public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
* [tests/selinux] pr775-checkpolicy-revdeps: kernel/selinux-testsuite: bump upstream ref
@ 2026-09-11 13:19 Ondrej Mosnacek
  0 siblings, 0 replies; 6+ messages in thread
From: Ondrej Mosnacek @ 2026-09-11 13:19 UTC (permalink / raw)
  To: git-commits

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 0f43ff1aad958a36cc7fef05f0555735f402cb58
            Author : Ondrej Mosnacek <omosnace@redhat.com>
            Date   : 2021-09-27T10:52:19+02:00
            Stats  : +2/-2 in 1 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/0f43ff1aad958a36cc7fef05f0555735f402cb58?branch=pr775-checkpolicy-revdeps

            Log:
            kernel/selinux-testsuite: bump upstream ref

This revision integrates two patch series and adds a fix for:
https://gitlab.com/cki-project/kernel-tests/-/issues/750

Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>

---
diff --git a/kernel/selinux-testsuite/runtest.sh b/kernel/selinux-testsuite/runtest.sh
index bafc765..728c237 100755
--- a/kernel/selinux-testsuite/runtest.sh
+++ b/kernel/selinux-testsuite/runtest.sh
@@ -35,13 +35,13 @@ PACKAGE="selinux-policy"
 # This should be updated as needed after verifying that the new version
 # doesn't break testing and after applying all necessary tweaks in the TC.
 # Run with GIT_BRANCH=master to run the latest upstream version.
-DEFAULT_COMMIT="4ed5d11312d673203d93dafbcdad441c3afc36f9"
+DEFAULT_COMMIT="29c42c865a9f43a15ae72ebd19642c3d88a7d5ce"
 # Default pull requests to merge before running the test.
 # If non-empty, then after checking out GIT_BRANCH the listed upstream pull
 # requests (by number) are merged, creating a new temporary local branch.
 DEFAULT_PULLS=""
 # Default SELinux Patchwork series to apply before running the test.
-DEFAULT_PATCHES="542465 543757"
+DEFAULT_PATCHES=""
 
 # Optional test parameter - location of testuite git.
 GIT_URL=${GIT_URL:-"git://github.com/SELinuxProject/selinux-testsuite"}

^ permalink raw reply related	[flat|nested] 6+ messages in thread
* [tests/selinux] pr775-checkpolicy-revdeps: kernel/selinux-testsuite: bump upstream ref
@ 2026-09-11 13:23 Ondrej Mosnacek
  0 siblings, 0 replies; 6+ messages in thread
From: Ondrej Mosnacek @ 2026-09-11 13:23 UTC (permalink / raw)
  To: git-commits

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : f0131ccacae22f53b119cd5d59d4ed1581dfbe18
            Author : Ondrej Mosnacek <omosnace@redhat.com>
            Date   : 2025-07-09T11:38:04+02:00
            Stats  : +1/-1 in 1 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/f0131ccacae22f53b119cd5d59d4ed1581dfbe18?branch=pr775-checkpolicy-revdeps

            Log:
            kernel/selinux-testsuite: bump upstream ref

The only important commit is 72e60b601832 ("policy/test_secretmem.te:
add anon_inode perms required in Linux v6.16-rc5"), which fixes the
testsuite to work on 6.16-rc5+ kernels.

Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>

---
diff --git a/kernel/selinux-testsuite/runtest.sh b/kernel/selinux-testsuite/runtest.sh
index dbb1e56..cefb9e1 100755
--- a/kernel/selinux-testsuite/runtest.sh
+++ b/kernel/selinux-testsuite/runtest.sh
@@ -35,7 +35,7 @@ PACKAGE="selinux-policy"
 # This should be updated as needed after verifying that the new version
 # doesn't break testing and after applying all necessary tweaks in the TC.
 # Run with GIT_BRANCH=master to run the latest upstream version.
-DEFAULT_COMMIT="7a25c1a8a1c30e46409f81ee82fe53850ad7f1e3"
+DEFAULT_COMMIT="72e60b6018321a3da9d5e328477e29ee7366e498"
 # Default pull requests to merge before running the test.
 # If non-empty, then after checking out GIT_BRANCH the listed upstream pull
 # requests (by number) are merged, creating a new temporary local branch.

^ permalink raw reply related	[flat|nested] 6+ messages in thread
* [tests/selinux] pr775-checkpolicy-revdeps: kernel/selinux-testsuite: bump upstream ref
@ 2026-09-11 13:19 Ondrej Mosnacek
  0 siblings, 0 replies; 6+ messages in thread
From: Ondrej Mosnacek @ 2026-09-11 13:19 UTC (permalink / raw)
  To: git-commits

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : c1eb05380135ceaae0eb51c3de56730de065b5cb
            Author : Ondrej Mosnacek <omosnace@redhat.com>
            Date   : 2021-10-13T11:02:27+02:00
            Stats  : +1/-1 in 1 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/c1eb05380135ceaae0eb51c3de56730de065b5cb?branch=pr775-checkpolicy-revdeps

            Log:
            kernel/selinux-testsuite: bump upstream ref

This pulls in the lockdown test removal, which will be needed for
successful testing of new kernels.

Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>

---
diff --git a/kernel/selinux-testsuite/runtest.sh b/kernel/selinux-testsuite/runtest.sh
index 728c237..583276f 100755
--- a/kernel/selinux-testsuite/runtest.sh
+++ b/kernel/selinux-testsuite/runtest.sh
@@ -35,7 +35,7 @@ PACKAGE="selinux-policy"
 # This should be updated as needed after verifying that the new version
 # doesn't break testing and after applying all necessary tweaks in the TC.
 # Run with GIT_BRANCH=master to run the latest upstream version.
-DEFAULT_COMMIT="29c42c865a9f43a15ae72ebd19642c3d88a7d5ce"
+DEFAULT_COMMIT="bba37c007a0c7a12dd603bdac5e4431796f3e2e1"
 # Default pull requests to merge before running the test.
 # If non-empty, then after checking out GIT_BRANCH the listed upstream pull
 # requests (by number) are merged, creating a new temporary local branch.

^ permalink raw reply related	[flat|nested] 6+ messages in thread
* [tests/selinux] pr775-checkpolicy-revdeps: kernel/selinux-testsuite: Bump upstream ref
@ 2026-09-11 13:18 Ondrej Mosnacek
  0 siblings, 0 replies; 6+ messages in thread
From: Ondrej Mosnacek @ 2026-09-11 13:18 UTC (permalink / raw)
  To: git-commits

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 09d35a1f290fd5a17842a64507d14628d578672c
            Author : Ondrej Mosnacek <omosnace@redhat.com>
            Date   : 2020-10-23T20:13:17+02:00
            Stats  : +1/-10 in 1 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/09d35a1f290fd5a17842a64507d14628d578672c?branch=pr775-checkpolicy-revdeps

            Log:
            kernel/selinux-testsuite: Bump upstream ref

Highlights:
 - SCTP tests have been refactored and extended
 - the "keys" subtest has been fixed to not fail when Intel QAT driver
   is used for DH acceleration
 - the GRE interface for a second IP address is now created
   automatically by the testsuite

Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>

---
diff --git a/kernel/selinux-testsuite/runtest.sh b/kernel/selinux-testsuite/runtest.sh
index 04c9937..1a481ac 100755
--- a/kernel/selinux-testsuite/runtest.sh
+++ b/kernel/selinux-testsuite/runtest.sh
@@ -35,7 +35,7 @@ PACKAGE="selinux-policy"
 # This should be updated as needed after verifying that the new version
 # doesn't break testing and after applying all necessary tweaks in the TC.
 # Run with GIT_BRANCH=master to run the latest upstream version.
-DEFAULT_COMMIT="03872ef3c206e56a90ef7df7c1042895c7096cc3"
+DEFAULT_COMMIT="0c8e8d550f95b41ad64624d3f3e149bf3c6f290c"
 # Default pull requests to merge before running the test.
 # If non-empty, then after checking out GIT_BRANCH the listed upstream pull
 # requests (by number) are merged, creating a new temporary local branch.
@@ -455,14 +455,6 @@ rlJournalStart
         rlRun "AUDIT_FILE=\"\$(mktemp)\""
         rlRun "auditctl -w \"\$AUDIT_FILE\" -p w" 0 \
             "Enable creation of PATH audit records"
-
-        # Get another global IPv4 address to allow running a few extra SCTP tests.
-        rlRun "ip link add mygre type gretap local 127.0.0.1 remote 127.0.0.1" 0 \
-            "Set up a GRE tunnel to get one more global IPv4 address"
-        rlRun "ip addr add 10.123.123.123 dev mygre" 0 \
-            "Add a dummy address to the GRE tunnel interface"
-        rlRun "ip link set mygre up" 0 \
-            "Activate the GRE interface"
     rlPhaseEnd
 
     rlPhaseStartTest
@@ -477,7 +469,6 @@ rlJournalStart
     rlPhaseEnd
 
     rlPhaseStartCleanup
-        rlRun "ip link del mygre"
         rlRun "auditctl -W \"\$AUDIT_FILE\" -p w" 0 \
             "Remove rule for creation of PATH audit records"
         rlRun "rm -f \"\$AUDIT_FILE\""

^ permalink raw reply related	[flat|nested] 6+ messages in thread
* [tests/selinux] pr775-checkpolicy-revdeps: kernel/selinux-testsuite: bump upstream ref
@ 2026-09-11 13:18 Ondrej Mosnacek
  0 siblings, 0 replies; 6+ messages in thread
From: Ondrej Mosnacek @ 2026-09-11 13:18 UTC (permalink / raw)
  To: git-commits

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 10f9a3da400c551fce330cebc14ca9a6a528ee8c
            Author : Ondrej Mosnacek <omosnace@redhat.com>
            Date   : 2020-07-15T13:37:11+02:00
            Stats  : +30/-5 in 1 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/10f9a3da400c551fce330cebc14ca9a6a528ee8c?branch=pr775-checkpolicy-revdeps

            Log:
            kernel/selinux-testsuite: bump upstream ref

Highlights:
 - Use native filesystem for FS tests
 - Avoid mmap test failures when /dev is mounted noexec
 - Add nftables to inet_socket and sctp tests
 - Fix overlayfs test false positive on new kernels (previously applied
   as a patch)
 - Add check for key changes on watch_queue

Several RHEL workarounds were needed, see the diff for details.

Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>

---
diff --git a/kernel/selinux-testsuite/runtest.sh b/kernel/selinux-testsuite/runtest.sh
index a3bc970..0f789f5 100755
--- a/kernel/selinux-testsuite/runtest.sh
+++ b/kernel/selinux-testsuite/runtest.sh
@@ -35,14 +35,13 @@ PACKAGE="selinux-policy"
 # This should be updated as needed after verifying that the new version
 # doesn't break testing and after applying all necessary tweaks in the TC.
 # Run with GIT_BRANCH=master to run the latest upstream version.
-DEFAULT_COMMIT="04fb49b946b9cb48ff75d770d4c16338463b1814"
+DEFAULT_COMMIT="03872ef3c206e56a90ef7df7c1042895c7096cc3"
 # Default pull requests to merge before running the test.
 # If non-empty, then after checking out GIT_BRANCH the listed upstream pull
 # requests (by number) are merged, creating a new temporary local branch.
 DEFAULT_PULLS=""
 # Default SELinux Patchwork series to apply before running the test.
-DEFAULT_PATCHES="297289"
-# 297289 - policy/test_overlayfs.te: allow mounter to create whiteouts
+DEFAULT_PATCHES=""
 
 # Optional test parameter - location of testuite git.
 GIT_URL=${GIT_URL:-"git://github.com/SELinuxProject/selinux-testsuite"}
@@ -160,6 +159,7 @@ rlJournalStart
             libselinux-utils
             libsemanage
             libsepol-devel
+            libuuid-devel
             lksctp-tools-devel
             mktemp
             nc
@@ -182,6 +182,7 @@ rlJournalStart
             selinux-policy-devel
             setools-console
             which
+            xfsprogs-devel
         "
         rlRun "installDeps \$REQUIRES" 0 "Install requires"
 
@@ -217,6 +218,12 @@ rlJournalStart
             selinuxfs=/selinux
         fi
 
+        if rlIsRHEL '<7.3'; then
+            use_cil=n
+        else
+            use_cil=y
+        fi
+
         # test turns this boolean off
         rlRun "BACKUP_allow_domain_fd_use=\$(boolGet allow_domain_fd_use)"
         rlRun "BACKUP_domain_can_mmap_files=\$(boolGet domain_can_mmap_files)"
@@ -342,6 +349,11 @@ rlJournalStart
         rlRun "sed -i 's/tm\.tv_sec = [0-9]*;/tm.tv_sec = $NETWORK_TIMEOUT;/' ./tests/*/*.c" 0 \
             "Tweak timeout in networking tests" # 2 secs is too little for SCTP test
 
+        if kver_lt "3.10" || rlIsRHEL '<7.4'; then
+            # filesystem tests don't work well on RHEL <7.4
+            exclude_tests+=" filesystem"
+        fi
+
         if kver_lt "3.10.0-349"; then
             # c4684bbdac07 [security] selinux: Permit bounded transitions under NO_NEW_PRIVS or NOSUID
             # da74590f6501 [security] selinux: reject setexeccon() on MNT_NOSUID applications with -EACCES
@@ -369,6 +381,18 @@ rlJournalStart
             rlRun "cat >>policy/test_mmap.te <<<'allow_map(test_no_execmem_t, tmpfs_t, file)'"
         fi
 
+        if rlIsRHEL; then
+            # Needs:
+            # e4cfa05e9bfe ("selinux: Add xfs quota command types")
+            # (not backported to any RHEL at this point - TODO update the check once it is)
+            script1='s/\$test_count += 62;/$test_count = 55;/g'
+            script2='s/\$quota_checks += 1;/$quota_checks = 0;/g'
+            # for some reason this is needed for older RHEL 7 versions...
+            script3='s/\$test_count += 69;/$test_count = 55;/g'
+            rlRun "sed -i -E -e '$script1' -e '$script2' -e '$script3' tests/filesystem/test" 0 \
+                "Apply workaround for missing XFS quota checks"
+        fi
+
         # CKI mainline kernels don't ship with module build infrastructure
         # just yet. Also, RHEL-8 CKI kernel-devel programs are
         # cross-compiled badly for alt arches, so try executing one of them.
@@ -438,10 +462,11 @@ rlJournalStart
 
     rlPhaseStartTest
         rlRun "pushd selinux-testsuite"
-        rlRun "$TS_ENV make SELINUXFS=$selinuxfs" 0
+        make_vars="SELINUXFS=$selinuxfs SUPPORTS_CIL=$use_cil"
+        rlRun "$TS_ENV make $make_vars" 0
         rlRun "cat results.log" 0
         $PIPEFAIL_ENABLE
-        rlRun "$TS_ENV unbuffer make -s test SELINUXFS=$selinuxfs 2>&1 | tee -a results.log" 0
+        rlRun "$TS_ENV unbuffer make -s test $make_vars 2>&1 | tee -a results.log" 0
         $PIPEFAIL_DISABLE
         rlRun "popd"
     rlPhaseEnd

^ permalink raw reply related	[flat|nested] 6+ messages in thread
* [tests/selinux] pr775-checkpolicy-revdeps: kernel/selinux-testsuite: bump upstream ref
@ 2026-09-11 13:17 Ondrej Mosnacek
  0 siblings, 0 replies; 6+ messages in thread
From: Ondrej Mosnacek @ 2026-09-11 13:17 UTC (permalink / raw)
  To: git-commits

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 382ea52b682de59fd86590be40b39b53b0059a8e
            Author : Ondrej Mosnacek <omosnace@redhat.com>
            Date   : 2020-04-16T23:51:32+02:00
            Stats  : +1/-10 in 1 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/382ea52b682de59fd86590be40b39b53b0059a8e?branch=pr775-checkpolicy-revdeps

            Log:
            kernel/selinux-testsuite: bump upstream ref

...and remove a workaround that is now obsoleted by an upstream patch.

Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>

---
diff --git a/kernel/selinux-testsuite/runtest.sh b/kernel/selinux-testsuite/runtest.sh
index 283c993..090c34d 100755
--- a/kernel/selinux-testsuite/runtest.sh
+++ b/kernel/selinux-testsuite/runtest.sh
@@ -35,7 +35,7 @@ PACKAGE="selinux-policy"
 # This should be updated as needed after verifying that the new version
 # doesn't break testing and after applying all necessary tweaks in the TC.
 # Run with GIT_BRANCH=master to run the latest upstream version.
-DEFAULT_COMMIT="e95fe950381682a18c93a0952b995eb975cb5c2e"
+DEFAULT_COMMIT="04fb49b946b9cb48ff75d770d4c16338463b1814"
 # Default pull requests to merge before running the test.
 # If non-empty, then after checking out GIT_BRANCH the listed upstream pull
 # requests (by number) are merged, creating a new temporary local branch.
@@ -361,15 +361,6 @@ rlJournalStart
                 rlRun "cat >>policy/test_mmap.te <<<'allow_map(test_no_execmem_t, tmpfs_t, file)'"
             fi
 
-            if [ -f /proc/sys/kernel/unprivileged_bpf_disabled ] &&
-               [ "$(cat /proc/sys/kernel/unprivileged_bpf_disabled)" -eq 1 ] ||
-               [ "$(rlGetPrimaryArch)" != x86_64 ]
-            then
-                rlLog "Unprivileged BPF disabled => add CAP_SYS_ADMIN to BPF domains"
-                rlRun "echo 'allow bpfdomain self:capability { sys_admin };' >>policy/test_bpf.te"
-                rlRun "echo 'allow fdreceivebpfdomain self:capability { sys_admin };' >>policy/test_fdreceive_bpf.te"
-            fi
-
             # CKI mainline kernels don't ship with module build infrastructure
             # just yet. Also, RHEL-8 CKI kernel-devel programs are
             # cross-compiled badly for alt arches, so try executing one of them.

^ permalink raw reply related	[flat|nested] 6+ messages in thread
end of thread, other threads:[~2026-09-11 13:23 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-09-11 13:19 [tests/selinux] pr775-checkpolicy-revdeps: kernel/selinux-testsuite: bump upstream ref Ondrej Mosnacek
  -- strict thread matches above, loose matches on Subject: below --
2026-09-11 13:23 Ondrej Mosnacek
2026-09-11 13:19 Ondrej Mosnacek
2026-09-11 13:18 [tests/selinux] pr775-checkpolicy-revdeps: kernel/selinux-testsuite: Bump " Ondrej Mosnacek
2026-09-11 13:18 [tests/selinux] pr775-checkpolicy-revdeps: kernel/selinux-testsuite: bump " Ondrej Mosnacek
2026-09-11 13:17 Ondrej Mosnacek

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox