[tests/selinux] pr775-checkpolicy-revdeps: make the upstream tests up-to-date

public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed

From: Milos Malik <mmalik@redhat.com>
To: git-commits@fedoraproject.org
Subject: [tests/selinux] pr775-checkpolicy-revdeps: make the upstream tests up-to-date
Date: Fri, 11 Sep 2026 13:21:37 GMT	[thread overview]
Message-ID: <178913289794.1.2745856811919530959.tests-selinux-4e1655b3f32e@fedoraproject.org> (raw)

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 4e1655b3f32ed6da47aad3074b2a119a4f2126d3
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2024-04-30T14:19:57+00:00
            Stats  : +135/-27 in 10 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/4e1655b3f32ed6da47aad3074b2a119a4f2126d3?branch=pr775-checkpolicy-revdeps

            Log:
            make the upstream tests up-to-date

Some upstream tests diverged from their downstream versions. Let's
synchronize them.

---
diff --git a/checkpolicy/checkmodule/Makefile b/checkpolicy/checkmodule/Makefile
index 4dca103..c0b1096 100644
--- a/checkpolicy/checkmodule/Makefile
+++ b/checkpolicy/checkmodule/Makefile
@@ -53,12 +53,17 @@ $(METADATA): Makefile
 	@echo "Type:            Sanity" >> $(METADATA)
 	@echo "TestTime:        10m" >> $(METADATA)
 	@echo "RunFor:          checkpolicy" >> $(METADATA)
-	@echo "Requires:        checkpolicy man grep mktemp policycoreutils policycoreutils-devel" >> $(METADATA)
+	@echo "Requires:        checkpolicy man grep policycoreutils policycoreutils-devel" >> $(METADATA)
 	@echo "Priority:        Normal" >> $(METADATA)
 	@echo "License:         GPLv2" >> $(METADATA)
 	@echo "Confidential:    no" >> $(METADATA)
 	@echo "Destructive:     no" >> $(METADATA)
 	@echo "Releases:        -RHEL4" >> $(METADATA)
+	@echo "Bug:             533796" >> $(METADATA) # RHEL-5
+	@echo "Bug:             588294" >> $(METADATA) # RHEL-6
+	@echo "Bug:             1064603" >> $(METADATA) # RHEL-7
+	@echo "Bug:             1329217" >> $(METADATA) # RHEL-7
+	@echo "Bug:             1392394" >> $(METADATA) # RHEL-6
 
 	rhts-lint $(METADATA)
 

diff --git a/checkpolicy/checkmodule/main.fmf b/checkpolicy/checkmodule/main.fmf
index c990752..8e5531a 100644
--- a/checkpolicy/checkmodule/main.fmf
+++ b/checkpolicy/checkmodule/main.fmf
@@ -5,11 +5,12 @@ description: |+
 contact: Milos Malik <mmalik@redhat.com>
 component:
   - checkpolicy
+test: ./runtest.sh
+framework: beakerlib
 recommend:
   - checkpolicy
   - man
   - grep
-  - mktemp
   - policycoreutils
   - policycoreutils-devel
 duration: 10m
@@ -17,7 +18,6 @@ enabled: true
 tag:
   - CI-Tier-1
   - NoRHEL4
-  - TIPpass_Security
   - Tier1
   - Tier1se
   - f31friendly
@@ -25,11 +25,11 @@ tag:
   - targeted
 tier: '1'
 link:
-  - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1329217
   - relates: https://bugzilla.redhat.com/show_bug.cgi?id=533796
   - relates: https://bugzilla.redhat.com/show_bug.cgi?id=588294
-  - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1392394
   - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1064603
+  - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1329217
+  - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1392394
 adjust:
   - enabled: false
     when: distro == rhel-4

diff --git a/checkpolicy/checkmodule/runtest.sh b/checkpolicy/checkmodule/runtest.sh
index 49dc17f..430d30d 100755
--- a/checkpolicy/checkmodule/runtest.sh
+++ b/checkpolicy/checkmodule/runtest.sh
@@ -40,7 +40,7 @@ rlJournalStart
         rlRun "rpm -ql ${PACKAGE} | grep /usr/share/man/.*checkmodule"
     rlPhaseEnd
 
-    rlPhaseStartTest
+    rlPhaseStartTest "bz#533796 + bz#588294"
         rlRun "checkmodule >& ${TEST_FILE}" 1
         rlAssertGrep "unable to open policy.conf" ${TEST_FILE}
         rlRun "checkmodule -b >& ${TEST_FILE}" 1
@@ -74,14 +74,14 @@ rlJournalStart
         rlRun "checkmodule --help 2>&1 | grep -- -U"
     rlPhaseEnd
 
-    rlPhaseStartTest
+    rlPhaseStartTest "bz#1064603 + bz#1392394"
         for POLICY_KIND in minimum mls targeted ; do
             rlRun "checkmodule -M -m -b -o testmod.mod /etc/selinux/${POLICY_KIND}/policy/policy.* >& ${TEST_FILE}" 1
             rlRun "grep -i \"checkmodule.*-b and -m are incompatible with each other\" ${TEST_FILE}"
         done
     rlPhaseEnd
 
-    rlPhaseStartTest
+    rlPhaseStartTest "bz#1329217"
         INPUT_FILE="mypolicy.te"
         OUTPUT_FILE="mypolicy.output"
         rlRun "ls -l ${INPUT_FILE}"
@@ -94,6 +94,24 @@ rlJournalStart
         fi
     rlPhaseEnd
 
+    if ! rlIsRHEL 5 6 ; then # semodule_unpackage is not available on RHEL-5 and RHEL-6
+    rlPhaseStartTest "handle unknown classes and perms"
+        rlRun "rm -f base.pp base.mod"
+        rlRun "semodule -E base"
+        rlRun "semodule_unpackage base.pp base.mod"
+        for ACTION in allow deny reject ; do
+            rlRun "checkmodule -b -o base.out -M -U ${ACTION} base.mod"
+            rlRun "echo -e 'u\nq\n' | sedismod base.out | grep -i \"${ACTION} unknown\""
+        done
+        rlRun "checkmodule -m -o mypolicy.out -M -U deny mypolicy.te"
+        rlRun "ls -l mypolicy.out"
+        for ACTION in allow reject ; do
+            rlRun "checkmodule -m -o mypolicy.out -M -U ${ACTION} mypolicy.te 2>&1 | grep -i 'only valid.*base module'"
+        done
+        rlRun "rm -f base.pp base.mod base.out mypolicy.out"
+    rlPhaseEnd
+    fi
+
     rlPhaseStartCleanup
         rlRun "rm -rf ${TEST_FILE} ${TEST_DIR} ${OUTPUT_FILE}"
     rlPhaseEnd

diff --git a/checkpolicy/checkpolicy-docs/Makefile b/checkpolicy/checkpolicy-docs/Makefile
index ea1a0bc..d0b165e 100644
--- a/checkpolicy/checkpolicy-docs/Makefile
+++ b/checkpolicy/checkpolicy-docs/Makefile
@@ -1,6 +1,6 @@
 # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 #
-#   Makefile of /CoreOS/checkpolicy/Sanity/checkpolicy
+#   Makefile of /CoreOS/checkpolicy/Sanity/checkpolicy-docs
 #   Description: covers an issue where manpage included an unsupported option.
 #   Author: Milos Malik <mmalik@redhat.com>
 #
@@ -24,7 +24,7 @@
 #
 # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-export TEST=/CoreOS/checkpolicy/Sanity/checkpolicy
+export TEST=/CoreOS/checkpolicy/Sanity/checkpolicy-docs
 export TESTVERSION=1.0
 
 BUILT_FILES=

diff --git a/checkpolicy/checkpolicy-docs/PURPOSE b/checkpolicy/checkpolicy-docs/PURPOSE
index bde34d7..ce7d2cc 100644
--- a/checkpolicy/checkpolicy-docs/PURPOSE
+++ b/checkpolicy/checkpolicy-docs/PURPOSE
@@ -1,4 +1,4 @@
-PURPOSE of /CoreOS/checkpolicy/Sanity/checkpolicy
+PURPOSE of /CoreOS/checkpolicy/Sanity/checkpolicy-docs
 
 Description: covers an issue where manpage included an unsupported option.
 

diff --git a/checkpolicy/checkpolicy-docs/main.fmf b/checkpolicy/checkpolicy-docs/main.fmf
index 368c6bd..f66b1a9 100644
--- a/checkpolicy/checkpolicy-docs/main.fmf
+++ b/checkpolicy/checkpolicy-docs/main.fmf
@@ -32,6 +32,7 @@ adjust:
   - enabled: false
     when: distro == rhel-4
     continue: false
-extra-nitrate: TC#0062302
-extra-summary: /CoreOS/checkpolicy/Sanity/checkpolicy
-extra-task: /CoreOS/checkpolicy/Sanity/checkpolicy
+extra-nitrate: TC#00612804
+extra-summary: /CoreOS/checkpolicy/Sanity/checkpolicy-docs
+extra-task: /CoreOS/checkpolicy/Sanity/checkpolicy-docs
+id: 8e06af12-0434-448a-aa85-9ed5c854daf9

diff --git a/checkpolicy/checkpolicy/Makefile b/checkpolicy/checkpolicy/Makefile
index 1ba29a4..3712630 100644
--- a/checkpolicy/checkpolicy/Makefile
+++ b/checkpolicy/checkpolicy/Makefile
@@ -59,6 +59,10 @@ $(METADATA): Makefile
 	@echo "Confidential:    no" >> $(METADATA)
 	@echo "Destructive:     no" >> $(METADATA)
 	@echo "Releases:        -RHEL4" >> $(METADATA)
+	@echo "Bug:             533790" >> $(METADATA) # RHEL-5
+	@echo "Bug:             739866" >> $(METADATA) # RHEL-6
+	@echo "Bug:             1328966" >> $(METADATA) # RHEL-7
+	@echo "Bug:             1328979" >> $(METADATA) # RHEL-7
 
 	rhts-lint $(METADATA)
 

diff --git a/checkpolicy/checkpolicy/PURPOSE b/checkpolicy/checkpolicy/PURPOSE
index c60c59e..58a2359 100644
--- a/checkpolicy/checkpolicy/PURPOSE
+++ b/checkpolicy/checkpolicy/PURPOSE
@@ -4,4 +4,5 @@ Description: runs checkpolicy with various options to find out if it behaves cor
 
 Author: Milos Malik <mmalik@redhat.com>
 
+This test also covers bz#533790 ( https://bugzilla.redhat.com/show_bug.cgi?id=533790 ).
 

diff --git a/checkpolicy/checkpolicy/main.fmf b/checkpolicy/checkpolicy/main.fmf
index f11940a..4459507 100644
--- a/checkpolicy/checkpolicy/main.fmf
+++ b/checkpolicy/checkpolicy/main.fmf
@@ -4,11 +4,14 @@ description: |+
 
     Author: Milos Malik <mmalik@redhat.com>
 
+    This test also covers bz#533790 ( https://bugzilla.redhat.com/show_bug.cgi?id=533790 ).
 
 contact: Milos Malik <mmalik@redhat.com>
 component:
   - setools
   - checkpolicy
+test: ./runtest.sh
+framework: beakerlib
 recommend:
   - checkpolicy
   - setools-console
@@ -20,7 +23,6 @@ enabled: true
 tag:
   - CI-Tier-1
   - NoRHEL4
-  - TIPpass_Security
   - Tier1
   - Tier1se
   - f31friendly
@@ -28,10 +30,10 @@ tag:
   - targeted
 tier: '1'
 link:
+  - relates: https://bugzilla.redhat.com/show_bug.cgi?id=533790
+  - relates: https://bugzilla.redhat.com/show_bug.cgi?id=739866
   - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1328966
   - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1328979
-  - relates: https://bugzilla.redhat.com/show_bug.cgi?id=739866
-  - relates: https://bugzilla.redhat.com/show_bug.cgi?id=533790
 adjust:
   - enabled: false
     when: distro == rhel-4

diff --git a/checkpolicy/checkpolicy/runtest.sh b/checkpolicy/checkpolicy/runtest.sh
index fd0de7d..359bc3e 100755
--- a/checkpolicy/checkpolicy/runtest.sh
+++ b/checkpolicy/checkpolicy/runtest.sh
@@ -34,10 +34,12 @@ PACKAGE="checkpolicy"
 rlJournalStart
     rlPhaseStartSetup
         rlAssertRpm ${PACKAGE}
-        rlRun "yum -y install selinux-policy-minimum selinux-policy-mls selinux-policy-targeted --enablerepo '*' --nobest"
-        rlAssertRpm selinux-policy-minimum
+        if rlIsRHEL "<9" ; then
+            rlAssertRpm selinux-policy-minimum
+        fi
         rlAssertRpm selinux-policy-mls
         rlAssertRpm selinux-policy-targeted
+        rlRun "rpm -qa | grep kernel"
         rlRun "uname -a"
         TEST_FILE=`mktemp`
         TEST_DIR=`mktemp -d`
@@ -52,7 +54,7 @@ rlJournalStart
         if rlIsRHEL 5 6 ; then
             VERSIONS=`seq ${MIN_VERSION} 1 ${MAX_VERSION}`
         else
-            # some versions are skipped because seinfo segfaults when inspecting binary policies between v.20 and v.23"
+            # some versions are skipped because of BZ#1328979
             VERSIONS=`seq ${MIN_VERSION} 1 ${MAX_VERSION} | grep -v -e 19 -e 20 -e 21 -e 22 -e 23`
         fi
         for CUR_VERSION in ${VERSIONS} ; do
@@ -67,7 +69,7 @@ rlJournalStart
         done
     rlPhaseEnd
 
-    rlPhaseStartTest
+    rlPhaseStartTest "bz#533790"
         rlRun "checkpolicy >& ${TEST_FILE}" 1
         rlAssertGrep "unable to open policy.conf" ${TEST_FILE}
         rlRun "checkpolicy -b >& ${TEST_FILE}" 1
@@ -102,7 +104,7 @@ rlJournalStart
         rlRun "checkpolicy --help 2>&1 | grep -- '-m]'" 1
     rlPhaseEnd
 
-    rlPhaseStartTest
+    rlPhaseStartTest "bz#739866"
         if rlIsRHEL 5 6 ; then
             ACTIVE_POLICY="/selinux/policy"
         else
@@ -110,7 +112,12 @@ rlJournalStart
         fi
         rlRun "echo -e 'q\n' | checkpolicy -Mdb ${ACTIVE_POLICY} | tee ${OUTPUT_FILE}"
         rlRun "grep -qi -e error -e ebitmap -e 'not match' ${OUTPUT_FILE}" 1
-        for POLICY_TYPE in minimum mls targeted ; do
+        if rlIsRHEL "<9" ; then
+            LIST="minimum mls targeted"
+        else
+            LIST="mls targeted"
+        fi
+        for POLICY_TYPE in $LIST ; do
             if [ ! -e /etc/selinux/${POLICY_TYPE}/policy/policy.* ] ; then
                 continue
             fi
@@ -119,7 +126,7 @@ rlJournalStart
         done
     rlPhaseEnd
 
-    rlPhaseStartTest
+    rlPhaseStartTest "bz#1328966 + bz#1328979"
         if rlIsRHEL 5 6 ; then
             ACTIVE_POLICY_TREE="/selinux"
         else # RHEL-7 and above
@@ -127,11 +134,16 @@ rlJournalStart
         fi
         MIN_VERSION="15"
         MAX_VERSION=`find /etc/selinux/ -name policy.?? | cut -d / -f 6 | cut -d . -f 2 | head -n 1`
-        for POLICY_TYPE in minimum mls targeted ; do
+        if rlIsRHEL "<9" ; then
+            LIST="minimum mls targeted"
+        else
+            LIST="mls targeted"
+        fi
+        for POLICY_TYPE in $LIST ; do
             if rlIsRHEL 5 6 ; then
                 VERSIONS=`seq ${MIN_VERSION} 1 ${MAX_VERSION}`
             else
-                # some versions are skipped because seinfo segfaults when inspecting binary policies between v.20 and v.23"
+                # some versions are skipped because of BZ#1328979
                 VERSIONS=`seq ${MIN_VERSION} 1 ${MAX_VERSION} | grep -v -e 19 -e 20 -e 21 -e 22 -e 23`
             fi
             for CUR_VERSION in ${VERSIONS} ; do
@@ -147,8 +159,73 @@ rlJournalStart
         done
     rlPhaseEnd
 
+    rlPhaseStartTest "handle unknown classes and perms"
+        for ACTION in allow deny reject ; do
+            rlRun "rm -f policy.out"
+            rlWatchdog "checkpolicy -M -U ${ACTION} -o policy.out policy.conf.from.secilc" 15
+            if [ -s policy.out ] ; then
+                rlRun "echo -e 'U\nq\n' | sedispol policy.out 2>&1 | tee ${OUTPUT_FILE}"
+                rlRun "grep -i \"${ACTION} unknown\" ${OUTPUT_FILE}"
+            else
+                rlFail "policy.out is empty or was not created"
+            fi
+        done
+    rlPhaseEnd
+
+    if ! rlIsRHEL '<=8.1'; then
+    rlPhaseStartTest "sorting ocontexts"
+        # check -S option in --help
+        rlRun "checkpolicy --help >$OUTPUT_FILE" 0,1
+        rlRun "cat $OUTPUT_FILE"
+        rlAssertGrep "\[-S\]" $OUTPUT_FILE
+
+        # check -S option in man page
+        rlRun "PAGER=cat man checkpolicy >$OUTPUT_FILE"
+        rlRun "cat $OUTPUT_FILE"
+        rlAssertGrep "\[-S\]" $OUTPUT_FILE
+
+        # run checkpolicy with the -S option
+        rlWatchdog "checkpolicy -S -M -o policy.out policy.conf.from.secilc" 15
+        rlRun "seinfo policy.out"
+    rlPhaseEnd
+    fi
+
+    rlPhaseStartTest "Test checkpolicy cil option"
+        # check -C option without input file
+        rlRun "checkpolicy -C 2>&1 | grep \"unable to open policy.conf\""
+        # check -C option with policy.conf file
+        rlRun "checkpolicy -C -M -o policy.cil policy.conf.from.secilc"
+        rlAssertGrep "(allow [a-z]*_.* [a-z]*_.* ([a-z]* ([a-z]*)))" policy.cil
+        # check -C option with policy binary file
+        rlRun "checkpolicy -C -M -o policy.cil2 -b /sys/fs/selinux/policy"
+        rlAssertGrep "(allow [a-z]*_.* [a-z]*_.* ([a-z]* ([a-z]*)))" policy.cil2
+    rlPhaseEnd
+
+    if rlIsRHEL '>=9' ; then
+    rlPhaseStartTest "Test checkpolicy optimize option"
+        # check -O option without input file
+        rlRun "checkpolicy -O 2>&1 | grep \"unable to open policy.conf\""
+        # Create optimized -O binary with policy.conf file
+        rlRun "checkpolicy -O -M -o policy.opt policy.conf.from.secilc"
+        rlRun "seinfo policy.opt"
+        # Create regular binary with policy.conf file
+        rlRun "checkpolicy -M -o policy.reg policy.conf.from.secilc"
+        rlRun "seinfo policy.reg"
+        # Compare size of optimized and regular binary
+        OPT1=`stat -c %s policy.opt`
+        REG1=`stat -c %s policy.reg`
+        rlAssertGreater "Test if regular file size is higher than optimized file" $REG1 $OPT1
+        # Compare allow rule counts between optimized and regular binary
+        rlRun "seinfo policy.opt > /tmp/optfile"
+        OPT_CNT=`grep Allow: /tmp/optfile | tr -s ' ' | sed 's/^ //' | cut -d ' ' -f2`
+        rlRun "seinfo policy.reg > /tmp/regfile"
+        REG_CNT=`grep Allow: /tmp/regfile | tr -s ' ' | sed 's/^ //' | cut -d ' ' -f2`
+        rlAssertGreater "Regular file has higher allow rule than optimized file" $REG_CNT $OPT_CNT
+    rlPhaseEnd
+    fi
+
     rlPhaseStartCleanup
-        rm -f ${OUTPUT_FILE} policy.out
+        rm -f ${OUTPUT_FILE} policy.out policy.cil policy.cil2 policy.opt policy.reg /tmp/optfile /tmp/regfile
     rlPhaseEnd
 rlJournalPrintText
 rlJournalEnd

                 reply	other threads:[~2026-09-11 13:21 UTC|newest]

Thread overview: [no followups] expand[flat|nested]  mbox.gz  Atom feed

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=178913289794.1.2745856811919530959.tests-selinux-4e1655b3f32e@fedoraproject.org \
    --to=mmalik@redhat.com \
    --cc=git-commits@fedoraproject.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Be sure your reply has a Subject: header at the top and a blank line before the message body.

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox