public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
* [tests/selinux] pr775-checkpolicy-revdeps: adding test coverage for unknown permissions
@ 2026-09-11 13:23 jan janasek
0 siblings, 0 replies; only message in thread
From: jan janasek @ 2026-09-11 13:23 UTC (permalink / raw)
To: git-commits
A new commit has been pushed.
Repo : tests/selinux
Branch : pr775-checkpolicy-revdeps
Commit : ec5c6a63063a08ed608e37a9d1d3fe7062c78a92
Author : jan janasek <jjanasek@redhat.com>
Date : 2025-10-22T09:03:25+02:00
Stats : +171/-0 in 2 file(s)
URL : https://src.fedoraproject.org/tests/selinux/c/ec5c6a63063a08ed608e37a9d1d3fe7062c78a92?branch=pr775-checkpolicy-revdeps
Log:
adding test coverage for unknown permissions
Unknown permissions are now handled as errors in CIL.
With selinux >= 3.0: a CIL module, which contains unknown permissions,
cannot be inserted via semodule -i. Error messages appear.
Signed-off-by: jan janasek <janjanasek@redhat.com>
---
diff --git a/selinux-policy/unknown-permissions-cil/main.fmf b/selinux-policy/unknown-permissions-cil/main.fmf
new file mode 100644
index 0000000..405f5da
--- /dev/null
+++ b/selinux-policy/unknown-permissions-cil/main.fmf
@@ -0,0 +1,19 @@
+summary: test coverage for Unknown permissions are now handled as errors in CIL
+description: |+
+ Unknown permissions are now handled as errors in CIL
+contact: Jan Janasek <jjanasek@redhat.com>
+component:
+ - selinux-policy
+require:
+ - libselinux
+ - libselinux-utils
+ - policycoreutils-devel
+ - selinux-policy
+ - selinux-policy-targeted
+environment:
+ AVC_ERROR: +no_avc_check
+duration: 20m
+enabled: true
+tier: 2
+link:
+ - verifies: https://issues.redhat.com/browse/SELINUX-2380
diff --git a/selinux-policy/unknown-permissions-cil/runtest.sh b/selinux-policy/unknown-permissions-cil/runtest.sh
new file mode 100755
index 0000000..83b2b13
--- /dev/null
+++ b/selinux-policy/unknown-permissions-cil/runtest.sh
@@ -0,0 +1,152 @@
+#!/bin/bash
+# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+# Description: Unknown permissions are now handled as errors in CIL
+# Author: Jan Janasek <jjanasek@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+# Copyright (c) 2021 Red Hat, Inc. All rights reserved.
+#
+# This copyrighted material is made available to anyone wishing
+# to use, modify, copy, or redistribute it subject to the terms
+# and conditions of the GNU General Public License version 2.
+#
+# This program is distributed in the hope that it will be
+# useful, but WITHOUT ANY WARRANTY; without even the implied
+# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+# PURPOSE. See the GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public
+# License along with this program; if not, write to the Free
+# Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+# Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include Beaker environment
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGE="selinux-policy"
+FILE="my_policy.cil"
+
+rlJournalStart
+ rlPhaseStartSetup
+ rlAssertRpm ${PACKAGE}
+ rlAssertRpm ${PACKAGE}-targeted
+ rlRun "sestatus"
+ echo "(type test_domain_t)" > $FILE
+ echo "(type test_file_t)" >> $FILE
+ sleep 2
+ rlPhaseEnd
+
+
+ rlPhaseStartTest "permission watch"
+ echo "(allow test_domain_t test_file_t (dir (watch)))" >> $FILE
+ rlRun "semodule -i $FILE"
+ head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE
+ echo "(allow test_domain_t test_file_t (dir (watching)))" >> $FILE
+ rlRun "semodule -i $FILE" 1
+ head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE
+ rlPhaseEnd
+
+ rlPhaseStartTest "permission that is not defined in a class"
+ echo "(allow test_domain_t test_file_t (dir (add_name)))" >> $FILE
+ rlRun "semodule -i $FILE"
+ head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE
+ echo "(allow test_domain_t test_file_t (file (add_name)))" >> $FILE
+ rlRun "semodule -i $FILE" 1
+ head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE
+ rlPhaseEnd
+
+ rlPhaseStartTest "permission sendto"
+ echo "(allow test_domain_t test_file_t (node (sendto)))" >> $FILE
+ rlRun "semodule -i $FILE"
+ head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE
+ echo "(allow test_domain_t test_file_t (node (sendsto)))" >> $FILE
+ rlRun "semodule -i $FILE" 1
+ head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE
+ echo "(allow test_domain_t test_file_t (dir (sendto)))" >> $FILE
+ rlRun "semodule -i $FILE" 1
+ head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE
+ rlPhaseEnd
+
+ rlPhaseStartTest "permission stop"
+ echo "(allow test_domain_t test_file_t (system (stop)))" >> $FILE
+ rlRun "semodule -i $FILE"
+ head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE
+ echo "(allow test_domain_t test_file_t (system (stops)))" >> $FILE
+ rlRun "semodule -i $FILE" 1
+ head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE
+ echo "(allow test_domain_t test_file_t (dir (stop)))" >> $FILE
+ rlRun "semodule -i $FILE" 1
+ head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE
+ rlPhaseEnd
+
+ rlPhaseStartTest "permission reload"
+ echo "(allow test_domain_t test_file_t (service (reload)))" >> $FILE
+ rlRun "semodule -i $FILE"
+ head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE
+ echo "(allow test_domain_t test_file_t (service (reloads)))" >> $FILE
+ rlRun "semodule -i $FILE" 1
+ head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE
+ echo "(allow test_domain_t test_file_t (dir (reload)))" >> $FILE
+ rlRun "semodule -i $FILE" 1
+ head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE
+ rlPhaseEnd
+
+ rlPhaseStartTest "permission use"
+ echo "(allow test_domain_t test_file_t (fd (use)))" >> $FILE
+ rlRun "semodule -i $FILE"
+ head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE
+ echo "(allow test_domain_t test_file_t (fd (using)))" >> $FILE
+ rlRun "semodule -i $FILE" 1
+ head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE
+ echo "(allow test_domain_t test_file_t (dir (use)))" >> $FILE
+ rlRun "semodule -i $FILE" 1
+ head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE
+ rlPhaseEnd
+
+ rlPhaseStartTest "permission flow_in"
+ echo "(allow test_domain_t test_file_t (packet (flow_in)))" >> $FILE
+ rlRun "semodule -i $FILE"
+ head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE
+ echo "(allow test_domain_t test_file_t (packet (flows_in)))" >> $FILE
+ rlRun "semodule -i $FILE" 1
+ head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE
+ echo "(allow test_domain_t test_file_t (system (flow_in)))" >> $FILE
+ rlRun "semodule -i $FILE" 1
+ head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE
+ rlPhaseEnd
+
+ rlPhaseStartTest "permission contains"
+ echo "(allow test_domain_t test_file_t (context (contains)))" >> $FILE
+ rlRun "semodule -i $FILE"
+ head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE
+ echo "(allow test_domain_t test_file_t (context (contain)))" >> $FILE
+ rlRun "semodule -i $FILE" 1
+ head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE
+ echo "(allow test_domain_t test_file_t (fd (contains)))" >> $FILE
+ rlRun "semodule -i $FILE" 1
+ head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE
+ rlPhaseEnd
+
+ rlPhaseStartTest "permission lock"
+ echo "(allow test_domain_t test_file_t (shm (lock)))" >> $FILE
+ rlRun "semodule -i $FILE"
+ head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE
+ echo "(allow test_domain_t test_file_t (shm (locked)))" >> $FILE
+ rlRun "semodule -i $FILE" 1
+ head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE
+ echo "(allow test_domain_t test_file_t (system (lock)))" >> $FILE
+ rlRun "semodule -i $FILE" 1
+ head -n -1 $FILE > "temp.txt" && mv "temp.txt" $FILE
+ rlPhaseEnd
+
+ rlPhaseStartCleanup
+ rm $FILE
+ rlRun "semodule -r my_policy"
+ rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2026-09-11 13:23 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-09-11 13:23 [tests/selinux] pr775-checkpolicy-revdeps: adding test coverage for unknown permissions jan janasek
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox