shaba/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2025-03-19 22:50:17 +03:00
Code

TEST-06-SELINUX: Add knob to allow checking for AVCs

Browse Source 
When running the integration tests downstream, it's useful to be
able to test that a new systemd version doesn't introduce any AVC
denials, so let's add a knob to make that possible.

(cherry picked from commit de19520ec979902fd457515d1a795210fdaedf93)
This commit is contained in:
Daan De Meyer 2025-01-08 13:31:11 +01:00 committed by Luca Boccassi
parent 963bfbbf69
commit 27acc15203
3 changed files with 21 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
test/README.testsuite
View File

@ -151,6 +151,16 @@ that make use of `run_testcases`.
`TEST_SKIP_TESTCASE=testcase`: takes a space separated list of testcases to skip.
### SELinux AVCs
To have `TEST-06-SELINUX` check for SELinux denials, write the following to
mkosi.local.conf:
```conf
[Runtime]
KernelCommandLineExtra=systemd.setenv=TEST_SELINUX_CHECK_AVCS=1
```
## Ubuntu CI
New PRs submitted to the project are run through regression tests, and one set

7
test/fmf/integration-tests/test.sh
View File

@ -69,6 +69,13 @@ ToolsTreeDistribution=$ID
ToolsTreeRelease=${VERSION_ID:-rawhide}
EOF
if [[ -n "${TEST_SELINUX_CHECK_AVCS:-}" ]]; then
tee --append mkosi.local.conf <<EOF
[Runtime]
KernelCommandLineExtra=systemd.setenv=TEST_SELINUX_CHECK_AVCS=$TEST_SELINUX_CHECK_AVCS
EOF
fi
if [[ -n "${TESTING_FARM_REQUEST_ID:-}" ]]; then
tee --append mkosi.local.conf <<EOF
[Build]

4
test/units/TEST-06-SELINUX.sh
View File

@ -46,4 +46,8 @@ NSPAWN_ARGS=(systemd-nspawn -q --volatile=yes --directory=/ --bind-ro=/etc --ina
[[ "$("${NSPAWN_ARGS[@]}" --selinux-apifs-context="$CONTEXT" stat --printf %C /run)" == "$CONTEXT" ]]
[[ "$("${NSPAWN_ARGS[@]}" --selinux-apifs-context="$CONTEXT" --tmpfs=/tmp stat --printf %C /tmp)" == "$CONTEXT" ]]
if [[ -n "${TEST_SELINUX_CHECK_AVCS:-}" ]] && ((TEST_SELINUX_CHECK_AVCS)); then
(! journalctl -t audit -g AVC -o cat)
fi
touch /testok