public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
From: Milos Malik <mmalik@redhat.com>
To: git-commits@fedoraproject.org
Subject: [tests/selinux] pr775-checkpolicy-revdeps: add the chronyd test to upstream repo
Date: Fri, 11 Sep 2026 13:21:20 GMT [thread overview]
Message-ID: <178913288024.1.11188099810644121566.tests-selinux-53adb4565103@fedoraproject.org> (raw)
A new commit has been pushed.
Repo : tests/selinux
Branch : pr775-checkpolicy-revdeps
Commit : 53adb4565103910ba433111fddcb2435eaabfa12
Author : Milos Malik <mmalik@redhat.com>
Date : 2024-02-06T13:39:21+00:00
Stats : +706/-0 in 5 file(s)
URL : https://src.fedoraproject.org/tests/selinux/c/53adb4565103910ba433111fddcb2435eaabfa12?branch=pr775-checkpolicy-revdeps
Log:
add the chronyd test to upstream repo
The chrony component is frequently used by various users on Fedora
and RHEL, so it makes sense to run this TC in upstream testing too.
There are no changes in the TC functionality.
Moving the downstream TC to upstream repo.
The TC covers RHEL-18219.
---
diff --git a/selinux-policy/chronyd-and-similar/Makefile b/selinux-policy/chronyd-and-similar/Makefile
new file mode 100644
index 0000000..63baa53
--- /dev/null
+++ b/selinux-policy/chronyd-and-similar/Makefile
@@ -0,0 +1,110 @@
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+# Makefile of /CoreOS/selinux-policy/Regression/chronyd-and-similar
+# Description: SELinux interferes with chronyd and related programs
+# Author: Milos Malik <mmalik@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+# Copyright (c) 2012 Red Hat, Inc. All rights reserved.
+#
+# This copyrighted material is made available to anyone wishing
+# to use, modify, copy, or redistribute it subject to the terms
+# and conditions of the GNU General Public License version 2.
+#
+# This program is distributed in the hope that it will be
+# useful, but WITHOUT ANY WARRANTY; without even the implied
+# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+# PURPOSE. See the GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public
+# License along with this program; if not, write to the Free
+# Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+# Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+export TEST=/CoreOS/selinux-policy/Regression/chronyd-and-similar
+export TESTVERSION=1.0
+
+BUILT_FILES=
+
+FILES=$(METADATA) runtest.sh Makefile PURPOSE chrony-nts-test.sh
+
+.PHONY: all install download clean
+
+run: $(FILES) build
+ ./runtest.sh
+
+build: $(BUILT_FILES)
+ chmod a+x runtest.sh chrony-nts-test.sh
+ chcon -t bin_t runtest.sh chrony-nts-test.sh
+
+clean:
+ rm -f *~ $(BUILT_FILES)
+
+include /usr/share/rhts/lib/rhts-make.include
+
+$(METADATA): Makefile
+ @echo "Owner: Milos Malik <mmalik@redhat.com>" > $(METADATA)
+ @echo "Name: $(TEST)" >> $(METADATA)
+ @echo "TestVersion: $(TESTVERSION)" >> $(METADATA)
+ @echo "Path: $(TEST_DIR)" >> $(METADATA)
+ @echo "Description: SELinux interferes with chronyd and related programs" >> $(METADATA)
+ @echo "Type: Regression" >> $(METADATA)
+ @echo "TestTime: 1h" >> $(METADATA)
+ @echo "RunFor: selinux-policy" >> $(METADATA)
+ @echo "RunFor: chrony" >> $(METADATA)
+ @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy-mls selinux-policy-targeted setools-console chrony ksh nscd /usr/bin/certtool /usr/sbin/service socat" >> $(METADATA) # EPEL
+ @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA)
+ @echo "Priority: Normal" >> $(METADATA)
+ @echo "License: GPLv2" >> $(METADATA)
+ @echo "Confidential: no" >> $(METADATA)
+ @echo "Destructive: no" >> $(METADATA)
+ @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA)
+ @echo "Releases: -RHEL4" >> $(METADATA)
+ @echo "Architectures: i386 ppc64 x86_64" >> $(METADATA)
+ @echo "Bug: 974992" >> $(METADATA) # RHEL-7
+ @echo "Bug: 978993" >> $(METADATA) # RHEL-6
+ @echo "Bug: 1243764" >> $(METADATA) # RHEL-7
+ @echo "Bug: 1243987" >> $(METADATA) # RHEL-7
+ @echo "Bug: 1273116" >> $(METADATA) # RHEL-7
+ @echo "Bug: 1281473" >> $(METADATA) # RHEL-6
+ @echo "Bug: 1290310" >> $(METADATA) # RHEL-6
+ @echo "Bug: 1350765" >> $(METADATA) # RHEL-7
+ @echo "Bug: 1390657" >> $(METADATA) # RHEL-6
+ @echo "Bug: 1416015" >> $(METADATA) # RHEL-7
+ @echo "Bug: 1421248" >> $(METADATA) # RHEL-7
+ @echo "Bug: 1425408" >> $(METADATA) # RHEL-7
+ @echo "Bug: 1440791" >> $(METADATA) # RHEL-7
+ @echo "Bug: 1470150" >> $(METADATA) # RHEL-7
+ @echo "Bug: 1508486" >> $(METADATA) # RHEL-7
+ @echo "Bug: 1509379" >> $(METADATA) # RHEL-7
+ @echo "Bug: 1509927" >> $(METADATA) # RHEL-7
+ @echo "Bug: 1530525" >> $(METADATA) # RHEL-7
+ @echo "Bug: 1567753" >> $(METADATA) # RHEL-7
+ @echo "Bug: 1568281" >> $(METADATA) # RHEL-7
+ @echo "Bug: 1574418" >> $(METADATA) # RHEL-7
+ @echo "Bug: 1575002" >> $(METADATA) # RHEL-7
+ @echo "Bug: 1577057" >> $(METADATA) # RHEL-7
+ @echo "Bug: 1593267" >> $(METADATA) # RHEL-7
+ @echo "Bug: 1593607" >> $(METADATA) # RHEL-8
+ @echo "Bug: 1596563" >> $(METADATA) # RHEL-7
+ @echo "Bug: 1618757" >> $(METADATA) # RHEL-7
+ @echo "Bug: 1622499" >> $(METADATA) # RHEL-8
+ @echo "Bug: 1652079" >> $(METADATA) # RHEL-7
+ @echo "Bug: 1696252" >> $(METADATA) # RHEL-8
+ @echo "Bug: 1772852" >> $(METADATA) # RHEL-8
+ @echo "Bug: 1895825" >> $(METADATA) # RHEL-9
+ @echo "Bug: 1900143" >> $(METADATA) # Fedora 34
+ @echo "Bug: 1961207" >> $(METADATA) # RHEL-8
+ @echo "Bug: 2008894" >> $(METADATA) # Fedora 35
+ @echo "Bug: 2065313" >> $(METADATA) # RHEL-8
+ @echo "Bug: 2118628" >> $(METADATA) # RHEL-8
+ @echo "Bug: 2118631" >> $(METADATA) # RHEL-9
+ @echo "Bug: 2173604" >> $(METADATA) # RHEL-9
+ @echo "Bug: 2169949" >> $(METADATA) # Fedora-38
+ @echo "Bug: RHEL-18219" >> $(METADATA) # RHEL-9
+
+ rhts-lint $(METADATA)
+
diff --git a/selinux-policy/chronyd-and-similar/PURPOSE b/selinux-policy/chronyd-and-similar/PURPOSE
new file mode 100644
index 0000000..b67781b
--- /dev/null
+++ b/selinux-policy/chronyd-and-similar/PURPOSE
@@ -0,0 +1,5 @@
+PURPOSE of /CoreOS/selinux-policy/Regression/chronyd-and-similar
+Author: Milos Malik <mmalik@redhat.com>
+
+SELinux interferes with chronyc, chronyd and related programs.
+
diff --git a/selinux-policy/chronyd-and-similar/chrony-nts-test.sh b/selinux-policy/chronyd-and-similar/chrony-nts-test.sh
new file mode 100755
index 0000000..4771d70
--- /dev/null
+++ b/selinux-policy/chronyd-and-similar/chrony-nts-test.sh
@@ -0,0 +1,41 @@
+#!/bin/bash
+
+set -e
+
+server_name=chrony-nts-test
+cert=/etc/pki/tls/certs/nts.crt
+key=/etc/pki/tls/private/nts.key
+
+sed -i "/ $server_name\$/d" /etc/hosts
+echo "127.0.0.1 $server_name" >> /etc/hosts
+
+cat > cert.cfg <<EOF
+cn = "$server_name"
+serial = 001
+activation_date = "2020-01-01 00:00:00 UTC"
+expiration_date = "2030-01-01 00:00:00 UTC"
+signing_key
+encryption_key
+EOF
+
+certtool --generate-privkey --key-type=ed25519 --outfile $key
+certtool --generate-self-signed --load-privkey $key --template cert.cfg --outfile $cert
+chmod 640 $cert $key
+chown root:chrony $cert $key
+
+cat > /etc/chrony.conf <<EOF
+server chrony-nts-test iburst nts
+server time.cloudflare.com iburst nts
+ntsserverkey $key
+ntsservercert $cert
+ntstrustedcerts $cert
+ntsdumpdir /var/lib/chrony
+local
+allow
+EOF
+
+systemctl restart chronyd
+
+sleep 3
+
+chronyc -N authdata
\ No newline at end of file
diff --git a/selinux-policy/chronyd-and-similar/main.fmf b/selinux-policy/chronyd-and-similar/main.fmf
new file mode 100644
index 0000000..24be338
--- /dev/null
+++ b/selinux-policy/chronyd-and-similar/main.fmf
@@ -0,0 +1,96 @@
+summary: SELinux interferes with chronyd and related programs
+description: |+
+ SELinux interferes with chronyc, chronyd and related programs.
+
+contact: Milos Malik <mmalik@redhat.com>
+component:
+ - chrony
+ - selinux-policy
+test: ./runtest.sh
+framework: beakerlib
+require:
+ - library(selinux-policy/common)
+recommend:
+ - audit
+ - libselinux
+ - libselinux-utils
+ - policycoreutils
+ - selinux-policy-mls
+ - selinux-policy-targeted
+ - setools-console
+ - chrony
+ - ksh
+ - nscd
+ - /usr/bin/certtool
+ - /usr/sbin/service
+ - socat
+environment:
+ AVC_ERROR: +no_avc_check
+duration: 1h
+enabled: true
+tag:
+ - NoRHEL4
+ - TIP_fedora_fail
+ - TIPfail_Security
+ - TIPfail_fedora
+ - TIPfail_infra
+ - TIPpass
+ - Tier3
+ - Tier3se
+ - TipWaived6
+ - f33friendly
+ - targeted
+tier: '3'
+link:
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=974992
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=978993
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1243764
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1243987
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1273116
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1281473
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1290310
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1350765
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1390657
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1416015
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1421248
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1425408
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1440791
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1470150
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1508486
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1509379
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1509927
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1530525
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1567753
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1568281
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1574418
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1575002
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1577057
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1593267
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1593607
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1596563
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1618757
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1622499
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1652079
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1696252
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1772852
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1895825
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1900143
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1961207
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2008894
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2065313
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1949493
+ - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2118628
+ - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2118631
+ - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2173604
+ - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2169949
+ - verifies: https://issues.redhat.com/browse/RHEL-18219
+adjust:
+ - enabled: false
+ when: distro == rhel-4
+ continue: false
+ - enabled: false
+ when: arch == ia64, ppc, s390
+ continue: false
+extra-nitrate: TC#0202180
+extra-summary: /CoreOS/selinux-policy/Regression/chronyd-and-similar
+extra-task: /CoreOS/selinux-policy/Regression/chronyd-and-similar
diff --git a/selinux-policy/chronyd-and-similar/runtest.sh b/selinux-policy/chronyd-and-similar/runtest.sh
new file mode 100755
index 0000000..d469f05
--- /dev/null
+++ b/selinux-policy/chronyd-and-similar/runtest.sh
@@ -0,0 +1,454 @@
+#!/bin/bash
+# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+# runtest.sh of /CoreOS/selinux-policy/Regression/chronyd-and-similar
+# Description: SELinux interferes with chronyd and related programs
+# Author: Milos Malik <mmalik@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+# Copyright (c) 2012 Red Hat, Inc. All rights reserved.
+#
+# This copyrighted material is made available to anyone wishing
+# to use, modify, copy, or redistribute it subject to the terms
+# and conditions of the GNU General Public License version 2.
+#
+# This program is distributed in the hope that it will be
+# useful, but WITHOUT ANY WARRANTY; without even the implied
+# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+# PURPOSE. See the GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public
+# License along with this program; if not, write to the Free
+# Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+# Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include Beaker environment
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGE="selinux-policy"
+ROOT_PASSWORD="redhat"
+SERVICE_PACKAGE="chrony"
+SERVICE_NAME="chronyd"
+PROCESS_NAME="chronyd"
+PROCESS_CONTEXT="chronyd_t"
+CHRONYD_RESTRICTED_SERVICE="chronyd-restricted"
+CHRONYD_RESTRICTED_UNIT_FILE="/usr/lib/systemd/system/chronyd-restricted.service"
+CHRONYD_RESTRICTED_UNIT_DROPIN_DIR="/etc/systemd/system/chronyd-restricted.service.d"
+CHRONYD_RESTRICTED_UNIT_DROPIN_FILE="${CHRONYD_RESTRICTED_UNIT_DROPIN_DIR}/context.conf"
+
+rlJournalStart
+ rlPhaseStartSetup
+ rlRun "rlImport 'selinux-policy/common'"
+ rlSESatisfyRequires
+ rlAssertRpm ${PACKAGE}
+ rlAssertRpm ${PACKAGE}-targeted
+ rlAssertRpm ${SERVICE_PACKAGE}
+
+ rlServiceStop `rlSEListServices 123`
+ rlFileBackup /etc/chrony.conf
+ rlFileBackup /etc/shadow
+ rlFileBackup /etc/chrony.keys
+
+ rlRun "find /var /run -type f -name '*lease*'"
+ rlRun "find /var /run -type f -name '*lease*' | xargs cat"
+ rlSESetEnforce
+ rlSEStatus
+ rlSESetTimestamp
+ sleep 2
+ rlPhaseEnd
+
+ if ! rlIsRHEL 5 ; then
+ rlPhaseStartTest "bz#974992 + bz#978993"
+ rlSEMatchPathCon "/usr/sbin/chronyd" "chronyd_exec_t"
+ rlSESearchRule "allow chronyd_t chronyd_t : capability { sys_nice } [ ]"
+ rlSESearchRule "allow chronyd_t chronyd_t : process { setsched } [ ]"
+ rlPhaseEnd
+ fi
+
+ if ! rlIsRHEL 5 6 ; then
+ rlPhaseStartTest "bz#1243764 + bz#1243987"
+ rlSEMatchPathCon "/usr/libexec/chrony-helper" "chronyd_exec_t"
+ rlSEMatchPathCon "/var/run/chrony-helper" "chronyd_var_run_t"
+ rlSEMatchPathCon "/var/run/chrony-helper/added_servers" "chronyd_var_run_t"
+ rlSEMatchPathCon "/var/run/chrony-helper/lock" "chronyd_var_run_t"
+ rlSEMatchPathCon "/var/lib/dhclient" "dhcpc_state_t"
+ rlSEMatchPathCon "/var/lib/dhclient/chrony.servers.eth0" "dhcpc_state_t"
+ rlSEMatchPathCon "/usr/bin/systemctl" "systemd_systemctl_exec_t"
+ rlSESearchRule "allow dhcpc_t chronyd_exec_t : file { getattr open read execute }"
+ rlSESearchRule "type_transition dhcpc_t chronyd_exec_t : process chronyd_t"
+ rlSESearchRule "allow dhcpc_t chronyd_t : process { transition }"
+ rlSESearchRule "allow chronyd_t var_run_t : dir { read write add_name remove_name search open getattr }"
+ rlSESearchRule "type_transition chronyd_t var_run_t : dir chronyd_var_run_t"
+ rlSESearchRule "allow chronyd_t chronyd_var_run_t : dir { read write add_name remove_name search open getattr }"
+ rlSESearchRule "allow chronyd_t chronyd_var_run_t : file { getattr open read write create unlink }"
+ rlSESearchRule "allow chronyd_t dhcpc_state_t : dir { getattr open read search }"
+ rlSESearchRule "allow chronyd_t dhcpc_state_t : file { getattr open read }"
+ rlSESearchRule "allow chronyd_t bin_t : file { getattr open read execute_no_trans }"
+ rlSESearchRule "allow chronyd_t systemd_systemctl_exec_t : file { getattr open read execute_no_trans }"
+ rlSESearchRule "allow timemaster_t chronyd_t : process { signal }"
+ rlPhaseEnd
+
+ rlPhaseStartTest "bz#1350765"
+ rlSESearchRule "allow chronyd_t chronyd_t : capability2 { block_suspend } [ ]"
+ rlSESearchRule "allow chronyd_t kernel_t : system { module_request } [ ]"
+ rlPhaseEnd
+
+ rlPhaseStartTest "bz#1416015 + bz#1421248 + bz#1425408 + bz#1440791"
+ rlSEMatchPathCon "/usr/sbin/chronyd" "chronyd_exec_t"
+ rlSEMatchPathCon "/etc/adjtime" "adjtime_t"
+ rlSEMatchPathCon "/var/run/chrony" "chronyd_var_run_t"
+ rlSEMatchPathCon "/var/run/chrony/chronyd.sock" "chronyd_var_run_t"
+ rlSEMatchPathCon "/var/run/chrony/chronyc.1117.sock" "chronyd_var_run_t"
+ rlSESearchRule "allow chronyd_t adjtime_t : file { getattr open read }"
+ rlSESearchRule "allow chronyd_t chronyd_t : capability { chown }"
+ rlSESearchRule "allow chronyd_t chronyd_t : unix_dgram_socket { sendto }"
+ rlSESearchRule "allow chronyd_t chronyd_t : capability { net_admin }"
+ rlPhaseEnd
+
+ rlPhaseStartTest "bz#1508486"
+ rlSEMatchPathCon "/usr/libexec/chrony-helper" "chronyd_exec_t"
+ rlSEMatchPathCon "/usr/bin/chronyc" "chronyc_exec_t"
+ rlSESearchRule "allow chronyd_t chronyc_exec_t : file { getattr open read execute_no_trans }"
+ rlSESearchRule "allow chronyd_t chronyc_t : process { transition }" 1
+ rlPhaseEnd
+
+ rlPhaseStartTest "bz#1509379"
+ rlSEMatchPathCon "/usr/bin/chronyc" "chronyc_exec_t"
+ rlSESearchRule "allow chronyc_t chronyc_t : capability { dac_read_search } [ ]"
+ rlSESearchRule "type_transition chronyd_t chronyc_exec_t : process chronyc_t" 1
+ rlSESearchRule "allow chronyd_t chronyd_t : capability { dac_read_search } [ ]"
+ rlPhaseEnd
+
+ rlPhaseStartTest "bz#1530525"
+ rlSEMatchPathCon "/usr/bin/chronyc" "chronyc_exec_t"
+ rlSEMatchPathCon "/etc" "etc_t"
+ rlSEMatchPathCon "/etc/chrony.keys" "chronyd_keys_t"
+# rlSESearchRule "allow chronyc_t etc_t : dir { write add_name }"
+# rlSESearchRule "type_transition chronyc_t etc_t : file chronyd_keys_t"
+ rlSESearchRule "allow chronyc_t chronyd_keys_t : file { getattr ioctl append write } [ ]"
+ rlPhaseEnd
+
+ rlPhaseStartTest "bz#1470150"
+ rlSEMatchPathCon "/var/run/chrony" "chronyd_var_run_t"
+ rlSEMatchPathCon "/var/run/chrony/chronyc.3781.sock" "chronyd_var_run_t"
+ rlSESearchRule "allow chronyd_t chronyc_t : unix_dgram_socket { sendto }"
+ rlSESearchRule "allow chronyc_t chronyd_t : unix_dgram_socket { sendto }"
+ rlSESearchRule "allow system_cronjob_t chronyc_exec_t : file { getattr open read execute } [ ]"
+ rlSESearchRule "type_transition system_cronjob_t chronyc_exec_t : process chronyc_t"
+ rlSESearchRule "allow system_cronjob_t chronyc_t : process { transition } [ ]"
+ rlSESearchRule "allow inetd_child_t chronyc_exec_t : file { getattr open read execute } [ ]"
+ rlSESearchRule "type_transition inetd_child_t chronyc_exec_t : process chronyc_t"
+ rlSESearchRule "allow inetd_child_t chronyc_t : process { transition } [ ]"
+ rlSESearchRule "allow chronyc_t chronyd_var_run_t : sock_file { create write unlink }"
+ rlPhaseEnd
+ fi
+
+ if false ; then
+ rlPhaseStartTest "bz#1273116" # CLOSED as NOT-A-BUG, unable to reproduce it anymore
+ rlSEMatchPathCon "/usr/lib/systemd/system/chronyd.service" "chronyd_unit_file_t"
+ rlSESearchRule "allow chronyd_t chronyd_unit_file_t : service { status }"
+ rlPhaseEnd
+ fi
+
+ if ! rlIsRHEL 5 ; then
+ rlPhaseStartTest "bz#1281473"
+ rlSEMatchPathCon "/usr/sbin/chronyd" "chronyd_exec_t"
+ rlSEMatchPathCon "/etc/chrony.keys" "chronyd_keys_t"
+ rlSEMatchPathCon "/var/run/timemaster/chrony.conf" "timemaster_var_run_t"
+ rlSESearchRule "allow chronyd_t chronyd_keys_t : file { append setattr }"
+ rlSESearchRule "allow chronyd_t timemaster_var_run_t : file { getattr open read }"
+ rlPhaseEnd
+
+ rlPhaseStartTest "bz#1290310"
+ rlSEMatchPathCon "/usr/sbin/chronyd" "chronyd_exec_t"
+ rlSEMatchPathCon "/var/run" "var_run_t"
+ rlSEMatchPathCon "/var/run/chronyd.sock" "chronyd_var_run_t"
+ rlSESearchRule "allow chronyd_t var_run_t : dir { getattr open search read write add_name remove_name }"
+ rlSESearchRule "type_transition chronyd_t var_run_t : sock_file chronyd_var_run_t"
+ rlSESearchRule "allow chronyd_t chronyd_var_run_t : sock_file { create }"
+ rlPhaseEnd
+
+ rlPhaseStartTest "bz#1390657"
+ rlSEMatchPathCon "/etc/chrony.keys" "chronyd_keys_t"
+ rlSESearchRule "allow logrotate_t chronyd_keys_t : file { getattr open read }"
+ rlPhaseEnd
+ fi
+
+ if ! rlIsRHEL 5 6 ; then
+ rlPhaseStartTest "bz#1509927"
+ rlSEMatchPathCon "/usr/bin/chronyc" "chronyc_exec_t"
+ rlSESearchRule "allow chronyc_t user_devpts_t : chr_file { read write getattr append open } [ ]"
+ rlPhaseEnd
+
+ rlPhaseStartTest "bz#1574418"
+ rlSEMatchPathCon "/usr/bin/chronyc" "chronyc_exec_t"
+ rlSEMatchPathCon "/tmp" "tmp_t"
+ rlSEMatchPathCon "/var/lib" "var_lib_t"
+ rlSEMatchPathCon "/var/lib/check_mk_agent" "var_lib_t"
+ rlSEMatchPathCon "/var/lib/check_mk_agent/cache" "var_lib_t"
+ rlSEMatchPathCon "/var/lib/check_mk_agent/cache/chrony.cache.new" "var_lib_t"
+ rlSEMatchPathCon "/var/log" "var_log_t"
+ rlSESearchRule "allow chronyc_t tmp_t : dir { write add_name } [ ]"
+ rlSESearchRule "type_transition chronyc_t tmp_t : file chronyd_tmp_t"
+ rlSESearchRule "allow chronyc_t chronyd_tmp_t : file { create getattr open write } [ ]"
+ rlSESearchRule "allow chronyc_t var_log_t : dir { write add_name } [ ]"
+ rlSESearchRule "type_transition chronyc_t var_log_t : file chronyd_var_log_t"
+ rlSESearchRule "allow chronyc_t chronyd_var_log_t : file { create getattr open write } [ ]"
+ rlSESearchRule "allow chronyc_t var_lib_t : dir { write add_name } [ ]"
+ rlSESearchRule "type_transition chronyc_t var_lib_t : file chronyd_var_lib_t"
+ rlSESearchRule "allow chronyc_t chronyd_var_lib_t : file { create getattr open write } [ ]"
+ rlPhaseEnd
+
+ rlPhaseStartTest "bz#1575002 + bz#1577057 + bz#1593267"
+ rlSEMatchPathCon "/dev/tty1" "tty_device_t"
+ rlSESearchRule "allow unconfined_t chronyc_exec_t : file { getattr open read execute }"
+ rlSESearchRule "allow unconfined_t chronyc_t : process { transition }"
+ rlSESearchRule "type_transition unconfined_t chronyc_exec_t : process chronyc_t"
+ rlSESearchRule "type_change unconfined_t tty_device_t : chr_file user_tty_device_t"
+ rlSESearchRule "allow chronyc_t user_tty_device_t : chr_file { read write } [ ]"
+ rlPhaseEnd
+
+ rlPhaseStartTest "bz#1596563"
+ rlSEMatchPathCon "/usr/bin/chronyc" "chronyc_exec_t"
+ rlSEMatchPathCon "/var/run/nscd/socket" "nscd_var_run_t"
+ rlSEMatchPathCon "/var/db/nscd/passwd" "nscd_var_run_t"
+ rlSESearchRule "allow chronyc_t nscd_t : unix_stream_socket { connectto }"
+ rlSESearchRule "allow system_dbusd_t nscd_var_run_t : file { map }"
+ rlSESearchRule "dontaudit chronyc_t nscd_var_run_t : file { getattr open read }"
+ rlSESearchRule "allow chronyd_t chronyd_tmpfs_t : file { map }"
+ rlSESearchRule "allow chronyd_t gpsd_tmpfs_t : file { map }"
+ rlSESearchRule "allow chronyc_t nscd_t : nscd { shmemhost gethost }"
+ rlPhaseEnd
+
+ rlPhaseStartTest "bz#1568281"
+ rlSEMatchPathCon "/usr/bin/chronyc" "chronyc_exec_t"
+ rlSEMatchPathCon "/run/chrony" "chronyd_var_run_t"
+ rlSESearchRule "allow logrotate_t chronyc_exec_t : file { getattr open read execute } [ ]"
+ rlSESearchRule "type_transition logrotate_t chronyc_exec_t : process chronyc_t"
+ rlSESearchRule "allow logrotate_t chronyc_t : process { transition } [ ]"
+ rlSESearchRule "allow chronyc_t chronyd_var_run_t : dir { write } [ ]"
+ rlPhaseEnd
+
+ rlPhaseStartTest "bz#1567753"
+ rlSEMatchPathCon "/usr/sbin/chronyd" "chronyd_exec_t"
+ rlSEMatchPathCon "/var/lib/libvirt/dnsmasq" "virt_var_lib_t"
+ rlSESearchRule "allow chronyd_t virt_var_lib_t : dir { getattr open search read } [ ]"
+ rlPhaseEnd
+
+ rlPhaseStartTest "bz#1618757 + bz#1622499"
+ rlSEMatchPathCon "/usr/bin/chronyc" "chronyc_exec_t"
+ rlSESearchRule "allow chronyc_t unconfined_t : unix_stream_socket { read write ioctl getattr } [ ]"
+ rlPhaseEnd
+ fi
+
+ if ! rlIsRHEL 5 6 7 ; then
+ # bz#1652079 was closed as WONTFIX
+ rlPhaseStartTest "bz#1652079 + bz#1696252"
+ rlSEMatchPathCon "/usr/bin/chronyc" "chronyc_exec_t"
+ rlSEMatchPathCon "/var/lib" "var_lib_t"
+ rlSEMatchPathCon "/var/lib/test" "var_lib_t"
+ rlSEMatchPathCon "/var/log" "var_log_t"
+ rlSEMatchPathCon "/var/log/test" "var_log_t"
+ rlSEMatchPathCon "/var/run" "var_run_t"
+ rlSEMatchPathCon "/var/run/test" "var_run_t"
+ rlSEMatchPathCon "/var/cache" "var_t"
+ rlSEMatchPathCon "/var/cache/test" "var_t"
+ rlSESearchRule "allow chronyc_t var_lib_t : dir { getattr open search write add_name } [ ]"
+ rlSESearchRule "allow chronyc_t var_lib_t : file { getattr ioctl write append } [ ]"
+ rlSESearchRule "allow chronyc_t var_log_t : dir { getattr open search write add_name } [ ]"
+ rlSESearchRule "allow chronyc_t var_log_t : file { getattr ioctl write append } [ ]"
+ rlSESearchRule "allow chronyc_t var_t : file { getattr ioctl write append } [ ]"
+ rlSESearchRule "allow chronyc_t var_run_t : file { getattr ioctl write append } [ ]"
+ rlPhaseEnd
+
+ rlPhaseStartTest "bz#1593607"
+ rlSEMatchPathCon "/usr/libexec/chrony-helper" "chronyd_exec_t"
+ rlSESearchRule "allow chronyd_t shell_exec_t : file { map } [ ] mls"
+ rlPhaseEnd
+
+ rlPhaseStartTest "bz#1772852"
+ rlSEMatchPathCon "/usr/bin/chronyc" "chronyc_exec_t"
+ rlSEMatchPathCon "/var/db/nscd/hosts" "nscd_var_run_t"
+ rlSESearchRule "allow chronyc_t nscd_var_run_t : file { map } [ ]"
+ rlPhaseEnd
+ fi
+
+ if ! rlIsRHEL 5 6 7 8 ; then
+ rlPhaseStartTest "bz#1895825"
+ rlSEMatchPathCon "/run/chrony-dhcp" "chronyd_var_run_t"
+ rlSEMatchPathCon "/run/chrony-dhcp/something.source" "chronyd_var_run_t"
+ rlPhaseEnd
+
+ rlPhaseStartTest "bz#1900143"
+ rlSEMatchPathCon "/run/systemd/resolve/io.systemd.Resolve" "systemd_resolved_var_run_t"
+ rlSESearchRule "allow chronyd_t systemd_resolved_var_run_t : sock_file { write } [ ]"
+ rlRun "grep resolve /etc/nsswitch.conf"
+ rlPhaseEnd
+
+ rlPhaseStartTest "bz#2173604"
+ rlSEMatchPathCon "/usr/bin/chronyc" "chronyc_exec_t"
+ rlRun "ls -dZ /proc/sys/net/ipv6/conf/all | grep :sysctl_net_t"
+ rlRun "ls -dZ /proc/sys/net/ipv6/conf/all/disable_ipv6 | grep :sysctl_net_t"
+ rlSESearchRule "allow chronyc_t sysctl_net_t : dir { search } [ ]"
+ rlSESearchRule "allow chronyc_t sysctl_net_t : file { getattr open read } [ ]"
+ rlPhaseEnd
+ fi
+
+ if ! rlIsRHEL 5 6 7 ; then
+ rlPhaseStartTest "bz#1961207"
+ rlSEMatchPortCon tcp 4460 ntske_port_t
+ rlSEMatchPathCon "/usr/share/pki/ca-trust-source/ca-bundle.trust.p11-ki" "cert_t"
+ rlSESearchRule "allow chronyd_t ntske_port_t : tcp_socket { name_bind name_connect } [ ]"
+ rlSESearchRule "allow chronyd_t chronyd_t : tcp_socket { listen accept }"
+ rlSESearchRule "allow chronyd_t cert_t : file { map } [ ]"
+ rlPhaseEnd
+ fi
+
+ if rlIsFedora ; then
+ rlPhaseStartTest "bz#2008894"
+ rlSEMatchPathCon "/usr/bin/chronyc" "chronyc_exec_t"
+ rlSESearchRule "allow init_t chronyc_t : process2 { nnp_transition } [ ]"
+ rlPhaseEnd
+
+ rlPhaseStartTest "real scenario -- chrony-wait service"
+ rlServiceStop chrony-wait
+ rlRun "mkdir -p /run/systemd/system/chrony-wait.service.d"
+ rlRun "echo -e '[Service]\nDynamicUser=yes' > /run/systemd/system/chrony-wait.service.d/override.conf"
+ rlRun "systemctl daemon-reload"
+ rlRun "systemctl start chrony-wait.service"
+ sleep 5
+ rlRun "systemctl stop chrony-wait.service"
+ rlRun "rm -f /run/systemd/system/chrony-wait.service.d/override.conf"
+ rlRun "systemctl daemon-reload"
+ rlServiceRestore chrony-wait
+ rlPhaseEnd
+ fi
+
+ rlPhaseStartTest "real scenario"
+ rlRun "echo \"sched_priority 50\" >> /etc/chrony.conf"
+ rlRun "echo \"refclock SHM 0\" >> /etc/chrony.conf"
+ rlRun "echo \"refclock SOCK /var/run/chronyd.sock\" >> /etc/chrony.conf"
+ rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root"
+ if ! rlSEDefined ${PROCESS_CONTEXT} ; then
+ if rlIsRHEL 5 6 ; then
+ PROCESS_CONTEXT="initrc_t"
+ else
+ PROCESS_CONTEXT="unconfined_service_t"
+ fi
+ fi
+ rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1
+ if ! rlIsFedora ; then
+ rlRun "ipcs -m | grep 0x4e545030"
+ rlRun "ls -Z /var/run/chronyd.sock | grep :chronyd_var_run_t"
+ fi
+ rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255
+ rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status" 1
+ rlRun "chronyc tracking"
+ for OUTPUT_FILE in /tmp/chronyc.output /var/lib/chrony/chronyc.output /var/log/chrony/chronyc.output ; do
+ rlRun "rm -f ${OUTPUT_FILE}"
+ rlRun "chronyc tracking > ${OUTPUT_FILE}"
+ rlRun "test -s ${OUTPUT_FILE}"
+ rlRun "ls -Z ${OUTPUT_FILE} | grep -e :user_tmp_t -e :chronyd_var_lib_t -e :chronyd_var_log_t"
+ done
+ if ! rlIsRHEL 7 ; then
+ for OUTPUT_FILE in /var/lib/test /var/log/test /var/run/test /var/cache/test ; do
+ rlRun "rm -f ${OUTPUT_FILE}"
+ rlRun "chronyc -n tracking > ${OUTPUT_FILE}"
+ rlRun "test -s ${OUTPUT_FILE}"
+ rlRun "chronyc -n tracking >> ${OUTPUT_FILE}"
+ rlRun "ls -Z ${OUTPUT_FILE}"
+ rlRun "ls -Z ${OUTPUT_FILE} | grep -e :var_lib_t -e :var_log_t -e :var_run_t -e :var_t"
+ rlRun "rm -f ${OUTPUT_FILE}"
+ done
+ fi
+ if rpm -q nscd >& /dev/null ; then
+ rlRun "service nscd start"
+ fi
+ sleep 2
+ rlRun "getsebool -a | grep nscd"
+ rlRun "chronyc sources"
+ rlRun "ksh -c \"chronyc sources\""
+ if ! rlIsRHEL 5 6 ; then
+ rlRun "chronyc serverstats"
+ fi
+ if rpm -q nscd >& /dev/null ; then
+ rlRun "service nscd stop"
+ fi
+ rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "stop status" 1
+ rlPhaseEnd
+
+ if ! rlIsRHEL 5 6 ; then
+ rlPhaseStartTest "real scenario -- bz#1530525"
+ rlRun "rm -f /etc/chrony.keys"
+ rlRun "touch /etc/chrony.keys"
+ rlRun "restorecon -v /etc/chrony.keys"
+ rlRun "chronyc keygen 1111 SHA1 > /etc/chrony.keys"
+ rlRun "chronyc keygen 1111 SHA1 >> /etc/chrony.keys"
+ rlRun "ls -Z /etc/chrony.keys | grep :chronyd_keys_t"
+ rlPhaseEnd
+ fi
+
+ if ! rlIsRHEL 5 6 7 ; then
+ rlPhaseStartTest "real scenario -- bz#1961207"
+ rlRun "./chrony-nts-test.sh"
+ rlRun "rm -f /var/lib/chrony/*.nts"
+ rlRun "systemctl restart chronyd"
+ rlPhaseEnd
+
+ rlPhaseStartTest "bz#2065313"
+ rlSESearchRule "allow chronyd_t unconfined_t : unix_dgram_socket { sendto }"
+ rlPhaseEnd
+
+ rlPhaseStartTest "real scenario -- bz#2065313"
+ rlRun 'printf "\x6\x1\x0\x0\x0\x21\x0\x0\x21\xd7\xe4\x22\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0\x0" | socat unix-sendto:/run/chrony/chronyd.sock,bind=/run/chrony/chronyc.sock,umask=0000 - | hexdump -C' 0 "special socat command talks to chronyd via its UNIX socket"
+ rlPhaseEnd
+
+ rlPhaseStartTest "bz#2118628 + bz#2118631"
+ rlSEMatchPortCon udp 319 ptp_event_port_t
+ rlSESearchRule "allow chronyd_t ptp_event_port_t : udp_socket { name_bind } [ ]"
+ rlPhaseEnd
+
+ rlPhaseStartTest "real scenario -- bz#2118628 + bz#2118631"
+ rlRun "echo -en '\nallow\nptpport 319\nserver 127.0.0.1 port 319 minpoll 0 maxpoll 0\n' >> /etc/chrony.conf"
+ rlRun "systemctl restart chronyd"
+ sleep 5
+ rlRun "chronyc ntpdata 127.0.0.1 | grep 'Total RX'"
+ rlPhaseEnd
+ fi
+
+ if [ -f ${CHRONYD_RESTRICTED_UNIT_FILE} ]; then
+ rlPhaseStartTest "chronyd-restricted -- bz#2169949 + RHEL-18219"
+ rlRun "systemctl stop ${SERVICE_NAME}"
+ rlRun "mkdir -p ${CHRONYD_RESTRICTED_UNIT_DROPIN_DIR}"
+ if ! grep ^SELinuxContext= ${CHRONYD_RESTRICTED_UNIT_FILE} ; then
+ # temporary configuration change until it becomes a part of the chrony package
+ rlRun "echo -e '[Service]\nSELinuxContext=system_u:system_r:chronyd_restricted_t:s0\n' > ${CHRONYD_RESTRICTED_UNIT_DROPIN_FILE}"
+ rlRun "systemctl daemon-reload"
+ fi
+ rlRun "systemctl start ${CHRONYD_RESTRICTED_SERVICE}"
+ sleep 3
+ rlRun "ps -o pid,uid,command,context -C chronyd | grep -1 system_u:system_r:chronyd_restricted_t:"
+ rlRun "systemctl status ${CHRONYD_RESTRICTED_SERVICE}"
+ rlRun "systemctl restart ${CHRONYD_RESTRICTED_SERVICE}"
+ rlRun "systemctl status ${CHRONYD_RESTRICTED_SERVICE}"
+ rlRun "systemctl stop ${CHRONYD_RESTRICTED_SERVICE}"
+ rlRun "rm -f ${CHRONYD_RESTRICTED_UNIT_DROPIN_FILE}"
+ rlRun "systemctl daemon-reload"
+ rlPhaseEnd
+ fi
+
+ rlPhaseStartCleanup
+ sleep 2
+ rlSECheckAVC
+
+ rlRun "rm -f /tmp/chronyc.output /var/lib/chrony/chronyc.output /var/log/chrony/chronyc.output"
+ rlFileRestore
+ rlServiceRestore `rlSEListServices 123`
+ rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd
+
reply other threads:[~2026-09-11 13:21 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=178913288024.1.11188099810644121566.tests-selinux-53adb4565103@fedoraproject.org \
--to=mmalik@redhat.com \
--cc=git-commits@fedoraproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox