SELinuxProject / selinux-testsuite

This is the upstream SELinux testsuite which is designed as a basic set of regression tests for the SELinux kernel functionality.
GNU General Public License v2.0
54 stars 43 forks source link

Small fixes for overlay and mmap tests #9

Closed jstancek closed 7 years ago

jstancek commented 7 years ago

This series makes various small fixes to mmap/overlay tests to make selinux-testsuite compilable and runnable on older (RHEL) distros and architectures other than x86.

Tested on: RHEL5.6 (i386 x86 ppc64 s390) RHEL5.11 (i386 x86 ia64 ppc64 s390) RHEL6.2 (i386 x86 ppc64 s390) RHEL6.8 (i386 x86 ppc64 s390) RHEL7.0 (x86 ppc64 s390) RHEL7.1 (x86 ppc64 s390) RHEL7.2 (x86 ppc64 ppc64le s390) RHEL7.3 (x86 ppc64 ppc64le s390)

Known RHEL issues (not addressed by this series):

stephensmalley commented 7 years ago

LGTM. The only potential concern is that with this change, we need to separately ensure that checkreqprot == 0 on RHEL 7 and later as part of QA / SELinux testing outside of this testsuite; otherwise, a kernel could ship with the wrong default and no one would notice.

jstancek commented 7 years ago

I can add a separate test to this suite, to check that kernels >= 4.4 [1](and RHEL7.3+) have correct default in /sys/fs/selinux/checkreqprot. We avoid adding even more complexity to mmap test, and it won't go unnoticed.

[1] 2a35d196c160 "selinux: change CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE default"

stephensmalley commented 7 years ago

That's good for upstream testing, but doesn't help ensure RHEL 7, right?

jstancek commented 7 years ago

I can extend that check to include also RHEL7 if you don't mind introducing more distro-specific conditions.

stephensmalley commented 7 years ago

That's fine with me.

stephensmalley commented 7 years ago

LGTM, passes and fails as expected. @pcmoore, any objections?

pcmoore commented 7 years ago

Sorry for the delay - lost the drive in my laptop on Friday, slowly getting back up to speed - yes, these look good to me. Thanks!