SELinuxProject / selinux-testsuite

This is the upstream SELinux testsuite which is designed as a basic set of regression tests for the SELinux kernel functionality.
GNU General Public License v2.0
54 stars 43 forks source link

BUG: fix unlink tests #40

Closed rhvgoyal closed 6 years ago

rhvgoyal commented 6 years ago

test_70() tries unlink on readfile. It is label ro_t. It is only implied that client can't do unlink on this file. A better method might be to drop a file with name client_nounlinkfile (with label ro_t). Now file name makes it plenty clear that label this file in such a way so that client can not unlink it. As of now ro_t meets that requirement. Later one can come up with a new label if need be.

Similarly modify test_70_ctx() to unlink client_nounlinkfile. It makes it plenty clear that this file can't be unlinked by client. But if a context mount is done with label rwx_t, then that label overrides real label and now file can be unlinked.

Get rid of test_72() and test_72_ctx(). These tests don't make much sense in current form for multiple reasons.

Signed-off-by: Vivek Goyal vgoyal@redhat.com

rhvgoyal commented 6 years ago

cc @rhatdan @pcmoore @stephensmalley

rhatdan commented 6 years ago

LGTM

pcmoore commented 6 years ago

Merged via 43502dcba69c6d84163697df8bbc6aaeb78a2804, thanks!