public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
* [tests/selinux] pr775-checkpolicy-revdeps: homectl: Add test coverage for homectl
@ 2026-09-11 13:18 Amith Kumar
0 siblings, 0 replies; only message in thread
From: Amith Kumar @ 2026-09-11 13:18 UTC (permalink / raw)
To: git-commits
A new commit has been pushed.
Repo : tests/selinux
Branch : pr775-checkpolicy-revdeps
Commit : eadf0887228d4d18cb7ddc22c960de2321cf00ad
Author : Amith Kumar <apeetham@redhat.com>
Date : 2020-10-07T13:35:47+00:00
Stats : +298/-0 in 3 file(s)
URL : https://src.fedoraproject.org/tests/selinux/c/eadf0887228d4d18cb7ddc22c960de2321cf00ad?branch=pr775-checkpolicy-revdeps
Log:
homectl: Add test coverage for homectl
Add test coverage for SELinux AVC issues related to systemd-homed
service. The homectl program calls the systemd-homed service, which is
not yet confined, but it triggers SELinux denials. This test suite
provides coverage for command homectl along with its subcommands and
checks for avc denials.
Signed-off-by: Amith Kumar <apeetham@redhat.com>
---
diff --git a/selinux-policy/systemd-homed/Makefile b/selinux-policy/systemd-homed/Makefile
new file mode 100644
index 0000000..5c6ffd0
--- /dev/null
+++ b/selinux-policy/systemd-homed/Makefile
@@ -0,0 +1,69 @@
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+# Makefile of /CoreOS/selinux-policy/Regression/systemd-homed
+# Description: Test coverage for avc denials related to systemd-homed service.
+# Author: Amith Kumar <apeetham@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+# Copyright (c) 2012 Red Hat, Inc. All rights reserved.
+#
+# This copyrighted material is made available to anyone wishing
+# to use, modify, copy, or redistribute it subject to the terms
+# and conditions of the GNU General Public License version 2.
+#
+# This program is distributed in the hope that it will be
+# useful, but WITHOUT ANY WARRANTY; without even the implied
+# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+# PURPOSE. See the GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public
+# License along with this program; if not, write to the Free
+# Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+# Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+export TEST=/CoreOS/selinux-policy/Regression/systemd-homed
+export TESTVERSION=1.0
+
+BUILT_FILES=
+
+FILES=$(METADATA) runtest.sh Makefile PURPOSE
+
+.PHONY: all install download clean
+
+run: $(FILES) build
+ ./runtest.sh
+
+build: $(BUILT_FILES)
+ test -x runtest.sh || chmod a+x runtest.sh
+ test -x runtest.sh || chcon -t bin_t runtest.sh
+
+clean:
+ rm -f *~ $(BUILT_FILES)
+
+include /usr/share/rhts/lib/rhts-make.include
+
+$(METADATA): Makefile
+ @echo "Owner: Amith Kumar <apeetham@redhat.com>" > $(METADATA)
+ @echo "Name: $(TEST)" >> $(METADATA)
+ @echo "TestVersion: $(TESTVERSION)" >> $(METADATA)
+ @echo "Path: $(TEST_DIR)" >> $(METADATA)
+ @echo "Description: Tests for systemd-homed service" >> $(METADATA)
+ @echo "Type: Regression" >> $(METADATA)
+ @echo "TestTime: 1h" >> $(METADATA)
+ @echo "RunFor: selinux-policy" >> $(METADATA)
+ @echo "RunFor: systemd" >> $(METADATA)
+ @echo "Requires: audit expect initscripts systemd libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console" >> $(METADATA)
+ @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA)
+ @echo "Priority: Normal" >> $(METADATA)
+ @echo "License: GPLv2" >> $(METADATA)
+ @echo "Confidential: no" >> $(METADATA)
+ @echo "Destructive: no" >> $(METADATA)
+ @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA)
+ @echo "Releases: -RHEL4 -RHEL5" >> $(METADATA)
+ @echo "Bug: 1809878" >> $(METADATA) # Fedora 32
+
+ rhts-lint $(METADATA)
+
diff --git a/selinux-policy/systemd-homed/main.fmf b/selinux-policy/systemd-homed/main.fmf
new file mode 100644
index 0000000..e39d0e5
--- /dev/null
+++ b/selinux-policy/systemd-homed/main.fmf
@@ -0,0 +1,10 @@
+path: /selinux-policy/systemd-homed
+summary: Test homectl utility and its sub-commands to verify AVC denials
+description: |
+ Test coverage for SELinux AVC issues associated with systemd-homed
+ service. The homectl program calls the systemd-homed service, which
+ is not yet confined, but it triggers SELinux denials. This test suite
+ covers command homectl with its subcommands and checks for avc denials.
+relevancy:
+ - "distro = rhel-4, rhel-5, rhel-6, rhel-7: False"
+
diff --git a/selinux-policy/systemd-homed/runtest.sh b/selinux-policy/systemd-homed/runtest.sh
new file mode 100755
index 0000000..7c0a45f
--- /dev/null
+++ b/selinux-policy/systemd-homed/runtest.sh
@@ -0,0 +1,219 @@
+#!/bin/bash
+# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+# runtest.sh of /CoreOS/selinux-policy/Regression/systemd-homed
+# Description: Test coverage for SELinux AVC issues related to systemd-homed service.
+# Author: Amith Kumar <apeetham@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+# Copyright (c) 2012 Red Hat, Inc. All rights reserved.
+#
+# This copyrighted material is made available to anyone wishing
+# to use, modify, copy, or redistribute it subject to the terms
+# and conditions of the GNU General Public License version 2.
+#
+# This program is distributed in the hope that it will be
+# useful, but WITHOUT ANY WARRANTY; without even the implied
+# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+# PURPOSE. See the GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public
+# License along with this program; if not, write to the Free
+# Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+# Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include Beaker environment
+. /usr/bin/rhts-environment.sh || exit 1
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGE1="selinux-policy"
+PACKAGE2="systemd"
+
+function create_u() {
+expect -f - <<<'
+ set timeout -1
+ spawn homectl create test_u --disk-size=500M
+ expect "*: "
+ send -- "Red_123hat\r"
+ expect "*: "
+ send -- "Red_123hat\r"
+ expect eof
+ foreach {pid spawnid os_error_flag value} [wait] break
+ exit $value
+'
+}
+
+function activate_u() {
+expect -f - <<<'
+ set timeout -1
+ spawn homectl activate test_u
+ expect "*: "
+ send -- "Red_123hat\r"
+ expect eof
+ foreach {pid spawnid os_error_flag value} [wait] break
+ exit $value
+'
+}
+
+function unlock_u() {
+expect -f - <<<'
+ set timeout -1
+ spawn homectl unlock test_u
+ expect "*: "
+ send -- "Red_123hat\r"
+ expect eof
+ foreach {pid spawnid os_error_flag value} [wait] break
+ exit $value
+'
+}
+
+function passwd_u() {
+expect -f - <<<'
+ set timeout -1
+ spawn homectl passwd test_u
+ expect "*: "
+ send -- "Sim_123pl1\r"
+ expect "*: "
+ send -- "Sim_123pl1\r"
+ expect eof
+ foreach {pid spawnid os_error_flag value} [wait] break
+ exit $value
+'
+}
+
+function auth_u() {
+expect -f - <<<'
+ set timeout -1
+ spawn homectl authenticate test_u
+ expect "*: "
+ send -- "Sim_123pl1\r"
+ expect eof
+ foreach {pid spawnid os_error_flag value} [wait] break
+ exit $value
+'
+}
+
+function resize_u() {
+expect -f - <<<'
+ set timeout -1
+ spawn homectl resize test_u 425.0M
+ expect "*: "
+ send -- "Sim_123pl1\r"
+ expect eof
+ foreach {pid spawnid os_error_flag value} [wait] break
+ exit $value
+'
+}
+
+rlJournalStart
+ rlPhaseStartSetup
+ rlRun "rlImport 'selinux-policy/common'"
+ rlSESatisfyRequires
+ rlAssertRpm ${PACKAGE1}
+ rlAssertRpm ${PACKAGE1}-targeted
+ rlAssertRpm ${PACKAGE2}
+ rlSESetEnforce
+ rlSEStatus
+ rlSESetTimestamp
+ sleep 2
+ rlPhaseEnd
+
+ rlPhaseStartTest "homectl create"
+ rlRun "create_u"
+ rlRun "ausearch -m AVC -m USER_AVC -c systemd-homed -f mail" 1
+ rlRun "ausearch -m AVC -m USER_AVC -c systemd-homewor" 1
+ rlPhaseEnd
+
+ rlPhaseStartTest "homectl list"
+ sleep 20
+ tst_Time="$(date '+%T')"
+ rlRun "homectl list"
+ sleep 5
+ rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time" 1
+ rlPhaseEnd
+
+ rlPhaseStartTest "homectl activate"
+ sleep 20
+ tst_Time="$(date '+%T')"
+ rlRun "activate_u"
+ sleep 5
+ rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time" 1
+ rlPhaseEnd
+
+ rlPhaseStartTest "homectl inspect"
+ sleep 20
+ tst_Time="$(date '+%T')"
+ rlRun "homectl inspect test_u"
+ sleep 5
+ rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time" 1
+ rlPhaseEnd
+
+ rlPhaseStartTest "homectl update"
+ sleep 20
+ tst_Time="$(date '+%T')"
+ rlRun "homectl update test_u --email-address=test_u@redhat.com"
+ sleep 5
+ rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time" 1
+ rlPhaseEnd
+
+ rlPhaseStartTest "homectl lock"
+ sleep 20
+ tst_Time="$(date '+%T')"
+ rlRun "homectl lock test_u"
+ sleep 5
+ rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time" 1
+ rlPhaseEnd
+
+ rlPhaseStartTest "homectl unlock"
+ sleep 90
+ tst_Time="$(date '+%T')"
+ rlRun "unlock_u"
+ sleep 5
+ rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time" 1
+ rlPhaseEnd
+
+ rlPhaseStartTest "homectl passwd"
+ sleep 20
+ tst_Time="$(date '+%T')"
+ rlRun "passwd_u"
+ sleep 5
+ rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time" 1
+ rlPhaseEnd
+
+ rlPhaseStartTest "homectl authenticate"
+ sleep 90
+ tst_Time="$(date '+%T')"
+ rlRun "auth_u"
+ sleep 5
+ rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time" 1
+ rlPhaseEnd
+
+ rlPhaseStartTest "homectl deactivate and resize"
+ sleep 90
+ tst_Time="$(date '+%T')"
+ rlRun "homectl deactivate test_u"
+ sleep 60
+ rlRun "resize_u"
+ sleep 5
+ rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time" 1
+ rlPhaseEnd
+
+ rlPhaseStartTest "homectl remove"
+ sleep 20
+ tst_Time="$(date '+%T')"
+ rlRun "homectl remove test_u"
+ sleep 5
+ rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time" 1
+ rlPhaseEnd
+
+ rlPhaseStartCleanup
+ sleep 2
+ rlSECheckAVC
+ rlRun "rm -f /tmp/avcfile"
+ rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2026-09-11 13:18 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-09-11 13:18 [tests/selinux] pr775-checkpolicy-revdeps: homectl: Add test coverage for homectl Amith Kumar
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox