[tests/selinux] pr775-checkpolicy-revdeps: fix several failing tests

public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed

From: Milos Malik <mmalik@redhat.com>
To: git-commits@fedoraproject.org
Subject: [tests/selinux] pr775-checkpolicy-revdeps: fix several failing tests
Date: Fri, 11 Sep 2026 13:23:07 GMT	[thread overview]
Message-ID: <178913298733.1.892697430252561095.tests-selinux-7a6077caace6@fedoraproject.org> (raw)

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 7a6077caace65b3b255e78acc616bc4c4ac1be53
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2025-08-26T07:55:35+00:00
            Stats  : +12/-6 in 8 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/7a6077caace65b3b255e78acc616bc4c4ac1be53?branch=pr775-checkpolicy-revdeps

            Log:
            fix several failing tests

Several automated tests were updated, because they were failing on
RHEL-10 machines. The list of reasons follows:
 * incorrect test relevancy
 * unimportant SELinux denials
 * newly defined SELinux labels
 * missing metadata

---
diff --git a/selinux-policy/hostapd-and-similar/runtest.sh b/selinux-policy/hostapd-and-similar/runtest.sh
index aee5619..c36d878 100755
--- a/selinux-policy/hostapd-and-similar/runtest.sh
+++ b/selinux-policy/hostapd-and-similar/runtest.sh
@@ -100,6 +100,7 @@ rlJournalStart
     rlPhaseStartTest "real scenario -- standalone service"
         rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root"
         rlRun "modprobe mac80211_hwsim"
+        rlRun "lsmod | grep mac80211_hwsim"
         rlRun "sed -i 's/^interface=.*$//' /etc/hostapd/hostapd.conf"
         rlRun "sed -i 's/^hw_mode=.*$//' /etc/hostapd/hostapd.conf"
         rlRun "sed -i 's/^channel=.*$//' /etc/hostapd/hostapd.conf"

diff --git a/selinux-policy/iio-sensor-proxy-and-similar/main.fmf b/selinux-policy/iio-sensor-proxy-and-similar/main.fmf
index ad25712..633e118 100644
--- a/selinux-policy/iio-sensor-proxy-and-similar/main.fmf
+++ b/selinux-policy/iio-sensor-proxy-and-similar/main.fmf
@@ -40,6 +40,9 @@ adjust:
   - enabled: false
     when: distro == rhel-4, rhel-5, rhel-6, rhel-7
     because: the iio-sensor-proxy package is not available there
+  - enabled: false
+    when: arch == s390x
+    because: the service is not activatable there
 extra-summary: /CoreOS/selinux-policy/Regression/iio-sensor-proxy-and-similar
 extra-task: /CoreOS/selinux-policy/Regression/iio-sensor-proxy-and-similar
 extra-nitrate: TC#0617897

diff --git a/selinux-policy/pam_limits-and-related/runtest.sh b/selinux-policy/pam_limits-and-related/runtest.sh
index dc56fa8..e788de1 100755
--- a/selinux-policy/pam_limits-and-related/runtest.sh
+++ b/selinux-policy/pam_limits-and-related/runtest.sh
@@ -82,7 +82,7 @@ rlJournalStart
 
     rlPhaseStartCleanup
         sleep 2
-        rlSECheckAVC
+        rlSECheckAVC --ignore 'type=AVC.*connectto.*:guest_t:.*:systemd_machined_t:' --ignore 'type=AVC.*connectto.*:xguest_t:.*:systemd_machined_t:'
 
         rlFileRestore
     rlPhaseEnd

diff --git a/selinux-policy/systemd-generators/runtest.sh b/selinux-policy/systemd-generators/runtest.sh
index 1024c7b..d52e632 100755
--- a/selinux-policy/systemd-generators/runtest.sh
+++ b/selinux-policy/systemd-generators/runtest.sh
@@ -202,7 +202,7 @@ EOF
     rlPhaseStartTest "RHEL-72549"
         rlSEMatchPathCon "/usr/lib/systemd/system-generators/systemd-ssh-generator" "systemd_ssh_generator_exec_t"
         rlSEMatchPathCon "/dev/vsock" "vsock_device_t"
-        rlSEMatchPathCon "/run/systemd/generator/sshd-vsock.socket" "systemd_unit_file_t"
+        rlSEMatchPathCon "/run/systemd/generator/sshd-vsock.socket" "systemd_generator_unit_file_t"
         rlSESearchRule "allow init_t systemd_ssh_generator_exec_t : file { getattr open read execute } [ ]"
         rlSESearchRule "type_transition init_t systemd_ssh_generator_exec_t : process systemd_ssh_generator_t"
         rlSESearchRule "allow systemd_ssh_generator_t vsock_device_t : chr_file { getattr ioctl open read } [ ]"

diff --git a/selinux-policy/systemd-homed/main.fmf b/selinux-policy/systemd-homed/main.fmf
index 25edf64..ef2d162 100644
--- a/selinux-policy/systemd-homed/main.fmf
+++ b/selinux-policy/systemd-homed/main.fmf
@@ -27,7 +27,7 @@ link:
   - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2316163
 adjust:
   - enabled: false
-    when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, rhel-9, centos-stream-8, centos-stream-9
+    when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, rhel-9, centos-stream-8, centos-stream-9, rhel-10, centos-stream-10
     because: the systemd-homed program is not available there
 extra-summary: /CoreOS/selinux-policy/Regression/systemd-homed
 extra-task: /CoreOS/selinux-policy/Regression/systemd-homed

diff --git a/selinux-policy/systemd-userdbd-and-similar/runtest.sh b/selinux-policy/systemd-userdbd-and-similar/runtest.sh
index 6932575..3120cf3 100755
--- a/selinux-policy/systemd-userdbd-and-similar/runtest.sh
+++ b/selinux-policy/systemd-userdbd-and-similar/runtest.sh
@@ -106,7 +106,7 @@ rlJournalStart
             PROCESS_CONTEXT="unconfined_service_t"
         fi
         rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1
-        rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255
+        rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255
         rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1
     rlPhaseEnd
 
@@ -121,7 +121,7 @@ rlJournalStart
 
     rlPhaseStartCleanup
         sleep 2
-        rlSECheckAVC
+        rlSECheckAVC --ignore 'type=AVC.*connectto.*userdbctl.*:guest_t:.*:systemd_machined_t:' --ignore 'type=AVC.*connectto.*userdbctl.*:xguest_t:.*:systemd_machined_t:'
 
         rlFileRestore
         rlServiceRestore ${SERVICE_NAME}

diff --git a/selinux-policy/tlshd-and-similar/runtest.sh b/selinux-policy/tlshd-and-similar/runtest.sh
index bf67f0e..0e13e00 100755
--- a/selinux-policy/tlshd-and-similar/runtest.sh
+++ b/selinux-policy/tlshd-and-similar/runtest.sh
@@ -80,7 +80,7 @@ rlJournalStart
         rlSESearchRule "allow ktlshd_t cert_t : dir { search } [ ]"
         rlSESearchRule "allow ktlshd_t cert_t : file { getattr open read } [ ]"
         rlSESearchRule "allow ktlshd_t net_conf_t : file { getattr open read } [ ]"
-        rlSESearchRule "allow ktlshd_t proc_net_t : lnk_file { read } [ ]"
+        # rlSESearchRule "allow ktlshd_t proc_net_t : lnk_file { read } [ ]"
         rlSESearchRule "allow ktlshd_t ktlshd_t : netlink_route_socket { bind create getattr getopt nlmsg_read setopt } [ ]"
         rlSESearchRule "allow ktlshd_t ktlshd_t : udp_socket { connect create getattr setopt } [ ]"
         rlSESearchRule "allow ktlshd_t sysctl_net_t : dir { search } [ ]"

diff --git a/selinux-policy/valkey-and-similar/main.fmf b/selinux-policy/valkey-and-similar/main.fmf
index 4029ed9..110f6a2 100644
--- a/selinux-policy/valkey-and-similar/main.fmf
+++ b/selinux-policy/valkey-and-similar/main.fmf
@@ -35,3 +35,5 @@ adjust:
   - enabled: false
     when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8
     because: the package is not available there
+extra-nitrate: TC#0619564
+id: 337de041-c42f-4292-99d4-f687ec629fc9

                 reply	other threads:[~2026-09-11 13:23 UTC|newest]

Thread overview: [no followups] expand[flat|nested]  mbox.gz  Atom feed

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=178913298733.1.892697430252561095.tests-selinux-7a6077caace6@fedoraproject.org \
    --to=mmalik@redhat.com \
    --cc=git-commits@fedoraproject.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Be sure your reply has a Subject: header at the top and a blank line before the message body.

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox