[tests/selinux] pr775-checkpolicy-revdeps: improve other tests which fail on CentOS-stream-10

public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed

From: Milos Malik <mmalik@redhat.com>
To: git-commits@fedoraproject.org
Subject: [tests/selinux] pr775-checkpolicy-revdeps: improve other tests which fail on CentOS-stream-10
Date: Fri, 11 Sep 2026 13:21:34 GMT	[thread overview]
Message-ID: <178913289414.1.6083068681790289997.tests-selinux-cc86664885b2@fedoraproject.org> (raw)

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : cc86664885b24eff4e7c4847b8237c02b206a2d1
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2024-04-15T16:09:41+02:00
            Stats  : +30/-8 in 13 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/cc86664885b24eff4e7c4847b8237c02b206a2d1?branch=pr775-checkpolicy-revdeps

            Log:
            improve other tests which fail on CentOS-stream-10

Some components/packages are not available on CentOS-stream-10,
which leads to conclusion not to run the affected tests/phases there.

The /var and /run directories very often contain mislabeled files
and directories. In order to find discrepancies between file context
patterns and type_transition rules defined in the SELinux policy,
the restorecon command is needed.

---
diff --git a/policycoreutils/file-contexts/runtest.sh b/policycoreutils/file-contexts/runtest.sh
index 3375f00..b736e5a 100755
--- a/policycoreutils/file-contexts/runtest.sh
+++ b/policycoreutils/file-contexts/runtest.sh
@@ -54,7 +54,11 @@ rlJournalStart
         rlAssertGrep "/run/\.\* *all files *$RUN_CON" stdout
         rlAssertGrep "/run *directory *$RUN_CON" stdout
         rlAssertGrep "/home/\[\^/\]+/bin(/\.\*)? *all files *$HOME_BIN_CON" stdout
-        rlAssertGrep "/run = /var/run" stdout
+        if rlIsFedora '>= 40' || rlIsCentOS '>= 10' || rlIsRHEL '>= 10' ; then
+            rlAssertGrep "/var/run = /run" stdout
+        else
+            rlAssertGrep "/run = /var/run" stdout
+        fi
     rlPhaseEnd
 
     rlPhaseStartTest "semanage fcontext add and delete"

diff --git a/selinux-policy/ModemManager-and-similar/runtest.sh b/selinux-policy/ModemManager-and-similar/runtest.sh
index bba63cb..63470fb 100755
--- a/selinux-policy/ModemManager-and-similar/runtest.sh
+++ b/selinux-policy/ModemManager-and-similar/runtest.sh
@@ -115,6 +115,7 @@ rlJournalStart
         sleep 1
         rlRun "service systemd-logind restart"
         sleep 1
+        rlRun "restorecon -Rv /var /run -e /var/ARTIFACTS" 0-255
         rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1
     rlPhaseEnd
     fi

diff --git a/selinux-policy/blueman-and-similar/runtest.sh b/selinux-policy/blueman-and-similar/runtest.sh
index 7c0c15c..a0b6ec8 100755
--- a/selinux-policy/blueman-and-similar/runtest.sh
+++ b/selinux-policy/blueman-and-similar/runtest.sh
@@ -107,6 +107,7 @@ rlJournalStart
         rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1
         PYTHON_VERSION=`python --version | tr -d ' ' | cut -d . -f 1,2 | tr '[:upper:]' '[:lower:]'`
         rlRun "mkdir -p ~/.local/lib/${PYTHON_VERSION}/site-packages/"
+        rlRun "restorecon -Rv /var /run -e /var/ARTIFACTS" 0-255
         rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1
     rlPhaseEnd
 

diff --git a/selinux-policy/bootupd-and-similar/runtest.sh b/selinux-policy/bootupd-and-similar/runtest.sh
index 3fdddda..06a8156 100755
--- a/selinux-policy/bootupd-and-similar/runtest.sh
+++ b/selinux-policy/bootupd-and-similar/runtest.sh
@@ -34,7 +34,7 @@ FILE_PATH="/usr/libexec/bootupd"
 SERVICE_PACKAGE="bootupd"
 SERVICE_NAME="bootupd"
 PROCESS_NAME="bootupd"
-if rlIsFedora ; then
+if rlIsFedora || rlIsRHEL '>= 10' || rlIsCentOS '>= 10' ; then
     FILE_CONTEXT="bootupd_exec_t"
     PROCESS_CONTEXT="bootupd_t"
 else

diff --git a/selinux-policy/bz733494-amanda-and-similar/runtest.sh b/selinux-policy/bz733494-amanda-and-similar/runtest.sh
index bb1aec9..8360689 100755
--- a/selinux-policy/bz733494-amanda-and-similar/runtest.sh
+++ b/selinux-policy/bz733494-amanda-and-similar/runtest.sh
@@ -195,7 +195,9 @@ rlJournalStart
         fi
         rlRun "systemctl enable amanda-udp.socket"
         rlRun "systemctl start amanda-udp.socket"
-        rlSEService ${ROOT_PASSWORD} amanda-udp amandad amanda_t "start status restart status stop status" 1
+        rlSEService ${ROOT_PASSWORD} amanda-udp amandad amanda_t "start status" 1
+        rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255
+        rlSEService ${ROOT_PASSWORD} amanda-udp amandad amanda_t "restart status stop status" 1
         rlRun "systemctl stop amanda-udp.socket"
         rlRun "systemctl disable amanda-udp.socket"
     rlPhaseEnd

diff --git a/selinux-policy/cockpit-ws-and-similar/runtest.sh b/selinux-policy/cockpit-ws-and-similar/runtest.sh
index 0dbc556..9ee500c 100755
--- a/selinux-policy/cockpit-ws-and-similar/runtest.sh
+++ b/selinux-policy/cockpit-ws-and-similar/runtest.sh
@@ -152,7 +152,9 @@ rlJournalStart
                 PROCESS_CONTEXT="unconfined_service_t"
             fi
         fi
-        rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status restart status stop status" 1
+        rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1
+        rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255
+        rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1
     rlPhaseEnd
 
     rlPhaseStartTest "bz#1402316 + bz#1402495"

diff --git a/selinux-policy/firewalld-and-similar/runtest.sh b/selinux-policy/firewalld-and-similar/runtest.sh
index f0beb41..a4c117c 100755
--- a/selinux-policy/firewalld-and-similar/runtest.sh
+++ b/selinux-policy/firewalld-and-similar/runtest.sh
@@ -205,7 +205,9 @@ rlJournalStart
                 PROCESS_CONTEXT="unconfined_service_t"
             fi
         fi
-        rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status restart status stop status" 1
+        rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1
+        rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255
+        rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1
         rlRun "rm -f /etc/firewalld/lockdown-whitelist.xml*"
         rlRun "ls -dZ /run/firewalld | grep :firewalld_var_run_t"
         if rlIsRHEL 7 ; then

diff --git a/selinux-policy/icecast-and-similar/runtest.sh b/selinux-policy/icecast-and-similar/runtest.sh
index 04a6bb3..bbfa4d4 100755
--- a/selinux-policy/icecast-and-similar/runtest.sh
+++ b/selinux-policy/icecast-and-similar/runtest.sh
@@ -115,6 +115,7 @@ rlJournalStart
         rlRun "grep logsize /etc/icecast.xml"
         rlRun "sed -i 's|^.*\(<logarchive.*logarchive>\).*$|\1|' /etc/icecast.xml"
         rlRun "grep logarchive /etc/icecast.xml"
+        rlRun "restorecon -Rv /var /run -e /var/ARTIFACTS" 0-255
         rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1
         if rlIsRHEL 5 6 ; then
             rlRun "setsebool icecast_connect_any off"

diff --git a/selinux-policy/kerberos-and-similar/runtest.sh b/selinux-policy/kerberos-and-similar/runtest.sh
index 6f5139e..5ba7389 100755
--- a/selinux-policy/kerberos-and-similar/runtest.sh
+++ b/selinux-policy/kerberos-and-similar/runtest.sh
@@ -202,7 +202,9 @@ rlJournalStart
         rlRun "rm -f /etc/krb5.conf"
         rlRun "cp ./krb5.conf /etc"
         rlRun "restorecon -v /etc/krb5.conf"
-        rlSEService ${ROOT_PASSWORD} kprop kpropd kpropd_t "start status restart status stop status" 1
+        rlSEService ${ROOT_PASSWORD} kprop kpropd kpropd_t "start status" 1
+        rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255
+        rlSEService ${ROOT_PASSWORD} kprop kpropd kpropd_t "restart status stop status" 1
     rlPhaseEnd
 
     rlPhaseStartCleanup

diff --git a/selinux-policy/sudo-and-dnf/Makefile b/selinux-policy/sudo-and-dnf/Makefile
index d1cc3ca..8fd75e9 100644
--- a/selinux-policy/sudo-and-dnf/Makefile
+++ b/selinux-policy/sudo-and-dnf/Makefile
@@ -54,7 +54,7 @@ $(METADATA): Makefile
 	@echo "Type:            Regression" >> $(METADATA)
 	@echo "TestTime:        10m" >> $(METADATA)
 	@echo "RunFor:          selinux-policy" >> $(METADATA)
-	@echo "Requires:        audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console expect openssh-clients shadow-utils sudo dnf" >> $(METADATA)
+	@echo "Requires:        audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console expect openssh-clients shadow-utils sudo dnf /usr/sbin/service" >> $(METADATA)
 	@echo "RhtsRequires:    library(selinux-policy/common)" >> $(METADATA)
 	@echo "Environment:     AVC_ERROR=+no_avc_check" >> $(METADATA)
 	@echo "Priority:        Normal" >> $(METADATA)

diff --git a/selinux-policy/sudo-and-dnf/main.fmf b/selinux-policy/sudo-and-dnf/main.fmf
index c46b178..f1591fb 100644
--- a/selinux-policy/sudo-and-dnf/main.fmf
+++ b/selinux-policy/sudo-and-dnf/main.fmf
@@ -22,6 +22,7 @@ recommend:
   - shadow-utils
   - sudo
   - dnf
+  - /usr/sbin/service
 environment:
     AVC_ERROR: +no_avc_check
 duration: 10m

diff --git a/selinux-policy/systemd-generators/main.fmf b/selinux-policy/systemd-generators/main.fmf
index 6bb603a..9374c7f 100644
--- a/selinux-policy/systemd-generators/main.fmf
+++ b/selinux-policy/systemd-generators/main.fmf
@@ -10,8 +10,11 @@ test: ./runtest.sh
 framework: beakerlib
 require:
   - library(selinux-policy/common)
-  - selinux-policy
 recommend:
+  - audit
+  - libselinux-utils
+  - policycoreutils
+  - selinux-policy
   - selinux-policy-targeted
 environment:
     AVC_ERROR: +no_avc_check

diff --git a/selinux-policy/systemd-generators/runtest.sh b/selinux-policy/systemd-generators/runtest.sh
index 3da5533..f6f6c25 100755
--- a/selinux-policy/systemd-generators/runtest.sh
+++ b/selinux-policy/systemd-generators/runtest.sh
@@ -84,6 +84,7 @@ rlJournalStart
     echo "${SD_SYSTEM_GENERATORS_NOTCONFINED}"
     rlPhaseEnd
 
+    if [ -f /usr/lib/systemd/system/systemd-networkd.service ] ; then
 
     ### network-generator actually is a service, not a generator
     # systemd-network-generator.service is a system service that translates ip= and the
@@ -107,6 +108,8 @@ rlJournalStart
 	rlRun "diff /run/systemd/network/71-default.network 71-default-off.network"
     rlPhaseEnd
 
+    fi
+
     ### fstab-generator
     # systemd-fstab-generator is a generator that translates /etc/fstab (see fstab(5)
     # for details) into native systemd units early at boot and when configuration of

                 reply	other threads:[~2026-09-11 13:21 UTC|newest]

Thread overview: [no followups] expand[flat|nested]  mbox.gz  Atom feed

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=178913289414.1.6083068681790289997.tests-selinux-cc86664885b2@fedoraproject.org \
    --to=mmalik@redhat.com \
    --cc=git-commits@fedoraproject.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Be sure your reply has a Subject: header at the top and a blank line before the message body.

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox