195 lines
6.3 KiB
Diff
195 lines
6.3 KiB
Diff
From dc1c3f25709aa675cfe045b5cf9e5444c4034f0c Mon Sep 17 00:00:00 2001
|
|
From: "Richard W.M. Jones" <rjones@redhat.com>
|
|
Date: Wed, 22 Jul 2026 14:25:19 +0100
|
|
Subject: [PATCH] tests/relabel: Add a new test for setfiles
|
|
|
|
Previously we tested only the deprecated guestfs_selinux_relabel
|
|
function. Add a new test for guestfs_setfiles. Since the APIs and
|
|
their usage are very similar, the test is basically the same at the
|
|
moment.
|
|
|
|
(cherry picked from commit 3567dc6fe9685a1695bfff396fbeb15601c67eaa)
|
|
---
|
|
tests/Makefile.am | 10 ++-
|
|
tests/relabel/test-relabel.py | 2 +
|
|
tests/relabel/test-setfiles.py | 133 +++++++++++++++++++++++++++++++++
|
|
3 files changed, 143 insertions(+), 2 deletions(-)
|
|
create mode 100755 tests/relabel/test-setfiles.py
|
|
|
|
diff --git a/tests/Makefile.am b/tests/Makefile.am
|
|
index f4d92eaa7..f59ec4a25 100644
|
|
--- a/tests/Makefile.am
|
|
+++ b/tests/Makefile.am
|
|
@@ -735,8 +735,14 @@ regressions_test_big_heap_LDADD = \
|
|
SLOW_TESTS += regressions/rhbz909624.sh
|
|
EXTRA_DIST += regressions/rhbz909624.sh
|
|
|
|
-TESTS += relabel/test-relabel.py
|
|
-EXTRA_DIST += relabel/test-relabel.py
|
|
+TESTS += \
|
|
+ relabel/test-relabel.py \
|
|
+ relabel/test-setfiles.py \
|
|
+ $(NULL)
|
|
+EXTRA_DIST += \
|
|
+ relabel/test-relabel.py \
|
|
+ relabel/test-setfiles.py \
|
|
+ $(NULL)
|
|
|
|
# Test relative paths to backing files. Mainly this is a test that we
|
|
# don't break this.
|
|
diff --git a/tests/relabel/test-relabel.py b/tests/relabel/test-relabel.py
|
|
index c2c4c5e41..83e09ea86 100755
|
|
--- a/tests/relabel/test-relabel.py
|
|
+++ b/tests/relabel/test-relabel.py
|
|
@@ -15,6 +15,8 @@
|
|
# along with this program; if not, write to the Free Software
|
|
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
|
|
|
+# Test the deprecated selinux_relabel function.
|
|
+
|
|
import os
|
|
import sys
|
|
import guestfs
|
|
diff --git a/tests/relabel/test-setfiles.py b/tests/relabel/test-setfiles.py
|
|
new file mode 100755
|
|
index 000000000..c36098645
|
|
--- /dev/null
|
|
+++ b/tests/relabel/test-setfiles.py
|
|
@@ -0,0 +1,133 @@
|
|
+#!/usr/bin/env python3
|
|
+# Copyright (C) 2025-2026 Red Hat Inc.
|
|
+#
|
|
+# This program is free software; you can redistribute it and/or modify
|
|
+# it under the terms of the GNU General Public License as published by
|
|
+# the Free Software Foundation; either version 2 of the License, or
|
|
+# (at your option) any later version.
|
|
+#
|
|
+# This program is distributed in the hope that it will be useful,
|
|
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
+# GNU General Public License for more details.
|
|
+#
|
|
+# You should have received a copy of the GNU General Public License
|
|
+# along with this program; if not, write to the Free Software
|
|
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
|
+
|
|
+# Test the setfiles function.
|
|
+
|
|
+import os
|
|
+import sys
|
|
+import guestfs
|
|
+
|
|
+prog = os.path.basename(sys.argv[0])
|
|
+# Because we parse error message strings below.
|
|
+os.environ["LANG"] = "C"
|
|
+
|
|
+if os.environ.get("SKIP_TEST_SETFILES_PY"):
|
|
+ print(f"{prog}: test skipped because environment variable is set.")
|
|
+ sys.exit(77)
|
|
+
|
|
+# SELinux labelling won't work (and can be skipped) if SELinux isn't
|
|
+# installed on the host.
|
|
+if not os.path.isfile("/etc/selinux/config") or not os.access("/usr/sbin/load_policy", os.X_OK):
|
|
+ print(f"{prog}: test skipped because SELinux is not available.")
|
|
+ sys.exit(77)
|
|
+
|
|
+# Create a filesystem.
|
|
+g = guestfs.GuestFS(python_return_dict=True)
|
|
+g.add_drive_scratch(256 * 1024 * 1024)
|
|
+g.launch()
|
|
+
|
|
+# If Linux extended attrs aren't available then we cannot test this.
|
|
+if not g.feature_available(["linuxxattrs"]):
|
|
+ print(f"{prog}: test skipped because 'linuxxattrs' feature not available.")
|
|
+ g.close()
|
|
+ sys.exit(77)
|
|
+
|
|
+# If SELinux relabelling is not available then we cannot test this.
|
|
+if not g.feature_available(["selinuxrelabel"]):
|
|
+ print(f"{prog}: test skipped because 'selinuxrelabel' feature not available.")
|
|
+ g.close()
|
|
+ sys.exit(77)
|
|
+
|
|
+g.part_disk("/dev/sda", "mbr")
|
|
+g.mkfs("ext4", "/dev/sda1")
|
|
+g.mount_options("user_xattr", "/dev/sda1", "/")
|
|
+
|
|
+# Create some files and directories that we want to have relabelled.
|
|
+g.mkdir("/bin")
|
|
+g.touch("/bin/ls")
|
|
+g.mkdir("/etc")
|
|
+g.mkdir("/tmp")
|
|
+g.touch("/tmp/test")
|
|
+g.mkdir("/var")
|
|
+g.mkdir("/var/log")
|
|
+g.touch("/var/log/messages")
|
|
+
|
|
+# Create a spec file.
|
|
+# This doesn't test the optional file_type field. XXX
|
|
+# See also file_contexts(5).
|
|
+g.write("/etc/file_contexts", """/.* system_u:object_r:default_t:s0
|
|
+/bin/.* system_u:object_r:bin_t:s0
|
|
+/etc/.* system_u:object_r:etc_t:s0
|
|
+/etc/file_contexts <<none>>
|
|
+/tmp/.* <<none>>
|
|
+/var/.* system_u:object_r:var_t:s0
|
|
+/var/log/.* system_u:object_r:var_log_t:s0
|
|
+""")
|
|
+
|
|
+# Do the relabel.
|
|
+g.setfiles("/etc/file_contexts", "/", force=True)
|
|
+
|
|
+# Check the labels were set correctly.
|
|
+errors = 0
|
|
+
|
|
+def check_label(file, expected_label):
|
|
+ global errors
|
|
+ actual_label = g.lgetxattr(file, "security.selinux")
|
|
+ # The label returned from lgetxattr has \0 appended.
|
|
+ if (expected_label + "\0").encode() != actual_label:
|
|
+ print(
|
|
+ f"{prog}: expected label on file {file}: "
|
|
+ f"expected={expected_label} actual={actual_label.decode(errors='ignore')}",
|
|
+ file=sys.stderr,
|
|
+ )
|
|
+ errors += 1
|
|
+
|
|
+def check_label_none(file):
|
|
+ global errors
|
|
+ try:
|
|
+ r = g.lgetxattr(file, "security.selinux")
|
|
+ if r:
|
|
+ print(
|
|
+ f"{prog}: expecting no label on file {file}, "
|
|
+ f"but got {r.decode(errors='ignore')}",
|
|
+ file=sys.stderr,
|
|
+ )
|
|
+ errors += 1
|
|
+ except RuntimeError as e:
|
|
+ if "No data available" not in str(e):
|
|
+ print(
|
|
+ f"{prog}: expecting an error reading label from file {file}, "
|
|
+ f"but got {e}",
|
|
+ file=sys.stderr,
|
|
+ )
|
|
+ errors += 1
|
|
+
|
|
+check_label("/bin", "system_u:object_r:default_t:s0")
|
|
+check_label("/bin/ls", "system_u:object_r:bin_t:s0")
|
|
+check_label("/etc", "system_u:object_r:default_t:s0")
|
|
+check_label_none("/etc/file_contexts")
|
|
+check_label("/tmp", "system_u:object_r:default_t:s0")
|
|
+check_label_none("/tmp/test")
|
|
+check_label("/var", "system_u:object_r:default_t:s0")
|
|
+check_label("/var/log", "system_u:object_r:var_t:s0")
|
|
+check_label("/var/log/messages", "system_u:object_r:var_log_t:s0")
|
|
+
|
|
+# Finish up.
|
|
+g.shutdown()
|
|
+g.close()
|
|
+
|
|
+sys.exit(0 if errors == 0 else 1)
|
|
--
|
|
2.47.3
|
|
|