public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
From: Milos Malik <mmalik@redhat.com>
To: git-commits@fedoraproject.org
Subject: [tests/selinux] pr775-checkpolicy-revdeps: adapt to policies with reduced set of types and rules
Date: Fri, 11 Sep 2026 13:23:01 GMT [thread overview]
Message-ID: <178913298104.1.18225104840602965612.tests-selinux-dff2d2b919c1@fedoraproject.org> (raw)
A new commit has been pushed.
Repo : tests/selinux
Branch : pr775-checkpolicy-revdeps
Commit : dff2d2b919c1af94f97c3dd892649cf367c5ac87
Author : Milos Malik <mmalik@redhat.com>
Date : 2025-07-14T10:52:51+00:00
Stats : +21/-11 in 3 file(s)
URL : https://src.fedoraproject.org/tests/selinux/c/dff2d2b919c1af94f97c3dd892649cf367c5ac87?branch=pr775-checkpolicy-revdeps
Log:
adapt to policies with reduced set of types and rules
There are policies which define less types and rules than the targeted
policy. The executed automated tests should adapt if they still make sense.
---
diff --git a/selinux-policy/journalctl-and-similar/runtest.sh b/selinux-policy/journalctl-and-similar/runtest.sh
index 4f5a7f3..87426c5 100755
--- a/selinux-policy/journalctl-and-similar/runtest.sh
+++ b/selinux-policy/journalctl-and-similar/runtest.sh
@@ -62,15 +62,21 @@ rlJournalStart
rlPhaseStartTest "bz#1288255"
rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}"
- rlSESearchRule "allow staff_t ${FILE_CONTEXT} : file { getattr open read execute } [ ]"
- rlSESearchRule "allow sysadm_t ${FILE_CONTEXT} : file { getattr open read execute } [ ]"
- rlSESearchRule "allow user_t ${FILE_CONTEXT} : file { getattr open read execute } [ ]"
- rlSESearchRule "allow staff_t ${PROCESS_CONTEXT} : process { transition } [ ]"
- rlSESearchRule "allow sysadm_t ${PROCESS_CONTEXT} : process { transition } [ ]"
- rlSESearchRule "allow user_t ${PROCESS_CONTEXT} : process { transition } [ ]"
- rlSESearchRule "type_transition staff_t ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} [ ]"
- rlSESearchRule "type_transition sysadm_t ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} [ ]"
- rlSESearchRule "type_transition user_t ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} [ ]"
+ if rlSEDefined "staff_t" ; then
+ rlSESearchRule "allow staff_t ${FILE_CONTEXT} : file { getattr open read execute } [ ]"
+ rlSESearchRule "allow staff_t ${PROCESS_CONTEXT} : process { transition } [ ]"
+ rlSESearchRule "type_transition staff_t ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} [ ]"
+ fi
+ if rlSEDefined "sysadm_t" ; then
+ rlSESearchRule "allow sysadm_t ${FILE_CONTEXT} : file { getattr open read execute } [ ]"
+ rlSESearchRule "allow sysadm_t ${PROCESS_CONTEXT} : process { transition } [ ]"
+ rlSESearchRule "type_transition sysadm_t ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} [ ]"
+ fi
+ if rlSEDefined "user_t" ; then
+ rlSESearchRule "allow user_t ${FILE_CONTEXT} : file { getattr open read execute } [ ]"
+ rlSESearchRule "allow user_t ${PROCESS_CONTEXT} : process { transition } [ ]"
+ rlSESearchRule "type_transition user_t ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} [ ]"
+ fi
rlPhaseEnd
rlPhaseStartTest "bz#1685689"
@@ -90,7 +96,7 @@ rlJournalStart
rlSESearchRule "allow journalctl_t journalctl_t : process { setrlimit } [ ]"
rlPhaseEnd
- if ! rlIsFedora ; then
+ if ! rlIsFedora && rlSEDefined "user_t" ; then
rlPhaseStartTest "bz#2017838"
rlSEMatchPathCon "/run/log/journal/somehash/system.journal" "syslogd_var_run_t"
rlSEMatchPathCon "/var/lib/systemd/catalog/database" "init_var_lib_t"
diff --git a/selinux-policy/systemd-run-and-similar/runtest.sh b/selinux-policy/systemd-run-and-similar/runtest.sh
index 38b0fa4..e4a4fee 100755
--- a/selinux-policy/systemd-run-and-similar/runtest.sh
+++ b/selinux-policy/systemd-run-and-similar/runtest.sh
@@ -69,9 +69,11 @@ rlJournalStart
rlSEMatchPathCon "/var/lib" "var_lib_t"
rlSEMatchPathCon "/var/lib/myservice0" "var_lib_t"
rlSESearchRule "allow init_t var_lib_t : lnk_file { getattr read } [ ]"
+ rlRun "setsebool daemons_use_tty on"
rlRun "systemd-run -p DynamicUser=yes -p StateDirectory=myservice0 touch /var/lib/myservice0/foo"
rlRun "systemd-run -p DynamicUser=yes -p StateDirectory=myservice0 --pipe wc -c /var/lib/myservice0/foo"
rlRun "ls -alZ /var/lib/myservice0 /var/lib/private/myservice0"
+ rlRun "setsebool daemons_use_tty off"
rlPhaseEnd
if ! rlIsRHEL "<9.7" ; then
diff --git a/selinux-policy/systemd-tmpfiles-and-similar/runtest.sh b/selinux-policy/systemd-tmpfiles-and-similar/runtest.sh
index 7f2e944..6c28056 100755
--- a/selinux-policy/systemd-tmpfiles-and-similar/runtest.sh
+++ b/selinux-policy/systemd-tmpfiles-and-similar/runtest.sh
@@ -51,7 +51,9 @@ rlJournalStart
rlPhaseStartTest "RHEL-40374 + RHEL-44191"
rlSEMatchPathCon "/usr/bin/systemd-tmpfiles" "systemd_tmpfiles_exec_t"
- rlSESearchRule "allow staff_t systemd_tmpfiles_exec_t : file { getattr open read map execute execute_no_trans } [ ]"
+ if rlSEDefined "staff_t" ; then
+ rlSESearchRule "allow staff_t systemd_tmpfiles_exec_t : file { getattr open read map execute execute_no_trans } [ ]"
+ fi
rlRun "setsebool ssh_sysadm_login on"
CREATED_USERS=""
for SELINUX_USER in ${ALLOWED_USERS} ; do
reply other threads:[~2026-09-11 13:23 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=178913298104.1.18225104840602965612.tests-selinux-dff2d2b919c1@fedoraproject.org \
--to=mmalik@redhat.com \
--cc=git-commits@fedoraproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox