forked from oamg/leapp-repository
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Each actor has it's own component test. The tests introduce SELinux customizations that should not affect the system. All changes are removed after testing. Actor SELinuxPrepare, which is executed as part of its component test, will remove any SELinux customizations introduced via semanage! Unit tests added for some library functions.
- Loading branch information
Showing
17 changed files
with
498 additions
and
54 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
91 changes: 91 additions & 0 deletions
91
repos/system_upgrade/el7toel8/actors/selinux/selinuxapplycustom/tests/component_test.py
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,91 @@ | ||
| import os | ||
|
|
||
| from leapp.snactor.fixture import current_actor_context | ||
| from leapp.models import SELinuxModule, SELinuxModules, SELinuxCustom, SELinuxFacts, SELinuxRequestRPMs | ||
| from leapp.libraries.stdlib import api, run, CalledProcessError | ||
| from leapp.reporting import Report | ||
|
|
||
| test_modules = [ | ||
| ["400", "mock1"], | ||
| ["99", "mock1"], | ||
| ["200", "mock1"], | ||
| ["400", "mock2"], | ||
| ["999", "mock3"], | ||
| ["400", "permissive_abrt_t"] | ||
| ] | ||
|
|
||
| semanage_commands = [ | ||
| ['fcontext', '-t', 'ganesha_var_run_t', "'/ganesha(/.*)?'"], | ||
| ['fcontext', '-t', 'httpd_sys_content_t', "'/web(/.*)?'"], | ||
| ['port', '-t', 'http_port_t', '-p', 'udp', '81'] | ||
| ] | ||
|
|
||
| def findModuleSemodule(semodule_lfull, name, priority): | ||
| for line in semodule_lfull: | ||
| if name in line and priority in line: | ||
| return line | ||
| return None | ||
|
|
||
| def findSemanageRule(rules, rule): | ||
| for r in rules: | ||
| for word in rule: | ||
| if word not in r: | ||
| break | ||
| else: | ||
| return r | ||
| return None | ||
|
|
||
| def test_SELinuxApplyCustom(current_actor_context): | ||
|
|
||
| semodule_list = [SELinuxModule(name=module, priority=int(prio), | ||
| content="(allow domain proc_type (file (getattr open read)))", removed=[]) | ||
| for (prio, module) in test_modules] | ||
|
|
||
| commands = [" ".join([c[0], "-a"] + c[1:]) for c in semanage_commands[1:]] | ||
| semanage_removed = [" ".join([semanage_commands[0][0], "-a"] + semanage_commands[0][1:])] | ||
|
|
||
| current_actor_context.feed(SELinuxModules(modules=semodule_list)) | ||
| current_actor_context.feed(SELinuxCustom(commands=commands, removed=semanage_removed)) | ||
| current_actor_context.run() | ||
|
|
||
| # check if all given modules and local customizations where removed | ||
| semodule_lfull = [] | ||
| semanage_export = [] | ||
| try: | ||
| semodule = run(["semodule", "-lfull"], split=True) | ||
| semodule_lfull = semodule.get("stdout", "") | ||
| semanage = run(["semanage", "export"], split=True) | ||
| semanage_export = semanage.get("stdout", "") | ||
| except CalledProcessError as e: | ||
| api.current_logger().warning("Error listing selinux customizations: %s", str(e.stderr)) | ||
| assert False | ||
|
|
||
| # check that all modules installed during test setup where reported | ||
| for priority, name in test_modules: | ||
| if priority != "100" and priority != "200": | ||
| assert findModuleSemodule(semodule_lfull, name, priority) | ||
| # check that all valid commands where reintroduced to the system | ||
| for command in semanage_commands[1:-1]: | ||
| assert findSemanageRule(semanage_export, command) | ||
|
|
||
| def teardown(): | ||
| for priority, module in test_modules: | ||
| try: | ||
| run(["semodule", "-X", priority, "-r", module]) | ||
| except CalledProcessError as e: | ||
| # expected if the test fails | ||
| api.current_logger().warning("Error removing selinux modules after testing: %s", str(e.stderr)) | ||
|
|
||
| for command in semanage_commands[1:]: | ||
| try: | ||
| run(["semanage", command[0], "-d"] + [x.strip('"\'') for x in command[1:]]) | ||
| except CalledProcessError as e: | ||
| # expected if the test fails | ||
| api.current_logger().warning("Error removing selinux customizations after testing: %s", str(e.stderr)) | ||
| continue | ||
|
|
||
| try: | ||
| run(["semanage", semanage_commands[0][0], "-d"] + semanage_commands[0][1:]) | ||
| except CalledProcessError: | ||
| # expected | ||
| pass |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
105 changes: 105 additions & 0 deletions
105
repos/system_upgrade/el7toel8/actors/selinux/selinuxcontentscanner/tests/component_test.py
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,105 @@ | ||
| import os | ||
|
|
||
| from leapp.snactor.fixture import current_actor_context | ||
| from leapp.models import SELinuxModule, SELinuxModules, SELinuxCustom, SELinuxFacts, SELinuxRequestRPMs | ||
| from leapp.libraries.stdlib import api, run, CalledProcessError | ||
| from leapp.reporting import Report | ||
|
|
||
| test_modules = [ | ||
| ["400", "mock1"], | ||
| ["99", "mock1"], | ||
| ["200", "mock1"], | ||
| ["400", "mock2"], | ||
| ["999", "mock3"] | ||
| ] | ||
|
|
||
| semanage_commands = [ | ||
| ['fcontext', '-t', 'httpd_sys_content_t', '"/web(/.*)?"'], | ||
| ['fcontext', '-t', 'ganesha_var_run_t', '"/ganesha(/.*)?"'], | ||
| ['port', '-t', 'http_port_t', '-p', 'udp', '81'], | ||
| ['permissive', 'abrt_t'] | ||
| ] | ||
|
|
||
| testmoduledir = os.path.join(os.getcwd(), "tests/mock_modules/") | ||
|
|
||
| def setup(): | ||
| for priority, module in test_modules: | ||
| try: | ||
| semodule = run(["semodule", "-X", priority, "-i", os.path.join(testmoduledir, module + ".cil")]) | ||
| except CalledProcessError as e: | ||
| api.current_logger().warning("Error installing mock module: %s", e.stderr) | ||
| api.current_logger().warning("Error installing mock module: %s, %s", str(e.stderr), | ||
| semodule.get("stderr", "fuck")) | ||
| continue | ||
|
|
||
| for command in semanage_commands: | ||
| try: | ||
| run(["semanage", command[0], "-a"] + command[1:]) | ||
| except CalledProcessError as e: | ||
| api.current_logger().warning("Error applying selinux customizations %s", str(e.stderr)) | ||
| continue | ||
|
|
||
| def findModule(selinuxmodules, name, priority): | ||
| for module in selinuxmodules.modules: | ||
| if module.name == name and module.priority == int(priority): | ||
| return module | ||
| return None | ||
|
|
||
| def findSemanageRule(rules, rule): | ||
| for r in rules: | ||
| for word in rule: | ||
| if word not in r: | ||
| break | ||
| else: | ||
| return r | ||
| return None | ||
|
|
||
| def test_SELinuxContentScanner(current_actor_context): | ||
|
|
||
| expected_data = {'policy': 'targeted', | ||
| 'mls_enabled': True, | ||
| 'enabled': True, | ||
| 'runtime_mode': 'enforcing', | ||
| 'static_mode': 'enforcing'} | ||
|
|
||
| current_actor_context.feed(SELinuxFacts(**expected_data)) | ||
| current_actor_context.run() | ||
|
|
||
| modules = current_actor_context.consume(SELinuxModules)[0] | ||
| api.current_logger().warning("Modules: %s", str(modules)) | ||
| assert modules | ||
| # check that all modules installed during test setup where reported | ||
| for priority, name in test_modules: | ||
| if priority != "100" and priority != "200": | ||
| assert findModule(modules, name, priority) | ||
|
|
||
| rpms = current_actor_context.consume(SELinuxRequestRPMs)[0] | ||
| assert rpms | ||
| # modules with priority 200 should only originate in "<module_name>-selinux" rpms | ||
| assert "mock1-selinux" in rpms.to_keep | ||
| # mock1 contains container related type | ||
| assert "container-selinux" in rpms.to_install | ||
|
|
||
| custom = current_actor_context.consume(SELinuxCustom)[0] | ||
| assert custom | ||
| # the second command contains removed type and should be discarded | ||
| assert findSemanageRule(custom.removed, semanage_commands[1]) | ||
| # the rest of the commands should be reported (except for the last which will show up in modules) | ||
| assert findSemanageRule(custom.commands, semanage_commands[0]) | ||
| assert findSemanageRule(custom.commands, semanage_commands[2]) | ||
|
|
||
|
|
||
| def teardown(): | ||
| for command in semanage_commands[:-1]: | ||
| try: | ||
| run(["semanage", command[0], "-d"] + command[1:]) | ||
| except CalledProcessError as e: | ||
| api.current_logger().warning("Error removing selinux customizations after testing: %s", str(e.stderr)) | ||
| continue | ||
|
|
||
| for priority, module in reversed(test_modules + [["400", "permissive_abrt_t"]]): | ||
| try: | ||
| run(["semodule", "-X", priority, "-r", module]) | ||
| except CalledProcessError as e: | ||
| api.current_logger().warning("Error removing selinux modules after testing: %s", str(e.stderr)) | ||
| continue |
4 changes: 4 additions & 0 deletions
4
...system_upgrade/el7toel8/actors/selinux/selinuxcontentscanner/tests/mock_modules/mock1.cil
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,4 @@ | ||
| (type mock_type_t) | ||
| (typeattributeset domain (mock_type_t)) | ||
| (allow mock_type_t proc_type (file (getattr open read))) | ||
| (allow mock_type_t container_var_run_t (file (getattr open read))) |
4 changes: 4 additions & 0 deletions
4
...system_upgrade/el7toel8/actors/selinux/selinuxcontentscanner/tests/mock_modules/mock2.cil
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,4 @@ | ||
| (type mock_type2_t) | ||
| (typeattributeset direct_run_init (mock_type2_t)) | ||
| (allow mock_type_t file_type (file (getattr open read))) | ||
| (allow mock_type_t ganesha_exec_t (file (getattr open read))) |
3 changes: 3 additions & 0 deletions
3
...system_upgrade/el7toel8/actors/selinux/selinuxcontentscanner/tests/mock_modules/mock3.cil
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,3 @@ | ||
| (type mock_type3_t) | ||
| (typeattributeset domain (mock_type3_t)) | ||
| (allow mock_type_t file_type (file (getattr open read))) |
Oops, something went wrong.