public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
* [tests/selinux] pr775-checkpolicy-revdeps: exclude the /var/ARTIFACTS when running restorecon
@ 2026-09-11 13:20 Milos Malik
0 siblings, 0 replies; only message in thread
From: Milos Malik @ 2026-09-11 13:20 UTC (permalink / raw)
To: git-commits
A new commit has been pushed.
Repo : tests/selinux
Branch : pr775-checkpolicy-revdeps
Commit : d7ee07804b8803510c4bb2f8e2efc56247e8768e
Author : Milos Malik <mmalik@redhat.com>
Date : 2023-01-23T15:55:29+01:00
Stats : +19/-19 in 19 file(s)
URL : https://src.fedoraproject.org/tests/selinux/c/d7ee07804b8803510c4bb2f8e2efc56247e8768e?branch=pr775-checkpolicy-revdeps
Log:
exclude the /var/ARTIFACTS when running restorecon
A lot of running services create various FS objects under the
/var or the /run directories. These objects may get SELinux
labels which are different than what file context database specifies.
To reveal such discrepancies, many automated tests run the
"restorecon -Rv /run /var" command.
Unfortunately, the command affects SELinux contexts of files
and directories stored under /var/ARTIFACTS/. For example:
the rlFileBackup function uses this location as storage.
To avoid unpleasant effects of the restorecon command on anything
stored under /var/ARTIFACTS, the restorecon command intentionally
excluded that directory.
---
diff --git a/selinux-policy/accounts-daemon-and-similar/runtest.sh b/selinux-policy/accounts-daemon-and-similar/runtest.sh
index 40839e9..38ea62c 100755
--- a/selinux-policy/accounts-daemon-and-similar/runtest.sh
+++ b/selinux-policy/accounts-daemon-and-similar/runtest.sh
@@ -140,7 +140,7 @@ rlJournalStart
rlRun "restorecon -Rv /etc"
rlRun "service realmd start" # helps to reproduce BZ#1792895
rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1
- rlRun "restorecon -Rv /run /var" 0-255
+ rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255
rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1
rlPhaseEnd
diff --git a/selinux-policy/bgpd-and-similar/runtest.sh b/selinux-policy/bgpd-and-similar/runtest.sh
index 7acd85e..6dd2698 100755
--- a/selinux-policy/bgpd-and-similar/runtest.sh
+++ b/selinux-policy/bgpd-and-similar/runtest.sh
@@ -80,7 +80,7 @@ rlJournalStart
rlPhaseStartTest "real scenario -- standalone service"
rlRun "sed -i 's/^\(include.*\)$/# \1/' /etc/bgpd.conf"
rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1
- rlRun "restorecon -Rv /run /var" 0-255
+ rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255
rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1
rlPhaseEnd
diff --git a/selinux-policy/bz624405-pcsc-and-similar/runtest.sh b/selinux-policy/bz624405-pcsc-and-similar/runtest.sh
index 5a2838f..29d27e5 100755
--- a/selinux-policy/bz624405-pcsc-and-similar/runtest.sh
+++ b/selinux-policy/bz624405-pcsc-and-similar/runtest.sh
@@ -101,7 +101,7 @@ rlJournalStart
fi
fi
rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1
- rlRun "restorecon -Rv /run /var" 0-255
+ rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255
rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1
rlPhaseEnd
diff --git a/selinux-policy/caddy-and-similar/runtest.sh b/selinux-policy/caddy-and-similar/runtest.sh
index 7cf9384..69ff27c 100755
--- a/selinux-policy/caddy-and-similar/runtest.sh
+++ b/selinux-policy/caddy-and-similar/runtest.sh
@@ -72,7 +72,7 @@ rlJournalStart
rlRun "semanage fcontext -l -C | grep caddy"
for SERVICE_NAME in caddy caddy-api ; do
rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1
- rlRun "restorecon -Rv /run /var" 0-255
+ rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255
rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1
done
rlPhaseEnd
diff --git a/selinux-policy/cups-browsed-and-similar/runtest.sh b/selinux-policy/cups-browsed-and-similar/runtest.sh
index 3b7c056..3db7b5c 100755
--- a/selinux-policy/cups-browsed-and-similar/runtest.sh
+++ b/selinux-policy/cups-browsed-and-similar/runtest.sh
@@ -80,7 +80,7 @@ rlJournalStart
fi
fi
rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1
- rlRun "restorecon -Rv /run /var"
+ rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255
rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1
rlPhaseEnd
diff --git a/selinux-policy/fapolicyd-and-similar/runtest.sh b/selinux-policy/fapolicyd-and-similar/runtest.sh
index 49ccb65..1d532eb 100755
--- a/selinux-policy/fapolicyd-and-similar/runtest.sh
+++ b/selinux-policy/fapolicyd-and-similar/runtest.sh
@@ -109,7 +109,7 @@ rlJournalStart
PROCESS_CONTEXT="unconfined_service_t"
fi
rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1
- rlRun "restorecon -Rv /run /var"
+ rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255
rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1
rlPhaseEnd
diff --git a/selinux-policy/ksm-and-similar/runtest.sh b/selinux-policy/ksm-and-similar/runtest.sh
index 21d276f..2d26a1f 100755
--- a/selinux-policy/ksm-and-similar/runtest.sh
+++ b/selinux-policy/ksm-and-similar/runtest.sh
@@ -86,7 +86,7 @@ rlJournalStart
rlRun "sed -i 's/^ConditionVirtualization=.*$//' /usr/lib/systemd/system/ksm.service"
rlRun "systemctl daemon-reload"
rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "start status" 1
- rlRun "restorecon -Rv /etc /run /var" 0-255
+ rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255
rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "restart status stop status" 1
rlPhaseEnd
diff --git a/selinux-policy/nfsdcld-and-similar/runtest.sh b/selinux-policy/nfsdcld-and-similar/runtest.sh
index bf4b321..a97e694 100755
--- a/selinux-policy/nfsdcld-and-similar/runtest.sh
+++ b/selinux-policy/nfsdcld-and-similar/runtest.sh
@@ -69,7 +69,7 @@ rlJournalStart
PROCESS_CONTEXT="unconfined_service_t"
fi
rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1
- rlRun "restorecon -Rv /run /var"
+ rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255
rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1
rlPhaseEnd
diff --git a/selinux-policy/numad-and-similar/runtest.sh b/selinux-policy/numad-and-similar/runtest.sh
index 3d2efe1..27d5b96 100755
--- a/selinux-policy/numad-and-similar/runtest.sh
+++ b/selinux-policy/numad-and-similar/runtest.sh
@@ -108,7 +108,7 @@ rlJournalStart
rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1
rlRun "numad -S 0"
rlRun "numad -S 1"
- rlRun "restorecon -Rv /run /var"
+ rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255
rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1
rlPhaseEnd
diff --git a/selinux-policy/rngd-and-similar/runtest.sh b/selinux-policy/rngd-and-similar/runtest.sh
index 9007917..4401f0d 100755
--- a/selinux-policy/rngd-and-similar/runtest.sh
+++ b/selinux-policy/rngd-and-similar/runtest.sh
@@ -169,7 +169,7 @@ rlJournalStart
rlRun "setsebool daemons_use_tty on"
rlRun "runcon system_u:system_r:initrc_t:s0 bash -c 'rngd -l'" 0-255
rlRun "setsebool daemons_use_tty off"
- rlRun "restorecon -Rv /run /var" 0-255
+ rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255
rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status" 1
if ${DROP_PRIV} ; then
rlLog "modifying the /etc/sysconfig/rngd file"
diff --git a/selinux-policy/rrdcached-service-and-related/runtest.sh b/selinux-policy/rrdcached-service-and-related/runtest.sh
index d26e456..bd201e4 100755
--- a/selinux-policy/rrdcached-service-and-related/runtest.sh
+++ b/selinux-policy/rrdcached-service-and-related/runtest.sh
@@ -86,7 +86,7 @@ rlJournalStart
rlPhaseStartTest "real scenario"
rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 2
- rlRun "restorecon -Rv /run /var"
+ rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255
rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 2
rlPhaseEnd
diff --git a/selinux-policy/rtkit-daemon-and-similar/runtest.sh b/selinux-policy/rtkit-daemon-and-similar/runtest.sh
index f7e2613..6cf0153 100755
--- a/selinux-policy/rtkit-daemon-and-similar/runtest.sh
+++ b/selinux-policy/rtkit-daemon-and-similar/runtest.sh
@@ -108,7 +108,7 @@ rlJournalStart
fi
fi
rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1
- rlRun "restorecon -Rv /run /var"
+ rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255
rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1
rlPhaseEnd
fi
diff --git a/selinux-policy/stalld-and-similar/runtest.sh b/selinux-policy/stalld-and-similar/runtest.sh
index 909a0b5..90f86ef 100755
--- a/selinux-policy/stalld-and-similar/runtest.sh
+++ b/selinux-policy/stalld-and-similar/runtest.sh
@@ -108,7 +108,7 @@ rlJournalStart
rlRun "journalctl -u ${SERVICE_NAME} > after.txt"
rlRun "setsebool domain_can_write_kmsg on"
rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status" 1
- rlRun "restorecon -Rv /run /var" 0-255
+ rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255
rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "stop status" 1
rlRun "setsebool domain_can_write_kmsg off"
rlRun "diff before.txt after.txt | grep -i -e 'operation not permitted' -e 'permission denied'" 1
diff --git a/selinux-policy/systemd-bootchart-and-similar/runtest.sh b/selinux-policy/systemd-bootchart-and-similar/runtest.sh
index c8bbacd..362b6a2 100755
--- a/selinux-policy/systemd-bootchart-and-similar/runtest.sh
+++ b/selinux-policy/systemd-bootchart-and-similar/runtest.sh
@@ -81,7 +81,7 @@ rlJournalStart
PROCESS_CONTEXT="unconfined_service_t"
fi
rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1
- rlRun "restorecon -Rv /run /var" 0-255
+ rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255
rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1
rlPhaseEnd
diff --git a/selinux-policy/systemd-modules-load-and-similar/runtest.sh b/selinux-policy/systemd-modules-load-and-similar/runtest.sh
index 0e951c8..920c3e0 100755
--- a/selinux-policy/systemd-modules-load-and-similar/runtest.sh
+++ b/selinux-policy/systemd-modules-load-and-similar/runtest.sh
@@ -110,7 +110,7 @@ rlJournalStart
rlRun "lsmod"
rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} - ${PROCESS_CONTEXT} "start status" 1
rlRun "lsmod | grep ${KERNEL_MODULE}"
- rlRun "restorecon -Rv /run /var" 0-255
+ rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255
rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} - ${PROCESS_CONTEXT} "stop status" 1
rlRun "lsmod"
rlRun "rm -f /etc/modules-load.d/${KERNEL_MODULE}.conf"
diff --git a/selinux-policy/systemd-sysctl-and-similar/runtest.sh b/selinux-policy/systemd-sysctl-and-similar/runtest.sh
index d7f0d06..f7ad2d3 100755
--- a/selinux-policy/systemd-sysctl-and-similar/runtest.sh
+++ b/selinux-policy/systemd-sysctl-and-similar/runtest.sh
@@ -63,7 +63,7 @@ rlJournalStart
rlPhaseStartTest "real scenario"
rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "start status" 1
- rlRun "restorecon -Rv /run /var" 0-255
+ rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255
rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "restart status stop status" 1
rlPhaseEnd
diff --git a/selinux-policy/systemd-timesyncd-and-similar/runtest.sh b/selinux-policy/systemd-timesyncd-and-similar/runtest.sh
index 886546a..37f186c 100755
--- a/selinux-policy/systemd-timesyncd-and-similar/runtest.sh
+++ b/selinux-policy/systemd-timesyncd-and-similar/runtest.sh
@@ -118,7 +118,7 @@ rlJournalStart
PROCESS_CONTEXT="unconfined_service_t"
fi
rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1
- rlRun "restorecon -Rv /run /var" 0-255
+ rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255
rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1
rlPhaseEnd
fi
diff --git a/selinux-policy/systemd-userdbd-and-similar/runtest.sh b/selinux-policy/systemd-userdbd-and-similar/runtest.sh
index 38bf5c6..f7cf06f 100755
--- a/selinux-policy/systemd-userdbd-and-similar/runtest.sh
+++ b/selinux-policy/systemd-userdbd-and-similar/runtest.sh
@@ -107,7 +107,7 @@ rlJournalStart
PROCESS_CONTEXT="unconfined_service_t"
fi
rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1
- rlRun "restorecon -Rv /run /var" 0-255
+ rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255
rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1
rlPhaseEnd
diff --git a/selinux-policy/usbguard-daemon-and-similar/runtest.sh b/selinux-policy/usbguard-daemon-and-similar/runtest.sh
index a23c68f..6c00b0c 100755
--- a/selinux-policy/usbguard-daemon-and-similar/runtest.sh
+++ b/selinux-policy/usbguard-daemon-and-similar/runtest.sh
@@ -85,7 +85,7 @@ rlJournalStart
PROCESS_CONTEXT="unconfined_service_t"
fi
rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1
- rlRun "restorecon -Rv /run /var"
+ rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255
rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1
rlPhaseEnd
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2026-09-11 13:20 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-09-11 13:20 [tests/selinux] pr775-checkpolicy-revdeps: exclude the /var/ARTIFACTS when running restorecon Milos Malik
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox