public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
From: Milos Malik <mmalik@redhat.com>
To: git-commits@fedoraproject.org
Subject: [tests/selinux] pr775-checkpolicy-revdeps: enable the SSH login via password for common users
Date: Fri, 11 Sep 2026 13:20:37 GMT [thread overview]
Message-ID: <178913283723.1.10857536080096176152.tests-selinux-e3b384c85feb@fedoraproject.org> (raw)
A new commit has been pushed.
Repo : tests/selinux
Branch : pr775-checkpolicy-revdeps
Commit : e3b384c85feb269e00923f29fd0792635933fba3
Author : Milos Malik <mmalik@redhat.com>
Date : 2023-04-20T12:04:09+02:00
Stats : +19/-16 in 16 file(s)
URL : https://src.fedoraproject.org/tests/selinux/c/e3b384c85feb269e00923f29fd0792635933fba3?branch=pr775-checkpolicy-revdeps
Log:
enable the SSH login via password for common users
Some of the automated tests require the SSH password authentication
to be enabled in order to succeed. The following file is added into
/etc/ssh/sshd_config.d/ directory to enable it:
* /etc/ssh/sshd_config.d/001-enable-password.conf
---
diff --git a/selinux-policy/Library/common/lib.sh b/selinux-policy/Library/common/lib.sh
index 4bcb8ee..af691e0 100755
--- a/selinux-policy/Library/common/lib.sh
+++ b/selinux-policy/Library/common/lib.sh
@@ -1289,6 +1289,7 @@ function rlSEConfigureSSH () {
rlFileBackup /etc/ssh/sshd_config
rlRun "sed -i 's/^.*PermitRootLogin.*$/PermitRootLogin yes/' /etc/ssh/sshd_config"
rlRun "sed -i 's/^.*PasswordAuthentication.*$/PasswordAuthentication yes/' /etc/ssh/sshd_config"
+ rlRun "echo 'PasswordAuthentication yes' > /etc/ssh/sshd_config.d/001-enable-password.conf"
rlRun "service sshd restart"
}
diff --git a/selinux-policy/boltd-and-similar/runtest.sh b/selinux-policy/boltd-and-similar/runtest.sh
index 682646f..f3c9a37 100755
--- a/selinux-policy/boltd-and-similar/runtest.sh
+++ b/selinux-policy/boltd-and-similar/runtest.sh
@@ -50,6 +50,7 @@ rlJournalStart
rlServiceStop ${SERVICE_NAME}
rlFileBackup /etc/shadow
+ rlSEConfigureSSH
rlSESetEnforce
rlSEStatus
diff --git a/selinux-policy/bz481628-send-msg-to-dbus/runtest.sh b/selinux-policy/bz481628-send-msg-to-dbus/runtest.sh
index bf6648e..c0e7719 100755
--- a/selinux-policy/bz481628-send-msg-to-dbus/runtest.sh
+++ b/selinux-policy/bz481628-send-msg-to-dbus/runtest.sh
@@ -50,6 +50,8 @@ rlJournalStart
rlAssertRpm ${PACKAGE}-targeted
rlAssertRpm ${SERVICE_PACKAGE}
+ rlSEConfigureSSH
+
rlSESetEnforce
rlSEStatus
rlSESetTimestamp
@@ -129,8 +131,6 @@ rlJournalStart
rlPhaseEnd
rlPhaseStartTest "real scenario -- user session service"
- rlSEConfigureSSH
-
rlRun "setsebool ssh_sysadm_login on"
rlRun "setsebool selinuxuser_tcp_server on"
CREATED_USERS=""
diff --git a/selinux-policy/colord-and-similar/runtest.sh b/selinux-policy/colord-and-similar/runtest.sh
index badb931..4d7aece 100755
--- a/selinux-policy/colord-and-similar/runtest.sh
+++ b/selinux-policy/colord-and-similar/runtest.sh
@@ -48,6 +48,7 @@ rlJournalStart
rlServiceStop ${SERVICE_NAME}
rlFileBackup /etc/shadow
+ rlSEConfigureSSH
rlSESetEnforce
rlSEStatus
diff --git a/selinux-policy/cups-lpd-and-similar/runtest.sh b/selinux-policy/cups-lpd-and-similar/runtest.sh
index 1ada2fc..6b3952d 100755
--- a/selinux-policy/cups-lpd-and-similar/runtest.sh
+++ b/selinux-policy/cups-lpd-and-similar/runtest.sh
@@ -30,7 +30,6 @@
. /usr/share/beakerlib/beakerlib.sh || exit 1
PACKAGE="selinux-policy"
-ROOT_PASSWORD="redhat"
FILE_PATH="/usr/lib/cups/daemon/cups-lpd"
FILE_CONTEXT="cupsd_lpd_exec_t"
SERVICE_PACKAGE="cups-lpd"
diff --git a/selinux-policy/cups-pdf-and-similar/runtest.sh b/selinux-policy/cups-pdf-and-similar/runtest.sh
index a8d6c77..149bc38 100755
--- a/selinux-policy/cups-pdf-and-similar/runtest.sh
+++ b/selinux-policy/cups-pdf-and-similar/runtest.sh
@@ -30,7 +30,6 @@
. /usr/share/beakerlib/beakerlib.sh || exit 1
PACKAGE="selinux-policy"
-ROOT_PASSWORD="redhat"
FILE_PATH="/usr/lib/cups/backend/cups-pdf"
FILE_CONTEXT="cups_pdf_exec_t"
SERVICE_PACKAGE="cups-pdf"
@@ -56,6 +55,7 @@ rlJournalStart
rlServiceStart ${SERVICE_NAME}
rlFileBackup /etc/shadow
+ rlSEConfigureSSH
rlSESetEnforce
rlSEStatus
diff --git a/selinux-policy/dmidecode-and-similar/runtest.sh b/selinux-policy/dmidecode-and-similar/runtest.sh
index e6189f3..0c18c3b 100755
--- a/selinux-policy/dmidecode-and-similar/runtest.sh
+++ b/selinux-policy/dmidecode-and-similar/runtest.sh
@@ -41,6 +41,8 @@ rlJournalStart
rlAssertRpm ${PACKAGE}-targeted
rlAssertRpm dmidecode
+ rlSEConfigureSSH
+
rlSESetEnforce
rlSEStatus
rlSESetTimestamp
diff --git a/selinux-policy/fwupd-and-similar/runtest.sh b/selinux-policy/fwupd-and-similar/runtest.sh
index e5ce44d..ae0fac8 100755
--- a/selinux-policy/fwupd-and-similar/runtest.sh
+++ b/selinux-policy/fwupd-and-similar/runtest.sh
@@ -50,6 +50,7 @@ rlJournalStart
rlServiceStop ${SERVICE_NAME}
rlFileBackup /etc/shadow
+ rlSEConfigureSSH
rlSESetEnforce
rlSEStatus
diff --git a/selinux-policy/journalctl-and-similar/runtest.sh b/selinux-policy/journalctl-and-similar/runtest.sh
index c60084c..ac96c64 100755
--- a/selinux-policy/journalctl-and-similar/runtest.sh
+++ b/selinux-policy/journalctl-and-similar/runtest.sh
@@ -33,7 +33,6 @@ PACKAGE="selinux-policy"
FILE_PATH="/usr/bin/journalctl"
FILE_CONTEXT="journalctl_exec_t"
SERVICE_PACKAGE="systemd"
-SERVICE_NAME=""
PROCESS_NAME="journalctl"
PROCESS_CONTEXT="journalctl_t"
ALLOWED_USERS=${ALLOWED_USERS:-"staff_u user_u sysadm_u unconfined_u"}
@@ -47,6 +46,8 @@ rlJournalStart
rlAssertRpm ${PACKAGE}-targeted
rlAssertRpm ${SERVICE_PACKAGE}
+ rlSEConfigureSSH
+
rlSESetEnforce
rlSEStatus
rlSESetTimestamp
diff --git a/selinux-policy/pam_console-and-related/runtest.sh b/selinux-policy/pam_console-and-related/runtest.sh
index 812c07c..05c8796 100755
--- a/selinux-policy/pam_console-and-related/runtest.sh
+++ b/selinux-policy/pam_console-and-related/runtest.sh
@@ -30,7 +30,6 @@
. /usr/share/beakerlib/beakerlib.sh || exit 1
PACKAGE="selinux-policy"
-ROOT_PASSWORD="redhat"
SERVICE_PACKAGE="pam"
if rlIsRHEL 7 ; then
DENIED_USERS=${DENIED_USERS:-"staff_u"}
@@ -49,6 +48,7 @@ rlJournalStart
rlAssertRpm ${SERVICE_PACKAGE}
rlFileBackup /etc/shadow
+ rlSEConfigureSSH
rlSESetEnforce
rlSEStatus
@@ -76,8 +76,6 @@ rlJournalStart
fi
rlPhaseStartTest "real scenario -- confined users"
- rlSEConfigureSSH
-
rlRun "setsebool ssh_sysadm_login on"
rlLog "configuration says not to test SELinux users: ${DENIED_USERS}"
for SELINUX_USER in ${ALLOWED_USERS} ; do
diff --git a/selinux-policy/pam_limits-and-related/runtest.sh b/selinux-policy/pam_limits-and-related/runtest.sh
index b7a03ff..da513df 100755
--- a/selinux-policy/pam_limits-and-related/runtest.sh
+++ b/selinux-policy/pam_limits-and-related/runtest.sh
@@ -44,6 +44,7 @@ rlJournalStart
rlFileBackup /etc/shadow
rlFileBackup /etc/security/limits.conf
+ rlSEConfigureSSH
rlSESetEnforce
rlSEStatus
diff --git a/selinux-policy/pam_timestamp-and-related/runtest.sh b/selinux-policy/pam_timestamp-and-related/runtest.sh
index f1a7b86..22521a0 100755
--- a/selinux-policy/pam_timestamp-and-related/runtest.sh
+++ b/selinux-policy/pam_timestamp-and-related/runtest.sh
@@ -30,7 +30,6 @@
. /usr/share/beakerlib/beakerlib.sh || exit 1
PACKAGE="selinux-policy"
-ROOT_PASSWORD="redhat"
SERVICE_PACKAGE="pam"
DENIED_USERS=${DENIED_USERS:-"guest_u xguest_u"}
ALLOWED_USERS=${ALLOWED_USERS:-"staff_u user_u sysadm_u unconfined_u"}
@@ -46,6 +45,7 @@ rlJournalStart
rlFileBackup /etc/shadow
rlFileBackup ${TIMESTAMP_DIR}/_pam_timestamp_key
+ rlSEConfigureSSH
rlSESetEnforce
rlSEStatus
@@ -69,8 +69,6 @@ rlJournalStart
fi
rlPhaseStartTest "real scenario -- confined users"
- rlSEConfigureSSH
-
rlRun "setsebool ssh_sysadm_login on"
rlRun "mkdir -p ${TIMESTAMP_DIR}"
rlRun "touch ${TIMESTAMP_DIR}/_pam_timestamp_key"
diff --git a/selinux-policy/ping-and-similar/runtest.sh b/selinux-policy/ping-and-similar/runtest.sh
index 6262122..004b259 100755
--- a/selinux-policy/ping-and-similar/runtest.sh
+++ b/selinux-policy/ping-and-similar/runtest.sh
@@ -30,7 +30,6 @@
. /usr/share/beakerlib/beakerlib.sh || exit 1
PACKAGE="selinux-policy"
-ROOT_PASSWORD="redhat"
FILE_PATH="/bin/ping"
FILE_CONTEXT="ping_exec_t"
SERVICE_PACKAGE="iputils"
@@ -46,6 +45,7 @@ rlJournalStart
rlAssertRpm ${SERVICE_PACKAGE}
rlFileBackup /etc/shadow
+ rlSEConfigureSSH
rlSESetEnforce
rlSEStatus
@@ -89,8 +89,6 @@ rlJournalStart
# this phase is useful if you want to run some commands under confined users
rlPhaseStartTest "real scenario -- confined users"
- rlSEConfigureSSH
-
rlRun "setsebool ssh_sysadm_login on"
rlRun "setsebool user_ping on"
for SELINUX_USER in staff_u user_u sysadm_u unconfined_u ; do
diff --git a/selinux-policy/policykit-general/runtest.sh b/selinux-policy/policykit-general/runtest.sh
index 9775454..e89eefc 100755
--- a/selinux-policy/policykit-general/runtest.sh
+++ b/selinux-policy/policykit-general/runtest.sh
@@ -51,6 +51,7 @@ rlJournalStart
rlServiceStop ${SERVICE_NAME}
rlFileBackup /etc/shadow
+ rlSEConfigureSSH
rlSESetEnforce
rlSEStatus
diff --git a/selinux-policy/systemd-notify-and-similar/runtest.sh b/selinux-policy/systemd-notify-and-similar/runtest.sh
index a0dde3d..59a2908 100755
--- a/selinux-policy/systemd-notify-and-similar/runtest.sh
+++ b/selinux-policy/systemd-notify-and-similar/runtest.sh
@@ -47,6 +47,8 @@ rlJournalStart
rlAssertRpm ${PACKAGE}-targeted
rlAssertRpm ${SERVICE_PACKAGE}
+ rlSEConfigureSSH
+
rlSESetEnforce
rlSEStatus
rlSESetTimestamp
diff --git a/selinux-policy/systemd-userdbd-and-similar/runtest.sh b/selinux-policy/systemd-userdbd-and-similar/runtest.sh
index f7cf06f..5df13af 100755
--- a/selinux-policy/systemd-userdbd-and-similar/runtest.sh
+++ b/selinux-policy/systemd-userdbd-and-similar/runtest.sh
@@ -56,6 +56,7 @@ rlJournalStart
rlServiceStop ${SERVICE_NAME}
rlFileBackup /etc/shadow
+ rlSEConfigureSSH
rlSESetEnforce
rlSEStatus
@@ -80,8 +81,6 @@ rlJournalStart
fi
rlPhaseStartTest "real scenario -- confined users"
- rlSEConfigureSSH
-
rlRun "setsebool ssh_sysadm_login on"
rlRun "setsebool selinuxuser_tcp_server on"
rlLog "configuration says not to test SELinux users: ${DENIED_USERS}"
reply other threads:[~2026-09-11 13:20 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=178913283723.1.10857536080096176152.tests-selinux-e3b384c85feb@fedoraproject.org \
--to=mmalik@redhat.com \
--cc=git-commits@fedoraproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox