public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
From: Ondrej Mosnacek <omosnace@redhat.com>
To: git-commits@fedoraproject.org
Subject: [tests/selinux] pr775-checkpolicy-revdeps: policycoreutils/semodule-rebuild-...: add coverage for dontaudit
Date: Fri, 11 Sep 2026 13:20:33 GMT	[thread overview]
Message-ID: <178913283393.1.206924021939600635.tests-selinux-93eca7b0a958@fedoraproject.org> (raw)

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 93eca7b0a958b64e2801a18a7c0bc1450834396f
            Author : Ondrej Mosnacek <omosnace@redhat.com>
            Date   : 2023-03-21T15:15:30+00:00
            Stats  : +26/-0 in 2 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/93eca7b0a958b64e2801a18a7c0bc1450834396f?branch=pr775-checkpolicy-revdeps

            Log:
            policycoreutils/semodule-rebuild-...: add coverage for dontaudit

Test that semodule --refresh works correctly with the disable_dontaudit
flag.

This currently requires the following patch to pass:
https://lore.kernel.org/selinux/20230309143741.346749-1-omosnace@redhat.com/

Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>

---
diff --git a/policycoreutils/semodule-rebuild-if-modules-changed/main.fmf b/policycoreutils/semodule-rebuild-if-modules-changed/main.fmf
index 1a8db10..a3191eb 100644
--- a/policycoreutils/semodule-rebuild-if-modules-changed/main.fmf
+++ b/policycoreutils/semodule-rebuild-if-modules-changed/main.fmf
@@ -26,3 +26,4 @@ link:
   - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2049189
   - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2049191
   - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2049193
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2173959

diff --git a/policycoreutils/semodule-rebuild-if-modules-changed/runtest.sh b/policycoreutils/semodule-rebuild-if-modules-changed/runtest.sh
index 16e3ccf..d3c8f63 100755
--- a/policycoreutils/semodule-rebuild-if-modules-changed/runtest.sh
+++ b/policycoreutils/semodule-rebuild-if-modules-changed/runtest.sh
@@ -12,6 +12,7 @@ STORE_TYPE=targeted
 MODULES_ROOT="$STORE_ROOT/$STORE_TYPE/active/modules"
 STORE_POLICY="$STORE_ROOT/$STORE_TYPE/active/policy.kern"
 STORE_BOOLS="$STORE_ROOT/$STORE_TYPE/active/booleans.local"
+STORE_DISABLE_DONTAUDIT="$STORE_ROOT/$STORE_TYPE/active/disable_dontaudit"
 TEST_MODULE_DIR="$MODULES_ROOT/400/test_module"
 TEST_BOOLEAN="xguest_exec_content"
 TEST_BOOLEAN_VALUE="0"
@@ -29,6 +30,7 @@ rlJournalStart
     rlPhaseStartSetup
         rlAssertRpm "libsemanage"
         rlAssertRpm "policycoreutils"
+        rlAssertRpm "selinux-policy"
 
         policyvers="$(checkpolicy -V | cut -f 1 -d ' ')"
         policyvers_kernel="$(cat /sys/fs/selinux/policyvers)"
@@ -114,6 +116,29 @@ rlJournalStart
                 rlRun "semodule -N -B" 0 \
                     "Force a rebuild to clean things up"
             rlPhaseEnd
+
+            if  { rlIsRHEL 9 && rlIsRHEL '<9.3'; } || \
+                { rlIsRHEL 8 && rlIsRHEL '<8.9'; }
+            then
+                rlPhaseStartTest "Disable dontaudit injected"
+                    rlLog "Inject disable_dontaudit flag into the store"
+                    rlRun "touch '$STORE_DISABLE_DONTAUDIT'"
+                    rlRun "semodule -N $refresh_opt" 0 \
+                        "Do a conditional rebuild"
+                    rlRun "test \$(sesearch --dontaudit '$STORE_POLICY' | wc -l) -eq 0" 0 \
+                        "Verify that the flag has been picked up"
+
+                    rlLog "Now remove the flag"
+                    rlRun "rm -f '$STORE_DISABLE_DONTAUDIT'"
+                    rlRun "semodule -N $refresh_opt"
+                    rlRun "test \$(sesearch --dontaudit '$STORE_POLICY' | wc -l) -gt 0" 0 \
+                        "Verify that the dontaudit rules are back"
+
+                    # Make sure policy is restored regardless of any previous failures
+                    rlRun "semodule -N -B" 0 \
+                        "Force a rebuild to clean things up"
+                rlPhaseEnd
+            fi
         fi
     else
         rlPhaseStartTest "Test skipped"

                 reply	other threads:[~2026-09-11 13:20 UTC|newest]

Thread overview: [no followups] expand[flat|nested]  mbox.gz  Atom feed

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=178913283393.1.206924021939600635.tests-selinux-93eca7b0a958@fedoraproject.org \
    --to=omosnace@redhat.com \
    --cc=git-commits@fedoraproject.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox