public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
From: Milos Malik <mmalik@redhat.com>
To: git-commits@fedoraproject.org
Subject: [tests/selinux] pr775-checkpolicy-revdeps: bring all downstream changes to the upstream tests
Date: Fri, 11 Sep 2026 13:20:20 GMT [thread overview]
Message-ID: <178913282026.1.10137717078507861814.tests-selinux-f1b7777fbf2f@fedoraproject.org> (raw)
A new commit has been pushed.
Repo : tests/selinux
Branch : pr775-checkpolicy-revdeps
Commit : f1b7777fbf2ff6d0e37dc2625b0d4e90644894a2
Author : Milos Malik <mmalik@redhat.com>
Date : 2022-12-01T18:42:46+01:00
Stats : +74/-41 in 11 file(s)
URL : https://src.fedoraproject.org/tests/selinux/c/f1b7777fbf2ff6d0e37dc2625b0d4e90644894a2?branch=pr775-checkpolicy-revdeps
Log:
bring all downstream changes to the upstream tests
Downstream and upstream versions of certain automated tests
diverged before the duplicates were removed.
Now, they should be in sync.
---
diff --git a/selinux-policy/accounts-daemon-and-similar/Makefile b/selinux-policy/accounts-daemon-and-similar/Makefile
index 1923789..249d054 100644
--- a/selinux-policy/accounts-daemon-and-similar/Makefile
+++ b/selinux-policy/accounts-daemon-and-similar/Makefile
@@ -55,7 +55,7 @@ $(METADATA): Makefile
@echo "TestTime: 10m" >> $(METADATA)
@echo "RunFor: accountsservice" >> $(METADATA)
@echo "RunFor: selinux-policy" >> $(METADATA)
- @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console accountsservice glib2 procps-ng realmd initscripts" >> $(METADATA)
+ @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console accountsservice glib2 procps-ng realmd initscripts gdm" >> $(METADATA)
@echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA)
@echo "Priority: Normal" >> $(METADATA)
@echo "License: GPLv2" >> $(METADATA)
@@ -80,6 +80,13 @@ $(METADATA): Makefile
@echo "Bug: 1829013" >> $(METADATA) # Fedora 32
@echo "Bug: 1829075" >> $(METADATA) # Fedora 32
@echo "Bug: 1829128" >> $(METADATA) # Fedora 32
+ @echo "Bug: 1928546" >> $(METADATA) # Fedora 34
+ @echo "Bug: 1928565" >> $(METADATA) # Fedora 34
+ @echo "Bug: 1928567" >> $(METADATA) # Fedora 34
+ @echo "Bug: 1933687" >> $(METADATA) # Fedora 34
+ @echo "Bug: 1933842" >> $(METADATA) # RHEL-9
+ @echo "Bug: 1934573" >> $(METADATA) # Fedora 34
+ @echo "Bug: 1935232" >> $(METADATA) # RHEL-9
rhts-lint $(METADATA)
diff --git a/selinux-policy/accounts-daemon-and-similar/main.fmf b/selinux-policy/accounts-daemon-and-similar/main.fmf
index 86dea1b..85c80d0 100644
--- a/selinux-policy/accounts-daemon-and-similar/main.fmf
+++ b/selinux-policy/accounts-daemon-and-similar/main.fmf
@@ -5,6 +5,8 @@ description: |+
contact: Milos Malik <mmalik@redhat.com>
component:
- selinux-policy
+test: ./runtest.sh
+framework: beakerlib
require:
- library(selinux-policy/common)
recommend:
@@ -20,6 +22,7 @@ recommend:
- procps-ng
- realmd
- initscripts
+ - gdm
environment:
AVC_ERROR: +no_avc_check
duration: 10m
@@ -54,13 +57,13 @@ link:
- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1829013
- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1829075
- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1829128
- - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1935232
- - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1933842
- - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1933687
- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1928546
- - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1934573
- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1928565
- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1928567
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1933687
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1933842
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1934573
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1935232
adjust:
- enabled: false
when: distro == rhel-4, rhel-5, rhel-6
diff --git a/selinux-policy/accounts-daemon-and-similar/runtest.sh b/selinux-policy/accounts-daemon-and-similar/runtest.sh
index 0c64eb0..40839e9 100755
--- a/selinux-policy/accounts-daemon-and-similar/runtest.sh
+++ b/selinux-policy/accounts-daemon-and-similar/runtest.sh
@@ -119,6 +119,14 @@ rlJournalStart
rlPhaseEnd
fi
+ if seinfo --common file -x | grep -q watch ; then
+ rlPhaseStartTest "bz#1928546 + bz#1933842 + bz#1935232"
+ rlSEMatchPathCon "/usr/libexec/accounts-daemon" "accountsd_exec_t"
+ rlSEMatchPathCon "/etc/gdm" "xdm_etc_t"
+ rlSESearchRule "allow accountsd_t xdm_etc_t : dir { watch } [ ]"
+ rlPhaseEnd
+ fi
+
rlPhaseStartTest "real scenario"
rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root"
if ! rlSEDefined ${PROCESS_CONTEXT} ; then
diff --git a/selinux-policy/acpid-and-similar/Makefile b/selinux-policy/acpid-and-similar/Makefile
index 3803c53..8abefeb 100644
--- a/selinux-policy/acpid-and-similar/Makefile
+++ b/selinux-policy/acpid-and-similar/Makefile
@@ -69,6 +69,7 @@ $(METADATA): Makefile
@echo "Bug: 1468548" >> $(METADATA) # RHEL-7
@echo "Bug: 1622417" >> $(METADATA) # RHEL-7
@echo "Bug: 1623342" >> $(METADATA) # RHEL-7
+ @echo "Bug: 1932294" >> $(METADATA) # RHEL-9
rhts-lint $(METADATA)
diff --git a/selinux-policy/acpid-and-similar/runtest.sh b/selinux-policy/acpid-and-similar/runtest.sh
index 9034f7d..52e751d 100755
--- a/selinux-policy/acpid-and-similar/runtest.sh
+++ b/selinux-policy/acpid-and-similar/runtest.sh
@@ -98,6 +98,14 @@ rlJournalStart
rlPhaseEnd
fi
+ if seinfo --common file -x | grep -q watch ; then
+ rlPhaseStartTest "bz#1932294"
+ rlSEMatchPathCon "/usr/sbin/acpid" "apmd_exec_t"
+ rlSEMatchPathCon "/dev/input" "device_t"
+ rlSESearchRule "allow apmd_t device_t : dir { watch } [ ]"
+ rlPhaseEnd
+ fi
+
rlPhaseStartTest "real scenario"
rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root"
if ! rlSEDefined ${PROCESS_CONTEXT} ; then
@@ -108,7 +116,7 @@ rlJournalStart
fi
fi
rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1
- rlRun "restorecon -Rv /var /run"
+ rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255
rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1
rlPhaseEnd
diff --git a/selinux-policy/boltd-and-similar/runtest.sh b/selinux-policy/boltd-and-similar/runtest.sh
index 17359a7..682646f 100755
--- a/selinux-policy/boltd-and-similar/runtest.sh
+++ b/selinux-policy/boltd-and-similar/runtest.sh
@@ -126,13 +126,12 @@ rlJournalStart
fi
fi
rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1
- rlRun "restorecon -Rv /run /var"
+ rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255
rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1
rlPhaseEnd
rlPhaseStartTest "real scenario -- confined users"
- rlSEConfigureSSH
-
+ CREATED_USERS=""
rlRun "setsebool ssh_sysadm_login on"
rlLog "configuration says not to test SELinux users: ${DENIED_USERS}"
for SELINUX_USER in ${ALLOWED_USERS} ; do
@@ -143,10 +142,12 @@ rlJournalStart
rlRun "restorecon -RvF /home/${USER_NAME}"
rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost boltctl list"
sleep 2
- rlRun "userdel -rfZ ${USER_NAME}"
- sleep 10
+ CREATED_USERS="${USER_NAME} ${CREATED_USERS}"
done
rlRun "setsebool ssh_sysadm_login off"
+ for USER_NAME in ${CREATED_USERS} ; do
+ rlRun "userdel -rfZ ${USER_NAME}"
+ done
rlPhaseEnd
rlPhaseStartCleanup
@@ -154,7 +155,6 @@ rlJournalStart
rlSECheckAVC
rlFileRestore
- rlRun "service sshd restart"
rlServiceRestore ${SERVICE_NAME}
rlPhaseEnd
rlJournalPrintText
diff --git a/selinux-policy/colord-and-similar/runtest.sh b/selinux-policy/colord-and-similar/runtest.sh
index f082735..badb931 100755
--- a/selinux-policy/colord-and-similar/runtest.sh
+++ b/selinux-policy/colord-and-similar/runtest.sh
@@ -73,8 +73,7 @@ rlJournalStart
if ! rlIsRHEL 5 6 7 ; then
rlPhaseStartTest "real scenario -- user session service"
- rlSEConfigureSSH
-
+ CREATED_USERS=""
rlRun "setsebool ssh_sysadm_login on"
rlLog "configuration says not to test SELinux users: ${DENIED_USERS}"
for SELINUX_USER in ${ALLOWED_USERS} ; do
@@ -86,10 +85,13 @@ rlJournalStart
rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost /usr/bin/systemctl --user --no-pager status colord-session"
rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost /usr/bin/systemctl --user --no-pager start colord-session"
rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost /usr/bin/systemctl --user --no-pager stop colord-session"
- rlRun "userdel -rfZ ${USER_NAME}"
- sleep 10
+ sleep 2
+ CREATED_USERS="${USER_NAME} ${CREATED_USERS}"
done
rlRun "setsebool ssh_sysadm_login off"
+ for USER_NAME in ${CREATED_USERS} ; do
+ rlRun "userdel -rfZ ${USER_NAME}"
+ done
rlPhaseEnd
rlPhaseStartTest "bz#1772669"
@@ -105,6 +107,7 @@ rlJournalStart
rlPhaseEnd
rlPhaseStartTest "real scenario -- bz#1772669"
+ CREATED_USERS=""
rlRun "setsebool ssh_sysadm_login on"
rlLog "configuration says not to test SELinux users: ${DENIED_USERS}"
for SELINUX_USER in ${ALLOWED_USERS} ; do
@@ -115,10 +118,12 @@ rlJournalStart
rlRun "restorecon -RvF /home/${USER_NAME}"
rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost colormgr get-devices"
sleep 2
- rlRun "userdel -rfZ ${USER_NAME}"
- sleep 10
+ CREATED_USERS="${USER_NAME} ${CREATED_USERS}"
done
rlRun "setsebool ssh_sysadm_login off"
+ for USER_NAME in ${CREATED_USERS} ; do
+ rlRun "userdel -rfZ ${USER_NAME}"
+ done
rlPhaseEnd
fi
@@ -132,7 +137,7 @@ rlJournalStart
fi
fi
rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1
- rlRun "restorecon -Rv /run /var"
+ rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255
rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1
rlPhaseEnd
@@ -141,7 +146,6 @@ rlJournalStart
rlSECheckAVC
rlFileRestore
- rlRun "service sshd restart"
rlServiceRestore ${SERVICE_NAME}
rlPhaseEnd
rlJournalPrintText
diff --git a/selinux-policy/cups-pdf-and-similar/runtest.sh b/selinux-policy/cups-pdf-and-similar/runtest.sh
index 2e20f6e..a8d6c77 100755
--- a/selinux-policy/cups-pdf-and-similar/runtest.sh
+++ b/selinux-policy/cups-pdf-and-similar/runtest.sh
@@ -107,8 +107,7 @@ rlJournalStart
rlPhaseEnd
rlPhaseStartTest "real scenario -- confined users"
- rlSEConfigureSSH
-
+ CREATED_USERS=""
rlRun "lpadmin -x cups-pdf" 0-255
rlRun "lpadmin -p cups-pdf -v cups-pdf:/ -E -P /usr/share/cups/model/CUPS-PDF_opt.ppd"
rlRun "setsebool ssh_sysadm_login on"
@@ -123,12 +122,14 @@ rlJournalStart
rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost lpr -P cups-pdf /usr/share/cups/data/testprint"
sleep 5
rlRun "find /home/${USER_NAME} -type f | grep testprint-job"
- rlRun "userdel -rfZ ${USER_NAME}"
- sleep 10
+ CREATED_USERS="${USER_NAME} ${CREATED_USERS}"
done
rlRun "setsebool selinuxuser_tcp_server off"
rlRun "setsebool ssh_sysadm_login off"
rlRun "lpadmin -x cups-pdf"
+ for USER_NAME in ${CREATED_USERS} ; do
+ rlRun "userdel -rfZ ${USER_NAME}"
+ done
rlPhaseEnd
rlPhaseStartCleanup
@@ -137,7 +138,6 @@ rlJournalStart
rlFileRestore
rlServiceRestore ${SERVICE_NAME}
- rlRun "service sshd restart"
rlPhaseEnd
rlJournalPrintText
rlJournalEnd
diff --git a/selinux-policy/dmidecode-and-similar/runtest.sh b/selinux-policy/dmidecode-and-similar/runtest.sh
index 1885ae8..e6189f3 100755
--- a/selinux-policy/dmidecode-and-similar/runtest.sh
+++ b/selinux-policy/dmidecode-and-similar/runtest.sh
@@ -108,8 +108,7 @@ rlJournalStart
rlPhaseEnd
rlPhaseStartTest "real scenario -- confined users"
- rlSEConfigureSSH
-
+ CREATED_USERS=""
rlRun "setsebool ssh_sysadm_login on"
rlLog "configuration says not to test SELinux users: ${DENIED_USERS}"
for SELINUX_USER in ${ALLOWED_USERS} ; do
@@ -131,11 +130,12 @@ rlJournalStart
rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost /usr/sbin/ownership"
fi
sleep 2
- rlRun "userdel -rfZ ${USER_NAME}"
+ CREATED_USERS="${USER_NAME} ${CREATED_USERS}"
done
rlRun "setsebool ssh_sysadm_login off"
- rlFileRestore
- rlRun "service sshd restart"
+ for USER_NAME in ${CREATED_USERS} ; do
+ rlRun "userdel -rfZ ${USER_NAME}"
+ done
rlPhaseEnd
rlPhaseStartCleanup
diff --git a/selinux-policy/fwupd-and-similar/runtest.sh b/selinux-policy/fwupd-and-similar/runtest.sh
index 91b2300..e5ce44d 100755
--- a/selinux-policy/fwupd-and-similar/runtest.sh
+++ b/selinux-policy/fwupd-and-similar/runtest.sh
@@ -95,7 +95,7 @@ rlJournalStart
PROCESS_CONTEXT="unconfined_service_t"
fi
rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1
- rlRun "restorecon -Rv /run /var" 0-255
+ rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255
rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1
rlPhaseEnd
@@ -154,8 +154,7 @@ rlJournalStart
fi
rlPhaseStartTest "real scenario -- confined users -- bz#1772619"
- rlSEConfigureSSH
-
+ CREATED_USERS=""
rlRun "setsebool ssh_sysadm_login on"
rlLog "configuration says not to test SELinux users: ${DENIED_USERS}"
for SELINUX_USER in ${ALLOWED_USERS} ; do
@@ -166,10 +165,12 @@ rlJournalStart
rlRun "restorecon -RvF /home/${USER_NAME}"
rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost fwupdmgr get-devices"
sleep 2
- rlRun "userdel -rfZ ${USER_NAME}"
- sleep 10
+ CREATED_USERS="${USER_NAME} ${CREATED_USERS}"
done
rlRun "setsebool ssh_sysadm_login off"
+ for USER_NAME in ${CREATED_USERS} ; do
+ rlRun "userdel -rfZ ${USER_NAME}"
+ done
rlPhaseEnd
rlPhaseStartCleanup
@@ -177,7 +178,6 @@ rlJournalStart
rlSECheckAVC
rlFileRestore
- rlRun "service sshd restart"
rlServiceRestore ${SERVICE_NAME}
rlPhaseEnd
rlJournalPrintText
diff --git a/selinux-policy/policykit-general/runtest.sh b/selinux-policy/policykit-general/runtest.sh
index 6388404..9775454 100755
--- a/selinux-policy/policykit-general/runtest.sh
+++ b/selinux-policy/policykit-general/runtest.sh
@@ -143,13 +143,12 @@ rlJournalStart
fi
fi
rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1
- rlRun "restorecon -Rv /run /var"
+ rlRun "restorecon -Rv /var /run -e /var/ARTIFACTS" 0-255
rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1
rlPhaseEnd
rlPhaseStartTest "real scenario -- confined users"
- rlSEConfigureSSH
-
+ CREATED_USERS=""
rlRun "setsebool ssh_sysadm_login on"
for SELINUX_USER in ${ALLOWED_USERS} ; do
USER_NAME="user${RANDOM}"
@@ -158,9 +157,13 @@ rlJournalStart
rlRun "echo ${USER_SECRET} | passwd --stdin ${USER_NAME}"
rlRun "restorecon -Rv /home/${USER_NAME}"
rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost pkaction"
- rlRun "userdel -rfZ ${USER_NAME}"
+ sleep 2
+ CREATED_USERS="${USER_NAME} ${CREATED_USERS}"
done
rlRun "setsebool ssh_sysadm_login off"
+ for USER_NAME in ${CREATED_USERS} ; do
+ rlRun "userdel -rfZ ${USER_NAME}"
+ done
rlPhaseEnd
fi
@@ -170,7 +173,6 @@ rlJournalStart
rlFileRestore
rlServiceRestore ${SERVICE_NAME}
- rlRun "service sshd restart"
rlPhaseEnd
rlJournalPrintText
rlJournalEnd
reply other threads:[~2026-09-11 13:20 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=178913282026.1.10137717078507861814.tests-selinux-f1b7777fbf2f@fedoraproject.org \
--to=mmalik@redhat.com \
--cc=git-commits@fedoraproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox