public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
From: Jan Onderka <jonderka@redhat.com>
To: git-commits@fedoraproject.org
Subject: [tests/selinux] pr775-checkpolicy-revdeps: Metadata update of PURPOSE files with expected inputs and outputs
Date: Fri, 11 Sep 2026 13:22:27 GMT [thread overview]
Message-ID: <178913294794.1.11772133741764992231.tests-selinux-5a9000d76f96@fedoraproject.org> (raw)
A new commit has been pushed.
Repo : tests/selinux
Branch : pr775-checkpolicy-revdeps
Commit : 5a9000d76f96c0b8c256cd9bbca40f816c0e402d
Author : Jan Onderka <jonderka@redhat.com>
Date : 2025-03-17T15:21:56+01:00
Stats : +335/-0 in 6 file(s)
URL : https://src.fedoraproject.org/tests/selinux/c/5a9000d76f96c0b8c256cd9bbca40f816c0e402d?branch=pr775-checkpolicy-revdeps
Log:
Metadata update of PURPOSE files with expected inputs and outputs
---
diff --git a/libselinux/realpath_not_final-function/PURPOSE b/libselinux/realpath_not_final-function/PURPOSE
index 8305d70..8fcf56a 100644
--- a/libselinux/realpath_not_final-function/PURPOSE
+++ b/libselinux/realpath_not_final-function/PURPOSE
@@ -1,3 +1,61 @@
PURPOSE of /CoreOS/libselinux/Sanity/realpath_not_final-function
Description: Test realpath_not_final function
Author: Jan Zarsky <jzarsky@redhat.com>
+
+Inputs
+
+compiled C source code
+
+Outputs
+
+Test passes or fail based on log file content
+
+Expected log output example
+
+::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
+:: Test
+::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
+
+:: [ 06:17:21 ] :: [ BEGIN ] :: Running './test NULL'
+/usr/share/beakerlib/testing.sh: line 896: 39526 Segmentation fault (core dumped) ./test NULL
+:: [ 06:17:22 ] :: [ PASS ] :: Command './test NULL' (Expected 139, got 139)
+:: [ 06:17:22 ] :: [ BEGIN ] :: Running './test /somedir/somefile NULL'
+symlink_realpath(/somedir/somefile) realpath() failed: No such file or directory
+Executing: realpath_not_final(/somedir/somefile, resolved_path)
+realpath_not_final: /somedir
+:: [ 06:17:22 ] :: [ PASS ] :: Command './test /somedir/somefile NULL' (Expected 255, got 255)
+:: [ 06:17:22 ] :: [ BEGIN ] :: Running './test NULL NULL'
+/usr/share/beakerlib/testing.sh: line 896: 39584 Segmentation fault (core dumped) ./test NULL NULL
+:: [ 06:17:23 ] :: [ PASS ] :: Command './test NULL NULL' (Expected 139, got 139)
+:: [ 06:17:23 ] :: [ BEGIN ] :: Running './test /tmp | tee output'
+Executing: realpath_not_final(/tmp, resolved_path)
+realpath_not_final: /tmp
+:: [ 06:17:23 ] :: [ PASS ] :: Command './test /tmp | tee output' (Expected 0, got 0)
+:: [ 06:17:23 ] :: [ BEGIN ] :: Running 'grep 'realpath_not_final: /tmp' output'
+realpath_not_final: /tmp
+:: [ 06:17:23 ] :: [ PASS ] :: Command 'grep 'realpath_not_final: /tmp' output' (Expected 0, got 0)
+:: [ 06:17:24 ] :: [ BEGIN ] :: Running './test //tmp | tee output'
+Executing: realpath_not_final(//tmp, resolved_path)
+realpath_not_final: //tmp
+:: [ 06:17:24 ] :: [ PASS ] :: Command './test //tmp | tee output' (Expected 0, got 0)
+:: [ 06:17:24 ] :: [ BEGIN ] :: Running 'grep -E 'realpath_not_final: /tmp|realpath_not_final: //tmp' output'
+realpath_not_final: //tmp
+:: [ 06:17:24 ] :: [ PASS ] :: Command 'grep -E 'realpath_not_final: /tmp|realpath_not_final: //tmp' output' (Expected 0, got 0)
+:: [ 06:17:24 ] :: [ BEGIN ] :: Running './test ///tmp | tee output'
+Executing: realpath_not_final(///tmp, resolved_path)
+realpath_not_final: //tmp
+:: [ 06:17:24 ] :: [ PASS ] :: Command './test ///tmp | tee output' (Expected 0, got 0)
+:: [ 06:17:24 ] :: [ BEGIN ] :: Running 'grep -E 'realpath_not_final: /tmp|realpath_not_final: //tmp' output'
+realpath_not_final: //tmp
+:: [ 06:17:24 ] :: [ PASS ] :: Command 'grep -E 'realpath_not_final: /tmp|realpath_not_final: //tmp' output' (Expected 0, got 0)
+:: [ 06:17:24 ] :: [ BEGIN ] :: Running './test ////tmp | tee output'
+Executing: realpath_not_final(////tmp, resolved_path)
+realpath_not_final: //tmp
+:: [ 06:17:24 ] :: [ PASS ] :: Command './test ////tmp | tee output' (Expected 0, got 0)
+:: [ 06:17:24 ] :: [ BEGIN ] :: Running 'grep -E 'realpath_not_final: /tmp|realpath_not_final: //tmp' output'
+realpath_not_final: //tmp
+:: [ 06:17:24 ] :: [ PASS ] :: Command 'grep -E 'realpath_not_final: /tmp|realpath_not_final: //tmp' output' (Expected 0, got 0)
+::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
+:: Duration: 3s
+:: Assertions: 11 good, 0 bad
+:: RESULT: PASS (Test)
diff --git a/libselinux/selabel-functions/PURPOSE b/libselinux/selabel-functions/PURPOSE
index aa07643..d718413 100644
--- a/libselinux/selabel-functions/PURPOSE
+++ b/libselinux/selabel-functions/PURPOSE
@@ -1,3 +1,73 @@
PURPOSE of /CoreOS/libselinux/Sanity/selabel-functions
Description: Test selabel functions
Author: Jan Zarsky <jzarsky@redhat.com>
+
+Inputs
+
+compiled C source code
+
+Outputs
+
+Test passes or fail based on log file content
+
+Expected log output example
+
+::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
+:: selabel_lookup and selabel_lookup_raw
+::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
+
+:: [ 06:17:59 ] :: [ INFO ] :: Handle
+:: [ 06:17:59 ] :: [ BEGIN ] :: Running './test_lookup CTX_FILE NULL NULL 0 0 some_input 0 nohandle'
+/usr/share/beakerlib/testing.sh: line 896: 45881 Segmentation fault (core dumped) ./test_lookup CTX_FILE NULL NULL 0 0 some_input 0 nohandle
+:: [ 06:18:00 ] :: [ PASS ] :: Command './test_lookup CTX_FILE NULL NULL 0 0 some_input 0 nohandle' (Expected 139, got 139)
+:: [ 06:18:00 ] :: [ BEGIN ] :: Running './test_lookup CTX_MEDIA NULL NULL 0 0 some_input 0 nohandle'
+/usr/share/beakerlib/testing.sh: line 896: 45913 Segmentation fault (core dumped) ./test_lookup CTX_MEDIA NULL NULL 0 0 some_input 0 nohandle
+:: [ 06:18:01 ] :: [ PASS ] :: Command './test_lookup CTX_MEDIA NULL NULL 0 0 some_input 0 nohandle' (Expected 139, got 139)
+:: [ 06:18:02 ] :: [ BEGIN ] :: Running './test_lookup CTX_X NULL NULL 0 0 some_input 0 nohandle'
+/usr/share/beakerlib/testing.sh: line 896: 45945 Segmentation fault (core dumped) ./test_lookup CTX_X NULL NULL 0 0 some_input 0 nohandle
+:: [ 06:18:03 ] :: [ PASS ] :: Command './test_lookup CTX_X NULL NULL 0 0 some_input 0 nohandle' (Expected 139, got 139)
+:: [ 06:18:03 ] :: [ BEGIN ] :: Running './test_lookup CTX_DB NULL NULL 0 0 some_input 0 nohandle'
+/usr/share/beakerlib/testing.sh: line 896: 45977 Segmentation fault (core dumped) ./test_lookup CTX_DB NULL NULL 0 0 some_input 0 nohandle
+:: [ 06:18:04 ] :: [ PASS ] :: Command './test_lookup CTX_DB NULL NULL 0 0 some_input 0 nohandle' (Expected 139, got 139)
+:: [ 06:18:04 ] :: [ INFO ] :: Path
+:: [ 06:18:05 ] :: [ BEGIN ] :: Running './test_lookup CTX_FILE NULL NULL 0 0 NULL 0'
+selabel_lookup - ERROR: Invalid argument
+selabel_lookup_raw - ERROR: Invalid argument
+selabel_options: SELABEL_OPT_PATH = (null), SELABEL_OPT_SUBSET = (null), SELABEL_OPT_VALIDATE = 0, SELABEL_OPT_BASEONLY = 0
+Executing: selabel_open(SELABEL_CTX_FILE, &selabel_option, 4)
+Executing: selabel_lookup(hnd, &selabel_context, (null), 0)
+Executing: selabel_lookup_raw(hnd, &selabel_context, (null), 0)
+:: [ 06:18:05 ] :: [ PASS ] :: Command './test_lookup CTX_FILE NULL NULL 0 0 NULL 0' (Expected 22, got 22)
+:: [ 06:18:05 ] :: [ BEGIN ] :: Running './test_lookup CTX_MEDIA NULL NULL 0 0 NULL 0'
+selabel_lookup - ERROR: Invalid argument
+selabel_lookup_raw - ERROR: Invalid argument
+selabel_options: SELABEL_OPT_PATH = (null), SELABEL_OPT_SUBSET = (null), SELABEL_OPT_VALIDATE = 0, SELABEL_OPT_BASEONLY = 0
+Executing: selabel_open(SELABEL_CTX_MEDIA, &selabel_option, 4)
+Executing: selabel_lookup(hnd, &selabel_context, (null), 0)
+Executing: selabel_lookup_raw(hnd, &selabel_context, (null), 0)
+:: [ 06:18:05 ] :: [ PASS ] :: Command './test_lookup CTX_MEDIA NULL NULL 0 0 NULL 0' (Expected 22, got 22)
+:: [ 06:18:05 ] :: [ BEGIN ] :: Running './test_lookup CTX_X NULL NULL 0 0 NULL 0'
+selabel_lookup - ERROR: Invalid argument
+selabel_lookup_raw - ERROR: Invalid argument
+selabel_options: SELABEL_OPT_PATH = (null), SELABEL_OPT_SUBSET = (null), SELABEL_OPT_VALIDATE = 0, SELABEL_OPT_BASEONLY = 0
+Executing: selabel_open(SELABEL_CTX_X, &selabel_option, 4)
+Executing: selabel_lookup(hnd, &selabel_context, (null), 0)
+Executing: selabel_lookup_raw(hnd, &selabel_context, (null), 0)
+:: [ 06:18:05 ] :: [ PASS ] :: Command './test_lookup CTX_X NULL NULL 0 0 NULL 0' (Expected 22, got 22)
+:: [ 06:18:05 ] :: [ BEGIN ] :: Running './test_lookup CTX_DB NULL NULL 0 0 NULL 0'
+selabel_lookup - ERROR: Invalid argument
+selabel_lookup_raw - ERROR: Invalid argument
+selabel_options: SELABEL_OPT_PATH = (null), SELABEL_OPT_SUBSET = (null), SELABEL_OPT_VALIDATE = 0, SELABEL_OPT_BASEONLY = 0
+Executing: selabel_open(SELABEL_CTX_DB, &selabel_option, 4)
+Executing: selabel_lookup(hnd, &selabel_context, (null), 0)
+Executing: selabel_lookup_raw(hnd, &selabel_context, (null), 0)
+:: [ 06:18:05 ] :: [ PASS ] :: Command './test_lookup CTX_DB NULL NULL 0 0 NULL 0' (Expected 22, got 22)
+:: [ 06:18:05 ] :: [ BEGIN ] :: Running './test_lookup CTX_ANDROID_PROP NULL NULL 0 0 NULL 0'
+selabel_open - ERROR: Operation not supported
+selabel_options: SELABEL_OPT_PATH = (null), SELABEL_OPT_SUBSET = (null), SELABEL_OPT_VALIDATE = 0, SELABEL_OPT_BASEONLY = 0
+Executing: selabel_open(SELABEL_CTX_ANDROID_PROP, &selabel_option, 4)
+:: [ 06:18:05 ] :: [ PASS ] :: Command './test_lookup CTX_ANDROID_PROP NULL NULL 0 0 NULL 0' (Expected 255, got 255)
+::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
+:: Duration: 6s
+:: Assertions: 9 good, 0 bad
+:: RESULT: PASS (selabel_lookup and selabel_lookup_raw)
diff --git a/libselinux/selinux_boolean_sub-function/PURPOSE b/libselinux/selinux_boolean_sub-function/PURPOSE
index 289e8e7..a34845b 100644
--- a/libselinux/selinux_boolean_sub-function/PURPOSE
+++ b/libselinux/selinux_boolean_sub-function/PURPOSE
@@ -1,3 +1,57 @@
PURPOSE of /CoreOS/libselinux/Sanity/selinux_boolean_sub-function
Description: Test selinux_boolean_sub function
Author: Jan Zarsky <jzarsky@redhat.com>
+
+Inputs
+
+compiled C source code
+
+Outputs
+
+Test passes or fail based on log file content
+
+Expected log output example
+
+::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
+:: Test
+::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
+
+:: [ 06:19:03 ] :: [ BEGIN ] :: Running './test NULL | tee output'
+Executing: selinux_boolean_sub((null))
+selinux_boolean_sub: (null)
+:: [ 06:19:04 ] :: [ PASS ] :: Command './test NULL | tee output' (Expected 0, got 0)
+:: [ 06:19:04 ] :: [ BEGIN ] :: Running 'grep 'selinux_boolean_sub: (null)' output'
+selinux_boolean_sub: (null)
+:: [ 06:19:04 ] :: [ PASS ] :: Command 'grep 'selinux_boolean_sub: (null)' output' (Expected 0, got 0)
+:: [ 06:19:04 ] :: [ BEGIN ] :: Running './test my_nonexisting_record | tee output'
+Executing: selinux_boolean_sub(my_nonexisting_record)
+selinux_boolean_sub: my_nonexisting_record
+:: [ 06:19:04 ] :: [ PASS ] :: Command './test my_nonexisting_record | tee output' (Expected 0, got 0)
+:: [ 06:19:04 ] :: [ BEGIN ] :: Running 'grep 'selinux_boolean_sub: my_nonexisting_record' output'
+selinux_boolean_sub: my_nonexisting_record
+:: [ 06:19:04 ] :: [ PASS ] :: Command 'grep 'selinux_boolean_sub: my_nonexisting_record' output' (Expected 0, got 0)
+:: [ 06:19:04 ] :: [ BEGIN ] :: Running './test allow_auditadm_exec_content | tee output'
+Executing: selinux_boolean_sub(allow_auditadm_exec_content)
+selinux_boolean_sub: auditadm_exec_content
+:: [ 06:19:04 ] :: [ PASS ] :: Command './test allow_auditadm_exec_content | tee output' (Expected 0, got 0)
+:: [ 06:19:04 ] :: [ BEGIN ] :: Running 'grep 'selinux_boolean_sub: auditadm_exec_content' output'
+selinux_boolean_sub: auditadm_exec_content
+:: [ 06:19:04 ] :: [ PASS ] :: Command 'grep 'selinux_boolean_sub: auditadm_exec_content' output' (Expected 0, got 0)
+:: [ 06:19:04 ] :: [ BEGIN ] :: Running './test allow_domain_fd_use | tee output'
+Executing: selinux_boolean_sub(allow_domain_fd_use)
+selinux_boolean_sub: domain_fd_use
+:: [ 06:19:04 ] :: [ PASS ] :: Command './test allow_domain_fd_use | tee output' (Expected 0, got 0)
+:: [ 06:19:04 ] :: [ BEGIN ] :: Running 'grep 'selinux_boolean_sub: domain_fd_use' output'
+selinux_boolean_sub: domain_fd_use
+:: [ 06:19:04 ] :: [ PASS ] :: Command 'grep 'selinux_boolean_sub: domain_fd_use' output' (Expected 0, got 0)
+:: [ 06:19:04 ] :: [ BEGIN ] :: Running './test virt_sandbox_use_nfs | tee output'
+Executing: selinux_boolean_sub(virt_sandbox_use_nfs)
+selinux_boolean_sub: virt_use_nfs
+:: [ 06:19:04 ] :: [ PASS ] :: Command './test virt_sandbox_use_nfs | tee output' (Expected 0, got 0)
+:: [ 06:19:05 ] :: [ BEGIN ] :: Running 'grep 'selinux_boolean_sub: virt_use_nfs' output'
+selinux_boolean_sub: virt_use_nfs
+:: [ 06:19:05 ] :: [ PASS ] :: Command 'grep 'selinux_boolean_sub: virt_use_nfs' output' (Expected 0, got 0)
+::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
+:: Duration: 2s
+:: Assertions: 10 good, 0 bad
+:: RESULT: PASS (Test)
diff --git a/libselinux/selinux_restorecon-functions/PURPOSE b/libselinux/selinux_restorecon-functions/PURPOSE
index 8a2f7ba..a51df62 100644
--- a/libselinux/selinux_restorecon-functions/PURPOSE
+++ b/libselinux/selinux_restorecon-functions/PURPOSE
@@ -1,3 +1,40 @@
PURPOSE of /CoreOS/libselinux/Sanity/selinux_restorecon-functions
Description: Test functions in selinux_restorecon.c
Author: Jan Zarsky <jzarsky@redhat.com>
+
+Inputs
+
+compiled C source code
+
+Outputs
+
+Test passes or fail based on log files content
+
+Expected log output example
+
+::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
+:: /sys directory
+::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
+
+:: [ 06:19:36 ] :: [ BEGIN ] :: Calling selinux_restorecon on /tmp :: actually running 'strace -ostrace.out -s 64 ./test_restorecon /var/log RECURSE NOCHANGE'
+Running selinux_restorecon("/var/log", 0x00000a);
+:: [ 06:19:36 ] :: [ PASS ] :: Calling selinux_restorecon on /tmp (Expected 0, got 0)
+:: [ 06:19:37 ] :: [ BEGIN ] :: Running 'grep -E "security\.(restorecon_last|sehash)" strace.out'
+getxattr("/var/log", "security.sehash", 0xffffd9c79128, 32) = -1 ENODATA (No data available)
+getxattr("/var/log/journal", "security.sehash", 0xffffd9c79128, 32) = -1 ENODATA (No data available)
+getxattr("/var/log/journal/9f26e28ec0b04e2bbb812e4227ff5bb3", "security.sehash", 0xffffd9c79128, 32) = -1 ENODATA (No data available)
+getxattr("/var/log/chrony", "security.sehash", 0xffffd9c79128, 32) = -1 ENODATA (No data available)
+getxattr("/var/log/private", "security.sehash", 0xffffd9c79128, 32) = -1 ENODATA (No data available)
+getxattr("/var/log/audit", "security.sehash", 0xffffd9c79128, 32) = -1 ENODATA (No data available)
+:: [ 06:19:37 ] :: [ PASS ] :: Command 'grep -E "security\.(restorecon_last|sehash)" strace.out' (Expected 0, got 0)
+:: [ 06:19:37 ] :: [ BEGIN ] :: Calling selinux_restorecon on /sys :: actually running 'strace -ostrace.out -s 64 ./test_restorecon /sys RECURSE NOCHANGE'
+Running selinux_restorecon("/sys", 0x00000a);
+:: [ 06:19:55 ] :: [ PASS ] :: Calling selinux_restorecon on /sys (Expected 0, got 0)
+:: [ 06:19:55 ] :: [ BEGIN ] :: Running 'grep -E "security\.(restorecon_last|sehash)" strace.out'
+:: [ 06:19:55 ] :: [ PASS ] :: Command 'grep -E "security\.(restorecon_last|sehash)" strace.out' (Expected 1, got 1)
+:: [ 06:19:55 ] :: [ BEGIN ] :: Running 'rm -f strace.out'
+:: [ 06:19:55 ] :: [ PASS ] :: Command 'rm -f strace.out' (Expected 0, got 0)
+::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
+:: Duration: 19s
+:: Assertions: 5 good, 0 bad
+:: RESULT: PASS (/sys directory)
diff --git a/libselinux/selinux_sestatus-functions/PURPOSE b/libselinux/selinux_sestatus-functions/PURPOSE
index c638364..26011d7 100644
--- a/libselinux/selinux_sestatus-functions/PURPOSE
+++ b/libselinux/selinux_sestatus-functions/PURPOSE
@@ -1,3 +1,79 @@
PURPOSE of /CoreOS/libselinux/Sanity/selinux_sestatus-functions
Description: Test sestatus.c functions
Author: Jan Zarsky <jzarsky@redhat.com>
+
+Inputs
+
+compiled C source code
+
+Outputs
+
+Test passes or fail based on res.txt file content
+
+Expected log output example
+
+::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
+:: Test
+::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
+
+:: [ 06:20:25 ] :: [ BEGIN ] :: Running './test > res.txt'
+:: [ 06:20:25 ] :: [ PASS ] :: Command './test > res.txt' (Expected 0, got 0)
+:: [ 06:20:25 ] :: [ BEGIN ] :: Running 'cat res.txt'
+(before open) selinux_status_getenforce -1
+(before open) selinux_status_policyload -1
+(before open) selinux_status_deny_unknown -1
+(before open) selinux_status_updated -1
+selinux_status_open 0
+selinux_status_getenforce 1
+selinux_status_policyload 7
+selinux_status_deny_unknown 0
+selinux_status_updated 0
+selinux_status_close void
+:: [ 06:20:26 ] :: [ LOG ] :: Output of 'cat res.txt':
+:: [ 06:20:26 ] :: [ LOG ] :: --------------- OUTPUT START ---------------
+:: [ 06:20:26 ] :: [ LOG ] :: (before open) selinux_status_getenforce -1
+:: [ 06:20:26 ] :: [ LOG ] :: (before open) selinux_status_policyload -1
+:: [ 06:20:26 ] :: [ LOG ] :: (before open) selinux_status_deny_unknown -1
+:: [ 06:20:26 ] :: [ LOG ] :: (before open) selinux_status_updated -1
+:: [ 06:20:26 ] :: [ LOG ] :: selinux_status_open 0
+:: [ 06:20:26 ] :: [ LOG ] :: selinux_status_getenforce 1
+:: [ 06:20:26 ] :: [ LOG ] :: selinux_status_policyload 7
+:: [ 06:20:26 ] :: [ LOG ] :: selinux_status_deny_unknown 0
+:: [ 06:20:26 ] :: [ LOG ] :: selinux_status_updated 0
+:: [ 06:20:26 ] :: [ LOG ] :: selinux_status_close void
+:: [ 06:20:26 ] :: [ LOG ] :: --------------- OUTPUT END ---------------
+:: [ 06:20:26 ] :: [ PASS ] :: Command 'cat res.txt' (Expected 0, got 0)
+:: [ 06:20:26 ] :: [ BEGIN ] :: Running 'grep "(before open) selinux_status_getenforce -1" res.txt'
+(before open) selinux_status_getenforce -1
+:: [ 06:20:26 ] :: [ PASS ] :: Command 'grep "(before open) selinux_status_getenforce -1" res.txt' (Expected 0, got 0)
+:: [ 06:20:26 ] :: [ BEGIN ] :: Running 'grep "(before open) selinux_status_policyload -1" res.txt'
+(before open) selinux_status_policyload -1
+:: [ 06:20:26 ] :: [ PASS ] :: Command 'grep "(before open) selinux_status_policyload -1" res.txt' (Expected 0, got 0)
+:: [ 06:20:26 ] :: [ BEGIN ] :: Running 'grep "(before open) selinux_status_deny_unknown -1" res.txt'
+(before open) selinux_status_deny_unknown -1
+:: [ 06:20:26 ] :: [ PASS ] :: Command 'grep "(before open) selinux_status_deny_unknown -1" res.txt' (Expected 0, got 0)
+:: [ 06:20:26 ] :: [ BEGIN ] :: Running 'grep "(before open) selinux_status_updated -1" res.txt'
+(before open) selinux_status_updated -1
+:: [ 06:20:26 ] :: [ PASS ] :: Command 'grep "(before open) selinux_status_updated -1" res.txt' (Expected 0, got 0)
+:: [ 06:20:26 ] :: [ BEGIN ] :: Running 'grep "selinux_status_open 0" res.txt'
+selinux_status_open 0
+:: [ 06:20:26 ] :: [ PASS ] :: Command 'grep "selinux_status_open 0" res.txt' (Expected 0, got 0)
+:: [ 06:20:26 ] :: [ BEGIN ] :: Running 'grep "selinux_status_getenforce 1" res.txt'
+selinux_status_getenforce 1
+:: [ 06:20:26 ] :: [ PASS ] :: Command 'grep "selinux_status_getenforce 1" res.txt' (Expected 0, got 0)
+:: [ 06:20:27 ] :: [ BEGIN ] :: Running 'grep -E "selinux_status_policyload [0-9]" res.txt'
+selinux_status_policyload 7
+:: [ 06:20:27 ] :: [ PASS ] :: Command 'grep -E "selinux_status_policyload [0-9]" res.txt' (Expected 0, got 0)
+:: [ 06:20:27 ] :: [ BEGIN ] :: Running 'grep "selinux_status_deny_unknown 0" res.txt'
+selinux_status_deny_unknown 0
+:: [ 06:20:27 ] :: [ PASS ] :: Command 'grep "selinux_status_deny_unknown 0" res.txt' (Expected 0, got 0)
+:: [ 06:20:27 ] :: [ BEGIN ] :: Running 'grep "selinux_status_updated 0" res.txt'
+selinux_status_updated 0
+:: [ 06:20:27 ] :: [ PASS ] :: Command 'grep "selinux_status_updated 0" res.txt' (Expected 0, got 0)
+:: [ 06:20:27 ] :: [ BEGIN ] :: Running 'grep "selinux_status_close void" res.txt'
+selinux_status_close void
+:: [ 06:20:27 ] :: [ PASS ] :: Command 'grep "selinux_status_close void" res.txt' (Expected 0, got 0)
+::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
+:: Duration: 2s
+:: Assertions: 12 good, 0 bad
+:: RESULT: PASS (Test)
diff --git a/libselinux/setenforce/PURPOSE b/libselinux/setenforce/PURPOSE
index de8a77e..dd776a1 100644
--- a/libselinux/setenforce/PURPOSE
+++ b/libselinux/setenforce/PURPOSE
@@ -3,3 +3,43 @@ Author: Milos Malik <mmalik@redhat.com>
Does setenforce work as expected? Does it produce correct audit messages?
+Inputs
+
+Various setups related to setenforce
+
+Outputs
+
+Test passes or fail based on ausearch resutls
+
+Expected log output example
+
+::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
+:: basic use
+::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
+
+:: [ 06:20:45 ] :: [ BEGIN ] :: Running 'setenforce 1'
+:: [ 06:20:45 ] :: [ PASS ] :: Command 'setenforce 1' (Expected 0, got 0)
+:: [ 06:20:45 ] :: [ BEGIN ] :: Running 'grep 1 /sys/fs/selinux/enforce'
+1
+:: [ 06:20:45 ] :: [ PASS ] :: Command 'grep 1 /sys/fs/selinux/enforce' (Expected 0, got 0)
+:: [ 06:20:45 ] :: [ BEGIN ] :: Running 'setenforce 0'
+:: [ 06:20:45 ] :: [ PASS ] :: Command 'setenforce 0' (Expected 0, got 0)
+:: [ 06:20:45 ] :: [ BEGIN ] :: Running 'grep 0 /sys/fs/selinux/enforce'
+0
+:: [ 06:20:45 ] :: [ PASS ] :: Command 'grep 0 /sys/fs/selinux/enforce' (Expected 0, got 0)
+:: [ 06:20:45 ] :: [ BEGIN ] :: Running 'setenforce 1'
+:: [ 06:20:46 ] :: [ PASS ] :: Command 'setenforce 1' (Expected 0, got 0)
+:: [ 06:20:51 ] :: [ BEGIN ] :: Running 'ausearch --input-logs -m MAC_STATUS -i -ts 03/10/2025 06:20:44 | grep 'type=MAC_STATUS.*enforcing=1.*old_enforcing=0''
+type=MAC_STATUS msg=audit(03/10/2025 06:20:45.979:2609) : enforcing=1 old_enforcing=0 auid=root ses=10 enabled=1 old-enabled=1 lsm=selinux res=yes
+:: [ 06:20:51 ] :: [ PASS ] :: Command 'ausearch --input-logs -m MAC_STATUS -i -ts 03/10/2025 06:20:44 | grep 'type=MAC_STATUS.*enforcing=1.*old_enforcing=0'' (Expected 0, got 0)
+:: [ 06:20:51 ] :: [ BEGIN ] :: Running 'ausearch --input-logs -m MAC_STATUS -i -ts 03/10/2025 06:20:44 | grep 'type=MAC_STATUS.*enforcing=0.*old_enforcing=1''
+type=MAC_STATUS msg=audit(03/10/2025 06:20:45.759:2608) : enforcing=0 old_enforcing=1 auid=root ses=10 enabled=1 old-enabled=1 lsm=selinux res=yes
+:: [ 06:20:51 ] :: [ PASS ] :: Command 'ausearch --input-logs -m MAC_STATUS -i -ts 03/10/2025 06:20:44 | grep 'type=MAC_STATUS.*enforcing=0.*old_enforcing=1'' (Expected 0, got 0)
+:: [ 06:20:51 ] :: [ BEGIN ] :: Running 'ausearch --input-logs -m MAC_STATUS -i -ts 03/10/2025 06:20:44 | grep 'type=SYSCALL.*comm=setenforce''
+type=SYSCALL msg=audit(03/10/2025 06:20:45.759:2608) : arch=aarch64 syscall=write success=yes exit=1 a0=0x3 a1=0xffffd04eebc0 a2=0x1 a3=0xff78bbc00020 items=0 ppid=75829 pid=79376 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts0 ses=10 comm=setenforce exe=/usr/sbin/setenforce subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+type=SYSCALL msg=audit(03/10/2025 06:20:45.979:2609) : arch=aarch64 syscall=write success=yes exit=1 a0=0x3 a1=0xffffc38319d0 a2=0x1 a3=0xff32e45b8020 items=0 ppid=75829 pid=79426 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts0 ses=10 comm=setenforce exe=/usr/sbin/setenforce subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)
+:: [ 06:20:51 ] :: [ PASS ] :: Command 'ausearch --input-logs -m MAC_STATUS -i -ts 03/10/2025 06:20:44 | grep 'type=SYSCALL.*comm=setenforce'' (Expected 0, got 0)
+::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
+:: Duration: 7s
+:: Assertions: 8 good, 0 bad
+:: RESULT: PASS (basic use)
reply other threads:[~2026-09-11 13:22 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=178913294794.1.11772133741764992231.tests-selinux-5a9000d76f96@fedoraproject.org \
--to=jonderka@redhat.com \
--cc=git-commits@fedoraproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox