[tests/selinux] pr775-checkpolicy-revdeps: exclude the /var/ARTIFACTS when running restorecon

public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed

From: Milos Malik <mmalik@redhat.com>
To: git-commits@fedoraproject.org
Subject: [tests/selinux] pr775-checkpolicy-revdeps: exclude the /var/ARTIFACTS when running restorecon
Date: Fri, 11 Sep 2026 13:20:26 GMT	[thread overview]
Message-ID: <178913282688.1.720340799627801101.tests-selinux-d7ee07804b88@fedoraproject.org> (raw)

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : d7ee07804b8803510c4bb2f8e2efc56247e8768e
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2023-01-23T15:55:29+01:00
            Stats  : +19/-19 in 19 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/d7ee07804b8803510c4bb2f8e2efc56247e8768e?branch=pr775-checkpolicy-revdeps

            Log:
            exclude the /var/ARTIFACTS when running restorecon

A lot of running services create various FS objects under the
/var or the /run directories. These objects may get SELinux
labels which are different than what file context database specifies.

To reveal such discrepancies, many automated tests run the
"restorecon -Rv /run /var" command.

Unfortunately, the command affects SELinux contexts of files
and directories stored under /var/ARTIFACTS/. For example:
the rlFileBackup function uses this location as storage.

To avoid unpleasant effects of the restorecon command on anything
stored under /var/ARTIFACTS, the restorecon command intentionally
excluded that directory.

---
diff --git a/selinux-policy/accounts-daemon-and-similar/runtest.sh b/selinux-policy/accounts-daemon-and-similar/runtest.sh
index 40839e9..38ea62c 100755
--- a/selinux-policy/accounts-daemon-and-similar/runtest.sh
+++ b/selinux-policy/accounts-daemon-and-similar/runtest.sh
@@ -140,7 +140,7 @@ rlJournalStart
         rlRun "restorecon -Rv /etc"
         rlRun "service realmd start" # helps to reproduce BZ#1792895
         rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1
-        rlRun "restorecon -Rv /run /var" 0-255
+        rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255
         rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1
     rlPhaseEnd
 

diff --git a/selinux-policy/bgpd-and-similar/runtest.sh b/selinux-policy/bgpd-and-similar/runtest.sh
index 7acd85e..6dd2698 100755
--- a/selinux-policy/bgpd-and-similar/runtest.sh
+++ b/selinux-policy/bgpd-and-similar/runtest.sh
@@ -80,7 +80,7 @@ rlJournalStart
     rlPhaseStartTest "real scenario -- standalone service"
         rlRun "sed -i 's/^\(include.*\)$/# \1/' /etc/bgpd.conf"
         rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1
-        rlRun "restorecon -Rv /run /var" 0-255
+        rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255
         rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1
     rlPhaseEnd
 

diff --git a/selinux-policy/bz624405-pcsc-and-similar/runtest.sh b/selinux-policy/bz624405-pcsc-and-similar/runtest.sh
index 5a2838f..29d27e5 100755
--- a/selinux-policy/bz624405-pcsc-and-similar/runtest.sh
+++ b/selinux-policy/bz624405-pcsc-and-similar/runtest.sh
@@ -101,7 +101,7 @@ rlJournalStart
             fi
         fi
         rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1
-        rlRun "restorecon -Rv /run /var" 0-255
+        rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255
         rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1
     rlPhaseEnd
 

diff --git a/selinux-policy/caddy-and-similar/runtest.sh b/selinux-policy/caddy-and-similar/runtest.sh
index 7cf9384..69ff27c 100755
--- a/selinux-policy/caddy-and-similar/runtest.sh
+++ b/selinux-policy/caddy-and-similar/runtest.sh
@@ -72,7 +72,7 @@ rlJournalStart
         rlRun "semanage fcontext -l -C | grep caddy"
         for SERVICE_NAME in caddy caddy-api ; do
             rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1
-            rlRun "restorecon -Rv /run /var" 0-255
+            rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255
             rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1
         done
     rlPhaseEnd

diff --git a/selinux-policy/cups-browsed-and-similar/runtest.sh b/selinux-policy/cups-browsed-and-similar/runtest.sh
index 3b7c056..3db7b5c 100755
--- a/selinux-policy/cups-browsed-and-similar/runtest.sh
+++ b/selinux-policy/cups-browsed-and-similar/runtest.sh
@@ -80,7 +80,7 @@ rlJournalStart
             fi
         fi
         rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1
-        rlRun "restorecon -Rv /run /var"
+        rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255
         rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1
     rlPhaseEnd
 

diff --git a/selinux-policy/fapolicyd-and-similar/runtest.sh b/selinux-policy/fapolicyd-and-similar/runtest.sh
index 49ccb65..1d532eb 100755
--- a/selinux-policy/fapolicyd-and-similar/runtest.sh
+++ b/selinux-policy/fapolicyd-and-similar/runtest.sh
@@ -109,7 +109,7 @@ rlJournalStart
             PROCESS_CONTEXT="unconfined_service_t"
         fi
         rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1
-        rlRun "restorecon -Rv /run /var"
+        rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255
         rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1
     rlPhaseEnd
 

diff --git a/selinux-policy/ksm-and-similar/runtest.sh b/selinux-policy/ksm-and-similar/runtest.sh
index 21d276f..2d26a1f 100755
--- a/selinux-policy/ksm-and-similar/runtest.sh
+++ b/selinux-policy/ksm-and-similar/runtest.sh
@@ -86,7 +86,7 @@ rlJournalStart
         rlRun "sed -i 's/^ConditionVirtualization=.*$//' /usr/lib/systemd/system/ksm.service"
         rlRun "systemctl daemon-reload"
         rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "start status" 1
-        rlRun "restorecon -Rv /etc /run /var" 0-255
+        rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255
         rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "restart status stop status" 1
     rlPhaseEnd
 

diff --git a/selinux-policy/nfsdcld-and-similar/runtest.sh b/selinux-policy/nfsdcld-and-similar/runtest.sh
index bf4b321..a97e694 100755
--- a/selinux-policy/nfsdcld-and-similar/runtest.sh
+++ b/selinux-policy/nfsdcld-and-similar/runtest.sh
@@ -69,7 +69,7 @@ rlJournalStart
             PROCESS_CONTEXT="unconfined_service_t"
         fi
         rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1
-        rlRun "restorecon -Rv /run /var"
+        rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255
         rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1
     rlPhaseEnd
 

diff --git a/selinux-policy/numad-and-similar/runtest.sh b/selinux-policy/numad-and-similar/runtest.sh
index 3d2efe1..27d5b96 100755
--- a/selinux-policy/numad-and-similar/runtest.sh
+++ b/selinux-policy/numad-and-similar/runtest.sh
@@ -108,7 +108,7 @@ rlJournalStart
         rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1
         rlRun "numad -S 0"
         rlRun "numad -S 1"
-        rlRun "restorecon -Rv /run /var"
+        rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255
         rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1
     rlPhaseEnd
 

diff --git a/selinux-policy/rngd-and-similar/runtest.sh b/selinux-policy/rngd-and-similar/runtest.sh
index 9007917..4401f0d 100755
--- a/selinux-policy/rngd-and-similar/runtest.sh
+++ b/selinux-policy/rngd-and-similar/runtest.sh
@@ -169,7 +169,7 @@ rlJournalStart
         rlRun "setsebool daemons_use_tty on"
         rlRun "runcon system_u:system_r:initrc_t:s0 bash -c 'rngd -l'" 0-255
         rlRun "setsebool daemons_use_tty off"
-        rlRun "restorecon -Rv /run /var" 0-255
+        rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255
         rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status" 1
         if ${DROP_PRIV} ; then
             rlLog "modifying the /etc/sysconfig/rngd file"

diff --git a/selinux-policy/rrdcached-service-and-related/runtest.sh b/selinux-policy/rrdcached-service-and-related/runtest.sh
index d26e456..bd201e4 100755
--- a/selinux-policy/rrdcached-service-and-related/runtest.sh
+++ b/selinux-policy/rrdcached-service-and-related/runtest.sh
@@ -86,7 +86,7 @@ rlJournalStart
 
     rlPhaseStartTest "real scenario"
         rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 2
-        rlRun "restorecon -Rv /run /var"
+        rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255
         rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 2
     rlPhaseEnd
 

diff --git a/selinux-policy/rtkit-daemon-and-similar/runtest.sh b/selinux-policy/rtkit-daemon-and-similar/runtest.sh
index f7e2613..6cf0153 100755
--- a/selinux-policy/rtkit-daemon-and-similar/runtest.sh
+++ b/selinux-policy/rtkit-daemon-and-similar/runtest.sh
@@ -108,7 +108,7 @@ rlJournalStart
             fi
         fi
         rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1
-        rlRun "restorecon -Rv /run /var"
+        rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255
         rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1
     rlPhaseEnd
     fi

diff --git a/selinux-policy/stalld-and-similar/runtest.sh b/selinux-policy/stalld-and-similar/runtest.sh
index 909a0b5..90f86ef 100755
--- a/selinux-policy/stalld-and-similar/runtest.sh
+++ b/selinux-policy/stalld-and-similar/runtest.sh
@@ -108,7 +108,7 @@ rlJournalStart
         rlRun "journalctl -u ${SERVICE_NAME} > after.txt"
         rlRun "setsebool domain_can_write_kmsg on"
         rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status" 1
-        rlRun "restorecon -Rv /run /var" 0-255
+        rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255
         rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "stop status" 1
         rlRun "setsebool domain_can_write_kmsg off"
         rlRun "diff before.txt after.txt | grep -i -e 'operation not permitted' -e 'permission denied'" 1

diff --git a/selinux-policy/systemd-bootchart-and-similar/runtest.sh b/selinux-policy/systemd-bootchart-and-similar/runtest.sh
index c8bbacd..362b6a2 100755
--- a/selinux-policy/systemd-bootchart-and-similar/runtest.sh
+++ b/selinux-policy/systemd-bootchart-and-similar/runtest.sh
@@ -81,7 +81,7 @@ rlJournalStart
             PROCESS_CONTEXT="unconfined_service_t"
         fi
         rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1
-        rlRun "restorecon -Rv /run /var" 0-255
+        rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255
         rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1
     rlPhaseEnd
 

diff --git a/selinux-policy/systemd-modules-load-and-similar/runtest.sh b/selinux-policy/systemd-modules-load-and-similar/runtest.sh
index 0e951c8..920c3e0 100755
--- a/selinux-policy/systemd-modules-load-and-similar/runtest.sh
+++ b/selinux-policy/systemd-modules-load-and-similar/runtest.sh
@@ -110,7 +110,7 @@ rlJournalStart
         rlRun "lsmod"
         rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} - ${PROCESS_CONTEXT} "start status" 1
         rlRun "lsmod | grep ${KERNEL_MODULE}"
-        rlRun "restorecon -Rv /run /var" 0-255
+        rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255
         rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} - ${PROCESS_CONTEXT} "stop status" 1
         rlRun "lsmod"
         rlRun "rm -f /etc/modules-load.d/${KERNEL_MODULE}.conf"

diff --git a/selinux-policy/systemd-sysctl-and-similar/runtest.sh b/selinux-policy/systemd-sysctl-and-similar/runtest.sh
index d7f0d06..f7ad2d3 100755
--- a/selinux-policy/systemd-sysctl-and-similar/runtest.sh
+++ b/selinux-policy/systemd-sysctl-and-similar/runtest.sh
@@ -63,7 +63,7 @@ rlJournalStart
 
     rlPhaseStartTest "real scenario"
         rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "start status" 1
-        rlRun "restorecon -Rv /run /var" 0-255
+        rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255
         rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "restart status stop status" 1
     rlPhaseEnd
 

diff --git a/selinux-policy/systemd-timesyncd-and-similar/runtest.sh b/selinux-policy/systemd-timesyncd-and-similar/runtest.sh
index 886546a..37f186c 100755
--- a/selinux-policy/systemd-timesyncd-and-similar/runtest.sh
+++ b/selinux-policy/systemd-timesyncd-and-similar/runtest.sh
@@ -118,7 +118,7 @@ rlJournalStart
             PROCESS_CONTEXT="unconfined_service_t"
         fi
         rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1
-        rlRun "restorecon -Rv /run /var" 0-255
+        rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255
         rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1
     rlPhaseEnd
     fi

diff --git a/selinux-policy/systemd-userdbd-and-similar/runtest.sh b/selinux-policy/systemd-userdbd-and-similar/runtest.sh
index 38bf5c6..f7cf06f 100755
--- a/selinux-policy/systemd-userdbd-and-similar/runtest.sh
+++ b/selinux-policy/systemd-userdbd-and-similar/runtest.sh
@@ -107,7 +107,7 @@ rlJournalStart
             PROCESS_CONTEXT="unconfined_service_t"
         fi
         rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1
-        rlRun "restorecon -Rv /run /var" 0-255
+        rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255
         rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1
     rlPhaseEnd
 

diff --git a/selinux-policy/usbguard-daemon-and-similar/runtest.sh b/selinux-policy/usbguard-daemon-and-similar/runtest.sh
index a23c68f..6c00b0c 100755
--- a/selinux-policy/usbguard-daemon-and-similar/runtest.sh
+++ b/selinux-policy/usbguard-daemon-and-similar/runtest.sh
@@ -85,7 +85,7 @@ rlJournalStart
             PROCESS_CONTEXT="unconfined_service_t"
         fi
         rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1
-        rlRun "restorecon -Rv /run /var"
+        rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255
         rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1
     rlPhaseEnd

                 reply	other threads:[~2026-09-11 13:20 UTC|newest]

Thread overview: [no followups] expand[flat|nested]  mbox.gz  Atom feed

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=178913282688.1.720340799627801101.tests-selinux-d7ee07804b88@fedoraproject.org \
    --to=mmalik@redhat.com \
    --cc=git-commits@fedoraproject.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Be sure your reply has a Subject: header at the top and a blank line before the message body.

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox