public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
From: Veronika Syncakova <veva.syncakova@gmail.com>
To: git-commits@fedoraproject.org
Subject: [tests/selinux] pr775-checkpolicy-revdeps: test if systemd-tmpfiles-clean.service triggers an AVC denial
Date: Fri, 11 Sep 2026 13:23:43 GMT	[thread overview]
Message-ID: <178913302312.1.14446629740783650809.tests-selinux-18274abc2a42@fedoraproject.org> (raw)

A new commit has been pushed.

Repo   : tests/selinux
Branch : pr775-checkpolicy-revdeps
Commit : 18274abc2a426a37c2bff003bd4821a7fdf01dd8
Author : Veronika Syncakova <veva.syncakova@gmail.com>
Date   : 2026-04-13T10:11:28+00:00
Stats  : +23/-0 in 3 file(s)
URL    : https://src.fedoraproject.org/tests/selinux/c/18274abc2a426a37c2bff003bd4821a7fdf01dd8?branch=pr775-checkpolicy-revdeps

Log:
test if systemd-tmpfiles-clean.service triggers an AVC denial

---
diff --git a/selinux-policy/systemd-tmpfiles-and-similar/Makefile b/selinux-policy/systemd-tmpfiles-and-similar/Makefile
index fd16134..e30c908 100644
--- a/selinux-policy/systemd-tmpfiles-and-similar/Makefile
+++ b/selinux-policy/systemd-tmpfiles-and-similar/Makefile
@@ -64,6 +64,7 @@ $(METADATA): Makefile
 	@echo "Releases:        -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA)
 	@echo "Bug:             RHEL-40374" >> $(METADATA) # RHEL-9
 	@echo "Bug:             RHEL-44191" >> $(METADATA) # RHEL-10
+	@echo "Bug:             RHEL-139855" >> $(METADATA) # RHEL-10
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/systemd-tmpfiles-and-similar/main.fmf b/selinux-policy/systemd-tmpfiles-and-similar/main.fmf
index c72634c..6741bc4 100644
--- a/selinux-policy/systemd-tmpfiles-and-similar/main.fmf
+++ b/selinux-policy/systemd-tmpfiles-and-similar/main.fmf
@@ -36,6 +36,7 @@ tier: 2
 link:
   - verifies: https://issues.redhat.com/browse/RHEL-40374
   - verifies: https://issues.redhat.com/browse/RHEL-44191
+  - verifies: https://issues.redhat.com/browse/RHEL-139855
 adjust+:
   - enabled: false
     when: distro < rhel-9.5

diff --git a/selinux-policy/systemd-tmpfiles-and-similar/runtest.sh b/selinux-policy/systemd-tmpfiles-and-similar/runtest.sh
index 6c28056..a4fd928 100755
--- a/selinux-policy/systemd-tmpfiles-and-similar/runtest.sh
+++ b/selinux-policy/systemd-tmpfiles-and-similar/runtest.sh
@@ -76,6 +76,27 @@ rlJournalStart
         done
     rlPhaseEnd
 
+    rlPhaseStartTest "RHEL-139855"
+        SOFT_LIMIT=1000
+        HARD_LIMIT=1500
+        LIMIT_NOFILE="$(systemctl show --value --property DefaultLimitNOFILE)"
+        LIMIT_NOFILE_SOFT="$(systemctl show --value --property DefaultLimitNOFILESoft)"
+        rlAssertNotEquals "DefaultLimitNOFILE is set to: ${LIMIT_NOFILE}" $HARD_LIMIT $LIMIT_NOFILE
+        rlAssertNotEquals "DefaultLimitNOFILESoft is set to: ${LIMIT_NOFILE_SOFT}" $SOFT_LIMIT $LIMIT_NOFILE_SOFT
+        rlRun "mkdir /run/systemd/system.conf.d/"
+        rlRun "cat >/run/systemd/system.conf.d/99-NOFILE.conf <<EOF
+               [Manager]
+               DefaultLimitNOFILE=${SOFT_LIMIT}:${HARD_LIMIT}
+               EOF"
+        rlRun "systemctl daemon-reload"
+        LIMIT_NOFILE="$(systemctl show --value --property DefaultLimitNOFILE)"
+        LIMIT_NOFILE_SOFT="$(systemctl show --value --property DefaultLimitNOFILESoft)"
+        rlAssertEquals "DefaultLimitNOFILE has changed after daemon reload" $HARD_LIMIT $LIMIT_NOFILE
+        rlAssertEquals "DefaultLimitNOFILESoft has changed after daemon reload" $SOFT_LIMIT $LIMIT_NOFILE_SOFT
+        rlRun "systemctl restart systemd-tmpfiles-clean.service"
+        rlRun "rm /run/systemd/system.conf.d/99-NOFILE.conf"
+    rlPhaseEnd
+
     rlPhaseStartCleanup
         sleep 2
         rlSECheckAVC

                 reply	other threads:[~2026-09-11 13:23 UTC|newest]

Thread overview: [no followups] expand[flat|nested]  mbox.gz  Atom feed

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=178913302312.1.14446629740783650809.tests-selinux-18274abc2a42@fedoraproject.org \
    --to=veva.syncakova@gmail.com \
    --cc=git-commits@fedoraproject.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox