tequilaOS/platform_external_selinux
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_external_selinux/scripts/ci/fedora-test-runner.sh

100 lines
1.9 KiB
Bash
Raw Normal View History

ci: run SELinux kernel test suite The current Travis CI runs the userspace tooling and libraries against policy files, but cannot test against an SELinux enabled kernel. Thus, some tests are not being done in the CI. Travis, unfortunately only provides Ubuntu images, so in order to run against a modern distro with SELinux in enforcing mode, we need to launch a KVM with something like Fedora. This patch enables this support by launching a Fedora32 Cloud Image with the SELinux userspace library passed on from the Travis clone, it then builds and replaces the current SELinux bits on the Fedora32 image and runs the SELinux testsuite. The cloud image run can be controlled with the TRAVIS env variable: TRAVIS_CLOUD_IMAGE_VERSION. That variable takes the major and minor version numbers in a colon delimited string, eg: "32:1.6". Signed-off-by: William Roberts <william.c.roberts@intel.com> Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
2020-06-02 21:18:56 +02:00
#!/usr/bin/env bash
scripts/ci: license as MIT License the ci scripts with a permissive, OSI approved license, such as MIT. Signed-off-by: William Roberts <william.c.roberts@intel.com> [omosnace: removed the dummy copyright header from LICENSE] Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
2020-08-03 17:14:28 +02:00
# SPDX-License-Identifier: MIT
ci: run SELinux kernel test suite The current Travis CI runs the userspace tooling and libraries against policy files, but cannot test against an SELinux enabled kernel. Thus, some tests are not being done in the CI. Travis, unfortunately only provides Ubuntu images, so in order to run against a modern distro with SELinux in enforcing mode, we need to launch a KVM with something like Fedora. This patch enables this support by launching a Fedora32 Cloud Image with the SELinux userspace library passed on from the Travis clone, it then builds and replaces the current SELinux bits on the Fedora32 image and runs the SELinux testsuite. The cloud image run can be controlled with the TRAVIS env variable: TRAVIS_CLOUD_IMAGE_VERSION. That variable takes the major and minor version numbers in a colon delimited string, eg: "32:1.6". Signed-off-by: William Roberts <william.c.roberts@intel.com> Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
2020-06-02 21:18:56 +02:00
set -ev
ci: dont use hardcoded project name Not everyone's github project is "selinux" so use the projects name, as derived from TRAVIS_BUILD_DIR. TRAVIS_BUILD_DIR is the absolute path to the project checkout on disk, so the basename should be sufficient. The script that runs in the KVM environment also needs to be updated where it can find the selinux project code, so we pass it in through an env variable in the ssh command. Tested on Travis CI here: - https://travis-ci.org/github/williamcroberts/selinux/jobs/697307824 Signed-off-by: William Roberts <william.c.roberts@intel.com> Acked-by: Petr Lautrbach <plautrba@redhat.com>
2020-06-11 19:30:39 +02:00
#
# We expect this to be set in the environment, but if it's not, most selinux projects
# just have the same name as upstream, so choose that.
#
export SELINUX_DIR="${SELINUX_DIR:-/root/selinux}"
ci: run SELinux kernel test suite The current Travis CI runs the userspace tooling and libraries against policy files, but cannot test against an SELinux enabled kernel. Thus, some tests are not being done in the CI. Travis, unfortunately only provides Ubuntu images, so in order to run against a modern distro with SELinux in enforcing mode, we need to launch a KVM with something like Fedora. This patch enables this support by launching a Fedora32 Cloud Image with the SELinux userspace library passed on from the Travis clone, it then builds and replaces the current SELinux bits on the Fedora32 image and runs the SELinux testsuite. The cloud image run can be controlled with the TRAVIS env variable: TRAVIS_CLOUD_IMAGE_VERSION. That variable takes the major and minor version numbers in a colon delimited string, eg: "32:1.6". Signed-off-by: William Roberts <william.c.roberts@intel.com> Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
2020-06-02 21:18:56 +02:00
# CI Debug output if things go squirrely.
getenforce
id -Z
nproc
pwd
# Turn off enforcing for the setup to prevent any weirdness from breaking
# the CI.
setenforce 0
dnf clean all -y
dnf install -y \
--allowerasing \
--skip-broken \
git \
audit-libs-devel \
bison \
bzip2-devel \
CUnit-devel \
diffutils \
flex \
gcc \
gettext \
glib2-devel \
make \
libcap-devel \
libcap-ng-devel \
pam-devel \
Replace PCRE with PCRE2 build dependencies Now that libselinux defaults to PCRE2 and mcstrans has been ported, update all documentation and scripts. Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
2021-11-23 19:32:49 +01:00
pcre2-devel \
ci: run SELinux kernel test suite The current Travis CI runs the userspace tooling and libraries against policy files, but cannot test against an SELinux enabled kernel. Thus, some tests are not being done in the CI. Travis, unfortunately only provides Ubuntu images, so in order to run against a modern distro with SELinux in enforcing mode, we need to launch a KVM with something like Fedora. This patch enables this support by launching a Fedora32 Cloud Image with the SELinux userspace library passed on from the Travis clone, it then builds and replaces the current SELinux bits on the Fedora32 image and runs the SELinux testsuite. The cloud image run can be controlled with the TRAVIS env variable: TRAVIS_CLOUD_IMAGE_VERSION. That variable takes the major and minor version numbers in a colon delimited string, eg: "32:1.6". Signed-off-by: William Roberts <william.c.roberts@intel.com> Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
2020-06-02 21:18:56 +02:00
xmlto \
python3-devel \
ruby-devel \
swig \
perl-Test \
perl-Test-Harness \
perl-Test-Simple \
selinux-policy-devel \
gcc \
libselinux-devel \
net-tools \
netlabel_tools \
iptables \
lksctp-tools-devel \
attr \
libbpf-devel \
keyutils-libs-devel \
kernel-devel \
quota \
xfsprogs-devel \
libuuid-devel \
ci: add new dependencies needed by selinux-testsuite The testsuite now runs filesystem tests also on other filesystems than just the default ext4. [1] That means a few more userspace utilities are needed to format these filesystems. [2] [1] https://github.com/SELinuxProject/selinux-testsuite/commit/071ec9c5e5f0442aae0b14f455ea6e6b34ada1e0 [2] https://github.com/SELinuxProject/selinux-testsuite/commit/d4e507f78a1784334611421cdfa3683a8214b22d Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
2020-11-12 10:15:19 +01:00
e2fsprogs \
jfsutils \
dosfstools \
ci: run SELinux kernel test suite The current Travis CI runs the userspace tooling and libraries against policy files, but cannot test against an SELinux enabled kernel. Thus, some tests are not being done in the CI. Travis, unfortunately only provides Ubuntu images, so in order to run against a modern distro with SELinux in enforcing mode, we need to launch a KVM with something like Fedora. This patch enables this support by launching a Fedora32 Cloud Image with the SELinux userspace library passed on from the Travis clone, it then builds and replaces the current SELinux bits on the Fedora32 image and runs the SELinux testsuite. The cloud image run can be controlled with the TRAVIS env variable: TRAVIS_CLOUD_IMAGE_VERSION. That variable takes the major and minor version numbers in a colon delimited string, eg: "32:1.6". Signed-off-by: William Roberts <william.c.roberts@intel.com> Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
2020-06-02 21:18:56 +02:00
kernel-devel-"$(uname -r)" \
kernel-modules-"$(uname -r)"
#
# Move to selinux code and build
#
ci: dont use hardcoded project name Not everyone's github project is "selinux" so use the projects name, as derived from TRAVIS_BUILD_DIR. TRAVIS_BUILD_DIR is the absolute path to the project checkout on disk, so the basename should be sufficient. The script that runs in the KVM environment also needs to be updated where it can find the selinux project code, so we pass it in through an env variable in the ssh command. Tested on Travis CI here: - https://travis-ci.org/github/williamcroberts/selinux/jobs/697307824 Signed-off-by: William Roberts <william.c.roberts@intel.com> Acked-by: Petr Lautrbach <plautrba@redhat.com>
2020-06-11 19:30:39 +02:00
cd "$SELINUX_DIR"
ci: run SELinux kernel test suite The current Travis CI runs the userspace tooling and libraries against policy files, but cannot test against an SELinux enabled kernel. Thus, some tests are not being done in the CI. Travis, unfortunately only provides Ubuntu images, so in order to run against a modern distro with SELinux in enforcing mode, we need to launch a KVM with something like Fedora. This patch enables this support by launching a Fedora32 Cloud Image with the SELinux userspace library passed on from the Travis clone, it then builds and replaces the current SELinux bits on the Fedora32 image and runs the SELinux testsuite. The cloud image run can be controlled with the TRAVIS env variable: TRAVIS_CLOUD_IMAGE_VERSION. That variable takes the major and minor version numbers in a colon delimited string, eg: "32:1.6". Signed-off-by: William Roberts <william.c.roberts@intel.com> Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
2020-06-02 21:18:56 +02:00
# Show HEAD commit for sanity checking
ci: declare git repository a safe directory Since version 2.35.2, due to CVE-2022-24765, git refuses to operate by default on a repository owned by a different user. Signed-off-by: Christian Göttsche <cgzones@googlemail.com> Acked-by: Petr Lautrbach <plautrba@redhat.com>
2022-05-17 15:26:22 +02:00
git config --global --add safe.directory "$SELINUX_DIR"
ci: fix stall on git log -1 git log -1 may use a pager to output long messages, and when the pager is invoked, leads to stalls on the ci system waiting for user input. Use --oneline to print the short part of the commit message and the digest. This information is for debug/informational purposes only, so truncating the output is sufficient. Reported-by: Stephen Smalley <sds@tycho.nsa.gov> Signed-off-by: William Roberts <william.c.roberts@intel.com>
2020-08-11 16:42:20 +02:00
git log --oneline -1
ci: run SELinux kernel test suite The current Travis CI runs the userspace tooling and libraries against policy files, but cannot test against an SELinux enabled kernel. Thus, some tests are not being done in the CI. Travis, unfortunately only provides Ubuntu images, so in order to run against a modern distro with SELinux in enforcing mode, we need to launch a KVM with something like Fedora. This patch enables this support by launching a Fedora32 Cloud Image with the SELinux userspace library passed on from the Travis clone, it then builds and replaces the current SELinux bits on the Fedora32 image and runs the SELinux testsuite. The cloud image run can be controlled with the TRAVIS env variable: TRAVIS_CLOUD_IMAGE_VERSION. That variable takes the major and minor version numbers in a colon delimited string, eg: "32:1.6". Signed-off-by: William Roberts <william.c.roberts@intel.com> Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
2020-06-02 21:18:56 +02:00
#
# Build and replace userspace components
#
scripts/ci: add configuration for a Vagrant virtual machine Using Vagrant makes reproducing and debugging CI issues easier: after "vagrant up", a test virtual machine is up and running, and ready to run "fedora-test-runner.sh". In order to make using this VM even easier, a helper script, "run-selinux-test.sh" is created inside and instructions on how to use it are documented at the beginning of Vagrantfile. Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
2020-12-03 09:15:12 +01:00
make clean distclean
ci: run SELinux kernel test suite The current Travis CI runs the userspace tooling and libraries against policy files, but cannot test against an SELinux enabled kernel. Thus, some tests are not being done in the CI. Travis, unfortunately only provides Ubuntu images, so in order to run against a modern distro with SELinux in enforcing mode, we need to launch a KVM with something like Fedora. This patch enables this support by launching a Fedora32 Cloud Image with the SELinux userspace library passed on from the Travis clone, it then builds and replaces the current SELinux bits on the Fedora32 image and runs the SELinux testsuite. The cloud image run can be controlled with the TRAVIS env variable: TRAVIS_CLOUD_IMAGE_VERSION. That variable takes the major and minor version numbers in a colon delimited string, eg: "32:1.6". Signed-off-by: William Roberts <william.c.roberts@intel.com> Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
2020-06-02 21:18:56 +02:00
make -j"$(nproc)" LIBDIR=/usr/lib64 SHLIBDIR=/lib64 install
make -j"$(nproc)" LIBDIR=/usr/lib64 SHLIBDIR=/lib64 install-pywrap
make -j"$(nproc)" LIBDIR=/usr/lib64 SHLIBDIR=/lib64 relabel
#
ci: dont use hardcoded project name Not everyone's github project is "selinux" so use the projects name, as derived from TRAVIS_BUILD_DIR. TRAVIS_BUILD_DIR is the absolute path to the project checkout on disk, so the basename should be sufficient. The script that runs in the KVM environment also needs to be updated where it can find the selinux project code, so we pass it in through an env variable in the ssh command. Tested on Travis CI here: - https://travis-ci.org/github/williamcroberts/selinux/jobs/697307824 Signed-off-by: William Roberts <william.c.roberts@intel.com> Acked-by: Petr Lautrbach <plautrba@redhat.com>
2020-06-11 19:30:39 +02:00
# Get the selinux testsuite, but don't clone it in selinux git directory, move to $HOME
ci: run SELinux kernel test suite The current Travis CI runs the userspace tooling and libraries against policy files, but cannot test against an SELinux enabled kernel. Thus, some tests are not being done in the CI. Travis, unfortunately only provides Ubuntu images, so in order to run against a modern distro with SELinux in enforcing mode, we need to launch a KVM with something like Fedora. This patch enables this support by launching a Fedora32 Cloud Image with the SELinux userspace library passed on from the Travis clone, it then builds and replaces the current SELinux bits on the Fedora32 image and runs the SELinux testsuite. The cloud image run can be controlled with the TRAVIS env variable: TRAVIS_CLOUD_IMAGE_VERSION. That variable takes the major and minor version numbers in a colon delimited string, eg: "32:1.6". Signed-off-by: William Roberts <william.c.roberts@intel.com> Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
2020-06-02 21:18:56 +02:00
# first.
#
cd "$HOME"
scripts/ci: add configuration for a Vagrant virtual machine Using Vagrant makes reproducing and debugging CI issues easier: after "vagrant up", a test virtual machine is up and running, and ready to run "fedora-test-runner.sh". In order to make using this VM even easier, a helper script, "run-selinux-test.sh" is created inside and instructions on how to use it are documented at the beginning of Vagrantfile. Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
2020-12-03 09:15:12 +01:00
rm -rf selinux-testsuite
ci: run SELinux kernel test suite The current Travis CI runs the userspace tooling and libraries against policy files, but cannot test against an SELinux enabled kernel. Thus, some tests are not being done in the CI. Travis, unfortunately only provides Ubuntu images, so in order to run against a modern distro with SELinux in enforcing mode, we need to launch a KVM with something like Fedora. This patch enables this support by launching a Fedora32 Cloud Image with the SELinux userspace library passed on from the Travis clone, it then builds and replaces the current SELinux bits on the Fedora32 image and runs the SELinux testsuite. The cloud image run can be controlled with the TRAVIS env variable: TRAVIS_CLOUD_IMAGE_VERSION. That variable takes the major and minor version numbers in a colon delimited string, eg: "32:1.6". Signed-off-by: William Roberts <william.c.roberts@intel.com> Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
2020-06-02 21:18:56 +02:00
git clone --depth=1 https://github.com/SELinuxProject/selinux-testsuite.git
cd selinux-testsuite
# The testsuite must be run in enforcing mode
setenforce 1
#
# Run the test suite
#
make test
Reference in a new issue Copy permalink