public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
* [tests/selinux] pr775-checkpolicy-revdeps: add the kdump test to upstream repo
@ 2026-09-11 13:21 Milos Malik
0 siblings, 0 replies; only message in thread
From: Milos Malik @ 2026-09-11 13:21 UTC (permalink / raw)
To: git-commits
A new commit has been pushed.
Repo : tests/selinux
Branch : pr775-checkpolicy-revdeps
Commit : 58842891ba001a36b23d75b1287bd30946bfa017
Author : Milos Malik <mmalik@redhat.com>
Date : 2023-09-22T11:25:50+00:00
Stats : +516/-0 in 8 file(s)
URL : https://src.fedoraproject.org/tests/selinux/c/58842891ba001a36b23d75b1287bd30946bfa017?branch=pr775-checkpolicy-revdeps
Log:
add the kdump test to upstream repo
The kexec-tools component is frequently used by various users on Fedora
and RHEL, so it makes sense to run this TC in upstream testing too.
There are no changes in the TC functionality.
Moving the downstream TC to upstream repo.
The TC covers BZ#2236876.
---
diff --git a/selinux-policy/bz533007-unable-to-start-kdump-service/Makefile b/selinux-policy/bz533007-unable-to-start-kdump-service/Makefile
new file mode 100644
index 0000000..20c69e7
--- /dev/null
+++ b/selinux-policy/bz533007-unable-to-start-kdump-service/Makefile
@@ -0,0 +1,113 @@
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+# Makefile of /CoreOS/selinux-policy/Regression/bz533007-unable-to-start-kdump-service
+# Description: kdump service cannot be started because of SELinux
+# Author: Milos Malik <mmalik@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+# Copyright (c) 2009 Red Hat, Inc. All rights reserved.
+#
+# This copyrighted material is made available to anyone wishing
+# to use, modify, copy, or redistribute it subject to the terms
+# and conditions of the GNU General Public License version 2.
+#
+# This program is distributed in the hope that it will be
+# useful, but WITHOUT ANY WARRANTY; without even the implied
+# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+# PURPOSE. See the GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public
+# License along with this program; if not, write to the Free
+# Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+# Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+export TEST=/CoreOS/selinux-policy/Regression/bz533007-unable-to-start-kdump-service
+export TESTVERSION=1.0
+
+BUILT_FILES=
+
+FILES=$(METADATA) runtest.sh Makefile PURPOSE testpolicy.te run.exp id_rsa id_rsa.pub
+
+.PHONY: all install download clean
+
+run: $(FILES) build
+ ./runtest.sh
+
+build: $(BUILT_FILES)
+ chmod a+x runtest.sh run.exp
+ chcon -t bin_t runtest.sh run.exp
+
+clean:
+ rm -f *~ $(BUILT_FILES)
+
+include /usr/share/rhts/lib/rhts-make.include
+
+$(METADATA): Makefile
+ @echo "Owner: Milos Malik <mmalik@redhat.com>" > $(METADATA)
+ @echo "Name: $(TEST)" >> $(METADATA)
+ @echo "TestVersion: $(TESTVERSION)" >> $(METADATA)
+ @echo "Path: $(TEST_DIR)" >> $(METADATA)
+ @echo "Description: kdump service cannot be started because of SELinux" >> $(METADATA)
+ @echo "Type: Regression" >> $(METADATA)
+ @echo "TestTime: 15m" >> $(METADATA)
+ @echo "RunFor: selinux-policy" >> $(METADATA)
+ @echo "Requires: audit" >> $(METADATA)
+ @echo "Requires: expect" >> $(METADATA)
+ @echo "Requires: /usr/sbin/service" >> $(METADATA)
+ @echo "Requires: kexec-tools" >> $(METADATA)
+ @echo "Requires: grubby" >> $(METADATA)
+ @echo "Requires: libselinux" >> $(METADATA)
+ @echo "Requires: libselinux-utils" >> $(METADATA)
+ @echo "Requires: policycoreutils" >> $(METADATA)
+ @echo "Requires: sed" >> $(METADATA)
+ @echo "Requires: selinux-policy" >> $(METADATA)
+ @echo "Requires: selinux-policy-mls" >> $(METADATA)
+ @echo "Requires: selinux-policy-targeted" >> $(METADATA)
+ @echo "Requires: setools-console" >> $(METADATA)
+ @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA)
+ @echo "Priority: Normal" >> $(METADATA)
+ @echo "License: GPLv2" >> $(METADATA)
+ @echo "Confidential: no" >> $(METADATA)
+ @echo "Destructive: no" >> $(METADATA)
+ @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA)
+ @echo "Releases: -RHEL4" >> $(METADATA)
+ @echo "Bug: 533007" >> $(METADATA) # RHEL-6
+ @echo "Bug: 533366" >> $(METADATA) # RHEL-6
+ @echo "Bug: 537088" >> $(METADATA) # RHEL-6
+ @echo "Bug: 540758" >> $(METADATA) # RHEL-6
+ @echo "Bug: 549503" >> $(METADATA) # RHEL-6
+ @echo "Bug: 618329" >> $(METADATA) # RHEL-6
+ @echo "Bug: 621061" >> $(METADATA) # RHEL-6
+ @echo "Bug: 753039" >> $(METADATA) # RHEL-5
+ @echo "Bug: 966203" >> $(METADATA) # RHEL-6
+ @echo "Bug: 1055634" >> $(METADATA) # RHEL-7
+ @echo "Bug: 1117368" >> $(METADATA) # RHEL-7
+ @echo "Bug: 1117710" >> $(METADATA) # RHEL-7
+ @echo "Bug: 1146491" >> $(METADATA) # RHEL-7
+ @echo "Bug: 1288565" >> $(METADATA) # RHEL-6
+ @echo "Bug: 1363977" >> $(METADATA) # RHEL-7
+ @echo "Bug: 1375963" >> $(METADATA) # RHEL-7
+ @echo "Bug: 1390669" >> $(METADATA) # RHEL-7
+ @echo "Bug: 1418441" >> $(METADATA) # RHEL-7
+ @echo "Bug: 1431236" >> $(METADATA) # RHEL-6
+ @echo "Bug: 1536690" >> $(METADATA) # RHEL-7
+ @echo "Bug: 1540004" >> $(METADATA) # RHEL-7
+ @echo "Bug: 1542283" >> $(METADATA) # RHEL-7
+ @echo "Bug: 1576730" >> $(METADATA) # RHEL-8
+ @echo "Bug: 1588884" >> $(METADATA) # RHEL-7
+ @echo "Bug: 1842897" >> $(METADATA) # RHEL-8
+ @echo "Bug: 1896424" >> $(METADATA) # RHEL-8
+ @echo "Bug: 1896595" >> $(METADATA) # RHEL-8
+ @echo "Bug: 1899141" >> $(METADATA) # RHEL-8
+ @echo "Bug: 1932752" >> $(METADATA) # RHEL-9
+ @echo "Bug: 1951323" >> $(METADATA) # Fedora 33
+ @echo "Bug: 1961728" >> $(METADATA) # RHEL-8
+ @echo "Bug: 1965985" >> $(METADATA) # RHEL-8
+ @echo "Bug: 1965989" >> $(METADATA) # RHEL-9
+ @echo "Bug: 1965989" >> $(METADATA) # Fedora rawhide
+
+ rhts-lint $(METADATA)
+
diff --git a/selinux-policy/bz533007-unable-to-start-kdump-service/PURPOSE b/selinux-policy/bz533007-unable-to-start-kdump-service/PURPOSE
new file mode 100644
index 0000000..dd2a012
--- /dev/null
+++ b/selinux-policy/bz533007-unable-to-start-kdump-service/PURPOSE
@@ -0,0 +1,5 @@
+PURPOSE of /CoreOS/selinux-policy/Regression/bz533007-unable-to-start-kdump-service
+Author: Milos Malik <mmalik@redhat.com>
+
+SELinux interferes with kdump and related programs.
+
diff --git a/selinux-policy/bz533007-unable-to-start-kdump-service/id_rsa b/selinux-policy/bz533007-unable-to-start-kdump-service/id_rsa
new file mode 100644
index 0000000..a38bb9b
--- /dev/null
+++ b/selinux-policy/bz533007-unable-to-start-kdump-service/id_rsa
@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEowIBAAKCAQEA724nX9GdCr5+gJTSgdn6QK+AhSdqlN0D++qqs6fGBn5YA1w1
+dGNtuMsL81HjKPIjK+tecFO9HRUSM1nsxg6z8zNzlVxvQYB8uTw3cZXKgorDI280
+6ESdU4oXDQqrUyZVRJmh2I58qMVn9TdeTwbnYFEbrnItq7NKQ9VobcF4T3w2aj61
+vSTLLx8IT9cfyTfQI9ELJ3RFTVzlyfMJ6x9PSyWPzeclsL9pR39rp5ZuZpOXY2Nm
+1t3UiQcOurPS/1Y3lxUgZHadFnQyW/oIeQddIfKOollFqnKx/71YPq1RUcPcO/ba
+y1IpM8tgpxXfkIWk7jB4N9zmVRI7QwDe+5NKBwIDAQABAoIBAQDAnqnmmEfzANXc
+s922wZpmt8p5VQCVykkOPfgemHbjenlsGp6Wh/cZl6CBm/tYUZSiHLTZQUT/RJhj
+35BwthtnKJlwK/EFjUzJ6Pvh0VQeOWxL8Ydq5Oh88LcistaqCkjG66IdCmSXkljU
+Gjsw8Kjr/9R5PzomzBKPB/z/b4pOxlzAxUev2m7Gfb8UcCwnlMTq3udn6sexZ50V
+bTX//tgpsUAMMzARKYk2v472qtmQuTa7rP9EIjKR8qVpv27tX0i80MFUSsOpL1E3
+kPSqqkKEXkCf1zCw14dF2d2JeiyW7ADka71m51ZMfn1POMdwWgpreeWUQphwC798
+KyrJ3RNhAoGBAPy1yUlE1Hs7+/6G3ndpf5lI5lU6aiaT12TVYi0cMWpFDjX0qA93
+Ew7HMFfkZpFwV54YYW1ZuoGG0l93voKsP8LWnSDLEoX+gBbkKHeyMHkzCTiVTlYN
+rB7EtAxEe6kYlTbcYhpICA561ujxf+kn/uLhYZQ8iq70Z0kpiDGYwN19AoGBAPKM
+HAq7xmxq8rCC65CBbneIJD8luK+XenDKkIj/OjjOp33odR4DAyNwUigu+DzZjdb4
+Xm2Mb3HofDzsRjPjEidQ9dx/rQoA4qKmXMLZI9qFMcFsqFkNwHToBYgrQU0XK+2G
+DYIs1spu5TtqWspflcvos4oWM0EiTZs5y8TrnGzTAoGASWEn36Si5l3WoGPdOWNi
+78mhSGI77JPFWbw0U9D58Fe49qXiHwt+dy4TtZHWzqiGaJu/vpbtdysE7z/ADAWk
+Rhk3awxMhqgN3ZfGwGr3dFoDdXC1XHt/3TdU6LMCDWnb+iAoRGViIYI94Uou0C8S
+7iJvyTGDO6YwT6hFqdEnP6kCgYB9LSA/zd8/DwcHX9nxL0tytzl1uaMSREw1r+Ve
+PtKuhMDecz0WaxmQjaRpBqyowuK4ImChiwvtLr4Hty0YFEXHMrpgvSfx9LkClndj
+PCuL2JfwKoLLyxQbga9xMlm2TpImOLv6Begoe4kk2+PVc/VcUlFun7x+DhUdWnu2
+up51bwKBgAfnx94dIgA8Z7P4Za8Cpp9FCMfUa4R+gNI+/0XLFAGR9Bd+c/61jMRd
+OQjErru9Fq47kvE91GHfyS069gI+g7tsTcnPgAXiNhmhILe5O+blNuPPclQ9NMLG
+4WII0I6nrbKMnvwCRw6Ikc2OiijPkmbI9VXwIMfbGxI77A4UGBp5
+-----END RSA PRIVATE KEY-----
diff --git a/selinux-policy/bz533007-unable-to-start-kdump-service/id_rsa.pub b/selinux-policy/bz533007-unable-to-start-kdump-service/id_rsa.pub
new file mode 100644
index 0000000..7b2871f
--- /dev/null
+++ b/selinux-policy/bz533007-unable-to-start-kdump-service/id_rsa.pub
@@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDvbidf0Z0Kvn6AlNKB2fpAr4CFJ2qU3QP76qqzp8YGflgDXDV0Y224ywvzUeMo8iMr615wU70dFRIzWezGDrPzM3OVXG9BgHy5PDdxlcqCisMjbzToRJ1TihcNCqtTJlVEmaHYjnyoxWf1N15PBudgURuuci2rs0pD1WhtwXhPfDZqPrW9JMsvHwhP1x/JN9Aj0QsndEVNXOXJ8wnrH09LJY/N5yWwv2lHf2unlm5mk5djY2bW3dSJBw66s9L/VjeXFSBkdp0WdDJb+gh5B10h8o6iWUWqcrH/vVg+rVFRw9w79trLUikzy2CnFd+QhaTuMHg33OZVEjtDAN77k0oH
diff --git a/selinux-policy/bz533007-unable-to-start-kdump-service/main.fmf b/selinux-policy/bz533007-unable-to-start-kdump-service/main.fmf
new file mode 100644
index 0000000..c604c09
--- /dev/null
+++ b/selinux-policy/bz533007-unable-to-start-kdump-service/main.fmf
@@ -0,0 +1,81 @@
+summary: kdump service cannot be started because of SELinux
+description: |+
+ SELinux interferes with kdump and related programs.
+
+contact: Milos Malik <mmalik@redhat.com>
+component:
+ - selinux-policy
+test: ./runtest.sh
+framework: beakerlib
+require:
+ - library(selinux-policy/common)
+recommend:
+ - audit
+ - expect
+ - /usr/sbin/service
+ - kexec-tools
+ - grubby
+ - libselinux
+ - libselinux-utils
+ - policycoreutils
+ - sed
+ - selinux-policy
+ - selinux-policy-mls
+ - selinux-policy-targeted
+ - setools-console
+environment:
+ AVC_ERROR: +no_avc_check
+duration: 15m
+enabled: true
+tag:
+ - MLS
+ - NoRHEL4
+ - TIPpass_Security
+ - TierCandidatesPASS
+ - TipWaived7
+ - failinfedora
+ - targeted
+link:
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=533007
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=533366
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=537088
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=540758
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=549503
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=618329
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=621061
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=753039
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=966203
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1055634
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1117368
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1117710
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1146491
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1288565
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1363977
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1375963
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1390669
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1418441
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1431236
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1536690
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1540004
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1542283
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1576730
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1588884
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1842897
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1896424
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1896595
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1899141
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1932752
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1951323
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1961728
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1965985
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1965989
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1934347
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=830822
+ - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2236876
+adjust:
+ - enabled: false
+ when: distro == rhel-4
+ continue: false
+extra-nitrate: TC#0057470
+extra-summary: /CoreOS/selinux-policy/Regression/bz533007-unable-to-start-kdump-service
+extra-task: /CoreOS/selinux-policy/Regression/bz533007-unable-to-start-kdump-service
diff --git a/selinux-policy/bz533007-unable-to-start-kdump-service/run.exp b/selinux-policy/bz533007-unable-to-start-kdump-service/run.exp
new file mode 100755
index 0000000..939b3a3
--- /dev/null
+++ b/selinux-policy/bz533007-unable-to-start-kdump-service/run.exp
@@ -0,0 +1,17 @@
+#!/usr/bin/expect -f
+# ./run.exp password param1 param2 param3
+set password [lrange $argv 0 0]
+set param1 [lrange $argv 1 1]
+set param2 [lrange $argv 2 2]
+set param3 [lrange $argv 3 3]
+set timeout 15
+spawn $param1 $param2 $param3
+expect {
+ "yes/no" { send -- "yes\r" }
+ eof
+}
+expect {
+ "assword" { send -- "$password\r" }
+ eof
+}
+
diff --git a/selinux-policy/bz533007-unable-to-start-kdump-service/runtest.sh b/selinux-policy/bz533007-unable-to-start-kdump-service/runtest.sh
new file mode 100755
index 0000000..ba14f7e
--- /dev/null
+++ b/selinux-policy/bz533007-unable-to-start-kdump-service/runtest.sh
@@ -0,0 +1,257 @@
+#!/bin/bash
+# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+# runtest.sh of /CoreOS/selinux-policy/Regression/bz533007-unable-to-start-kdump-service
+# Description: kdump service cannot be started because of SELinux
+# Author: Milos Malik <mmalik@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+# Copyright (c) 2009 Red Hat, Inc. All rights reserved.
+#
+# This copyrighted material is made available to anyone wishing
+# to use, modify, copy, or redistribute it subject to the terms
+# and conditions of the GNU General Public License version 2.
+#
+# This program is distributed in the hope that it will be
+# useful, but WITHOUT ANY WARRANTY; without even the implied
+# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+# PURPOSE. See the GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public
+# License along with this program; if not, write to the Free
+# Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+# Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include rhts environment
+. /usr/share/beakerlib/beakerlib.sh
+
+if ! grep crashkernel= /proc/cmdline ; then
+ grubby --update-kernel ALL --args crashkernel=512M
+ sync
+ rhts-reboot
+fi
+
+PACKAGE="selinux-policy"
+
+rlJournalStart
+ rlPhaseStartSetup
+ rlRun "rlImport 'selinux-policy/common'"
+ rlSESatisfyRequires
+ rlAssertRpm ${PACKAGE}
+ rlAssertRpm ${PACKAGE}-mls
+ rlAssertRpm ${PACKAGE}-targeted
+ rlAssertRpm kexec-tools
+ rlRun "uname -a"
+ rlRun "cat /proc/cmdline"
+
+ rlFileBackup --clean /root/.ssh
+ rlFileBackup /etc/kdump.conf
+ rlFileBackup /etc/shadow
+ OUTPUT_FILE=`mktemp`
+
+ if rlIsRHEL 6 ; then
+ rlRun "ls -l testpolicy.te"
+ rlRun "make -f /usr/share/selinux/devel/Makefile"
+ rlRun "ls -l testpolicy.pp"
+ rlRun "semodule -i testpolicy.pp"
+ fi
+
+ rlSESetEnforce
+ rlSEStatus
+ rlSESetTimestamp
+ sleep 2
+ rlPhaseEnd
+
+ if ! rlIsRHEL 5 ; then
+ rlPhaseStartTest "bz#533007 + bz#533366 + bz#540758 + bz#549503 + bz#966203"
+ rlSEMatchPathCon "/sbin/kexec" "kdump_exec_t"
+ rlRun "ls -Z /proc/kcore | grep :proc_kcore_t"
+ if rlIsRHEL 6 ; then
+ rlRun "seinfo -tkdump_t -x | grep mlsfileread"
+ fi
+ rlSESearchRule "allow kdump_t proc_kcore_t : file { getattr open read }"
+ rlPhaseEnd
+
+ rlPhaseStartTest "bz#537088"
+ rlSEMatchPathCon "/sbin/kexec" "kdump_exec_t"
+ rlSESearchRule "allow kdump_t kdump_t : capability { sys_rawio }"
+ rlPhaseEnd
+
+ rlPhaseStartTest "bz#618329"
+ rlSEMatchPathCon "/sbin/kexec" "kdump_exec_t"
+ [ -e /sys/kernel/debug/boot_params/data ] && rlRun "ls -Z /sys/kernel/debug/boot_params/data | grep :debugfs_t"
+ rlSESearchRule "allow kdump_t user_devpts_t : chr_file { read write } [ allow_daemons_use_tty ]"
+ rlSESearchRule "allow kdump_t sysfs_t : dir { getattr read search }"
+ rlSESearchRule "allow kdump_t sysfs_t : file { getattr open read }"
+ rlSESearchRule "allow kdump_t debugfs_t : dir { getattr search }"
+ rlSESearchRule "allow kdump_t debugfs_t : file { getattr open read }"
+ rlPhaseEnd
+
+ rlPhaseStartTest "bz#621061"
+ rlSEMatchPathCon "/sbin/kexec" "kdump_exec_t"
+ rlSESearchRule "allow kdump_t kernel_t : system { module_request }"
+ rlPhaseEnd
+ fi
+
+ if rlIsRHEL 6 ; then
+ rlPhaseStartTest "bz#1288565 + bz#1431236"
+ rlSEMatchPathCon "/usr/sbin/bmc-watchdog" "freeipmi_bmc_watchdog_exec_t"
+ rlSEMatchPathCon "/var/lock/kdump" "kdump_lock_t"
+ # even though the context of /var/lock/kdump was corrected via restorecon before reboot
+ # after reboot the file was mislabeled (var_lock_t) again
+ rlSESearchRule "dontaudit freeipmi_bmc_watchdog_t var_lock_t : file { write }"
+ rlPhaseEnd
+ fi
+
+ if ! rlIsRHEL 5 6 ; then
+ rlPhaseStartTest "bz#1055634" # MLS + targeted
+ rlSEMatchPathCon "/usr/bin/kdumpctl" "kdumpctl_exec_t"
+ rlSEMatchPathCon "/var/lock" "var_lock_t"
+ rlSEMatchPathCon "/var/lock/kdump" "kdump_lock_t"
+ rlSESearchRule "allow kdumpctl_t var_lock_t : lnk_file { getattr read }"
+ rlSESearchRule "allow kdumpctl_t var_lock_t : dir { getattr open search read write add_name remove_name }"
+ rlRun "sesearch -s kdumpctl_t -t var_lock_t -c file -T | grep \"kdump_lock_t.*kdump\""
+ rlSESearchRule "allow kdumpctl_t kdump_lock_t : file { getattr open create unlink }"
+ rlPhaseEnd
+
+ rlPhaseStartTest "bz#1117368 + bz#1117710 + bz#1146491"
+ rlSEMatchPathCon "/sbin/kexec" "kdump_exec_t"
+ rlRun "ls -Z /proc/kallsyms | grep :system_map_t"
+ rlSESearchRule "allow kdump_t system_map_t : file { getattr open read }"
+ rlPhaseEnd
+
+ rlPhaseStartTest "bz#1363977"
+ rlSESearchRule "allow NetworkManager_t kdumpctl_t : dbus { send_msg }"
+ rlSESearchRule "allow kdumpctl_t NetworkManager_t : dbus { send_msg }"
+ rlPhaseEnd
+
+ rlPhaseStartTest "bz#1375963 + bz#1418441"
+ rlSEMatchPathCon "/sbin/kexec" "kdump_exec_t"
+ rlSESearchRule "allow kdump_t kdump_t : capability { sys_admin }"
+ rlPhaseEnd
+
+ rlPhaseStartTest "bz#1390669"
+ rlSEMatchPathCon "/usr/bin/kdumpctl" "kdumpctl_exec_t"
+ if [ -f /sys/kernel/security/securelevel ] ; then
+ # the file is present on RHEL-7.5: kernel 3.10
+ # the file is not present on RHEL-ALT-7.5: kernel 4.14
+ rlRun "ls -Z /sys/kernel/security/securelevel | grep :security_t"
+ fi
+ rlSESearchRule "allow kdumpctl_t security_t : file { getattr open read } mls"
+ rlSESearchRule "allow kdumpctl_t security_t : file { getattr open read } targeted"
+ rlPhaseEnd
+
+ rlPhaseStartTest "bz#1540004 + bz#1542283"
+ rlSEMatchPathCon "/sbin/kexec" "kdump_exec_t"
+ rlSESearchRule "allow kdump_t kdump_t : capability2 { syslog }"
+ rlPhaseEnd
+
+ rlPhaseStartTest "bz#1536690"
+ rlSESearchRule "allow kdump_t modules_object_t : file { getattr open read } [ ]"
+ rlPhaseEnd
+ fi
+
+ if ! rlIsRHEL 5 6 ; then
+ rlPhaseStartTest "bz#1576730 + bz#1588884"
+ rlSEMatchPathCon "/sbin/kexec" "kdump_exec_t"
+ rlSEMatchPathCon "/boot/initramfs-4.16.0-8.el8+5.s390xkdump.img" "boot_t"
+ rlSESearchRule "allow kdump_t boot_t : file { map }"
+ rlPhaseEnd
+ fi
+
+ if ! rlIsRHEL 5 6 7 ; then
+ rlPhaseStartTest "bz#1842897"
+ # relevant SELinux denials appear during the real scenario phases
+ rlSESearchRule "dontaudit NetworkManager_t kdumpctl_tmp_t : fifo_file { write } [ ]"
+ rlPhaseEnd
+
+ rlPhaseStartTest "bz#1896424 + bz#1896595 + bz#1899141"
+ rlSEMatchPathCon "/sbin/kexec" "kdump_exec_t"
+ rlSESearchRule "allow kdump_t tmp_t : dir { write add_name remove_name } [ ]"
+ rlSESearchRule "allow kdump_t tmp_t : file { create unlink } [ ]"
+ rlPhaseEnd
+ fi
+
+ if seinfo -c | grep -q lockdown ; then
+ rlPhaseStartTest "bz#1932752"
+ rlSEMatchPathCon "/sbin/kexec" "kdump_exec_t"
+ rlSESearchRule "allow kdump_t kdump_t : lockdown { confidentiality integrity } [ ]"
+ rlPhaseEnd
+ fi
+
+ if ! rlIsRHEL 5 6 7 ; then
+ rlPhaseStartTest "bz#1951323 + bz#1961728 + bz#1965985 + bz#1965989"
+ # the directory belongs to the kexec-tools package
+ rlSEMatchPathCon "/var/lib/kdump" "kdump_var_lib_t"
+ rlSEMatchPathCon "/var/lib/kdump/initramfs-kernel-version.kdump.img" "kdump_var_lib_t"
+ rlSESearchRule "allow kdump_t kdump_var_lib_t : dir { getattr open search add_name remove_name read write } [ ]"
+ rlSESearchRule "allow kdump_t kdump_var_lib_t : file { getattr open read } [ ]"
+ rlSESearchRule "allow rpm_script_t kdump_var_lib_t : dir { getattr open search add_name remove_name read write } [ ]"
+ rlSESearchRule "allow rpm_script_t kdump_var_lib_t : file { getattr open read } [ ]"
+ rlPhaseEnd
+ fi
+
+ if rlIsFedora ; then
+ rlPhaseStartTest "bz#2236876"
+ rlSESearchRule "allow kdump_t tmpfs_t : dir { write add_name } [ ]"
+ rlSESearchRule "type_transition kdump_t tmpfs_t : file kdump_tmpfs_t"
+ rlSESearchRule "allow kdump_t kdump_tmpfs_t : file { read write } [ ]"
+ rlPhaseEnd
+ fi
+
+ rlPhaseStartTest "real scenario"
+ rlRun "sed -i \"s/^\(net.*\)$/# \1/\" /etc/kdump.conf"
+ rlRun "service kdump start 2>&1 | tee ${OUTPUT_FILE}"
+ rlRun "grep -i \"unable to gather efi data\" ${OUTPUT_FILE}" 1
+ sleep 1
+ rlRun "service kdump restart 2>&1 | tee ${OUTPUT_FILE}"
+ rlRun "grep -i \"unable to gather efi data\" ${OUTPUT_FILE}" 1
+ sleep 1
+ rlRun "service kdump stop"
+ sleep 1
+ rlRun "grep \"kdump.*kexec.*loaded.*kernel\" /var/log/messages | tail -n 2"
+ rlPhaseEnd
+
+ rlPhaseStartTest "real scenario -- bz#753039"
+ USER_NAME="root"
+ USER_SECRET="redhat"
+ rlRun "echo ${USER_SECRET} | passwd --stdin ${USER_NAME}"
+ rlRun "mkdir -p /root/.ssh"
+ rlRun "restorecon -Rv /root/.ssh"
+ rlRun "cp id_rsa /root/.ssh/"
+ rlRun "chmod 600 /root/.ssh/id_rsa"
+ rlRun "cat id_rsa.pub >> /root/.ssh/authorized_keys"
+
+ if rlIsRHEL 5 6 ; then
+ rlRun "echo \"net ${USER_NAME}@${HOSTNAME}\" >> /etc/kdump.conf"
+ rlRun "./run.exp ${USER_SECRET} service kdump propagate"
+ else
+ rlRun "sed -i \"s/makedumpfile/makedumpfile -F/\" /etc/kdump.conf"
+ rlRun "echo \"ssh ${USER_NAME}@${HOSTNAME}\" >> /etc/kdump.conf"
+ rlRun "./run.exp ${USER_SECRET} kdumpctl propagate"
+ rlRun "runcon system_u:system_r:initrc_t:s0 bash -c \"kdumpctl showmem\""
+ fi
+ rlRun "service kdump restart"
+ sleep 1
+ rlRun "grep \"kdump.*propagated ssh key\" /var/log/messages | tail -n 1"
+ rlPhaseEnd
+
+ rlPhaseStartCleanup
+ sleep 2
+ rlSECheckAVC
+
+ if rlIsRHEL 6 ; then
+ rlRun "semodule -r testpolicy"
+ rlRun "rm -f testpolicy.pp"
+ fi
+
+ rm -f ${OUTPUT_FILE}
+ rlFileRestore
+ rlPhaseEnd
+ rlJournalPrintText
+rlJournalEnd
+
diff --git a/selinux-policy/bz533007-unable-to-start-kdump-service/testpolicy.te b/selinux-policy/bz533007-unable-to-start-kdump-service/testpolicy.te
new file mode 100644
index 0000000..d90b338
--- /dev/null
+++ b/selinux-policy/bz533007-unable-to-start-kdump-service/testpolicy.te
@@ -0,0 +1,15 @@
+module testpolicy 1.0;
+
+require {
+ type user_tmp_t;
+ type setfiles_t;
+ type kdump_t;
+ class file write;
+}
+
+#============= kdump_t ==============
+allow kdump_t user_tmp_t:file write;
+
+#============= setfiles_t ==============
+allow setfiles_t user_tmp_t:file write;
+
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2026-09-11 13:21 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-09-11 13:21 [tests/selinux] pr775-checkpolicy-revdeps: add the kdump test to upstream repo Milos Malik
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox