From cd2d8fea141761785195c53658a499006c19210b Mon Sep 17 00:00:00 2001 From: Frantisek Sumsal Date: Fri, 5 Feb 2021 16:57:30 +0100 Subject: [PATCH 1/2] test: clean the module build dir before compiling it otherwise the module won't compile & load after autorelabel reboot, since the target is already built. --- test/testsuite-06.units/load-systemd-test-module.service | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test/testsuite-06.units/load-systemd-test-module.service b/test/testsuite-06.units/load-systemd-test-module.service index 323a76c68d..335f38c5b4 100644 --- a/test/testsuite-06.units/load-systemd-test-module.service +++ b/test/testsuite-06.units/load-systemd-test-module.service @@ -8,7 +8,7 @@ Before=sysinit.target shutdown.target autorelabel.service ConditionSecurity=selinux [Service] -ExecStart=sh -x -c 'echo 0 >/sys/fs/selinux/enforce && cd /systemd-test-module && make -f /usr/share/selinux/devel/Makefile load' +ExecStart=sh -x -c 'echo 0 >/sys/fs/selinux/enforce && cd /systemd-test-module && make -f /usr/share/selinux/devel/Makefile clean load' Type=oneshot TimeoutSec=0 RemainAfterExit=yes From 01da74243d74cbf9610666a0bf868da613e97069 Mon Sep 17 00:00:00 2001 From: Frantisek Sumsal Date: Fri, 5 Feb 2021 16:59:38 +0100 Subject: [PATCH 2/2] test: add a custom SELinux file context Since the test suite overhaul, the test units are now under /usr/lib/systemd/tests/testdata/tetsuite-06.units with system_u:object_r:lib_t context. This causes an AVC denial, since the systemd unit files are expected to have the system_u:object_r:systemd_unit_file_t context. Let's fix this by using a custom file context definition. --- test/TEST-06-SELINUX/systemd_test.fc | 1 + test/TEST-06-SELINUX/test.sh | 1 + 2 files changed, 2 insertions(+) create mode 100644 test/TEST-06-SELINUX/systemd_test.fc diff --git a/test/TEST-06-SELINUX/systemd_test.fc b/test/TEST-06-SELINUX/systemd_test.fc new file mode 100644 index 0000000000..249c6792cf --- /dev/null +++ b/test/TEST-06-SELINUX/systemd_test.fc @@ -0,0 +1 @@ +/usr/lib/systemd/tests/testdata/testsuite-06\.units(/.*)? system_u:object_r:systemd_unit_file_t:s0 diff --git a/test/TEST-06-SELINUX/test.sh b/test/TEST-06-SELINUX/test.sh index 37528a1a26..f05cd35593 100755 --- a/test/TEST-06-SELINUX/test.sh +++ b/test/TEST-06-SELINUX/test.sh @@ -37,6 +37,7 @@ test_append_files() { mkdir $1/systemd-test-module cp systemd_test.te $1/systemd-test-module cp systemd_test.if $1/systemd-test-module + cp systemd_test.fc $1/systemd-test-module dracut_install -o sesearch dracut_install runcon dracut_install checkmodule semodule semodule_package m4 make load_policy sefcontext_compile