#449 fix the relevancy of tests failing on centos stream
Merged 5 months ago by mmalik. Opened 5 months ago by mmalik.
tests/ mmalik/selinux fix-relevancy-for-centos  into  main

@@ -32,8 +32,8 @@ 

    - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2008965

  adjust:

    - enabled: false

-     when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8

-     continue: false

+     when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8

+     because: the validatetrans program is not available there

    - enabled: false

      when: distro < Fedora-32

      continue: false

@@ -18,7 +18,7 @@ 

  

      rlPhaseStartTest "sepolicy manpage --web, bz#1854639 + bz#1989840"

          rlRun "sepolicy manpage --web -d zebra_t"

-         if rlIsRHEL 7 8 ; then

+         if rlIsRHEL 7 8 || rlIsCentOS 7 8 ; then

              rlRun "ls -l /tmp/*release*" 0 "Html file with OS name exists."

              rlRun "cat /tmp/*release* > /tmp/testfile"

          else

@@ -119,7 +119,7 @@ 

      rlPhaseEnd

      fi

  

-     if ! rlIsRHEL 6 7 8 ; then

+     if ! rlIsRHEL 6 7 8 && ! rlIsCentOS 6 7 8 ; then

      rlPhaseStartTest "bz#1996903 + bz#1996905 + bz#2001141 + bz#2001143 + bz#2001144 + bz#2001145 + bz#2036582"

          rlSEMatchPathCon "/usr/sbin/ModemManager" "modemmanager_exec_t"

          rlSESearchRule "allow modemmanager_t modemmanager_t : qipcrtr_socket { create getattr getopt } [ ]"

@@ -79,7 +79,7 @@ 

  

      rlPhaseStartTest "real scenario -- standalone service"

          rlRun "sed -i 's/^\(include.*\)$/# \1/' /etc/bgpd.conf"

-         if rlIsRHEL 8 ; then

+         if rlIsRHEL 8 || rlIsCentOS 8 ; then

              # work around BZ#1830170 that was closed as WONTFIX

              rlRun "chcon -t bin_t /usr/sbin/bgpd"

              PROCESS_CONTEXT="unconfined_service_t"
@@ -87,7 +87,7 @@ 

          rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1

          rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255

          rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1

-         if rlIsRHEL 8 ; then

+         if rlIsRHEL 8 || rlIsCentOS 8 ; then

              # work around BZ#1830170 that was closed as WONTFIX

              rlRun "restorecon -v /usr/sbin/bgpd"

          fi

@@ -37,7 +37,7 @@ 

    - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2218106

  adjust:

    - enabled: false

-     when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8

+     when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8

      because: the package is not available there

    - enabled: false

      when: arch == ppc64, ppc64le, s390x

@@ -201,7 +201,7 @@ 

          rlPhaseEnd

      fi

  

-     if ! rlIsRHEL 5 6 7 8 ; then

+     if ! rlIsRHEL 5 6 7 8 && ! rlIsCentOS 5 6 7 8 ; then

          rlPhaseStartTest "bz#1827591 + bz#1923929"

              rlSEMatchPathCon "/usr/sbin/rndc" "ndc_exec_t"

              rlSESearchRule "dontaudit ndc_t ndc_t : process { setsched } [ ]"

@@ -177,7 +177,7 @@ 

      rlPhaseEnd

      fi

  

-     if ! rlIsRHEL 5 6 7 8 ; then

+     if ! rlIsRHEL 5 6 7 8 && ! rlIsCentOS 5 6 7 8 ; then

      rlPhaseStartTest "bz#1960513"

          rlRun "ls -l /usr/sbin/amandad"

          rlSEMatchPathCon "/usr/lib64/amanda/amandad" "amanda_inetd_exec_t"

@@ -23,9 +23,10 @@ 

  enabled: true

  tag:

    - failinfedora

+   - targeted

  adjust:

    - enabled: false

-     when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8

+     when: distro == rhel-4, rhel-5, rhel-6, rhel-7

      because: the caddy package is not available there

  link:

    - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1706651

@@ -23,7 +23,7 @@ 

    - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1915264

  adjust:

    - enabled: false

-     when: distro = rhel-4, rhel-5, rhel-6, rhel-7, rhel-8

+     when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8

      continue: false

  extra-nitrate: TC#0615396

  id: 251fd08a-0f65-4592-8d4d-2b79e9479460

@@ -94,7 +94,7 @@ 

          rlSESearchRule "allow cupsd_lpd_t cupsd_var_run_t : sock_file { read } [ ]"

      rlPhaseEnd

  

-     if ! rlIsRHEL 5 6 7 8 ; then

+     if ! rlIsRHEL 5 6 7 8 && ! rlIsCentOS 5 6 7 8 ; then

      rlPhaseStartTest "bz#2020531"

          rlSEMatchPathCon "/usr/lib/cups/daemon/cups-lpd" "cupsd_lpd_exec_t"

          rlRun "ls -Z /proc/1/environ | grep :init_t"

@@ -105,7 +105,7 @@ 

          rlSESearchRule "type_transition cups_pdf_t var_log_t : file cupsd_log_t"

      rlPhaseEnd

  

-     if ! rlIsRHEL 8 ; then

+     if ! rlIsRHEL 8 && ! rlIsCentOS 8 ; then

      rlPhaseStartTest "bz#1832521"

          rlSESearchRule "allow cups_pdf_t cups_pdf_t : unix_dgram_socket { create connect } [ ]"

      rlPhaseEnd

@@ -52,7 +52,7 @@ 

          sleep 2

      rlPhaseEnd

  

-     if ! rlIsRHEL 8 ; then

+     if ! rlIsRHEL 8 && ! rlIsCentOS 8 ; then

      rlPhaseStartTest "bz#1897388"

          rlSEMatchPathCon "/usr/sbin/dhclient-script" "dhcpc_exec_t"

          rlSEMatchPathCon "/usr/bin/chronyc" "chronyc_exec_t"
@@ -78,7 +78,7 @@ 

          DHCLIENT_PID=`pgrep dhclient`

          rlRun "ps -efZ | grep dhclient"

          rlRun "ps -efZ | grep ':dhcpc_t:.*dhclient'"

-         if ! rlIsRHEL 8 ; then

+         if ! rlIsRHEL 8 && ! rlIsCentOS 8 ; then

              rlRun "ls -alZ /run/chrony-dhcp"

          fi

      rlPhaseEnd

@@ -168,7 +168,7 @@ 

      rlPhaseEnd

      fi

  

-     if ! rlIsRHEL 5 6 7 8 ; then

+     if ! rlIsRHEL 5 6 7 8 && ! rlIsCentOS 5 6 7 8 ; then

      rlPhaseStartTest "bz#1989641"

          rlSESearchRule "allow firewalld_t firewalld_t : capability { setpcap } [ ]"

          rlSESearchRule "allow firewalld_t firewalld_t : process { setcap } [ ]"

@@ -99,7 +99,7 @@ 

      rlPhaseEnd

      fi

  

-     if ! rlIsRHEL 7 8 ; then

+     if ! rlIsRHEL 7 8 && ! rlIsCentOS 7 8 ; then

      rlPhaseStartTest "bz#2075527 + bz#2152823"

          rlSESearchRule "allow syslogd_t syslogd_var_run_t : file { relabelfrom relabelto } [ ]"

          rlRun "journalctl --rotate"

@@ -32,7 +32,7 @@ 

    - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1933134

  adjust:

    - enabled: false

-     when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7, rhel-8

+     when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7, rhel-8, centos-stream-8

      because: the lockdown class is not defined there

  extra-summary: /CoreOS/selinux-policy/Sanity/lockdown-class

  extra-task: /CoreOS/selinux-policy/Sanity/lockdown-class

@@ -23,7 +23,7 @@ 

  duration: 10m

  adjust:

    - enabled: false

-     when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8

+     when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8

      because: the nas package is not available there

  extra-summary: /CoreOS/selinux-policy/Regression/nasd-and-similar

  extra-task: /CoreOS/selinux-policy/Regression/nasd-and-similar

@@ -36,7 +36,7 @@ 

    - verifies: https://issues.redhat.com/browse/RHEL-15085

  adjust:

    - enabled: false

-     when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8

+     when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8

      because: the ntpsec package is not available there

  extra-summary: /CoreOS/selinux-policy/Regression/ntpsec-and-similar

  extra-task: /CoreOS/selinux-policy/Regression/ntpsec-and-similar

@@ -35,7 +35,7 @@ 

    - verifies: https://issues.redhat.com/browse/RHEL-1557

  adjust:

    - enabled: false

-     when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8

+     when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8

      because: the nvme-stas package is not available there

  extra-summary: /CoreOS/selinux-policy/Regression/nvme-stas-and-similar

  extra-task: /CoreOS/selinux-policy/Regression/nvme-stas-and-similar

@@ -53,6 +53,7 @@ 

          sleep 2

      rlPhaseEnd

  

+     if ! rlIsRHEL 8 && ! rlIsCentOS 8 ; then

      rlPhaseStartTest "bz#2208696"

          rlSEMatchPathCon "${FILE_PATH}" "${FILE_CONTEXT}"

          rlSEMatchPathCon "/var/run" "var_run_t"
@@ -66,6 +67,7 @@ 

          rlSEMatchPathCon "/run/smtpd.sock" "sendmail_var_run_t"

          rlSESearchRule "allow sendmail_t sendmail_t : unix_stream_socket { connectto } [ ]"

      rlPhaseEnd

+     fi

  

      rlPhaseStartTest "real scenario -- standalone service"

          rlRun "sestatus | mailx -s test-email root@localhost"

@@ -52,7 +52,7 @@ 

          sleep 2

      rlPhaseEnd

  

-     if ! rlIsRHEL 8 ; then

+     if ! rlIsRHEL 8 && ! rlIsCentOS 8 ; then

      rlPhaseStartTest "bz#1958819"

          rlSESearchRule "allow init_t guest_t : process2 { nnp_transition } [ ]"

          rlSESearchRule "allow init_t staff_t : process2 { nnp_transition } [ ]"

@@ -64,7 +64,7 @@ 

          rlSESearchRule "allow sysadm_t sysadm_t : perf_event { open cpu kernel read write } [ ]"

      rlPhaseEnd

  

-     if ! rlIsRHEL 8 ; then

+     if ! rlIsRHEL 8 && ! rlIsCentOS 8 ; then

      rlPhaseStartTest "bz#2229936"

          rlSESearchRule "allow sysadm_t kernel_t : bpf { prog_run } [ ]"

      rlPhaseEnd

@@ -35,7 +35,7 @@ 

    - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1465824

  adjust:

    - enabled: false

-     when: distro == rhel-4, rhel-5, rhel-6, rhel-8

+     when: distro == rhel-4, rhel-5, rhel-6

      continue: false

  extra-nitrate: TC#0546229

  extra-summary: /CoreOS/selinux-policy/Sanity/policy-rpm-macros

@@ -27,6 +27,7 @@ 

    - NoRHEL5

    - NoRHEL6

    - NoRHEL7

+   - NoRHEL8

    - targeted

  link:

    - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1461313
@@ -35,7 +36,7 @@ 

    - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2164752

  adjust:

    - enabled: false

-     when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8

+     when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8

      continue: false

  extra-nitrate: TC#0609732

  extra-summary: /CoreOS/selinux-policy/Regression/rpmdb-and-similar

@@ -36,7 +36,7 @@ 

  PROCESS_CONTEXT="rpmdb_t"

  

  rlJournalStart

-     if rlIsRHEL '<9' ; then

+     if rlIsRHEL '<9' || rlIsCentOS '<9' ; then

          rlLog "Not applicable to this OS version."

          rlJournalEnd

          exit 0

@@ -41,7 +41,7 @@ 

    - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2140673

  adjust:

    - enabled: false

-     when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8

+     when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8

      continue: false

  extra-nitrate: TC#0613202

  extra-summary: /CoreOS/selinux-policy/Regression/stalld-and-similar

@@ -31,8 +31,8 @@ 

    - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1838163

  adjust:

    - enabled: false

-     when: distro == rhel-4, rhel-5, rhel-6, rhel-8, rhel-9

-     continue: false

+     when: distro == rhel-4, rhel-5, rhel-6, rhel-8, rhel-9, centos-stream-8, centos-stream-9

+     because: the systemd-bootchart package is not available there

  extra-nitrate: TC#0608092

  extra-summary: /CoreOS/selinux-policy/Regression/systemd-bootchart-and-similar

  extra-task: /CoreOS/selinux-policy/Regression/systemd-bootchart-and-similar

@@ -27,7 +27,7 @@ 

  tier: '2'

  adjust:

    - enabled: false

-     when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8

+     when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8

      because: the systemd-creds program is not available there

  link:

    - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2096857

@@ -22,7 +22,7 @@ 

    - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1809878

  adjust:

    - enabled: false

-     when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, rhel-9

+     when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, rhel-9, centos-stream-8, centos-stream-9

      because: the systemd-homed program is not available there

  extra-summary: /CoreOS/selinux-policy/Regression/systemd-homed

  extra-task: /CoreOS/selinux-policy/Regression/systemd-homed

@@ -130,7 +130,7 @@ 

          fi

      rlPhaseEnd

  

-     if ! rlIsRHEL 8 ; then

+     if ! rlIsRHEL 8 && ! rlIsCentOS 8 ; then

      rlPhaseStartTest "bz#2088257 + bz#2088258"

          rlSEMatchPathCon "/usr/lib/systemd/systemd-modules-load" "systemd_modules_load_exec_t"

          rlSEMatchPathCon "/dev/kmsg" "kmsg_device_t"

@@ -50,7 +50,7 @@ 

          sleep 2

      rlPhaseEnd

  

-     if ! rlIsRHEL 8 ; then

+     if ! rlIsRHEL 8 && ! rlIsCentOS 8 ; then

      rlPhaseStartTest "bz#2056207 + bz#2056999"

          rlSEMatchPathCon "/usr/lib/systemd/systemd-sysctl" "systemd_sysctl_exec_t"

          rlRun "ls -Z /proc/sys/fs/suid_dumpable | grep :proc_security_t"

@@ -102,7 +102,7 @@ 

          rlSESearchRule "allow systemd_timedated_t efivarfs_t : file { getattr open read } [ ]"

      rlPhaseEnd

  

-     if ! rlIsRHEL '<9' ; then

+     if ! rlIsRHEL '<9' && ! rlIsCentOS '<9' ; then

      rlPhaseStartTest "bz#1949315"

          rlSEMatchPathCon "/" "root_t"

          rlSEMatchPathCon "/run" "var_run_t"

@@ -48,7 +48,7 @@ 

    - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2222199

  adjust:

    - enabled: true

-     when: distro == rhel-7, rhel-8, fedora

+     when: distro == rhel-7, rhel-8, centos-stream-8, fedora

      because: the targetd package is not available elsewhere

  extra-nitrate: TC#0337221

  extra-summary: /CoreOS/selinux-policy/Regression/targetd-and-similar

@@ -80,7 +80,7 @@ 

          rlSESearchRule "allow usbmuxd_t udev_var_run_t : file { getattr open read } [ ]"

      rlPhaseEnd

  

-     if ! rlIsRHEL 8 ; then

+     if ! rlIsRHEL 8 && ! rlIsCentOS 8 ; then

      rlPhaseStartTest "bz#1930992"

          rlSEMatchPathCon "/sys" "sysfs_t"

          rlSESearchRule "allow usbmuxd_t sysfs_t : filesystem { getattr } [ ]"

@@ -23,7 +23,7 @@ 

    - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1915034

  adjust:

    - enabled: false

-     when: distro = rhel-4, rhel-5, rhel-6, rhel-7, rhel-8

-     continue: false

+     when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8

+     because: the watch permission is not defined there

  extra-nitrate: TC#0615395

  id: c4421242-0b97-4a1e-abbb-1dbe5dd21355

Apparently, the first attempt to adjust the relevancy was not
complete. So here is another one.
Certain tests should not be executed on centos-stream 8 or 9 at all,
because packages required by those tests are not available there.
Certain tests need to reflect the fact that SELinux policies which
confine the tested programs are not present on all versions of RHEL,
CentOS or Fedora.

rebased onto 3a6544c3f01d49d6241ce3114a940f8486064f65

5 months ago

Summary:
* 2 tests failed because of problems not related to SELinux
* 2 tests failed because SELinux denials were found
* the rest of modified tests passed

rebased onto 83cf1ef5435195add029abfd0bad82ddcc079f37

5 months ago

I'm going to merge the PR soon because I would like to use the updated test relevancy values from a different repository.

rebased onto fdf8fa14480269daf68950200f4f53bd3bb3690f

5 months ago

Summary:
* 2 tests failed because of problems not related to SELinux
* 3 tests failed because SELinux denials were found
* the rest of modified tests passed

rebased onto 7582d85

5 months ago

Pull-Request has been merged by mmalik

5 months ago
Metadata
Changes Summary 34
+2 -2
file changed
libselinux/validatetrans/main.fmf
+1 -1
file changed
policycoreutils/sepolicy-manpage/runtest.sh
+1 -1
file changed
selinux-policy/ModemManager-and-similar/runtest.sh
+2 -2
file changed
selinux-policy/bgpd-and-similar/runtest.sh
+1 -1
file changed
selinux-policy/bootupd-and-similar/main.fmf
+1 -1
file changed
selinux-policy/bz562833-chrooted-named-file-contexts/runtest.sh
+1 -1
file changed
selinux-policy/bz733494-amanda-and-similar/runtest.sh
+2 -1
file changed
selinux-policy/caddy-and-similar/main.fmf
+1 -1
file changed
selinux-policy/capability2-class/main.fmf
+1 -1
file changed
selinux-policy/cups-lpd-and-similar/runtest.sh
+1 -1
file changed
selinux-policy/cups-pdf-and-similar/runtest.sh
+2 -2
file changed
selinux-policy/dhclient-and-similar/runtest.sh
+1 -1
file changed
selinux-policy/firewalld-and-similar/runtest.sh
+1 -1
file changed
selinux-policy/journalctl-and-similar/runtest.sh
+1 -1
file changed
selinux-policy/lockdown-class/main.fmf
+1 -1
file changed
selinux-policy/nasd-and-similar/main.fmf
+1 -1
file changed
selinux-policy/ntpsec-and-similar/main.fmf
+1 -1
file changed
selinux-policy/nvme-stas-and-similar/main.fmf
+2 -0
file changed
selinux-policy/opensmtpd-and-similar/runtest.sh
+1 -1
file changed
selinux-policy/pam_limits-and-related/runtest.sh
+1 -1
file changed
selinux-policy/perf_event-and-related/runtest.sh
+1 -1
file changed
selinux-policy/policy-rpm-macros/main.fmf
+2 -1
file changed
selinux-policy/rpmdb-and-similar/main.fmf
+1 -1
file changed
selinux-policy/rpmdb-and-similar/runtest.sh
+1 -1
file changed
selinux-policy/stalld-and-similar/main.fmf
+2 -2
file changed
selinux-policy/systemd-bootchart-and-similar/main.fmf
+1 -1
file changed
selinux-policy/systemd-creds/main.fmf
+1 -1
file changed
selinux-policy/systemd-homed/main.fmf
+1 -1
file changed
selinux-policy/systemd-modules-load-and-similar/runtest.sh
+1 -1
file changed
selinux-policy/systemd-sysctl-and-similar/runtest.sh
+1 -1
file changed
selinux-policy/systemd-timesyncd-and-similar/runtest.sh
+1 -1
file changed
selinux-policy/targetd-and-similar/main.fmf
+1 -1
file changed
selinux-policy/usbmuxd-and-similar/runtest.sh
+2 -2
file changed
selinux-policy/watch-permissions/main.fmf