public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
From: jan janasek <jjanasek@redhat.com>
To: git-commits@fedoraproject.org
Subject: [tests/selinux] pr775-checkpolicy-revdeps: adding test coverage for unknown permissions
Date: Fri, 11 Sep 2026 13:23:23 GMT [thread overview]
Message-ID: <178913300326.1.9448135941205672502.tests-selinux-ec5c6a63063a@fedoraproject.org> (raw)
A new commit has been pushed.
Repo : tests/selinux
Branch : pr775-checkpolicy-revdeps
Commit : ec5c6a63063a08ed608e37a9d1d3fe7062c78a92
Author : jan janasek <jjanasek@redhat.com>
Date : 2025-10-22T09:03:25+02:00
Stats : +171/-0 in 2 file(s)
URL : https://src.fedoraproject.org/tests/selinux/c/ec5c6a63063a08ed608e37a9d1d3fe7062c78a92?branch=pr775-checkpolicy-revdeps
Log:
adding test coverage for unknown permissions
Unknown permissions are now handled as errors in CIL.
With selinux >= 3.0: a CIL module, which contains unknown permissions,
cannot be inserted via semodule -i. Error messages appear.
Signed-off-by: jan janasek <janjanasek@redhat.com>
---
diff --git a/selinux-policy/unknown-permissions-cil/main.fmf b/selinux-policy/unknown-permissions-cil/main.fmf
new file mode 100644
index 0000000..405f5da
--- /dev/null
+++ b/selinux-policy/unknown-permissions-cil/main.fmf
@@ -0,0 +1,19 @@
+summary: test coverage for Unknown permissions are now handled as errors in CIL
+description: |+
+ Unknown permissions are now handled as errors in CIL
+contact: Jan Janasek <jjanasek@redhat.com>
+component:
+ - selinux-policy
+require:
+ - libselinux
+ - libselinux-utils
+ - policycoreutils-devel
+ - selinux-policy
+ - selinux-policy-targeted
+environment:
+ AVC_ERROR: +no_avc_check
+duration: 20m
+enabled: true
+tier: 2
+link:
+ - verifies: https://issues.redhat.com/browse/SELINUX-2380
diff --git a/selinux-policy/unknown-permissions-cil/runtest.sh b/selinux-policy/unknown-permissions-cil/runtest.sh
new file mode 100755
index 0000000..83b2b13
--- /dev/null
+++ b/selinux-policy/unknown-permissions-cil/runtest.sh
@@ -0,0 +1,152 @@
+#!/bin/bash
+# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+# Description: Unknown permissions are now handled as errors in CIL
+# Author: Jan Janasek <jjanasek@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+# Copyright (c) 2021 Red Hat, Inc. All rights reserved.
+#
+# This copyrighted material is made available to anyone wishing
+# to use, modify, copy, or redistribute it subject to the terms
+# and conditions of the GNU General Public License version 2.
+#
+# This program is distributed in the hope that it will be
+# useful, but WITHOUT ANY WARRANTY; without even the implied
+# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+# PURPOSE. See the GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public
+# License along with this program; if not, write to the Free
+# Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+# Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include Beaker environment
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGE="selinux-policy"
+FILE="my_policy.cil"
+
+rlJournalStart
+ rlPhaseStartSetup
+ rlAssertRpm ${PACKAGE}
+ rlAssertRpm ${PACKAGE}-targeted
+ rlRun "sestatus"
+ echo "(type test_domain_t)" > $FILE
+ echo "(type test_file_t)" >> $FILE
+ sleep 2
+ rlPhaseEnd
+
+
+ rlPhaseStartTest "permission watch"
+ echo "(allow test_domain_t test_file_t (dir (watch)))" >> $FILE
+ rlRun "semodule -i $FILE"
+ head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE
+ echo "(allow test_domain_t test_file_t (dir (watching)))" >> $FILE
+ rlRun "semodule -i $FILE" 1
+ head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE
+ rlPhaseEnd
+
+ rlPhaseStartTest "permission that is not defined in a class"
+ echo "(allow test_domain_t test_file_t (dir (add_name)))" >> $FILE
+ rlRun "semodule -i $FILE"
+ head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE
+ echo "(allow test_domain_t test_file_t (file (add_name)))" >> $FILE
+ rlRun "semodule -i $FILE" 1
+ head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE
+ rlPhaseEnd
+
+ rlPhaseStartTest "permission sendto"
+ echo "(allow test_domain_t test_file_t (node (sendto)))" >> $FILE
+ rlRun "semodule -i $FILE"
+ head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE
+ echo "(allow test_domain_t test_file_t (node (sendsto)))" >> $FILE
+ rlRun "semodule -i $FILE" 1
+ head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE
+ echo "(allow test_domain_t test_file_t (dir (sendto)))" >> $FILE
+ rlRun "semodule -i $FILE" 1
+ head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE
+ rlPhaseEnd
+
+ rlPhaseStartTest "permission stop"
+ echo "(allow test_domain_t test_file_t (system (stop)))" >> $FILE
+ rlRun "semodule -i $FILE"
+ head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE
+ echo "(allow test_domain_t test_file_t (system (stops)))" >> $FILE
+ rlRun "semodule -i $FILE" 1
+ head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE
+ echo "(allow test_domain_t test_file_t (dir (stop)))" >> $FILE
+ rlRun "semodule -i $FILE" 1
+ head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE
+ rlPhaseEnd
+
+ rlPhaseStartTest "permission reload"
+ echo "(allow test_domain_t test_file_t (service (reload)))" >> $FILE
+ rlRun "semodule -i $FILE"
+ head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE
+ echo "(allow test_domain_t test_file_t (service (reloads)))" >> $FILE
+ rlRun "semodule -i $FILE" 1
+ head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE
+ echo "(allow test_domain_t test_file_t (dir (reload)))" >> $FILE
+ rlRun "semodule -i $FILE" 1
+ head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE
+ rlPhaseEnd
+
+ rlPhaseStartTest "permission use"
+ echo "(allow test_domain_t test_file_t (fd (use)))" >> $FILE
+ rlRun "semodule -i $FILE"
+ head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE
+ echo "(allow test_domain_t test_file_t (fd (using)))" >> $FILE
+ rlRun "semodule -i $FILE" 1
+ head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE
+ echo "(allow test_domain_t test_file_t (dir (use)))" >> $FILE
+ rlRun "semodule -i $FILE" 1
+ head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE
+ rlPhaseEnd
+
+ rlPhaseStartTest "permission flow_in"
+ echo "(allow test_domain_t test_file_t (packet (flow_in)))" >> $FILE
+ rlRun "semodule -i $FILE"
+ head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE
+ echo "(allow test_domain_t test_file_t (packet (flows_in)))" >> $FILE
+ rlRun "semodule -i $FILE" 1
+ head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE
+ echo "(allow test_domain_t test_file_t (system (flow_in)))" >> $FILE
+ rlRun "semodule -i $FILE" 1
+ head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE
+ rlPhaseEnd
+
+ rlPhaseStartTest "permission contains"
+ echo "(allow test_domain_t test_file_t (context (contains)))" >> $FILE
+ rlRun "semodule -i $FILE"
+ head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE
+ echo "(allow test_domain_t test_file_t (context (contain)))" >> $FILE
+ rlRun "semodule -i $FILE" 1
+ head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE
+ echo "(allow test_domain_t test_file_t (fd (contains)))" >> $FILE
+ rlRun "semodule -i $FILE" 1
+ head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE
+ rlPhaseEnd
+
+ rlPhaseStartTest "permission lock"
+ echo "(allow test_domain_t test_file_t (shm (lock)))" >> $FILE
+ rlRun "semodule -i $FILE"
+ head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE
+ echo "(allow test_domain_t test_file_t (shm (locked)))" >> $FILE
+ rlRun "semodule -i $FILE" 1
+ head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE
+ echo "(allow test_domain_t test_file_t (system (lock)))" >> $FILE
+ rlRun "semodule -i $FILE" 1
+ head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE
+ rlPhaseEnd
+
+ rlPhaseStartCleanup
+ rm $FILE
+ rlRun "semodule -r my_policy"
+ rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd
reply other threads:[~2026-09-11 13:23 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=178913300326.1.9448135941205672502.tests-selinux-ec5c6a63063a@fedoraproject.org \
--to=jjanasek@redhat.com \
--cc=git-commits@fedoraproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox