public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
* [tests/selinux] pr775-checkpolicy-revdeps: make the upstream tests up-to-date
@ 2026-09-11 13:21 Milos Malik
0 siblings, 0 replies; only message in thread
From: Milos Malik @ 2026-09-11 13:21 UTC (permalink / raw)
To: git-commits
A new commit has been pushed.
Repo : tests/selinux
Branch : pr775-checkpolicy-revdeps
Commit : 4e1655b3f32ed6da47aad3074b2a119a4f2126d3
Author : Milos Malik <mmalik@redhat.com>
Date : 2024-04-30T14:19:57+00:00
Stats : +135/-27 in 10 file(s)
URL : https://src.fedoraproject.org/tests/selinux/c/4e1655b3f32ed6da47aad3074b2a119a4f2126d3?branch=pr775-checkpolicy-revdeps
Log:
make the upstream tests up-to-date
Some upstream tests diverged from their downstream versions. Let's
synchronize them.
---
diff --git a/checkpolicy/checkmodule/Makefile b/checkpolicy/checkmodule/Makefile
index 4dca103..c0b1096 100644
--- a/checkpolicy/checkmodule/Makefile
+++ b/checkpolicy/checkmodule/Makefile
@@ -53,12 +53,17 @@ $(METADATA): Makefile
@echo "Type: Sanity" >> $(METADATA)
@echo "TestTime: 10m" >> $(METADATA)
@echo "RunFor: checkpolicy" >> $(METADATA)
- @echo "Requires: checkpolicy man grep mktemp policycoreutils policycoreutils-devel" >> $(METADATA)
+ @echo "Requires: checkpolicy man grep policycoreutils policycoreutils-devel" >> $(METADATA)
@echo "Priority: Normal" >> $(METADATA)
@echo "License: GPLv2" >> $(METADATA)
@echo "Confidential: no" >> $(METADATA)
@echo "Destructive: no" >> $(METADATA)
@echo "Releases: -RHEL4" >> $(METADATA)
+ @echo "Bug: 533796" >> $(METADATA) # RHEL-5
+ @echo "Bug: 588294" >> $(METADATA) # RHEL-6
+ @echo "Bug: 1064603" >> $(METADATA) # RHEL-7
+ @echo "Bug: 1329217" >> $(METADATA) # RHEL-7
+ @echo "Bug: 1392394" >> $(METADATA) # RHEL-6
rhts-lint $(METADATA)
diff --git a/checkpolicy/checkmodule/main.fmf b/checkpolicy/checkmodule/main.fmf
index c990752..8e5531a 100644
--- a/checkpolicy/checkmodule/main.fmf
+++ b/checkpolicy/checkmodule/main.fmf
@@ -5,11 +5,12 @@ description: |+
contact: Milos Malik <mmalik@redhat.com>
component:
- checkpolicy
+test: ./runtest.sh
+framework: beakerlib
recommend:
- checkpolicy
- man
- grep
- - mktemp
- policycoreutils
- policycoreutils-devel
duration: 10m
@@ -17,7 +18,6 @@ enabled: true
tag:
- CI-Tier-1
- NoRHEL4
- - TIPpass_Security
- Tier1
- Tier1se
- f31friendly
@@ -25,11 +25,11 @@ tag:
- targeted
tier: '1'
link:
- - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1329217
- relates: https://bugzilla.redhat.com/show_bug.cgi?id=533796
- relates: https://bugzilla.redhat.com/show_bug.cgi?id=588294
- - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1392394
- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1064603
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1329217
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1392394
adjust:
- enabled: false
when: distro == rhel-4
diff --git a/checkpolicy/checkmodule/runtest.sh b/checkpolicy/checkmodule/runtest.sh
index 49dc17f..430d30d 100755
--- a/checkpolicy/checkmodule/runtest.sh
+++ b/checkpolicy/checkmodule/runtest.sh
@@ -40,7 +40,7 @@ rlJournalStart
rlRun "rpm -ql ${PACKAGE} | grep /usr/share/man/.*checkmodule"
rlPhaseEnd
- rlPhaseStartTest
+ rlPhaseStartTest "bz#533796 + bz#588294"
rlRun "checkmodule >& ${TEST_FILE}" 1
rlAssertGrep "unable to open policy.conf" ${TEST_FILE}
rlRun "checkmodule -b >& ${TEST_FILE}" 1
@@ -74,14 +74,14 @@ rlJournalStart
rlRun "checkmodule --help 2>&1 | grep -- -U"
rlPhaseEnd
- rlPhaseStartTest
+ rlPhaseStartTest "bz#1064603 + bz#1392394"
for POLICY_KIND in minimum mls targeted ; do
rlRun "checkmodule -M -m -b -o testmod.mod /etc/selinux/${POLICY_KIND}/policy/policy.* >& ${TEST_FILE}" 1
rlRun "grep -i \"checkmodule.*-b and -m are incompatible with each other\" ${TEST_FILE}"
done
rlPhaseEnd
- rlPhaseStartTest
+ rlPhaseStartTest "bz#1329217"
INPUT_FILE="mypolicy.te"
OUTPUT_FILE="mypolicy.output"
rlRun "ls -l ${INPUT_FILE}"
@@ -94,6 +94,24 @@ rlJournalStart
fi
rlPhaseEnd
+ if ! rlIsRHEL 5 6 ; then # semodule_unpackage is not available on RHEL-5 and RHEL-6
+ rlPhaseStartTest "handle unknown classes and perms"
+ rlRun "rm -f base.pp base.mod"
+ rlRun "semodule -E base"
+ rlRun "semodule_unpackage base.pp base.mod"
+ for ACTION in allow deny reject ; do
+ rlRun "checkmodule -b -o base.out -M -U ${ACTION} base.mod"
+ rlRun "echo -e 'u\nq\n' | sedismod base.out | grep -i \"${ACTION} unknown\""
+ done
+ rlRun "checkmodule -m -o mypolicy.out -M -U deny mypolicy.te"
+ rlRun "ls -l mypolicy.out"
+ for ACTION in allow reject ; do
+ rlRun "checkmodule -m -o mypolicy.out -M -U ${ACTION} mypolicy.te 2>&1 | grep -i 'only valid.*base module'"
+ done
+ rlRun "rm -f base.pp base.mod base.out mypolicy.out"
+ rlPhaseEnd
+ fi
+
rlPhaseStartCleanup
rlRun "rm -rf ${TEST_FILE} ${TEST_DIR} ${OUTPUT_FILE}"
rlPhaseEnd
diff --git a/checkpolicy/checkpolicy-docs/Makefile b/checkpolicy/checkpolicy-docs/Makefile
index ea1a0bc..d0b165e 100644
--- a/checkpolicy/checkpolicy-docs/Makefile
+++ b/checkpolicy/checkpolicy-docs/Makefile
@@ -1,6 +1,6 @@
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#
-# Makefile of /CoreOS/checkpolicy/Sanity/checkpolicy
+# Makefile of /CoreOS/checkpolicy/Sanity/checkpolicy-docs
# Description: covers an issue where manpage included an unsupported option.
# Author: Milos Malik <mmalik@redhat.com>
#
@@ -24,7 +24,7 @@
#
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-export TEST=/CoreOS/checkpolicy/Sanity/checkpolicy
+export TEST=/CoreOS/checkpolicy/Sanity/checkpolicy-docs
export TESTVERSION=1.0
BUILT_FILES=
diff --git a/checkpolicy/checkpolicy-docs/PURPOSE b/checkpolicy/checkpolicy-docs/PURPOSE
index bde34d7..ce7d2cc 100644
--- a/checkpolicy/checkpolicy-docs/PURPOSE
+++ b/checkpolicy/checkpolicy-docs/PURPOSE
@@ -1,4 +1,4 @@
-PURPOSE of /CoreOS/checkpolicy/Sanity/checkpolicy
+PURPOSE of /CoreOS/checkpolicy/Sanity/checkpolicy-docs
Description: covers an issue where manpage included an unsupported option.
diff --git a/checkpolicy/checkpolicy-docs/main.fmf b/checkpolicy/checkpolicy-docs/main.fmf
index 368c6bd..f66b1a9 100644
--- a/checkpolicy/checkpolicy-docs/main.fmf
+++ b/checkpolicy/checkpolicy-docs/main.fmf
@@ -32,6 +32,7 @@ adjust:
- enabled: false
when: distro == rhel-4
continue: false
-extra-nitrate: TC#0062302
-extra-summary: /CoreOS/checkpolicy/Sanity/checkpolicy
-extra-task: /CoreOS/checkpolicy/Sanity/checkpolicy
+extra-nitrate: TC#00612804
+extra-summary: /CoreOS/checkpolicy/Sanity/checkpolicy-docs
+extra-task: /CoreOS/checkpolicy/Sanity/checkpolicy-docs
+id: 8e06af12-0434-448a-aa85-9ed5c854daf9
diff --git a/checkpolicy/checkpolicy/Makefile b/checkpolicy/checkpolicy/Makefile
index 1ba29a4..3712630 100644
--- a/checkpolicy/checkpolicy/Makefile
+++ b/checkpolicy/checkpolicy/Makefile
@@ -59,6 +59,10 @@ $(METADATA): Makefile
@echo "Confidential: no" >> $(METADATA)
@echo "Destructive: no" >> $(METADATA)
@echo "Releases: -RHEL4" >> $(METADATA)
+ @echo "Bug: 533790" >> $(METADATA) # RHEL-5
+ @echo "Bug: 739866" >> $(METADATA) # RHEL-6
+ @echo "Bug: 1328966" >> $(METADATA) # RHEL-7
+ @echo "Bug: 1328979" >> $(METADATA) # RHEL-7
rhts-lint $(METADATA)
diff --git a/checkpolicy/checkpolicy/PURPOSE b/checkpolicy/checkpolicy/PURPOSE
index c60c59e..58a2359 100644
--- a/checkpolicy/checkpolicy/PURPOSE
+++ b/checkpolicy/checkpolicy/PURPOSE
@@ -4,4 +4,5 @@ Description: runs checkpolicy with various options to find out if it behaves cor
Author: Milos Malik <mmalik@redhat.com>
+This test also covers bz#533790 ( https://bugzilla.redhat.com/show_bug.cgi?id=533790 ).
diff --git a/checkpolicy/checkpolicy/main.fmf b/checkpolicy/checkpolicy/main.fmf
index f11940a..4459507 100644
--- a/checkpolicy/checkpolicy/main.fmf
+++ b/checkpolicy/checkpolicy/main.fmf
@@ -4,11 +4,14 @@ description: |+
Author: Milos Malik <mmalik@redhat.com>
+ This test also covers bz#533790 ( https://bugzilla.redhat.com/show_bug.cgi?id=533790 ).
contact: Milos Malik <mmalik@redhat.com>
component:
- setools
- checkpolicy
+test: ./runtest.sh
+framework: beakerlib
recommend:
- checkpolicy
- setools-console
@@ -20,7 +23,6 @@ enabled: true
tag:
- CI-Tier-1
- NoRHEL4
- - TIPpass_Security
- Tier1
- Tier1se
- f31friendly
@@ -28,10 +30,10 @@ tag:
- targeted
tier: '1'
link:
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=533790
+ - relates: https://bugzilla.redhat.com/show_bug.cgi?id=739866
- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1328966
- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1328979
- - relates: https://bugzilla.redhat.com/show_bug.cgi?id=739866
- - relates: https://bugzilla.redhat.com/show_bug.cgi?id=533790
adjust:
- enabled: false
when: distro == rhel-4
diff --git a/checkpolicy/checkpolicy/runtest.sh b/checkpolicy/checkpolicy/runtest.sh
index fd0de7d..359bc3e 100755
--- a/checkpolicy/checkpolicy/runtest.sh
+++ b/checkpolicy/checkpolicy/runtest.sh
@@ -34,10 +34,12 @@ PACKAGE="checkpolicy"
rlJournalStart
rlPhaseStartSetup
rlAssertRpm ${PACKAGE}
- rlRun "yum -y install selinux-policy-minimum selinux-policy-mls selinux-policy-targeted --enablerepo '*' --nobest"
- rlAssertRpm selinux-policy-minimum
+ if rlIsRHEL "<9" ; then
+ rlAssertRpm selinux-policy-minimum
+ fi
rlAssertRpm selinux-policy-mls
rlAssertRpm selinux-policy-targeted
+ rlRun "rpm -qa | grep kernel"
rlRun "uname -a"
TEST_FILE=`mktemp`
TEST_DIR=`mktemp -d`
@@ -52,7 +54,7 @@ rlJournalStart
if rlIsRHEL 5 6 ; then
VERSIONS=`seq ${MIN_VERSION} 1 ${MAX_VERSION}`
else
- # some versions are skipped because seinfo segfaults when inspecting binary policies between v.20 and v.23"
+ # some versions are skipped because of BZ#1328979
VERSIONS=`seq ${MIN_VERSION} 1 ${MAX_VERSION} | grep -v -e 19 -e 20 -e 21 -e 22 -e 23`
fi
for CUR_VERSION in ${VERSIONS} ; do
@@ -67,7 +69,7 @@ rlJournalStart
done
rlPhaseEnd
- rlPhaseStartTest
+ rlPhaseStartTest "bz#533790"
rlRun "checkpolicy >& ${TEST_FILE}" 1
rlAssertGrep "unable to open policy.conf" ${TEST_FILE}
rlRun "checkpolicy -b >& ${TEST_FILE}" 1
@@ -102,7 +104,7 @@ rlJournalStart
rlRun "checkpolicy --help 2>&1 | grep -- '-m]'" 1
rlPhaseEnd
- rlPhaseStartTest
+ rlPhaseStartTest "bz#739866"
if rlIsRHEL 5 6 ; then
ACTIVE_POLICY="/selinux/policy"
else
@@ -110,7 +112,12 @@ rlJournalStart
fi
rlRun "echo -e 'q\n' | checkpolicy -Mdb ${ACTIVE_POLICY} | tee ${OUTPUT_FILE}"
rlRun "grep -qi -e error -e ebitmap -e 'not match' ${OUTPUT_FILE}" 1
- for POLICY_TYPE in minimum mls targeted ; do
+ if rlIsRHEL "<9" ; then
+ LIST="minimum mls targeted"
+ else
+ LIST="mls targeted"
+ fi
+ for POLICY_TYPE in $LIST ; do
if [ ! -e /etc/selinux/${POLICY_TYPE}/policy/policy.* ] ; then
continue
fi
@@ -119,7 +126,7 @@ rlJournalStart
done
rlPhaseEnd
- rlPhaseStartTest
+ rlPhaseStartTest "bz#1328966 + bz#1328979"
if rlIsRHEL 5 6 ; then
ACTIVE_POLICY_TREE="/selinux"
else # RHEL-7 and above
@@ -127,11 +134,16 @@ rlJournalStart
fi
MIN_VERSION="15"
MAX_VERSION=`find /etc/selinux/ -name policy.?? | cut -d / -f 6 | cut -d . -f 2 | head -n 1`
- for POLICY_TYPE in minimum mls targeted ; do
+ if rlIsRHEL "<9" ; then
+ LIST="minimum mls targeted"
+ else
+ LIST="mls targeted"
+ fi
+ for POLICY_TYPE in $LIST ; do
if rlIsRHEL 5 6 ; then
VERSIONS=`seq ${MIN_VERSION} 1 ${MAX_VERSION}`
else
- # some versions are skipped because seinfo segfaults when inspecting binary policies between v.20 and v.23"
+ # some versions are skipped because of BZ#1328979
VERSIONS=`seq ${MIN_VERSION} 1 ${MAX_VERSION} | grep -v -e 19 -e 20 -e 21 -e 22 -e 23`
fi
for CUR_VERSION in ${VERSIONS} ; do
@@ -147,8 +159,73 @@ rlJournalStart
done
rlPhaseEnd
+ rlPhaseStartTest "handle unknown classes and perms"
+ for ACTION in allow deny reject ; do
+ rlRun "rm -f policy.out"
+ rlWatchdog "checkpolicy -M -U ${ACTION} -o policy.out policy.conf.from.secilc" 15
+ if [ -s policy.out ] ; then
+ rlRun "echo -e 'U\nq\n' | sedispol policy.out 2>&1 | tee ${OUTPUT_FILE}"
+ rlRun "grep -i \"${ACTION} unknown\" ${OUTPUT_FILE}"
+ else
+ rlFail "policy.out is empty or was not created"
+ fi
+ done
+ rlPhaseEnd
+
+ if ! rlIsRHEL '<=8.1'; then
+ rlPhaseStartTest "sorting ocontexts"
+ # check -S option in --help
+ rlRun "checkpolicy --help >$OUTPUT_FILE" 0,1
+ rlRun "cat $OUTPUT_FILE"
+ rlAssertGrep "\[-S\]" $OUTPUT_FILE
+
+ # check -S option in man page
+ rlRun "PAGER=cat man checkpolicy >$OUTPUT_FILE"
+ rlRun "cat $OUTPUT_FILE"
+ rlAssertGrep "\[-S\]" $OUTPUT_FILE
+
+ # run checkpolicy with the -S option
+ rlWatchdog "checkpolicy -S -M -o policy.out policy.conf.from.secilc" 15
+ rlRun "seinfo policy.out"
+ rlPhaseEnd
+ fi
+
+ rlPhaseStartTest "Test checkpolicy cil option"
+ # check -C option without input file
+ rlRun "checkpolicy -C 2>&1 | grep \"unable to open policy.conf\""
+ # check -C option with policy.conf file
+ rlRun "checkpolicy -C -M -o policy.cil policy.conf.from.secilc"
+ rlAssertGrep "(allow [a-z]*_.* [a-z]*_.* ([a-z]* ([a-z]*)))" policy.cil
+ # check -C option with policy binary file
+ rlRun "checkpolicy -C -M -o policy.cil2 -b /sys/fs/selinux/policy"
+ rlAssertGrep "(allow [a-z]*_.* [a-z]*_.* ([a-z]* ([a-z]*)))" policy.cil2
+ rlPhaseEnd
+
+ if rlIsRHEL '>=9' ; then
+ rlPhaseStartTest "Test checkpolicy optimize option"
+ # check -O option without input file
+ rlRun "checkpolicy -O 2>&1 | grep \"unable to open policy.conf\""
+ # Create optimized -O binary with policy.conf file
+ rlRun "checkpolicy -O -M -o policy.opt policy.conf.from.secilc"
+ rlRun "seinfo policy.opt"
+ # Create regular binary with policy.conf file
+ rlRun "checkpolicy -M -o policy.reg policy.conf.from.secilc"
+ rlRun "seinfo policy.reg"
+ # Compare size of optimized and regular binary
+ OPT1=`stat -c %s policy.opt`
+ REG1=`stat -c %s policy.reg`
+ rlAssertGreater "Test if regular file size is higher than optimized file" $REG1 $OPT1
+ # Compare allow rule counts between optimized and regular binary
+ rlRun "seinfo policy.opt > /tmp/optfile"
+ OPT_CNT=`grep Allow: /tmp/optfile | tr -s ' ' | sed 's/^ //' | cut -d ' ' -f2`
+ rlRun "seinfo policy.reg > /tmp/regfile"
+ REG_CNT=`grep Allow: /tmp/regfile | tr -s ' ' | sed 's/^ //' | cut -d ' ' -f2`
+ rlAssertGreater "Regular file has higher allow rule than optimized file" $REG_CNT $OPT_CNT
+ rlPhaseEnd
+ fi
+
rlPhaseStartCleanup
- rm -f ${OUTPUT_FILE} policy.out
+ rm -f ${OUTPUT_FILE} policy.out policy.cil policy.cil2 policy.opt policy.reg /tmp/optfile /tmp/regfile
rlPhaseEnd
rlJournalPrintText
rlJournalEnd
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2026-09-11 13:21 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-09-11 13:21 [tests/selinux] pr775-checkpolicy-revdeps: make the upstream tests up-to-date Milos Malik
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox