public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
From: Milos Malik <mmalik@redhat.com>
To: git-commits@fedoraproject.org
Subject: [tests/selinux] pr775-checkpolicy-revdeps: test if 'hostapd_cli ping' can run as a systemd service
Date: Fri, 11 Sep 2026 13:22:01 GMT [thread overview]
Message-ID: <178913292153.1.6404059319720112922.tests-selinux-2b36306eb2f9@fedoraproject.org> (raw)
A new commit has been pushed.
Repo : tests/selinux
Branch : pr775-checkpolicy-revdeps
Commit : 2b36306eb2f9c81e54c60e7a36b0167e727b0bf6
Author : Milos Malik <mmalik@redhat.com>
Date : 2024-10-03T07:48:29+00:00
Stats : +6/-1 in 3 file(s)
URL : https://src.fedoraproject.org/tests/selinux/c/2b36306eb2f9c81e54c60e7a36b0167e727b0bf6?branch=pr775-checkpolicy-revdeps
Log:
test if 'hostapd_cli ping' can run as a systemd service
A recent testing of a documented hostapd + freeradius use case
revealed that SELinux prevents the hostapd processes from writing
to a control socket located in /tmp. The TC reproduces the situation.
In order to support the documented use case, I believe that SELinux
policy should allow the action. The TC looks for appropriate policy
rules and file context patterns.
The TC covers RHEL-59683.
---
diff --git a/selinux-policy/hostapd-and-similar/Makefile b/selinux-policy/hostapd-and-similar/Makefile
index 594646a..4c1c5dd 100644
--- a/selinux-policy/hostapd-and-similar/Makefile
+++ b/selinux-policy/hostapd-and-similar/Makefile
@@ -76,6 +76,7 @@ $(METADATA): Makefile
@echo "Bug: 1979968" >> $(METADATA) # RHEL-9
@echo "Bug: 1784253" >> $(METADATA) # Fedora 35
@echo "Bug: 2032277" >> $(METADATA) # Fedora 35
+ @echo "Bug: RHEL-59683" >> $(METADATA) # RHEL-9
rhts-lint $(METADATA)
diff --git a/selinux-policy/hostapd-and-similar/main.fmf b/selinux-policy/hostapd-and-similar/main.fmf
index 46fb896..aa3ac7a 100644
--- a/selinux-policy/hostapd-and-similar/main.fmf
+++ b/selinux-policy/hostapd-and-similar/main.fmf
@@ -4,6 +4,7 @@ description: |+
contact: Milos Malik <mmalik@redhat.com>
component:
+ - hostapd
- selinux-policy
require:
- library(selinux-policy/common)
@@ -46,6 +47,7 @@ link:
- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1784253
- relates: https://bugzilla.redhat.com/show_bug.cgi?id=2032277
- relates: https://bugzilla.redhat.com/show_bug.cgi?id=2064688
+ - verifies: https://issues.redhat.com/browse/RHEL-59683
adjust:
- enabled: false
when: arch == s390x
diff --git a/selinux-policy/hostapd-and-similar/runtest.sh b/selinux-policy/hostapd-and-similar/runtest.sh
index d2b2bbd..aee5619 100755
--- a/selinux-policy/hostapd-and-similar/runtest.sh
+++ b/selinux-policy/hostapd-and-similar/runtest.sh
@@ -112,8 +112,10 @@ rlJournalStart
PROCESS_CONTEXT="unconfined_service_t"
fi
rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1
- rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255
+ rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255
rlRun "hostapd_cli all_sta"
+ rlRun "systemd-run hostapd_cli ping"
+ sleep 5
rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1
rlPhaseEnd
reply other threads:[~2026-09-11 13:22 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=178913292153.1.6404059319720112922.tests-selinux-2b36306eb2f9@fedoraproject.org \
--to=mmalik@redhat.com \
--cc=git-commits@fedoraproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox