public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
From: Milos Malik <mmalik@redhat.com>
To: git-commits@fedoraproject.org
Subject: [tests/selinux] pr775-checkpolicy-revdeps: add the cockpit test to upstream repo
Date: Fri, 11 Sep 2026 13:19:34 GMT [thread overview]
Message-ID: <178913277446.1.9956441178901590504.tests-selinux-14a6d433c15d@fedoraproject.org> (raw)
A new commit has been pushed.
Repo : tests/selinux
Branch : pr775-checkpolicy-revdeps
Commit : 14a6d433c15d844a26da8a69fd186448a43bbe1e
Author : Milos Malik <mmalik@redhat.com>
Date : 2022-01-19T17:46:00+01:00
Stats : +342/-0 in 5 file(s)
URL : https://src.fedoraproject.org/tests/selinux/c/14a6d433c15d844a26da8a69fd186448a43bbe1e?branch=pr775-checkpolicy-revdeps
Log:
add the cockpit test to upstream repo
The cockpit* services are frequently used by various users on Fedora
and RHEL, so it makes sense to run this TC in upstream testing too.
There are no changes in the TC functionality.
Moving the downstream TC to upstream repo.
---
diff --git a/selinux-policy/cockpit-ws-and-similar/Makefile b/selinux-policy/cockpit-ws-and-similar/Makefile
new file mode 100644
index 0000000..d048f53
--- /dev/null
+++ b/selinux-policy/cockpit-ws-and-similar/Makefile
@@ -0,0 +1,85 @@
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+# Makefile of /CoreOS/selinux-policy/Regression/cockpit-ws-and-similar
+# Description: SELinux interferes with cockpit-ws and related programs
+# Author: Milos Malik <mmalik@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+# Copyright (c) 2012 Red Hat, Inc. All rights reserved.
+#
+# This copyrighted material is made available to anyone wishing
+# to use, modify, copy, or redistribute it subject to the terms
+# and conditions of the GNU General Public License version 2.
+#
+# This program is distributed in the hope that it will be
+# useful, but WITHOUT ANY WARRANTY; without even the implied
+# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+# PURPOSE. See the GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public
+# License along with this program; if not, write to the Free
+# Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+# Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+export TEST=/CoreOS/selinux-policy/Regression/cockpit-ws-and-similar
+export TESTVERSION=1.0
+
+BUILT_FILES=
+
+FILES=$(METADATA) runtest.sh Makefile PURPOSE testpolicy.te
+
+.PHONY: all install download clean
+
+run: $(FILES) build
+ ./runtest.sh
+
+build: $(BUILT_FILES)
+ chmod a+x runtest.sh
+ chcon -t bin_t runtest.sh
+
+clean:
+ rm -f *~ $(BUILT_FILES)
+
+include /usr/share/rhts/lib/rhts-make.include
+
+$(METADATA): Makefile
+ @echo "Owner: Milos Malik <mmalik@redhat.com>" > $(METADATA)
+ @echo "Name: $(TEST)" >> $(METADATA)
+ @echo "TestVersion: $(TESTVERSION)" >> $(METADATA)
+ @echo "Path: $(TEST_DIR)" >> $(METADATA)
+ @echo "Description: SELinux interferes with cockpit-ws and related programs" >> $(METADATA)
+ @echo "Type: Regression" >> $(METADATA)
+ @echo "TestTime: 10m" >> $(METADATA)
+ @echo "RunFor: selinux-policy" >> $(METADATA)
+ @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console glib2 cockpit-ws net-tools nmap-ncat cockpit-dashboard cockpit-bridge psmisc selinux-policy-devel" >> $(METADATA)
+ @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA)
+ @echo "Priority: Normal" >> $(METADATA)
+ @echo "License: GPLv2" >> $(METADATA)
+ @echo "Confidential: no" >> $(METADATA)
+ @echo "Destructive: no" >> $(METADATA)
+ @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA)
+ @echo "Architectures: x86_64" >> $(METADATA)
+ @echo "Releases: -RHEL4 -RHEL5 -RHEL6" >> $(METADATA)
+ @echo "Bug: 1100808" >> $(METADATA) # RHEL-7
+ @echo "Bug: 1214223" >> $(METADATA) # RHEL-7
+ @echo "Bug: 1279429" >> $(METADATA) # RHEL-7
+ @echo "Bug: 1283955" >> $(METADATA) # RHEL-7
+ @echo "Bug: 1374572" >> $(METADATA) # RHEL-7
+ @echo "Bug: 1381914" >> $(METADATA) # RHEL-7
+ @echo "Bug: 1402316" >> $(METADATA) # RHEL-7
+ @echo "Bug: 1402495" >> $(METADATA) # RHEL-7
+ @echo "Bug: 1413509" >> $(METADATA) # RHEL-7
+ @echo "Bug: 1561053" >> $(METADATA) # Fedora 28
+ @echo "Bug: 1584167" >> $(METADATA) # Fedora 28
+ @echo "Bug: 1609929" >> $(METADATA) # Fedora 28
+ @echo "Bug: 1613638" >> $(METADATA) # Fedora 28
+ @echo "Bug: 1615318" >> $(METADATA) # RHEL-8
+ @echo "Bug: 1629678" >> $(METADATA) # RHEL-8
+ @echo "Bug: 1718814" >> $(METADATA) # RHEL-8
+ @echo "Bug: 1979182" >> $(METADATA) # RHEL-8
+
+ rhts-lint $(METADATA)
+
diff --git a/selinux-policy/cockpit-ws-and-similar/PURPOSE b/selinux-policy/cockpit-ws-and-similar/PURPOSE
new file mode 100644
index 0000000..b42781c
--- /dev/null
+++ b/selinux-policy/cockpit-ws-and-similar/PURPOSE
@@ -0,0 +1,5 @@
+PURPOSE of /CoreOS/selinux-policy/Regression/cockpit-ws-and-similar
+Author: Milos Malik <mmalik@redhat.com>
+
+SELinux interferes with cockpit-ws, cockpit-ssh, cockpit-session and related programs.
+
diff --git a/selinux-policy/cockpit-ws-and-similar/main.fmf b/selinux-policy/cockpit-ws-and-similar/main.fmf
new file mode 100644
index 0000000..adb81d8
--- /dev/null
+++ b/selinux-policy/cockpit-ws-and-similar/main.fmf
@@ -0,0 +1,3 @@
+path: /selinux-policy/cockpit-ws-and-similar
+tier: 2
+
diff --git a/selinux-policy/cockpit-ws-and-similar/runtest.sh b/selinux-policy/cockpit-ws-and-similar/runtest.sh
new file mode 100755
index 0000000..e0b6a92
--- /dev/null
+++ b/selinux-policy/cockpit-ws-and-similar/runtest.sh
@@ -0,0 +1,232 @@
+#!/bin/bash
+# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+# runtest.sh of /CoreOS/selinux-policy/Regression/cockpit-ws-and-similar
+# Description: SELinux interferes with cockpit-ws and related programs
+# Author: Milos Malik <mmalik@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+# Copyright (c) 2012 Red Hat, Inc. All rights reserved.
+#
+# This copyrighted material is made available to anyone wishing
+# to use, modify, copy, or redistribute it subject to the terms
+# and conditions of the GNU General Public License version 2.
+#
+# This program is distributed in the hope that it will be
+# useful, but WITHOUT ANY WARRANTY; without even the implied
+# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+# PURPOSE. See the GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public
+# License along with this program; if not, write to the Free
+# Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+# Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include Beaker environment
+. /usr/bin/rhts-environment.sh || exit 1
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGE="selinux-policy"
+ROOT_PASSWORD="redhat"
+FILE_PATH="/usr/libexec/cockpit-ws"
+FILE_CONTEXT="cockpit_ws_exec_t"
+SERVICE_PACKAGE="cockpit-ws"
+SERVICE_NAME="cockpit"
+if grep "cockpit-tls" /usr/lib/systemd/system/cockpit.service; then
+ PROCESS_NAME="cockpit-tls"
+else
+ PROCESS_NAME="cockpit-ws"
+fi
+PROCESS_CONTEXT="cockpit_ws_t"
+
+rlJournalStart
+ rlPhaseStartSetup
+ rlRun "rlImport 'selinux-policy/common'"
+ rlSESatisfyRequires
+ rlAssertRpm ${PACKAGE}
+ rlAssertRpm ${PACKAGE}-targeted
+ rlAssertRpm ${SERVICE_PACKAGE}
+
+ rlServiceStop ${SERVICE_NAME}
+ rlFileBackup /etc/shadow
+
+ rlSESetEnforce
+ rlSEStatus
+ rlSESetTimestamp
+ sleep 2
+ rlPhaseEnd
+
+ rlPhaseStartTest "bz#1100808"
+ rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}"
+ if rlIsRHEL 5 ; then
+ SOURCE_TYPE="initrc_t"
+ BOOLEANS="[ ]"
+ elif rlIsRHEL 6 ; then
+ SOURCE_TYPE="initrc_t"
+ else # RHEL-7 etc.
+ SOURCE_TYPE="init_t" # systemd runs the process
+ fi
+ rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS"
+ rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS"
+ rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS"
+ rlPhaseEnd
+
+ if ! rlIsRHEL 5 6 ; then
+ rlPhaseStartTest "bz#1214223"
+ rlSEMatchPathCon "/usr/libexec/cockpit-session" "cockpit_session_exec_t"
+ rlSEMatchPathCon "/var/tmp" "tmp_t"
+ rlSESearchRule "allow cockpit_session_t tmp_t : dir { read write add_name remove_name getattr open search } [ ]"
+ rlSESearchRule "type_transition cockpit_session_t tmp_t : file cockpit_tmp_t"
+ rlSESearchRule "allow cockpit_session_t cockpit_tmp_t : file { create write open unlink } [ ]"
+ rlPhaseEnd
+
+ rlPhaseStartTest "bz#1279429 + bz#1283955"
+ rlSEMatchPathCon "/usr/libexec/cockpit-ws" "cockpit_ws_exec_t"
+ rlSEMatchPathCon "/tmp" "tmp_t"
+ rlSEMatchPathCon "/var/run" "var_run_t"
+ rlSEMatchPathCon "/var/run/cockpit-ws" "cockpit_var_run_t"
+ rlSESearchRule "allow cockpit_ws_t var_run_t : dir { write add_name } [ ]"
+ rlSESearchRule "type_transition cockpit_ws_t var_run_t : dir cockpit_var_run_t [ ]"
+ rlSESearchRule "allow cockpit_ws_t cockpit_var_run_t : dir { create } [ ]"
+ rlSESearchRule "allow cockpit_ws_t tmp_t : dir { write add_name } [ ]"
+ rlSESearchRule "type_transition cockpit_ws_t tmp_t : dir cockpit_tmp_t [ ]"
+ rlSESearchRule "type_transition cockpit_ws_t tmp_t : file cockpit_tmp_t [ ]"
+ rlSESearchRule "allow cockpit_ws_t cockpit_tmp_t : dir { read write create getattr setattr lock unlink link rename add_name remove_name search rmdir open } [ ]"
+ rlSESearchRule "allow cockpit_ws_t cockpit_tmp_t : file { read write create getattr setattr lock append unlink link rename open } [ ]"
+ rlPhaseEnd
+
+ rlPhaseStartTest "bz#1374572"
+ rlSEMatchPathCon "/usr/libexec/cockpit-session" "cockpit_session_exec_t"
+ rlSEMatchPathCon "/usr/share/cracklib" "crack_db_t"
+ rlSEMatchPathCon "/usr/share/cracklib/pw_dict.pwd" "crack_db_t"
+ rlSEMatchPathCon "/etc/nshadow" "shadow_t"
+ rlSESearchRule "allow cockpit_session_t crack_db_t : dir { search }"
+ rlSESearchRule "allow cockpit_session_t crack_db_t : file { getattr open read }"
+ rlSESearchRule "allow cockpit_session_t shadow_t : file { create write setattr }"
+ rlSESearchRule "allow cockpit_session_t passwd_file_t : file { write }"
+ rlPhaseEnd
+
+ rlPhaseStartTest "bz#1413509"
+ rlSEMatchPathCon "/usr/libexec/cockpit-ws" "cockpit_ws_exec_t"
+ rlSEMatchPathCon "/usr/libexec/cockpit-ssh" "cockpit_session_exec_t"
+ rlSEMatchPathCon "/var/lib/cockpit" "cockpit_var_lib_t"
+ rlSEMatchPortCon tcp 22 ssh_port_t
+ rlSESearchRule "allow cockpit_ws_t cockpit_session_exec_t : file { getattr open read execute }"
+ rlSESearchRule "type_transition cockpit_ws_t cockpit_session_exec_t : process cockpit_session_t"
+ rlSESearchRule "allow cockpit_ws_t cockpit_session_t : process { transition }"
+ rlSESearchRule "allow cockpit_session_t cockpit_var_lib_t : dir { search }"
+ rlSESearchRule "allow cockpit_session_t ssh_port_t : tcp_socket { name_connect } [ ]"
+ rlPhaseEnd
+
+ if ! rlIsRHEL 7 ; then
+ rlPhaseStartTest "bz#1584167 + bz#1609929 + bz#1613638 + bz#1615318"
+ rlSEMatchPathCon "/usr/sbin/sshd" "sshd_exec_t"
+ rlSEMatchPathCon "/var/run/cockpit" "cockpit_var_run_t"
+ rlSEMatchPathCon "/var/run/cockpit/active.motd" "cockpit_var_run_t"
+ rlSESearchRule "allow sshd_t cockpit_var_run_t : dir { getattr open search } [ ]"
+ rlSESearchRule "allow sshd_t cockpit_var_run_t : file { getattr open read } [ ]"
+ rlPhaseEnd
+
+ rlPhaseStartTest "bz#1629678"
+ rlSEMatchPathCon "/usr/lib/systemd/system/cockpit.socket" "cockpit_unit_file_t"
+ rlSESearchRule "allow cockpit_ws_t cockpit_unit_file_t : service { status } [ ]"
+ rlPhaseEnd
+
+ rlPhaseStartTest "bz#1561053"
+ rlSEMatchPathCon "/usr/libexec/cockpit-ws" "cockpit_ws_exec_t"
+ rlRun "ls -Z /proc/cpuinfo | grep :proc_t"
+ rlSESearchRule "allow cockpit_ws_t proc_t : file { getattr open read } [ ]"
+ rlPhaseEnd
+ fi
+ fi
+
+ rlPhaseStartTest "real scenario -- standalone service"
+ rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root"
+ if ! rlSEDefined ${PROCESS_CONTEXT} ; then
+ if rlIsRHEL 5 6 ; then
+ PROCESS_CONTEXT="initrc_t"
+ else
+ PROCESS_CONTEXT="unconfined_service_t"
+ fi
+ fi
+ rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status restart status stop status" 1
+ rlPhaseEnd
+
+ rlPhaseStartTest "bz#1402316 + bz#1402495"
+ rlSEMatchPathCon "/usr/libexec/cockpit-session" "cockpit_session_exec_t"
+ rlSESearchRule "allow cockpit_session_t cockpit_session_t : process { setrlimit }"
+ rlPhaseEnd
+
+ if ! rlIsRHEL 7 ; then
+ rlPhaseStartTest "bz#1718814"
+ # staff_u section
+ rlSESearchRule "allow staff_ssh_agent_t cockpit_session_t : fifo_file { getattr read write } [ ]"
+ rlSESearchRule "allow staff_ssh_agent_t ssh_agent_tmp_t : dir { write } [ ]"
+ rlSESearchRule "allow staff_t cockpit_ws_t : unix_stream_socket { getattr ioctl shutdown } [ ]"
+ # rlSESearchRule "allow staff_sudo_t staff_t : unix_stream_socket { ioctl } [ ]"
+ rlSESearchRule "allow cockpit_session_t staff_ssh_agent_t : process { signal } [ ]"
+ # user_u section
+ rlSESearchRule "allow user_ssh_agent_t cockpit_session_t : fifo_file { getattr read write } [ ]"
+ rlSESearchRule "allow user_ssh_agent_t ssh_agent_tmp_t : dir { write } [ ]"
+ rlSESearchRule "allow user_t cockpit_ws_t : unix_stream_socket { getattr ioctl shutdown } [ ]"
+ # user_u cannot run sudo - tested in a different TC
+ rlSESearchRule "allow cockpit_session_t user_ssh_agent_t : process { signal } [ ]"
+ # sysadm_u section
+ rlSESearchRule "allow sysadm_ssh_agent_t cockpit_session_t : fifo_file { getattr read write } [ ]"
+ rlSESearchRule "allow sysadm_ssh_agent_t ssh_agent_tmp_t : dir { write } [ ]"
+
+ # rlSESearchRule "allow sysadm_sudo_t sysadm_t : unix_stream_socket { ioctl } [ ]"
+ rlSESearchRule "allow sysadm_t cockpit_ws_t : unix_stream_socket { getattr ioctl shutdown } [ ]"
+ rlSESearchRule "allow cockpit_session_t sysadm_ssh_agent_t : process { signal } [ ]"
+ rlPhaseEnd
+
+ rlPhaseStartTest "bz#1979182"
+ rlSESearchRule "allow cockpit_ws_t fs_t : filesystem { getattr } [ ]"
+ rlPhaseEnd
+ fi
+
+ rlPhaseStartTest "real scenario -- xinetd service"
+ HOST_ADDRESS="127.0.0.1" # IP address or nothing
+ PORT_NUMBER="9090" # number or socket path
+ PORT_TYPE="" # default is TCP, otherwise use -u (UDP) or --sctp (SCTP)
+ if rlIsRHEL 5 6 ; then
+ rlRun "chkconfig ${SERVICE_NAME} on"
+ rlRun "service xinetd restart"
+ rlLog "starting provocateur job"
+ ( tail -f - | nc ${PORT_TYPE} ${HOST_ADDRESS} ${PORT_NUMBER} ) &
+ PROVOCATEUR_PID=$!
+ else
+ rlRun "systemctl enable ${SERVICE_NAME}.socket"
+ rlRun "systemctl start ${SERVICE_NAME}.socket"
+ rlLog "starting provocateur job"
+ ( tail -f - | ncat ${PORT_TYPE} ${HOST_ADDRESS} ${PORT_NUMBER} ) &
+ PROVOCATEUR_PID=$!
+ fi
+ sleep 1
+ rlRun "netstat -tupan | grep :${PORT_NUMBER}"
+ rlRun "ps -o pid,user,context,args -C ${PROCESS_NAME}"
+ rlRun "ps -o pid,user,context,args -C ${PROCESS_NAME} | grep :${PROCESS_CONTEXT}"
+ rlRun "kill ${PROVOCATEUR_PID}"
+ if rlIsRHEL 5 6 ; then
+ rlRun "chkconfig ${SERVICE_NAME} off"
+ rlRun "service xinetd stop"
+ else
+ rlRun "systemctl stop ${SERVICE_NAME}.socket"
+ rlRun "systemctl disable ${SERVICE_NAME}.socket"
+ fi
+ rlPhaseEnd
+
+ rlPhaseStartCleanup
+ sleep 2
+ rlSECheckAVC
+
+ rlFileRestore
+ rlServiceRestore ${SERVICE_NAME}
+ rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd
+
diff --git a/selinux-policy/cockpit-ws-and-similar/testpolicy.te b/selinux-policy/cockpit-ws-and-similar/testpolicy.te
new file mode 100644
index 0000000..10b6586
--- /dev/null
+++ b/selinux-policy/cockpit-ws-and-similar/testpolicy.te
@@ -0,0 +1,17 @@
+policy_module(testpolicy,1.0)
+
+require {
+ type initrc_t;
+ type cockpit_session_exec_t;
+ type cockpit_session_t;
+ type user_devpts_t;
+ class file { getattr open read execute entrypoint };
+ class process { transition };
+ class chr_file { getattr open read write append };
+}
+
+allow initrc_t cockpit_session_exec_t : file { getattr open read execute entrypoint };
+allow initrc_t cockpit_session_t : process { transition };
+type_transition initrc_t cockpit_session_exec_t : process cockpit_session_t;
+allow cockpit_session_t user_devpts_t : chr_file { getattr open read write append };
+
reply other threads:[~2026-09-11 13:19 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=178913277446.1.9956441178901590504.tests-selinux-14a6d433c15d@fedoraproject.org \
--to=mmalik@redhat.com \
--cc=git-commits@fedoraproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox