public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
* [tests/selinux] pr775-checkpolicy-revdeps: ladvd : Add coverage for ladvd service
@ 2026-09-11 13:18 Amith Kumar
0 siblings, 0 replies; only message in thread
From: Amith Kumar @ 2026-09-11 13:18 UTC (permalink / raw)
To: git-commits
A new commit has been pushed.
Repo : tests/selinux
Branch : pr775-checkpolicy-revdeps
Commit : c109e465d3d034447fc9e32b93ce16389c084b72
Author : Amith Kumar <apeetham@redhat.com>
Date : 2020-09-08T13:55:27+00:00
Stats : +177/-0 in 3 file(s)
URL : https://src.fedoraproject.org/tests/selinux/c/c109e465d3d034447fc9e32b93ce16389c084b72?branch=pr775-checkpolicy-revdeps
Log:
ladvd : Add coverage for ladvd service
Add test cases which provide coverage for ladvd service and also
verifies bug 1834325 and bug 1855163.
Signed-off-by: Amith Kumar <apeetham@redhat.com>
---
diff --git a/other/ladvd/Makefile b/other/ladvd/Makefile
new file mode 100644
index 0000000..8572b36
--- /dev/null
+++ b/other/ladvd/Makefile
@@ -0,0 +1,81 @@
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+# Makefile of /CoreOS/selinux-policy/Regression/ladvd
+# Description: Test coverage for avc denials related to ladvd service.
+# Author: Amith Kumar <apeetham@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+# Copyright (c) 2012 Red Hat, Inc. All rights reserved.
+#
+# This copyrighted material is made available to anyone wishing
+# to use, modify, copy, or redistribute it subject to the terms
+# and conditions of the GNU General Public License version 2.
+#
+# This program is distributed in the hope that it will be
+# useful, but WITHOUT ANY WARRANTY; without even the implied
+# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+# PURPOSE. See the GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public
+# License along with this program; if not, write to the Free
+# Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+# Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+export TEST=/CoreOS/selinux-policy/Regression/ladvd
+export TESTVERSION=1.0
+
+BUILT_FILES=
+
+FILES=$(METADATA) runtest.sh Makefile PURPOSE
+
+.PHONY: all install download clean
+
+run: $(FILES) build
+ ./runtest.sh
+
+build: $(BUILT_FILES)
+ test -x runtest.sh || chmod a+x runtest.sh
+ test -x runtest.sh || chcon -t bin_t runtest.sh
+
+clean:
+ rm -f *~ $(BUILT_FILES)
+
+include /usr/share/rhts/lib/rhts-make.include
+
+$(METADATA): Makefile
+ @echo "Owner: Amith Kumar <apeetham@redhat.com>" > $(METADATA)
+ @echo "Name: $(TEST)" >> $(METADATA)
+ @echo "TestVersion: $(TESTVERSION)" >> $(METADATA)
+ @echo "Path: $(TEST_DIR)" >> $(METADATA)
+ @echo "Description: Tests for ladvd service" >> $(METADATA)
+ @echo "Type: Regression" >> $(METADATA)
+ @echo "TestTime: 1h" >> $(METADATA)
+ @echo "RunFor: selinux-policy" >> $(METADATA)
+ @echo "RunFor: ladvd" >> $(METADATA)
+ @echo "Requires: audit" >> $(METADATA)
+ @echo "Requires: initscripts" >> $(METADATA)
+ @echo "Requires: kernel-headers" >> $(METADATA)
+ @echo "Requires: ladvd" >> $(METADATA)
+ @echo "Requires: ladvd-selinux" >> $(METADATA)
+ @echo "Requires: libpcap" >> $(METADATA)
+ @echo "Requires: libselinux" >> $(METADATA)
+ @echo "Requires: libselinux-utils" >> $(METADATA)
+ @echo "Requires: policycoreutils" >> $(METADATA)
+ @echo "Requires: selinux-policy" >> $(METADATA)
+ @echo "Requires: selinux-policy-targeted" >> $(METADATA)
+ @echo "Requires: setools-console" >> $(METADATA)
+ @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA)
+ @echo "Priority: Normal" >> $(METADATA)
+ @echo "License: GPLv2" >> $(METADATA)
+ @echo "Confidential: no" >> $(METADATA)
+ @echo "Destructive: no" >> $(METADATA)
+ @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA)
+ @echo "Releases: -RHEL4 -RHEL5" >> $(METADATA)
+ @echo "Bug: 1834325" >> $(METADATA) # Fedora 32
+ @echo "Bug: 1855163" >> $(METADATA) # Fedora 32
+
+ rhts-lint $(METADATA)
+
diff --git a/other/ladvd/PURPOSE b/other/ladvd/PURPOSE
new file mode 100644
index 0000000..556576a
--- /dev/null
+++ b/other/ladvd/PURPOSE
@@ -0,0 +1,5 @@
+PURPOSE of /CoreOS/selinux-policy/Regression/ladvd
+Author: Amith Kumar <apeetham@redhat.com>
+
+Test coverage for SELinux AVC issues related to ladvd service.
+
diff --git a/other/ladvd/runtest.sh b/other/ladvd/runtest.sh
new file mode 100755
index 0000000..682f8da
--- /dev/null
+++ b/other/ladvd/runtest.sh
@@ -0,0 +1,91 @@
+#!/bin/bash
+# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+# runtest.sh of /CoreOS/selinux-policy/Regression/ladvd
+# Description: Test coverage for SELinux AVC issues related to ladvd service.
+# Author: Amith Kumar <apeetham@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+# Copyright (c) 2012 Red Hat, Inc. All rights reserved.
+#
+# This copyrighted material is made available to anyone wishing
+# to use, modify, copy, or redistribute it subject to the terms
+# and conditions of the GNU General Public License version 2.
+#
+# This program is distributed in the hope that it will be
+# useful, but WITHOUT ANY WARRANTY; without even the implied
+# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+# PURPOSE. See the GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public
+# License along with this program; if not, write to the Free
+# Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+# Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include Beaker environment
+. /usr/bin/rhts-environment.sh || exit 1
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGE="selinux-policy"
+
+rlJournalStart
+ rlPhaseStartSetup
+ rlRun "rlImport 'selinux-policy/common'"
+ rlSESatisfyRequires
+ rlAssertRpm ${PACKAGE}
+ rlAssertRpm ${PACKAGE}-targeted
+ rlAssertRpm ladvd
+ rlAssertRpm ladvd-selinux
+ rlServiceStop ladvd
+ rlSESetEnforce
+ rlSEStatus
+ rlPhaseEnd
+
+ rlPhaseStartTest "ladvd service selinux denials, bz#1834325"
+ rlServiceStart ladvd
+ sleep 2
+ rlRun "ausearch -m AVC -c ladvd --raw > /tmp/avcfile"
+ if grep "tclass=process2" /tmp/avcfile; then
+ grep "tclass=process2" /tmp/avcfile > /tmp/avc_class_file
+ rlAssertNotGrep "denied { nnp_transition }" /tmp/avc_class_file
+ else
+ rlLog "AVCs related to tclass process2 not found."
+ fi
+ if grep "tclass=packet_socket" /tmp/avcfile; then
+ grep "tclass=packet_socket" /tmp/avcfile > /tmp/avc_class_file
+ rlAssertNotGrep "denied { map }" /tmp/avc_class_file
+ else
+ rlLog "AVCs related to tclass packet_socket not found."
+ fi
+ rlSESearchRule "allow init_t ladvd_t : process2 { nnp_transition }"
+ rlSESearchRule "allow ladvd_t ladvd_t : packet_socket { map }"
+ rlSESearchRule "allow ladvd_t ladvd_t : capability { kill }"
+ rlServiceStop ladvd
+ rlPhaseEnd
+
+ rlPhaseStartTest "ladvd selinux denials due to libpcap, bz#1855163"
+ rlServiceStart ladvd
+ sleep 2
+ rlRun "ausearch -m AVC -c 'ladvd' --raw > /tmp/avcfile"
+ if grep "tclass=netlink_rdma_socket" /tmp/avcfile; then
+ grep "tclass=netlink_rdma_socket" /tmp/avcfile > /tmp/avc_class_file
+ rlAssertNotGrep "denied { create }" /tmp/avc_class_file
+ rlAssertNotGrep "denied { setopt }" /tmp/avc_class_file
+ rlAssertNotGrep "denied { bind }" /tmp/avc_class_file
+ rlAssertNotGrep "denied { getattr }" /tmp/avc_class_file
+ else
+ rlLog "AVCs related to tclass netlink_rdma_socket not found."
+ fi
+ rlSESearchRule "allow ladvd_t self : netlink_rdma_socket { bind create getattr setopt }"
+ rlPhaseEnd
+
+ rlPhaseStartCleanup
+ rlRun "rm -f /tmp/avcfile"
+ rlRun "rm -f /tmp/avc_class_file"
+ rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2026-09-11 13:18 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-09-11 13:18 [tests/selinux] pr775-checkpolicy-revdeps: ladvd : Add coverage for ladvd service Amith Kumar
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox