diff --git a/other/collect-denials/main.fmf b/other/collect-denials/main.fmf new file mode 100644 index 0000000..a02c9b6 --- /dev/null +++ b/other/collect-denials/main.fmf @@ -0,0 +1,11 @@ +summary: collect SELinux denials which appeared since boot +contact: Milos Malik +test: ./runtest.sh +framework: beakerlib +recommend: + - audit + - /usr/sbin/service + - policycoreutils +duration: 5m +enabled: true + diff --git a/other/collect-denials/runtest.sh b/other/collect-denials/runtest.sh new file mode 100755 index 0000000..ff52732 --- /dev/null +++ b/other/collect-denials/runtest.sh @@ -0,0 +1,20 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +rlJournalStart + rlPhaseStartSetup + rlRun "sestatus" + rlRun "rpm -qa | grep -e audit -e libsepol -e libselinux -e libsemanage -e selinux-policy -e policycoreutils | sort" + rlPhaseEnd + + rlPhaseStartTest + rlRun "service auditd status -l" + rlRun "ausearch -m avc -m selinux_err -i -ts boot" 1 + rlRun "dmesg | grep -i -e selinux -e type=1300 -e type=1400" + rlPhaseEnd + + rlPhaseStartCleanup + rlPhaseEnd +rlJournalEnd + diff --git a/other/collect-denials/test.sh b/other/collect-denials/test.sh new file mode 100755 index 0000000..f8845e4 --- /dev/null +++ b/other/collect-denials/test.sh @@ -0,0 +1,20 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +rlJournalStart + rlPhaseStartSetup + rlRun "sestatus" + rlRun "rpm -qa | grep -e audit -e libsepol -e libselinux -e libsemanage -e selinux-policy -e policycoreutils | sort" + rlPhaseEnd + + rlPhaseStartTest + rlRun "service auditd status -l" + rlRun "ausearch -m avc -m selinux_err -i -ts boot" + rlRun "dmesg | grep -i -e selinux -e type=1300 -e type=1400" + rlPhaseEnd + + rlPhaseStartCleanup + rlPhaseEnd +rlJournalEnd + diff --git a/other/update-packages/main.fmf b/other/update-packages/main.fmf new file mode 100644 index 0000000..2c54741 --- /dev/null +++ b/other/update-packages/main.fmf @@ -0,0 +1,7 @@ +summary: update packages to the latest versions available +contact: Milos Malik +test: ./runtest.sh +framework: beakerlib +duration: 15m +enabled: true + diff --git a/other/update-packages/runtest.sh b/other/update-packages/runtest.sh new file mode 100755 index 0000000..967588e --- /dev/null +++ b/other/update-packages/runtest.sh @@ -0,0 +1,19 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +rlJournalStart + rlPhaseStartSetup + rlRun "rpm -qa | grep -e audit -e libsepol -e libselinux -e libsemanage -e selinux-policy -e policycoreutils | sort" + rlPhaseEnd + + rlPhaseStartTest + rlRun "dnf clean all" + rlRun "dnf -y update --skip-broken --allowerasing" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "rpm -qa | grep -e audit -e libsepol -e libselinux -e libsemanage -e selinux-policy -e policycoreutils | sort" + rlPhaseEnd +rlJournalEnd + diff --git a/other/update-packages/test.sh b/other/update-packages/test.sh new file mode 100755 index 0000000..967588e --- /dev/null +++ b/other/update-packages/test.sh @@ -0,0 +1,19 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +rlJournalStart + rlPhaseStartSetup + rlRun "rpm -qa | grep -e audit -e libsepol -e libselinux -e libsemanage -e selinux-policy -e policycoreutils | sort" + rlPhaseEnd + + rlPhaseStartTest + rlRun "dnf clean all" + rlRun "dnf -y update --skip-broken --allowerasing" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "rpm -qa | grep -e audit -e libsepol -e libselinux -e libsemanage -e selinux-policy -e policycoreutils | sort" + rlPhaseEnd +rlJournalEnd + diff --git a/plans/reboot.fmf b/plans/reboot.fmf new file mode 100644 index 0000000..cb304d0 --- /dev/null +++ b/plans/reboot.fmf @@ -0,0 +1,11 @@ +summary: update, reboot and check for denials +discover: + how: fmf + url: https://src.fedoraproject.org/tests/selinux + test: + - /other/update-packages + - /selinux-policy/bz533007-unable-to-start-kdump-service + - /other/collect-denials +execute: + how: tmt + diff --git a/selinux-policy/bz533007-unable-to-start-kdump-service/main.fmf b/selinux-policy/bz533007-unable-to-start-kdump-service/main.fmf index eb81cce..152701d 100644 --- a/selinux-policy/bz533007-unable-to-start-kdump-service/main.fmf +++ b/selinux-policy/bz533007-unable-to-start-kdump-service/main.fmf @@ -1,4 +1,4 @@ -summary: kdump service cannot be started because of SELinux +summary: SELinux interferes with kdump and related programs description: |+ SELinux interferes with kdump and related programs.