[tests/selinux] pr775-checkpolicy-revdeps: update the failing tests with the latest findings

public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed

From: Milos Malik <mmalik@redhat.com>
To: git-commits@fedoraproject.org
Subject: [tests/selinux] pr775-checkpolicy-revdeps: update the failing tests with the latest findings
Date: Fri, 11 Sep 2026 13:22:15 GMT	[thread overview]
Message-ID: <178913293565.1.3039264118370265177.tests-selinux-6be8a931475a@fedoraproject.org> (raw)

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 6be8a931475a48f812155fcc1f1932e8ec71db18
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2025-01-16T12:55:26+01:00
            Stats  : +53/-6 in 8 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/6be8a931475a48f812155fcc1f1932e8ec71db18?branch=pr775-checkpolicy-revdeps

            Log:
            update the failing tests with the latest findings

Several automated tests had to be updated to reflect the latest
findings (new bugs, new rules because of denials) from testing on
various machines.
These tests also need to work in environments where the tested
services or their policies are not yet present. Test phases
relevancy is important.

---
diff --git a/selinux-policy/gnome-remote-desktop-and-similar/runtest.sh b/selinux-policy/gnome-remote-desktop-and-similar/runtest.sh
index 6f3fcdf..9c72937 100755
--- a/selinux-policy/gnome-remote-desktop-and-similar/runtest.sh
+++ b/selinux-policy/gnome-remote-desktop-and-similar/runtest.sh
@@ -64,12 +64,12 @@ rlJournalStart
         rlSEMatchPathCon "/etc/gnome-remote-desktop" "etc_t"
         rlSESearchRule "allow gnome_remote_desktop_t etc_t : dir { watch } [ ]"
     rlPhaseEnd
-    fi
 
     rlPhaseStartTest "RHEL-35877"
         rlSESearchRule "allow gnome_remote_desktop_t policykit_t : dbus { send_msg } [ ]"
         rlSESearchRule "allow policykit_t gnome_remote_desktop_t : dbus { send_msg } [ ]"
     rlPhaseEnd
+    fi
 
     if [ -f /usr/lib/systemd/system/gnome-remote-desktop.service ] ; then
     rlPhaseStartTest "real scenario"

diff --git a/selinux-policy/iio-sensor-proxy-and-similar/runtest.sh b/selinux-policy/iio-sensor-proxy-and-similar/runtest.sh
index bf177c6..041e959 100755
--- a/selinux-policy/iio-sensor-proxy-and-similar/runtest.sh
+++ b/selinux-policy/iio-sensor-proxy-and-similar/runtest.sh
@@ -65,11 +65,16 @@ rlJournalStart
         sleep 2
     rlPhaseEnd
 
-    rlPhaseStartTest "RHEL-70850"
+    if seinfo -t | grep -q iiosensorproxy ; then
+    rlPhaseStartTest "RHEL-17346 + RHEL-62355 + RHEL-70850"
+        rlSEMatchPathCon ${FILE_PATH} ${FILE_CONTEXT}
         rlSESearchRule "allow xdm_t iiosensorproxy_t : dbus { send_msg } [ ]"
         rlSESearchRule "allow iiosensorproxy_t xdm_t : dbus { send_msg } [ ]"
+        rlSESearchRule "allow iiosensorproxy_t iiosensorproxy_t : capability2 { bpf } [ ]"
     rlPhaseEnd
+    fi
 
+    if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then
     rlPhaseStartTest "real scenario -- standalone service"
         rlRun "sed -i 's/^.*Environment=.*$/Environment=FAKE_COMPASS=1/' /usr/lib/systemd/system/iio-sensor-proxy.service"
         rlRun "systemctl daemon-reload"
@@ -82,6 +87,7 @@ rlJournalStart
         rlWatchdog "monitor-sensor --all" 10
         rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "stop status" 1
     rlPhaseEnd
+    fi
 
     rlPhaseStartCleanup
         sleep 2

diff --git a/selinux-policy/power-profiles-daemon-and-similar/runtest.sh b/selinux-policy/power-profiles-daemon-and-similar/runtest.sh
index 72e5ea4..ee54652 100755
--- a/selinux-policy/power-profiles-daemon-and-similar/runtest.sh
+++ b/selinux-policy/power-profiles-daemon-and-similar/runtest.sh
@@ -63,6 +63,14 @@ rlJournalStart
         sleep 2
     rlPhaseEnd
 
+    if rlIsRHEL 9 || rlIsCentOS 9 ; then
+    rlPhaseStartTest "RHEL-61117"
+        rlSEMatchPathCon ${FILE_PATH} ${FILE_CONTEXT}
+        rlSESearchRule "allow powerprofiles_t powerprofiles_t : capability2 { bpf } [ ]"
+    rlPhaseEnd
+    fi
+
+    if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then
     rlPhaseStartTest "real scenario -- standalone service"
         rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1
         rlRun "powerprofilesctl list"
@@ -75,6 +83,7 @@ rlJournalStart
         rlRun "powerprofilesctl launch echo" 0,1
         rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "stop status" 1
     rlPhaseEnd
+    fi
 
     rlPhaseStartCleanup
         sleep 2

diff --git a/selinux-policy/samba-bgqd-and-similar/runtest.sh b/selinux-policy/samba-bgqd-and-similar/runtest.sh
index 476534d..df5195b 100755
--- a/selinux-policy/samba-bgqd-and-similar/runtest.sh
+++ b/selinux-policy/samba-bgqd-and-similar/runtest.sh
@@ -89,6 +89,7 @@ rlJournalStart
     rlPhaseEnd
     fi
 
+    if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then
     rlPhaseStartTest "real scenario"
         rlRun "service cups start"
         USER_NAME="smbuser${RANDOM}"
@@ -108,6 +109,7 @@ rlJournalStart
         rlRun "userdel -rf ${USER_NAME}"
         rlRun "service cups stop"
     rlPhaseEnd
+    fi
 
     rlPhaseStartCleanup
         sleep 2

diff --git a/selinux-policy/switcheroo-control-and-similar/runtest.sh b/selinux-policy/switcheroo-control-and-similar/runtest.sh
index c1d2100..243d0ee 100755
--- a/selinux-policy/switcheroo-control-and-similar/runtest.sh
+++ b/selinux-policy/switcheroo-control-and-similar/runtest.sh
@@ -35,8 +35,8 @@ SERVICE_PACKAGE="switcheroo-control"
 SERVICE_NAME="switcheroo-control"
 PROCESS_NAME="switcheroo-control"
 if seinfo -t | grep -q switcheroo ; then
-    PROCESS_CONTEXT="switcheroo_t"
-    FILE_CONTEXT="switcheroo_exec_t"
+    PROCESS_CONTEXT="switcheroo_control_t"
+    FILE_CONTEXT="switcheroo_control_exec_t"
 else
     PROCESS_CONTEXT="unconfined_service_t"
     FILE_CONTEXT="bin_t"
@@ -58,6 +58,29 @@ rlJournalStart
         sleep 2
     rlPhaseEnd
 
+    if seinfo -t | grep -q switcheroo ; then
+    rlPhaseStartTest "RHEL-24268"
+        rlSEMatchPathCon ${FILE_PATH} ${FILE_CONTEXT}
+        rlSEMatchPathCon "/run/udev/" "udev_var_run_t"
+        rlSEMatchPathCon "/run/dbus/" "system_dbusd_var_run_t"
+        rlSEMatchPathCon "/run/dbus/system_bus_socket" "system_dbusd_var_run_t"
+        rlSESearchRule "allow switcheroo_control_t udev_var_run_t : dir { search } [ ]"
+        rlSESearchRule "allow switcheroo_control_t switcheroo_control_t : netlink_kobject_uevent_socket { create setopt bind getattr } [ ]"
+        rlSESearchRule "allow switcheroo_control_t switcheroo_control_t : capability2 { bpf } [ ]"
+        rlSESearchRule "allow switcheroo_control_t sysfs_t : dir { read } [ ]"
+        rlSESearchRule "allow switcheroo_control_t sysfs_t : lnk_file { getattr read } [ ]"
+        rlSESearchRule "allow switcheroo_control_t sysfs_t : file { getattr open read } [ ]"
+        rlSESearchRule "allow switcheroo_control_t system_dbusd_t : unix_stream_socket { connectto } [ ]"
+        rlSESearchRule "allow switcheroo_control_t system_dbusd_var_run_t : sock_file { write } [ ]"
+        rlSESearchRule "allow switcheroo_control_t system_dbusd_var_run_t : dir { search } [ ]"
+        rlSESearchRule "allow switcheroo_control_t system_dbusd_t : dbus { acquire_svc send_msg } [ ]"
+        rlSESearchRule "allow system_dbusd_t switcheroo_control_t : dbus { send_msg } [ ]"
+        rlSESearchRule "allow unconfined_t switcheroo_control_t : dbus { send_msg } [ ]"
+        rlSESearchRule "allow switcheroo_control_t unconfined_t : dbus { send_msg } [ ]"
+    rlPhaseEnd
+    fi
+
+    if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then
     rlPhaseStartTest "real scenario -- standalone service"
         rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1
         rlRun "switcherooctl version"
@@ -69,6 +92,7 @@ rlJournalStart
         rlRun "rm -f ./empty-file"
         rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "stop status" 1
     rlPhaseEnd
+    fi
 
     rlPhaseStartCleanup
         sleep 2

diff --git a/selinux-policy/systemd-journal-upload/Makefile b/selinux-policy/systemd-journal-upload/Makefile
index 71c64ef..2ede7ea 100644
--- a/selinux-policy/systemd-journal-upload/Makefile
+++ b/selinux-policy/systemd-journal-upload/Makefile
@@ -63,7 +63,8 @@ $(METADATA): Makefile
 	@echo "Destructive:     no" >> $(METADATA)
 	@echo "Environment:     AVC_ERROR=+no_avc_check" >> $(METADATA)
 	@echo "Releases:        -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA)
-	@echo "Bug:             RHEL-57774" >> $(METADATA) # RHEL-9
+	@echo "Bug:             RHEL-57774" >> $(METADATA) # RHEL-10
+	@echo "Bug:             RHEL-62196" >> $(METADATA) # RHEL-9
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/systemd-journal-upload/main.fmf b/selinux-policy/systemd-journal-upload/main.fmf
index 2771cd6..a134969 100644
--- a/selinux-policy/systemd-journal-upload/main.fmf
+++ b/selinux-policy/systemd-journal-upload/main.fmf
@@ -29,6 +29,7 @@ tag:
   - NoRHIVOS
 link:
   - verifies: https://issues.redhat.com/browse/RHEL-57774
+  - verifies: https://issues.redhat.com/browse/RHEL-62196
 adjust:
   - enabled: false
     when: distro == rhel-4, rhel-5, rhel-6, rhel-7

diff --git a/selinux-policy/systemd-journal-upload/runtest.sh b/selinux-policy/systemd-journal-upload/runtest.sh
index 4c1a71f..09a627e 100755
--- a/selinux-policy/systemd-journal-upload/runtest.sh
+++ b/selinux-policy/systemd-journal-upload/runtest.sh
@@ -23,12 +23,15 @@ rlJournalStart
         sleep 2
     rlPhaseEnd
 
-    rlPhaseStartTest "RHEL-57774"
+    if seinfo -t | grep -q ${PROCESS_CONTEXT} ; then
+    rlPhaseStartTest "RHEL-57774 + RHEL-62196"
         rlSEMatchPathCon "/usr/lib/systemd/systemd-journal-upload" "systemd_journal_upload_exec_t"
         rlSEMatchPathCon "/run/systemd/journal-upload.conf.d" "systemd_conf_t"
         rlSESearchRule "allow systemd_journal_upload_t systemd_conf_t : dir { read } [ ]"
     rlPhaseEnd
+    fi
 
+    if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then
     rlPhaseStartTest "real scenario -- RHEL-57774"
         rlRun "mkdir -pZ /run/systemd/journal-upload.conf.d"
         rlRun "echo -e '[Upload]\nURL=http://localhost/\n' > /run/systemd/journal-upload.conf.d/test.conf"
@@ -37,6 +40,7 @@ rlJournalStart
         rlRun "restorecon -Rv /etc /var /run -e /var/ARTIFACTS" 0-255
         rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "stop status" 1
     rlPhaseEnd
+    fi
 
     rlPhaseStartCleanup
         sleep 2

                 reply	other threads:[~2026-09-11 13:22 UTC|newest]

Thread overview: [no followups] expand[flat|nested]  mbox.gz  Atom feed

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=178913293565.1.3039264118370265177.tests-selinux-6be8a931475a@fedoraproject.org \
    --to=mmalik@redhat.com \
    --cc=git-commits@fedoraproject.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Be sure your reply has a Subject: header at the top and a blank line before the message body.

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox