SELinux policy and tests for posix mqueues

[davidgraz]

This is a set of tests for use with the posix mqueue filesystem.

The policy defines three process types:

• test_mqmangeop_t - a process to manage the creation and deletion of the queues
• test_mqread_t - a process with read access to queues
• test_mqwrite_t - a process with write access to queues

It also defines the following types:

• mqop_file_t - for test files
• mqop_exec_t - for test helper executables
• mqop_mqbase_t - base label for newly created queues via standard type_transition
• mqop_mqread_t - label for the read message queue
• mqop_mqwrite_t - label for the write message queue
• mqop_mqrw_t - label for the read/write message queue

They test the creation, labeling, access (read/write) and removal of queues. The manage domain is used to create three queues (mqread, mqwrite, mqrw). Within the policy a named type_transition is defined to uniquely label each of these queues. The other test domains then perform read and/or write operations on the queues and their success/failure is evaluated based on the policy.

Note: The test checks to see if mqueue named type_transitions are supported by the kernel. If not, after their creation chcon is used to apply the appropriate labels.

Signed-off-by: David Graziano david.graziano@rockwellcollins.com

[stephensmalley]

LGTM, will wait on @pcmoore to ack.

[pcmoore]

Sorry, I didn't forget about this, I just didn't get to this today, it's on my list for tomorrow/weekend.

[pcmoore]

This looks good to me, the only comment I have is a bit nit picky - why not just name the test directory "mqueue"? The SysV message queue tests are already present under "msg", the "posix_" prefix seems a bit unnecessary.

[davidgraz]

@pcmoore I will update the naming to drop the "posix"

[pcmoore]

Thanks @davidgraz, I appreciate the quick response (even if my responses aren't so quick these days).

[pcmoore]

@stephensmalley did we really want to merge this now without the corresponding kernel support?

[stephensmalley]

The test is written such that it will fall back to manual labeling of the mqueues if the kernel does not support it, and thus the tests pass on old and new kernels.