Skip to content

Commit

Permalink
Disable component tests because they edit the system
Browse files Browse the repository at this point in the history
  • Loading branch information
vmojzis committed Jun 14, 2019
1 parent 7392eba commit 10405c5
Show file tree
Hide file tree
Showing 11 changed files with 73 additions and 51 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,7 @@

WORKING_DIRECTORY = '/tmp/selinux/'


class SELinuxApplyCustom(Actor):
'''
Re-apply SELinux customizations from RHEL-7 installation
Expand Down Expand Up @@ -52,12 +53,12 @@ def process(self):
continue

try:
run([
'semodule',
'-X',
str(module.priority),
'-i',
cil_filename]
run(['semodule',
'-X',
str(module.priority),
'-i',
cil_filename
]
)
except CalledProcessError as e:
self.log.info("Error installing module: %s", str(e))
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -15,17 +15,19 @@
]

semanage_commands = [
['fcontext', '-t', 'ganesha_var_run_t', "'/ganesha(/.*)?'"],
['fcontext', '-t', 'httpd_sys_content_t', "'/web(/.*)?'"],
['port', '-t', 'http_port_t', '-p', 'udp', '81']
['fcontext', '-t', 'ganesha_var_run_t', "'/ganesha(/.*)?'"],
['fcontext', '-t', 'httpd_sys_content_t', "'/web(/.*)?'"],
['port', '-t', 'http_port_t', '-p', 'udp', '81']
]


def findModuleSemodule(semodule_lfull, name, priority):
for line in semodule_lfull:
if name in line and priority in line:
return line
return None


def findSemanageRule(rules, rule):
for r in rules:
for word in rule:
Expand All @@ -35,11 +37,12 @@ def findSemanageRule(rules, rule):
return r
return None


def test_SELinuxApplyCustom(current_actor_context):

semodule_list = [SELinuxModule(name=module, priority=int(prio),
content="(allow domain proc_type (file (getattr open read)))", removed=[])
for (prio, module) in test_modules]
for (prio, module) in test_modules]

commands = [" ".join([c[0], "-a"] + c[1:]) for c in semanage_commands[1:]]
semanage_removed = [" ".join([semanage_commands[0][0], "-a"] + semanage_commands[0][1:])]
Expand Down Expand Up @@ -68,6 +71,7 @@ def test_SELinuxApplyCustom(current_actor_context):
for command in semanage_commands[1:-1]:
assert findSemanageRule(semanage_export, command)


def teardown():
for priority, module in test_modules:
try:
Expand Down
Original file line number Diff line number Diff line change
@@ -1,7 +1,6 @@
from leapp.actors import Actor
from leapp.models import SELinuxModules, SELinuxCustom, SELinuxFacts, SELinuxRequestRPMs, RpmTransactionTasks
from leapp.tags import FactsPhaseTag, IPUWorkflowTag
from leapp.libraries.stdlib import run, CalledProcessError
from leapp.libraries.actor import library


Expand Down
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
import os
import re
from shutil import rmtree

from leapp.libraries.stdlib import api, run, CalledProcessError
from leapp.models import SELinuxModule

Expand Down Expand Up @@ -28,6 +29,7 @@

WORKING_DIRECTORY = '/tmp/selinux/'


def checkModule(name):
'''
Check if given module contains one of removed types.
Expand Down Expand Up @@ -61,7 +63,7 @@ def listSELinuxModules():
# "<priority> <module name> <module type - pp/cil> "
m = re.match(r'([0-9]+)\s+([\w-]+)\s+([\w-]+)\s*\Z', module)
if not m:
#invalid output of "semodule -lfull"
# invalid output of "semodule -lfull"
api.current_logger().info('Invalid output of "semodule -lfull": %s', module)
continue
modules.append((m.group(2), m.group(1)))
Expand Down Expand Up @@ -166,6 +168,7 @@ def getSELinuxModules():

return (semodule_list, retain_rpms, install_rpms)


def getSELinuxCustomizations():
'''
Extract local SELinux customizations introduced by semanage command
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -14,14 +14,15 @@
]

semanage_commands = [
['fcontext', '-t', 'httpd_sys_content_t', '"/web(/.*)?"'],
['fcontext', '-t', 'ganesha_var_run_t', '"/ganesha(/.*)?"'],
['port', '-t', 'http_port_t', '-p', 'udp', '81'],
['permissive', 'abrt_t']
['fcontext', '-t', 'httpd_sys_content_t', '"/web(/.*)?"'],
['fcontext', '-t', 'ganesha_var_run_t', '"/ganesha(/.*)?"'],
['port', '-t', 'http_port_t', '-p', 'udp', '81'],
['permissive', 'abrt_t']
]

testmoduledir = os.path.join(os.getcwd(), "tests/mock_modules/")


def setup():
for priority, module in test_modules:
try:
Expand All @@ -39,12 +40,14 @@ def setup():
api.current_logger().warning("Error applying selinux customizations %s", str(e.stderr))
continue


def findModule(selinuxmodules, name, priority):
for module in selinuxmodules.modules:
if module.name == name and module.priority == int(priority):
return module
return None


def findSemanageRule(rules, rule):
for r in rules:
for word in rule:
Expand All @@ -54,6 +57,7 @@ def findSemanageRule(rules, rule):
return r
return None


def test_SELinuxContentScanner(current_actor_context):

expected_data = {'policy': 'targeted',
Expand Down
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
from leapp.libraries.stdlib import run, CalledProcessError
from leapp.libraries.actor import library


class run_mocked(object):
def __init__(self):
self.args = []
Expand All @@ -12,28 +13,29 @@ def __call__(self, args, split=True):

if self.args == ['semodule', '-lfull']:
stdout = ["400 permissive_abrt_t cil",
"400 zebra cil",
"300 zebra cil",
"100 vpn pp ",
"099 zebra cil ",
"100 minissdpd pp"]
"400 zebra cil",
"300 zebra cil",
"100 vpn pp ",
"099 zebra cil ",
"100 minissdpd pp"]

elif self.args == ['semanage', 'export']:
stdout = ["boolean -D",
"login -D",
"interface -D",
"user -D",
"port -D",
"node -D",
"fcontext -D",
"module -D",
"boolean -m -1 cron_can_relabel",
"port -a -t http_port_t -p udp 81",
"fcontext -a -f a -t httpd_sys_content_t '/web(/.*)?'",
"fcontext -a -f a -t ganesha_var_run_t '/ganesha(/.*)?'"]
"login -D",
"interface -D",
"user -D",
"port -D",
"node -D",
"fcontext -D",
"module -D",
"boolean -m -1 cron_can_relabel",
"port -a -t http_port_t -p udp 81",
"fcontext -a -f a -t httpd_sys_content_t '/web(/.*)?'",
"fcontext -a -f a -t ganesha_var_run_t '/ganesha(/.*)?'"]

return {'stdout': stdout}


class run_mocked_fail(object):
def __init__(self):
self.called = 0
Expand All @@ -56,6 +58,7 @@ def test_listSELinuxModules(monkeypatch):

assert library.listSELinuxModules() == []


def test_getSELinuxCustomizations(monkeypatch):
monkeypatch.setattr(library, "run", run_mocked())

Expand Down
Original file line number Diff line number Diff line change
@@ -1,9 +1,9 @@
from leapp.actors import Actor
from leapp.models import SELinuxModules, SELinuxCustom
from leapp.tags import PreparationPhaseTag, IPUWorkflowTag
from leapp.libraries.stdlib import run, CalledProcessError
from leapp.libraries.actor import library


class SELinuxPrepare(Actor):
'''
Remove selinux policy customizations before updating selinux-policy* packages
Expand Down
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
from leapp.libraries.stdlib import api, run, CalledProcessError
from leapp.models import SELinuxModules, SELinuxCustom
from leapp.models import SELinuxModules


def removeSemanageCustomizations():
# remove SELinux customizations done by semanage -- to be reintroduced after the upgrade
Expand All @@ -14,19 +15,19 @@ def removeSemanageCustomizations():
except CalledProcessError:
continue


def removeCustomModules():
# remove custom SElinux modules - to be reinstalled after the upgrade
for semodules in api.consume(SELinuxModules):
api.current_logger().info("Removing custom SELinux policy modules. Count: %d", len(semodules.modules))
for module in semodules.modules:
api.current_logger().info("Removing %s on priority %d.", module.name, module.priority)
try:
run([
'semodule',
'-X',
str(module.priority),
'-r',
module.name]
run(['semodule',
'-X',
str(module.priority),
'-r',
module.name]
)
except CalledProcessError as e:
api.current_logger().info("Failed to remove module %s on priority %d: %s",
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -14,10 +14,10 @@
]

semanage_commands = [
['fcontext', '-t', 'httpd_sys_content_t', '"/web(/.*)?"'],
['fcontext', '-t', 'ganesha_var_run_t', '"/ganesha(/.*)?"'],
['port', '-t', 'http_port_t', '-p', 'udp', '81'],
['permissive', 'abrt_t']
['fcontext', '-t', 'httpd_sys_content_t', '"/web(/.*)?"'],
['fcontext', '-t', 'ganesha_var_run_t', '"/ganesha(/.*)?"'],
['port', '-t', 'http_port_t', '-p', 'udp', '81'],
['permissive', 'abrt_t']
]

# save value of semodule -lfull for comparison
Expand All @@ -33,6 +33,7 @@

testmoduledir = os.path.join(os.getcwd(), "tests/mock_modules/")


def setup():
for priority, module in test_modules:
try:
Expand All @@ -48,6 +49,7 @@ def setup():
api.current_logger().warning("Error applying selinux customizations %s", str(e.stderr))
continue


def test_SELinuxPrepare(current_actor_context):
try:
semodule = run(["semodule", "-lfull"], split=False)
Expand All @@ -58,7 +60,7 @@ def test_SELinuxPrepare(current_actor_context):
api.current_logger().warning("Error listing SELinux customizations: %s", str(e.stderr))

semodule_list = [SELinuxModule(name=module, priority=int(prio), content="", removed=[])
for (prio, module) in test_modules + [["400", "permissive_abrt_t"]]]
for (prio, module) in test_modules + [["400", "permissive_abrt_t"]]]

current_actor_context.feed(SELinuxModules(modules=semodule_list))
current_actor_context.run()
Expand All @@ -73,17 +75,18 @@ def test_SELinuxPrepare(current_actor_context):
api.current_logger().warning("Error listing SELinux customizations: %s", str(e.stderr))
assert False


def teardown():
for priority, module in test_modules + [["400", "permissive_abrt_t"]]:
try:
run(["semodule", "-X", priority, "-r", module])
except CalledProcessError:
#expected -- should be removed by the actor
# expected -- should be removed by the actor
pass

for command in semanage_commands:
try:
run(["semanage", command[0], "-d"] + command[1:])
except CalledProcessError:
#expected -- should be removed by the actor
# expected -- should be removed by the actor
continue
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@
from leapp.libraries.stdlib import api
from leapp.models import SELinuxModules, SELinuxModule


class run_mocked(object):
def __init__(self):
self.args = []
Expand All @@ -23,20 +24,19 @@ def __call__(self, args, split=True):

return {'stdout': stdout}


def test_removeCustomModules(monkeypatch):
mock_modules = {"a": 99,
"b": 300,
"c": 400,
"abrt":190}
"abrt": 190}

def consume_SELinuxModules_mocked(*models):

semodule_list = [SELinuxModule(name=k, priority=mock_modules[k], content="", removed=[])
for k in mock_modules]

for k in mock_modules]
yield SELinuxModules(modules=semodule_list)


monkeypatch.setattr(api, "consume", consume_SELinuxModules_mocked)
monkeypatch.setattr(library, "run", run_mocked())

Expand Down
4 changes: 4 additions & 0 deletions repos/system_upgrade/el7toel8/models/selinux.py
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
from leapp.models import Model, fields
from leapp.topics import SystemInfoTopic, TransactionTopic


class SELinuxModule(Model):
"""SELinux module in cil including priority"""
topic = SystemInfoTopic
Expand All @@ -10,17 +11,20 @@ class SELinuxModule(Model):
# lines removed due to content invalid on RHEL 8
removed = fields.List(fields.String())


class SELinuxModules(Model):
"""List of custom selinux modules (priority != 100,200)"""
topic = SystemInfoTopic
modules = fields.List(fields.Model(SELinuxModule))


class SELinuxCustom(Model):
"""SELinux customizations returned by semanage export"""
topic = SystemInfoTopic
commands = fields.List(fields.String())
removed = fields.List(fields.String())


class SELinuxRequestRPMs(Model):
"""
SELinux related RPM packages that need to be present after upgrade
Expand Down

0 comments on commit 10405c5

Please sign in to comment.