public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
* [tests/selinux] pr775-checkpolicy-revdeps: Port kernel tests from downstream
@ 2026-09-11 13:20 Ondrej Mosnacek
0 siblings, 0 replies; only message in thread
From: Ondrej Mosnacek @ 2026-09-11 13:20 UTC (permalink / raw)
To: git-commits
A new commit has been pushed.
Repo : tests/selinux
Branch : pr775-checkpolicy-revdeps
Commit : ef2646911d5c8c42619129711d79266ab340ad4f
Author : Ondrej Mosnacek <omosnace@redhat.com>
Date : 2022-09-13T14:24:47+02:00
Stats : +767/-0 in 24 file(s)
URL : https://src.fedoraproject.org/tests/selinux/c/ef2646911d5c8c42619129711d79266ab340ad4f?branch=pr775-checkpolicy-revdeps
Log:
Port kernel tests from downstream
Forward-port of downstream kernel tests that haven't been upstreamed
yet, manually converted to TMT.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
---
diff --git a/kernel/avc_corrupted_context/main.fmf b/kernel/avc_corrupted_context/main.fmf
new file mode 100644
index 0000000..85fdb4e
--- /dev/null
+++ b/kernel/avc_corrupted_context/main.fmf
@@ -0,0 +1,18 @@
+summary: Test SELinux labeling before initial policy load
+description: |
+ Regression test for a bug where SELinux may have printed uninitialized
+ kernel memory instead of a valid source/target context in AVC denials.
+contact: Ondrej Mosnacek <omosnace@redhat.com>
+component:
+ - kernel
+framework: beakerlib
+require:
+ - memcached
+ - policycoreutils
+duration: 5m
+tier: 2
+enabled: true
+link:
+ - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1758086
+environment:
+ AVC_ERROR: +no_avc_check
diff --git a/kernel/avc_corrupted_context/runtest.sh b/kernel/avc_corrupted_context/runtest.sh
new file mode 100755
index 0000000..51bf7ee
--- /dev/null
+++ b/kernel/avc_corrupted_context/runtest.sh
@@ -0,0 +1,35 @@
+#!/bin/bash
+# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# SPDX-License-Identifier: GPLv2
+# Copyright (c) 2022 Red Hat, Inc.
+# Author: Ondrej Mosnacek <omosnace@redhat.com>
+
+# Include Beakerlib environment
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+rlJournalStart
+ rlPhaseStartSetup
+ rlRun "uname -r" 0 "Print running kernel version"
+ rlServiceStart memcached
+ rlPhaseEnd
+
+ rlPhaseStartTest
+ rlRun "semodule -d memcached" 0
+ rlRun "ps -Zp \$(pidof memcached) | grep unlabeled_t" 0 \
+ "The service should be unlabeled now"
+ rlRun "load_policy" 0
+ rlRun "semodule -e memcached" 0
+ rlRun "ps -Zp \$(pidof memcached) | grep unlabeled_t" 1 \
+ "The service shouldn't stay unlabeled"
+ rlRun "ps -Zp \$(pidof memcached) | grep system_r:memcached_t:s0" 0 \
+ "The service should have the correct label"
+ rlPhaseEnd
+
+ rlPhaseStartCleanup
+ rlRun "setenforce 0" 0 # service may be unlabeled
+ rlServiceStop memcached
+ rlRun "setenforce 1" 0
+ rlServiceRestore memcached
+ rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd
diff --git a/kernel/avc_log_actual_context_if_invalid/main.fmf b/kernel/avc_log_actual_context_if_invalid/main.fmf
new file mode 100644
index 0000000..44160b6
--- /dev/null
+++ b/kernel/avc_log_actual_context_if_invalid/main.fmf
@@ -0,0 +1,27 @@
+summary: Test logging of actual context in AVCs if it is invalid
+description: |
+ Verify that SELinux logs the actual source/target context in a separate
+ AVC record field in case it is invalid.
+contact: Ondrej Mosnacek <omosnace@redhat.com>
+component:
+ - kernel
+framework: beakerlib
+require:
+ - library(selinux-policy/common)
+ - attr
+ - audit
+ - libselinux-utils
+ - policycoreutils
+ - selinux-policy
+duration: 15m
+tier: 2
+enabled: true
+adjust:
+ - enabled: false
+ when: distro < rhel-8.1
+ because: RHEL-8.0 and below is not expected to support this
+link:
+ - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1670039
+ - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1719666
+environment:
+ AVC_ERROR: +no_avc_check
diff --git a/kernel/avc_log_actual_context_if_invalid/runtest.sh b/kernel/avc_log_actual_context_if_invalid/runtest.sh
new file mode 100755
index 0000000..4ae5531
--- /dev/null
+++ b/kernel/avc_log_actual_context_if_invalid/runtest.sh
@@ -0,0 +1,101 @@
+# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# SPDX-License-Identifier: GPLv2
+# Copyright (c) 2022 Red Hat, Inc.
+# Author: Ondrej Mosnacek <omosnace@redhat.com>
+
+# Include Beakerlib environment
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+EXE4="reproducer4"
+EXE6="reproducer6"
+PORT=8000
+
+UNLABELED_CONTEXT="system_u:object_r:unlabeled_t:s0"
+INVALID_TCONTEXT="system_u:object_r:banana_t:s0"
+INVALID_SCONTEXT="system_u:system_r:tor_t:s0"
+INVALID_SCONTEXT_MODULE="tor"
+
+GARBAGE_TCONTEXT="kuřecí řízek"
+GARBAGE_TCONTEXT_AUDIT="6B75C5996563C3AD20C599C3AD7A656B"
+
+rlJournalStart
+ rlPhaseStartSetup
+ rlImport "selinux-policy/common" # for audit daemon handling
+
+ rlRun "uname -r" 0 "Print running kernel version"
+
+ rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory"
+ rlRun "pushd $TmpDir"
+ old_enforce=$(getenforce)
+ rlLog "Backing up SELinux status: $old_enforce"
+ rlRun "setenforce 0" 0 "Switching to permissive"
+ rlPhaseEnd
+
+ # helper function for subtests:
+ function check_avcs() {
+ local field_main="$1"
+ local field_raw="$2"
+ local invalid_ctx="$3"
+
+ rlRun "LANG=en_US ausearch --input-logs -ts $audit_ts --raw -m AVC | \
+ grep -E '^type=AVC .* $field_main=$UNLABELED_CONTEXT' \
+ >tmpavcs" 0 "Collect AVCs"
+
+ unlabeled_avcs=$(cat tmpavcs | wc -l)
+ unlabeled_avcs_with_rawcon=$(cat tmpavcs | \
+ grep " $field_raw=$invalid_ctx" | wc -l)
+ rlAssertEquals "Check that all AVCs with $field_main=unlabeled have $field_raw= with the correct label" \
+ $unlabeled_avcs $unlabeled_avcs_with_rawcon
+ rlRun "cat tmpavcs" 0 "Print checked AVCs"
+ }
+
+ rlPhaseStartTest "trawcon"
+ rlRun "touch foo" 0 "Creating the foo test file"
+ rlRun "setfattr -n security.selinux -v $INVALID_TCONTEXT foo" 0 \
+ "Setting SELinux xattr of foo to an invalid value"
+
+ audit_ts="$(date +'%x %T')"; sleep 1.1
+ rlRun "runcon system_u:system_r:sshd_t:s0 cat foo" 0 \
+ "Generating AVCs with invalid tcontext"
+ check_avcs tcontext trawcon "\"$INVALID_TCONTEXT\""
+ rlPhaseEnd
+
+ rlPhaseStartTest "trawcon-garbage"
+ rlRun "touch foo" 0 "Creating the foo test file"
+ rlRun "setfattr -n security.selinux -v '$GARBAGE_TCONTEXT' foo" 0 \
+ "Setting SELinux xattr of foo to a garbage value"
+
+ sleep 1.1; audit_ts="$(date +'%x %T')"; sleep 1.1
+ rlRun "runcon system_u:system_r:sshd_t:s0 cat foo" 0 \
+ "Generating AVCs with invalid tcontext"
+ check_avcs tcontext trawcon "$GARBAGE_TCONTEXT_AUDIT"
+ rlPhaseEnd
+
+ rlPhaseStartTest "srawcon"
+ function gen_scontext_unlabeled_avc() {
+ local fifo="$1"
+
+ # Start bash with tor label, then make it invalid,
+ # and try to do something under the invalid label:
+ runcon "$INVALID_SCONTEXT" \
+ bash -c "cat $fifo > /dev/null; </usr/bin/echo >/dev/null" &
+ semodule -d "$INVALID_SCONTEXT_MODULE"
+ echo go! >$fifo
+ wait %1
+ semodule -e "$INVALID_SCONTEXT_MODULE"
+ }
+
+ sleep 1.1; audit_ts="$(date +'%x %T')"; sleep 1.1
+ rlRun "mkfifo tmpfifo" 0
+ rlRun "gen_scontext_unlabeled_avc tmpfifo" 0 \
+ "Generating AVCs with invalid scontext"
+ check_avcs scontext srawcon "\"$INVALID_SCONTEXT\""
+ rlPhaseEnd
+
+ rlPhaseStartCleanup
+ rlRun "setenforce $old_enforce" 0 "Restoring SELinux status"
+ rlRun "popd"
+ rlRun "rm -r $TmpDir" 0 "Removing tmp directory"
+ rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd
diff --git a/kernel/connect_AF_UNSPEC/main.fmf b/kernel/connect_AF_UNSPEC/main.fmf
new file mode 100644
index 0000000..7afdbc4
--- /dev/null
+++ b/kernel/connect_AF_UNSPEC/main.fmf
@@ -0,0 +1,25 @@
+summary: Test connect(AF_UNSPEC) behavior
+description: |
+ Ensure that connect(AF_UNSPEC) (should disconnect a connected socket)
+ works correctly under SELinux.
+contact: Ondrej Mosnacek <omosnace@redhat.com>
+component:
+ - kernel
+framework: beakerlib
+require:
+ - gcc
+ - nc
+ - strace
+duration: 5m
+tier: 2
+enabled: true
+adjust:
+ - enabled: false
+ when: distro ~< rhel-8.1
+ because: RHEL-8.0 is not expected to have the bug fixed
+ - enabled: false
+ when: distro ~< rhel-7.9
+ because: RHEL-7.8 and below are not expected to have the bug fixed
+link:
+ - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1707828
+ - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1886305
diff --git a/kernel/connect_AF_UNSPEC/reproducer4.c b/kernel/connect_AF_UNSPEC/reproducer4.c
new file mode 100644
index 0000000..def3f57
--- /dev/null
+++ b/kernel/connect_AF_UNSPEC/reproducer4.c
@@ -0,0 +1,46 @@
+#include <sys/types.h>
+#include <sys/socket.h>
+
+#include <netinet/in.h>
+
+#include <unistd.h>
+#include <stdlib.h>
+#include <string.h>
+#include <stdio.h>
+
+int main(int argc, char **argv)
+{
+ int fd;
+ struct sockaddr_in addr;
+ struct sockaddr addr_unspec;
+
+ if (argc < 2)
+ return 2;
+
+ fd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
+ if (fd < 0) {
+ perror(argv[0]);
+ return 1;
+ }
+
+ addr.sin_family = AF_INET;
+ addr.sin_port = htons(atoi(argv[1]));
+ addr.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
+
+ if (connect(fd, (struct sockaddr *)&addr, sizeof(addr)) < 0) {
+ perror(argv[0]);
+ close(fd);
+ return 1;
+ }
+
+ memset(&addr_unspec, 0, sizeof(addr_unspec));
+ addr_unspec.sa_family = AF_UNSPEC;
+ if (connect(fd, (struct sockaddr *)&addr_unspec, sizeof(addr_unspec)) < 0) {
+ perror(argv[0]);
+ close(fd);
+ return 1;
+ }
+
+ close(fd);
+ return 0;
+}
diff --git a/kernel/connect_AF_UNSPEC/reproducer6.c b/kernel/connect_AF_UNSPEC/reproducer6.c
new file mode 100644
index 0000000..169ed52
--- /dev/null
+++ b/kernel/connect_AF_UNSPEC/reproducer6.c
@@ -0,0 +1,47 @@
+#include <sys/types.h>
+#include <sys/socket.h>
+
+#include <netinet/in.h>
+
+#include <unistd.h>
+#include <stdlib.h>
+#include <string.h>
+#include <stdio.h>
+
+int main(int argc, char **argv)
+{
+ int fd;
+ struct sockaddr_in6 addr;
+ struct sockaddr addr_unspec;
+
+ if (argc < 2)
+ return 2;
+
+ fd = socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP);
+ if (fd < 0) {
+ perror(argv[0]);
+ return 1;
+ }
+
+ memset(&addr, 0, sizeof(addr));
+ addr.sin6_family = AF_INET6;
+ addr.sin6_port = htons(atoi(argv[1]));
+ addr.sin6_addr = (struct in6_addr)IN6ADDR_LOOPBACK_INIT;
+
+ if (connect(fd, (struct sockaddr *)&addr, sizeof(addr)) < 0) {
+ perror(argv[0]);
+ close(fd);
+ return 1;
+ }
+
+ memset(&addr_unspec, 0, sizeof(addr_unspec));
+ addr_unspec.sa_family = AF_UNSPEC;
+ if (connect(fd, (struct sockaddr *)&addr_unspec, sizeof(addr_unspec)) < 0) {
+ perror(argv[0]);
+ close(fd);
+ return 1;
+ }
+
+ close(fd);
+ return 0;
+}
diff --git a/kernel/connect_AF_UNSPEC/runtest.sh b/kernel/connect_AF_UNSPEC/runtest.sh
new file mode 100755
index 0000000..bc63688
--- /dev/null
+++ b/kernel/connect_AF_UNSPEC/runtest.sh
@@ -0,0 +1,39 @@
+# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# SPDX-License-Identifier: GPLv2
+# Copyright (c) 2022 Red Hat, Inc.
+# Author: Ondrej Mosnacek <omosnace@redhat.com>
+
+# Include Beakerlib environment
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+EXE4="reproducer4"
+EXE6="reproducer6"
+PORT=8000
+
+rlJournalStart
+ rlPhaseStartSetup
+ rlRun "uname -r" 0 "Print running kernel version"
+
+ rlRun "gcc -o $EXE4 reproducer4.c" 0 "Compile the IPv4 reproducer"
+ rlRun "gcc -o $EXE6 reproducer6.c" 0 "Compile the IPv6 reproducer"
+ rlRun "nc -4lk $PORT &" 0 "Start IPv4 server"
+ rlRun "nc -6lk $PORT &" 0 "Start IPv6 server"
+ rlPhaseEnd
+
+ rlPhaseStartTest "IPv4"
+ rlRun "strace ./$EXE4 $PORT" 0 "Run the IPv4 reproducer"
+ rlPhaseEnd
+
+ rlPhaseStartTest "IPv6"
+ rlRun "strace ./$EXE6 $PORT" 0 "Run the IPv6 reproducer"
+ rlPhaseEnd
+
+ rlPhaseStartCleanup
+ rlRun "rm -f $EXE4" 0 "Removing the IPv4 reproducer binary"
+ rlRun "rm -f $EXE6" 0 "Removing the IPv6 reproducer binary"
+ rlRun "kill %1" 0 "Kill the IPv4 server"
+ rlRun "kill %2" 0 "Kill the IPv6 server"
+ rlRun "wait $(jobs -p)" 0 "Wait for the servers to terminate"
+ rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd
diff --git a/kernel/getxattr_read_out_of_bounds/main.fmf b/kernel/getxattr_read_out_of_bounds/main.fmf
new file mode 100644
index 0000000..f3360cb
--- /dev/null
+++ b/kernel/getxattr_read_out_of_bounds/main.fmf
@@ -0,0 +1,23 @@
+summary: Reproducer for an out-of-bounds read on getxattr(2)
+description: |
+ Verifies that it is not possible to trigger an out-of-bounds read by
+ setting the security.selinux xattr to a value containing a null character
+ and then trying to read back the xattr.
+
+ See also: https://git.kernel.org/torvalds/c/efe3de79e0b5
+contact: Ondrej Mosnacek <omosnace@redhat.com>
+component:
+ - kernel
+framework: beakerlib
+require:
+ - coreutils
+ - policycoreutils
+ - attr
+duration: 5m
+tier: 2
+enabled: true
+link:
+ - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1584307
+ - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1595706
+environment:
+ AVC_ERROR: +no_avc_check
diff --git a/kernel/getxattr_read_out_of_bounds/runtest.sh b/kernel/getxattr_read_out_of_bounds/runtest.sh
new file mode 100755
index 0000000..8ae46c1
--- /dev/null
+++ b/kernel/getxattr_read_out_of_bounds/runtest.sh
@@ -0,0 +1,36 @@
+#!/bin/bash
+# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# SPDX-License-Identifier: GPLv2
+# Copyright (c) 2018-2022 Red Hat, Inc.
+# Author: Ondrej Mosnacek <omosnace@redhat.com>
+
+# Include Beakerlib environment
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+rlJournalStart
+ rlPhaseStartSetup
+ rlRun "uname -r" 0 "Print running kernel version"
+ rlRun "touch testfile"
+ reset_enforcing=0
+ if [ "$(getenforce)" = "Enforcing" ]; then
+ rlRun "setenforce 0" 0 "Switch to permissive"
+ reset_enforcing=1
+ fi
+ rlPhaseEnd
+
+ rlPhaseStartTest
+ rlRun "setfattr -n security.selinux -v 'a\\0aaaaaaaaaaaaaaaa' testfile" 0 \
+ "Try to set a label with a null char in it"
+ rlRun "getfattr -e hex -n security.selinux testfile"
+ rlRun "getfattr -e hex -n security.selinux testfile | grep -E '0x6100[0-9a-f]+'" 1 \
+ "Check for junk in the output of getfattr"
+ rlPhaseEnd
+
+ rlPhaseStartCleanup
+ if [ "$reset_enforcing" -eq 1 ]; then
+ rlRun "setenforce 1" 0 "Switch back to enforcing"
+ fi
+ rlRun "rm -f testfile"
+ rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd
diff --git a/kernel/journald_performance/main.fmf b/kernel/journald_performance/main.fmf
new file mode 100644
index 0000000..755f41a
--- /dev/null
+++ b/kernel/journald_performance/main.fmf
@@ -0,0 +1,24 @@
+summary: Test journald performance under SELinux
+description: |
+ Regression test for a bug where systemd-journald suffered a terrible
+ performance overhead due to SELinux.
+contact: Ondrej Mosnacek <omosnace@redhat.com>
+component:
+ - kernel
+framework: beakerlib
+require:
+ - perf
+ - util-linux
+ - coreutils
+ - perl-interpreter
+ - perl-open
+ - git-core
+duration: 30m
+tier: 2
+enabled: true
+adjust:
+ - enabled: false
+ when: distro < rhel-8.3
+ because: RHEL-8.2 and below are not expected to have the bug fixed
+link:
+ - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1733259
diff --git a/kernel/journald_performance/runtest.sh b/kernel/journald_performance/runtest.sh
new file mode 100755
index 0000000..bb960db
--- /dev/null
+++ b/kernel/journald_performance/runtest.sh
@@ -0,0 +1,51 @@
+#!/bin/bash
+# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# SPDX-License-Identifier: GPLv2
+# Copyright (c) 2022 Red Hat, Inc.
+# Author: Ondrej Mosnacek <omosnace@redhat.com>
+
+# Include Beakerlib environment
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+FG_URL="https://github.com/brendangregg/FlameGraph"
+FG_DIR="FlameGraph"
+
+TARGET_SYMBOL="security_secid_to_secctx"
+LIMIT="10.00%"
+
+rlJournalStart
+ rlPhaseStartSetup
+ rlRun "uname -r" 0 "Print running kernel version"
+
+ rlRun "git clone $FG_URL $FG_DIR"
+ rlPhaseEnd
+
+ rlPhaseStartTest
+ JOURNALD_PID=$(pidof systemd-journald)
+ rlLog "PID of systemd-journald is $JOURNALD_PID"
+
+ rlRun "cat /dev/urandom | base64 | logger &" 0 \
+ "Flood systemd-journald with data"
+ rlRun "timeout 30s perf record -o perf.data -p $(pidof systemd-journald) -g --call-graph dwarf" 124 \
+ "Capture perf data on systemd-journald"
+ rlRun "kill %1"
+
+ rlRun "perf script -i perf.data | $FG_DIR/stackcollapse-perf.pl | $FG_DIR/flamegraph.pl > flamegraph.svg"
+
+ rlRun "perf report -i perf.data -g none --pretty raw | grep $TARGET_SYMBOL"
+ PERCENT="$(perf report -g none --pretty raw | grep $TARGET_SYMBOL | \
+ grep -Eo '[0-9]+\.[0-9]+%' | head -n 1)"
+ rlLog "Detected that $TARGET_SYMBOL took up $PERCENT of time (limit $LIMIT)."
+ rlRun "{ echo \$PERCENT; echo \$LIMIT; } | sort -n | tail -n 1 | grep \$LIMIT" 0 \
+ "Check that time usage is within limit"
+ rlPhaseEnd
+
+ rlPhaseStartCleanup
+ rlFileSubmit "perf.data"
+ rlFileSubmit "flamegraph.svg"
+
+ rlRun "rm -rf $FG_DIR"
+ rlRun "rm -f perf.data flamegraph.svg"
+ rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd
diff --git a/kernel/keycreate_empty_value/main.fmf b/kernel/keycreate_empty_value/main.fmf
new file mode 100644
index 0000000..80cfd80
--- /dev/null
+++ b/kernel/keycreate_empty_value/main.fmf
@@ -0,0 +1,20 @@
+summary: Test writing empty value into /proc/self/attr/keycreate
+description: |
+ Verifies that writing an empty value into /proc/<PID>/attr/keycreate
+ is allowed.
+contact: Ondrej Mosnacek <omosnace@redhat.com>
+component:
+ - kernel
+framework: beakerlib
+require:
+ - policycoreutils
+ - gcc
+duration: 5m
+tier: 2
+enabled: true
+adjust:
+ - enabled: false
+ when: distro < rhel-8.1
+ because: RHEL-8.0 and below are not expected to have the bug fixed
+link:
+ - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1719067
diff --git a/kernel/keycreate_empty_value/reproducer.c b/kernel/keycreate_empty_value/reproducer.c
new file mode 100644
index 0000000..fa09608
--- /dev/null
+++ b/kernel/keycreate_empty_value/reproducer.c
@@ -0,0 +1,22 @@
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <unistd.h>
+#include <stdio.h>
+
+int main(void)
+{
+ int fd, r;
+
+ fd = open("/proc/self/attr/keycreate", O_WRONLY);
+ if (fd < 0) {
+ perror("open");
+ }
+
+ r = write(fd, "", 0);
+ if (r < 0) {
+ perror("write");
+ }
+
+ return !!r;
+}
diff --git a/kernel/keycreate_empty_value/runtest.sh b/kernel/keycreate_empty_value/runtest.sh
new file mode 100755
index 0000000..d8a0034
--- /dev/null
+++ b/kernel/keycreate_empty_value/runtest.sh
@@ -0,0 +1,37 @@
+#!/bin/bash
+# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# SPDX-License-Identifier: GPLv2
+# Copyright (c) 2022 Red Hat, Inc.
+# Author: Ondrej Mosnacek <omosnace@redhat.com>
+
+# Include Beakerlib environment
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+EXE="reproducer"
+
+rlJournalStart
+ rlPhaseStartSetup
+ rlRun "uname -r" 0 "Print running kernel version"
+
+ enable_container=0
+ if semodule -l | grep -q container; then
+ rlRun "semodule -d container" 0 "Disable the container module"
+ enable_container=1
+ fi
+
+ rlRun "gcc -o $EXE reproducer.c" 0 "Compile the reproducer"
+ rlPhaseEnd
+
+ rlPhaseStartTest
+ rlRun "./$EXE" 0 "Run the reproducer"
+ rlPhaseEnd
+
+ rlPhaseStartCleanup
+ rlRun "rm -f $EXE" 0 "Remove the reproducer binary"
+
+ if [ "$enable_container" -eq 1 ]; then
+ rlRun "semodule -e container" 0 "Re-enable the container module"
+ fi
+ rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd
diff --git a/kernel/labeling_before_policy_load/labeldump-expected.txt b/kernel/labeling_before_policy_load/labeldump-expected.txt
new file mode 100644
index 0000000..da985b5
--- /dev/null
+++ b/kernel/labeling_before_policy_load/labeldump-expected.txt
@@ -0,0 +1,3 @@
+system_u:object_r:etc_t:s0
+
+system_u:object_r:etc_t:s0
diff --git a/kernel/labeling_before_policy_load/main.fmf b/kernel/labeling_before_policy_load/main.fmf
new file mode 100644
index 0000000..edddad8
--- /dev/null
+++ b/kernel/labeling_before_policy_load/main.fmf
@@ -0,0 +1,27 @@
+summary: Test SELinux labeling before initial policy load
+description: |
+ Verifies that reading/writing SELinux labels works before the first policy
+ load.
+
+ See also:
+ https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3e3e24b42043eceb97ed834102c2d094dfd7aaa6
+ https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c8e222616c7e98305bdc861db3ccac520bc29921
+ https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9530a3e00459cd6eabf050133205e0e8fecbdfc7
+contact: Ondrej Mosnacek <omosnace@redhat.com>
+component:
+ - kernel
+framework: beakerlib
+require:
+ - dracut
+ - coreutils
+ - policycoreutils
+ - attr
+duration: 30m
+tier: 2
+enabled: true
+adjust:
+ - enabled: false
+ when: distro < rhel-8.3
+ because: RHEL-8.2 and below are not expected to support this
+link:
+ - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1777525
diff --git a/kernel/labeling_before_policy_load/module-setup.sh b/kernel/labeling_before_policy_load/module-setup.sh
new file mode 100644
index 0000000..d76aa67
--- /dev/null
+++ b/kernel/labeling_before_policy_load/module-setup.sh
@@ -0,0 +1,17 @@
+#!/bin/bash
+
+# called by dracut
+check() {
+ return 0
+}
+
+# called by dracut
+depends() {
+ return 0
+}
+
+# called by dracut
+install() {
+ inst_hook pre-pivot 50 "$moddir/relabel.sh"
+ inst_multiple setfiles getfattr
+}
diff --git a/kernel/labeling_before_policy_load/relabel.sh b/kernel/labeling_before_policy_load/relabel.sh
new file mode 100644
index 0000000..18c0cc6
--- /dev/null
+++ b/kernel/labeling_before_policy_load/relabel.sh
@@ -0,0 +1,15 @@
+#!/bin/bash
+
+function dumpcon() {
+ getfattr --only-values -n security.selinux "$@" | tr -d '\000'
+ echo
+}
+
+mount -o remount,rw /sysroot
+dumpcon /sysroot/etc >/sysroot/etc/labeldump
+echo test > /sysroot/etc/testfile
+dumpcon /sysroot/etc/testfile >>/sysroot/etc/labeldump
+setfiles -vF -r /sysroot \
+ /sysroot/etc/selinux/targeted/contexts/files/file_contexts \
+ /sysroot/etc
+dumpcon /sysroot/etc/testfile >>/sysroot/etc/labeldump
diff --git a/kernel/labeling_before_policy_load/runtest.sh b/kernel/labeling_before_policy_load/runtest.sh
new file mode 100755
index 0000000..ff92dfd
--- /dev/null
+++ b/kernel/labeling_before_policy_load/runtest.sh
@@ -0,0 +1,46 @@
+#!/bin/bash
+# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# SPDX-License-Identifier: GPLv2
+# Copyright (c) 2022 Red Hat, Inc.
+# Author: Ondrej Mosnacek <omosnace@redhat.com>
+
+# Include Beakerlib environment
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+rlJournalStart
+if [ $TMT_REBOOT_COUNT -lt 1 ]; then
+ rlPhaseStartSetup "Setup"
+ rlRun "uname -r" 0 "Kernel version before reboot"
+
+ rlRun "install -d /usr/lib/dracut/modules.d/97bz1777525"
+ rlRun "install module-setup.sh relabel.sh /usr/lib/dracut/modules.d/97bz1777525"
+ rlRun "dracut --regenerate-all -f"
+ if command -v zipl >/dev/null; then
+ rlRun "zipl"
+ fi
+ rlPhaseEnd
+
+ rlPhaseStartSetup "Reboot"
+ tmt-reboot
+fi
+ rlRun "uname -r" 0 "Kernel version after reboot"
+ rlPhaseEnd
+
+ rlPhaseStartTest "Test"
+ # Test writing labels (BZ 1777525)
+ rlRun "ls -lZ /etc/testfile"
+ rlRun "ls -lZ /etc/testfile | grep -qF ':etc_t:'" 0 \
+ "/etc/testfile is labeled correctly"
+
+ # Test reading labels (BZ 1839819)
+ rlRun "cat /etc/labeldump"
+ rlAssertNotDiffer "/etc/labeldump" labeldump-expected.txt
+ rlPhaseEnd
+
+ rlPhaseStartCleanup
+ rlRun "rm -f /etc/labeldump /etc/testfile"
+ rlRun "rm -rf /usr/lib/dracut/modules.d/97bz1777525"
+ rlRun "dracut -f"
+ rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd
diff --git a/kernel/policy_load_enomem_on_new_context/main.fmf b/kernel/policy_load_enomem_on_new_context/main.fmf
new file mode 100644
index 0000000..0f69dae
--- /dev/null
+++ b/kernel/policy_load_enomem_on_new_context/main.fmf
@@ -0,0 +1,17 @@
+summary: Test that creating a new SELinux context doesn't fail during policy load
+description: |
+ Verifies that there are no ENOMEM errors when the kernel encounters a new
+ SELinux context during a policy load.
+contact: Ondrej Mosnacek <omosnace@redhat.com>
+component:
+ - kernel
+framework: beakerlib
+require:
+ - policycoreutils
+ - diffutils
+duration: 10m
+tier: 2
+enabled: true
+link:
+ - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1335986
+ - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1656787
diff --git a/kernel/policy_load_enomem_on_new_context/runtest.sh b/kernel/policy_load_enomem_on_new_context/runtest.sh
new file mode 100755
index 0000000..a6c7196
--- /dev/null
+++ b/kernel/policy_load_enomem_on_new_context/runtest.sh
@@ -0,0 +1,36 @@
+#!/bin/bash
+# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# SPDX-License-Identifier: GPLv2
+# Copyright (c) 2019-2022 Red Hat, Inc.
+# Author: Milos Malik <mmalik@redhat.com>
+
+# Include Beakerlib environment
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+rlJournalStart
+ rlPhaseStartSetup
+ rlRun "uname -r" 0 "Print running kernel version"
+ rlPhaseEnd
+
+ rlPhaseStartTest "bz#1335986 + bz#1656787"
+ rlRun "dmesg > before.txt"
+ rlRun "while true; do load_policy; sleep 0.1; done &" 0 \
+ "Start reloading the policy in a loop"
+
+ function runcon_loop() {
+ for (( i = 0; i < 1024; i++ )); do
+ runcon -l s0:c$i true || return 1
+ done
+ return 0
+ }
+ rlRun "runcon_loop" 0 "Run runcon in a loop with varying contexts"
+ rlRun "dmesg > after.txt"
+ rlRun "diff before.txt after.txt | grep -e inode_doinit_with_dentry -e context_to_sid" 1
+ rlPhaseEnd
+
+ rlPhaseStartCleanup
+ rlRun "kill \$(jobs -p)" 0 "Terminate background jobs"
+ rlRun "wait" 0 "Wait for background jobs to terminate"
+ rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd
diff --git a/kernel/selinuxfs_dentry_softlockup/main.fmf b/kernel/selinuxfs_dentry_softlockup/main.fmf
new file mode 100644
index 0000000..5043c2e
--- /dev/null
+++ b/kernel/selinuxfs_dentry_softlockup/main.fmf
@@ -0,0 +1,18 @@
+summary: Test soft lockup on selinuxfs dentry lookup
+description: |
+ Verifies that traversing selinuxfs while policy is being reloaded doesn't
+ cause a deadlock in the kernel.
+contact: Ondrej Mosnacek <omosnace@redhat.com>
+component:
+ - kernel
+framework: beakerlib
+require:
+ - policycoreutils
+ - findutils
+duration: 5m
+tier: 2
+enabled: true
+link:
+ - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1510603
+extra-hardware: |
+ keyvalue = PROCESSORS >= 2
diff --git a/kernel/selinuxfs_dentry_softlockup/runtest.sh b/kernel/selinuxfs_dentry_softlockup/runtest.sh
new file mode 100755
index 0000000..779df6d
--- /dev/null
+++ b/kernel/selinuxfs_dentry_softlockup/runtest.sh
@@ -0,0 +1,37 @@
+#!/bin/bash
+# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# SPDX-License-Identifier: GPLv2
+# Copyright (c) 2022 Red Hat, Inc.
+# Author: Ondrej Mosnacek <omosnace@redhat.com>
+
+# Include Beakerlib environment
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+rlJournalStart
+ rlPhaseStartSetup
+ rlRun "uname -r" 0 "Print running kernel version"
+ rlPhaseEnd
+
+ rlPhaseStartTest
+ rlAssertGreaterOrEqual "Ensure the machine has at least two cores" \
+ "$(nproc)" 2
+
+ rlRun "(cd /sys/fs/selinux; while true; do find >/dev/null 2>&1; done) &"
+ rlRun "while true; do load_policy; sleep 0.1; done &"
+
+ function check_soft_lockup() {
+ for (( i = 0; i < 60; i++ )); do
+ dmesg | grep 'BUG: soft lockup' && return 1
+ sleep 1
+ done
+ return 0
+ }
+ rlRun "check_soft_lockup" 0 "Wait and see if soft lockup appears in dmesg"
+ rlPhaseEnd
+
+ rlPhaseStartCleanup
+ rlRun "kill \$(jobs -p)" 0 "Terminate background jobs"
+ rlRun "wait" 0 "Wait for background jobs to terminate"
+ rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2026-09-11 13:20 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-09-11 13:20 [tests/selinux] pr775-checkpolicy-revdeps: Port kernel tests from downstream Ondrej Mosnacek
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox