public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
From: Amith Kumar <apeetham@redhat.com>
To: git-commits@fedoraproject.org
Subject: [tests/selinux] pr775-checkpolicy-revdeps: ladvd: Move dir to selinux-policy and add fmf file
Date: Fri, 11 Sep 2026 13:18:19 GMT [thread overview]
Message-ID: <178913269912.1.15198564613843457460.tests-selinux-1fad7c1e621e@fedoraproject.org> (raw)
A new commit has been pushed.
Repo : tests/selinux
Branch : pr775-checkpolicy-revdeps
Commit : 1fad7c1e621ec99523dbd437a67cc6223ef63616
Author : Amith Kumar <apeetham@redhat.com>
Date : 2020-10-07T13:22:50+00:00
Stats : +182/-177 in 7 file(s)
URL : https://src.fedoraproject.org/tests/selinux/c/1fad7c1e621ec99523dbd437a67cc6223ef63616?branch=pr775-checkpolicy-revdeps
Log:
ladvd: Move dir to selinux-policy and add fmf file
The ladvd testsuite is removed from other/* directory and placed within
selinux-policy. Also add the missing main.fmf file. The runtest file is
updated as well with a type related to exit status. The expected exit
status in ausearch is 1.
Signed-off-by: Amith Kumar <apeetham@redhat.com>
---
diff --git a/other/ladvd/Makefile b/other/ladvd/Makefile
deleted file mode 100644
index 8572b36..0000000
--- a/other/ladvd/Makefile
+++ /dev/null
@@ -1,81 +0,0 @@
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-#
-# Makefile of /CoreOS/selinux-policy/Regression/ladvd
-# Description: Test coverage for avc denials related to ladvd service.
-# Author: Amith Kumar <apeetham@redhat.com>
-#
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-#
-# Copyright (c) 2012 Red Hat, Inc. All rights reserved.
-#
-# This copyrighted material is made available to anyone wishing
-# to use, modify, copy, or redistribute it subject to the terms
-# and conditions of the GNU General Public License version 2.
-#
-# This program is distributed in the hope that it will be
-# useful, but WITHOUT ANY WARRANTY; without even the implied
-# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
-# PURPOSE. See the GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public
-# License along with this program; if not, write to the Free
-# Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-# Boston, MA 02110-1301, USA.
-#
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-export TEST=/CoreOS/selinux-policy/Regression/ladvd
-export TESTVERSION=1.0
-
-BUILT_FILES=
-
-FILES=$(METADATA) runtest.sh Makefile PURPOSE
-
-.PHONY: all install download clean
-
-run: $(FILES) build
- ./runtest.sh
-
-build: $(BUILT_FILES)
- test -x runtest.sh || chmod a+x runtest.sh
- test -x runtest.sh || chcon -t bin_t runtest.sh
-
-clean:
- rm -f *~ $(BUILT_FILES)
-
-include /usr/share/rhts/lib/rhts-make.include
-
-$(METADATA): Makefile
- @echo "Owner: Amith Kumar <apeetham@redhat.com>" > $(METADATA)
- @echo "Name: $(TEST)" >> $(METADATA)
- @echo "TestVersion: $(TESTVERSION)" >> $(METADATA)
- @echo "Path: $(TEST_DIR)" >> $(METADATA)
- @echo "Description: Tests for ladvd service" >> $(METADATA)
- @echo "Type: Regression" >> $(METADATA)
- @echo "TestTime: 1h" >> $(METADATA)
- @echo "RunFor: selinux-policy" >> $(METADATA)
- @echo "RunFor: ladvd" >> $(METADATA)
- @echo "Requires: audit" >> $(METADATA)
- @echo "Requires: initscripts" >> $(METADATA)
- @echo "Requires: kernel-headers" >> $(METADATA)
- @echo "Requires: ladvd" >> $(METADATA)
- @echo "Requires: ladvd-selinux" >> $(METADATA)
- @echo "Requires: libpcap" >> $(METADATA)
- @echo "Requires: libselinux" >> $(METADATA)
- @echo "Requires: libselinux-utils" >> $(METADATA)
- @echo "Requires: policycoreutils" >> $(METADATA)
- @echo "Requires: selinux-policy" >> $(METADATA)
- @echo "Requires: selinux-policy-targeted" >> $(METADATA)
- @echo "Requires: setools-console" >> $(METADATA)
- @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA)
- @echo "Priority: Normal" >> $(METADATA)
- @echo "License: GPLv2" >> $(METADATA)
- @echo "Confidential: no" >> $(METADATA)
- @echo "Destructive: no" >> $(METADATA)
- @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA)
- @echo "Releases: -RHEL4 -RHEL5" >> $(METADATA)
- @echo "Bug: 1834325" >> $(METADATA) # Fedora 32
- @echo "Bug: 1855163" >> $(METADATA) # Fedora 32
-
- rhts-lint $(METADATA)
-
diff --git a/other/ladvd/PURPOSE b/other/ladvd/PURPOSE
deleted file mode 100644
index 556576a..0000000
--- a/other/ladvd/PURPOSE
+++ /dev/null
@@ -1,5 +0,0 @@
-PURPOSE of /CoreOS/selinux-policy/Regression/ladvd
-Author: Amith Kumar <apeetham@redhat.com>
-
-Test coverage for SELinux AVC issues related to ladvd service.
-
diff --git a/other/ladvd/runtest.sh b/other/ladvd/runtest.sh
deleted file mode 100755
index 682f8da..0000000
--- a/other/ladvd/runtest.sh
+++ /dev/null
@@ -1,91 +0,0 @@
-#!/bin/bash
-# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-#
-# runtest.sh of /CoreOS/selinux-policy/Regression/ladvd
-# Description: Test coverage for SELinux AVC issues related to ladvd service.
-# Author: Amith Kumar <apeetham@redhat.com>
-#
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-#
-# Copyright (c) 2012 Red Hat, Inc. All rights reserved.
-#
-# This copyrighted material is made available to anyone wishing
-# to use, modify, copy, or redistribute it subject to the terms
-# and conditions of the GNU General Public License version 2.
-#
-# This program is distributed in the hope that it will be
-# useful, but WITHOUT ANY WARRANTY; without even the implied
-# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
-# PURPOSE. See the GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public
-# License along with this program; if not, write to the Free
-# Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-# Boston, MA 02110-1301, USA.
-#
-# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-# Include Beaker environment
-. /usr/bin/rhts-environment.sh || exit 1
-. /usr/share/beakerlib/beakerlib.sh || exit 1
-
-PACKAGE="selinux-policy"
-
-rlJournalStart
- rlPhaseStartSetup
- rlRun "rlImport 'selinux-policy/common'"
- rlSESatisfyRequires
- rlAssertRpm ${PACKAGE}
- rlAssertRpm ${PACKAGE}-targeted
- rlAssertRpm ladvd
- rlAssertRpm ladvd-selinux
- rlServiceStop ladvd
- rlSESetEnforce
- rlSEStatus
- rlPhaseEnd
-
- rlPhaseStartTest "ladvd service selinux denials, bz#1834325"
- rlServiceStart ladvd
- sleep 2
- rlRun "ausearch -m AVC -c ladvd --raw > /tmp/avcfile"
- if grep "tclass=process2" /tmp/avcfile; then
- grep "tclass=process2" /tmp/avcfile > /tmp/avc_class_file
- rlAssertNotGrep "denied { nnp_transition }" /tmp/avc_class_file
- else
- rlLog "AVCs related to tclass process2 not found."
- fi
- if grep "tclass=packet_socket" /tmp/avcfile; then
- grep "tclass=packet_socket" /tmp/avcfile > /tmp/avc_class_file
- rlAssertNotGrep "denied { map }" /tmp/avc_class_file
- else
- rlLog "AVCs related to tclass packet_socket not found."
- fi
- rlSESearchRule "allow init_t ladvd_t : process2 { nnp_transition }"
- rlSESearchRule "allow ladvd_t ladvd_t : packet_socket { map }"
- rlSESearchRule "allow ladvd_t ladvd_t : capability { kill }"
- rlServiceStop ladvd
- rlPhaseEnd
-
- rlPhaseStartTest "ladvd selinux denials due to libpcap, bz#1855163"
- rlServiceStart ladvd
- sleep 2
- rlRun "ausearch -m AVC -c 'ladvd' --raw > /tmp/avcfile"
- if grep "tclass=netlink_rdma_socket" /tmp/avcfile; then
- grep "tclass=netlink_rdma_socket" /tmp/avcfile > /tmp/avc_class_file
- rlAssertNotGrep "denied { create }" /tmp/avc_class_file
- rlAssertNotGrep "denied { setopt }" /tmp/avc_class_file
- rlAssertNotGrep "denied { bind }" /tmp/avc_class_file
- rlAssertNotGrep "denied { getattr }" /tmp/avc_class_file
- else
- rlLog "AVCs related to tclass netlink_rdma_socket not found."
- fi
- rlSESearchRule "allow ladvd_t self : netlink_rdma_socket { bind create getattr setopt }"
- rlPhaseEnd
-
- rlPhaseStartCleanup
- rlRun "rm -f /tmp/avcfile"
- rlRun "rm -f /tmp/avc_class_file"
- rlPhaseEnd
-rlJournalPrintText
-rlJournalEnd
diff --git a/selinux-policy/ladvd/Makefile b/selinux-policy/ladvd/Makefile
new file mode 100644
index 0000000..8572b36
--- /dev/null
+++ b/selinux-policy/ladvd/Makefile
@@ -0,0 +1,81 @@
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+# Makefile of /CoreOS/selinux-policy/Regression/ladvd
+# Description: Test coverage for avc denials related to ladvd service.
+# Author: Amith Kumar <apeetham@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+# Copyright (c) 2012 Red Hat, Inc. All rights reserved.
+#
+# This copyrighted material is made available to anyone wishing
+# to use, modify, copy, or redistribute it subject to the terms
+# and conditions of the GNU General Public License version 2.
+#
+# This program is distributed in the hope that it will be
+# useful, but WITHOUT ANY WARRANTY; without even the implied
+# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+# PURPOSE. See the GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public
+# License along with this program; if not, write to the Free
+# Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+# Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+export TEST=/CoreOS/selinux-policy/Regression/ladvd
+export TESTVERSION=1.0
+
+BUILT_FILES=
+
+FILES=$(METADATA) runtest.sh Makefile PURPOSE
+
+.PHONY: all install download clean
+
+run: $(FILES) build
+ ./runtest.sh
+
+build: $(BUILT_FILES)
+ test -x runtest.sh || chmod a+x runtest.sh
+ test -x runtest.sh || chcon -t bin_t runtest.sh
+
+clean:
+ rm -f *~ $(BUILT_FILES)
+
+include /usr/share/rhts/lib/rhts-make.include
+
+$(METADATA): Makefile
+ @echo "Owner: Amith Kumar <apeetham@redhat.com>" > $(METADATA)
+ @echo "Name: $(TEST)" >> $(METADATA)
+ @echo "TestVersion: $(TESTVERSION)" >> $(METADATA)
+ @echo "Path: $(TEST_DIR)" >> $(METADATA)
+ @echo "Description: Tests for ladvd service" >> $(METADATA)
+ @echo "Type: Regression" >> $(METADATA)
+ @echo "TestTime: 1h" >> $(METADATA)
+ @echo "RunFor: selinux-policy" >> $(METADATA)
+ @echo "RunFor: ladvd" >> $(METADATA)
+ @echo "Requires: audit" >> $(METADATA)
+ @echo "Requires: initscripts" >> $(METADATA)
+ @echo "Requires: kernel-headers" >> $(METADATA)
+ @echo "Requires: ladvd" >> $(METADATA)
+ @echo "Requires: ladvd-selinux" >> $(METADATA)
+ @echo "Requires: libpcap" >> $(METADATA)
+ @echo "Requires: libselinux" >> $(METADATA)
+ @echo "Requires: libselinux-utils" >> $(METADATA)
+ @echo "Requires: policycoreutils" >> $(METADATA)
+ @echo "Requires: selinux-policy" >> $(METADATA)
+ @echo "Requires: selinux-policy-targeted" >> $(METADATA)
+ @echo "Requires: setools-console" >> $(METADATA)
+ @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA)
+ @echo "Priority: Normal" >> $(METADATA)
+ @echo "License: GPLv2" >> $(METADATA)
+ @echo "Confidential: no" >> $(METADATA)
+ @echo "Destructive: no" >> $(METADATA)
+ @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA)
+ @echo "Releases: -RHEL4 -RHEL5" >> $(METADATA)
+ @echo "Bug: 1834325" >> $(METADATA) # Fedora 32
+ @echo "Bug: 1855163" >> $(METADATA) # Fedora 32
+
+ rhts-lint $(METADATA)
+
diff --git a/selinux-policy/ladvd/PURPOSE b/selinux-policy/ladvd/PURPOSE
new file mode 100644
index 0000000..556576a
--- /dev/null
+++ b/selinux-policy/ladvd/PURPOSE
@@ -0,0 +1,5 @@
+PURPOSE of /CoreOS/selinux-policy/Regression/ladvd
+Author: Amith Kumar <apeetham@redhat.com>
+
+Test coverage for SELinux AVC issues related to ladvd service.
+
diff --git a/selinux-policy/ladvd/main.fmf b/selinux-policy/ladvd/main.fmf
new file mode 100644
index 0000000..aeab96e
--- /dev/null
+++ b/selinux-policy/ladvd/main.fmf
@@ -0,0 +1,5 @@
+path: /selinux-policy/ladvd
+summary: Test ladvd utility to verify AVC denials
+description: |
+ Test coverage for SELinux AVC issues related ladvd service. This
+ test suite primarily verifies two bugs ie bz1834325 and bz1855163.
diff --git a/selinux-policy/ladvd/runtest.sh b/selinux-policy/ladvd/runtest.sh
new file mode 100755
index 0000000..be9c7cb
--- /dev/null
+++ b/selinux-policy/ladvd/runtest.sh
@@ -0,0 +1,91 @@
+#!/bin/bash
+# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+# runtest.sh of /CoreOS/selinux-policy/Regression/ladvd
+# Description: Test coverage for SELinux AVC issues related to ladvd service.
+# Author: Amith Kumar <apeetham@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+# Copyright (c) 2012 Red Hat, Inc. All rights reserved.
+#
+# This copyrighted material is made available to anyone wishing
+# to use, modify, copy, or redistribute it subject to the terms
+# and conditions of the GNU General Public License version 2.
+#
+# This program is distributed in the hope that it will be
+# useful, but WITHOUT ANY WARRANTY; without even the implied
+# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+# PURPOSE. See the GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public
+# License along with this program; if not, write to the Free
+# Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+# Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include Beaker environment
+. /usr/bin/rhts-environment.sh || exit 1
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGE="selinux-policy"
+
+rlJournalStart
+ rlPhaseStartSetup
+ rlRun "rlImport 'selinux-policy/common'"
+ rlSESatisfyRequires
+ rlAssertRpm ${PACKAGE}
+ rlAssertRpm ${PACKAGE}-targeted
+ rlAssertRpm ladvd
+ rlAssertRpm ladvd-selinux
+ rlServiceStop ladvd
+ rlSESetEnforce
+ rlSEStatus
+ rlPhaseEnd
+
+ rlPhaseStartTest "ladvd service selinux denials, bz#1834325"
+ rlServiceStart ladvd
+ sleep 2
+ rlRun "ausearch -m AVC -c ladvd --raw > /tmp/avcfile" 1
+ if grep "tclass=process2" /tmp/avcfile; then
+ grep "tclass=process2" /tmp/avcfile > /tmp/avc_class_file
+ rlAssertNotGrep "denied { nnp_transition }" /tmp/avc_class_file
+ else
+ rlLog "AVCs related to tclass process2 not found."
+ fi
+ if grep "tclass=packet_socket" /tmp/avcfile; then
+ grep "tclass=packet_socket" /tmp/avcfile > /tmp/avc_class_file
+ rlAssertNotGrep "denied { map }" /tmp/avc_class_file
+ else
+ rlLog "AVCs related to tclass packet_socket not found."
+ fi
+ rlSESearchRule "allow init_t ladvd_t : process2 { nnp_transition }"
+ rlSESearchRule "allow ladvd_t ladvd_t : packet_socket { map }"
+ rlSESearchRule "allow ladvd_t ladvd_t : capability { kill }"
+ rlServiceStop ladvd
+ rlPhaseEnd
+
+ rlPhaseStartTest "ladvd selinux denials due to libpcap, bz#1855163"
+ rlServiceStart ladvd
+ sleep 2
+ rlRun "ausearch -m AVC -c 'ladvd' --raw > /tmp/avcfile" 1
+ if grep "tclass=netlink_rdma_socket" /tmp/avcfile; then
+ grep "tclass=netlink_rdma_socket" /tmp/avcfile > /tmp/avc_class_file
+ rlAssertNotGrep "denied { create }" /tmp/avc_class_file
+ rlAssertNotGrep "denied { setopt }" /tmp/avc_class_file
+ rlAssertNotGrep "denied { bind }" /tmp/avc_class_file
+ rlAssertNotGrep "denied { getattr }" /tmp/avc_class_file
+ else
+ rlLog "AVCs related to tclass netlink_rdma_socket not found."
+ fi
+ rlSESearchRule "allow ladvd_t self : netlink_rdma_socket { bind create getattr setopt }"
+ rlPhaseEnd
+
+ rlPhaseStartCleanup
+ rlRun "rm -f /tmp/avcfile"
+ rlRun "rm -f /tmp/avc_class_file"
+ rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd
reply other threads:[~2026-09-11 13:18 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=178913269912.1.15198564613843457460.tests-selinux-1fad7c1e621e@fedoraproject.org \
--to=apeetham@redhat.com \
--cc=git-commits@fedoraproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox