public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
From: Ondrej Mosnacek <omosnace@redhat.com>
To: git-commits@fedoraproject.org
Subject: [tests/selinux] pr775-checkpolicy-revdeps: semodule-rebuild-if-modules-changed: test changing booleans
Date: Fri, 11 Sep 2026 13:20:08 GMT [thread overview]
Message-ID: <178913280826.1.11060921261926815788.tests-selinux-c3dd00f4bcf4@fedoraproject.org> (raw)
A new commit has been pushed.
Repo : tests/selinux
Branch : pr775-checkpolicy-revdeps
Commit : c3dd00f4bcf4355897a4e726ca12740b88ea5b17
Author : Ondrej Mosnacek <omosnace@redhat.com>
Date : 2022-08-02T15:03:48+02:00
Stats : +58/-16 in 1 file(s)
URL : https://src.fedoraproject.org/tests/selinux/c/c3dd00f4bcf4355897a4e726ca12740b88ea5b17?branch=pr775-checkpolicy-revdeps
Log:
semodule-rebuild-if-modules-changed: test changing booleans
Extend the test to verify correct behavior when a boolean setting
override is injected. Also add auto-detection of the --refresh /
--rebuild-if-modules-changed command-line option support, which
indicates the expected level of functionality. (And we also need to
ensure that --refresh is used when supported because the other option
may be removed in the future.)
Additionally, we need to work around the fact that the exact binary
policy content can now be different depending on if the optimized code
path has been taken. Do this by toggling a boolean before introducing
injected customizations, thus obtaining the expected policy content for
the case after `semodule --refresh`.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
---
diff --git a/policycoreutils/semodule-rebuild-if-modules-changed/runtest.sh b/policycoreutils/semodule-rebuild-if-modules-changed/runtest.sh
index 98e84d6..16e3ccf 100755
--- a/policycoreutils/semodule-rebuild-if-modules-changed/runtest.sh
+++ b/policycoreutils/semodule-rebuild-if-modules-changed/runtest.sh
@@ -11,7 +11,11 @@ STORE_ROOT=/var/lib/selinux
STORE_TYPE=targeted
MODULES_ROOT="$STORE_ROOT/$STORE_TYPE/active/modules"
STORE_POLICY="$STORE_ROOT/$STORE_TYPE/active/policy.kern"
+STORE_BOOLS="$STORE_ROOT/$STORE_TYPE/active/booleans.local"
TEST_MODULE_DIR="$MODULES_ROOT/400/test_module"
+TEST_BOOLEAN="xguest_exec_content"
+TEST_BOOLEAN_VALUE="0"
+TEST_BOOLEAN_VALUE_TEXT="false"
CHECKSUM_CMD=sha256sum
@@ -31,27 +35,46 @@ rlJournalStart
if [ "$policyvers" -lt "$policyvers_kernel" ]; then
policyvers="$policyvers_kernel"
fi
+
+ rlRun "semodule -N -B" 0 \
+ "Make sure policy store is in a consistent state initially"
+
+ refresh_opt=""
+ for opt in --refresh --rebuild-if-modules-changed; do
+ if semodule --help | grep -q -- "$opt"; then
+ refresh_opt="$opt"
+ rlLog "$opt command-line option detected for semodule"
+ break
+ fi
+ done
rlPhaseEnd
- rlPhaseStartTest
- if semodule --help | grep -q -- --rebuild-if-modules-changed; then
- rlRun "semodule -N -B" 0 \
- "Make sure policy store is in a consistent state initially"
+ if [ -n "$refresh_opt" ]; then
+ rlPhaseStartTest "No change behavior"
+ # The resulting binary policy will be different (albeit
+ # equivalent) after a full rebuild vs. when only local
+ # changes are applied to existing policy.linked file, so
+ # toggle a boolean twice to get the expected binary form.
+ rlRun "setsebool -P xguest_exec_content $TEST_BOOLEAN_VALUE"
+ rlRun "setsebool -P xguest_exec_content $(( ! $TEST_BOOLEAN_VALUE ))"
checksum_before="$(policy_checksum "$policyvers")"
- rlRun "semodule -N --rebuild-if-modules-changed"
+ rlRun "semodule -N $refresh_opt"
checksum_after="$(policy_checksum "$policyvers")"
rlAssertEquals "Binary policy must not change after rebuild" \
"$checksum_before" "$checksum_after"
+ # Make sure policy is restored regardless of any previous failures
rlRun "semodule -N -B" 0 \
- "Make sure policy store is in a consistent state initially"
+ "Force a rebuild to clean things up"
+ rlPhaseEnd
+ rlPhaseStartTest "Module injected"
rlLog "Inject a new module into the store"
rlRun "mkdir -p '$TEST_MODULE_DIR'"
rlRun "echo -n cil >'$TEST_MODULE_DIR/lang_ext'"
rlRun "echo '(type test_module_type_t)' >'$TEST_MODULE_DIR/cil'"
- rlRun "semodule -N --rebuild-if-modules-changed" 0 \
+ rlRun "semodule -N $refresh_opt" 0 \
"Do a conditional rebuild"
rlRun "semodule -l | grep test_module" 0 \
"Verify that the module has been picked up"
@@ -60,7 +83,7 @@ rlJournalStart
rlLog "Now remove the module"
rlRun "rm -rf '$TEST_MODULE_DIR'"
- rlRun "semodule -N --rebuild-if-modules-changed"
+ rlRun "semodule -N $refresh_opt"
rlRun "semodule -l | grep test_module" 1 \
"Verify that the module has been removed"
rlRun "seinfo -t test_module_type_t '$STORE_POLICY' | grep test_module_type_t" 1 \
@@ -69,14 +92,33 @@ rlJournalStart
# Make sure policy is restored regardless of any previous failures
rlRun "semodule -N -B" 0 \
"Force a rebuild to clean things up"
- #rlRun "setsebool -NP daemons_use_tty=on"
- # TODO test changing booleans (persistently)
- else
- rlLog "--rebuild-if-modules-changed command-line option not supported; skipping tests..."
- fi
- rlPhaseEnd
+ rlPhaseEnd
- rlPhaseStartCleanup
- rlPhaseEnd
+ # --refresh option implies fixed boolean/etc. behavior
+ if [ "$refresh_opt" = "--refresh" ]; then
+ rlPhaseStartTest "Boolean setting injected"
+ rlLog "Inject a boolean setting into the store"
+ rlRun "echo '$TEST_BOOLEAN=$TEST_BOOLEAN_VALUE' >'$STORE_BOOLS'"
+ rlRun "semodule -N $refresh_opt" 0 \
+ "Do a conditional rebuild"
+ rlRun "seinfo -xb '$TEST_BOOLEAN' '$STORE_POLICY' | grep -F -- '$TEST_BOOLEAN_VALUE_TEXT;'" 0 \
+ "Verify that the boolean setting has been picked up"
+
+ rlLog "Now remove the setting"
+ rlRun "rm -f '$STORE_BOOLS'"
+ rlRun "semodule -N $refresh_opt"
+ rlRun "seinfo -xb '$TEST_BOOLEAN' '$STORE_POLICY' | grep -F -- '$TEST_BOOLEAN_VALUE_TEXT;'" 1 \
+ "Verify that the boolean setting has been reset back"
+
+ # Make sure policy is restored regardless of any previous failures
+ rlRun "semodule -N -B" 0 \
+ "Force a rebuild to clean things up"
+ rlPhaseEnd
+ fi
+ else
+ rlPhaseStartTest "Test skipped"
+ rlLog "--rebuild-if-modules-changed/--refresh command-line option not supported; skipping tests..."
+ rlPhaseEnd
+ fi
rlJournalPrintText
rlJournalEnd
reply other threads:[~2026-09-11 13:20 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=178913280826.1.11060921261926815788.tests-selinux-c3dd00f4bcf4@fedoraproject.org \
--to=omosnace@redhat.com \
--cc=git-commits@fedoraproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox