public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
* [tests/selinux] pr775-checkpolicy-revdeps: update the failing tests with the latest findings
@ 2026-09-11 13:22 Milos Malik
0 siblings, 0 replies; only message in thread
From: Milos Malik @ 2026-09-11 13:22 UTC (permalink / raw)
To: git-commits
A new commit has been pushed.
Repo : tests/selinux
Branch : pr775-checkpolicy-revdeps
Commit : 6be8a931475a48f812155fcc1f1932e8ec71db18
Author : Milos Malik <mmalik@redhat.com>
Date : 2025-01-16T12:55:26+01:00
Stats : +53/-6 in 8 file(s)
URL : https://src.fedoraproject.org/tests/selinux/c/6be8a931475a48f812155fcc1f1932e8ec71db18?branch=pr775-checkpolicy-revdeps
Log:
update the failing tests with the latest findings
Several automated tests had to be updated to reflect the latest
findings (new bugs, new rules because of denials) from testing on
various machines.
These tests also need to work in environments where the tested
services or their policies are not yet present. Test phases
relevancy is important.
---
diff --git a/selinux-policy/gnome-remote-desktop-and-similar/runtest.sh b/selinux-policy/gnome-remote-desktop-and-similar/runtest.sh
index 6f3fcdf..9c72937 100755
--- a/selinux-policy/gnome-remote-desktop-and-similar/runtest.sh
+++ b/selinux-policy/gnome-remote-desktop-and-similar/runtest.sh
@@ -64,12 +64,12 @@ rlJournalStart
rlSEMatchPathCon "/etc/gnome-remote-desktop" "etc_t"
rlSESearchRule "allow gnome_remote_desktop_t etc_t : dir { watch } [ ]"
rlPhaseEnd
- fi
rlPhaseStartTest "RHEL-35877"
rlSESearchRule "allow gnome_remote_desktop_t policykit_t : dbus { send_msg } [ ]"
rlSESearchRule "allow policykit_t gnome_remote_desktop_t : dbus { send_msg } [ ]"
rlPhaseEnd
+ fi
if [ -f /usr/lib/systemd/system/gnome-remote-desktop.service ] ; then
rlPhaseStartTest "real scenario"
diff --git a/selinux-policy/iio-sensor-proxy-and-similar/runtest.sh b/selinux-policy/iio-sensor-proxy-and-similar/runtest.sh
index bf177c6..041e959 100755
--- a/selinux-policy/iio-sensor-proxy-and-similar/runtest.sh
+++ b/selinux-policy/iio-sensor-proxy-and-similar/runtest.sh
@@ -65,11 +65,16 @@ rlJournalStart
sleep 2
rlPhaseEnd
- rlPhaseStartTest "RHEL-70850"
+ if seinfo -t | grep -q iiosensorproxy ; then
+ rlPhaseStartTest "RHEL-17346 + RHEL-62355 + RHEL-70850"
+ rlSEMatchPathCon ${FILE_PATH} ${FILE_CONTEXT}
rlSESearchRule "allow xdm_t iiosensorproxy_t : dbus { send_msg } [ ]"
rlSESearchRule "allow iiosensorproxy_t xdm_t : dbus { send_msg } [ ]"
+ rlSESearchRule "allow iiosensorproxy_t iiosensorproxy_t : capability2 { bpf } [ ]"
rlPhaseEnd
+ fi
+ if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then
rlPhaseStartTest "real scenario -- standalone service"
rlRun "sed -i 's/^.*Environment=.*$/Environment=FAKE_COMPASS=1/' /usr/lib/systemd/system/iio-sensor-proxy.service"
rlRun "systemctl daemon-reload"
@@ -82,6 +87,7 @@ rlJournalStart
rlWatchdog "monitor-sensor --all" 10
rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "stop status" 1
rlPhaseEnd
+ fi
rlPhaseStartCleanup
sleep 2
diff --git a/selinux-policy/power-profiles-daemon-and-similar/runtest.sh b/selinux-policy/power-profiles-daemon-and-similar/runtest.sh
index 72e5ea4..ee54652 100755
--- a/selinux-policy/power-profiles-daemon-and-similar/runtest.sh
+++ b/selinux-policy/power-profiles-daemon-and-similar/runtest.sh
@@ -63,6 +63,14 @@ rlJournalStart
sleep 2
rlPhaseEnd
+ if rlIsRHEL 9 || rlIsCentOS 9 ; then
+ rlPhaseStartTest "RHEL-61117"
+ rlSEMatchPathCon ${FILE_PATH} ${FILE_CONTEXT}
+ rlSESearchRule "allow powerprofiles_t powerprofiles_t : capability2 { bpf } [ ]"
+ rlPhaseEnd
+ fi
+
+ if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then
rlPhaseStartTest "real scenario -- standalone service"
rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1
rlRun "powerprofilesctl list"
@@ -75,6 +83,7 @@ rlJournalStart
rlRun "powerprofilesctl launch echo" 0,1
rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "stop status" 1
rlPhaseEnd
+ fi
rlPhaseStartCleanup
sleep 2
diff --git a/selinux-policy/samba-bgqd-and-similar/runtest.sh b/selinux-policy/samba-bgqd-and-similar/runtest.sh
index 476534d..df5195b 100755
--- a/selinux-policy/samba-bgqd-and-similar/runtest.sh
+++ b/selinux-policy/samba-bgqd-and-similar/runtest.sh
@@ -89,6 +89,7 @@ rlJournalStart
rlPhaseEnd
fi
+ if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then
rlPhaseStartTest "real scenario"
rlRun "service cups start"
USER_NAME="smbuser${RANDOM}"
@@ -108,6 +109,7 @@ rlJournalStart
rlRun "userdel -rf ${USER_NAME}"
rlRun "service cups stop"
rlPhaseEnd
+ fi
rlPhaseStartCleanup
sleep 2
diff --git a/selinux-policy/switcheroo-control-and-similar/runtest.sh b/selinux-policy/switcheroo-control-and-similar/runtest.sh
index c1d2100..243d0ee 100755
--- a/selinux-policy/switcheroo-control-and-similar/runtest.sh
+++ b/selinux-policy/switcheroo-control-and-similar/runtest.sh
@@ -35,8 +35,8 @@ SERVICE_PACKAGE="switcheroo-control"
SERVICE_NAME="switcheroo-control"
PROCESS_NAME="switcheroo-control"
if seinfo -t | grep -q switcheroo ; then
- PROCESS_CONTEXT="switcheroo_t"
- FILE_CONTEXT="switcheroo_exec_t"
+ PROCESS_CONTEXT="switcheroo_control_t"
+ FILE_CONTEXT="switcheroo_control_exec_t"
else
PROCESS_CONTEXT="unconfined_service_t"
FILE_CONTEXT="bin_t"
@@ -58,6 +58,29 @@ rlJournalStart
sleep 2
rlPhaseEnd
+ if seinfo -t | grep -q switcheroo ; then
+ rlPhaseStartTest "RHEL-24268"
+ rlSEMatchPathCon ${FILE_PATH} ${FILE_CONTEXT}
+ rlSEMatchPathCon "/run/udev/" "udev_var_run_t"
+ rlSEMatchPathCon "/run/dbus/" "system_dbusd_var_run_t"
+ rlSEMatchPathCon "/run/dbus/system_bus_socket" "system_dbusd_var_run_t"
+ rlSESearchRule "allow switcheroo_control_t udev_var_run_t : dir { search } [ ]"
+ rlSESearchRule "allow switcheroo_control_t switcheroo_control_t : netlink_kobject_uevent_socket { create setopt bind getattr } [ ]"
+ rlSESearchRule "allow switcheroo_control_t switcheroo_control_t : capability2 { bpf } [ ]"
+ rlSESearchRule "allow switcheroo_control_t sysfs_t : dir { read } [ ]"
+ rlSESearchRule "allow switcheroo_control_t sysfs_t : lnk_file { getattr read } [ ]"
+ rlSESearchRule "allow switcheroo_control_t sysfs_t : file { getattr open read } [ ]"
+ rlSESearchRule "allow switcheroo_control_t system_dbusd_t : unix_stream_socket { connectto } [ ]"
+ rlSESearchRule "allow switcheroo_control_t system_dbusd_var_run_t : sock_file { write } [ ]"
+ rlSESearchRule "allow switcheroo_control_t system_dbusd_var_run_t : dir { search } [ ]"
+ rlSESearchRule "allow switcheroo_control_t system_dbusd_t : dbus { acquire_svc send_msg } [ ]"
+ rlSESearchRule "allow system_dbusd_t switcheroo_control_t : dbus { send_msg } [ ]"
+ rlSESearchRule "allow unconfined_t switcheroo_control_t : dbus { send_msg } [ ]"
+ rlSESearchRule "allow switcheroo_control_t unconfined_t : dbus { send_msg } [ ]"
+ rlPhaseEnd
+ fi
+
+ if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then
rlPhaseStartTest "real scenario -- standalone service"
rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1
rlRun "switcherooctl version"
@@ -69,6 +92,7 @@ rlJournalStart
rlRun "rm -f ./empty-file"
rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "stop status" 1
rlPhaseEnd
+ fi
rlPhaseStartCleanup
sleep 2
diff --git a/selinux-policy/systemd-journal-upload/Makefile b/selinux-policy/systemd-journal-upload/Makefile
index 71c64ef..2ede7ea 100644
--- a/selinux-policy/systemd-journal-upload/Makefile
+++ b/selinux-policy/systemd-journal-upload/Makefile
@@ -63,7 +63,8 @@ $(METADATA): Makefile
@echo "Destructive: no" >> $(METADATA)
@echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA)
@echo "Releases: -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA)
- @echo "Bug: RHEL-57774" >> $(METADATA) # RHEL-9
+ @echo "Bug: RHEL-57774" >> $(METADATA) # RHEL-10
+ @echo "Bug: RHEL-62196" >> $(METADATA) # RHEL-9
rhts-lint $(METADATA)
diff --git a/selinux-policy/systemd-journal-upload/main.fmf b/selinux-policy/systemd-journal-upload/main.fmf
index 2771cd6..a134969 100644
--- a/selinux-policy/systemd-journal-upload/main.fmf
+++ b/selinux-policy/systemd-journal-upload/main.fmf
@@ -29,6 +29,7 @@ tag:
- NoRHIVOS
link:
- verifies: https://issues.redhat.com/browse/RHEL-57774
+ - verifies: https://issues.redhat.com/browse/RHEL-62196
adjust:
- enabled: false
when: distro == rhel-4, rhel-5, rhel-6, rhel-7
diff --git a/selinux-policy/systemd-journal-upload/runtest.sh b/selinux-policy/systemd-journal-upload/runtest.sh
index 4c1a71f..09a627e 100755
--- a/selinux-policy/systemd-journal-upload/runtest.sh
+++ b/selinux-policy/systemd-journal-upload/runtest.sh
@@ -23,12 +23,15 @@ rlJournalStart
sleep 2
rlPhaseEnd
- rlPhaseStartTest "RHEL-57774"
+ if seinfo -t | grep -q ${PROCESS_CONTEXT} ; then
+ rlPhaseStartTest "RHEL-57774 + RHEL-62196"
rlSEMatchPathCon "/usr/lib/systemd/systemd-journal-upload" "systemd_journal_upload_exec_t"
rlSEMatchPathCon "/run/systemd/journal-upload.conf.d" "systemd_conf_t"
rlSESearchRule "allow systemd_journal_upload_t systemd_conf_t : dir { read } [ ]"
rlPhaseEnd
+ fi
+ if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then
rlPhaseStartTest "real scenario -- RHEL-57774"
rlRun "mkdir -pZ /run/systemd/journal-upload.conf.d"
rlRun "echo -e '[Upload]\nURL=http://localhost/\n' > /run/systemd/journal-upload.conf.d/test.conf"
@@ -37,6 +40,7 @@ rlJournalStart
rlRun "restorecon -Rv /etc /var /run -e /var/ARTIFACTS" 0-255
rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "stop status" 1
rlPhaseEnd
+ fi
rlPhaseStartCleanup
sleep 2
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2026-09-11 13:22 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-09-11 13:22 [tests/selinux] pr775-checkpolicy-revdeps: update the failing tests with the latest findings Milos Malik
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox