public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
* [tests/selinux] pr775-checkpolicy-revdeps: add various virt-install test scenarios
@ 2026-09-11 13:22 Milos Malik
0 siblings, 0 replies; only message in thread
From: Milos Malik @ 2026-09-11 13:22 UTC (permalink / raw)
To: git-commits
A new commit has been pushed.
Repo : tests/selinux
Branch : pr775-checkpolicy-revdeps
Commit : 0efb4046b15aae90f8a56e1edf73e5262333a663
Author : Milos Malik <mmalik@redhat.com>
Date : 2024-12-03T13:41:42+00:00
Stats : +318/-0 in 5 file(s)
URL : https://src.fedoraproject.org/tests/selinux/c/0efb4046b15aae90f8a56e1edf73e5262333a663?branch=pr775-checkpolicy-revdeps
Log:
add various virt-install test scenarios
test if memory device can be attached to a VM
TBA later
The TC covers RHEL-65038.
test if VM can start with multiqueue virtio interface
TBA later
The TC covers RHEL-65373.
test if VM can start with an isolated port
TBA later
The TC covers RHEL-65383.
test if VM with NUMA setting can start
TBA later
The TC covers RHEL-65789.
test if nbdkit enabled VM can start
TBA later
The TC covers RHEL-56029 and RHEL-69118.
---
diff --git a/selinux-policy/virt-install-additional/Makefile b/selinux-policy/virt-install-additional/Makefile
new file mode 100644
index 0000000..10abc7e
--- /dev/null
+++ b/selinux-policy/virt-install-additional/Makefile
@@ -0,0 +1,74 @@
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+# Makefile of /CoreOS/selinux-policy/Regression/virt-install-additional
+# Description: SELinux interferes with virt-install and related programs
+# Author: Milos Malik <mmalik@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+# Copyright (c) 2024 Red Hat, Inc. All rights reserved.
+#
+# This copyrighted material is made available to anyone wishing
+# to use, modify, copy, or redistribute it subject to the terms
+# and conditions of the GNU General Public License version 2.
+#
+# This program is distributed in the hope that it will be
+# useful, but WITHOUT ANY WARRANTY; without even the implied
+# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+# PURPOSE. See the GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public
+# License along with this program; if not, write to the Free
+# Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+# Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+export TEST=/CoreOS/selinux-policy/Regression/virt-install-additional
+export TESTVERSION=1.0
+
+BUILT_FILES=
+
+FILES=$(METADATA) runtest.sh Makefile PURPOSE
+
+.PHONY: all install download clean
+
+run: $(FILES) build
+ ./runtest.sh
+
+build: $(BUILT_FILES)
+ chmod a+x runtest.sh
+ chcon -t bin_t runtest.sh
+
+clean:
+ rm -f *~ $(BUILT_FILES)
+
+include /usr/share/rhts/lib/rhts-make.include
+
+$(METADATA): Makefile
+ @echo "Owner: Milos Malik <mmalik@redhat.com>" > $(METADATA)
+ @echo "Name: $(TEST)" >> $(METADATA)
+ @echo "TestVersion: $(TESTVERSION)" >> $(METADATA)
+ @echo "Path: $(TEST_DIR)" >> $(METADATA)
+ @echo "Description: SELinux interferes with virt-install and related programs" >> $(METADATA)
+ @echo "Type: Regression" >> $(METADATA)
+ @echo "TestTime: 20m" >> $(METADATA)
+ @echo "RunFor: selinux-policy" >> $(METADATA)
+ @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted /usr/sbin/service setools-console virt-install numad nbdkit" >> $(METADATA)
+ @echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA)
+ @echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA)
+ @echo "Priority: Normal" >> $(METADATA)
+ @echo "License: GPLv2" >> $(METADATA)
+ @echo "Confidential: no" >> $(METADATA)
+ @echo "Destructive: no" >> $(METADATA)
+ @echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA)
+ @echo "Architectures: aarch64 s390x x86_64" >> $(METADATA)
+ @echo "Bug: RHEL-56029" >> $(METADATA) # RHEL-9
+ @echo "Bug: RHEL-65038" >> $(METADATA) # RHEL-10
+ @echo "Bug: RHEL-65373" >> $(METADATA) # RHEL-10
+ @echo "Bug: RHEL-65383" >> $(METADATA) # RHEL-10
+ @echo "Bug: RHEL-65789" >> $(METADATA) # RHEL-10
+ @echo "Bug: RHEL-69118" >> $(METADATA) # RHEL-10
+
+ rhts-lint $(METADATA)
+
diff --git a/selinux-policy/virt-install-additional/PURPOSE b/selinux-policy/virt-install-additional/PURPOSE
new file mode 100644
index 0000000..abe4221
--- /dev/null
+++ b/selinux-policy/virt-install-additional/PURPOSE
@@ -0,0 +1,5 @@
+PURPOSE of /CoreOS/selinux-policy/Regression/virt-install-additional
+Author: Milos Malik <mmalik@redhat.com>
+
+SELinux interferes with virt-install and related programs.
+Also covers: numad.
diff --git a/selinux-policy/virt-install-additional/dimm.xml b/selinux-policy/virt-install-additional/dimm.xml
new file mode 100644
index 0000000..326c928
--- /dev/null
+++ b/selinux-policy/virt-install-additional/dimm.xml
@@ -0,0 +1,6 @@
+<memory model='dimm' access='private' discard='yes'>
+ <target>
+ <size unit='KiB'>524287</size>
+ <node>0</node>
+ </target>
+</memory>
diff --git a/selinux-policy/virt-install-additional/main.fmf b/selinux-policy/virt-install-additional/main.fmf
new file mode 100644
index 0000000..970a87d
--- /dev/null
+++ b/selinux-policy/virt-install-additional/main.fmf
@@ -0,0 +1,51 @@
+summary: SELinux interferes with virt-install and related programs.
+description: |+
+ SELinux interferes with virt-install and related programs.
+
+contact: Milos Malik <mmalik@redhat.com>
+component:
+ - selinux-policy
+test: ./runtest.sh
+framework: beakerlib
+require:
+ - library(selinux-policy/common)
+recommend:
+ - audit
+ - libselinux
+ - libselinux-utils
+ - policycoreutils
+ - selinux-policy
+ - selinux-policy-targeted
+ - /usr/sbin/service
+ - setools-console
+ - virt-install
+ - numad
+ - nbdkit
+environment:
+ AVC_ERROR: +no_avc_check
+duration: 20m
+enabled: true
+tag:
+ - kernel-rt
+ - NoRHEL4
+ - NoRHEL5
+ - NoRHEL6
+ - NoRHEL7
+ - targeted
+ - NoRHIVOS
+link:
+ - verifies: https://issues.redhat.com/browse/RHEL-56029
+ - verifies: https://issues.redhat.com/browse/RHEL-65038
+ - verifies: https://issues.redhat.com/browse/RHEL-65373
+ - verifies: https://issues.redhat.com/browse/RHEL-65383
+ - verifies: https://issues.redhat.com/browse/RHEL-65789
+ - verifies: https://issues.redhat.com/browse/RHEL-69118
+adjust:
+ - enabled: false
+ when: distro == rhel-4, rhel-5, rhel-6, rhel-7
+ continue: false
+ - enabled: false
+ when: distro == ppc64le
+ continue: false
+extra-summary: /CoreOS/selinux-policy/Regression/virt-install-additional
+extra-task: /CoreOS/selinux-policy/Regression/virt-install-additional
diff --git a/selinux-policy/virt-install-additional/runtest.sh b/selinux-policy/virt-install-additional/runtest.sh
new file mode 100755
index 0000000..d6dbcdf
--- /dev/null
+++ b/selinux-policy/virt-install-additional/runtest.sh
@@ -0,0 +1,182 @@
+#!/bin/bash
+# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+# runtest.sh of /CoreOS/selinux-policy/Regression/virt-install-additional
+# Description: SELinux interferes with virt-install and related programs
+# Author: Milos Malik <mmalik@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+# Copyright (c) 2024 Red Hat, Inc. All rights reserved.
+#
+# This copyrighted material is made available to anyone wishing
+# to use, modify, copy, or redistribute it subject to the terms
+# and conditions of the GNU General Public License version 2.
+#
+# This program is distributed in the hope that it will be
+# useful, but WITHOUT ANY WARRANTY; without even the implied
+# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+# PURPOSE. See the GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public
+# License along with this program; if not, write to the Free
+# Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+# Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include Beaker environment
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGE="selinux-policy"
+
+rlJournalStart
+ rlPhaseStartSetup
+ rlRun "rlImport 'selinux-policy/common'"
+ rlSESatisfyRequires
+ rlAssertRpm ${PACKAGE}
+ rlAssertRpm ${PACKAGE}-targeted
+ rlAssertRpm virt-install
+
+ rlRun "yum -y install libvirt\* qemu\* --skip-broken"
+
+ rlSESetEnforce
+ rlSEStatus
+ rlSESetTimestamp
+ sleep 2
+ rlPhaseEnd
+
+ rlPhaseStartTest "RHEL-65038"
+ rlSESearchRule "allow virtqemud_t svirt_tcg_t : lnk_file { read } [ ]"
+ rlSESearchRule "allow virtqemud_t svirt_tcg_t : process { getrlimit } [ ]"
+ rlSESearchRule "allow virtqemud_t svirt_t : process { getrlimit } [ ]"
+ if rlIsRHEL 8 ; then
+ rlRun "service libvirtd start"
+ fi
+ rlRun "service virtqemud start"
+ rlRun "service virtnetworkd start"
+ rlRun "service virtstoraged start"
+ rlRun "virt-install --memory 128 --pxe --virt-type qemu --os-variant alpinelinux3.8 --disk none --wait 0 --name test1 --cpu mode=maximum,check=none,migratable=on,numa.cell.id=0,numa.cell.cpus=0,numa.cell.memory=512000,numa.cell.unit="KiB" --memory maxMemory.slots=16,maxMemory=4096"
+ sleep 30
+ rlRun "virsh list"
+ rlRun "virsh list | grep 'test1.*running'"
+ rlRun "virsh attach-device test1 dimm.xml"
+ sleep 30
+ rlRun "virsh destroy test1"
+ rlRun "virsh undefine test1"
+ rlRun "service virtstoraged stop"
+ rlRun "service virtnetworkd stop"
+ rlRun "service virtqemud stop"
+ if rlIsRHEL 8 ; then
+ rlRun "service libvirtd stop"
+ fi
+ rlPhaseEnd
+
+ rlPhaseStartTest "RHEL-65373"
+ rlSESearchRule "allow virtqemud_t virtqemud_t : tun_socket { relabelto relabelfrom } [ ]"
+ if rlIsRHEL 8 ; then
+ rlRun "service libvirtd start"
+ fi
+ rlRun "service virtqemud start"
+ rlRun "service virtnetworkd start"
+ rlRun "service virtstoraged start"
+ rlRun "virt-install --memory 128 --pxe --virt-type qemu --os-variant alpinelinux3.8 --wait 0 --name test2 --network type=network,mac.address='52:54:00:ee:01:68',source=default,model.type=virtio,driver.queues=4"
+ sleep 30
+ rlRun "virsh list"
+ rlRun "virsh list | grep 'test2.*running'"
+ rlRun "virsh destroy test2"
+ rlRun "virsh undefine test2"
+ rlRun "service virtstoraged stop"
+ rlRun "service virtnetworkd stop"
+ rlRun "service virtqemud stop"
+ if rlIsRHEL 8 ; then
+ rlRun "service libvirtd stop"
+ fi
+ rlPhaseEnd
+
+ rlPhaseStartTest "RHEL-65383"
+ rlSESearchRule "allow virtqemud_t sysfs_t : file { write } [ ]"
+ if rlIsRHEL 8 ; then
+ rlRun "service libvirtd start"
+ fi
+ rlRun "service virtqemud start"
+ rlRun "service virtnetworkd start"
+ rlRun "service virtstoraged start"
+ rlRun "virt-install --memory 128 --pxe --virt-type qemu --os-variant alpinelinux3.8 --wait 0 --name test3 --network type=network,mac.address='52:54:00:23:f2:12',source=default,model.type=virtio --xml xpath.set=./devices/interface/port/@isolated=yes"
+ sleep 30
+ rlRun "virsh list"
+ rlRun "virsh list | grep 'test3.*running'"
+ rlRun "virsh destroy test3"
+ rlRun "virsh undefine test3"
+ rlRun "service virtstoraged stop"
+ rlRun "service virtnetworkd stop"
+ rlRun "service virtqemud stop"
+ if rlIsRHEL 8 ; then
+ rlRun "service libvirtd stop"
+ fi
+ rlPhaseEnd
+
+ rlPhaseStartTest "RHEL-65789"
+ rlSESearchRule "allow virtqemud_t numad_exec_t : file { getattr open read map execute } [ ]"
+ rlSESearchRule "allow virtqemud_t numad_t : process { transition } [ ]"
+ rlSESearchRule "type_transition virtqemud_t numad_exec_t : process numad_t"
+ if rlIsRHEL 8 ; then
+ rlRun "service libvirtd start"
+ fi
+ rlRun "service virtqemud start"
+ rlRun "service virtnetworkd start"
+ rlRun "service virtstoraged start"
+ rlRun "virt-install --memory 128 --pxe --virt-type qemu --os-variant alpinelinux3.8 --wait 0 --name test4 --numatune memory.mode='strict',memory.placement='auto'"
+ sleep 30
+ rlRun "virsh list"
+ rlRun "virsh list | grep 'test4.*running'"
+ rlRun "virsh destroy test4"
+ rlRun "virsh undefine test4"
+ rlRun "service virtstoraged stop"
+ rlRun "service virtnetworkd stop"
+ rlRun "service virtqemud stop"
+ if rlIsRHEL 8 ; then
+ rlRun "service libvirtd stop"
+ fi
+ rlPhaseEnd
+
+ rlPhaseStartTest "RHEL-56029 + RHEL-69118"
+ if rlIsRHEL 9 || rlIsCentOS 9 ; then
+ rlSESearchRule "allow virtd_t nbdkit_exec_t : file { entrypoint } [ ]"
+ elif rlIsRHEL 10 || rlIsCentOS 10 ; then
+ rlSESearchRule "allow virtqemud_t nbdkit_exec_t : file { getattr open read map execute } [ ]"
+ rlSESearchRule "allow virtqemud_t nbdkit_t : process { transition } [ ]"
+ rlSESearchRule "type_transition virtqemud_t nbdkit_exec_t : process nbdkit_t"
+ fi
+ if rlIsRHEL 8 ; then
+ rlRun "service libvirtd start"
+ fi
+ rlFileBackup /etc/libvirt/qemu.conf
+ rlRun "sed -i 's/^.*storage_use_nbdkit.*=.*$/storage_use_nbdkit = 1/' /etc/libvirt/qemu.conf"
+ rlRun "grep storage_use_nbdkit /etc/libvirt/qemu.conf"
+ rlRun "service virtqemud start"
+ rlRun "service virtnetworkd start"
+ rlRun "service virtstoraged start"
+ rlRun "virt-install --memory 128 --pxe --virt-type qemu --os-variant alpinelinux3.8 --disk source.protocol=ssh,source.name=/var/lib/libvirt/images/test.img,source.host0.name=10.73.210.25,source.host0.port=22 --wait 0 --name test5"
+ sleep 30
+ rlRun "virsh list"
+ rlRun "virsh list | grep 'test5.*running'"
+ rlRun "virsh destroy test5"
+ rlRun "virsh undefine test5"
+ rlRun "service virtstoraged stop"
+ rlRun "service virtnetworkd stop"
+ rlRun "service virtqemud stop"
+ if rlIsRHEL 8 ; then
+ rlRun "service libvirtd stop"
+ fi
+ rlFileRestore
+ rlPhaseEnd
+
+ rlPhaseStartCleanup
+ sleep 2
+ rlSECheckAVC
+ rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd
+
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2026-09-11 13:22 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-09-11 13:22 [tests/selinux] pr775-checkpolicy-revdeps: add various virt-install test scenarios Milos Malik
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox