[tests/selinux] pr775-checkpolicy-revdeps: fix requirements, relevancy and checks

public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed

From: Milos Malik <mmalik@redhat.com>
To: git-commits@fedoraproject.org
Subject: [tests/selinux] pr775-checkpolicy-revdeps: fix requirements, relevancy and checks
Date: Fri, 11 Sep 2026 13:22:11 GMT	[thread overview]
Message-ID: <178913293143.1.5058891214293370224.tests-selinux-9c7a2f4fb49d@fedoraproject.org> (raw)

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 9c7a2f4fb49d5dae5aa31091a70d7609fd95c7ae
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2024-11-29T16:05:22+01:00
            Stats  : +21/-6 in 13 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/9c7a2f4fb49d5dae5aa31091a70d7609fd95c7ae?branch=pr775-checkpolicy-revdeps

            Log:
            fix requirements, relevancy and checks

The AVC subtest can be disabled, because all modified tests look for
SELinux denials directly.

At least 1 of the modified tests had an incorrect or incomplete list of
package requirements.

At least 1 of the modified tests had an incorrect relevancy.

---
diff --git a/selinux-policy/blueman-and-similar/Makefile b/selinux-policy/blueman-and-similar/Makefile
index 5b1d70a..633c985 100644
--- a/selinux-policy/blueman-and-similar/Makefile
+++ b/selinux-policy/blueman-and-similar/Makefile
@@ -56,6 +56,7 @@ $(METADATA): Makefile
 	@echo "RunFor:          selinux-policy" >> $(METADATA)
 	@echo "Requires:        audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console glib2 gtk3 blueman python-cairo pygtk2 /usr/sbin/service" >> $(METADATA)
 	@echo "RhtsRequires:    library(selinux-policy/common)" >> $(METADATA)
+	@echo "Environment:     AVC_ERROR=+no_avc_check" >> $(METADATA)
 	@echo "Priority:        Normal" >> $(METADATA)
 	@echo "License:         GPLv2" >> $(METADATA)
 	@echo "Confidential:    no" >> $(METADATA)

diff --git a/selinux-policy/blueman-and-similar/main.fmf b/selinux-policy/blueman-and-similar/main.fmf
index 502e9ce..3856db9 100644
--- a/selinux-policy/blueman-and-similar/main.fmf
+++ b/selinux-policy/blueman-and-similar/main.fmf
@@ -21,6 +21,8 @@ recommend:
   - python-cairo
   - pygtk2
   - /usr/sbin/service
+environment:
+    AVC_ERROR: +no_avc_check
 duration: 10m
 enabled: true
 tag:

diff --git a/selinux-policy/gnome-remote-desktop-and-similar/runtest.sh b/selinux-policy/gnome-remote-desktop-and-similar/runtest.sh
index d533dc7..9763687 100755
--- a/selinux-policy/gnome-remote-desktop-and-similar/runtest.sh
+++ b/selinux-policy/gnome-remote-desktop-and-similar/runtest.sh
@@ -66,6 +66,7 @@ rlJournalStart
     rlPhaseEnd
     fi
 
+    if [ -f /usr/lib/systemd/system/gnome-remote-desktop.service ] ; then
     rlPhaseStartTest "real scenario"
         rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1
         rlRun "grdctl --headless status"
@@ -76,6 +77,9 @@ rlJournalStart
         rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255
         rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1
     rlPhaseEnd
+    fi
+
+    # TODO: test the gnome-remote-desktop service under normal/confined users
 
     rlPhaseStartCleanup
         sleep 2

diff --git a/selinux-policy/power-profiles-daemon-and-similar/Makefile b/selinux-policy/power-profiles-daemon-and-similar/Makefile
index d9b17a0..afd0a0a 100644
--- a/selinux-policy/power-profiles-daemon-and-similar/Makefile
+++ b/selinux-policy/power-profiles-daemon-and-similar/Makefile
@@ -64,6 +64,7 @@ $(METADATA): Makefile
 	@echo "Destructive:     no" >> $(METADATA)
 	@echo "Releases:        -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA)
 	@echo "Bug:             RHEL-61117" >> $(METADATA) # RHEL-9
+	@echo "Bug:             RHEL-62356" >> $(METADATA) # RHEL-10
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/power-profiles-daemon-and-similar/main.fmf b/selinux-policy/power-profiles-daemon-and-similar/main.fmf
index 8c790f3..9b522b0 100644
--- a/selinux-policy/power-profiles-daemon-and-similar/main.fmf
+++ b/selinux-policy/power-profiles-daemon-and-similar/main.fmf
@@ -33,9 +33,10 @@ tag:
   - NoRHIVOS
 link:
   - verifies: https://issues.redhat.com/browse/RHEL-61117
+  - verifies: https://issues.redhat.com/browse/RHEL-62356
 adjust:
   - enabled: false
-    when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8
+    when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, rhel-10, centos-stream-10
     because: the power-profiles-daemon package is not available there
 extra-summary: /CoreOS/selinux-policy/Regression/power-profiles-daemon-and-similar
 extra-task: /CoreOS/selinux-policy/Regression/power-profiles-daemon-and-similar

diff --git a/selinux-policy/samba-bgqd-and-similar/Makefile b/selinux-policy/samba-bgqd-and-similar/Makefile
index 93dcc29..0c99403 100644
--- a/selinux-policy/samba-bgqd-and-similar/Makefile
+++ b/selinux-policy/samba-bgqd-and-similar/Makefile
@@ -56,6 +56,7 @@ $(METADATA): Makefile
 	@echo "RunFor:          selinux-policy" >> $(METADATA)
 	@echo "Requires:        audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console samba samba-client samba-common-tools" >> $(METADATA)
 	@echo "RhtsRequires:    library(selinux-policy/common)" >> $(METADATA)
+	@echo "Environment:     AVC_ERROR=+no_avc_check" >> $(METADATA)
 	@echo "Priority:        Normal" >> $(METADATA)
 	@echo "License:         GPLv2" >> $(METADATA)
 	@echo "Confidential:    no" >> $(METADATA)

diff --git a/selinux-policy/samba-bgqd-and-similar/main.fmf b/selinux-policy/samba-bgqd-and-similar/main.fmf
index 9ab8a49..99a0a4d 100644
--- a/selinux-policy/samba-bgqd-and-similar/main.fmf
+++ b/selinux-policy/samba-bgqd-and-similar/main.fmf
@@ -18,6 +18,8 @@ recommend:
   - samba
   - samba-client
   - samba-common-tools
+environment:
+    AVC_ERROR: +no_avc_check
 duration: 15m
 enabled: true
 tag:

diff --git a/selinux-policy/smbcontrol-and-similar/Makefile b/selinux-policy/smbcontrol-and-similar/Makefile
index 1f8ca03..e483fa0 100644
--- a/selinux-policy/smbcontrol-and-similar/Makefile
+++ b/selinux-policy/smbcontrol-and-similar/Makefile
@@ -56,6 +56,7 @@ $(METADATA): Makefile
 	@echo "RunFor:          selinux-policy" >> $(METADATA)
 	@echo "Requires:        audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console samba-common samba-common-tools" >> $(METADATA)
 	@echo "RhtsRequires:    library(selinux-policy/common)" >> $(METADATA)
+	@echo "Environment:     AVC_ERROR=+no_avc_check" >> $(METADATA)
 	@echo "Priority:        Normal" >> $(METADATA)
 	@echo "License:         GPLv2" >> $(METADATA)
 	@echo "Confidential:    no" >> $(METADATA)

diff --git a/selinux-policy/smbcontrol-and-similar/main.fmf b/selinux-policy/smbcontrol-and-similar/main.fmf
index 0c5ccda..6eefc44 100644
--- a/selinux-policy/smbcontrol-and-similar/main.fmf
+++ b/selinux-policy/smbcontrol-and-similar/main.fmf
@@ -17,6 +17,8 @@ recommend:
   - setools-console
   - samba-common
   - samba-common-tools
+environment:
+    AVC_ERROR: +no_avc_check
 duration: 15m
 enabled: true
 tag:

diff --git a/selinux-policy/systemd-mountfsd-and-similar/runtest.sh b/selinux-policy/systemd-mountfsd-and-similar/runtest.sh
index ddd5aae..0388f63 100755
--- a/selinux-policy/systemd-mountfsd-and-similar/runtest.sh
+++ b/selinux-policy/systemd-mountfsd-and-similar/runtest.sh
@@ -39,7 +39,7 @@ FILE_CONTEXT="systemd_mountfsd_exec_t"
 
 rlJournalStart
     rlPhaseStartSetup
-        rlRun "rlImport 'selinux-policy/common'"
+        rlRun "rlImport 'selinux-policy/common'" 0,1
         rlSESatisfyRequires
         rlAssertRpm ${PACKAGE}
         rlAssertRpm ${PACKAGE}-targeted

diff --git a/selinux-policy/systemd-nsresourced-and-similar/runtest.sh b/selinux-policy/systemd-nsresourced-and-similar/runtest.sh
index 2124748..9fb618c 100755
--- a/selinux-policy/systemd-nsresourced-and-similar/runtest.sh
+++ b/selinux-policy/systemd-nsresourced-and-similar/runtest.sh
@@ -39,7 +39,7 @@ FILE_CONTEXT="systemd_nsresourced_exec_t"
 
 rlJournalStart
     rlPhaseStartSetup
-        rlRun "rlImport 'selinux-policy/common'"
+        rlRun "rlImport 'selinux-policy/common'" 0,1
         rlSESatisfyRequires
         rlAssertRpm ${PACKAGE}
         rlAssertRpm ${PACKAGE}-targeted

diff --git a/selinux-policy/tlshd-and-similar/Makefile b/selinux-policy/tlshd-and-similar/Makefile
index 8cd29b8..b6e2928 100644
--- a/selinux-policy/tlshd-and-similar/Makefile
+++ b/selinux-policy/tlshd-and-similar/Makefile
@@ -54,7 +54,7 @@ $(METADATA): Makefile
 	@echo "Type:            Regression" >> $(METADATA)
 	@echo "TestTime:        10m" >> $(METADATA)
 	@echo "RunFor:          selinux-policy" >> $(METADATA)
-	@echo "Requires:        audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console tlshd /usr/sbin/service" >> $(METADATA)
+	@echo "Requires:        audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console ktls-utils /usr/sbin/service" >> $(METADATA)
 	@echo "RhtsRequires:    library(selinux-policy/common)" >> $(METADATA)
 	@echo "Environment:     AVC_ERROR=+no_avc_check" >> $(METADATA)
 	@echo "Priority:        Normal" >> $(METADATA)

diff --git a/selinux-policy/tlshd-and-similar/runtest.sh b/selinux-policy/tlshd-and-similar/runtest.sh
index 6e75aa8..4a2fc48 100755
--- a/selinux-policy/tlshd-and-similar/runtest.sh
+++ b/selinux-policy/tlshd-and-similar/runtest.sh
@@ -35,8 +35,8 @@ SERVICE_PACKAGE="ktls-utils"
 SERVICE_NAME="tlshd"
 PROCESS_NAME="tlshd"
 if seinfo -t | grep -q tlshd ; then
-    PROCESS_CONTEXT="tlshd_t"
-    FILE_CONTEXT="tlshd_exec_t"
+    PROCESS_CONTEXT="ktlshd_t"
+    FILE_CONTEXT="ktlshd_exec_t"
 else
     PROCESS_CONTEXT="unconfined_service_t"
     FILE_CONTEXT="bin_t"

                 reply	other threads:[~2026-09-11 13:22 UTC|newest]

Thread overview: [no followups] expand[flat|nested]  mbox.gz  Atom feed

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=178913293143.1.5058891214293370224.tests-selinux-9c7a2f4fb49d@fedoraproject.org \
    --to=mmalik@redhat.com \
    --cc=git-commits@fedoraproject.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Be sure your reply has a Subject: header at the top and a blank line before the message body.

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox