public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
From: Milos Malik <mmalik@redhat.com>
To: git-commits@fedoraproject.org
Subject: [tests/selinux] pr775-checkpolicy-revdeps: fix the type differences: stas_t vs. nvme_stas_t
Date: Fri, 11 Sep 2026 13:21:01 GMT [thread overview]
Message-ID: <178913286143.1.2582454921278281641.tests-selinux-8698c26ae9aa@fedoraproject.org> (raw)
A new commit has been pushed.
Repo : tests/selinux
Branch : pr775-checkpolicy-revdeps
Commit : 8698c26ae9aaa8661d7403974139f2a18a61d6ad
Author : Milos Malik <mmalik@redhat.com>
Date : 2023-09-25T07:16:37+00:00
Stats : +23/-23 in 4 file(s)
URL : https://src.fedoraproject.org/tests/selinux/c/8698c26ae9aaa8661d7403974139f2a18a61d6ad?branch=pr775-checkpolicy-revdeps
Log:
fix the type differences: stas_t vs. nvme_stas_t
Even though the new policy for nvme-stas component was tested
multiple times (as can be seen in BZ#2111414 and RHEL-1557),
a SELinux type naming problem was introduced by various selinux-policy
builds. For example:
* stas_t vs. nvme_stas_t
* stas_exec_t vs. nvme_stas_exec_t
* stas_var_run_t vs. nvme_stas_var_run_t
* stas_cache_t vs. nvme_stas_cache_t
In order to make the automated test correct and reliable, the SELinux
policy checks executed by the test will use the nvme_* prefixed types,
because they are present in the latest selinux-policy builds.
---
diff --git a/selinux-policy/nvme-stas-and-similar/Makefile b/selinux-policy/nvme-stas-and-similar/Makefile
index b2e07cb..fadaa75 100644
--- a/selinux-policy/nvme-stas-and-similar/Makefile
+++ b/selinux-policy/nvme-stas-and-similar/Makefile
@@ -1,7 +1,7 @@
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#
# Makefile of /CoreOS/selinux-policy/Regression/nvme-stas-and-similar
-# Description: SELinux interferes with NVME sta* services
+# Description: SELinux interferes with stacd and stafd services
# Author: Milos Malik <mmalik@redhat.com>
#
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
@@ -50,7 +50,7 @@ $(METADATA): Makefile
@echo "Name: $(TEST)" >> $(METADATA)
@echo "TestVersion: $(TESTVERSION)" >> $(METADATA)
@echo "Path: $(TEST_DIR)" >> $(METADATA)
- @echo "Description: SELinux interferes with NVME sta* services" >> $(METADATA)
+ @echo "Description: SELinux interferes with stacd and stafd services" >> $(METADATA)
@echo "Type: Regression" >> $(METADATA)
@echo "TestTime: 10m" >> $(METADATA)
@echo "RunFor: nvme-stas" >> $(METADATA)
diff --git a/selinux-policy/nvme-stas-and-similar/PURPOSE b/selinux-policy/nvme-stas-and-similar/PURPOSE
index a0cc42a..0f6ef81 100644
--- a/selinux-policy/nvme-stas-and-similar/PURPOSE
+++ b/selinux-policy/nvme-stas-and-similar/PURPOSE
@@ -1,6 +1,6 @@
PURPOSE of /CoreOS/selinux-policy/Regression/nvme-stas-and-similar
Author: Milos Malik <mmalik@redhat.com>
-SELinux interferes with stacd, stafd services.
+SELinux interferes with stacd and stafd services.
SELinux also affects the stacctl and stafctl programs.
diff --git a/selinux-policy/nvme-stas-and-similar/main.fmf b/selinux-policy/nvme-stas-and-similar/main.fmf
index 76b2ef4..decc044 100644
--- a/selinux-policy/nvme-stas-and-similar/main.fmf
+++ b/selinux-policy/nvme-stas-and-similar/main.fmf
@@ -1,6 +1,6 @@
-summary: SELinux interferes with NVME sta* services
+summary: SELinux interferes with stacd and stafd services
description: |+
- SELinux interferes with NVME sta* services
+ SELinux interferes with stacd and stafd services
contact: Milos Malik <mmalik@redhat.com>
component:
diff --git a/selinux-policy/nvme-stas-and-similar/runtest.sh b/selinux-policy/nvme-stas-and-similar/runtest.sh
index 725e2e9..ac5dd29 100755
--- a/selinux-policy/nvme-stas-and-similar/runtest.sh
+++ b/selinux-policy/nvme-stas-and-similar/runtest.sh
@@ -3,7 +3,7 @@
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#
# runtest.sh of /CoreOS/selinux-policy/Regression/nvme-stas-and-similar
-# Description: SELinux interferes with NVME sta* services
+# Description: SELinux interferes with stacd and stafd services
# Author: Milos Malik <mmalik@redhat.com>
#
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
@@ -30,9 +30,9 @@
. /usr/share/beakerlib/beakerlib.sh || exit 1
PACKAGE="selinux-policy"
-FILE_CONTEXT="stas_exec_t"
+FILE_CONTEXT="nvme_stas_exec_t"
SERVICE_PACKAGE="nvme-stas"
-PROCESS_CONTEXT="stas_t"
+PROCESS_CONTEXT="nvme_stas_t"
rlJournalStart
rlPhaseStartSetup
@@ -59,29 +59,29 @@ rlJournalStart
rlSEMatchPathCon "/usr/sbin/stafd" "${FILE_CONTEXT}"
rlSEMatchPathCon "/dev/nvme-fabrics" "fixed_disk_device_t"
rlSEMatchPathCon "/run/systemd/journal/socket" "syslogd_var_run_t"
- rlSEMatchPathCon "/run/stacd" "stas_var_run_t"
- rlSEMatchPathCon "/run/stacd/last-known-config.pickle" "stas_var_run_t"
- rlSEMatchPathCon "/run/stafd" "stas_var_run_t"
- rlSEMatchPathCon "/run/stafd/last-known-config.pickle" "stas_var_run_t"
+ rlSEMatchPathCon "/run/stacd" "nvme_stas_var_run_t"
+ rlSEMatchPathCon "/run/stacd/last-known-config.pickle" "nvme_stas_var_run_t"
+ rlSEMatchPathCon "/run/stafd" "nvme_stas_var_run_t"
+ rlSEMatchPathCon "/run/stafd/last-known-config.pickle" "nvme_stas_var_run_t"
rlSEMatchPathCon "/run/udev/" "udev_var_run_t"
rlSEMatchPathCon "/run/udev/rules.d/" "udev_var_run_t"
rlSEMatchPathCon "/run/udev/rules.d/70-nvmf-autoconnect.rules" "udev_var_run_t"
- rlSEMatchPathCon "/var/cache/stacd" "stas_cache_t"
- rlSEMatchPathCon "/var/cache/stafd" "stas_cache_t"
+ rlSEMatchPathCon "/var/cache/stacd" "nvme_stas_cache_t"
+ rlSEMatchPathCon "/var/cache/stafd" "nvme_stas_cache_t"
SOURCE_TYPE="init_t" # systemd runs the process
rlSESearchRule "allow ${SOURCE_TYPE} ${FILE_CONTEXT} : file { getattr open read execute } $BOOLEANS"
rlSESearchRule "allow ${SOURCE_TYPE} ${PROCESS_CONTEXT} : process { transition } $BOOLEANS"
rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS"
rlRun "semodule -lfull | grep stas"
- rlSESearchRule "allow avahi_t stas_t : dbus { send_msg } [ ]"
- rlSESearchRule "allow stas_t avahi_t : dbus { send_msg } [ ]"
- rlSESearchRule "allow stas_t fixed_disk_device_t : chr_file { getattr } [ ]"
- rlSESearchRule "allow stas_t stas_t : dbus { send_msg } [ ]"
- rlSESearchRule "allow stas_t syslogd_var_run_t : sock_file { write } [ ]"
- rlSESearchRule "allow stas_t system_dbusd_t : dbus { acquire_svc send_msg } [ ]"
- rlSESearchRule "allow stas_t udev_var_run_t : dir { add_name remove_name write } [ ]"
- rlSESearchRule "allow stas_t udev_var_run_t : file { create getattr ioctl open unlink write } [ ]"
- rlSESearchRule "allow stas_t stas_var_run_t : file { getattr ioctl open read write } [ ]"
+ rlSESearchRule "allow avahi_t nvme_stas_t : dbus { send_msg } [ ]"
+ rlSESearchRule "allow nvme_stas_t avahi_t : dbus { send_msg } [ ]"
+ rlSESearchRule "allow nvme_stas_t fixed_disk_device_t : chr_file { getattr } [ ]"
+ rlSESearchRule "allow nvme_stas_t nvme_stas_t : dbus { send_msg } [ ]"
+ rlSESearchRule "allow nvme_stas_t syslogd_var_run_t : sock_file { write } [ ]"
+ rlSESearchRule "allow nvme_stas_t system_dbusd_t : dbus { acquire_svc send_msg } [ ]"
+ rlSESearchRule "allow nvme_stas_t udev_var_run_t : dir { add_name remove_name write } [ ]"
+ rlSESearchRule "allow nvme_stas_t udev_var_run_t : file { create getattr ioctl open unlink write } [ ]"
+ rlSESearchRule "allow nvme_stas_t nvme_stas_var_run_t : file { getattr ioctl open read write } [ ]"
rlSESearchRule "allow unconfined_t nvme_stas_t : dbus { send_msg } [ ]"
rlSESearchRule "allow nvme_stas_t unconfined_t : dbus { send_msg } [ ]"
rlPhaseEnd
reply other threads:[~2026-09-11 13:21 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=178913286143.1.2582454921278281641.tests-selinux-8698c26ae9aa@fedoraproject.org \
--to=mmalik@redhat.com \
--cc=git-commits@fedoraproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox