public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
From: Petr Lautrbach <plautrba@redhat.com>
To: git-commits@fedoraproject.org
Subject: [tests/selinux] pr775-checkpolicy-revdeps: Rework "usepasswd in semanage.conf" test
Date: Fri, 11 Sep 2026 13:18:40 GMT [thread overview]
Message-ID: <178913272004.1.126518811714572992.tests-selinux-2cb83d9acd11@fedoraproject.org> (raw)
A new commit has been pushed.
Repo : tests/selinux
Branch : pr775-checkpolicy-revdeps
Commit : 2cb83d9acd1102bca40dd449a9df8b923056e001
Author : Petr Lautrbach <plautrba@redhat.com>
Date : 2020-12-21T14:15:57+01:00
Stats : +106/-37 in 1 file(s)
URL : https://src.fedoraproject.org/tests/selinux/c/2cb83d9acd1102bca40dd449a9df8b923056e001?branch=pr775-checkpolicy-revdeps
Log:
Rework "usepasswd in semanage.conf" test
- use spaces instead of tabs
- update copyright date
- cover more cases with correct behavior
usepasswd=False
- Standard users should not trigger a policy change
- SELinux users with home in / shoud not trigger a policy change
- Other SELinux users should trigger a policy change
usepasswd=True
- Standard users with home in /home should not trigger a policy change
- Standard users with home in directory like /var/home should trigger a policy change
- Standard users with home in / shoud not trigger a policy change
- SELinux users with home in / shoud not trigger a policy change
- Other SELinux users should trigger a policy change
---
diff --git a/libsemanage/usepasswd-in-semanage-conf/runtest.sh b/libsemanage/usepasswd-in-semanage-conf/runtest.sh
index d11a837..8aadf23 100755
--- a/libsemanage/usepasswd-in-semanage-conf/runtest.sh
+++ b/libsemanage/usepasswd-in-semanage-conf/runtest.sh
@@ -5,10 +5,11 @@
# runtest.sh of /CoreOS/libsemanage/Sanity/usepasswd-in-semanage-conf
# Description: Make sure usepasswd option in semanage.conf works properly
# Author: Vit Mojzis <vmojzis@redhat.com>
+# Author: Petr Lautrbach <plautrba@redhat.com>
#
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#
-# Copyright (c) 2016 Red Hat, Inc.
+# Copyright (c) 2020 Red Hat, Inc.
#
# This copyrighted material is made available to anyone wishing
# to use, modify, copy, or redistribute it subject to the terms
@@ -27,50 +28,118 @@
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
# Include Beaker environment
-. /usr/bin/rhts-environment.sh || exit 1
. /usr/share/beakerlib/beakerlib.sh || exit 1
PACKAGE="libsemanage"
SEMANAGE_CONF="/etc/selinux/semanage.conf"
rlJournalStart
- rlPhaseStartSetup
- rlAssertRpm ${PACKAGE}
- rlAssertRpm policycoreutils
- rlAssertRpm selinux-policy
- rlFileBackup ${SEMANAGE_CONF}
- rlRun "rpm -qf /usr/sbin/semanage"
- rlRun "grep -v -e '^#' -e '^$' ${SEMANAGE_CONF}"
- OUTPUT_FILE=`mktemp`
- CMP_FILE=`mktemp`
- rlRun "setenforce 1"
- rlRun "sestatus"
+ rlPhaseStartSetup
+ rlAssertRpm ${PACKAGE}
+ rlAssertRpm policycoreutils
+ rlAssertRpm selinux-policy
+ rlRun "rpm -qf /usr/sbin/semanage"
+ rlRun "grep -v -e '^#' -e '^$' ${SEMANAGE_CONF}"
+ OUTPUT_FILE=`mktemp`
+ CMP_FILE=`mktemp`
+ rlRun "setenforce 1"
+ rlRun "sestatus"
rlPhaseEnd
- rlPhaseStartTest "usepasswd=False"
- rlRun 'sed -i "s|usepasswd=.*$|usepasswd=False|g" ${SEMANAGE_CONF}'
- rlRun 'semodule -B' # rebuild file_contexts.homedirs
- rlRun "semanage fcontext -l 2>&1 > ${CMP_FILE}" # save file contexts for comparison
- rlRun 'useradd -Z unconfined_u duck'
- rlRun 'semanage login -l | grep duck' 0
- rlRun "semanage fcontext -l 2>&1 > ${OUTPUT_FILE}"
- rlRun "diff ${CMP_FILE} ${OUTPUT_FILE}" 0
- rlPhaseEnd
-
- rlPhaseStartTest "usepasswd=True"
- rlRun 'sed -i "s|usepasswd=.*$|usepasswd=True|g" ${SEMANAGE_CONF}'
- rlRun 'semodule -B' # rebuild file_contexts.homedirs
- rlRun "semanage fcontext -l 2>&1 > ${OUTPUT_FILE}" # file context with new selinux login
- rlRun 'semanage login -d duck'
- rlRun "semanage fcontext -l 2>&1 > ${CMP_FILE}"
- rlRun "diff ${CMP_FILE} ${OUTPUT_FILE} | grep duck"
- rlPhaseEnd
-
- rlPhaseStartCleanup
- rlRun "rm -f ${OUTPUT_FILE} ${CMP_FILE}"
- rlRun "userdel duck"
- rlFileRestore
- rlPhaseEnd
+ # usepasswd=False - generate contexts for user with explicit SELinux mapping
+ rlPhaseStartTest "usepasswd=False"
+ rlFileBackup ${SEMANAGE_CONF}
+
+ rlRun "sed -i 's|usepasswd=.*$|usepasswd=False|g' ${SEMANAGE_CONF}"
+ rlRun "semodule -B" # rebuild file_contexts.homedirs
+ rlRun "semanage fcontext -l 2>&1 > ${CMP_FILE}" # save file contexts for comparison
+
+ rlLog "Standard users should not trigger a policy change"
+ rlRun "useradd duck-home"
+ rlRun "useradd -d /tmp duck-tmp"
+ rlRun "useradd -d /var/lib/duck duck-var-lib"
+ rlRun "semodule -B" # rebuild file_contexts.homedirs
+ rlRun "semanage fcontext -l 2>&1 > ${OUTPUT_FILE}" # file context with new selinux login
+ rlRun "diff -u ${CMP_FILE} ${OUTPUT_FILE}" 0
+ rlRun "userdel duck-home"
+ rlRun "userdel duck-tmp"
+ rlRun "userdel duck-var-lib"
+
+ rlLog "SELinux users with home in / shoud not trigger a policy change"
+ rlRun "useradd -Z unconfined_u -d /tmp duck-tmp"
+ rlRun "useradd -Z unconfined_u -d /var duck-var"
+ rlRun "semodule -B" # rebuild file_contexts.homedirs
+ rlRun "semanage fcontext -l 2>&1 > ${OUTPUT_FILE}" # file context with new selinux login
+ rlRun "diff -u ${CMP_FILE} ${OUTPUT_FILE}" 0
+ rlRun "userdel -Z duck-tmp"
+ rlRun "userdel -Z duck-var"
+
+ rlLog "Other SELinux users should trigger a policy change"
+ rlRun "useradd -Z unconfined_u duck-home"
+ rlRun "useradd -Z unconfined_u -d /var/home duck-var-home"
+ rlRun "semodule -B" # rebuild file_contexts.homedirs
+ rlRun "semanage fcontext -l 2>&1 > ${OUTPUT_FILE}" # file context with new selinux login
+ rlRun "diff -u ${CMP_FILE} ${OUTPUT_FILE} | grep -E 'duck-(home|var-home)'" 0
+ rlRun "userdel -Z duck-home"
+ rlRun "userdel -Z duck-var-home"
+
+ rlFileRestore
+ rlPhaseEnd
+
+ rlPhaseStartTest "usepasswd=True"
+ rlFileBackup ${SEMANAGE_CONF}
+
+ rlRun "sed -i 's|usepasswd=.*$|usepasswd=True|g' ${SEMANAGE_CONF}"
+ rlRun "semodule -B" # rebuild file_contexts.homedirs
+ rlRun "semanage fcontext -l 2>&1 > ${CMP_FILE}" # save file contexts for comparison
+
+ rlLog "Standard users with home in /home should not trigger a policy change"
+ rlRun "useradd duck-home"
+ rlRun "semodule -B" # rebuild file_contexts.homedirs
+ rlRun "semanage fcontext -l 2>&1 > ${OUTPUT_FILE}" # file context with new selinux login
+ rlRun "diff -u ${CMP_FILE} ${OUTPUT_FILE}" 0
+ rlRun "userdel duck-home"
+
+ rlLog "Standard users with home in directory like /var/home should trigger a policy change"
+ rlRun "useradd -d /var/home/duck duck-var-home"
+ rlRun "semodule -B" # rebuild file_contexts.homedirs
+ rlRun "semanage fcontext -l 2>&1 > ${OUTPUT_FILE}" # file context with new selinux login
+ rlRun "diff -u ${CMP_FILE} ${OUTPUT_FILE} | grep -E '/var/home/'" 0
+ rlRun "userdel duck-var-home"
+
+ rlLog "Standard users with home in / shoud not trigger a policy change"
+ rlRun "useradd -d /tmp duck-tmp"
+ rlRun "useradd -d /var duck-var"
+ rlRun "semodule -B" # rebuild file_contexts.homedirs
+ rlRun "semanage fcontext -l 2>&1 > ${OUTPUT_FILE}" # file context with new selinux login
+ rlRun "diff -u ${CMP_FILE} ${OUTPUT_FILE}" 0
+ rlRun "userdel -Z duck-tmp"
+ rlRun "userdel -Z duck-var"
+
+ rlLog "SELinux users with home in / shoud not trigger a policy change"
+ rlRun "useradd -Z unconfined_u -d /tmp duck-tmp"
+ rlRun "useradd -Z unconfined_u -d /var duck-var"
+ rlRun "semodule -B" # rebuild file_contexts.homedirs
+ rlRun "semanage fcontext -l 2>&1 > ${OUTPUT_FILE}" # file context with new selinux login
+ rlRun "diff -u ${CMP_FILE} ${OUTPUT_FILE}" 0
+ rlRun "userdel -Z duck-tmp"
+ rlRun "userdel -Z duck-var"
+
+ rlLog "Other SELinux users should trigger a policy change"
+ rlRun "useradd -Z unconfined_u duck-home"
+ rlRun "useradd -Z unconfined_u -d /var/home duck-var-home"
+ rlRun "semodule -B" # rebuild file_contexts.homedirs
+ rlRun "semanage fcontext -l 2>&1 > ${OUTPUT_FILE}" # file context with new selinux login
+ rlRun "diff -u ${CMP_FILE} ${OUTPUT_FILE} | grep -E 'duck-(home|var-home)'" 0
+ rlRun "userdel -Z duck-home"
+ rlRun "userdel -Z duck-var-home"
+
+ rlFileRestore
+ rlPhaseEnd
+
+ rlPhaseStartCleanup
+ rlRun "rm -f ${OUTPUT_FILE} ${CMP_FILE}"
+ rlPhaseEnd
rlJournalPrintText
rlJournalEnd
reply other threads:[~2026-09-11 13:18 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=178913272004.1.126518811714572992.tests-selinux-2cb83d9acd11@fedoraproject.org \
--to=plautrba@redhat.com \
--cc=git-commits@fedoraproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox