PR#10: Test reboot of CI machine and collect AVCs - rpms/libsepol

rpms / libsepol

#10 Test reboot of CI machine and collect AVCs

Closed 3 years ago by plautrba. Opened 3 years ago by plautrba.

rpms/ plautrba/libsepol test-reboot into master

Test reboot of CI machine and collect AVCs

Petr Lautrbach • 3 years ago

6f541f3

tests/test-reboot.yml

file added

+42

		`@@ -0,0 +1,42 @@`
		`+ ---`
		`+ - hosts: localhost`
		`+ vars:`
		`+ - artifacts: "{{ lookup('env', 'TEST_ARTIFACTS')\|default('./artifacts', true) }}"`
		`+ tags:`
		`+ - classic`
		`+ tasks:`
		`+ - name: reboot`
		`+ block:`
		`+ - name: restart host`
		`+ shell: sleep 2 && shutdown -r now "Ansible updates triggered"`
		`+ async: 1`
		`+ poll: 0`
		`+ ignore_errors: true`
		`+`
		`+ - name: wait for host to come back`
		`+ wait_for_connection:`
		`+ delay: 10`
		`+ timeout: 300`
		`+`
		`+ - name: Re-create /tmp/artifacts`
		`+ command: mkdir /tmp/artifacts`
		`+`
		`+ - name: Generate fake SELinux denial`
		`+ shell: runcon -u system_u -r system_r -t init_t -- /bin/cat /etc/shadow \|\| true`
		`+`
		`+ - name: Gather SELinux denials since boot`
		`+ shell: \|`
		`+ ausearch -m avc -m selinux_err -m user_avc -ts boot > /tmp/avc.log 2> /tmp/avc.err.log`
		`+ grep -q '<no matches>' /tmp/avc.err.log && result=pass \|\| result=fail`
		`+ echo -e "results:\n- {result: $result, test: reboot}" > /tmp/results.yml`
		`+`
		`+ always:`
		`+ - name: Pull out the artifacts`
		`+ fetch:`
		`+ dest: "{{ artifacts }}/"`
		`+ src: "{{ item }}"`
		`+ flat: yes`
		`+ with_items:`
		`+ - /tmp/avc.log`
		`+ - /tmp/avc.err.log`
		`+ - /tmp/results.yml`

tests/tests.yml

file modified

+1 -12

		`@@ -1,12 +1,1 @@`
		`- ---`
		`- # Tests that run in all contexts`
		`- - hosts: localhost`
		`- roles:`
		`- - role: standard-test-beakerlib`
		`- tags:`
		`- - classic`
		`- - container`
		`- repositories:`
		`- - repo: "https://src.fedoraproject.org/tests/selinux.git"`
		`- dest: "selinux"`
		`- fmf_filter: "tier: 1 \| component: libsepol"`
		`+ - import_playbook: test-reboot.yml`

plautrba commented 3 years ago

DO NOT MERGE

rebased onto 15bdc6b

3 years ago

rebased onto 54c02f4

3 years ago

plautrba commented 3 years ago

[citest]

rebased onto 6f541f3

3 years ago

plautrba commented 3 years ago

[citest]

mmalik commented 3 years ago

Could you add dmesg to the list of executed commands? SELinux denials may appear before the auditd is started and in that case they are not present in the output of ausearch.

Pull-Request has been closed by plautrba

3 years ago