public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
* [tests/selinux] pr775-checkpolicy-revdeps: configure sshd to allow password auth for users
@ 2026-09-11 13:19 Milos Malik
0 siblings, 0 replies; only message in thread
From: Milos Malik @ 2026-09-11 13:19 UTC (permalink / raw)
To: git-commits
A new commit has been pushed.
Repo : tests/selinux
Branch : pr775-checkpolicy-revdeps
Commit : 0fdeb90e08016e6e68ccf7edadf6a7f924c3522c
Author : Milos Malik <mmalik@redhat.com>
Date : 2021-05-27T06:01:03+00:00
Stats : +38/-25 in 14 file(s)
URL : https://src.fedoraproject.org/tests/selinux/c/0fdeb90e08016e6e68ccf7edadf6a7f924c3522c?branch=pr775-checkpolicy-revdeps
Log:
configure sshd to allow password auth for users
Several TCs rely on the fact that tested users can login via SSH
using a password, but this option is disabled by default. If the
TCs should succeed the option must be enabled at least temporarily,
which is done in this change.
---
diff --git a/selinux-policy/Library/common/lib.sh b/selinux-policy/Library/common/lib.sh
index 21bd0bb..149e1a2 100644
--- a/selinux-policy/Library/common/lib.sh
+++ b/selinux-policy/Library/common/lib.sh
@@ -1285,6 +1285,13 @@ function rlSERunWithContext() {
}
+function rlSEConfigureSSH () {
+ rlFileBackup /etc/ssh/sshd_config
+ rlRun "sed -i 's/^.*PermitRootLogin.*$/PermitRootLogin yes/' /etc/ssh/sshd_config"
+ rlRun "sed -i 's/^.*PasswordAuthentication.*$/PasswordAuthentication yes/' /etc/ssh/sshd_config"
+ rlRun "service sshd restart"
+}
+
true <<'=cut'
=pod
diff --git a/selinux-policy/boltd-and-similar/runtest.sh b/selinux-policy/boltd-and-similar/runtest.sh
index bd26c50..73c0ae6 100755
--- a/selinux-policy/boltd-and-similar/runtest.sh
+++ b/selinux-policy/boltd-and-similar/runtest.sh
@@ -132,10 +132,7 @@ rlJournalStart
rlPhaseEnd
rlPhaseStartTest "real scenario -- confined users"
- rlFileBackup /etc/ssh/sshd_config
- rlRun "sed -i 's/^.*PermitRootLogin.*$/PermitRootLogin yes/' /etc/ssh/sshd_config"
- rlRun "sed -i 's/^.*PasswordAuthentication.*$/PasswordAuthentication yes/' /etc/ssh/sshd_config"
- rlRun "service sshd restart"
+ rlSEConfigureSSH
rlRun "setsebool ssh_sysadm_login on"
rlLog "configuration says not to test SELinux users: ${DENIED_USERS}"
diff --git a/selinux-policy/bz481628-send-msg-to-dbus/runtest.sh b/selinux-policy/bz481628-send-msg-to-dbus/runtest.sh
index 97c4f41..c0bdbd9 100755
--- a/selinux-policy/bz481628-send-msg-to-dbus/runtest.sh
+++ b/selinux-policy/bz481628-send-msg-to-dbus/runtest.sh
@@ -130,6 +130,8 @@ rlJournalStart
rlPhaseEnd
rlPhaseStartTest "real scenario -- user session service"
+ rlSEConfigureSSH
+
rlRun "setsebool ssh_sysadm_login on"
rlRun "setsebool selinuxuser_tcp_server on"
# TODO: guest_u, xguest_u cannot successfully run systemctl
@@ -161,6 +163,9 @@ rlJournalStart
sleep 2
rlSECheckAVC
rm -f files.txt
+
+ rlFileRestore
+ rlRun "service sshd restart"
rlPhaseEnd
rlJournalPrintText
rlJournalEnd
diff --git a/selinux-policy/colord-and-similar/runtest.sh b/selinux-policy/colord-and-similar/runtest.sh
index b385f8c..552a1bd 100755
--- a/selinux-policy/colord-and-similar/runtest.sh
+++ b/selinux-policy/colord-and-similar/runtest.sh
@@ -74,10 +74,7 @@ rlJournalStart
if ! rlIsRHEL 5 6 7 ; then
rlPhaseStartTest "real scenario -- user session service"
- rlFileBackup /etc/ssh/sshd_config
- rlRun "sed -i 's/^.*PermitRootLogin.*$/PermitRootLogin yes/' /etc/ssh/sshd_config"
- rlRun "sed -i 's/^.*PasswordAuthentication.*$/PasswordAuthentication yes/' /etc/ssh/sshd_config"
- rlRun "service sshd restart"
+ rlSEConfigureSSH
rlRun "setsebool ssh_sysadm_login on"
rlLog "configuration says not to test SELinux users: ${DENIED_USERS}"
diff --git a/selinux-policy/cups-pdf-and-similar/runtest.sh b/selinux-policy/cups-pdf-and-similar/runtest.sh
index 328ad07..9636625 100755
--- a/selinux-policy/cups-pdf-and-similar/runtest.sh
+++ b/selinux-policy/cups-pdf-and-similar/runtest.sh
@@ -108,6 +108,8 @@ rlJournalStart
rlPhaseEnd
rlPhaseStartTest "real scenario -- confined users"
+ rlSEConfigureSSH
+
rlRun "lpadmin -x cups-pdf" 0-255
rlRun "lpadmin -p cups-pdf -v cups-pdf:/ -E -P /usr/share/cups/model/CUPS-PDF_opt.ppd"
rlRun "setsebool ssh_sysadm_login on"
@@ -136,6 +138,7 @@ rlJournalStart
rlFileRestore
rlServiceRestore ${SERVICE_NAME}
+ rlRun "service sshd restart"
rlPhaseEnd
rlJournalPrintText
rlJournalEnd
diff --git a/selinux-policy/dmidecode-and-similar/runtest.sh b/selinux-policy/dmidecode-and-similar/runtest.sh
index 0defe7a..c488c8f 100755
--- a/selinux-policy/dmidecode-and-similar/runtest.sh
+++ b/selinux-policy/dmidecode-and-similar/runtest.sh
@@ -109,10 +109,7 @@ rlJournalStart
rlPhaseEnd
rlPhaseStartTest "real scenario -- confined users"
- rlFileBackup /etc/ssh/sshd_config
- rlRun "sed -i 's/^.*PermitRootLogin.*$/PermitRootLogin yes/' /etc/ssh/sshd_config"
- rlRun "sed -i 's/^.*PasswordAuthentication.*$/PasswordAuthentication yes/' /etc/ssh/sshd_config"
- rlRun "service sshd restart"
+ rlSEConfigureSSH
rlRun "setsebool ssh_sysadm_login on"
rlLog "configuration says not to test SELinux users: ${DENIED_USERS}"
diff --git a/selinux-policy/fwupd-and-similar/runtest.sh b/selinux-policy/fwupd-and-similar/runtest.sh
index 4a49c73..e7f5b3f 100755
--- a/selinux-policy/fwupd-and-similar/runtest.sh
+++ b/selinux-policy/fwupd-and-similar/runtest.sh
@@ -155,10 +155,7 @@ rlJournalStart
fi
rlPhaseStartTest "real scenario -- confined users -- bz#1772619"
- rlFileBackup /etc/ssh/sshd_config
- rlRun "sed -i 's/^.*PermitRootLogin.*$/PermitRootLogin yes/' /etc/ssh/sshd_config"
- rlRun "sed -i 's/^.*PasswordAuthentication.*$/PasswordAuthentication yes/' /etc/ssh/sshd_config"
- rlRun "service sshd restart"
+ rlSEConfigureSSH
rlRun "setsebool ssh_sysadm_login on"
rlLog "configuration says not to test SELinux users: ${DENIED_USERS}"
diff --git a/selinux-policy/journalctl-and-similar/runtest.sh b/selinux-policy/journalctl-and-similar/runtest.sh
index 7a53398..95e5d64 100755
--- a/selinux-policy/journalctl-and-similar/runtest.sh
+++ b/selinux-policy/journalctl-and-similar/runtest.sh
@@ -91,10 +91,7 @@ rlJournalStart
rlPhaseEnd
rlPhaseStartTest "real scenario -- confined users"
- rlFileBackup /etc/ssh/sshd_config
- rlRun "sed -i 's/^.*PermitRootLogin.*$/PermitRootLogin yes/' /etc/ssh/sshd_config"
- rlRun "sed -i 's/^.*PasswordAuthentication.*$/PasswordAuthentication yes/' /etc/ssh/sshd_config"
- rlRun "service sshd restart"
+ rlSEConfigureSSH
rlRun "setsebool ssh_sysadm_login on"
rlLog "configuration says not to test SELinux users: ${DENIED_USERS}"
diff --git a/selinux-policy/pam_console-and-related/runtest.sh b/selinux-policy/pam_console-and-related/runtest.sh
index 297d590..8d35eac 100755
--- a/selinux-policy/pam_console-and-related/runtest.sh
+++ b/selinux-policy/pam_console-and-related/runtest.sh
@@ -77,6 +77,8 @@ rlJournalStart
fi
rlPhaseStartTest "real scenario -- confined users"
+ rlSEConfigureSSH
+
rlRun "setsebool ssh_sysadm_login on"
rlLog "configuration says not to test SELinux users: ${DENIED_USERS}"
for SELINUX_USER in ${ALLOWED_USERS} ; do
@@ -108,6 +110,7 @@ rlJournalStart
rlSECheckAVC
rlFileRestore
+ rlRun "service sshd restart"
rlPhaseEnd
rlJournalPrintText
rlJournalEnd
diff --git a/selinux-policy/pam_timestamp-and-related/runtest.sh b/selinux-policy/pam_timestamp-and-related/runtest.sh
index d808a62..051cdaa 100755
--- a/selinux-policy/pam_timestamp-and-related/runtest.sh
+++ b/selinux-policy/pam_timestamp-and-related/runtest.sh
@@ -70,6 +70,8 @@ rlJournalStart
fi
rlPhaseStartTest "real scenario -- confined users"
+ rlSEConfigureSSH
+
rlRun "setsebool ssh_sysadm_login on"
rlRun "mkdir -p ${TIMESTAMP_DIR}"
rlRun "touch ${TIMESTAMP_DIR}/_pam_timestamp_key"
@@ -99,7 +101,9 @@ rlJournalStart
sleep 2
rlSECheckAVC
rlRun "rm -f ${TIMESTAMP_DIR}/_pam_timestamp_key"
+
rlFileRestore
+ rlRun "service sshd restart"
rlPhaseEnd
rlJournalPrintText
rlJournalEnd
diff --git a/selinux-policy/perf_event-and-related/runtest.sh b/selinux-policy/perf_event-and-related/runtest.sh
index a971635..f5fb5c1 100755
--- a/selinux-policy/perf_event-and-related/runtest.sh
+++ b/selinux-policy/perf_event-and-related/runtest.sh
@@ -72,11 +72,8 @@ rlJournalStart
rlPhaseEnd
rlPhaseStartTest "real scenario -- confined root sysadm_u"
- rlRun "grep -i permit /etc/ssh/sshd_config"
- rlFileBackup /etc/ssh/sshd_config
- rlRun "sed -i 's/^.*PermitRootLogin.*$/PermitRootLogin yes/' /etc/ssh/sshd_config"
- rlRun "sed -i 's/^.*PasswordAuthentication.*$/PasswordAuthentication yes/' /etc/ssh/sshd_config"
- rlRun "service sshd restart"
+ rlSEConfigureSSH
+
rlRun "setsebool ssh_sysadm_login on"
USER_NAME="toor"
USER_SECRET="S3kr3t${RANDOM}"
diff --git a/selinux-policy/ping-and-similar/runtest.sh b/selinux-policy/ping-and-similar/runtest.sh
index 83a004f..e00656a 100755
--- a/selinux-policy/ping-and-similar/runtest.sh
+++ b/selinux-policy/ping-and-similar/runtest.sh
@@ -90,6 +90,8 @@ rlJournalStart
# this phase is useful if you want to run some commands under confined users
rlPhaseStartTest "real scenario -- confined users"
+ rlSEConfigureSSH
+
rlRun "setsebool ssh_sysadm_login on"
rlRun "setsebool user_ping on"
for SELINUX_USER in staff_u user_u sysadm_u unconfined_u ; do
@@ -116,6 +118,7 @@ rlJournalStart
rlSECheckAVC
rlFileRestore
+ rlRun "service sshd restart"
rlPhaseEnd
rlJournalPrintText
rlJournalEnd
diff --git a/selinux-policy/policykit-general/runtest.sh b/selinux-policy/policykit-general/runtest.sh
index 867f2de..b3b11e5 100755
--- a/selinux-policy/policykit-general/runtest.sh
+++ b/selinux-policy/policykit-general/runtest.sh
@@ -149,6 +149,8 @@ rlJournalStart
rlPhaseEnd
rlPhaseStartTest "real scenario -- confined users"
+ rlSEConfigureSSH
+
rlRun "setsebool ssh_sysadm_login on"
for SELINUX_USER in ${ALLOWED_USERS} ; do
USER_NAME="user${RANDOM}"
@@ -169,6 +171,7 @@ rlJournalStart
rlFileRestore
rlServiceRestore ${SERVICE_NAME}
+ rlRun "service sshd restart"
rlPhaseEnd
rlJournalPrintText
rlJournalEnd
diff --git a/selinux-policy/systemd-userdbd-and-similar/runtest.sh b/selinux-policy/systemd-userdbd-and-similar/runtest.sh
index 9fba8c9..f817604 100755
--- a/selinux-policy/systemd-userdbd-and-similar/runtest.sh
+++ b/selinux-policy/systemd-userdbd-and-similar/runtest.sh
@@ -82,6 +82,8 @@ rlJournalStart
fi
rlPhaseStartTest "real scenario -- confined users"
+ rlSEConfigureSSH
+
rlRun "setsebool ssh_sysadm_login on"
rlRun "setsebool selinuxuser_tcp_server on"
rlLog "configuration says not to test SELinux users: ${DENIED_USERS}"
@@ -126,6 +128,7 @@ rlJournalStart
rlFileRestore
rlServiceRestore ${SERVICE_NAME}
+ rlRun "service sshd restart"
rlPhaseEnd
rlJournalPrintText
rlJournalEnd
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2026-09-11 13:19 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-09-11 13:19 [tests/selinux] pr775-checkpolicy-revdeps: configure sshd to allow password auth for users Milos Malik
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox