Compare commits

...

49 Commits

Author SHA1 Message Date
Petr Lautrbach a2b27337b5 Enable gating on tests
https://docs.fedoraproject.org/en-US/ci/gating/
2020-11-20 15:30:10 +01:00
Petr Lautrbach 1d15c0a436 checkpolicy-3.1-4
- Fix signed overflow caused by using (1 << 31) - 1
- Optimize storage of filename transitions
- Rebuild with libsepol.so.2
2020-11-01 14:51:04 +01:00
Petr Lautrbach 497bda00f7 Rebase on db0f2f382e31 at SELinuxProject
- Optimize storage of filename transitions
- Fix signed overflow caused by using (1 << 31) - 1
2020-11-01 14:51:04 +01:00
Fedora Release Engineering 611818c50a - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
2020-07-27 13:54:03 +00:00
Tom Stellard d653350d2a Use make macros
https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro
2020-07-21 11:03:59 +02:00
Petr Lautrbach 54b53e380c checkpolicy-3.1-1
- SELinux userspace 3.1 release
2020-07-10 20:27:21 +02:00
Petr Lautrbach ea213d0249 Fix -fno-common issues discovered by GCC 10 2020-01-28 15:05:19 +01:00
Fedora Release Engineering 460f6f4eee - Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
2020-01-28 13:56:54 +00:00
Petr Lautrbach ca4ac5b32e SELinux userspace 3.0 release 2019-12-06 10:16:44 +01:00
Petr Lautrbach bf308d366f SELinux userspace 3.0-rc1 release candidate 2019-11-11 12:04:40 +01:00
Fedora Release Engineering 9cf157d40b - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
2019-07-24 20:10:42 +00:00
Petr Lautrbach 6dfecce4ee SELinux userspace 2.9 release 2019-03-18 18:00:54 +01:00
Petr Lautrbach 32b01b4b5d SELinux userspace 2.9-rc2 release 2019-03-11 17:24:22 +01:00
Fedora Release Engineering e7b6fdd8c4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
2019-01-31 15:30:34 +00:00
Petr Lautrbach 445c9b4a2f SELinux userspace 2.9-rc1 release candidate 2019-01-30 10:25:45 +01:00
Petr Lautrbach f7ff2dd875 checkpolicy-2.8-3
- Check the result value of hashtable_search
- Destroy the class datum if it fails to initialize
2019-01-21 20:30:01 +01:00
Petr Šplíchal 3be8c4c38c Use FMF filter instead of listing tests manually
There is a new feature in the Standard Test Roles which allows to
use an FMF filter instead of listing all tests manually. All tier
one selinux tests are selected as well, thus extending requires.
2018-09-24 13:01:58 +02:00
Fedora Release Engineering a93670f5ac - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
2018-07-12 21:43:54 +00:00
Petr Lautrbach 04fa4fd788 checkpolicy-2.8-1
- SELinux userspace 2.8 release
2018-05-25 12:18:07 +02:00
Petr Lautrbach 5d411cd10a SELinux userspace 2.8-rc3 release candidate 2018-05-15 10:36:24 +02:00
Petr Lautrbach ccff9f365f SELinux userspace 2.8-rc1 release candidate 2018-04-23 16:05:04 +02:00
Petr Lautrbach bb731d2aae checkpolicy-2.7-7
- Add support for the SCTP portcon keyword
2018-03-21 18:08:32 +01:00
Petr Lautrbach 0d9f220a00 checkpolicy-2.7-6
- build: follow standard semantics for DESTDIR and PREFIX
2018-03-13 15:35:48 +01:00
Florian Weimer e67c25513c Use LDFLAGS from redhat-rpm-config 2018-02-22 19:17:04 +01:00
Petr Lautrbach b501520a1d List gcc in BuildRequires
https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/message/IJFYI5Q2BYZKIGDFS2WLOBDUSEGWHIKV/
https://fedoraproject.org/wiki/Packaging:C_and_C%2B%2B#BuildRequires_and_Requires
2018-02-19 13:37:47 +01:00
Petr Lautrbach 557e34ddd5 Spec file cleanup
https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/message/MRWOMRZ6KPCV25EFHJ2O67BCCP3L4Y6N/
2018-02-16 10:38:46 +01:00
Petr Lautrbach ec0a79526f Use shared repository for tests
https://fedoraproject.org/wiki/CI/Share_Test_Code
2018-02-14 17:44:50 +01:00
Igor Gnatenko 0c978bee29
Remove %clean section
None of currently supported distributions need that.
Last one was EL5 which is EOL for a while.

Signed-off-by: Igor Gnatenko <ignatenkobrain@fedoraproject.org>
2018-02-14 09:06:30 +01:00
Igor Gnatenko bf3512454a Remove BuildRoot definition
None of currently supported distributions need that.
It was needed last for EL5 which is EOL now

Signed-off-by: Igor Gnatenko <ignatenkobrain@fedoraproject.org>
2018-02-13 23:07:45 +01:00
Fedora Release Engineering 782a1515c6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
2018-02-07 04:50:03 +00:00
rasibley 17e01d10f0 swap out mktemp with coreutils in yaml file, otherwise requirement will fail to intall 2018-01-13 16:22:35 -05:00
Petr Lautrbach 817c204014 checkpolicy-2.7-3.fc28
- Rebuild with libsepol-2.7-3 and libselinux-2.7-6
2017-11-22 15:52:14 +01:00
Bruno Goncalves ba7a17bc80 Add CI tests using the standard test interface
The following steps are used to execute the tests using the standard test interface:

Docker

    sudo ANSIBLE_INVENTORY=$(test -e inventory && echo inventory || echo /usr/share/ansible/inventory) TEST_SUBJECTS=docker:docker.io/library/fedora:26 TEST_ARTIFACTS=$PWD/artifacts ansible-playbook --tags container tests.yml

Classic

    sudo ANSIBLE_INVENTORY=$(test -e inventory && echo inventory || echo /usr/share/ansible/inventory) TEST_SUBJECTS="" TEST_ARTIFACTS=$PWD/artifacts ansible-playbook --tags classic tests.yml

https://src.fedoraproject.org/rpms/checkpolicy/pull-request/1
2017-10-31 21:13:51 +01:00
Petr Lautrbach 39e0ef552a checkpolicy-2.7-2.fc28
- Rebuilt with libsepol-2.7-2
2017-10-20 14:04:28 +02:00
Petr Lautrbach 980d2c8c0c checkpolicy-2.7-1
- Update to upstream release 2017-08-04
2017-08-07 17:17:57 +02:00
Fedora Release Engineering 0d6e0220ec - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild 2017-08-02 18:44:54 +00:00
Fedora Release Engineering 3484761cd7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild 2017-07-26 04:44:26 +00:00
Petr Lautrbach 269e7db87e checkpolicy-2.6-1
- Update to upstream release 2016-10-14
2017-02-20 12:36:39 +01:00
Fedora Release Engineering 7671da68a5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild 2017-02-10 07:26:44 +00:00
Petr Lautrbach d70b2042c6 checkpolicy-2.5-8
- Add types associated to a role in the current scope when parsing
2016-10-04 09:17:25 +02:00
Petr Lautrbach eca1d03c02 checkpolicy-2.5-7
- Extend checkpolicy pathname matching
- Rebuilt with libsepol-2.5-9
2016-08-01 13:07:40 +02:00
Petr Lautrbach 39233d7a38 checkpolicy-2.5-6
- Fix typos in sedispol
2016-06-27 13:52:45 +02:00
Petr Lautrbach a1e6032110 checkpolicy-2.5-5
- Set flex as default lexer
- Fix checkmodule output message
2016-06-23 13:55:16 +02:00
Petr Lautrbach eedb877c67 checkpolicy-2.5-4
- Rebuilt with libsepol-2.5-6
2016-05-11 10:58:05 +02:00
Petr Lautrbach 43d653f220 checkpolicy-2.5-3
- Build policy on systems not supporting DCCP protocol
- Fail if module name different than output base filename
2016-04-29 19:08:43 +02:00
Petr Lautrbach 65b44362fe checkpolicy-2.5-2
- Add support for portcon dccp protocol
2016-04-08 21:02:57 +02:00
Petr Lautrbach ce5393bbac checkpolicy-2.5-1
- Update to upstream release 2016-02-23
2016-02-23 22:47:35 +01:00
Petr Lautrbach cfa584572b checkpolicy-2.5-0.1.rc1
Update to upstream rc1 release 2016-01-07
2016-02-21 13:42:03 +01:00
Dennis Gilmore 3ba2a7069f - Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild 2016-02-03 17:36:25 +00:00
26 changed files with 1473 additions and 21 deletions

13
.gitignore vendored
View File

@ -92,3 +92,16 @@ checkpolicy-2.0.22.tgz
/checkpolicy-2.2.tgz
/checkpolicy-2.3.tgz
/checkpolicy-2.4.tar.gz
/checkpolicy-2.5-rc1.tar.gz
/checkpolicy-2.5.tar.gz
/checkpolicy-2.6.tar.gz
/checkpolicy-2.7.tar.gz
/checkpolicy-2.8-rc1.tar.gz
/checkpolicy-2.8-rc3.tar.gz
/checkpolicy-2.8.tar.gz
/checkpolicy-2.9-rc1.tar.gz
/checkpolicy-2.9-rc2.tar.gz
/checkpolicy-2.9.tar.gz
/checkpolicy-3.0-rc1.tar.gz
/checkpolicy-3.0.tar.gz
/checkpolicy-3.1.tar.gz

View File

@ -0,0 +1,129 @@
From 42ae834a7428c57f7b2a9f448adf4cf991fa3487 Mon Sep 17 00:00:00 2001
From: Ondrej Mosnacek <omosnace@redhat.com>
Date: Fri, 31 Jul 2020 13:10:34 +0200
Subject: [PATCH] libsepol,checkpolicy: optimize storage of filename
transitions
In preparation to support a new policy format with a more optimal
representation of filename transition rules, this patch applies an
equivalent change from kernel commit c3a276111ea2 ("selinux: optimize
storage of filename transitions").
See the kernel commit's description [1] for the rationale behind this
representation. This change doesn't bring any measurable difference of
policy build performance (semodule -B) on Fedora.
[1] https://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux.git/commit/?id=c3a276111ea2572399281988b3129683e2a6b60b
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
---
checkpolicy/policy_define.c | 49 ++++++++++---------------------------
checkpolicy/test/dispol.c | 20 ++++++++++-----
2 files changed, 27 insertions(+), 42 deletions(-)
diff --git a/checkpolicy/policy_define.c b/checkpolicy/policy_define.c
index c6733fa469c5..395f62284e3c 100644
--- a/checkpolicy/policy_define.c
+++ b/checkpolicy/policy_define.c
@@ -3303,8 +3303,6 @@ int define_filename_trans(void)
ebitmap_t e_stypes, e_ttypes;
ebitmap_t e_tclasses;
ebitmap_node_t *snode, *tnode, *cnode;
- filename_trans_t *ft;
- filename_trans_datum_t *ftdatum;
filename_trans_rule_t *ftr;
type_datum_t *typdatum;
uint32_t otype;
@@ -3388,40 +3386,19 @@ int define_filename_trans(void)
ebitmap_for_each_positive_bit(&e_tclasses, cnode, c) {
ebitmap_for_each_positive_bit(&e_stypes, snode, s) {
ebitmap_for_each_positive_bit(&e_ttypes, tnode, t) {
- ft = calloc(1, sizeof(*ft));
- if (!ft) {
- yyerror("out of memory");
- goto bad;
- }
- ft->stype = s+1;
- ft->ttype = t+1;
- ft->tclass = c+1;
- ft->name = strdup(name);
- if (!ft->name) {
- yyerror("out of memory");
- goto bad;
- }
-
- ftdatum = hashtab_search(policydbp->filename_trans,
- (hashtab_key_t)ft);
- if (ftdatum) {
- yyerror2("duplicate filename transition for: filename_trans %s %s %s:%s",
- name,
- policydbp->p_type_val_to_name[s],
- policydbp->p_type_val_to_name[t],
- policydbp->p_class_val_to_name[c]);
- goto bad;
- }
-
- ftdatum = calloc(1, sizeof(*ftdatum));
- if (!ftdatum) {
- yyerror("out of memory");
- goto bad;
- }
- rc = hashtab_insert(policydbp->filename_trans,
- (hashtab_key_t)ft,
- ftdatum);
- if (rc) {
+ rc = policydb_filetrans_insert(
+ policydbp, s+1, t+1, c+1, name,
+ NULL, otype, NULL
+ );
+ if (rc != SEPOL_OK) {
+ if (rc == SEPOL_EEXIST) {
+ yyerror2("duplicate filename transition for: filename_trans %s %s %s:%s",
+ name,
+ policydbp->p_type_val_to_name[s],
+ policydbp->p_type_val_to_name[t],
+ policydbp->p_class_val_to_name[c]);
+ goto bad;
+ }
yyerror("out of memory");
goto bad;
}
diff --git a/checkpolicy/test/dispol.c b/checkpolicy/test/dispol.c
index d72d9fb331cf..8785b7252824 100644
--- a/checkpolicy/test/dispol.c
+++ b/checkpolicy/test/dispol.c
@@ -335,17 +335,25 @@ static int filenametr_display(hashtab_key_t key,
hashtab_datum_t datum,
void *ptr)
{
- struct filename_trans *ft = (struct filename_trans *)key;
+ struct filename_trans_key *ft = (struct filename_trans_key *)key;
struct filename_trans_datum *ftdatum = datum;
struct filenametr_display_args *args = ptr;
policydb_t *p = args->p;
FILE *fp = args->fp;
+ ebitmap_node_t *node;
+ uint32_t bit;
+
+ do {
+ ebitmap_for_each_positive_bit(&ftdatum->stypes, node, bit) {
+ display_id(p, fp, SYM_TYPES, bit, "");
+ display_id(p, fp, SYM_TYPES, ft->ttype - 1, "");
+ display_id(p, fp, SYM_CLASSES, ft->tclass - 1, ":");
+ display_id(p, fp, SYM_TYPES, ftdatum->otype - 1, "");
+ fprintf(fp, " %s\n", ft->name);
+ }
+ ftdatum = ftdatum->next;
+ } while (ftdatum);
- display_id(p, fp, SYM_TYPES, ft->stype - 1, "");
- display_id(p, fp, SYM_TYPES, ft->ttype - 1, "");
- display_id(p, fp, SYM_CLASSES, ft->tclass - 1, ":");
- display_id(p, fp, SYM_TYPES, ftdatum->otype - 1, "");
- fprintf(fp, " %s\n", ft->name);
return 0;
}
--
2.29.0

View File

@ -0,0 +1,90 @@
From 521e6a2f478a4c7a7c198c017d4d12e8667d89e7 Mon Sep 17 00:00:00 2001
From: Nicolas Iooss <nicolas.iooss@m4x.org>
Date: Sat, 3 Oct 2020 15:19:08 +0200
Subject: [PATCH] libsepol/cil: fix signed overflow caused by using (1 << 31) -
1
When compiling SELinux userspace tools with -ftrapv (this option
generates traps for signed overflow on addition, subtraction,
multiplication operations, instead of silently wrapping around),
semodule crashes when running the tests from
scripts/ci/fedora-test-runner.sh in a Fedora 32 virtual machine:
[root@localhost selinux-testsuite]# make test
make -C policy load
make[1]: Entering directory '/root/selinux-testsuite/policy'
# Test for "expand-check = 0" in /etc/selinux/semanage.conf
# General policy build
make[2]: Entering directory '/root/selinux-testsuite/policy/test_policy'
Compiling targeted test_policy module
Creating targeted test_policy.pp policy package
rm tmp/test_policy.mod.fc
make[2]: Leaving directory '/root/selinux-testsuite/policy/test_policy'
# General policy load
domain_fd_use --> off
/usr/sbin/semodule -i test_policy/test_policy.pp test_mlsconstrain.cil test_overlay_defaultrange.cil test_add_levels.cil test_glblub.cil
make[1]: *** [Makefile:174: load] Aborted (core dumped)
Using "coredumpctl gdb" leads to the following strack trace:
(gdb) bt
#0 0x00007f608fe4fa25 in raise () from /lib64/libc.so.6
#1 0x00007f608fe38895 in abort () from /lib64/libc.so.6
#2 0x00007f6090028aca in __addvsi3.cold () from /lib64/libsepol.so.1
#3 0x00007f6090096f59 in __avrule_xperm_setrangebits (low=30, high=30, xperms=0x8b9eea0)
at ../cil/src/cil_binary.c:1551
#4 0x00007f60900970dd in __cil_permx_bitmap_to_sepol_xperms_list (xperms=0xb650a30, xperms_list=0x7ffce2653b18)
at ../cil/src/cil_binary.c:1596
#5 0x00007f6090097286 in __cil_avrulex_ioctl_to_policydb (k=0xb8ec200 "@\023\214\022\006", datum=0xb650a30,
args=0x239a640) at ../cil/src/cil_binary.c:1649
#6 0x00007f609003f1e5 in hashtab_map (h=0x41f8710, apply=0x7f60900971da <__cil_avrulex_ioctl_to_policydb>,
args=0x239a640) at hashtab.c:234
#7 0x00007f609009ea19 in cil_binary_create_allocated_pdb (db=0x2394f10, policydb=0x239a640)
at ../cil/src/cil_binary.c:4969
#8 0x00007f609009d19d in cil_binary_create (db=0x2394f10, policydb=0x7ffce2653d30) at ../cil/src/cil_binary.c:4329
#9 0x00007f609008ec23 in cil_build_policydb_create_pdb (db=0x2394f10, sepol_db=0x7ffce2653d30)
at ../cil/src/cil.c:631
#10 0x00007f608fff4bf3 in semanage_direct_commit () from /lib64/libsemanage.so.1
#11 0x00007f608fff9fae in semanage_commit () from /lib64/libsemanage.so.1
#12 0x0000000000403e2b in main (argc=7, argv=0x7ffce2655058) at semodule.c:753
(gdb) f 3
#3 0x00007f6090096f59 in __avrule_xperm_setrangebits (low=30, high=30, xperms=0x8b9eea0)
at ../cil/src/cil_binary.c:1551
1551 xperms->perms[i] |= XPERM_SETBITS(h) - XPERM_SETBITS(low);
A signed integer overflow therefore occurs in XPERM_SETBITS(h):
#define XPERM_SETBITS(x) ((1 << (x & 0x1f)) - 1)
This macro is expanded with h=31, so "(1 << 31) - 1" is computed:
* (1 << 31) = -0x80000000 is the lowest signed 32-bit integer value
* (1 << 31) - 1 overflows the capacity of a signed 32-bit integer and
results in 0x7fffffff (which is unsigned)
Using unsigned integers (with "1U") fixes the crash, as
(1U << 31) = 0x80000000U has no overflowing issues.
Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
Acked-by: Petr Lautrbach <plautrba@redhat.com>
---
checkpolicy/policy_define.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/checkpolicy/policy_define.c b/checkpolicy/policy_define.c
index 395f62284e3c..bf6c3e68bef3 100644
--- a/checkpolicy/policy_define.c
+++ b/checkpolicy/policy_define.c
@@ -2147,7 +2147,7 @@ out:
/* index of the u32 containing the permission */
#define XPERM_IDX(x) (x >> 5)
/* set bits 0 through x-1 within the u32 */
-#define XPERM_SETBITS(x) ((1 << (x & 0x1f)) - 1)
+#define XPERM_SETBITS(x) ((1U << (x & 0x1f)) - 1)
/* low value for this u32 */
#define XPERM_LOW(x) (x << 5)
/* high value for this u32 */
--
2.29.0

View File

@ -1,15 +1,21 @@
%define libselinuxver 2.4-1
%define libsepolver 2.4-1
%define libselinuxver 3.1-4
%define libsepolver 3.1-4
Summary: SELinux policy compiler
Name: checkpolicy
Version: 2.4
Release: 1%{?dist}.1
Version: 3.1
Release: 4%{?dist}
License: GPLv2
Group: Development/System
Source: https://raw.githubusercontent.com/wiki/SELinuxProject/selinux/files/releases/20150202/checkpolicy-2.4.tar.gz
Conflicts: selinux-policy-base < 3.13.1-138
BuildRoot: %{_tmppath}/%{name}-buildroot
Source0: https://github.com/SELinuxProject/selinux/releases/download/20200710/checkpolicy-3.1.tar.gz
# $ git clone https://github.com/fedora-selinux/selinux.git
# $ cd selinux
# $ git format-patch -N checkpolicy-3.1 -- checkpolicy
# $ i=1; for j in 00*patch; do printf "Patch%04d: %s\n" $i $j; i=$((i+1));done
# Patch list start
Patch0001: 0001-libsepol-checkpolicy-optimize-storage-of-filename-tr.patch
Patch0002: 0002-libsepol-cil-fix-signed-overflow-caused-by-using-1-3.patch
# Patch list end
BuildRequires: gcc
BuildRequires: byacc bison flex flex-static libsepol-static >= %{libsepolver} libselinux-devel >= %{libselinuxver}
%description
@ -27,36 +33,159 @@ This package contains checkpolicy, the SELinux policy compiler.
Only required for building policies.
%prep
%setup -q
%autosetup -p 2 -n checkpolicy-%{version}
%build
make clean
make LIBDIR="%{_libdir}" CFLAGS="%{optflags}"
%set_build_flags
%make_build LIBDIR="%{_libdir}"
cd test
make LIBDIR="%{_libdir}" CFLAGS="%{optflags}"
%make_build LIBDIR="%{_libdir}"
%install
rm -rf ${RPM_BUILD_ROOT}
mkdir -p ${RPM_BUILD_ROOT}%{_bindir}
make LIBDIR="%{_libdir}" DESTDIR="${RPM_BUILD_ROOT}" install
%make_install LIBDIR="%{_libdir}"
install test/dismod ${RPM_BUILD_ROOT}%{_bindir}/sedismod
install test/dispol ${RPM_BUILD_ROOT}%{_bindir}/sedispol
%clean
rm -rf ${RPM_BUILD_ROOT}
%files
%defattr(-,root,root)
%{!?_licensedir:%global license %%doc}
%license COPYING
%{_bindir}/checkpolicy
%{_bindir}/checkmodule
%{_mandir}/man8/checkpolicy.8.gz
%{_mandir}/man8/checkmodule.8.gz
%{_mandir}/ru/man8/checkpolicy.8.gz
%{_mandir}/ru/man8/checkmodule.8.gz
%{_bindir}/sedismod
%{_bindir}/sedispol
%changelog
* Sun Nov 1 2020 Petr Lautrbach <plautrba@redhat.com> - 3.1-4
- Fix signed overflow caused by using (1 << 31) - 1
- Optimize storage of filename transitions
- Rebuild with libsepol.so.2
* Mon Jul 27 2020 Fedora Release Engineering <releng@fedoraproject.org> - 3.1-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
* Mon Jul 13 2020 Tom Stellard <tstellar@redhat.com> - 3.1-2
- Use make macros
- https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro
* Fri Jul 10 2020 Petr Lautrbach <plautrba@redhat.com> - 3.1-1
- SELinux userspace 3.1 release
* Tue Jan 28 2020 Petr Lautrbach <plautrba@redhat.com> - 3.0-3
- Fix -fno-common issues discovered by GCC 10
* Tue Jan 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 3.0-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
* Fri Dec 6 2019 Petr Lautrbach <plautrba@redhat.com> - 3.0-1
- SELinux userspace 3.0 release
* Mon Nov 11 2019 Petr Lautrbach <plautrba@redhat.com> - 3.0-0.rc1.1
- SELinux userspace 3.0-rc1 release candidate
* Wed Jul 24 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2.9-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
* Mon Mar 18 2019 Petr Lautrbach <plautrba@redhat.com> - 2.9-1
- SELinux userspace 2.9 release
* Mon Mar 11 2019 Petr Lautrbach <plautrba@redhat.com> - 2.9-0.rc2.1
- SELinux userspace 2.9-rc2 release
* Thu Jan 31 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2.9-0.rc1.1.1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
* Fri Jan 25 2019 Petr Lautrbach <plautrba@redhat.com> - 2.9-0.rc1.1
- SELinux userspace 2.9-rc1 release
* Mon Jan 21 2019 Petr Lautrbach <plautrba@redhat.com> - 2.8-3
- Check the result value of hashtable_search
- Destroy the class datum if it fails to initialize
* Thu Jul 12 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2.8-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
* Fri May 25 2018 Petr Lautrbach <plautrba@redhat.com> - 2.8-1
- SELinux userspace 2.8 release
* Tue May 15 2018 Petr Lautrbach <plautrba@workstation> - 2.8-0.rc3.1
- SELinux userspace 2.8-rc3 release candidate
* Mon Apr 23 2018 Petr Lautrbach <plautrba@redhat.com> - 2.8-0.rc1.1
- SELinux userspace 2.8-rc1 release candidate
* Wed Mar 21 2018 Petr Lautrbach <plautrba@redhat.com> - 2.7-7
- Add support for the SCTP portcon keyword
* Tue Mar 13 2018 Petr Lautrbach <plautrba@redhat.com> - 2.7-6
- build: follow standard semantics for DESTDIR and PREFIX
* Thu Feb 22 2018 Florian Weimer <fweimer@redhat.com> - 2.7-5
- Use LDFLAGS from redhat-rpm-config
* Wed Feb 07 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2.7-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
* Wed Nov 22 2017 Petr Lautrbach <plautrba@redhat.com> - 2.7-3
- Rebuild with libsepol-2.7-3 and libselinux-2.7-6
* Fri Oct 20 2017 Petr Lautrbach <plautrba@redhat.com> - 2.7-2
- Rebuilt with libsepol-2.7-2
* Mon Aug 07 2017 Petr Lautrbach <plautrba@redhat.com> - 2.7-1
- Update to upstream release 2017-08-04
* Wed Aug 02 2017 Fedora Release Engineering <releng@fedoraproject.org> - 2.6-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
* Wed Jul 26 2017 Fedora Release Engineering <releng@fedoraproject.org> - 2.6-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
* Wed Feb 15 2017 Petr Lautrbach <plautrba@redhat.com> - 2.6-1
- Update to upstream release 2016-10-14
* Fri Feb 10 2017 Fedora Release Engineering <releng@fedoraproject.org> - 2.5-9
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
* Mon Oct 03 2016 Petr Lautrbach <plautrba@redhat.com> 2.5-8
- Add types associated to a role in the current scope when parsing
* Mon Aug 01 2016 Petr Lautrbach <plautrba@redhat.com> 2.5-7
- Extend checkpolicy pathname matching
- Rebuilt with libsepol-2.5-9
* Mon Jun 27 2016 Petr Lautrbach <plautrba@redhat.com> - 2.5-6
- Fix typos in sedispol
* Thu Jun 23 2016 Petr Lautrbach <plautrba@redhat.com> - 2.5-5
- Set flex as default lexer
- Fix checkmodule output message
* Wed May 11 2016 Petr Lautrbach <plautrba@redhat.com> - 2.5-4
- Rebuilt with libsepol-2.5-6
* Fri Apr 29 2016 Petr Lautrbach <plautrba@redhat.com> - 2.5-3
- Build policy on systems not supporting DCCP protocol
- Fail if module name different than output base filename
* Fri Apr 08 2016 Petr Lautrbach <plautrba@redhat.com> - 2.5-2
- Add support for portcon dccp protocol
* Tue Feb 23 2016 Petr Lautrbach <plautrba@redhat.com> 2.5-1
- Update to upstream release 2016-02-23
* Sun Feb 21 2016 Petr Lautrbach <plautrba@redhat.com> 2.5-0.1.rc1
- Update to upstream rc1 release 2016-01-07
* Wed Feb 03 2016 Fedora Release Engineering <releng@fedoraproject.org> - 2.4-2.1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
* Tue Jul 21 2015 Petr Lautrbach <plautrba@redhat.com> 2.4-1.1
- Update to 2.4 release

16
gating.yaml Normal file
View File

@ -0,0 +1,16 @@
--- !Policy
product_versions:
- fedora-*
decision_context: bodhi_update_push_testing
subject_type: koji_build
rules:
- !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional}
--- !Policy
product_versions:
- fedora-*
decision_context: bodhi_update_push_stable
subject_type: koji_build
rules:
- !PassingTestCaseRule {test_case_name: fedora-ci.koji-build.tier0.functional}

View File

@ -1,2 +1 @@
5c083d1b02c854436197d5b4b8568a1f checkpolicy-2.3.tgz
4d35189dcfdcf9e3b8b8466f3f706756 checkpolicy-2.4.tar.gz
SHA512 (checkpolicy-3.1.tar.gz) = 2276a5a0919286049d2ceba386ef5f6de523745b588bb81cb4fed5eced5fd0b8070249b7a3ae5a85e2abb9369a86318f727d4073aad14ab75c43750a46069168

View File

@ -0,0 +1,67 @@
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#
# Makefile of /CoreOS/checkpolicy/Sanity/checkmodule
# Description: runs checkmodule with various options to find out if it behaves correctly
# Author: Milos Malik <mmalik@redhat.com>
#
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#
# Copyright (c) 2009 Red Hat, Inc. All rights reserved.
#
# This copyrighted material is made available to anyone wishing
# to use, modify, copy, or redistribute it subject to the terms
# and conditions of the GNU General Public License version 2.
#
# This program is distributed in the hope that it will be
# useful, but WITHOUT ANY WARRANTY; without even the implied
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
# PURPOSE. See the GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public
# License along with this program; if not, write to the Free
# Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
# Boston, MA 02110-1301, USA.
#
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
export TEST=/CoreOS/checkpolicy/Sanity/checkmodule
export TESTVERSION=1.0
BUILT_FILES=
FILES=$(METADATA) runtest.sh Makefile PURPOSE mypolicy.te
.PHONY: all install download clean
run: $(FILES) build
./runtest.sh
build: $(BUILT_FILES)
chmod a+x runtest.sh
clean:
rm -f *~ $(BUILT_FILES)
include /usr/share/rhts/lib/rhts-make.include
$(METADATA): Makefile
@echo "Owner: Milos Malik <mmalik@redhat.com>" > $(METADATA)
@echo "Name: $(TEST)" >> $(METADATA)
@echo "TestVersion: $(TESTVERSION)" >> $(METADATA)
@echo "Path: $(TEST_DIR)" >> $(METADATA)
@echo "Description: runs checkmodule with various options to find out if it behaves correctly" >> $(METADATA)
@echo "Type: Sanity" >> $(METADATA)
@echo "TestTime: 10m" >> $(METADATA)
@echo "RunFor: checkpolicy" >> $(METADATA)
@echo "Requires: checkpolicy" >> $(METADATA)
@echo "Requires: man" >> $(METADATA)
@echo "Requires: grep" >> $(METADATA)
@echo "Requires: mktemp" >> $(METADATA)
@echo "Priority: Normal" >> $(METADATA)
@echo "License: GPLv2" >> $(METADATA)
@echo "Confidential: no" >> $(METADATA)
@echo "Destructive: no" >> $(METADATA)
@echo "Releases: -RHEL4" >> $(METADATA)
rhts-lint $(METADATA)

View File

@ -0,0 +1,5 @@
PURPOSE of /CoreOS/checkpolicy/Sanity/checkmodule
Author: Milos Malik <mmalik@redhat.com>
This TC runs checkmodule with various options to find out if it behaves correctly.

View File

@ -0,0 +1,9 @@
module mypolicy 1.0;
require {
type httpd_log_t;
type postfix_postdrop_t;
class dir getattr;
class file { read getattr };
}
allow postfix_postdrop_t httpd_log_t:file getattr;

View File

@ -0,0 +1,101 @@
#!/bin/bash
# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#
# runtest.sh of /CoreOS/checkpolicy/Sanity/checkmodule
# Description: runs checkmodule with various options to find out if it behaves correctly
# Author: Milos Malik <mmalik@redhat.com>
#
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#
# Copyright (c) 2009 Red Hat, Inc. All rights reserved.
#
# This copyrighted material is made available to anyone wishing
# to use, modify, copy, or redistribute it subject to the terms
# and conditions of the GNU General Public License version 2.
#
# This program is distributed in the hope that it will be
# useful, but WITHOUT ANY WARRANTY; without even the implied
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
# PURPOSE. See the GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public
# License along with this program; if not, write to the Free
# Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
# Boston, MA 02110-1301, USA.
#
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
# Include rhts environment
. /usr/bin/rhts-environment.sh
. /usr/share/beakerlib/beakerlib.sh
PACKAGE="checkpolicy"
rlJournalStart
rlPhaseStartSetup
rlAssertRpm ${PACKAGE}
TEST_FILE=`mktemp`
TEST_DIR=`mktemp -d`
rlRun "rpm -ql ${PACKAGE} | grep bin/checkmodule"
rlPhaseEnd
rlPhaseStartTest
rlRun "checkmodule >& ${TEST_FILE}" 1
rlAssertGrep "loading policy configuration from policy.conf" ${TEST_FILE}
rlRun "checkmodule -b >& ${TEST_FILE}" 1
rlAssertGrep "loading policy configuration from policy" ${TEST_FILE}
rlRun "checkmodule -V"
rlRun "checkmodule -U 1>/dev/null" 1
rlRun "rm -f policy.conf"
for OPTION in "deny" "reject" "allow" ; do
rlRun "checkmodule -U ${OPTION} >& ${TEST_FILE}" 1
rlAssertGrep "unable to open policy.conf" ${TEST_FILE}
done
rlRun "rm -f ${TEST_FILE}"
rlRun "touch ${TEST_FILE}"
rlRun "rm -rf ${TEST_DIR}"
rlRun "mkdir ${TEST_DIR}"
rlRun "checkmodule ${TEST_FILE}" 1,2
rlRun "checkmodule -b ${TEST_FILE}" 1
rlRun "checkmodule ${TEST_DIR}" 1,2
rlRun "checkmodule -b ${TEST_DIR}" 1
rlRun "rm -f ${TEST_FILE}"
rlRun "rm -rf ${TEST_DIR}"
rlRun "checkmodule ${TEST_FILE}" 1
rlRun "checkmodule -b ${TEST_FILE}" 1
if rlIsRHEL 5 ; then
rlRun "checkmodule --help 2>&1 | grep -- -d"
fi
rlRun "checkmodule --help 2>&1 | grep -- -h"
rlRun "checkmodule --help 2>&1 | grep -- -U"
rlPhaseEnd
rlPhaseStartTest
for POLICY_KIND in minimum mls targeted ; do
rlRun "checkmodule -M -m -b -o testmod.mod /etc/selinux/${POLICY_KIND}/policy/policy.* >& ${TEST_FILE}" 1
rlRun "grep -i \"checkmodule.*-b and -m are incompatible with each other\" ${TEST_FILE}"
done
rlPhaseEnd
rlPhaseStartTest
INPUT_FILE="mypolicy.te"
OUTPUT_FILE="mypolicy.output"
rlRun "ls -l ${INPUT_FILE}"
rlRun "checkmodule -m -o ${OUTPUT_FILE} ${INPUT_FILE} 2>&1 | grep \"checkmodule.*loading policy configuration from ${INPUT_FILE}\""
rlRun "checkmodule -m -o ${OUTPUT_FILE} ${INPUT_FILE} 2>&1 | grep \"checkmodule.*writing binary representation.*to ${OUTPUT_FILE}\""
rlRun "ls -l ${OUTPUT_FILE}"
if checkmodule --help | grep -q " CIL " ; then
rlRun "rm -f ${OUTPUT_FILE}"
rlRun "checkmodule -m -C -o ${OUTPUT_FILE} ${INPUT_FILE} 2>&1 | grep \"checkmodule.*loading policy configuration from ${INPUT_FILE}\""
rlRun "checkmodule -m -C -o ${OUTPUT_FILE} ${INPUT_FILE} 2>&1 | grep \"checkmodule.*writing CIL to ${OUTPUT_FILE}\""
rlRun "ls -l ${OUTPUT_FILE}"
fi
rlPhaseEnd
rlPhaseStartCleanup
rlRun "rm -rf ${TEST_FILE} ${TEST_DIR} ${OUTPUT_FILE}"
rlPhaseEnd
rlJournalPrintText
rlJournalEnd

View File

@ -0,0 +1,64 @@
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#
# Makefile of /CoreOS/checkpolicy/Sanity/checkpolicy
# Description: covers an issue where manpage included an unsupported option.
# Author: Milos Malik <mmalik@redhat.com>
#
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#
# Copyright (c) 2009 Red Hat, Inc. All rights reserved.
#
# This copyrighted material is made available to anyone wishing
# to use, modify, copy, or redistribute it subject to the terms
# and conditions of the GNU General Public License version 2.
#
# This program is distributed in the hope that it will be
# useful, but WITHOUT ANY WARRANTY; without even the implied
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
# PURPOSE. See the GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public
# License along with this program; if not, write to the Free
# Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
# Boston, MA 02110-1301, USA.
#
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
export TEST=/CoreOS/checkpolicy/Sanity/checkpolicy
export TESTVERSION=1.0
BUILT_FILES=
FILES=$(METADATA) runtest.sh Makefile PURPOSE
.PHONY: all install download clean
run: $(FILES) build
./runtest.sh
build: $(BUILT_FILES)
chmod a+x runtest.sh
clean:
rm -f *~ $(BUILT_FILES)
include /usr/share/rhts/lib/rhts-make.include
$(METADATA): Makefile
@echo "Owner: Milos Malik <mmalik@redhat.com>" > $(METADATA)
@echo "Name: $(TEST)" >> $(METADATA)
@echo "TestVersion: $(TESTVERSION)" >> $(METADATA)
@echo "Path: $(TEST_DIR)" >> $(METADATA)
@echo "Description: covers an issue where manpage included an unsupported option." >> $(METADATA)
@echo "Type: Sanity" >> $(METADATA)
@echo "TestTime: 1m" >> $(METADATA)
@echo "RunFor: checkpolicy" >> $(METADATA)
@echo "Requires: checkpolicy" >> $(METADATA)
@echo "Priority: Normal" >> $(METADATA)
@echo "License: GPLv2" >> $(METADATA)
@echo "Confidential: no" >> $(METADATA)
@echo "Destructive: no" >> $(METADATA)
@echo "Releases: -RHEL4" >> $(METADATA)
rhts-lint $(METADATA)

View File

@ -0,0 +1,7 @@
PURPOSE of /CoreOS/checkpolicy/Sanity/checkpolicy
Description: covers an issue where manpage included an unsupported option.
Author: Milos Malik <mmalik@redhat.com>

View File

@ -0,0 +1,53 @@
#!/bin/bash
# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#
# runtest.sh of /CoreOS/checkpolicy/Sanity/checkpolicy-docs
# Description: covers an issue where manpage included an unsupported option.
# Author: Milos Malik <mmalik@redhat.com>
#
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#
# Copyright (c) 2009 Red Hat, Inc. All rights reserved.
#
# This copyrighted material is made available to anyone wishing
# to use, modify, copy, or redistribute it subject to the terms
# and conditions of the GNU General Public License version 2.
#
# This program is distributed in the hope that it will be
# useful, but WITHOUT ANY WARRANTY; without even the implied
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
# PURPOSE. See the GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public
# License along with this program; if not, write to the Free
# Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
# Boston, MA 02110-1301, USA.
#
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
# Include rhts environment
. /usr/bin/rhts-environment.sh
. /usr/share/beakerlib/beakerlib.sh
PACKAGE="checkpolicy"
rlJournalStart
rlPhaseStartSetup
rlAssertRpm ${PACKAGE}
rlAssertExists "/usr/share/man/man8/checkpolicy.8.gz"
rlPhaseEnd
rlPhaseStartTest
rlRun "man checkpolicy | col -b | grep -- '-m]'" 1
rlRun "rpm -ql ${PACKAGE} | grep /usr/share/man/.*checkmodule"
if rlIsRHEL 5 ; then
rlRun "man checkmodule | col -b | grep -- -d"
fi
rlRun "man checkmodule | col -b | grep -- -h"
rlRun "man checkmodule | col -b | grep -- -U"
rlPhaseEnd
rlJournalPrintText
rlJournalEnd

View File

@ -0,0 +1,64 @@
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#
# Makefile of /CoreOS/checkpolicy/Sanity/checkpolicy
# Description: runs checkpolicy with various options to find out if it behaves correctly
# Author: Milos Malik <mmalik@redhat.com>
#
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#
# Copyright (c) 2009 Red Hat, Inc. All rights reserved.
#
# This copyrighted material is made available to anyone wishing
# to use, modify, copy, or redistribute it subject to the terms
# and conditions of the GNU General Public License version 2.
#
# This program is distributed in the hope that it will be
# useful, but WITHOUT ANY WARRANTY; without even the implied
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
# PURPOSE. See the GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public
# License along with this program; if not, write to the Free
# Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
# Boston, MA 02110-1301, USA.
#
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
export TEST=/CoreOS/checkpolicy/Sanity/checkpolicy
export TESTVERSION=1.0
BUILT_FILES=
FILES=$(METADATA) runtest.sh Makefile PURPOSE policy.conf.from.secilc
.PHONY: all install download clean
run: $(FILES) build
./runtest.sh
build: $(BUILT_FILES)
chmod a+x runtest.sh
clean:
rm -f *~ $(BUILT_FILES)
include /usr/share/rhts/lib/rhts-make.include
$(METADATA): Makefile
@echo "Owner: Milos Malik <mmalik@redhat.com>" > $(METADATA)
@echo "Name: $(TEST)" >> $(METADATA)
@echo "TestVersion: $(TESTVERSION)" >> $(METADATA)
@echo "Path: $(TEST_DIR)" >> $(METADATA)
@echo "Description: runs checkpolicy with various options to find out if it behaves correctly" >> $(METADATA)
@echo "Type: Sanity" >> $(METADATA)
@echo "TestTime: 10m" >> $(METADATA)
@echo "RunFor: checkpolicy setools" >> $(METADATA)
@echo "Requires: checkpolicy setools-console selinux-policy-minimum selinux-policy-mls selinux-policy-targeted" >> $(METADATA)
@echo "Priority: Normal" >> $(METADATA)
@echo "License: GPLv2" >> $(METADATA)
@echo "Confidential: no" >> $(METADATA)
@echo "Destructive: no" >> $(METADATA)
@echo "Releases: -RHEL4" >> $(METADATA)
rhts-lint $(METADATA)

View File

@ -0,0 +1,7 @@
PURPOSE of /CoreOS/checkpolicy/Sanity/checkpolicy
Description: runs checkpolicy with various options to find out if it behaves correctly
Author: Milos Malik <mmalik@redhat.com>

View File

@ -0,0 +1,143 @@
class file
class process
class char
sid kernel
sid security
sid unlabeled
common file {ioctl read write create getattr setattr lock relabelfrom relabelto append unlink link rename execute swapon quotaon mounton }
class file inherits file { execute_no_trans entrypoint execmod open audit_access }
class char inherits file { foo transition }
class process { open }
sensitivity s0 alias sens0;
sensitivity s1;
dominance { s0 s1 }
category c0 alias cat0;
category c1;
category c2;
level s0:c0.c2;
level s1:c0.c2;
mlsconstrain file { open } (not (((l1 eq l2) and (u1 eq u2)) or (r1 eq r2)));
mlsconstrain file { open } (((l1 eq l2) and (u1 eq u2)) or (r1 != r2));
mlsconstrain file { open } (l1 dom h2);
mlsconstrain file { open } (h1 domby l2);
mlsconstrain file { open } (l1 incomp l2);
mlsvalidatetrans file (h1 domby l2);
attribute foo_type;
attribute bar_type;
attribute baz_type;
attribute exec_type;
type bin_t, bar_type, exec_type;
type kernel_t, foo_type, exec_type, baz_type;
type security_t, baz_type;
type unlabeled_t, baz_type;
type exec_t, baz_type;
type console_t, baz_type;
type auditadm_t, baz_type;
type console_device_t, baz_type;
type user_tty_device_t, baz_type;
type device_t, baz_type;
type getty_t, baz_type;
type a_t, baz_type;
type b_t, baz_type;
typealias bin_t alias sbin_t;
bool secure_mode false;
bool console_login true;
bool b1 false;
role system_r;
role user_r;
role system_r types bin_t;
role system_r types kernel_t;
role system_r types security_t;
role system_r types unlabeled_t;
policycap open_perms;
permissive device_t;
range_transition device_t console_t : file s0:c0 - s1:c0.c1;
type_transition device_t console_t : file console_device_t;
type_member device_t bin_t : file exec_t;
if console_login{
type_change auditadm_t console_device_t : file user_tty_device_t;
}
role_transition system_r bin_t user_r;
auditallow device_t auditadm_t: file { open };
dontaudit device_t auditadm_t: file { read };
allow system_r user_r;
allow console_t console_device_t: char { write setattr };
allow console_t console_device_t: file { open read getattr };
allow foo_type self: file { execute };
allow bin_t device_t: file { execute };
allow bin_t exec_t: file { execute };
allow bin_t bin_t: file { execute };
allow a_t b_t : file { write };
allow console_t console_device_t: file { read write getattr setattr lock append };
allow kernel_t kernel_t : file { execute };
if b1 {
allow a_t b_t : file { read };
}
if secure_mode{
auditallow device_t exec_t: file { read write };
}
if console_login{
allow getty_t console_device_t: file { getattr open read write append };
}
else {
dontaudit getty_t console_device_t: file { getattr open read write append };
}
if (not ((secure_mode eq console_login) xor ((secure_mode or console_login) and secure_mode))){
allow bin_t exec_t: file { execute };
}
user system_u roles system_r level s0:c0 range s0:c0 - s1:c0,c1;
user user_u roles user_r level s0:c0 range s0:c0 - s0:c0;
validatetrans file (t1 == exec_t);
constrain char transition (not (((t1 eq exec_t) and (t2 eq bin_t)) or (r1 eq r2)));
constrain file { open } (r1 dom r2);
constrain file { open } (r1 domby r2);
constrain file { open } (r1 incomp r2);
constrain file { open read getattr } (not (((t1 eq exec_t) and (t2 eq bin_t)) or (r1 eq r2)));
constrain char { write setattr } (not (((t1 eq exec_t) and (t2 eq bin_t)) or (r1 eq r2)));
sid kernel system_u:system_r:kernel_t:s0:c0 - s1:c0,c1
sid security system_u:system_r:security_t:s0:c0 - s1:c0,c1
sid unlabeled system_u:system_r:unlabeled_t:s0:c0 - s1:c0,c1
fs_use_xattr ext3 system_u:system_r:bin_t:s0:c0 - s1:c0,c1;
genfscon proc /usr/bin system_u:system_r:bin_t:s0:c0 - s1:c0,c1
portcon tcp 22 system_u:system_r:bin_t:s0:c0 - s1:c0,c1
portcon udp 25 system_u:system_r:bin_t:s0:c0 - s1:c0,c1
netifcon eth0 system_u:system_r:bin_t:s0:c0 - s1:c0,c1 system_u:system_r:bin_t:s0:c0 - s1:c0,c1
nodecon 192.25.35.200 192.168.1.1 system_u:system_r:bin_t:s0:c0 - s1:c0,c1
nodecon 2001:db8:ac10:fe01:: 2001:de0:da88:2222:: system_u:system_r:bin_t:s0:c0 - s1:c0,c1

View File

@ -0,0 +1,153 @@
#!/bin/bash
# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#
# runtest.sh of /CoreOS/checkpolicy/Sanity/checkpolicy
# Description: runs checkpolicy with various options to find out if it behaves correctly
# Author: Milos Malik <mmalik@redhat.com>
#
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#
# Copyright (c) 2009 Red Hat, Inc. All rights reserved.
#
# This copyrighted material is made available to anyone wishing
# to use, modify, copy, or redistribute it subject to the terms
# and conditions of the GNU General Public License version 2.
#
# This program is distributed in the hope that it will be
# useful, but WITHOUT ANY WARRANTY; without even the implied
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
# PURPOSE. See the GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public
# License along with this program; if not, write to the Free
# Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
# Boston, MA 02110-1301, USA.
#
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
# Include rhts environment
. /usr/bin/rhts-environment.sh
. /usr/share/beakerlib/beakerlib.sh
PACKAGE="checkpolicy"
rlJournalStart
rlPhaseStartSetup
rlAssertRpm ${PACKAGE}
rlAssertRpm selinux-policy-minimum
rlAssertRpm selinux-policy-mls
rlAssertRpm selinux-policy-targeted
rlRun "uname -a"
TEST_FILE=`mktemp`
TEST_DIR=`mktemp -d`
OUTPUT_FILE=`mktemp`
rlAssertExists "/usr/bin/checkpolicy"
rlPhaseEnd
rlPhaseStartTest "compilation from policy.conf"
MIN_VERSION="15"
MAX_VERSION=`find /etc/selinux/ -name policy.?? | cut -d / -f 6 | cut -d . -f 2 | head -n 1`
if rlIsRHEL 5 6 ; then
VERSIONS=`seq ${MIN_VERSION} 1 ${MAX_VERSION}`
else
# some versions are skipped because seinfo segfaults when inspecting binary policies between v.20 and v.23"
VERSIONS=`seq ${MIN_VERSION} 1 ${MAX_VERSION} | grep -v -e 19 -e 20 -e 21 -e 22 -e 23`
fi
for CUR_VERSION in ${VERSIONS} ; do
rlRun "rm -f policy.out"
rlWatchdog "checkpolicy -M -c ${CUR_VERSION} -o policy.out policy.conf.from.secilc" 15
if [ -s policy.out ] ; then
rlRun "seinfo policy.out 2>&1 | tee ${OUTPUT_FILE}"
rlRun "grep -i -e \"policy version.*${CUR_VERSION}\" -e \"unable to open policy\" ${OUTPUT_FILE}"
else
rlRun "ls -l policy.out"
fi
done
rlPhaseEnd
rlPhaseStartTest
rlRun "checkpolicy >& ${TEST_FILE}" 1
rlAssertGrep "loading policy configuration from policy.conf" ${TEST_FILE}
rlRun "checkpolicy -b >& ${TEST_FILE}" 1
rlAssertGrep "loading policy configuration from policy" ${TEST_FILE}
rlRun "checkpolicy -V"
rlRun "checkpolicy -U 2>&1 | grep \"option requires an argument\""
rlRun "checkpolicy -U xyz" 1
rlRun "rm -f policy.conf"
if ! rlIsRHEL 4 ; then
for OPTION in "deny" "reject" "allow" ; do
rlRun "checkpolicy -U ${OPTION} >& ${TEST_FILE}" 1
rlAssertGrep "unable to open policy.conf" ${TEST_FILE}
done
fi
rlRun "rm -f ${TEST_FILE}"
rlRun "touch ${TEST_FILE}"
rlRun "rm -rf ${TEST_DIR}"
rlRun "mkdir ${TEST_DIR}"
rlRun "checkpolicy ${TEST_FILE}" 1,2
rlRun "checkpolicy -b ${TEST_FILE}" 1
rlRun "checkpolicy ${TEST_DIR}" 1,2
rlRun "checkpolicy -b ${TEST_DIR}" 1
rlRun "rm -f ${TEST_FILE}"
rlRun "rm -rf ${TEST_DIR}"
rlRun "checkpolicy ${TEST_FILE}" 1
rlRun "checkpolicy -b ${TEST_FILE}" 1
rlRun "checkpolicy -c 2>&1 | grep \"option requires an argument\""
rlRun "checkpolicy -c 0 2>&1 | grep \"value 0 not in range\""
rlRun "checkpolicy -t 2>&1 | grep \"option requires an argument\""
rlRun "checkpolicy -t xyz 2>&1 | grep -i \"unknown target platform\""
rlRun "checkpolicy --help 2>&1 | grep -- '-m]'" 1
rlPhaseEnd
rlPhaseStartTest
if rlIsRHEL 5 6 ; then
ACTIVE_POLICY="/selinux/policy"
else
ACTIVE_POLICY="/sys/fs/selinux/policy"
fi
rlRun "echo -e 'q\n' | checkpolicy -Mdb ${ACTIVE_POLICY} | tee ${OUTPUT_FILE}"
rlRun "grep -qi -e error -e ebitmap -e 'not match' ${OUTPUT_FILE}" 1
for POLICY_TYPE in minimum mls targeted ; do
if [ ! -e /etc/selinux/${POLICY_TYPE}/policy/policy.* ] ; then
continue
fi
rlRun "echo -e 'q\n' | checkpolicy -Mdb /etc/selinux/${POLICY_TYPE}/policy/policy.* | tee ${OUTPUT_FILE}"
rlRun "grep -qi -e error -e ebitmap -e 'not match' ${OUTPUT_FILE}" 1
done
rlPhaseEnd
rlPhaseStartTest
if rlIsRHEL 5 6 ; then
ACTIVE_POLICY_TREE="/selinux"
else # RHEL-7 and above
ACTIVE_POLICY_TREE="/sys/fs/selinux"
fi
MIN_VERSION="15"
MAX_VERSION=`find /etc/selinux/ -name policy.?? | cut -d / -f 6 | cut -d . -f 2 | head -n 1`
for POLICY_TYPE in minimum mls targeted ; do
if rlIsRHEL 5 6 ; then
VERSIONS=`seq ${MIN_VERSION} 1 ${MAX_VERSION}`
else
# some versions are skipped because seinfo segfaults when inspecting binary policies between v.20 and v.23"
VERSIONS=`seq ${MIN_VERSION} 1 ${MAX_VERSION} | grep -v -e 19 -e 20 -e 21 -e 22 -e 23`
fi
for CUR_VERSION in ${VERSIONS} ; do
rlRun "rm -f policy.out"
rlWatchdog "checkpolicy -b -M -c ${CUR_VERSION} -o policy.out /etc/selinux/${POLICY_TYPE}/policy/policy.${MAX_VERSION}" 15
if [ -s policy.out ] ; then
rlRun "seinfo policy.out 2>&1 | tee ${OUTPUT_FILE}"
rlRun "grep -i -e \"policy version.*${CUR_VERSION}\" -e \"unable to open policy\" ${OUTPUT_FILE}"
else
rlRun "ls -l policy.out"
fi
done
done
rlPhaseEnd
rlPhaseStartCleanup
rm -f ${OUTPUT_FILE} policy.out
rlPhaseEnd
rlJournalPrintText
rlJournalEnd

65
tests/sedismod/Makefile Normal file
View File

@ -0,0 +1,65 @@
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#
# Makefile of /CoreOS/checkpolicy/Sanity/sedismod
# Description: Does sedismod work correctly ?)
# Author: Milos Malik <mmalik@redhat.com>
#
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#
# Copyright (c) 2016 Red Hat, Inc.
#
# This copyrighted material is made available to anyone wishing
# to use, modify, copy, or redistribute it subject to the terms
# and conditions of the GNU General Public License version 2.
#
# This program is distributed in the hope that it will be
# useful, but WITHOUT ANY WARRANTY; without even the implied
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
# PURPOSE. See the GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public
# License along with this program; if not, write to the Free
# Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
# Boston, MA 02110-1301, USA.
#
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
export TEST=/CoreOS/checkpolicy/Sanity/sedismod
export TESTVERSION=1.0
BUILT_FILES=
FILES=$(METADATA) runtest.sh Makefile PURPOSE sedismod.exp
.PHONY: all install download clean
run: $(FILES) build
./runtest.sh
build: $(BUILT_FILES)
test -x runtest.sh || chmod a+x runtest.sh
test -x sedismod.exp || chmod a+x sedismod.exp
clean:
rm -f *~ $(BUILT_FILES)
include /usr/share/rhts/lib/rhts-make.include
$(METADATA): Makefile
@echo "Owner: Milos Malik <mmalik@redhat.com>" > $(METADATA)
@echo "Name: $(TEST)" >> $(METADATA)
@echo "TestVersion: $(TESTVERSION)" >> $(METADATA)
@echo "Path: $(TEST_DIR)" >> $(METADATA)
@echo "Description: Does sedismod work correctly?" >> $(METADATA)
@echo "Type: Sanity" >> $(METADATA)
@echo "TestTime: 10m" >> $(METADATA)
@echo "RunFor: checkpolicy" >> $(METADATA)
@echo "Requires: checkpolicy selinux-policy-targeted expect policycoreutils psmisc" >> $(METADATA)
@echo "Priority: Normal" >> $(METADATA)
@echo "License: GPLv2" >> $(METADATA)
@echo "Confidential: no" >> $(METADATA)
@echo "Destructive: no" >> $(METADATA)
@echo "Releases: -RHEL4 -RHELClient5 -RHELServer5" >> $(METADATA)
rhts-lint $(METADATA)

5
tests/sedismod/PURPOSE Normal file
View File

@ -0,0 +1,5 @@
PURPOSE of /CoreOS/checkpolicy/Sanity/sedismod
Author: Milos Malik <mmalik@redhat.com>
Does sedismod work correctly?

83
tests/sedismod/runtest.sh Executable file
View File

@ -0,0 +1,83 @@
#!/bin/bash
# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#
# runtest.sh of /CoreOS/checkpolicy/Sanity/sedismod
# Description: Does sedismod work correctly
# Author: Milos Malik <mmalik@redhat.com>
#
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#
# Copyright (c) 2016 Red Hat, Inc.
#
# This copyrighted material is made available to anyone wishing
# to use, modify, copy, or redistribute it subject to the terms
# and conditions of the GNU General Public License version 2.
#
# This program is distributed in the hope that it will be
# useful, but WITHOUT ANY WARRANTY; without even the implied
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
# PURPOSE. See the GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public
# License along with this program; if not, write to the Free
# Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
# Boston, MA 02110-1301, USA.
#
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
# Include Beaker environment
. /usr/bin/rhts-environment.sh || exit 1
. /usr/share/beakerlib/beakerlib.sh || exit 1
PACKAGE="checkpolicy"
# TODO: repeat for all policy modules that are installed under /etc/selinux
if rlIsFedora ; then
POLICY_FILE="`find /var/lib/selinux/targeted -type d -name base`/hll"
elif rlIsRHEL '<7.3' ; then
POLICY_FILE=`find /etc/selinux/targeted -type f -name base.pp`
else # RHEL-7.3 and above
POLICY_FILE="`find /etc/selinux/targeted -type d -name base`/hll"
fi
rlJournalStart
rlPhaseStartSetup
rlAssertRpm ${PACKAGE}
OUTPUT_FILE=`mktemp`
if rlIsRHEL '>=7.3' || rlIsFedora ; then
rlRun "semodule -H -E base"
else
rlRun "cp ${POLICY_FILE} ./base.pp.bz2"
rlRun "rm -f base.pp"
rlRun "bzip2 -d ./base.pp.bz2"
fi
POLICY_FILE="base.pp"
rlRun "ls -l ${POLICY_FILE}"
rlPhaseEnd
rlPhaseStartTest "check all available options"
if rlIsRHEL 6 ; then
AVAILABLE_OPTIONS="1 2 3 4 5 6 7 8 0 a b c u"
else # RHEL-7 and above
AVAILABLE_OPTIONS="1 2 3 4 5 6 7 8 9 0 a b c u F"
fi
for OPTION in ${AVAILABLE_OPTIONS} ; do
rlRun "rm -f ${OUTPUT_FILE}"
rlWatchdog "./sedismod.exp ${OPTION} ${POLICY_FILE} ${OUTPUT_FILE}" 65
# rlWatchdog kills the expect script, but we need to kill the sedismod process too
rlRun "killall sedismod" 0,1
rlRun "ls -l ${OUTPUT_FILE}"
if [ -s ${OUTPUT_FILE} ] ; then
rlPass "sedismod produced some output"
else
rlFail "sedismod did not produce any output"
fi
done
rlPhaseEnd
rlPhaseStartCleanup
rlRun "rm -f ${OUTPUT_FILE} ${POLICY_FILE}"
rlPhaseEnd
rlJournalPrintText
rlJournalEnd

21
tests/sedismod/sedismod.exp Executable file
View File

@ -0,0 +1,21 @@
#!/usr/bin/expect -f
# ./sedismod.exp option policyfile outputfile
set option [lrange $argv 0 0]
set policyfile [lrange $argv 1 1]
set outputfile [lrange $argv 2 2]
set timeout 60
spawn sedismod $policyfile
expect "Command*:" {
send -- "f\r"
}
expect "Filename*:" {
send -- "$outputfile\r"
}
expect "Command*:" {
send -- "$option\r"
}
expect "Command*:" {
send -- "q\r"
}
expect eof

65
tests/sedispol/Makefile Normal file
View File

@ -0,0 +1,65 @@
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#
# Makefile of /CoreOS/checkpolicy/Sanity/sedispol
# Description: Does sedispol work correctly?
# Author: Milos Malik <mmalik@redhat.com>
#
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#
# Copyright (c) 2016 Red Hat, Inc.
#
# This copyrighted material is made available to anyone wishing
# to use, modify, copy, or redistribute it subject to the terms
# and conditions of the GNU General Public License version 2.
#
# This program is distributed in the hope that it will be
# useful, but WITHOUT ANY WARRANTY; without even the implied
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
# PURPOSE. See the GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public
# License along with this program; if not, write to the Free
# Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
# Boston, MA 02110-1301, USA.
#
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
export TEST=/CoreOS/checkpolicy/Sanity/sedispol
export TESTVERSION=1.0
BUILT_FILES=
FILES=$(METADATA) runtest.sh Makefile PURPOSE sedispol.exp
.PHONY: all install download clean
run: $(FILES) build
./runtest.sh
build: $(BUILT_FILES)
test -x runtest.sh || chmod a+x runtest.sh
test -x sedispol.exp || chmod a+x sedispol.exp
clean:
rm -f *~ $(BUILT_FILES)
include /usr/share/rhts/lib/rhts-make.include
$(METADATA): Makefile
@echo "Owner: Milos Malik <mmalik@redhat.com>" > $(METADATA)
@echo "Name: $(TEST)" >> $(METADATA)
@echo "TestVersion: $(TESTVERSION)" >> $(METADATA)
@echo "Path: $(TEST_DIR)" >> $(METADATA)
@echo "Description: Does sedispol work correctly?" >> $(METADATA)
@echo "Type: Sanity" >> $(METADATA)
@echo "TestTime: 10m" >> $(METADATA)
@echo "RunFor: checkpolicy" >> $(METADATA)
@echo "Requires: checkpolicy selinux-policy expect" >> $(METADATA)
@echo "Priority: Normal" >> $(METADATA)
@echo "License: GPLv2" >> $(METADATA)
@echo "Confidential: no" >> $(METADATA)
@echo "Destructive: no" >> $(METADATA)
@echo "Releases: -RHEL4 -RHELClient5 -RHELServer5" >> $(METADATA)
rhts-lint $(METADATA)

5
tests/sedispol/PURPOSE Normal file
View File

@ -0,0 +1,5 @@
PURPOSE of /CoreOS/checkpolicy/Sanity/sedispol
Author: Milos Malik <mmalik@redhat.com>
Does sedispol work correctly?

77
tests/sedispol/runtest.sh Executable file
View File

@ -0,0 +1,77 @@
#!/bin/bash
# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#
# runtest.sh of /CoreOS/checkpolicy/Sanity/sedispol
# Description: Does sedispol work correctly?
# Author: Milos Malik <mmalik@redhat.com>
#
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#
# Copyright (c) 2016 Red Hat, Inc.
#
# This copyrighted material is made available to anyone wishing
# to use, modify, copy, or redistribute it subject to the terms
# and conditions of the GNU General Public License version 2.
#
# This program is distributed in the hope that it will be
# useful, but WITHOUT ANY WARRANTY; without even the implied
# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
# PURPOSE. See the GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public
# License along with this program; if not, write to the Free
# Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
# Boston, MA 02110-1301, USA.
#
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
# Include Beaker environment
. /usr/bin/rhts-environment.sh || exit 1
. /usr/share/beakerlib/beakerlib.sh || exit 1
PACKAGE="checkpolicy"
# TODO: repeat for all policy files that are installed under /etc/selinux
POLICY_FILE=`find /etc/selinux/targeted/policy/ -type f`
rlJournalStart
rlPhaseStartSetup
rlAssertRpm ${PACKAGE}
OUTPUT_FILE=`mktemp`
rlPhaseEnd
rlPhaseStartTest
if rlIsRHEL 6 ; then
AVAILABLE_OPTIONS="1 2 3 4 5 6 c p u"
else # RHEL-7 and above
AVAILABLE_OPTIONS="1 2 3 4 5 6 8 c p u F"
fi
for OPTION in ${AVAILABLE_OPTIONS} ; do
rlRun "rm -f ${OUTPUT_FILE}"
rlWatchdog "./sedispol.exp ${OPTION} ${POLICY_FILE} ${OUTPUT_FILE}" 65
# rlWatchdog kills the expect script, but we need to kill the sedispol process too
rlRun "killall sedispol" 0,1
rlRun "ls -l ${OUTPUT_FILE}"
if [ -s ${OUTPUT_FILE} ] ; then
rlPass "sedispol produced some output"
else
rlFail "sedispol did not produce any output"
fi
done
rlPhaseEnd
rlPhaseStartTest
rlRun "echo q | sedispol ${POLICY_FILE} >& ${OUTPUT_FILE}"
rlRun "grep AVTAB ${OUTPUT_FILE}"
rlRun "grep AVTAG ${OUTPUT_FILE}" 1
rlRun "echo -en 'u\nq\n' | sedispol ${POLICY_FILE} >& ${OUTPUT_FILE}"
rlRun "grep permissions ${OUTPUT_FILE}"
rlRun "grep permisions ${OUTPUT_FILE}" 1
rlPhaseEnd
rlPhaseStartCleanup
rlRun "rm -f ${OUTPUT_FILE}"
rlPhaseEnd
rlJournalPrintText
rlJournalEnd

21
tests/sedispol/sedispol.exp Executable file
View File

@ -0,0 +1,21 @@
#!/usr/bin/expect -f
# ./sedispol.exp option policyfile outputfile
set option [lrange $argv 0 0]
set policyfile [lrange $argv 1 1]
set outputfile [lrange $argv 2 2]
set timeout 60
spawn sedispol $policyfile
expect "Command*:" {
send -- "f\r"
}
expect "Filename*:" {
send -- "$outputfile\r"
}
expect "Command*:" {
send -- "$option\r"
}
expect "Command*:" {
send -- "q\r"
}
expect eof

61
tests/tests.yml Normal file
View File

@ -0,0 +1,61 @@
---
# Tests for Classic
- hosts: localhost
roles:
- role: standard-test-beakerlib
tags:
- classic
repositories:
- repo: "https://src.fedoraproject.org/tests/selinux.git"
dest: "selinux"
fmf_filter: "tier:1 | component:checkpolicy"
required_packages:
- checkpolicy # Required by all tests
- man # Required by checkpolicy-docs
- grep # Required by checkmodule
- coreutils # Required by checkmodule
- setools-console # Required by checkpolicy
- selinux-policy-minimum # Required by checkpolicy
- selinux-policy-mls # Required by checkpolicy
- selinux-policy-targeted # Required by checkpolicy and sedismod
- expect # Required by sedismod and sedispol
- policycoreutils # Required by sedismod
- psmisc # Required by sedismod
- selinux-policy # Required by sedispol
- e2fsprogs
- gcc
- git
- libselinux
- libselinux-utils
- libsemanage
- libsepol
- libsepol-devel
- policycoreutils-python-utils
- selinux-policy-devel
# Tests for Container
- hosts: localhost
roles:
- role: standard-test-beakerlib
tags:
- container
repositories:
- repo: "https://src.fedoraproject.org/tests/selinux.git"
dest: "selinux"
tests:
- selinux/checkpolicy/checkmodule
- selinux/checkpolicy/checkpolicy
- selinux/checkpolicy/sedismod
- selinux/checkpolicy/sedispol
required_packages:
- checkpolicy # Required by all tests
- grep # Required by checkmodule
- coreutils # Required by checkmodule
- setools-console # Required by checkpolicy
- selinux-policy-minimum # Required by checkpolicy
- selinux-policy-mls # Required by checkpolicy
- selinux-policy-targeted # Required by checkpolicy and sedismod
- expect # Required by sedismod and sedispol
- policycoreutils # Required by sedismod
- psmisc # Required by sedismod
- selinux-policy # Required by sedispol