list_dir_perms/r_dir_perms/' policy/*.te" 0
+ rlRun "sed -i 's/ open / /' policy/*.te" 0
+
+ rlRun "sed -i 's/^sysadm_bin_spec_domtrans_to/userdom_sysadm_bin_spec_domtrans_to/' policy/*.te" 0
+
+ rlRun "sed -i 's/^corecmd_exec_bin(\(.*\))$/corecmd_exec_bin(\1)\ncorecmd_exec_sbin(\1)/' policy/*.te" 0
+ rlRun "sed -i 's/^corecmd_bin_entry_type(\(.*\))$/corecmd_bin_entry_type(\1)\ncorecmd_sbin_entry_type(\1)/' policy/*.te" 0
+ rlRun "sed -i 's/^userdom_search_user_home_dirs(\(.*\))$/userdom_search_user_home_dirs(user, \1)/' policy/*.te" 0
+ fi
+ if ! [ -x /usr/bin/python3 ]; then
+ # to avoid error messages like runcon: ‘overlay/access’: No such file or directory
+ rlRun "rpm -qa | grep python | sort"
+ rlRun "sed -i 's/python3\$/python2/' tests/overlay/access" 0 \
+ "Fix up Python shebang in overlay test"
+ fi
+
+ if kver_lt "3.10.0-349"; then
+ # c4684bbdac07 [security] selinux: Permit bounded transitions under NO_NEW_PRIVS or NOSUID
+ # da74590f6501 [security] selinux: reject setexeccon() on MNT_NOSUID applications with -EACCES
+ exclude_tests+=" nnp_nosuid"
+ fi
+
+ if kver_lt "3.10.0-693"; then
+ # I don't know when exactly this test starts passing, so I'm just
+ # disabling it for anything below the RHEL-7.4 kernel...
+ exclude_tests+=" inet_socket"
+ fi
+
+ if kver_lt "3.10.0-875"; then
+ rlLog "No xperms support => disable xperms testing"
+ rlRun "sed -i '/TARGETS += test_ioctl_xperms\.te/d' policy/Makefile"
+ rlRun "sed -i 's/\$kernver >= 30/\$kernver >= 999999/' tests/ioctl/test"
+ fi
+ # workaround for https://bugzilla.redhat.com/show_bug.cgi?id=1613056
+ # (if running kernel version sorts inside the known-bug window, then
+ # we need to apply the workaround)
+ if kver_ge "3.10.0-875" && kver_lt "3.10.0-972"; then
+ rlLog "Applying workaround for BZ 1613056..."
+ rlRun "cat >>policy/test_ipc.te <<<'allow_map(ipcdomain, tmpfs_t, file)'"
+ rlRun "cat >>policy/test_mmap.te <<<'allow_map(test_execmem_t, tmpfs_t, file)'"
+ rlRun "cat >>policy/test_mmap.te <<<'allow_map(test_no_execmem_t, tmpfs_t, file)'"
+ fi
+
+ if rlIsRHEL || [ "$(rlGetPrimaryArch)" != x86_64 ]; then
+ rlRun "sed -i '/SUBDIRS += bpf/d;/export CFLAGS += -DHAVE_BPF/d' tests/Makefile" 0 \
+ "Disable BPF tests on RHEL and non-x86_64 Fedora"
+ fi
+
+ if [ -n "$exclude_tests" ] ; then
+ rlRun "sed -i '/^[^[:space:]]*:\(\| .*\)\$/i SUBDIRS:=\$(filter-out $exclude_tests, \$(SUBDIRS))' tests/Makefile" 0 \
+ "Exclude not applicable tests: $exclude_tests"
+ fi
+
+ if ! modprobe sctp 2>/dev/null; then
+ script1='s/runcon -t test_sctp_socket_t/true/g'
+ script2='s/runcon -t test_no_sctp_socket_t/false/g'
+ rlRun "sed -i -e '$script1' -e '$script2' ./tests/extended_socket_class/test" 0 \
+ "No SCTP support => fix up extended_socket_class test"
+ fi
+
+ # on aarch64 and s390x the kernel support for Bluetooth is turned
+ # off so we disable the Bluetooth socket tests there
+ case "$(rlGetPrimaryArch)" in
+ aarch64|s390x)
+ script1='s/runcon -t test_bluetooth_socket_t/true/g'
+ script2='s/runcon -t test_no_bluetooth_socket_t/false/g'
+ rlRun "sed -i -e '$script1' -e '$script2' ./tests/extended_socket_class/test" 0 \
+ "No Bluetooth support => fix up extended_socket_class test"
+ ;;
+ esac
+
+ # Initialize report.
+ rlRun "echo 'Remote: $GIT_URL' >results.log" 0
+ rlRun "echo 'Branch: $GIT_BRANCH' >>results.log" 0
+ rlRun "echo 'Commit: $(git rev-parse $GIT_BRANCH)' >>results.log" 0
+ rlRun "echo 'GH PRs: ${GIT_PULLS:-"(none)"}' >>results.log" 0
+ rlRun "echo 'Series: ${GIT_PATCHES:-"(none)"}' >>results.log" 0
+ rlRun "echo 'Kernel: $(uname -r)' >>results.log" 0
+ rlRun "echo 'Policy: $(rpm -q selinux-policy)' >>results.log" 0
+ rlRun "echo ' $(rpm -q checkpolicy)' >>results.log" 0
+ rlRun "echo ' $(rpm -q libselinux)' >>results.log" 0
+ rlRun "echo ' $(rpm -q libsemanage)' >>results.log" 0
+ rlRun "echo ' $(rpm -q libsepol)' >>results.log" 0
+ rlRun "echo ' $(rpm -q policycoreutils)' >>results.log" 0
+ rlRun "echo '' >>results.log" 0
+
+ rlRun "popd"
+ fi
+ rlPhaseEnd
+
+ rlPhaseStartTest
+ if [ -d selinux-testsuite ]; then
+ rlRun "pushd selinux-testsuite"
+ rlRun "env -u ARCH make" 0
+ rlRun "cat results.log" 0
+ $PIPEFAIL_ENABLE
+ # DISTRO= needed for policy devel Makefile... (Beaker sets it to "redhat")
+ rlRun "env -u ARCH -u DISTRO LANG=C unbuffer make -s test 2>&1 | tee -a results.log" 0
+ $PIPEFAIL_DISABLE
+ rlRun "popd"
+ else
+ rlFail "GIT was unable to clone the testsuite repo"
+ fi
+ rlPhaseEnd
+
+ rlPhaseStartCleanup
+ # rlSEBooleanRestore
+ # rlSEBooleanRestore allow_domain_fd_use
+ # none of above-mentioned commands is able to correctly restore the value in the boolean
+ rlRun "boolSet domain_can_mmap_files $BACKUP_domain_can_mmap_files"
+ rlRun "boolSet allow_domain_fd_use $BACKUP_allow_domain_fd_use"
+
+ if [ -d selinux-testsuite ]; then
+ rlRun "pushd selinux-testsuite"
+ # Submit report to beaker.
+ rlFileSubmit "results.log" "selinux-testsuite.results.$(uname -r).txt"
+ rlRun "make clean" 0-2
+ rlRun "popd"
+ fi
+ rlRun "semodule -r test_policy" 0,1
+ rlRun "sleep 5" 0
+ rlRun "dmesg | grep -i \"rcu_sched detected stalls\"" 1
+ rlFileRestore
+ rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd
+
diff --git a/main.fmf b/main.fmf
index e39a89e..2b8a07d 100644
--- a/main.fmf
+++ b/main.fmf
@@ -10,6 +10,9 @@ tags: [generic]
/checkpolicy:
component: checkpolicy
+/kernel:
+ component: kernel
+
/libselinux:
component: libselinux
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2026-09-11 13:17 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-09-11 13:17 [tests/selinux] pr775-checkpolicy-revdeps: kernel: Add selinux-testsuite test Ondrej Mosnacek
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox