Ensure that qubesdb SELinux labels are correct

[DemiMarie]

/usr/sbin is now considered an alias for /usr/bin, so include rules for /usr/bin to ensure correct labelling. Do not remove the old rules to avoid regression on Fedora 40.

Suggested-by: Marek Marczykowski-Górecki [email protected]
Part-of: QubesOS/qubes-issues#9663

[qubesos-bot]

OpenQA test summary

Complete test suite and dependencies: https://openqa.qubes-os.org/tests/overview?distri=qubesos&version=4.3&build=2024122415-4.3&flavor=pull-requests

Test run included the following:

• vmupdate: Apply early fix for meminfo-writer SELinux label qubes-core-admin-linux#176 (QubesOS/qubes-core-admin-linux@e7dedd2)
• Wrap all JavaScript in an Immediately-Invoked Function Expression qubes-desktop-linux-kde#19 (QubesOS/qubes-desktop-linux-kde@a1b31ca)
• Don't rely on kdelibs qubes-desktop-linux-kde#20 (QubesOS/qubes-desktop-linux-kde@997a5a3)
• vmupdate: fix waiting for the other apt-get process qubes-core-admin-linux#175 (QubesOS/qubes-core-admin-linux@1d8ebf9)
• rpm: adjust SELinux snippets for relabeling qubes-linux-utils#121 (QubesOS/qubes-linux-utils@5c27d6e)
• Fix pulseaudio/pipewire dependencies on Arch qubes-gui-agent-linux#223 (QubesOS/qubes-gui-agent-linux@f06fae4)
• Ensure that qubesdb SELinux labels are correct on Fedora 41 qubes-linux-utils#120 (QubesOS/qubes-linux-utils@43387c3)
• Ensure that qubesdb SELinux labels are correct #66 (50acd9d)
• rpm: adjust SELinux snippets for relabeling #67 (00e2197)
• Also set software rendering via the new $GDK_DISABLE variable qubes-gui-agent-linux#221 (QubesOS/qubes-gui-agent-linux@dcf6256)
• log stdout/err from updates check on Debian qubes-core-agent-linux#537 (QubesOS/qubes-core-agent-linux@b8b485f)
• rpm: adjust SELinux snippets for relabeling qubes-core-qrexec#184 (QubesOS/qubes-core-qrexec@6077a10)
• Use the UUID for the machine ID qubes-core-admin#642 (QubesOS/qubes-core-admin@3efd0c3)
• Retire old qubes-vm-create dialog qubes-manager#393 (QubesOS/qubes-manager@210f867)

New failures, excluding unstable

Compared to: https://openqa.qubes-os.org/tests/overview?distri=qubesos&version=4.3&build=2024111705-4.3&flavor=update

• system_tests_network_updates

  • VmUpdates_debian-12-xfce: test_020_updates_available_notification (failure)
    ~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^... AssertionError: '1' is not false

• system_tests_dispvm

  • TC_20_DispVM_whonix-workstation-17: test_030_edit_file (failure)
    AssertionError: b'test1\n' != b'Test test 2\ntest1\n'

• system_tests_kde_gui_interactive

  • gui_keyboard_layout: wait_serial (wait serial expected)
    # wait_serial expected: "echo -e '[Layout]\nLayoutList=us,de' | sud...

  • gui_keyboard_layout: wait_serial (wait serial expected)
    # wait_serial expected: qr/JmOTS-\d+-/...

  • gui_keyboard_layout: wait_serial (wait serial expected)
    # wait_serial expected: "# "...

• system_tests_guivm_gui_interactive

  • gui_keyboard_layout: Failed (test died)
    # Test died: command 'test "$(qvm-run --nogui -p sys-gui 'ls e1*')"...

  • gui_keyboard_layout: unnamed test (unknown)

Failed tests

8 failures

• system_tests_network_updates

  • VmUpdates_debian-12-xfce: test_020_updates_available_notification (failure)
    ~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^... AssertionError: '1' is not false

• system_tests_dispvm

  • TC_20_DispVM_whonix-workstation-17: test_030_edit_file (failure)
    AssertionError: b'test1\n' != b'Test test 2\ntest1\n'

• system_tests_kde_gui_interactive

  • gui_keyboard_layout: wait_serial (wait serial expected)
    # wait_serial expected: "echo -e '[Layout]\nLayoutList=us,de' | sud...

  • gui_keyboard_layout: wait_serial (wait serial expected)
    # wait_serial expected: qr/JmOTS-\d+-/...

  • gui_keyboard_layout: Failed (test died + timed out)
    # Test died: command 'echo -e '[Layout]...

  • gui_keyboard_layout: wait_serial (wait serial expected)
    # wait_serial expected: "# "...

• system_tests_guivm_gui_interactive

  • gui_keyboard_layout: Failed (test died)
    # Test died: command 'test "$(qvm-run --nogui -p sys-gui 'ls e1*')"...

  • gui_keyboard_layout: unnamed test (unknown)

Fixed failures

Compared to: https://openqa.qubes-os.org/tests/119126#dependencies

3 fixed

• system_tests_extra

  • TC_00_QVCTest_whonix-gateway-17: test_010_screenshare (failure)
    ~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^... AssertionError: 0 == 0

• system_tests_basic_vm_qrexec_gui_zfs

  • switch_pool: Failed (test died)
    # Test died: command 'dnf install -y ./zfs-release.rpm' failed at /...

• system_tests_audio@hw1

  • TC_20_AudioVM_PipeWire_whonix-workstation-17: test_260_audio_mic_enabled_switch_audiovm (failure)
    AssertionError: too short audio, expected 10s, got 0.00013605442176...

Unstable tests

• system_tests_update

  update2/Failed (1/5 times with errors)

  • job 121711 # Test died: command '(set -o pipefail; qubesctl --show-output stat...

• system_tests_update@hw1

  update2/Failed (1/5 times with errors)

  • job 121711 # Test died: command '(set -o pipefail; qubesctl --show-output stat...

• system_tests_update@hw7

  update2/Failed (1/5 times with errors)

  • job 121711 # Test died: command '(set -o pipefail; qubesctl --show-output stat...