public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
From: Milos Malik <mmalik@redhat.com>
To: git-commits@fedoraproject.org
Subject: [tests/selinux] pr775-checkpolicy-revdeps: move reliable downstream tests to upstream repo
Date: Fri, 11 Sep 2026 13:20:36 GMT [thread overview]
Message-ID: <178913283676.1.4015572695921907810.tests-selinux-e17c855d2ae3@fedoraproject.org> (raw)
A new commit has been pushed.
Repo : tests/selinux
Branch : pr775-checkpolicy-revdeps
Commit : e17c855d2ae3277d9c1422e6bfca0ef91d34136d
Author : Milos Malik <mmalik@redhat.com>
Date : 2023-04-11T18:10:56+02:00
Stats : +720/-0 in 13 file(s)
URL : https://src.fedoraproject.org/tests/selinux/c/e17c855d2ae3277d9c1422e6bfca0ef91d34136d?branch=pr775-checkpolicy-revdeps
Log:
move reliable downstream tests to upstream repo
---
diff --git a/mcstrans/bz442327-setfscreatecon-with-invalid-context/Makefile b/mcstrans/bz442327-setfscreatecon-with-invalid-context/Makefile
new file mode 100644
index 0000000..ae8a25f
--- /dev/null
+++ b/mcstrans/bz442327-setfscreatecon-with-invalid-context/Makefile
@@ -0,0 +1,76 @@
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+# Makefile of /CoreOS/mcstrans/Regression/bz442327-setfscreatecon-with-invalid-context
+# Description: setfscreatecon with invalid context can mistakenly succeed
+# Author: Milos Malik <mmalik@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+# Copyright (c) 2009 Red Hat, Inc. All rights reserved.
+#
+# This copyrighted material is made available to anyone wishing
+# to use, modify, copy, or redistribute it subject to the terms
+# and conditions of the GNU General Public License version 2.
+#
+# This program is distributed in the hope that it will be
+# useful, but WITHOUT ANY WARRANTY; without even the implied
+# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+# PURPOSE. See the GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public
+# License along with this program; if not, write to the Free
+# Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+# Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+export TEST=/CoreOS/mcstrans/Regression/bz442327-setfscreatecon-with-invalid-context
+export TESTVERSION=1.0
+
+BUILT_FILES=
+
+FILES=$(METADATA) runtest.sh Makefile PURPOSE
+
+.PHONY: all install download clean
+
+run: $(FILES) build
+ ./runtest.sh
+
+build: $(BUILT_FILES)
+ chmod a+x runtest.sh
+ chcon -t bin_t runtest.sh
+
+clean:
+ rm -f *~ $(BUILT_FILES)
+
+include /usr/share/rhts/lib/rhts-make.include
+
+$(METADATA): Makefile
+ @echo "Owner: Milos Malik <mmalik@redhat.com>" > $(METADATA)
+ @echo "Name: $(TEST)" >> $(METADATA)
+ @echo "TestVersion: $(TESTVERSION)" >> $(METADATA)
+ @echo "Path: $(TEST_DIR)" >> $(METADATA)
+ @echo "Description: setfscreatecon with invalid context can mistakenly succeed" >> $(METADATA)
+ @echo "Type: Regression" >> $(METADATA)
+ @echo "TestTime: 5m" >> $(METADATA)
+ @echo "RunFor: mcstrans" >> $(METADATA)
+ @echo "Requires: mcstrans" >> $(METADATA)
+ @echo "Requires: /usr/sbin/service" >> $(METADATA)
+ @echo "Requires: selinux-policy" >> $(METADATA)
+ @echo "Requires: selinux-policy-targeted" >> $(METADATA)
+ @echo "Requires: libselinux" >> $(METADATA)
+ @echo "Requires: libselinux-utils" >> $(METADATA)
+ @echo "Requires: mktemp" >> $(METADATA)
+ @echo "Requires: grep" >> $(METADATA)
+ @echo "Requires: audit" >> $(METADATA)
+ @echo "Requires: policycoreutils" >> $(METADATA)
+ @echo "Priority: Normal" >> $(METADATA)
+ @echo "License: GPLv2" >> $(METADATA)
+ @echo "Confidential: no" >> $(METADATA)
+ @echo "Destructive: no" >> $(METADATA)
+ @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA)
+ @echo "Releases: -RHEL4" >> $(METADATA)
+ @echo "Bug: 442327" >> $(METADATA) # Fedora 9
+
+ rhts-lint $(METADATA)
+
diff --git a/mcstrans/bz442327-setfscreatecon-with-invalid-context/PURPOSE b/mcstrans/bz442327-setfscreatecon-with-invalid-context/PURPOSE
new file mode 100644
index 0000000..4ecdd5e
--- /dev/null
+++ b/mcstrans/bz442327-setfscreatecon-with-invalid-context/PURPOSE
@@ -0,0 +1,5 @@
+PURPOSE of /CoreOS/mcstrans/Regression/bz442327-setfscreatecon-with-invalid-context
+Author: Milos Malik <mmalik@redhat.com>
+
+Description: setfscreatecon with invalid context can mistakenly succeed
+
diff --git a/mcstrans/bz442327-setfscreatecon-with-invalid-context/main.fmf b/mcstrans/bz442327-setfscreatecon-with-invalid-context/main.fmf
new file mode 100644
index 0000000..ce3a355
--- /dev/null
+++ b/mcstrans/bz442327-setfscreatecon-with-invalid-context/main.fmf
@@ -0,0 +1,45 @@
+summary: setfscreatecon with invalid context can mistakenly succeed
+description: |+
+ Description: setfscreatecon with invalid context can mistakenly succeed
+
+contact: Milos Malik <mmalik@redhat.com>
+component:
+ - mcstrans
+test: ./runtest.sh
+framework: beakerlib
+recommend:
+ - mcstrans
+ - /usr/sbin/service
+ - selinux-policy
+ - selinux-policy-targeted
+ - libselinux
+ - libselinux-utils
+ - mktemp
+ - grep
+ - audit
+ - policycoreutils
+environment:
+ AVC_ERROR: +no_avc_check
+duration: 5m
+enabled: true
+tag:
+ - CI-Tier-1
+ - NoRHEL4
+ - TIPpass_Security
+ - Tier3
+ - Tier3se
+ - f31friendly
+ - f32friendly
+ - failinrhel8ci
+ - targeted
+tier: '3'
+link:
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=442327
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=800470
+adjust:
+ - enabled: false
+ when: distro == rhel-4
+ continue: false
+extra-nitrate: TC#0062266
+extra-summary: /CoreOS/mcstrans/Regression/bz442327-setfscreatecon-with-invalid-context
+extra-task: /CoreOS/mcstrans/Regression/bz442327-setfscreatecon-with-invalid-context
diff --git a/mcstrans/bz442327-setfscreatecon-with-invalid-context/runtest.sh b/mcstrans/bz442327-setfscreatecon-with-invalid-context/runtest.sh
new file mode 100755
index 0000000..6a9cbc3
--- /dev/null
+++ b/mcstrans/bz442327-setfscreatecon-with-invalid-context/runtest.sh
@@ -0,0 +1,85 @@
+#!/bin/bash
+# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+# runtest.sh of /CoreOS/mcstrans/Regression/bz442327-setfscreatecon-with-invalid-context
+# Description: setfscreatecon with invalid context can mistakenly succeed
+# Author: Milos Malik <mmalik@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+# Copyright (c) 2009 Red Hat, Inc. All rights reserved.
+#
+# This copyrighted material is made available to anyone wishing
+# to use, modify, copy, or redistribute it subject to the terms
+# and conditions of the GNU General Public License version 2.
+#
+# This program is distributed in the hope that it will be
+# useful, but WITHOUT ANY WARRANTY; without even the implied
+# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+# PURPOSE. See the GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public
+# License along with this program; if not, write to the Free
+# Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+# Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include rhts environment
+. /usr/share/beakerlib/beakerlib.sh
+
+PACKAGE="mcstrans"
+
+rlJournalStart
+ rlPhaseStartSetup
+ rlAssertRpm ${PACKAGE}
+ rlAssertRpm selinux-policy
+ rlAssertRpm libselinux
+ OUTPUT_FILE=`mktemp`
+ if rlIsRHEL 5 6 ; then
+ rlServiceStop mcstrans
+ else
+ rlServiceStop mcstransd
+ fi
+
+ rlRun "setenforce 1"
+ rlRun "sestatus"
+ START_DATE_TIME=`date "+%m/%d/%Y %T"`
+ sleep 2
+ rlPhaseEnd
+
+ rlPhaseStartTest "bz#442327"
+ if rlIsRHEL 5 6 ; then
+ rlRun "service mcstrans start"
+ else
+ rlRun "service mcstransd start"
+ fi
+ sleep 1
+ rlRun "for I in \`seq 1 1 5000\` ; do mkdir d --context=xyz 2>/dev/null && { t=X ; rmdir d ; } || t=. ; printf \$t ; done >& ${OUTPUT_FILE}"
+ rlRun "grep -ci x ${OUTPUT_FILE}" 1
+ sleep 1
+ if rlIsRHEL 5 6 ; then
+ rlRun "service mcstrans stop"
+ else
+ rlRun "service mcstransd stop"
+ fi
+ rlPhaseEnd
+
+ rlPhaseStartCleanup
+ sleep 2
+ rlRun "ausearch -m AVC -m USER_AVC -ts ${START_DATE_TIME} > ${OUTPUT_FILE}" 0,1
+ LINE_COUNT=`grep 'type=AVC' ${OUTPUT_FILE} | grep -v 'type=AVC.*denied.*mac_admin.*mkdir' | wc -l`
+ rlAssert0 "number of unexpected AVCs in ${OUTPUT_FILE} should be 0" ${LINE_COUNT}
+
+ if rlIsRHEL 5 6 ; then
+ rlServiceRestore mcstrans
+ else
+ rlServiceRestore mcstransd
+ fi
+
+ rm -f ${OUTPUT_FILE}
+ rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd
+
diff --git a/mcstrans/internal-examples-testsuite/Makefile b/mcstrans/internal-examples-testsuite/Makefile
new file mode 100644
index 0000000..b6fc4e1
--- /dev/null
+++ b/mcstrans/internal-examples-testsuite/Makefile
@@ -0,0 +1,65 @@
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+# Makefile of /CoreOS/mcstrans/Sanity/internal-examples-testsuite
+# Description: Wrapper for internal examples used as testsuite
+# Author: Milos Malik <mmalik@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+# Copyright (c) 2016 Red Hat, Inc.
+#
+# This copyrighted material is made available to anyone wishing
+# to use, modify, copy, or redistribute it subject to the terms
+# and conditions of the GNU General Public License version 2.
+#
+# This program is distributed in the hope that it will be
+# useful, but WITHOUT ANY WARRANTY; without even the implied
+# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+# PURPOSE. See the GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public
+# License along with this program; if not, write to the Free
+# Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+# Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+export TEST=/CoreOS/mcstrans/Sanity/internal-examples-testsuite
+export TESTVERSION=1.0
+
+BUILT_FILES=
+
+FILES=$(METADATA) runtest.sh Makefile PURPOSE
+
+.PHONY: all install download clean
+
+run: $(FILES) build
+ ./runtest.sh
+
+build: $(BUILT_FILES)
+ test -x runtest.sh || chmod a+x runtest.sh
+
+clean:
+ rm -f *~ $(BUILT_FILES)
+
+include /usr/share/rhts/lib/rhts-make.include
+
+$(METADATA): Makefile
+ @echo "Owner: Milos Malik <mmalik@redhat.com>" > $(METADATA)
+ @echo "Name: $(TEST)" >> $(METADATA)
+ @echo "TestVersion: $(TESTVERSION)" >> $(METADATA)
+ @echo "Path: $(TEST_DIR)" >> $(METADATA)
+ @echo "Description: Wrapper for internal examples used as testsuite" >> $(METADATA)
+ @echo "Type: Sanity" >> $(METADATA)
+ @echo "TestTime: 10m" >> $(METADATA)
+ @echo "RunFor: mcstrans" >> $(METADATA)
+ @echo "Requires: mcstrans selinux-policy-targeted libselinux-python sed platform-python-devel python3-libselinux /usr/sbin/service" >> $(METADATA)
+ @echo "Priority: Normal" >> $(METADATA)
+ @echo "License: GPLv2" >> $(METADATA)
+ @echo "Confidential: no" >> $(METADATA)
+ @echo "Destructive: no" >> $(METADATA)
+ @echo "Releases: -RHEL4 -RHEL5" >> $(METADATA)
+ @echo "Bug: 1656304" >> $(METADATA) # RHEL-8
+
+ rhts-lint $(METADATA)
+
diff --git a/mcstrans/internal-examples-testsuite/PURPOSE b/mcstrans/internal-examples-testsuite/PURPOSE
new file mode 100644
index 0000000..85fecad
--- /dev/null
+++ b/mcstrans/internal-examples-testsuite/PURPOSE
@@ -0,0 +1,5 @@
+PURPOSE of /CoreOS/mcstrans/Sanity/internal-examples-testsuite
+Author: Milos Malik <mmalik@redhat.com>
+
+Internal examples and scripts are used as mcstrans testsuite.
+
diff --git a/mcstrans/internal-examples-testsuite/main.fmf b/mcstrans/internal-examples-testsuite/main.fmf
new file mode 100644
index 0000000..85aea97
--- /dev/null
+++ b/mcstrans/internal-examples-testsuite/main.fmf
@@ -0,0 +1,37 @@
+summary: Wrapper for internal examples used as testsuite
+description: |+
+ Internal examples and scripts are used as mcstrans testsuite.
+
+contact: Milos Malik <mmalik@redhat.com>
+component:
+ - mcstrans
+test: ./runtest.sh
+framework: beakerlib
+recommend:
+ - mcstrans
+ - selinux-policy-targeted
+ - libselinux-python
+ - sed
+ - platform-python-devel
+ - python3-libselinux
+ - /usr/sbin/service
+duration: 10m
+enabled: true
+tier: 1
+tag:
+ - CI-Tier-1
+ - NoRHEL4
+ - NoRHEL5
+ - TIPpass_Security
+ - f32friendly
+ - f33friendly
+ - targeted
+link:
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1656304
+adjust:
+ - enabled: false
+ when: distro == rhel-4, rhel-5
+ continue: false
+extra-nitrate: TC#0520362
+extra-summary: /CoreOS/mcstrans/Sanity/internal-examples-testsuite
+extra-task: /CoreOS/mcstrans/Sanity/internal-examples-testsuite
diff --git a/mcstrans/internal-examples-testsuite/runtest.sh b/mcstrans/internal-examples-testsuite/runtest.sh
new file mode 100755
index 0000000..01ae3e3
--- /dev/null
+++ b/mcstrans/internal-examples-testsuite/runtest.sh
@@ -0,0 +1,181 @@
+#!/bin/bash
+# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+# runtest.sh of /CoreOS/mcstrans/Sanity/internal-examples-testsuite
+# Description: Wrapper for internal examples used as testsuite
+# Author: Milos Malik <mmalik@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+# Copyright (c) 2016 Red Hat, Inc.
+#
+# This copyrighted material is made available to anyone wishing
+# to use, modify, copy, or redistribute it subject to the terms
+# and conditions of the GNU General Public License version 2.
+#
+# This program is distributed in the hope that it will be
+# useful, but WITHOUT ANY WARRANTY; without even the implied
+# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+# PURPOSE. See the GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public
+# License along with this program; if not, write to the Free
+# Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+# Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include Beaker environment
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGE="mcstrans"
+if rlIsRHEL 5 6 ; then
+ SERVICE_NAME="mcstrans"
+else
+ SERVICE_NAME="mcstransd"
+fi
+
+if rlIsRHEL 5 6 7 ; then
+ PYTHON="python2"
+ SERVICE_START_LIMIT="[Service]
+StartLimitIntervalSec=0
+StartLimitBurst=50
+"
+else
+ PYTHON="python3"
+ SERVICE_START_LIMIT="[Unit]
+StartLimitIntervalSec=0
+"
+fi
+
+rlJournalStart
+ rlPhaseStartSetup
+ rlAssertRpm ${PACKAGE}
+ rlAssertRpm selinux-policy-targeted
+ rlRun "mkdir -p /etc/systemd/system/mcstrans.service.d/"
+ rlRun "mkdir -p /etc/systemd/system/mcstransd.service.d/"
+ echo "${SERVICE_START_LIMIT}" > /etc/systemd/system/mcstrans.service.d/limit.conf
+ rlRun "cp /etc/systemd/system/mcstrans.service.d/limit.conf /etc/systemd/system/mcstransd.service.d/limit.conf"
+ rlRun "systemctl daemon-reload"
+ rlServiceStop ${SERVICE_NAME}
+ rlRun "mkdir -p /etc/selinux/targeted/setrans.d"
+ rlFileBackup /etc/selinux/targeted/secolor.conf
+ rlFileBackup /etc/selinux/targeted/setrans.conf
+ rlFileBackup /usr/share/mcstrans/util/mlscolor-test
+ rlFileBackup /usr/share/mcstrans/util/mlstrans-test
+ rlRun "sed -i 's/^verbose.*$/verbose=1/' /usr/share/mcstrans/util/mlscolor-test"
+ rlRun "sed -i 's/^verbose.*$/verbose=1/' /usr/share/mcstrans/util/mlstrans-test"
+ if ! rlIsRHEL 5 6 7 && ! rlIsFedora ; then
+ # convert the python2 scripts to python3 syntax
+ rlRun "2to3 -w --no-diffs /usr/share/mcstrans/util/mlscolor-test"
+ rlRun "2to3 -w --no-diffs /usr/share/mcstrans/util/mlstrans-test"
+ fi
+ rlPhaseEnd
+
+ rlPhaseStartTest "default"
+ rlRun "pushd /usr/share/mcstrans/examples/default"
+ rlRun "rm -f /etc/selinux/targeted/secolor.conf"
+ rlRun "cp -f setrans.conf /etc/selinux/targeted/setrans.conf"
+ rlRun "service ${SERVICE_NAME} restart"
+ sleep 1
+ rlRun "service ${SERVICE_NAME} status"
+ rlRun "${PYTHON} /usr/share/mcstrans/util/mlstrans-test default.test"
+ rlRun "popd"
+ rlPhaseEnd
+
+ rlPhaseStartTest "include"
+ rlRun "pushd /usr/share/mcstrans/examples/include"
+ rlRun "rm -f /etc/selinux/targeted/secolor.conf"
+ rlRun "cp -f setrans.conf /etc/selinux/targeted/setrans.conf"
+ rlRun "sed -i 's/mls/targeted/' /etc/selinux/targeted/setrans.conf"
+ rlRun "cp -f setrans.d/* /etc/selinux/targeted/setrans.d"
+ rlRun "service ${SERVICE_NAME} restart"
+ sleep 1
+ rlRun "service ${SERVICE_NAME} status"
+ rlRun "${PYTHON} /usr/share/mcstrans/util/mlstrans-test default.test"
+ rlRun "popd"
+ rlPhaseEnd
+
+ rlPhaseStartTest "non-mls-color"
+ rlRun "pushd /usr/share/mcstrans/examples/non-mls-color"
+ rlRun "cp -f secolor.conf /etc/selinux/targeted/secolor.conf"
+ rlRun "rm -f /etc/selinux/targeted/setrans.conf"
+ rlRun "touch /etc/selinux/targeted/setrans.conf"
+ rlRun "service ${SERVICE_NAME} restart"
+ sleep 1
+ rlRun "service ${SERVICE_NAME} status"
+ rlRun "${PYTHON} /usr/share/mcstrans/util/mlscolor-test non-mls.color"
+ rlRun "popd"
+ rlPhaseEnd
+
+ rlPhaseStartTest "urcsts"
+ rlRun "pushd /usr/share/mcstrans/examples/urcsts"
+ rlRun "cp -f secolor.conf /etc/selinux/targeted/secolor.conf"
+ rlRun "cp -f setrans.conf /etc/selinux/targeted/setrans.conf"
+ rlRun "service ${SERVICE_NAME} restart"
+ sleep 1
+ rlRun "service ${SERVICE_NAME} status"
+ #rlRun "${PYTHON} /usr/share/mcstrans/util/mlscolor-test urcsts.color"
+ rlRun "${PYTHON} /usr/share/mcstrans/util/mlstrans-test urcsts.test"
+ rlRun "popd"
+ rlPhaseEnd
+
+ rlPhaseStartTest "urcsts-via-include"
+ rlRun "pushd /usr/share/mcstrans/examples/urcsts-via-include"
+ rlRun "cp -f secolor.conf /etc/selinux/targeted/secolor.conf"
+ rlRun "cp -f setrans.conf /etc/selinux/targeted/setrans.conf"
+ rlRun "sed -i 's/mls/targeted/' /etc/selinux/targeted/setrans.conf"
+ rlRun "rm -f /etc/selinux/targeted/setrans.d/*"
+ rlRun "cp setrans.d/* /etc/selinux/targeted/setrans.d"
+ rlRun "service ${SERVICE_NAME} restart"
+ sleep 1
+ rlRun "service ${SERVICE_NAME} status"
+ #rlRun "${PYTHON} /usr/share/mcstrans/util/mlscolor-test urcsts.color"
+ rlRun "${PYTHON} /usr/share/mcstrans/util/mlstrans-test urcsts.test"
+ rlRun "popd"
+ rlPhaseEnd
+
+ if ! rlIsRHEL 5 6 ; then
+ rlPhaseStartTest "nato"
+ rlRun "pushd /usr/share/mcstrans/examples/nato"
+ rlRun "rm -f /etc/selinux/targeted/secolor.conf"
+ rlRun "cp -f setrans.conf /etc/selinux/targeted/setrans.conf"
+ rlRun "sed -i 's/mls/targeted/' /etc/selinux/targeted/setrans.conf"
+ rlRun "rm -f /etc/selinux/targeted/setrans.d/*"
+ rlRun "cp setrans.d/* /etc/selinux/targeted/setrans.d"
+ rlRun "service ${SERVICE_NAME} restart"
+ sleep 1
+ rlRun "service ${SERVICE_NAME} status"
+ ${PYTHON} /usr/share/mcstrans/util/mlstrans-test nato.test
+ rlRun "${PYTHON} /usr/share/mcstrans/util/mlstrans-test nato.test"
+ rlRun "popd"
+ rlPhaseEnd
+
+ rlPhaseStartTest "pipes"
+ rlRun "pushd /usr/share/mcstrans/examples/pipes"
+ rlRun "rm -f /etc/selinux/targeted/secolor.conf"
+ rlRun "cp -f setrans.conf /etc/selinux/targeted/setrans.conf"
+ rlRun "sed -i 's/mls/targeted/' /etc/selinux/targeted/setrans.conf"
+ rlRun "rm -f /etc/selinux/targeted/setrans.d/*"
+ rlRun "cp setrans.d/* /etc/selinux/targeted/setrans.d"
+ rlRun "service ${SERVICE_NAME} restart"
+ sleep 1
+ rlRun "service ${SERVICE_NAME} status"
+ ${PYTHON} /usr/share/mcstrans/util/mlstrans-test pipes.test
+ rlRun "${PYTHON} /usr/share/mcstrans/util/mlstrans-test pipes.test"
+ rlRun "popd"
+ rlPhaseEnd
+ fi
+
+ rlPhaseStartCleanup
+ rlRun "rm -rf /etc/systemd/system/mcstrans.service.d/"
+ rlRun "rm -rf /etc/systemd/system/mcstransd.service.d/"
+ rlRun "rm -f /etc/selinux/targeted/secolor.conf /etc/selinux/targeted/setrans.conf"
+ rlRun "rm -rf /etc/selinux/targeted/setrans.d"
+ rlFileRestore
+ rlServiceRestore ${SERVICE_NAME}
+ rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd
+
diff --git a/mcstrans/mcstrans-daemon-segfaults-when-using-secon-C/Makefile b/mcstrans/mcstrans-daemon-segfaults-when-using-secon-C/Makefile
new file mode 100644
index 0000000..dc15dc2
--- /dev/null
+++ b/mcstrans/mcstrans-daemon-segfaults-when-using-secon-C/Makefile
@@ -0,0 +1,67 @@
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+# Makefile of /CoreOS/mcstrans/Regression/mcstrans-daemon-segfaults-when-using-secon-C
+# Description: mcstrans daemon segfaults when secon -C asks for incomplete context
+# Author: Milos Malik <mmalik@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+# Copyright (c) 2016 Red Hat, Inc.
+#
+# This copyrighted material is made available to anyone wishing
+# to use, modify, copy, or redistribute it subject to the terms
+# and conditions of the GNU General Public License version 2.
+#
+# This program is distributed in the hope that it will be
+# useful, but WITHOUT ANY WARRANTY; without even the implied
+# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+# PURPOSE. See the GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public
+# License along with this program; if not, write to the Free
+# Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+# Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+export TEST=/CoreOS/mcstrans/Regression/mcstrans-daemon-segfaults-when-using-secon-C
+export TESTVERSION=1.0
+
+BUILT_FILES=
+
+FILES=$(METADATA) runtest.sh Makefile PURPOSE secolor.conf
+
+.PHONY: all install download clean
+
+run: $(FILES) build
+ ./runtest.sh
+
+build: $(BUILT_FILES)
+ test -x runtest.sh || chmod a+x runtest.sh
+
+clean:
+ rm -f *~ $(BUILT_FILES)
+
+include /usr/share/rhts/lib/rhts-make.include
+
+$(METADATA): Makefile
+ @echo "Owner: Milos Malik <mmalik@redhat.com>" > $(METADATA)
+ @echo "Name: $(TEST)" >> $(METADATA)
+ @echo "TestVersion: $(TESTVERSION)" >> $(METADATA)
+ @echo "Path: $(TEST_DIR)" >> $(METADATA)
+ @echo "Description: mcstrans daemon segfaults when secon -C asks for incomplete context" >> $(METADATA)
+ @echo "Type: Regression" >> $(METADATA)
+ @echo "TestTime: 10m" >> $(METADATA)
+ @echo "RunFor: mcstrans" >> $(METADATA)
+ @echo "Requires: mcstrans selinux-policy-targeted policycoreutils libselinux-python python3-libselinux /usr/sbin/service" >> $(METADATA)
+ @echo "Priority: Normal" >> $(METADATA)
+ @echo "License: GPLv2" >> $(METADATA)
+ @echo "Confidential: no" >> $(METADATA)
+ @echo "Destructive: no" >> $(METADATA)
+ @echo "Releases: -RHEL4 -RHEL5" >> $(METADATA)
+ @echo "Bug: 1315996" >> $(METADATA) # RHEL-7
+ @echo "Bug: 1316680" >> $(METADATA) # RHEL-6
+ @echo "Bug: 1699784" >> $(METADATA) # RHEL-8
+
+ rhts-lint $(METADATA)
+
diff --git a/mcstrans/mcstrans-daemon-segfaults-when-using-secon-C/PURPOSE b/mcstrans/mcstrans-daemon-segfaults-when-using-secon-C/PURPOSE
new file mode 100644
index 0000000..49f8afd
--- /dev/null
+++ b/mcstrans/mcstrans-daemon-segfaults-when-using-secon-C/PURPOSE
@@ -0,0 +1,5 @@
+PURPOSE of /CoreOS/mcstrans/Regression/mcstrans-daemon-segfaults-when-using-secon-C
+Author: Milos Malik <mmalik@redhat.com>
+
+Description: mcstrans daemon segfaults when secon -C asks for incomplete context
+
diff --git a/mcstrans/mcstrans-daemon-segfaults-when-using-secon-C/main.fmf b/mcstrans/mcstrans-daemon-segfaults-when-using-secon-C/main.fmf
new file mode 100644
index 0000000..149799d
--- /dev/null
+++ b/mcstrans/mcstrans-daemon-segfaults-when-using-secon-C/main.fmf
@@ -0,0 +1,38 @@
+summary: mcstrans daemon segfaults when secon -C asks for incomplete context
+description: |+
+ Description: mcstrans daemon segfaults when secon -C asks for incomplete context
+
+contact: Milos Malik <mmalik@redhat.com>
+component:
+ - mcstrans
+test: ./runtest.sh
+framework: beakerlib
+recommend:
+ - mcstrans
+ - selinux-policy-targeted
+ - policycoreutils
+ - libselinux-python
+ - python3-libselinux
+ - /usr/sbin/service
+duration: 10m
+enabled: true
+tier: 1
+tag:
+ - CI-Tier-1
+ - NoRHEL4
+ - NoRHEL5
+ - TIPpass_Security
+ - f32friendly
+ - f33friendly
+ - targeted
+link:
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1315996
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1316680
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1699784
+adjust:
+ - enabled: false
+ when: distro == rhel-4, rhel-5
+ continue: false
+extra-nitrate: TC#0520380
+extra-summary: /CoreOS/mcstrans/Regression/mcstrans-daemon-segfaults-when-using-secon-C
+extra-task: /CoreOS/mcstrans/Regression/mcstrans-daemon-segfaults-when-using-secon-C
diff --git a/mcstrans/mcstrans-daemon-segfaults-when-using-secon-C/runtest.sh b/mcstrans/mcstrans-daemon-segfaults-when-using-secon-C/runtest.sh
new file mode 100755
index 0000000..5b089dc
--- /dev/null
+++ b/mcstrans/mcstrans-daemon-segfaults-when-using-secon-C/runtest.sh
@@ -0,0 +1,87 @@
+#!/bin/bash
+# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+# runtest.sh of /CoreOS/mcstrans/Regression/mcstrans-daemon-segfaults-when-using-secon-C
+# Description: mcstrans daemon segfaults when secon -C asks for incomplete context
+# Author: Milos Malik <mmalik@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+# Copyright (c) 2016 Red Hat, Inc.
+#
+# This copyrighted material is made available to anyone wishing
+# to use, modify, copy, or redistribute it subject to the terms
+# and conditions of the GNU General Public License version 2.
+#
+# This program is distributed in the hope that it will be
+# useful, but WITHOUT ANY WARRANTY; without even the implied
+# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+# PURPOSE. See the GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public
+# License along with this program; if not, write to the Free
+# Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+# Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include Beaker environment
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGE="mcstrans"
+if rlIsRHEL 6 ; then
+ SERVICE_NAME="mcstrans"
+else # RHEL-7 and above
+ SERVICE_NAME="mcstransd"
+fi
+if rlIsRHEL 6 7 ; then
+ if which python3 >& /dev/null ; then
+ PYTHON="python3"
+ else
+ PYTHON="python2"
+ fi
+else # RHEL-8
+ if which python3 >& /dev/null ; then
+ PYTHON="python3"
+ else
+ PYTHON="/usr/libexec/platform-python"
+ fi
+fi
+
+rlJournalStart
+ rlPhaseStartSetup
+ rlAssertRpm ${PACKAGE}
+ rlAssertRpm policycoreutils
+ rlAssertRpm selinux-policy-targeted
+ rlServiceStop ${SERVICE_NAME}
+ rlFileBackup /etc/selinux/targeted/secolor.conf
+ rlPhaseEnd
+
+ rlPhaseStartTest "bz#1315996 + bz#1316680 + bz#1699784"
+ rlRun "dmesg > before-secon-C.txt"
+ rlRun "cp -f secolor.conf /etc/selinux/targeted/"
+ for CONTEXT in ":::" "xyz_u:xyz_r:xyz_t:" "user_u:" "user_u:user_r:" "user_u:user_r:user_t:" ; do
+ rlRun "service ${SERVICE_NAME} restart"
+ sleep 1
+ rlRun "service ${SERVICE_NAME} status"
+ set -x
+ echo -en "import selinux\nselinux.selinux_raw_context_to_color(\"${CONTEXT}\")\n" | ${PYTHON}
+ set +x
+ # rlRun "secon -C ${CONTEXT}" 0,1
+ sleep 1
+ rlRun "service ${SERVICE_NAME} status"
+ done
+ rlRun "dmesg > after-secon-C.txt"
+ rlRun "diff before-secon-C.txt after-secon-C.txt | grep \"mcstransd.*segfault\"" 1
+ rlPhaseEnd
+
+ rlPhaseStartCleanup
+ rlRun "rm -f before-secon-C.txt after-secon-C.txt"
+ rlRun "rm -f /etc/selinux/targeted/secolor.conf"
+ rlFileRestore
+ rlServiceRestore ${SERVICE_NAME}
+ rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd
+
diff --git a/mcstrans/mcstrans-daemon-segfaults-when-using-secon-C/secolor.conf b/mcstrans/mcstrans-daemon-segfaults-when-using-secon-C/secolor.conf
new file mode 100644
index 0000000..17abaaf
--- /dev/null
+++ b/mcstrans/mcstrans-daemon-segfaults-when-using-secon-C/secolor.conf
@@ -0,0 +1,24 @@
+color black = #000000
+color green = #008000
+color yellow = #ffff00
+color blue = #0000ff
+color white = #ffffff
+color red = #ff0000
+color orange = #ffa500
+color tan = #d2b48c
+
+user unconfined_u = #ff0000 green
+role unconfined_r = red #ffffff
+type unconfined_t = red orange
+user user_u = black green
+role user_r = white black
+type user_t = tan red
+user xguest_u = black yellow
+role xguest_r = black red
+type xguest_t = black green
+user sysadm_u = white black
+range s0:c0.c1023 = black white
+user * = black white
+role * = black white
+type * = black white
+
reply other threads:[~2026-09-11 13:20 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=178913283676.1.4015572695921907810.tests-selinux-e17c855d2ae3@fedoraproject.org \
--to=mmalik@redhat.com \
--cc=git-commits@fedoraproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox