├── .fmf └── version ├── .github └── workflows │ └── checks.yml ├── COPYING ├── Makefile ├── README.md ├── ToDo ├── defconfig ├── doc └── tests │ ├── Makefile │ ├── ackno.sgml │ ├── biblio.sgml │ ├── binprm.sgml │ ├── capable.sgml │ ├── coverage.sgml │ ├── custom.dsl │ ├── environment.sgml │ ├── file.sgml │ ├── inode.sgml │ ├── intro.sgml │ ├── ipc.sgml │ ├── socket.sgml │ ├── system.sgml │ ├── task.sgml │ └── tests.sgml ├── policy ├── .gitignore ├── Makefile ├── test_add_levels.cil ├── test_atsecure.te ├── test_attrib.te ├── test_binder.te ├── test_binder_bpf.te ├── test_bounds.te ├── test_bpf.te ├── test_cap_userns.te ├── test_capable_file.te ├── test_capable_net.te ├── test_capable_sys.te ├── test_cgroupfs.te ├── test_dyntrace.te ├── test_dyntrans.te ├── test_entrypoint.te ├── test_execshare.te ├── test_exectrace.te ├── test_execute_no_trans.te ├── test_extended_socket_class.te ├── test_fdreceive.te ├── test_fdreceive_bpf.te ├── test_file.te ├── test_file_load.te ├── test_filesystem.te ├── test_filesystem_name_trans.te ├── test_filesystem_notify.te ├── test_glblub.cil ├── test_global.te ├── test_ibendport.te ├── test_ibpkey.te ├── test_inet_socket.te ├── test_inherit.te ├── test_ioctl.te ├── test_ioctl_cond_xperms.te ├── test_ioctl_xperms.te ├── test_ipc.te ├── test_key_socket.te ├── test_keys.te ├── test_link.te ├── test_mac_admin.te ├── test_mkdir.te ├── test_mlsconstrain.cil ├── test_mmap.te ├── test_module_load.te ├── test_mqueue.te ├── test_netlink_socket.te ├── test_nlmsg.te ├── test_nnp_nosuid.te ├── test_notify.te ├── test_open.te ├── test_overlay_defaultrange.cil ├── test_overlayfs.te ├── test_perf_event.te ├── test_policy.if ├── test_prlimit.te ├── test_ptrace.te ├── test_readlink.te ├── test_relabel.te ├── test_rename.te ├── test_rxdir.te ├── test_sctp.te ├── test_secretmem.te ├── test_setattr.te ├── test_setnice.te ├── test_sigkill.te ├── test_stat.te ├── test_sysctl.te ├── test_task_create.te ├── test_task_getpgid.te ├── test_task_getsched.te ├── test_task_getsid.te ├── test_task_setpgid.te ├── test_task_setsched.te ├── test_transition.te ├── test_tun_tap.te ├── test_unix_socket.te ├── test_userfaultfd.te ├── test_vsock_socket.te └── test_watchkey.te ├── tests ├── Makefile ├── atsecure │ ├── .gitignore │ ├── Makefile │ ├── atsecure.c │ ├── evil.c │ ├── good.c │ └── test ├── binder │ ├── .gitignore │ ├── Makefile │ ├── binder_common.c │ ├── binder_common.h │ ├── check_binder.c │ ├── check_binderfs.c │ ├── cleanup_binder.sh │ ├── client.c │ ├── init_binder.sh │ ├── manager.c │ ├── service_provider.c │ └── test ├── bounds │ ├── .gitignore │ ├── Makefile │ ├── test │ └── thread.c ├── bpf │ ├── .gitignore │ ├── Makefile │ ├── bpf_common.c │ ├── bpf_common.h │ ├── bpf_test.c │ └── test ├── cap_userns │ ├── .gitignore │ ├── Makefile │ ├── test │ └── userns_child_exec.c ├── capable_file │ ├── .gitignore │ ├── Makefile │ ├── test │ └── test_lease.c ├── capable_net │ ├── .gitignore │ ├── Makefile │ ├── test │ ├── test_bind.c │ └── test_raw.c ├── capable_sys │ ├── .gitignore │ ├── Makefile │ ├── test │ ├── test_chroot.c │ ├── test_hostname.c │ ├── test_nice.c │ └── test_rawio.c ├── cgroupfs_label │ ├── Makefile │ └── test ├── checkreqprot │ ├── Makefile │ ├── default_value.sh │ └── test ├── domain_trans │ ├── Makefile │ └── test ├── dyntrace │ ├── .gitignore │ ├── Makefile │ ├── child.c │ ├── parent.c │ └── test ├── dyntrans │ ├── .gitignore │ ├── Makefile │ ├── parent.c │ └── test ├── entrypoint │ ├── Makefile │ └── test ├── execshare │ ├── .gitignore │ ├── Makefile │ ├── child.c │ ├── parent.c │ └── test ├── exectrace │ ├── .gitignore │ ├── Makefile │ ├── child.c │ ├── parent.c │ └── test ├── execute_no_trans │ ├── Makefile │ └── test ├── extended_socket_class │ ├── .gitignore │ ├── Makefile │ ├── sockcreate.c │ └── test ├── fdreceive │ ├── .gitignore │ ├── Makefile │ ├── client.c │ ├── server.c │ └── test ├── file │ ├── .gitignore │ ├── Makefile │ ├── test │ ├── test_fcntl.c │ ├── test_lock.c │ ├── test_mmap.c │ ├── test_mprotect.c │ ├── test_nofcntl.c │ ├── test_rw.c │ ├── test_seek.c │ ├── test_sigiotask.c │ └── wait_io.c ├── filesystem │ ├── .gitignore │ ├── Filesystem.pm │ ├── Makefile │ ├── check_file_context.c │ ├── check_mount_context.c │ ├── create_file.c │ ├── create_file_change_context.c │ ├── ext4 │ ├── fanotify_fs.c │ ├── fs_relabel.c │ ├── grim_reaper.c │ ├── jfs │ ├── mount.c │ ├── native_quotas_test.c │ ├── quotas_test.c │ ├── statfs_test.c │ ├── test │ ├── umount.c │ ├── vfat │ ├── xfs │ └── xfs_quotas_test.c ├── fs_filesystem │ ├── .gitignore │ ├── Makefile │ ├── ext4 │ ├── fs_common.c │ ├── fs_common.h │ ├── fsmount.c │ ├── fspick.c │ ├── jfs │ ├── move_mount.c │ ├── test │ ├── vfat │ └── xfs ├── glblub │ ├── .gitignore │ ├── Makefile │ ├── default_range.c │ └── test ├── inet_socket │ ├── .gitignore │ ├── Makefile │ ├── bind.c │ ├── calipso-flush │ ├── calipso-load │ ├── cipso-fl-flush │ ├── cipso-fl-load │ ├── cipso-flush │ ├── cipso-load-t1 │ ├── cipso-load-t2 │ ├── cipso-load-t5 │ ├── client.c │ ├── connect.c │ ├── ipsec-flush │ ├── ipsec-load │ ├── iptables-flush │ ├── iptables-load │ ├── mptcp │ ├── nftables-flush │ ├── nftables-load │ ├── server.c │ ├── tcp │ ├── test │ └── udp ├── infiniband_endport │ ├── Makefile │ ├── ibendport_test.conf │ └── test ├── infiniband_pkey │ ├── .gitignore │ ├── Makefile │ ├── create_modify_qp.c │ ├── ibpkey_test.conf │ └── test ├── inherit │ ├── .gitignore │ ├── Makefile │ ├── child.c │ ├── parent.c │ └── test ├── ioctl │ ├── .gitignore │ ├── Makefile │ ├── test │ ├── test_ioctl.c │ ├── test_noioctl.c │ ├── test_siocgifindex.c │ └── test_siocgifname.c ├── key_socket │ ├── .gitignore │ ├── Makefile │ ├── key_sock.c │ └── test ├── keys │ ├── .gitignore │ ├── Makefile │ ├── keyctl.c │ ├── keyctl_relabel.c │ ├── keyring_service.c │ ├── keys_common.h │ ├── request_keys.c │ └── test ├── kvercmp ├── link │ ├── Makefile │ └── test ├── loop.pl ├── mac_admin │ ├── Makefile │ └── test ├── mkdir │ ├── Makefile │ └── test ├── mmap │ ├── .gitignore │ ├── Makefile │ ├── mmap_anon_private.c │ ├── mmap_anon_shared.c │ ├── mmap_file_private.c │ ├── mmap_file_shared.c │ ├── mmap_hugetlb_anon_private.c │ ├── mmap_hugetlb_anon_shared.c │ ├── mmap_zero.c │ ├── mprotect_anon_private.c │ ├── mprotect_anon_shared.c │ ├── mprotect_file_private_execmod.c │ ├── mprotect_file_private_rwx.c │ ├── mprotect_file_private_rx.c │ ├── mprotect_file_shared.c │ ├── mprotect_heap.c │ ├── mprotect_hugetlb_anon_private.c │ ├── mprotect_hugetlb_anon_shared.c │ ├── mprotect_stack.c │ ├── mprotect_stack_thread.c │ ├── shmat.c │ ├── test │ └── utils.h ├── module_load │ ├── .gitignore │ ├── Makefile │ ├── finit_load.c │ ├── init_load.c │ ├── setest_firmware_load.c │ ├── setest_module_load.c │ ├── setest_module_request.c │ └── test ├── mqueue │ ├── .gitignore │ ├── Makefile │ ├── mqmgr.c │ ├── mqrcv.c │ ├── mqsnd.c │ └── test ├── msg │ ├── .gitignore │ ├── Makefile │ ├── msgctl.c │ ├── msgget.c │ ├── msgrcv.c │ ├── msgsnd.c │ └── test ├── netlink_socket │ ├── .gitignore │ ├── Makefile │ ├── netlinkcreate.c │ └── test ├── nfs_filesystem │ ├── Makefile │ └── test ├── nfsruntests.pl ├── nlmsg │ ├── .gitignore │ ├── Makefile │ ├── nlmsg.c │ └── test ├── nnp_nosuid │ ├── .gitignore │ ├── Makefile │ ├── checkcon.c │ ├── execnnp.c │ └── test ├── notify │ ├── .gitignore │ ├── Makefile │ ├── test │ ├── test_fanotify.c │ └── test_inotify.c ├── open │ ├── .gitignore │ ├── Makefile │ ├── append2write.c │ ├── fopen.c │ └── test ├── os_detect ├── overlay │ ├── .gitignore │ ├── Makefile │ ├── access.c │ ├── append │ ├── badentrypoint │ ├── cleanup-overlay │ ├── goodentrypoint │ ├── setup-overlay │ └── test ├── perf_event │ ├── .gitignore │ ├── Makefile │ ├── perf_event.c │ └── test ├── pol_detect ├── prlimit │ ├── .gitignore │ ├── Makefile │ ├── child.c │ ├── parent.c │ └── test ├── ptrace │ ├── .gitignore │ ├── Makefile │ ├── ptrace.c │ └── test ├── readlink │ ├── Makefile │ └── test ├── relabel │ ├── Makefile │ └── test ├── rename │ ├── Makefile │ └── test ├── runtests.pl ├── rxdir │ ├── Makefile │ └── test ├── sctp │ ├── .gitignore │ ├── Makefile │ ├── calipso-flush │ ├── calipso-load │ ├── cipso-fl-flush │ ├── cipso-fl-load │ ├── cipso-flush │ ├── cipso-load-t1 │ ├── cipso-load-t2 │ ├── cipso-load-t5 │ ├── fb-deny-label-flush │ ├── fb-deny-label-load │ ├── fb-label-flush │ ├── fb-label-load │ ├── iptables-flush │ ├── iptables-load │ ├── nftables-flush │ ├── nftables-load │ ├── sctp_asconf_params_client.c │ ├── sctp_asconf_params_server.c │ ├── sctp_bind.c │ ├── sctp_bindx.c │ ├── sctp_client.c │ ├── sctp_common.c │ ├── sctp_common.h │ ├── sctp_connectx.c │ ├── sctp_peeloff_client.c │ ├── sctp_peeloff_server.c │ ├── sctp_server.c │ └── test ├── secretmem │ ├── .gitignore │ ├── Makefile │ ├── secretmem.c │ └── test ├── sem │ ├── .gitignore │ ├── Makefile │ ├── getinfo.c │ ├── semctl.c │ ├── semget.c │ ├── semop.c │ └── test ├── setattr │ ├── Makefile │ └── test ├── setnice │ ├── .gitignore │ ├── Makefile │ ├── child.c │ ├── parent.c │ └── test ├── shm │ ├── .gitignore │ ├── Makefile │ ├── shmat.c │ ├── shmctl.c │ ├── shmget.c │ └── test ├── sigkill │ ├── .gitignore │ ├── Makefile │ ├── server.c │ └── test ├── stat │ ├── Makefile │ └── test ├── sysctl │ ├── Makefile │ └── test ├── task_create │ ├── .gitignore │ ├── Makefile │ ├── parent.c │ └── test ├── task_getpgid │ ├── .gitignore │ ├── Makefile │ ├── source.c │ └── test ├── task_getscheduler │ ├── .gitignore │ ├── Makefile │ ├── source.c │ └── test ├── task_getsid │ ├── .gitignore │ ├── Makefile │ ├── source.c │ └── test ├── task_setnice │ ├── Makefile │ └── test ├── task_setpgid │ ├── .gitignore │ ├── Makefile │ ├── source.c │ └── test ├── task_setscheduler │ ├── .gitignore │ ├── Makefile │ ├── source.c │ └── test ├── tun_tap │ ├── .gitignore │ ├── Makefile │ ├── test │ ├── tun_common.c │ ├── tun_common.h │ ├── tun_relabel.c │ └── tun_tap.c ├── unix_socket │ ├── .gitignore │ ├── Makefile │ ├── client.c │ ├── server.c │ ├── socketpair.c │ └── test ├── userfaultfd │ ├── .gitignore │ ├── Makefile │ ├── test │ └── userfaultfd.c ├── vsock_socket │ ├── .gitignore │ ├── Makefile │ ├── client.c │ ├── server.c │ └── test └── watchkey │ ├── .gitignore │ ├── Makefile │ ├── test │ └── watchkey.c ├── tmt ├── README.md ├── plans.fmf └── tests.fmf └── tools ├── check-syntax └── nfs.sh /.fmf/version: -------------------------------------------------------------------------------- 1 | 1 2 | -------------------------------------------------------------------------------- /.github/workflows/checks.yml: -------------------------------------------------------------------------------- 1 | name: checks 2 | on: [push, pull_request] 3 | 4 | jobs: 5 | style-check: 6 | runs-on: ubuntu-latest 7 | container: 8 | image: fedora:latest 9 | steps: 10 | - run: sudo dnf install -y astyle perltidy findutils git-core 11 | - uses: actions/checkout@v4 12 | - run: sudo chown $(id -u):$(id -g) . 13 | - run: tools/check-syntax -f && git diff --exit-code 14 | run: 15 | runs-on: ubuntu-latest 16 | strategy: 17 | fail-fast: false 18 | matrix: 19 | domain: [unconfined_t, sysadm_t] 20 | arch: [x86_64, aarch64] 21 | kernel: [latest, secnext] 22 | steps: 23 | - name: Schedule test on Testing Farm 24 | uses: sclorg/testing-farm-as-github-action@main 25 | with: 26 | api_key: ${{ secrets.TESTING_FARM_API_TOKEN }} 27 | arch: ${{ matrix.arch }} 28 | compose: Fedora-${{ matrix.kernel == 'secnext' && 'Rawhide' || 'latest' }} 29 | variables: STS_ROOT_DOMAIN=${{ matrix.domain }}; STS_KERNEL=${{ matrix.kernel }} 30 | tmt_plan_filter: tag:ci 31 | -------------------------------------------------------------------------------- /Makefile: -------------------------------------------------------------------------------- 1 | SUBDIRS = policy tests 2 | 3 | all: 4 | @set -e; for i in $(SUBDIRS); do $(MAKE) -C $$i all ; done 5 | 6 | test: 7 | make -C policy load 8 | make -C tests test 9 | make -C policy unload 10 | 11 | check-syntax: 12 | @./tools/check-syntax 13 | 14 | clean: 15 | @set -e; for i in $(SUBDIRS); do $(MAKE) -C $$i clean ; done 16 | 17 | 18 | -------------------------------------------------------------------------------- /ToDo: -------------------------------------------------------------------------------- 1 | This ToDo list has moved to the GitHub issues tracker for selinux-testsuite, 2 | see: 3 | https://github.com/SELinuxProject/selinux-testsuite/issues 4 | -------------------------------------------------------------------------------- /doc/tests/Makefile: -------------------------------------------------------------------------------- 1 | TOP := tests.sgml 2 | ALL := $(wildcard *.sgml) 3 | 4 | PS := $(patsubst %.sgml, %.ps, $(TOP)) 5 | PDF := $(patsubst %.sgml, %.pdf, $(TOP)) 6 | HTML := $(patsubst %.sgml, %, $(TOP)) 7 | DVI := $(patsubst %.sgml, %.dvi, $(TOP)) 8 | AUX := $(patsubst %.sgml, %.aux, $(TOP)) 9 | TEX := $(patsubst %.sgml, %.tex, $(TOP)) 10 | LOG := $(patsubst %.sgml, %.log, $(TOP)) 11 | OUT := $(patsubst %.sgml, %.out, $(TOP)) 12 | 13 | all: $(PS) $(PDF) $(HMTL) 14 | 15 | $(PS): $(ALL) custom.dsl 16 | jw -f docbook -d custom.dsl -b ps $(TOP) 17 | 18 | $(PDF): $(ALL) custom.dsl 19 | jw -f docbook -d custom.dsl -b pdf $(TOP) 20 | 21 | $(HTML): $(ALL) 22 | -$(RM) -r $@ 23 | db2html $(TOP) 24 | if [ ! -z "$(JPG-$@)" ]; then cp $(JPG-$@) $@; fi 25 | 26 | clean: 27 | -$(RM) core *~ 28 | -$(RM) $(DVI) $(AUX) $(TEX) $(LOG) $(OUT) 29 | 30 | mrproper: clean 31 | -$(RM) $(PS) $(PDF) 32 | -$(RM) -r $(HTML) 33 | -------------------------------------------------------------------------------- /doc/tests/ackno.sgml: -------------------------------------------------------------------------------- 1 | Acknowledgements 2 | 3 | We thank Eric Richardson for his work on several of the 4 | test scripts and policies. 5 | 6 | 7 | -------------------------------------------------------------------------------- /doc/tests/biblio.sgml: -------------------------------------------------------------------------------- 1 | 2 | References 3 | 4 | 5 | LoscoccoFreenix2001 6 | 7 | 8 | PeterLoscocco 9 | StephenSmalley 10 | 11 | Integrating Flexible Support for Security Policies into the Linux Operating System 12 | 13 | 14 | Proceedings of the FREENIX Track: 2001 USENIX Annual Technical Conference 15 | 16 | The USENIX Association 17 | 18 | June 2001 19 | 20 | 21 | 22 | 23 | SmalleyModuleTR2001 24 | 25 | 26 | StephenSmalley 27 | ChrisVance 28 | WayneSalamon 29 | 30 | Implementing SELinux as a Linux Security Module 31 | 32 | 33 | NAI Labs Report #01-043 34 | December 2001 35 | 36 | 37 | 38 | 39 | 40 | -------------------------------------------------------------------------------- /doc/tests/custom.dsl: -------------------------------------------------------------------------------- 1 | 3 | ]> 4 | 5 | 6 | 7 | 8 | 9 | (define %two-side% #f) 10 | (define %section-autolabel% #t) 11 | (define %generate-article-toc% #t) 12 | (define %generate-article-titlepage% #t) 13 | 14 | (define (article-titlepage-recto-elements) 15 | (list (normalize "title") 16 | (normalize "subtitle") 17 | (normalize "graphic") 18 | (normalize "corpauthor") 19 | (normalize "authorgroup") 20 | (normalize "author") 21 | (normalize "editor") 22 | (normalize "copyright") 23 | (normalize "contractnum") 24 | (normalize "contractsponsor") 25 | (normalize "productnumber") 26 | (normalize "isbn") 27 | (normalize "pubdate") 28 | (normalize "pubsnumber") 29 | (normalize "revhistory") 30 | (normalize "abstract") 31 | (normalize "legalnotice"))) 32 | 33 | 34 | 35 | 36 | 37 | 38 | 39 | 40 | -------------------------------------------------------------------------------- /doc/tests/intro.sgml: -------------------------------------------------------------------------------- 1 | Introduction 2 | 3 | 4 | NSA Security-Enhanced Linux (SELinux) is an implementation of 5 | fine-grained and flexible nondiscretionary access controls in the 6 | Linux kernel . 7 | The SELinux implementation has been reworked by NAI Labs to use the 8 | Linux Security Modules (LSM) kernel patch. This technical report 10 | describes the functional test suite developed for the LSM-based 11 | SELinux security module. 12 | 13 | 14 | 15 | The test suite permits automated validation of the correct 16 | implementation of the SELinux access controls in the hook functions of 17 | the LSM-based SELinux security module. The test suite does not yet 18 | provide comprehensive coverage of all of the SELinux hook functions. 19 | Nonetheless, the test suite can be used to provide feedback on the 20 | basic functionality of the SELinux module as the module is undergoing 21 | continued development. The test suite does not provide any validation 22 | of the example security policy configuration or system security; such 23 | validation is outside the scope of this test suite. 24 | 25 | 26 | 27 | The report begins by providing an overview of the test environment, 28 | including a discussion of the test policy configuration and test 29 | scripts. It then briefly describes each set of tests, identifying the 30 | set of access controls that are being tested. Finally, the report 31 | summarizes the current test coverage. 32 | 33 | 34 | 35 | 36 | -------------------------------------------------------------------------------- /doc/tests/system.sgml: -------------------------------------------------------------------------------- 1 | System Tests 2 | 3 | 4 | The sysctl/test script checks permissions for 5 | system control (sysctl) operations. The policy for this set of tests 6 | is located in test_sysctl.te. summarizes the domains defined by the 8 | policy. 9 | 10 | 11 | 12 | 13 | System Control Test Domains 14 | 15 | 16 | 17 | 18 | 19 | Name 20 | Description 21 | 22 | 23 | 24 | 25 | test_sysctl_t 26 | Domain for process that has all system control permissions. 27 | 28 | 29 | test_nosysctl_t 30 | Domain for process that has no system control permissions, except for search access to the directories. 31 | 32 | 33 | 34 |
35 | 36 | 37 | 38 | The selinux_sysctl hook is tested. Attempts are 39 | made to read and write the kernel.modprobe sysctl 40 | variable from each domain. The test_sysctl_t 41 | domain should succeed on both operations, while the 42 | test_nosysctl_t domain should fail on both 43 | operations. 44 | 45 | 46 | 47 | -------------------------------------------------------------------------------- /policy/.gitignore: -------------------------------------------------------------------------------- 1 | test_policy/ 2 | -------------------------------------------------------------------------------- /policy/test_add_levels.cil: -------------------------------------------------------------------------------- 1 | (sensitivity s1) 2 | (sensitivitycategory s1 (range c0 c1023)) 3 | (sensitivity s2) 4 | (sensitivitycategory s2 (range c0 c1023)) 5 | (sensitivity s3) 6 | (sensitivitycategory s3 (range c0 c1023)) 7 | (sensitivity s4) 8 | (sensitivitycategory s4 (range c0 c1023)) 9 | (sensitivity s5) 10 | (sensitivitycategory s5 (range c0 c1023)) 11 | (sensitivity s6) 12 | (sensitivitycategory s6 (range c0 c1023)) 13 | (sensitivity s7) 14 | (sensitivitycategory s7 (range c0 c1023)) 15 | (sensitivity s8) 16 | (sensitivitycategory s8 (range c0 c1023)) 17 | (sensitivity s9) 18 | (sensitivitycategory s9 (range c0 c1023)) 19 | (sensitivity s10) 20 | (sensitivitycategory s10 (range c0 c1023)) 21 | (sensitivity s11) 22 | (sensitivitycategory s11 (range c0 c1023)) 23 | (sensitivity s12) 24 | (sensitivitycategory s12 (range c0 c1023)) 25 | (sensitivity s13) 26 | (sensitivitycategory s13 (range c0 c1023)) 27 | (sensitivity s14) 28 | (sensitivitycategory s14 (range c0 c1023)) 29 | (sensitivity s15) 30 | (sensitivitycategory s15 (range c0 c1023)) 31 | (sensitivityorder (s0 s1 s2 s3 s4 s5 s6 s7 s8 s9 s10 s11 s12 s13 s14 s15)) 32 | -------------------------------------------------------------------------------- /policy/test_atsecure.te: -------------------------------------------------------------------------------- 1 | ################################# 2 | # 3 | # Policy for testing the setting of the 4 | # AT_SECURE auxv flag based on noatsecure permission 5 | # 6 | 7 | attribute atsecuredomain; 8 | 9 | # Domain for process that is not allowed noatsecure to the new domain. 10 | type test_atsecure_denied_t; 11 | testsuite_domain_type(test_atsecure_denied_t) 12 | typeattribute test_atsecure_denied_t atsecuredomain; 13 | 14 | # Domain for process that is allowed noatsecure to the new domain. 15 | type test_atsecure_allowed_t; 16 | testsuite_domain_type(test_atsecure_allowed_t) 17 | typeattribute test_atsecure_allowed_t atsecuredomain; 18 | 19 | # New domain for the process after the transition. 20 | type test_atsecure_newdomain_t; 21 | testsuite_domain_type(test_atsecure_newdomain_t) 22 | typeattribute test_atsecure_newdomain_t atsecuredomain; 23 | 24 | # Allow the domain entrypoints and transitions. 25 | domain_entry_file(test_atsecure_newdomain_t, test_file_t) 26 | domain_transition_pattern(test_atsecure_denied_t, test_file_t, test_atsecure_newdomain_t) 27 | domain_transition_pattern(test_atsecure_allowed_t, test_file_t, test_atsecure_newdomain_t) 28 | allow test_atsecure_newdomain_t test_atsecure_denied_t:fd use; 29 | allow test_atsecure_newdomain_t test_atsecure_allowed_t:fd use; 30 | allow_map(atsecuredomain, test_file_t, file) 31 | 32 | # Only allow the allowed domain noatsecure permission to the 33 | # new domain. 34 | allow test_atsecure_allowed_t test_atsecure_newdomain_t:process noatsecure; 35 | -------------------------------------------------------------------------------- /policy/test_attrib.te: -------------------------------------------------------------------------------- 1 | # 2 | # Declarations for type attributes for test domains. 3 | # 4 | 5 | attribute capabledomain; 6 | attribute execsharedomain; 7 | attribute exectracedomain; 8 | attribute fdreceivedomain; 9 | attribute fileopdomain; 10 | attribute inheritdomain; 11 | attribute ioctldomain; 12 | attribute ipcdomain; 13 | attribute test_link_domain; 14 | attribute test_mkdir_domain; 15 | attribute test_open_domain; 16 | attribute ptracedomain; 17 | attribute test_readlink_domain; 18 | attribute test_relabel_domain; 19 | attribute test_rename_domain; 20 | attribute test_rxdir_domain; 21 | attribute test_setattr_domain; 22 | attribute setnicedomain; 23 | attribute killdomain; 24 | attribute socketdomain; 25 | attribute test_stat_domain; 26 | attribute sysctldomain; 27 | attribute sysmiscdomain; 28 | attribute test_create_d; 29 | attribute test_getsched_d; 30 | attribute test_getsid_d; 31 | attribute test_setpgid_d; 32 | attribute test_setsched_d; 33 | attribute transitiondomain; 34 | attribute waitdomain; 35 | attribute test_getpgid_d; 36 | attribute dyntracedomain; 37 | attribute dyntransdomain; 38 | attribute mqopdomain; 39 | -------------------------------------------------------------------------------- /policy/test_cap_userns.te: -------------------------------------------------------------------------------- 1 | ################################# 2 | # 3 | # Policy for testing non-init userns capability checking. 4 | # 5 | 6 | attribute capusernsdomain; 7 | 8 | # Domain for process that is allowed non-init userns capabilities 9 | type test_cap_userns_t; 10 | testsuite_domain_type(test_cap_userns_t) 11 | typeattribute test_cap_userns_t capusernsdomain; 12 | 13 | # This domain is allowed sys_admin on non-init userns for mount. 14 | allow test_cap_userns_t self:cap_userns sys_admin; 15 | 16 | # Domain for process that is not allowed non-init userns capabilities 17 | type test_no_cap_userns_t; 18 | testsuite_domain_type(test_no_cap_userns_t) 19 | typeattribute test_no_cap_userns_t capusernsdomain; 20 | 21 | # Rules common to both domains. 22 | allow_userns_create(capusernsdomain) 23 | # linux >= v5.12 needs setfcap to map UID 0 24 | allow capusernsdomain self:capability setfcap; 25 | -------------------------------------------------------------------------------- /policy/test_capable_sys.te: -------------------------------------------------------------------------------- 1 | ################################# 2 | # 3 | # Policy for testing system related capabilities. The test_capable_file.te 4 | # policy is a prequisite for this file. 5 | # 6 | 7 | # Type for process that is allowed certain capabilities 8 | type test_scap_t; 9 | testsuite_domain_type(test_scap_t) 10 | typeattribute test_scap_t capabledomain; 11 | 12 | # Domain for process that has no capability 13 | type test_noscap_t; 14 | testsuite_domain_type(test_noscap_t) 15 | typeattribute test_noscap_t capabledomain; 16 | 17 | # Permissions for the good domain 18 | allow test_scap_t self:capability { sys_rawio sys_chroot sys_admin sys_nice }; 19 | -------------------------------------------------------------------------------- /policy/test_cgroupfs.te: -------------------------------------------------------------------------------- 1 | ################################# 2 | # 3 | # Policy for testing cgroupfs labeling 4 | # 5 | 6 | # Types for test file. 7 | type test_cgroup_t; 8 | files_type(test_cgroup_t) 9 | 10 | require { 11 | type cgroup_t; 12 | } 13 | allow test_cgroup_t cgroup_t:filesystem { associate }; 14 | -------------------------------------------------------------------------------- /policy/test_dyntrans.te: -------------------------------------------------------------------------------- 1 | ################################# 2 | # 3 | # Policy for testing process dyntrans permission 4 | # 5 | 6 | attribute dyntransdomain; 7 | 8 | # Domain for process that is allowed to transition to the new domain. 9 | type test_dyntrans_fromdomain_t; 10 | testsuite_domain_type(test_dyntrans_fromdomain_t) 11 | domain_dyntrans_type(test_dyntrans_fromdomain_t) 12 | typeattribute test_dyntrans_fromdomain_t dyntransdomain; 13 | 14 | # Domain for process that is not allowed to transition to the new domain. 15 | type test_dyntrans_notfromdomain_t; 16 | testsuite_domain_type(test_dyntrans_notfromdomain_t) 17 | typeattribute test_dyntrans_notfromdomain_t dyntransdomain; 18 | 19 | # Allow the fromdomain to dyntrans to the new domain. 20 | type test_dyntrans_todomain_t; 21 | testsuite_domain_type(test_dyntrans_todomain_t) 22 | typeattribute test_dyntrans_todomain_t dyntransdomain; 23 | 24 | # Allow the fromdomain to dyntrans to the new domain. 25 | allow test_dyntrans_fromdomain_t test_dyntrans_todomain_t:process dyntransition; 26 | -------------------------------------------------------------------------------- /policy/test_entrypoint.te: -------------------------------------------------------------------------------- 1 | ################################# 2 | # 3 | # Policy for testing entrypoint permission 4 | # 5 | 6 | # Type that the test domain can be entered through. 7 | type test_entrypoint_allow_t; 8 | files_type(test_entrypoint_allow_t) 9 | 10 | # Type that the test domain can NOT be entered through. 11 | type test_entrypoint_deny_t; 12 | files_type(test_entrypoint_deny_t) 13 | 14 | # Test domain that can only be entered via the type above. 15 | type test_entrypoint_t; 16 | testsuite_domain_type(test_entrypoint_t) 17 | 18 | # Allow this domain to be entered via test_entrypoint_allow_t. 19 | domain_entry_file(test_entrypoint_t, test_entrypoint_allow_t) 20 | 21 | # Allow the domain to execute test_entrypoint_deny_t, but not 22 | # to enter through it. 23 | can_exec(test_entrypoint_t, test_entrypoint_deny_t) 24 | 25 | -------------------------------------------------------------------------------- /policy/test_execute_no_trans.te: -------------------------------------------------------------------------------- 1 | ################################# 2 | # 3 | # Policy for testing execute_notrans permission 4 | # 5 | 6 | # Type for the execute_notrans program allowed to execute from the test domain. 7 | type test_execute_notrans_allowed_t; 8 | files_type(test_execute_notrans_allowed_t) 9 | 10 | # Type for the execute_notrans program not allowed to execute 11 | # from the test domain. 12 | type test_execute_notrans_denied_t; 13 | files_type(test_execute_notrans_denied_t); 14 | 15 | # Test domain that can only be entered via the types above. 16 | type test_execute_notrans_t; 17 | testsuite_domain_type(test_execute_notrans_t); 18 | 19 | #Allow test_execute_notrans permissions to the allowed type 20 | can_exec(test_execute_notrans_t,test_execute_notrans_allowed_t) 21 | allow_map(test_execute_notrans_t, test_execute_notrans_denied_t, file) 22 | allow test_execute_notrans_t test_execute_notrans_denied_t:file { getattr open read }; 23 | -------------------------------------------------------------------------------- /policy/test_filesystem_name_trans.te: -------------------------------------------------------------------------------- 1 | # 2 | ######### Test filesystem name-base transition policy module ########## 3 | # 4 | 5 | # Name-based type transition context: 6 | type test_filesystem_filenametranscon1_t; 7 | files_type(test_filesystem_filenametranscon1_t) 8 | type test_filesystem_filenametranscon2_t; 9 | files_type(test_filesystem_filenametranscon2_t) 10 | 11 | # Create file and change context via name-based type_transition rule: 12 | fs_associate(test_filesystem_filenametranscon1_t) 13 | type_transition test_filesystem_t test_filesystem_file_t:file test_filesystem_filenametranscon1_t "name_trans_test_file1"; 14 | allow test_filesystem_t test_filesystem_filenametranscon1_t:file { create getattr open write }; 15 | 16 | fs_associate(test_filesystem_filenametranscon2_t) 17 | type_transition test_filesystem_t test_filesystem_file_t:file test_filesystem_filenametranscon2_t "name_trans_test_file2"; 18 | allow test_filesystem_t test_filesystem_filenametranscon2_t:file { create getattr open write }; 19 | 20 | ### NFS Rules ########## 21 | type_transition test_filesystem_t test_file_t:file test_filesystem_filenametranscon1_t "name_trans_test_file1"; 22 | type_transition test_filesystem_t test_file_t:file test_filesystem_filenametranscon2_t "name_trans_test_file2"; 23 | allow test_filesystem_filenametranscon1_t test_filesystem_file_t:filesystem { associate }; 24 | allow test_filesystem_filenametranscon2_t test_filesystem_file_t:filesystem { associate }; 25 | -------------------------------------------------------------------------------- /policy/test_glblub.cil: -------------------------------------------------------------------------------- 1 | (defaultrange db_table glblub) 2 | 3 | (class new_class_no_default_range (foobar)) 4 | (classorder (unordered new_class_no_default_range)) 5 | -------------------------------------------------------------------------------- /policy/test_ibendport.te: -------------------------------------------------------------------------------- 1 | ################################# 2 | # 3 | # Policy for testing Infiniband Pkey access. 4 | # 5 | 6 | attribute ibendportdomain; 7 | 8 | # Domain for process. 9 | type test_ibendport_manage_subnet_t; 10 | testsuite_domain_type(test_ibendport_manage_subnet_t) 11 | typeattribute test_ibendport_manage_subnet_t ibendportdomain; 12 | 13 | type test_ibendport_t; 14 | ifdef(`corenet_ib_endport',` 15 | corenet_ib_endport(test_ibendport_t) 16 | ') 17 | 18 | dev_rw_infiniband_dev(test_ibendport_manage_subnet_t) 19 | dev_rw_sysfs(test_ibendport_manage_subnet_t) 20 | 21 | ifdef(`dev_rw_infiniband_mgmt_dev', ` 22 | dev_rw_infiniband_mgmt_dev(test_ibendport_manage_subnet_t) 23 | ') 24 | 25 | ifdef(`corenet_ib_access_unlabeled_pkeys',` 26 | corenet_ib_access_unlabeled_pkeys(test_ibendport_manage_subnet_t) 27 | ') 28 | 29 | allow test_ibendport_manage_subnet_t test_ibendport_t:infiniband_endport manage_subnet; 30 | -------------------------------------------------------------------------------- /policy/test_ibpkey.te: -------------------------------------------------------------------------------- 1 | ################################# 2 | # 3 | # Policy for testing Infiniband Pkey access. 4 | # 5 | 6 | attribute ibpkeydomain; 7 | 8 | # Domain for process. 9 | type test_ibpkey_access_t; 10 | testsuite_domain_type(test_ibpkey_access_t) 11 | typeattribute test_ibpkey_access_t ibpkeydomain; 12 | 13 | # ibv_create_cq(3) locks some memory - make sure the domain can do that 14 | # even with strict resource limits. 15 | allow test_ibpkey_access_t self:capability ipc_lock; 16 | 17 | # ibv_get_device_list(3) wants to list the devices via netlink by default 18 | # (if denied it falls back to listing them via sysfs). 19 | allow test_ibpkey_access_t self:netlink_rdma_socket create_socket_perms; 20 | 21 | dev_rw_infiniband_dev(test_ibpkey_access_t) 22 | dev_rw_sysfs(test_ibpkey_access_t) 23 | 24 | # Define a pkey type for labeling pkeys during the test. 25 | type test_ibpkey_t; 26 | ifdef(`corenet_ib_pkey',` 27 | corenet_ib_pkey(test_ibpkey_t) 28 | ') 29 | 30 | ifdef(`corenet_ib_access_unlabeled_pkeys',` 31 | corenet_ib_access_unlabeled_pkeys(test_ibpkey_access_t) 32 | ') 33 | -------------------------------------------------------------------------------- /policy/test_ioctl.te: -------------------------------------------------------------------------------- 1 | ################################# 2 | # 3 | # Policy for testing ioctl permission 4 | # 5 | 6 | attribute ioctldomain; 7 | 8 | # Domain for process that is allowed to perform ioctl. 9 | type test_ioctl_t; 10 | testsuite_domain_type(test_ioctl_t) 11 | typeattribute test_ioctl_t ioctldomain; 12 | 13 | # Domain for process that is not allowed to perform ioctl. 14 | type test_noioctl_t; 15 | testsuite_domain_type(test_noioctl_t) 16 | typeattribute test_noioctl_t ioctldomain; 17 | 18 | # Type for temp test files 19 | type test_ioctl_file_t; 20 | files_type(test_ioctl_file_t) 21 | 22 | # Allow the test domains some access to the temp file 23 | allow test_ioctl_t test_ioctl_file_t:file { open read write ioctl getattr setattr }; 24 | allow test_noioctl_t test_ioctl_file_t:file { open read }; 25 | 26 | -------------------------------------------------------------------------------- /policy/test_ioctl_cond_xperms.te: -------------------------------------------------------------------------------- 1 | define(`SIOCGIFNAME', `{ 0x8910 }') 2 | define(`SIOCGIFINDEX', `{ 0x8933 }') 3 | 4 | bool test_ioctl_cond_xperm_switch false; 5 | 6 | # Domain for process that is allowed SIOCGIFNAME on true and SIOCGIFINDEX on false. 7 | type test_ioctl_cond_xperm_a_t; 8 | testsuite_domain_type(test_ioctl_cond_xperm_a_t) 9 | typeattribute test_ioctl_cond_xperm_a_t ioctldomain; 10 | allow test_ioctl_cond_xperm_a_t self:udp_socket { create ioctl }; 11 | if (test_ioctl_cond_xperm_switch) { 12 | allowxperm test_ioctl_cond_xperm_a_t self:udp_socket ioctl SIOCGIFNAME; 13 | } else { 14 | allowxperm test_ioctl_cond_xperm_a_t self:udp_socket ioctl SIOCGIFINDEX; 15 | } 16 | 17 | # Domain for process that is allowed SIOCGIFINDEX on true and SIOCGIFNAME on false. 18 | type test_ioctl_cond_xperm_b_t; 19 | testsuite_domain_type(test_ioctl_cond_xperm_b_t) 20 | typeattribute test_ioctl_cond_xperm_b_t ioctldomain; 21 | allow test_ioctl_cond_xperm_b_t self:udp_socket { create ioctl }; 22 | if (test_ioctl_cond_xperm_switch) { 23 | allowxperm test_ioctl_cond_xperm_b_t self:udp_socket ioctl SIOCGIFINDEX; 24 | } else { 25 | allowxperm test_ioctl_cond_xperm_b_t self:udp_socket ioctl SIOCGIFNAME; 26 | } 27 | -------------------------------------------------------------------------------- /policy/test_ioctl_xperms.te: -------------------------------------------------------------------------------- 1 | # include FIOQSIZE ioctl numbers through all arches 2 | define(`FIOQSIZE', `{ 0x545e 0x5460 0x667f 0x6680 }') 3 | 4 | # Domain for process that is allowed the required ioctl xperms. 5 | type test_ioctl_xperm_t; 6 | testsuite_domain_type(test_ioctl_xperm_t) 7 | typeattribute test_ioctl_xperm_t ioctldomain; 8 | allow test_ioctl_xperm_t test_ioctl_file_t:file { open read write ioctl getattr setattr }; 9 | allowxperm test_ioctl_xperm_t test_ioctl_file_t:file ioctl FIOQSIZE; 10 | 11 | # Domain for process that is not allowed the required ioctl xperms. 12 | type test_ioctl_noxperm_t; 13 | testsuite_domain_type(test_ioctl_noxperm_t) 14 | typeattribute test_ioctl_noxperm_t ioctldomain; 15 | allow test_ioctl_noxperm_t test_ioctl_file_t:file { open read getattr setattr ioctl }; 16 | allowxperm test_ioctl_noxperm_t test_ioctl_file_t:file ioctl ~FIOQSIZE; 17 | -------------------------------------------------------------------------------- /policy/test_mlsconstrain.cil: -------------------------------------------------------------------------------- 1 | (mlsconstrain (peer (recv)) (or (dom l1 l2) (and (neq t1 mcs_constrained_type) (neq t2 mcs_constrained_type)))) 2 | (mlsconstrain (packet (recv)) (or (dom l1 l2) (and (neq t1 mcs_constrained_type) (neq t2 mcs_constrained_type)))) 3 | -------------------------------------------------------------------------------- /policy/test_netlink_socket.te: -------------------------------------------------------------------------------- 1 | ######################################## 2 | # 3 | # Policy for testing the new netlink socket classes. 4 | 5 | attribute netlinksocktestdomain; 6 | 7 | # 8 | # netlink_socket_test(newclass) 9 | # 10 | # Generate a pair of test domains and rules to test 11 | # that the kernel checks permission against the 12 | # 'newclass' security class rather than the generic 13 | # 'netlink_socket' security class. 14 | # 15 | define(`netlink_socket_test', ` 16 | # Domain that is allowed to create $1_socket. 17 | type test_$1_t; 18 | testsuite_domain_type(test_$1_t) 19 | typeattribute test_$1_t netlinksocktestdomain; 20 | 21 | # Allow $1 but not netlink_socket. 22 | # This is to ensure that the kernel is checking the right class. 23 | allow test_$1_t self:$1 create_socket_perms; 24 | 25 | # Domain that is not allowed to create $1. 26 | type test_no_$1_t; 27 | testsuite_domain_type(test_no_$1_t) 28 | typeattribute test_no_$1_t netlinksocktestdomain; 29 | 30 | # Allow netlink_socket but not $1. 31 | # This is to ensure that the kernel is checking the right class. 32 | allow test_no_$1_t self:netlink_socket create_socket_perms; 33 | ') 34 | 35 | netlink_socket_test(netlink_iscsi_socket) 36 | netlink_socket_test(netlink_netfilter_socket) 37 | netlink_socket_test(netlink_generic_socket) 38 | netlink_socket_test(netlink_crypto_socket) 39 | 40 | # 41 | # Common rules for all netlink socket class test domains. 42 | # 43 | 44 | # Trigger kernel module auto-loading of the protocol implementations. 45 | kernel_request_load_module(netlinksocktestdomain) 46 | -------------------------------------------------------------------------------- /policy/test_nlmsg.te: -------------------------------------------------------------------------------- 1 | ######################################## 2 | # 3 | # Policy for testing the nlmsg extended permissions. 4 | 5 | define(`RTM_GETLINK', `18') 6 | define(`RTM_SETLINK', `19') 7 | define(`RTM_GETADDR', `22') 8 | 9 | attribute nlmsgtestdomain; 10 | 11 | # Domain that is allowed the nlmsg extended permissions. 12 | type test_nlmsg_xperm_t; 13 | typeattribute test_nlmsg_xperm_t nlmsgtestdomain; 14 | testsuite_domain_type(test_nlmsg_xperm_t) 15 | allow test_nlmsg_xperm_t self:netlink_route_socket create_socket_perms; 16 | # Also allow the legacy nlmsg_read/write permissions to ensure no false positives. 17 | allow test_nlmsg_xperm_t self:netlink_route_socket { nlmsg nlmsg_read nlmsg_write }; 18 | allowxperm test_nlmsg_xperm_t self:netlink_route_socket nlmsg { RTM_GETLINK RTM_SETLINK RTM_GETADDR }; 19 | 20 | # Domain that is not allowed the nlmsg extended permissions. 21 | type test_nlmsg_noxperm_t; 22 | typeattribute test_nlmsg_noxperm_t nlmsgtestdomain; 23 | testsuite_domain_type(test_nlmsg_noxperm_t) 24 | allow test_nlmsg_noxperm_t self:netlink_route_socket create_socket_perms; 25 | # Also allow the legacy nlmsg_read/write permissions to ensure no false positives. 26 | allow test_nlmsg_noxperm_t self:netlink_route_socket { nlmsg nlmsg_read nlmsg_write }; 27 | allowxperm test_nlmsg_noxperm_t self:netlink_route_socket nlmsg ~{ RTM_GETLINK RTM_SETLINK RTM_GETADDR }; 28 | 29 | # 30 | # Common rules for all nlmsg test domains. 31 | # 32 | 33 | # Trigger kernel module auto-loading of the protocol implementations. 34 | kernel_request_load_module(nlmsgtestdomain) 35 | -------------------------------------------------------------------------------- /policy/test_open.te: -------------------------------------------------------------------------------- 1 | ################################# 2 | # 3 | # Policy for testing open operation 4 | # 5 | 6 | attribute test_open_domain; 7 | 8 | # Types for test file. 9 | type test_open_file_t; 10 | files_type(test_open_file_t) 11 | 12 | # Domain for process that can open the test file for reading and writing. 13 | type test_open_t; 14 | testsuite_domain_type(test_open_t) 15 | typeattribute test_open_t test_open_domain; 16 | allow test_open_t test_open_file_t:file rw_file_perms; 17 | 18 | # Domain for process that cannot open the test file for reading or writing. 19 | type test_noopen_t; 20 | testsuite_domain_type(test_noopen_t) 21 | typeattribute test_noopen_t test_open_domain; 22 | # Allow open permission so that this tests read/write permissions. 23 | # TBD: Add separate tests for open permission itself. 24 | allow test_noopen_t test_open_file_t:file { getattr open }; 25 | 26 | # Domain for process that can open test file for writing with O_APPEND. 27 | type test_append_t; 28 | testsuite_domain_type(test_append_t) 29 | typeattribute test_append_t test_open_domain; 30 | allow test_append_t test_open_file_t:file append_file_perms; 31 | -------------------------------------------------------------------------------- /policy/test_overlay_defaultrange.cil: -------------------------------------------------------------------------------- 1 | (defaultrange file target low) 2 | (defaultrange dir target low) 3 | (defaultrange lnk_file target low) 4 | (defaultrange chr_file target low) 5 | (defaultrange blk_file target low) 6 | (defaultrange sock_file target low) 7 | (defaultrange fifo_file target low) 8 | -------------------------------------------------------------------------------- /policy/test_prlimit.te: -------------------------------------------------------------------------------- 1 | ######################################## 2 | # 3 | # Policy for testing prlimit(2) permission checks. 4 | 5 | attribute prlimittestdomain; 6 | 7 | # prlimit_test(permission) 8 | # Generate a pair of test domains and rules for 9 | # testing the specified permission check. 10 | # 11 | define(`prlimit_test', ` 12 | # Domain that is allowed $1 permission to the child. 13 | type test_$1_t; 14 | testsuite_domain_type(test_$1_t) 15 | typeattribute test_$1_t prlimittestdomain; 16 | 17 | # Child domain 18 | type test_$1_child_t; 19 | testsuite_domain_type(test_$1_child_t) 20 | typeattribute test_$1_child_t prlimittestdomain; 21 | 22 | # Transition from parent to child. 23 | spec_domtrans_pattern(test_$1_t, test_file_t, test_$1_child_t) 24 | 25 | # Allow parent $1 to child. 26 | allow test_$1_t test_$1_child_t:process $1; 27 | 28 | # Domain that is not allowed $1 permission. 29 | type test_no_$1_t; 30 | testsuite_domain_type(test_no_$1_t) 31 | typeattribute test_no_$1_t prlimittestdomain; 32 | 33 | # Transition from parent to child. 34 | spec_domtrans_pattern(test_no_$1_t, test_file_t, test_$1_child_t) 35 | ') 36 | 37 | prlimit_test(setrlimit) 38 | prlimit_test(getrlimit) 39 | -------------------------------------------------------------------------------- /policy/test_ptrace.te: -------------------------------------------------------------------------------- 1 | ################################# 2 | # 3 | # Policy for testing ptrace call 4 | # 5 | 6 | attribute ptracedomain; 7 | 8 | # Domain for process that is allowed to trace. 9 | type test_ptrace_tracer_t; 10 | testsuite_domain_type(test_ptrace_tracer_t) 11 | typeattribute test_ptrace_tracer_t ptracedomain; 12 | allow test_ptrace_tracer_t self:capability sys_ptrace; 13 | 14 | # Domain for process that is not allowed to trace. 15 | type test_ptrace_nottracer_t; 16 | testsuite_domain_type(test_ptrace_nottracer_t) 17 | typeattribute test_ptrace_nottracer_t ptracedomain; 18 | allow test_ptrace_nottracer_t self:capability sys_ptrace; 19 | 20 | # Domain for process that is to be traced. 21 | type test_ptrace_traced_t; 22 | testsuite_domain_type(test_ptrace_traced_t) 23 | typeattribute test_ptrace_traced_t ptracedomain; 24 | 25 | # For writing to flag file: 26 | allow test_ptrace_traced_t test_file_t:fifo_file rw_file_perms; 27 | 28 | # Allow the tracer domain to trace the traced domain. 29 | allow test_ptrace_tracer_t test_ptrace_traced_t:process ptrace; 30 | 31 | # Let the tracer wait on the traced domain. 32 | allow test_ptrace_traced_t test_ptrace_tracer_t:process sigchld; 33 | -------------------------------------------------------------------------------- /policy/test_readlink.te: -------------------------------------------------------------------------------- 1 | ################################# 2 | # 3 | # Policy for testing readlink and follow_link operations 4 | # 5 | 6 | attribute test_readlink_domain; 7 | 8 | # Types for test file and test symbolic link. 9 | type test_readlink_file_t; 10 | type test_readlink_link_t; 11 | files_type(test_readlink_file_t) 12 | files_type(test_readlink_link_t) 13 | 14 | # Domain for process that can read and follow the symbolic link. 15 | type test_readlink_t; 16 | testsuite_domain_type(test_readlink_t) 17 | typeattribute test_readlink_t test_readlink_domain; 18 | allow test_readlink_t test_readlink_file_t:file { getattr read }; 19 | allow test_readlink_t test_readlink_link_t:lnk_file { getattr read }; 20 | 21 | # Domain for process that cannot read or follow the symbolic link. 22 | type test_noreadlink_t; 23 | testsuite_domain_type(test_noreadlink_t) 24 | typeattribute test_noreadlink_t test_readlink_domain; 25 | allow test_noreadlink_t test_readlink_file_t:file { getattr read }; 26 | allow test_noreadlink_t test_readlink_link_t:lnk_file { getattr }; 27 | 28 | # TODO: Needs to be translated into refpolicy... how? 29 | require { 30 | type ls_exec_t; 31 | } 32 | domain_entry_file(test_readlink_domain, ls_exec_t) 33 | -------------------------------------------------------------------------------- /policy/test_relabel.te: -------------------------------------------------------------------------------- 1 | ################################# 2 | # 3 | # Policy for testing relabel (chsid) operations 4 | # 5 | 6 | attribute test_relabel_domain; 7 | 8 | # Original and new types for the test file. 9 | type test_relabel_oldtype_t; 10 | type test_relabel_newtype_t; 11 | files_type(test_relabel_oldtype_t) 12 | files_type(test_relabel_newtype_t) 13 | 14 | # Domain for process that can relabel the test file. 15 | type test_relabel_t; 16 | testsuite_domain_type(test_relabel_t) 17 | domain_obj_id_change_exemption(test_relabel_t) 18 | typeattribute test_relabel_t test_relabel_domain; 19 | allow test_relabel_t test_relabel_oldtype_t:file { getattr relabelfrom }; 20 | allow test_relabel_t test_relabel_newtype_t:file { getattr relabelto }; 21 | 22 | # Domain for process that lacks relabelfrom permission to the old type. 23 | type test_norelabelfrom_t; 24 | testsuite_domain_type(test_norelabelfrom_t) 25 | domain_obj_id_change_exemption(test_norelabelfrom_t) 26 | typeattribute test_norelabelfrom_t test_relabel_domain; 27 | allow test_norelabelfrom_t test_relabel_oldtype_t:file { getattr }; 28 | allow test_norelabelfrom_t test_relabel_newtype_t:file { getattr relabelto }; 29 | 30 | # Domain for process that lacks relabelto permission to the new type. 31 | type test_norelabelto_t; 32 | testsuite_domain_type(test_norelabelto_t) 33 | domain_obj_id_change_exemption(test_norelabelto_t) 34 | typeattribute test_norelabelto_t test_relabel_domain; 35 | allow test_norelabelto_t test_relabel_oldtype_t:file { getattr relabelfrom }; 36 | allow test_norelabelto_t test_relabel_newtype_t:file { getattr }; 37 | -------------------------------------------------------------------------------- /policy/test_rxdir.te: -------------------------------------------------------------------------------- 1 | ################################# 2 | # 3 | # Policy for testing read and search access to a directory. 4 | # 5 | 6 | attribute test_rxdir_domain; 7 | 8 | # Type for top-level test directory in which the tests are performed. 9 | type test_rxdir_dir_t; 10 | files_type(test_rxdir_dir_t) 11 | 12 | # Domain for process that can read but not search the directory. 13 | type test_rdir_t; 14 | testsuite_domain_type(test_rdir_t) 15 | typeattribute test_rdir_t test_rxdir_domain; 16 | allow test_rdir_t test_rxdir_dir_t:dir { getattr read open }; 17 | allow test_rdir_t test_rxdir_dir_t:file { getattr }; 18 | 19 | # Domain for process that can search but not read the directory. 20 | type test_xdir_t; 21 | testsuite_domain_type(test_xdir_t) 22 | typeattribute test_xdir_t test_rxdir_domain; 23 | allow test_xdir_t test_rxdir_dir_t:dir search_dir_perms; 24 | allow test_xdir_t test_rxdir_dir_t:file { getattr }; 25 | 26 | # TODO: How to translate this into refpolicy???? 27 | # Allow all of these domains to be entered from sysadm domain 28 | require { 29 | type ls_exec_t; 30 | } 31 | domain_entry_file(test_rxdir_domain, ls_exec_t) 32 | -------------------------------------------------------------------------------- /policy/test_setattr.te: -------------------------------------------------------------------------------- 1 | ################################# 2 | # 3 | # Policy for testing setattr operations 4 | # 5 | 6 | attribute test_setattr_domain; 7 | 8 | # Types for test file. 9 | type test_setattr_file_t; 10 | files_type(test_setattr_file_t) 11 | 12 | # Domain for process that can set attributes on the test file. 13 | type test_setattr_t; 14 | testsuite_domain_type(test_setattr_t) 15 | typeattribute test_setattr_t test_setattr_domain; 16 | allow test_setattr_t self:capability chown; 17 | allow test_setattr_t test_setattr_file_t:file { getattr setattr write }; 18 | 19 | # Domain for process that cannot set attributes on the test file. 20 | type test_nosetattr_t; 21 | testsuite_domain_type(test_nosetattr_t) 22 | typeattribute test_nosetattr_t test_setattr_domain; 23 | allow test_nosetattr_t self:capability chown; 24 | allow test_nosetattr_t test_setattr_file_t:file { getattr write }; 25 | -------------------------------------------------------------------------------- /policy/test_setnice.te: -------------------------------------------------------------------------------- 1 | ################################# 2 | # 3 | # Policy for testing setnice permission 4 | # 5 | 6 | attribute setnicedomain; 7 | 8 | # Domain for process whose nice can be set. 9 | type test_setnice_set_t; 10 | testsuite_domain_type(test_setnice_set_t) 11 | typeattribute test_setnice_set_t setnicedomain; 12 | 13 | # Domain for process whose nice cannot be set. 14 | type test_setnice_noset_t; 15 | testsuite_domain_type(test_setnice_noset_t) 16 | typeattribute test_setnice_noset_t setnicedomain; 17 | 18 | # Domain for parent process. 19 | type test_setnice_change_t; 20 | testsuite_domain_type(test_setnice_change_t) 21 | typeattribute test_setnice_change_t setnicedomain; 22 | 23 | domain_transition_pattern(test_setnice_change_t, test_file_t, {test_setnice_set_t test_setnice_noset_t}) 24 | allow test_setnice_change_t test_setnice_set_t:fd use; 25 | allow test_setnice_set_t test_setnice_change_t:fd use; 26 | allow test_setnice_set_t test_setnice_change_t:fifo_file rw_file_perms; 27 | allow test_setnice_set_t test_setnice_change_t:process sigchld; 28 | allow test_setnice_set_t test_setnice_change_t:file rw_file_perms; 29 | allow test_setnice_change_t test_setnice_noset_t:fd use; 30 | allow test_setnice_noset_t test_setnice_change_t:fd use; 31 | allow test_setnice_noset_t test_setnice_change_t:fifo_file rw_file_perms; 32 | allow test_setnice_noset_t test_setnice_change_t:process sigchld; 33 | allow test_setnice_noset_t test_setnice_change_t:file rw_file_perms; 34 | 35 | allow test_setnice_change_t test_setnice_set_t:process setsched; 36 | -------------------------------------------------------------------------------- /policy/test_sigkill.te: -------------------------------------------------------------------------------- 1 | ################################# 2 | # 3 | # Policy for testing the task_kill hook 4 | # 5 | 6 | attribute killdomain; 7 | 8 | # Domain for process that receives the signals. 9 | type test_kill_server_t; 10 | testsuite_domain_type(test_kill_server_t) 11 | typeattribute test_kill_server_t killdomain; 12 | 13 | # For writing to flag file: 14 | allow test_kill_server_t test_file_t:fifo_file rw_file_perms; 15 | 16 | # Domain for process that is allowed to send sigkill. 17 | type test_kill_sigkill_t; 18 | testsuite_domain_type(test_kill_sigkill_t) 19 | typeattribute test_kill_sigkill_t killdomain; 20 | allow test_kill_sigkill_t test_kill_server_t:process sigkill; 21 | 22 | # Domain for process that is allowed to send sigstop. 23 | type test_kill_sigstop_t; 24 | testsuite_domain_type(test_kill_sigstop_t) 25 | typeattribute test_kill_sigstop_t killdomain; 26 | allow test_kill_sigstop_t test_kill_server_t:process sigstop; 27 | 28 | # Domain for process that is allowed to send sigchld. 29 | type test_kill_sigchld_t; 30 | testsuite_domain_type(test_kill_sigchld_t) 31 | typeattribute test_kill_sigchld_t killdomain; 32 | allow test_kill_sigchld_t test_kill_server_t:process sigchld; 33 | 34 | # Domain for process that is allowed to send other signals. 35 | type test_kill_signal_t; 36 | testsuite_domain_type(test_kill_signal_t) 37 | typeattribute test_kill_signal_t killdomain; 38 | 39 | allow test_kill_signal_t test_kill_server_t:process signal; 40 | -------------------------------------------------------------------------------- /policy/test_stat.te: -------------------------------------------------------------------------------- 1 | ################################# 2 | # 3 | # Policy for testing stat operations 4 | # 5 | 6 | attribute test_stat_domain; 7 | 8 | # Types for test file. 9 | type test_stat_file_t; 10 | files_type(test_stat_file_t) 11 | 12 | # Domain for process that can get attributes on the test file. 13 | type test_stat_t; 14 | testsuite_domain_type(test_stat_t) 15 | typeattribute test_stat_t test_stat_domain; 16 | allow test_stat_t test_stat_file_t:file getattr; 17 | 18 | # Domain for process that cannot set attributes on the test file. 19 | type test_nostat_t; 20 | testsuite_domain_type(test_nostat_t) 21 | typeattribute test_nostat_t test_stat_domain; 22 | 23 | # TODO: what is a replacement for this in refpolicy??? 24 | # Allow entering test domains via ls_exec_t. 25 | require { 26 | type ls_exec_t; 27 | } 28 | domain_entry_file(test_stat_domain, ls_exec_t) 29 | -------------------------------------------------------------------------------- /policy/test_sysctl.te: -------------------------------------------------------------------------------- 1 | ################################# 2 | # 3 | # Policy for testing sysctl permission 4 | # 5 | 6 | attribute sysctldomain; 7 | 8 | # Domain for process that is allowed to perform sysctl. 9 | type test_sysctl_t; 10 | testsuite_domain_type(test_sysctl_t) 11 | typeattribute test_sysctl_t sysctldomain; 12 | 13 | # Domain for process that is not allowed to perform sysctl. 14 | type test_nosysctl_t; 15 | testsuite_domain_type(test_nosysctl_t) 16 | typeattribute test_nosysctl_t sysctldomain; 17 | 18 | # Allow the first domain to perform sysctl operations. 19 | kernel_rw_all_sysctls(test_sysctl_t) 20 | 21 | # Allow the second domain to search /proc/sys/kernel, but nothing more. 22 | allow test_nosysctl_t sysctl_type:dir search; 23 | -------------------------------------------------------------------------------- /policy/test_task_create.te: -------------------------------------------------------------------------------- 1 | ######################################### 2 | # 3 | # Policy for testing the selinux_task_create hook 4 | # 5 | 6 | attribute test_create_d; 7 | 8 | # Domain for process allowed to fork. 9 | type test_create_yes_t; 10 | testsuite_domain_type(test_create_yes_t) 11 | typeattribute test_create_yes_t test_create_d; 12 | 13 | # Domain for process not allowed to fork. 14 | # The same permissions as test_create_yes_t, except process fork 15 | type test_create_no_t; 16 | # In refpolicy, all types with "domain" attribute are allowed 17 | # process_fork. Thus, to prevent test_create_no_t from picking up this 18 | # permission so we can test it, we omit the domain attribute. 19 | # Ideally, refpolicy would _not_ grant such permissions to every domain, 20 | # as it makes the permission effectively unusable in real policy. 21 | testsuite_domain_type_minimal(test_create_no_t) 22 | typeattribute test_create_no_t test_create_d; 23 | -------------------------------------------------------------------------------- /policy/test_task_getpgid.te: -------------------------------------------------------------------------------- 1 | ######################################### 2 | # 3 | # Policy for testing the selinux_task_getpgid hook. 4 | # 5 | 6 | attribute test_getpgid_d; 7 | 8 | # Domain for the target process 9 | type test_getpgid_target_t; 10 | testsuite_domain_type(test_getpgid_target_t) 11 | typeattribute test_getpgid_target_t test_getpgid_d; 12 | 13 | # For writing to flag file: 14 | allow test_getpgid_target_t test_file_t:fifo_file rw_file_perms; 15 | 16 | # Domain that can get the target's process group ID. 17 | type test_getpgid_yes_t; 18 | testsuite_domain_type(test_getpgid_yes_t) 19 | typeattribute test_getpgid_yes_t test_getpgid_d; 20 | 21 | # Domain that cannot get the target's process group ID. 22 | type test_getpgid_no_t; 23 | testsuite_domain_type(test_getpgid_no_t) 24 | typeattribute test_getpgid_no_t test_getpgid_d; 25 | 26 | # Give test_getpgid_yes_t the permission needed. 27 | allow test_getpgid_yes_t test_getpgid_target_t:process getpgid; 28 | -------------------------------------------------------------------------------- /policy/test_task_getsched.te: -------------------------------------------------------------------------------- 1 | ######################################### 2 | # 3 | # Policy for testing the selinux_task_getscheduler hook. 4 | # 5 | 6 | attribute test_getsched_d; 7 | 8 | # Domain for the target process 9 | type test_getsched_target_t; 10 | testsuite_domain_type(test_getsched_target_t) 11 | typeattribute test_getsched_target_t test_getsched_d; 12 | 13 | # For writing to flag file: 14 | allow test_getsched_target_t test_file_t:fifo_file rw_file_perms; 15 | 16 | # Domain that can get the target's scheduling policy. 17 | type test_getsched_yes_t; 18 | testsuite_domain_type(test_getsched_yes_t) 19 | typeattribute test_getsched_yes_t test_getsched_d; 20 | 21 | # Domain that cannot get the target's scheduling policy. 22 | type test_getsched_no_t; 23 | testsuite_domain_type(test_getsched_no_t) 24 | typeattribute test_getsched_no_t test_getsched_d; 25 | 26 | # Give test_getsched_yes_t the permission needed. 27 | allow test_getsched_yes_t test_getsched_target_t:process getsched; 28 | -------------------------------------------------------------------------------- /policy/test_task_getsid.te: -------------------------------------------------------------------------------- 1 | ######################################### 2 | # 3 | # Policy for testing the selinux_task_getsid hook. 4 | # 5 | 6 | attribute test_getsid_d; 7 | 8 | # Domain for the target process 9 | type test_getsid_target_t; 10 | testsuite_domain_type(test_getsid_target_t) 11 | typeattribute test_getsid_target_t test_getsid_d; 12 | 13 | # For writing to flag file: 14 | allow test_getsid_target_t test_file_t:fifo_file rw_file_perms; 15 | 16 | # Domain that can get the target's session ID. 17 | type test_getsid_yes_t; 18 | testsuite_domain_type(test_getsid_yes_t) 19 | typeattribute test_getsid_yes_t test_getsid_d; 20 | 21 | # Domain that cannot get the target's session ID. 22 | type test_getsid_no_t; 23 | testsuite_domain_type(test_getsid_no_t) 24 | typeattribute test_getsid_no_t test_getsid_d; 25 | 26 | # Give test_getsid_yes_t the permission needed. 27 | allow test_getsid_yes_t test_getsid_target_t:process getsession; 28 | -------------------------------------------------------------------------------- /policy/test_task_setpgid.te: -------------------------------------------------------------------------------- 1 | ######################################### 2 | # 3 | # Policy for testing the selinux_task_setpgid hook 4 | # 5 | 6 | attribute test_setpgid_d; 7 | 8 | # Domain for process allowed to setpgid 9 | type test_setpgid_yes_t; 10 | testsuite_domain_type(test_setpgid_yes_t) 11 | typeattribute test_setpgid_yes_t test_setpgid_d; 12 | 13 | # Domain for process not allowed to setpgid. 14 | # The same permissions as test_setpgid_yes_t, except process setpgid 15 | type test_setpgid_no_t; 16 | testsuite_domain_type_minimal(test_setpgid_no_t) 17 | typeattribute test_setpgid_no_t test_setpgid_d; 18 | -------------------------------------------------------------------------------- /policy/test_task_setsched.te: -------------------------------------------------------------------------------- 1 | ######################################### 2 | # 3 | # Policy for testing the selinux_task_setnice and 4 | # selinux_task_setscheduler hooks. 5 | # 6 | 7 | attribute test_setsched_d; 8 | 9 | # Domain for the target process 10 | type test_setsched_target_t; 11 | testsuite_domain_type(test_setsched_target_t) 12 | typeattribute test_setsched_target_t test_setsched_d; 13 | 14 | # For writing to flag file: 15 | allow test_setsched_target_t test_file_t:fifo_file rw_file_perms; 16 | 17 | # Domain that can change the target's priority and scheduling policy. 18 | type test_setsched_yes_t; 19 | testsuite_domain_type(test_setsched_yes_t) 20 | typeattribute test_setsched_yes_t test_setsched_d; 21 | 22 | # Domain that cannot change the target's priority or scheduling policy. 23 | type test_setsched_no_t; 24 | testsuite_domain_type(test_setsched_no_t) 25 | typeattribute test_setsched_no_t test_setsched_d; 26 | 27 | # Give these domains the capability needed to change the target. 28 | allow test_setsched_d self:capability sys_nice; 29 | 30 | # Give test_setsched_yes_t the permission needed to change the target. 31 | allow test_setsched_yes_t test_setsched_target_t:process setsched; 32 | -------------------------------------------------------------------------------- /policy/test_transition.te: -------------------------------------------------------------------------------- 1 | ################################# 2 | # 3 | # Policy for testing process transition permission 4 | # 5 | 6 | attribute transitiondomain; 7 | 8 | # Domain for process that is allowed to transition to the new domain. 9 | type test_transition_fromdomain_t; 10 | testsuite_domain_type(test_transition_fromdomain_t) 11 | typeattribute test_transition_fromdomain_t transitiondomain; 12 | 13 | # Domain for process that is not allowed to transition to the new domain. 14 | type test_transition_notfromdomain_t; 15 | testsuite_domain_type(test_transition_notfromdomain_t) 16 | typeattribute test_transition_notfromdomain_t transitiondomain; 17 | 18 | # New domain for the process after the transition. 19 | type test_transition_todomain_t; 20 | testsuite_domain_type(test_transition_todomain_t) 21 | typeattribute test_transition_todomain_t transitiondomain; 22 | 23 | # Allow the fromdomain to transition to the new domain. 24 | domain_transition_pattern(test_transition_fromdomain_t,bin_t,test_transition_todomain_t) 25 | allow test_transition_fromdomain_t test_transition_todomain_t:fd use; 26 | allow test_transition_todomain_t test_transition_fromdomain_t:fd use; 27 | -------------------------------------------------------------------------------- /policy/test_watchkey.te: -------------------------------------------------------------------------------- 1 | # 2 | ######### Check watch_queue for key changes policy module ########## 3 | # 4 | attribute watchkeydomain; 5 | 6 | ################# Allow watch_queue key { view } ########################## 7 | type test_watchkey_t; 8 | # Note: allow rules for pipe2(2) 'fifo_file { ioctl }' are set via domain_type() 9 | testsuite_domain_type(test_watchkey_t) 10 | typeattribute test_watchkey_t watchkeydomain; 11 | 12 | allow test_watchkey_t self:key { view }; 13 | 14 | ################# Deny watch_queue key { view } ########################## 15 | type test_watchkey_no_view_t; 16 | testsuite_domain_type(test_watchkey_no_view_t) 17 | typeattribute test_watchkey_no_view_t watchkeydomain; 18 | -------------------------------------------------------------------------------- /tests/atsecure/.gitignore: -------------------------------------------------------------------------------- 1 | atsecure 2 | evil.so 3 | good 4 | -------------------------------------------------------------------------------- /tests/atsecure/Makefile: -------------------------------------------------------------------------------- 1 | TARGETS=atsecure good evil.so 2 | 3 | all: $(TARGETS) 4 | 5 | evil.so: evil.c 6 | $(CC) -shared -o $@ -fPIC $< 7 | 8 | clean: 9 | rm -f $(TARGETS) 10 | -------------------------------------------------------------------------------- /tests/atsecure/atsecure.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | 6 | int main(void) 7 | { 8 | return getauxval(AT_SECURE); 9 | 10 | } 11 | -------------------------------------------------------------------------------- /tests/atsecure/evil.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | 6 | uid_t getuid(void) 7 | { 8 | printf("Evil code ran!\n"); 9 | exit(1); 10 | } 11 | -------------------------------------------------------------------------------- /tests/atsecure/good.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | 6 | int main(void) 7 | { 8 | printf("%u\n", getuid()); 9 | exit(0); 10 | } 11 | -------------------------------------------------------------------------------- /tests/atsecure/test: -------------------------------------------------------------------------------- 1 | #!/usr/bin/perl 2 | 3 | use Test; 4 | BEGIN { plan tests => 4 } 5 | 6 | $basedir = $0; 7 | $basedir =~ s|(.*)/[^/]*|$1|; 8 | 9 | # Verify that AT_SECURE is 1 when noatsecure permission is not allowed. 10 | $result = system( 11 | "runcon -t test_atsecure_denied_t -- runcon -t test_atsecure_newdomain_t $basedir/atsecure" 12 | ); 13 | ok($result); 14 | 15 | # Verify that AT_SECURE is 0 when noatsecure permission is allowed. 16 | $result = system( 17 | "runcon -t test_atsecure_allowed_t -- runcon -t test_atsecure_newdomain_t $basedir/atsecure" 18 | ); 19 | ok( $result, 0 ); 20 | 21 | # Verify that LD_PRELOAD is ignored when noatsecure permission is not allowed. 22 | $result = system( 23 | "runcon -t test_atsecure_denied_t -- env LD_PRELOAD=$basedir/evil.so runcon -t test_atsecure_newdomain_t $basedir/good" 24 | ); 25 | ok( $result, 0 ); 26 | 27 | # Verify that LD_PRELOAD is honored when noatsecure permission is allowed. 28 | $result = system( 29 | "runcon -t test_atsecure_allowed_t -- env LD_PRELOAD=$basedir/evil.so runcon -t test_atsecure_newdomain_t $basedir/good" 30 | ); 31 | ok($result); 32 | -------------------------------------------------------------------------------- /tests/binder/.gitignore: -------------------------------------------------------------------------------- 1 | check_binder 2 | check_binderfs 3 | manager 4 | service_provider 5 | client 6 | -------------------------------------------------------------------------------- /tests/binder/Makefile: -------------------------------------------------------------------------------- 1 | # Required for local building 2 | INCLUDEDIR ?= /usr/include 3 | 4 | TARGETS = check_binder client manager service_provider 5 | LDLIBS += -lselinux -lrt 6 | DEPS = binder_common.c binder_common.h 7 | 8 | ifeq ($(shell test -e $(INCLUDEDIR)/linux/android/binderfs.h && echo true),true) 9 | CFLAGS += -DHAVE_BINDERFS 10 | TARGETS += check_binderfs 11 | endif 12 | 13 | ifneq (,$(findstring -DHAVE_BPF,$(CFLAGS))) 14 | DEPS += ../bpf/bpf_common.c ../bpf/bpf_common.h 15 | LDLIBS += -lbpf 16 | endif 17 | 18 | all: $(TARGETS) 19 | 20 | clean: 21 | rm -f $(TARGETS) manager_flag service_provider_flag 22 | 23 | $(TARGETS): $(DEPS) 24 | -------------------------------------------------------------------------------- /tests/binder/check_binder.c: -------------------------------------------------------------------------------- 1 | #include "binder_common.h" 2 | 3 | static void usage(char *progname) 4 | { 5 | fprintf(stderr, 6 | "usage: %s [-v]\n" 7 | "Where:\n\t" 8 | "-v Print binder version.\n", progname); 9 | exit(-1); 10 | } 11 | 12 | int main(int argc, char **argv) 13 | { 14 | int opt, result, fd; 15 | struct binder_version vers; 16 | 17 | while ((opt = getopt(argc, argv, "v")) != -1) { 18 | switch (opt) { 19 | case 'v': 20 | verbose = true; 21 | break; 22 | default: 23 | usage(argv[0]); 24 | } 25 | } 26 | 27 | fd = open(BINDER_DEV, O_RDWR | O_CLOEXEC); 28 | if (fd < 0) { 29 | fprintf(stderr, "Cannot open: %s error: %s\n", 30 | BINDER_DEV, strerror(errno)); 31 | return NO_BINDER_SUPPORT; 32 | } 33 | 34 | result = ioctl(fd, BINDER_VERSION, &vers); 35 | if (result < 0) { 36 | fprintf(stderr, "ioctl BINDER_VERSION: %s\n", 37 | strerror(errno)); 38 | result = BINDER_ERROR; 39 | goto brexit; 40 | } 41 | 42 | if (vers.protocol_version != BINDER_CURRENT_PROTOCOL_VERSION) { 43 | fprintf(stderr, 44 | "Binder kernel version: %d differs from user space version: %d\n", 45 | vers.protocol_version, 46 | BINDER_CURRENT_PROTOCOL_VERSION); 47 | result = BINDER_VER_ERROR; 48 | goto brexit; 49 | } 50 | 51 | if (verbose) 52 | printf("Binder kernel version: %d\n", vers.protocol_version); 53 | 54 | result = BASE_BINDER_SUPPORT; 55 | 56 | brexit: 57 | close(fd); 58 | 59 | return result; 60 | } 61 | -------------------------------------------------------------------------------- /tests/binder/cleanup_binder.sh: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | 3 | umount binder 2>/dev/null 4 | rmdir /dev/binderfs 2>/dev/null 5 | -------------------------------------------------------------------------------- /tests/binder/init_binder.sh: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | 3 | binder_dir=$(dirname $0) 4 | kvercmp=$binder_dir/../kvercmp 5 | 6 | # If < 5.4 then /dev/binder is automatically assigned by binder driver 7 | # when CONFIG_ANDROID_BINDER_DEVICES="binder" 8 | if [ "$($kvercmp $(uname -r) 5.4)" -lt 0 ]; then 9 | $binder_dir/check_binder $1 2>/dev/null 10 | rc=$? 11 | if [ $rc -ne 1 ]; then 12 | exit $rc 13 | fi 14 | # Have BASE_BINDER_SUPPORT 15 | if [ "$1" = '-v' ]; then 16 | echo "Using: /dev/binder" 17 | fi 18 | 19 | exit $rc 20 | else 21 | # From 5.4 generate a binder device using binderfs services 22 | mkdir /dev/binderfs 2>/dev/null 23 | mount -t binder binder /dev/binderfs -o context=system_u:object_r:device_t:s0 2>/dev/null 24 | $binder_dir/check_binderfs $1 2>/dev/null 25 | rc=$? 26 | if [ $rc -ne 2 ]; then 27 | umount binder 2>/dev/null 28 | rmdir /dev/binderfs 2>/dev/null 29 | exit $rc 30 | fi 31 | # Have BINDERFS_SUPPORT 32 | if [ "$1" = '-v' ]; then 33 | echo "Using: /dev/binder-test" 34 | fi 35 | 36 | exit $rc 37 | fi 38 | -------------------------------------------------------------------------------- /tests/bounds/.gitignore: -------------------------------------------------------------------------------- 1 | thread 2 | -------------------------------------------------------------------------------- /tests/bounds/Makefile: -------------------------------------------------------------------------------- 1 | TARGETS=$(patsubst %.c,%,$(wildcard *.c)) 2 | 3 | LDLIBS += -lselinux -lpthread 4 | 5 | all: $(TARGETS) 6 | clean: 7 | rm -f $(TARGETS) bounds_file* 8 | -------------------------------------------------------------------------------- /tests/bpf/.gitignore: -------------------------------------------------------------------------------- 1 | bpf_test 2 | bpf_common 3 | -------------------------------------------------------------------------------- /tests/bpf/Makefile: -------------------------------------------------------------------------------- 1 | TARGETS = bpf_test 2 | DEPS = bpf_common.c bpf_common.h 3 | LDLIBS += -lselinux -lbpf 4 | 5 | # export so that BPF_ENABLED entries get built correctly on local build 6 | export CFLAGS += -DHAVE_BPF 7 | 8 | BPF_ENABLED = ../fdreceive ../binder 9 | 10 | all: $(TARGETS) 11 | @set -e; for i in $(BPF_ENABLED); do $(MAKE) -C $$i all ; done 12 | 13 | clean: 14 | rm -f $(TARGETS) test_sock flag *_flag 15 | @set -e; for i in $(BPF_ENABLED); do $(MAKE) -C $$i clean ; done 16 | 17 | $(TARGETS): $(DEPS) 18 | -------------------------------------------------------------------------------- /tests/bpf/bpf_common.h: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include 7 | #include 8 | #include 9 | #include 10 | #include 11 | 12 | extern int create_bpf_map(void); 13 | extern int create_bpf_prog(void); 14 | extern void bpf_setrlimit(void); 15 | 16 | /* edited eBPF instruction library */ 17 | /* Short form of mov, dst_reg = imm32 */ 18 | #define BPF_MOV64_IMM(DST, IMM) \ 19 | ((struct bpf_insn) { \ 20 | .code = BPF_ALU64 | BPF_MOV | BPF_K, \ 21 | .dst_reg = DST, \ 22 | .src_reg = 0, \ 23 | .off = 0, \ 24 | .imm = IMM }) 25 | 26 | /* Program exit */ 27 | #define BPF_EXIT_INSN() \ 28 | ((struct bpf_insn) { \ 29 | .code = BPF_JMP | BPF_EXIT, \ 30 | .dst_reg = 0, \ 31 | .src_reg = 0, \ 32 | .off = 0, \ 33 | .imm = 0 }) 34 | 35 | -------------------------------------------------------------------------------- /tests/bpf/bpf_test.c: -------------------------------------------------------------------------------- 1 | #include "bpf_common.h" 2 | 3 | static void usage(char *progname) 4 | { 5 | fprintf(stderr, 6 | "usage: %s -m|-p [-v]\n" 7 | "Where:\n\t" 8 | "-m Create BPF map fd\n\t" 9 | "-p Create BPF prog fd\n\t" 10 | "-v Print information.\n", progname); 11 | exit(-1); 12 | } 13 | 14 | int main(int argc, char *argv[]) 15 | { 16 | int opt, result, fd; 17 | bool verbose = false; 18 | char *context; 19 | 20 | enum { 21 | MAP_FD = 1, 22 | PROG_FD 23 | } bpf_fd_type; 24 | 25 | while ((opt = getopt(argc, argv, "mpv")) != -1) { 26 | switch (opt) { 27 | case 'm': 28 | bpf_fd_type = MAP_FD; 29 | break; 30 | case 'p': 31 | bpf_fd_type = PROG_FD; 32 | break; 33 | case 'v': 34 | verbose = true; 35 | break; 36 | default: 37 | usage(argv[0]); 38 | } 39 | } 40 | 41 | result = getcon(&context); 42 | if (result < 0) { 43 | fprintf(stderr, "Failed to obtain SELinux context\n"); 44 | exit(-1); 45 | } 46 | 47 | if (verbose) 48 | printf("Process context:\n\t%s\n", context); 49 | 50 | free(context); 51 | 52 | /* If BPF enabled, then need to set limits */ 53 | bpf_setrlimit(); 54 | 55 | switch (bpf_fd_type) { 56 | case MAP_FD: 57 | if (verbose) 58 | printf("Creating BPF map\n"); 59 | 60 | fd = create_bpf_map(); 61 | break; 62 | case PROG_FD: 63 | if (verbose) 64 | printf("Creating BPF prog\n"); 65 | 66 | fd = create_bpf_prog(); 67 | break; 68 | default: 69 | usage(argv[0]); 70 | } 71 | 72 | if (fd < 0) 73 | return fd; 74 | 75 | close(fd); 76 | return 0; 77 | } 78 | -------------------------------------------------------------------------------- /tests/cap_userns/.gitignore: -------------------------------------------------------------------------------- 1 | userns_child_exec 2 | -------------------------------------------------------------------------------- /tests/cap_userns/Makefile: -------------------------------------------------------------------------------- 1 | TARGETS=userns_child_exec 2 | 3 | all: $(TARGETS) 4 | clean: 5 | rm -f $(TARGETS) 6 | -------------------------------------------------------------------------------- /tests/cap_userns/test: -------------------------------------------------------------------------------- 1 | #!/usr/bin/perl 2 | 3 | use Test::More; 4 | 5 | BEGIN { 6 | $basedir = $0; 7 | $basedir =~ s|(.*)/[^/]*|$1|; 8 | 9 | if ( -e '/proc/sys/kernel/unprivileged_userns_clone' ) { 10 | system( 11 | "echo 1 > /proc/sys/kernel/unprivileged_userns_clone 2> /dev/null"); 12 | } 13 | if ( system("$basedir/userns_child_exec -t -U > /dev/null 2>&1") == 0 ) { 14 | plan tests => 2; 15 | } 16 | else { 17 | plan skip_all => "CLONE_NEWUSER not supported"; 18 | } 19 | } 20 | 21 | # Verify that test_cap_userns_t can mount proc within its own mount namespace. 22 | 23 | $result = system( 24 | "runcon -t test_cap_userns_t -- $basedir/userns_child_exec -p -m -U -M '0 0 1' -G '0 0 1' -- true 2>&1" 25 | ); 26 | ok( $result eq 0 ); 27 | 28 | # Verify that test_no_cap_userns_t cannot mount proc within its own mount namespace. 29 | 30 | $result = system( 31 | "runcon -t test_no_cap_userns_t -- $basedir/userns_child_exec -p -m -U -M '0 0 1' -G '0 0 1' -- true 2>&1" 32 | ); 33 | ok($result); 34 | 35 | if ( -e '/proc/sys/kernel/unprivileged_userns_clone' ) { 36 | system("echo 0 > /proc/sys/kernel/unprivileged_userns_clone 2> /dev/null"); 37 | } 38 | -------------------------------------------------------------------------------- /tests/capable_file/.gitignore: -------------------------------------------------------------------------------- 1 | test_lease 2 | -------------------------------------------------------------------------------- /tests/capable_file/Makefile: -------------------------------------------------------------------------------- 1 | TARGETS=$(patsubst %.c,%,$(wildcard *.c)) 2 | all: $(TARGETS) 3 | clean: 4 | rm -f $(TARGETS) temp_file temp_file2 5 | 6 | -------------------------------------------------------------------------------- /tests/capable_file/test_lease.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include 7 | #include 8 | 9 | /* 10 | * Test the fcntl F_SETLEASE operation on a file whose name is given as 11 | * the first argument. 12 | */ 13 | int main(int argc, char **argv) 14 | { 15 | 16 | int fd; 17 | int rc; 18 | 19 | if( argc != 2 ) { 20 | printf("usage: %s filename\n", argv[0]); 21 | exit(2); 22 | } 23 | 24 | fd = open(argv[1], O_RDONLY, 0); 25 | 26 | if(fd == -1) { 27 | perror("test_lease:open"); 28 | exit(2); 29 | } 30 | 31 | rc = fcntl(fd, F_SETLEASE, 0); 32 | if( rc == -1 ) { 33 | perror("test_lease:F_SETLEASE"); 34 | close(fd); 35 | exit(1); 36 | } 37 | 38 | close(fd); 39 | exit(0); 40 | 41 | } 42 | -------------------------------------------------------------------------------- /tests/capable_net/.gitignore: -------------------------------------------------------------------------------- 1 | test_bind 2 | test_raw 3 | -------------------------------------------------------------------------------- /tests/capable_net/Makefile: -------------------------------------------------------------------------------- 1 | TARGETS=$(patsubst %.c,%,$(wildcard *.c)) 2 | all: $(TARGETS) 3 | clean: 4 | rm -f $(TARGETS) 5 | 6 | -------------------------------------------------------------------------------- /tests/capable_net/test: -------------------------------------------------------------------------------- 1 | #!/usr/bin/perl 2 | # 3 | # This test performs checks for network-related capabilties. 4 | # 5 | 6 | use Test; 7 | BEGIN { plan tests => 5 } 8 | 9 | $basedir = $0; 10 | $basedir =~ s|(.*)/[^/]*|$1|; 11 | 12 | # Find a usable ifconfig 13 | if ( -x "/sbin/ifconfig" ) { 14 | $ifconfig = "/sbin/ifconfig"; 15 | } 16 | elsif ( -x "/usr/bin/ifconfig" ) { 17 | $ifconfig = "/usr/bin/ifconfig"; 18 | } 19 | else { 20 | BAIL_OUT("can not find a copy of ifconfig"); 21 | } 22 | 23 | # 24 | # Tests for the good domain. 25 | # 26 | # CAP_NET_ADMIN 27 | $result = system "runcon -t test_ncap_t -- $ifconfig lo -promisc 2>&1"; 28 | ok( $result, 0 ); 29 | 30 | # CAP_NET_BIND_SERVICE 31 | $result = system "runcon -t test_ncap_t -- $basedir/test_bind 2>&1"; 32 | ok( $result, 0 ); 33 | 34 | # CAP_NET_BROADCAST - Not done. Kernel does not check this capability yet. 35 | 36 | # CAP_NET_RAW 37 | $result = system "runcon -t test_ncap_t -- $basedir/test_raw 2>&1"; 38 | ok( $result, 0 ); 39 | 40 | # 41 | # Tests for the bad domain. 42 | # 43 | 44 | # CAP_NET_ADMIN 45 | $result = system "runcon -t test_resncap_t -- $ifconfig lo -promisc 2>&1"; 46 | ok($result); 47 | 48 | # CAP_NET_BIND_SERVICE; included in can_network by fedora policy 49 | #$result = system "runcon -t test_resncap_t -- $basedir/test_bind 2>&1"; 50 | #ok($result); 51 | 52 | # CAP_NET_RAW - Domain requires rawip_socket create permission 53 | $result = system "runcon -t test_resncap_t -- $basedir/test_raw 2>&1"; 54 | ok($result); 55 | 56 | exit; 57 | -------------------------------------------------------------------------------- /tests/capable_net/test_bind.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | 6 | /* 7 | * Test the bind() operation for a socket that is protected (< 1024). 8 | */ 9 | int main(int argc, char **argv) 10 | { 11 | 12 | int fd; 13 | int aport; 14 | 15 | aport = IPPORT_RESERVED - 1; 16 | fd = rresvport(&aport); 17 | if(fd == -1) { 18 | perror("test_bind:rresvport"); 19 | exit(1); 20 | } 21 | 22 | close(fd); 23 | exit(0); 24 | 25 | } 26 | -------------------------------------------------------------------------------- /tests/capable_net/test_raw.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | 6 | /* 7 | * Test the bind() operation for a raw socket. 8 | */ 9 | int main(int argc, char **argv) 10 | { 11 | 12 | int fd; 13 | 14 | fd = socket(PF_INET, SOCK_RAW, IPPROTO_RAW); 15 | if(fd == -1) { 16 | perror("test_raw:socket"); 17 | exit(1); 18 | } 19 | 20 | close(fd); 21 | exit(0); 22 | 23 | } 24 | -------------------------------------------------------------------------------- /tests/capable_sys/.gitignore: -------------------------------------------------------------------------------- 1 | test_chroot 2 | test_hostname 3 | test_nice 4 | test_rawio 5 | -------------------------------------------------------------------------------- /tests/capable_sys/Makefile: -------------------------------------------------------------------------------- 1 | TARGETS=$(patsubst %.c,%,$(wildcard *.c)) 2 | all: $(TARGETS) 3 | clean: 4 | rm -f $(TARGETS) 5 | 6 | -------------------------------------------------------------------------------- /tests/capable_sys/test_chroot.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | 5 | /* 6 | * Test the chroot() call on a directory whose name is given as the first 7 | * argument. This call will result in a CAP_SYS_CHROOT capable check. 8 | */ 9 | int main(int argc, char **argv) 10 | { 11 | 12 | int rc; 13 | 14 | if( argc != 2 ) { 15 | printf("usage: %s pathname\n", argv[0]); 16 | exit(2); 17 | } 18 | 19 | rc = chroot(argv[1]); 20 | if( rc != 0 ) { 21 | perror("test_chroot:chroot"); 22 | exit(1); 23 | } 24 | 25 | exit(0); 26 | 27 | } 28 | -------------------------------------------------------------------------------- /tests/capable_sys/test_hostname.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | 6 | /* 7 | * Test the sethostname() call. 8 | * This call will result in a CAP_SYS_ADMIN capable check. 9 | */ 10 | int main(int argc, char **argv) 11 | { 12 | 13 | int rc; 14 | char buf[255]; 15 | 16 | rc = gethostname(buf, sizeof(buf)); 17 | if( rc != 0 ) { 18 | perror("test_sethostname:gethostname"); 19 | exit(2); 20 | } 21 | 22 | rc = sethostname(buf, strlen(buf)); 23 | if( rc != 0 ) { 24 | perror("test_sethostname:sethostname"); 25 | exit(1); 26 | } 27 | 28 | exit(0); 29 | 30 | } 31 | -------------------------------------------------------------------------------- /tests/capable_sys/test_nice.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | 6 | /* 7 | * Test the nice() system call. 8 | * This call will result in a CAP_SYS_NICE capable check. 9 | */ 10 | int main(int argc, char **argv) 11 | { 12 | 13 | int rc; 14 | 15 | rc = nice(-10); 16 | if( rc == -1) { 17 | perror("test_nice:nice"); 18 | exit(1); 19 | } 20 | 21 | exit(0); 22 | 23 | } 24 | -------------------------------------------------------------------------------- /tests/capable_sys/test_rawio.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include 7 | 8 | /* 9 | * Test the FIBMAP ioctl() call on a file whose name is given as the first 10 | * argument. This ioctl will result in a CAP_SYS_RAWIO capable check. 11 | */ 12 | int main(int argc, char **argv) 13 | { 14 | 15 | int fd; 16 | int rc; 17 | int val = 0; 18 | 19 | if( argc != 2 ) { 20 | printf("usage: %s filename\n", argv[0]); 21 | exit(2); 22 | } 23 | 24 | fd = open(argv[1], O_RDONLY, 0); 25 | 26 | if(fd == -1) { 27 | perror("test_rawio:open"); 28 | exit(2); 29 | } 30 | 31 | val = 0; 32 | rc = ioctl(fd, FIBMAP, &val); 33 | if( rc != 0 ) { 34 | perror("test_rawio:FIBMAP"); 35 | exit(1); 36 | } 37 | 38 | close(fd); 39 | exit(0); 40 | 41 | } 42 | -------------------------------------------------------------------------------- /tests/cgroupfs_label/Makefile: -------------------------------------------------------------------------------- 1 | all: 2 | clean: 3 | -------------------------------------------------------------------------------- /tests/cgroupfs_label/test: -------------------------------------------------------------------------------- 1 | #!/usr/bin/perl 2 | 3 | use Test::More; 4 | 5 | my ( $cgroup_dir, $cgroup_file ); 6 | 7 | BEGIN { 8 | if ( -d "/sys/fs/cgroup/unified" ) { 9 | 10 | # Cgroupfs v2 + v1, use v2. 11 | $cgroup_dir = "/sys/fs/cgroup/unified"; 12 | $cgroup_file = "cgroup.type"; 13 | plan tests => 2; 14 | } 15 | elsif ( -d "/sys/fs/cgroup/devices" ) { 16 | 17 | # Cgroupfs v1 only. 18 | $cgroup_dir = "/sys/fs/cgroup/devices"; 19 | $cgroup_file = "cgroup.procs"; 20 | plan tests => 2; 21 | } 22 | elsif ( -d "/sys/fs/cgroup" ) { 23 | 24 | # Assume cgroupfs v2 only. 25 | $cgroup_dir = "/sys/fs/cgroup"; 26 | $cgroup_file = "cgroup.type"; 27 | plan tests => 2; 28 | } 29 | else { 30 | plan skip_all => "No cgroupfs mount detected"; 31 | } 32 | } 33 | 34 | my $dir = "$cgroup_dir/selinuxtest"; 35 | my $ret; 36 | 37 | # Create a new cgroupfs directory and relabel it. 38 | mkdir("$dir"); 39 | system("chcon -R -t test_cgroup_t $dir"); 40 | 41 | # Create a subdirectory in it. 42 | mkdir("$dir/subdir"); 43 | 44 | $ret = system("secon -tf $dir/subdir | grep -q '^test_cgroup_t\$'"); 45 | ok( $ret eq 0 ); # Did the subdirectory inherit the parent's label? 46 | 47 | $ret = 48 | system("secon -tf $dir/subdir/$cgroup_file | grep -q '^test_cgroup_t\$'"); 49 | ok( $ret eq 0 ); # Did also files in the subdirectory inherit the label? 50 | 51 | # Cleanup. 52 | rmdir("$dir/subdir"); 53 | rmdir("$dir"); 54 | 55 | exit; 56 | -------------------------------------------------------------------------------- /tests/checkreqprot/Makefile: -------------------------------------------------------------------------------- 1 | all: 2 | clean: 3 | -------------------------------------------------------------------------------- /tests/checkreqprot/default_value.sh: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | 3 | mydir=$(dirname $0) 4 | DISTRO=$($mydir/../os_detect) 5 | kvercmp=$mydir/../kvercmp 6 | 7 | if [ "$($kvercmp $(uname -r) 4.4)" -ge 0 ] || 8 | [ "$DISTRO" = "RHEL7" -a "$($kvercmp $(uname -r) 3.10.0-327)" -ge 0 ]; then 9 | grep -q 0 /sys/fs/selinux/checkreqprot 2> /dev/null 10 | exit $? 11 | fi 12 | exit 0 13 | -------------------------------------------------------------------------------- /tests/checkreqprot/test: -------------------------------------------------------------------------------- 1 | #!/usr/bin/perl 2 | 3 | use Test; 4 | 5 | BEGIN { 6 | plan tests => 1; 7 | } 8 | 9 | $basedir = $0; 10 | $basedir =~ s|(.*)/[^/]*|$1|; 11 | 12 | $result = system("$basedir/default_value.sh"); 13 | ok( $result, 0 ); 14 | 15 | exit; 16 | -------------------------------------------------------------------------------- /tests/domain_trans/Makefile: -------------------------------------------------------------------------------- 1 | all: 2 | clean: 3 | -------------------------------------------------------------------------------- /tests/domain_trans/test: -------------------------------------------------------------------------------- 1 | #!/usr/bin/perl 2 | 3 | use Test; 4 | BEGIN { plan tests => 2 } 5 | 6 | $basedir = $0; 7 | $basedir =~ s|(.*)/[^/]*|$1|; 8 | 9 | # Verify that notfromdomain cannot transition to todomain. 10 | # Should fail on the transition permission check. 11 | $result = system( 12 | "runcon -t test_transition_notfromdomain_t -- runcon -t test_transition_todomain_t true 2>&1" 13 | ); 14 | ok($result); # we expect this to fail. 15 | 16 | # Verify that fromdomain can transition to todomain. 17 | $result = system( 18 | "runcon -t test_transition_fromdomain_t -- runcon -t test_transition_todomain_t true 2>&1" 19 | ); 20 | ok( $result, 0 ); 21 | -------------------------------------------------------------------------------- /tests/dyntrace/.gitignore: -------------------------------------------------------------------------------- 1 | child 2 | parent 3 | -------------------------------------------------------------------------------- /tests/dyntrace/Makefile: -------------------------------------------------------------------------------- 1 | TARGETS=parent child 2 | 3 | LDLIBS += -lselinux 4 | 5 | all: $(TARGETS) 6 | clean: 7 | rm -f $(TARGETS) 8 | -------------------------------------------------------------------------------- /tests/dyntrace/child.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | 5 | int main(int argc, char **argv) 6 | { 7 | int rc; 8 | 9 | rc = setcon(argv[1]); 10 | if (rc < 0) { 11 | perror("setcon"); 12 | exit(1); 13 | } 14 | exit(0); 15 | } 16 | 17 | -------------------------------------------------------------------------------- /tests/dyntrace/test: -------------------------------------------------------------------------------- 1 | #!/usr/bin/perl 2 | 3 | use Test; 4 | BEGIN { plan tests => 2 } 5 | 6 | $basedir = $0; 7 | $basedir =~ s|(.*)/[^/]*|$1|; 8 | 9 | # Verify that test_dyntrace_child_t can be traced across an dyn 10 | # by test_dyntrace_parent_t. 11 | $result = system( 12 | "runcon -t test_dyntrace_parent_t -- $basedir/parent test_dyntrace_child_t $basedir/child 2>&1" 13 | ); 14 | ok( $result, 0 ); 15 | 16 | # Verify that test_dyntrace_notchild_t cannot be traced across an dyn 17 | # by test_dyntrace_parent_t. 18 | # Should fail on ptrace permission. 19 | $result = system( 20 | "runcon -t test_dyntrace_parent_t -- $basedir/parent test_dyntrace_notchild_t $basedir/child 2>&1" 21 | ); 22 | ok($result); # we expect this to fail. 23 | 24 | -------------------------------------------------------------------------------- /tests/dyntrans/.gitignore: -------------------------------------------------------------------------------- 1 | parent 2 | -------------------------------------------------------------------------------- /tests/dyntrans/Makefile: -------------------------------------------------------------------------------- 1 | TARGETS=parent 2 | 3 | LDLIBS += -lselinux 4 | 5 | all: $(TARGETS) 6 | clean: 7 | rm -f $(TARGETS) 8 | -------------------------------------------------------------------------------- /tests/dyntrans/parent.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include 7 | #include 8 | #include 9 | #include 10 | 11 | int main(int argc, char **argv) 12 | { 13 | int rc; 14 | const char *context_s; 15 | char *context_tmp; 16 | context_t context; 17 | 18 | if (argc != 2) { 19 | fprintf(stderr, "usage: %s newdomain\n", argv[0]); 20 | exit(-1); 21 | } 22 | 23 | rc = getcon(&context_tmp); 24 | if (rc < 0) { 25 | fprintf(stderr, "%s: unable to get my context\n", argv[0]); 26 | exit(-1); 27 | 28 | } 29 | 30 | context = context_new(context_tmp); 31 | if (!context) { 32 | fprintf(stderr, "%s: unable to create context structure\n", argv[0]); 33 | exit(-1); 34 | } 35 | 36 | if (context_type_set(context, argv[1])) { 37 | fprintf(stderr, "%s: unable to set new type\n", argv[0]); 38 | exit(-1); 39 | } 40 | 41 | freecon(context_tmp); 42 | context_s = context_str(context); 43 | if (!context_s) { 44 | fprintf(stderr, "%s: unable to obtain new context string\n", argv[0]); 45 | exit(-1); 46 | } 47 | 48 | rc = setcon(context_s); 49 | if (rc < 0) { 50 | perror("setcon failed"); 51 | exit(-1); 52 | } 53 | 54 | printf("All systems go\n"); 55 | exit(0); 56 | } 57 | 58 | -------------------------------------------------------------------------------- /tests/dyntrans/test: -------------------------------------------------------------------------------- 1 | #!/usr/bin/perl 2 | 3 | use Test; 4 | BEGIN { plan tests => 2 } 5 | 6 | $basedir = $0; 7 | $basedir =~ s|(.*)/[^/]*|$1|; 8 | 9 | # Verify that notfromdomain cannot transition to todomain. 10 | # Should fail on the transition permission check. 11 | $result = system( 12 | "runcon -t test_dyntrans_notfromdomain_t -- $basedir/parent test_dyntrans_todomain_t 2>&1" 13 | ); 14 | ok($result); # we expect this to fail. 15 | 16 | # Verify that fromdomain can transition to todomain. 17 | $result = system( 18 | "runcon -t test_dyntrans_fromdomain_t -- $basedir/parent test_dyntrans_todomain_t 2>&1" 19 | ); 20 | ok( $result, 0 ); 21 | -------------------------------------------------------------------------------- /tests/entrypoint/Makefile: -------------------------------------------------------------------------------- 1 | all: 2 | clean: 3 | rm -f true 4 | -------------------------------------------------------------------------------- /tests/entrypoint/test: -------------------------------------------------------------------------------- 1 | #!/usr/bin/perl 2 | 3 | use Test; 4 | BEGIN { plan tests => 2 } 5 | 6 | $basedir = $0; 7 | $basedir =~ s|(.*)/[^/]*|$1|; 8 | 9 | system("cp /bin/true $basedir/true"); 10 | 11 | # Verify that test_entrypoint_t cannot be entered via test_entrypoint_deny_t. 12 | system("chcon -t test_entrypoint_deny_t $basedir/true"); 13 | $result = system("runcon -t test_entrypoint_t $basedir/true 2>&1"); 14 | ok($result); #this should fail 15 | 16 | # Verify that test_entrypoint_t can be entered via test_entrypoint_allow_t. 17 | system("chcon -t test_entrypoint_allow_t $basedir/true"); 18 | $result = system("runcon -t test_entrypoint_t $basedir/true"); 19 | ok( $result, 0 ); #this should pass 20 | 21 | # Cleanup. 22 | system("rm -f $basedir/true"); 23 | 24 | exit; 25 | -------------------------------------------------------------------------------- /tests/execshare/.gitignore: -------------------------------------------------------------------------------- 1 | child 2 | parent 3 | -------------------------------------------------------------------------------- /tests/execshare/Makefile: -------------------------------------------------------------------------------- 1 | TARGETS=parent child 2 | 3 | LDLIBS += -lselinux 4 | 5 | all: $(TARGETS) 6 | clean: 7 | rm -f $(TARGETS) 8 | -------------------------------------------------------------------------------- /tests/execshare/child.c: -------------------------------------------------------------------------------- 1 | #include 2 | 3 | int main(void) 4 | { 5 | exit(0); 6 | } 7 | 8 | -------------------------------------------------------------------------------- /tests/execshare/test: -------------------------------------------------------------------------------- 1 | #!/usr/bin/perl 2 | 3 | use Test; 4 | BEGIN { plan tests => 2 } 5 | 6 | $basedir = $0; 7 | $basedir =~ s|(.*)/[^/]*|$1|; 8 | 9 | # Verify that test_execshare_parent_t can share state across an exec with 10 | # test_execshare_child_t. 11 | 12 | $result = system( 13 | "runcon -t test_execshare_parent_t -- $basedir/parent 0x200 test_execshare_child_t $basedir/child 2>&1" 14 | ); 15 | ok( $result, 0 ); 16 | 17 | # Verify that test_execshare_parent_t cannot share state across an exec with 18 | # test_execshare_notchild_t. 19 | 20 | $result = system( 21 | "runcon -t test_execshare_parent_t -- $basedir/parent 0x200 test_execshare_notchild_t $basedir/child 2>&1" 22 | ); 23 | ok($result); 24 | 25 | -------------------------------------------------------------------------------- /tests/exectrace/.gitignore: -------------------------------------------------------------------------------- 1 | child 2 | parent 3 | -------------------------------------------------------------------------------- /tests/exectrace/Makefile: -------------------------------------------------------------------------------- 1 | TARGETS=parent child 2 | 3 | LDLIBS += -lselinux 4 | 5 | all: $(TARGETS) 6 | clean: 7 | rm -f $(TARGETS) 8 | -------------------------------------------------------------------------------- /tests/exectrace/child.c: -------------------------------------------------------------------------------- 1 | #include 2 | 3 | int main(void) 4 | { 5 | exit(0); 6 | } 7 | 8 | -------------------------------------------------------------------------------- /tests/exectrace/test: -------------------------------------------------------------------------------- 1 | #!/usr/bin/perl 2 | 3 | use Test; 4 | BEGIN { plan tests => 2 } 5 | 6 | $basedir = $0; 7 | $basedir =~ s|(.*)/[^/]*|$1|; 8 | 9 | # Verify that test_exectrace_child_t can be traced across an exec 10 | # by test_exectrace_parent_t. 11 | $result = system( 12 | "runcon -t test_exectrace_parent_t -- $basedir/parent test_exectrace_child_t $basedir/child 2>&1" 13 | ); 14 | ok( $result, 0 ); 15 | 16 | # Verify that test_exectrace_notchild_t cannot be traced across an exec 17 | # by test_exectrace_parent_t. 18 | # Should fail on ptrace permission. 19 | $result = system( 20 | "runcon -t test_exectrace_parent_t -- $basedir/parent test_exectrace_notchild_t $basedir/child 2>&1" 21 | ); 22 | ok($result); # we expect this to fail. 23 | 24 | -------------------------------------------------------------------------------- /tests/execute_no_trans/Makefile: -------------------------------------------------------------------------------- 1 | all: 2 | clean: 3 | rm -f true 4 | -------------------------------------------------------------------------------- /tests/execute_no_trans/test: -------------------------------------------------------------------------------- 1 | #!/usr/bin/perl 2 | 3 | use Test; 4 | BEGIN { plan tests => 2 } 5 | 6 | $basedir = $0; 7 | $basedir =~ s|(.*)/[^/]*|$1|; 8 | 9 | # Remove any leftover programs from prior failed runs. 10 | system("rm -f $basedir/true"); 11 | 12 | # Set up a program with the denied type for this domain. 13 | system("cp /bin/true $basedir/true"); 14 | system("chcon -t test_execute_notrans_denied_t $basedir/true"); 15 | 16 | # Verify that test_execute_notrans_t cannot execute the denied type. 17 | $result = 18 | system("runcon -t test_execute_notrans_t -- bash -c $basedir/true 2>&1"); 19 | ok($result); #this should fail 20 | 21 | # Set up a program with the allowed type for this domain. 22 | system("chcon -t test_execute_notrans_allowed_t $basedir/true"); 23 | 24 | # Verify that test_execute_notrans_t can execute the allowed type. 25 | $result = 26 | system("runcon -t test_execute_notrans_t -- bash -c $basedir/true 2>&1"); 27 | ok( $result, 0 ); #this should pass 28 | 29 | # Cleanup. 30 | system("rm -f $basedir/true"); 31 | 32 | exit; 33 | -------------------------------------------------------------------------------- /tests/extended_socket_class/.gitignore: -------------------------------------------------------------------------------- 1 | sockcreate 2 | -------------------------------------------------------------------------------- /tests/extended_socket_class/Makefile: -------------------------------------------------------------------------------- 1 | TARGETS=$(patsubst %.c,%,$(wildcard *.c)) 2 | all: $(TARGETS) 3 | clean: 4 | rm -f $(TARGETS) 5 | -------------------------------------------------------------------------------- /tests/fdreceive/.gitignore: -------------------------------------------------------------------------------- 1 | client 2 | server 3 | -------------------------------------------------------------------------------- /tests/fdreceive/Makefile: -------------------------------------------------------------------------------- 1 | TARGETS = client server 2 | 3 | ifneq (,$(findstring -DHAVE_BPF,$(CFLAGS))) 4 | DEPS = ../bpf/bpf_common.c ../bpf/bpf_common.h 5 | LDLIBS += -lbpf 6 | endif 7 | 8 | all: $(TARGETS) 9 | 10 | clean: 11 | rm -f $(TARGETS) test_file test_file2 test_sock flag 12 | 13 | client: $(DEPS) 14 | -------------------------------------------------------------------------------- /tests/file/.gitignore: -------------------------------------------------------------------------------- 1 | test_fcntl 2 | test_lock 3 | test_mmap 4 | test_mprotect 5 | test_nofcntl 6 | test_rw 7 | test_seek 8 | test_sigiotask 9 | wait_io 10 | -------------------------------------------------------------------------------- /tests/file/Makefile: -------------------------------------------------------------------------------- 1 | TARGETS=$(patsubst %.c,%,$(wildcard *.c)) 2 | LDLIBS += -lselinux 3 | test_sigiotask: LDLIBS += -lutil 4 | all: $(TARGETS) 5 | clean: 6 | rm -f $(TARGETS) temp_file temp_file2 temp_file3 7 | -------------------------------------------------------------------------------- /tests/file/test_fcntl.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include 7 | 8 | /* 9 | * Test the fcntl file operation on a file whose name is given as the first 10 | * argument. 11 | */ 12 | int main(int argc, char **argv) 13 | { 14 | 15 | int fd; 16 | int rc; 17 | struct flock my_lock; 18 | 19 | if( argc != 2 ) { 20 | printf("usage: %s filename\n", argv[0]); 21 | exit(2); 22 | } 23 | 24 | fd = open(argv[1], O_RDONLY | O_APPEND, 0); 25 | 26 | if(fd == -1) { 27 | perror("test_fcntl:open"); 28 | exit(2); 29 | } 30 | 31 | rc = fcntl(fd, F_SETFL, 0); 32 | if( rc == -1 ) { 33 | perror("test_fcntl:F_SETFL"); 34 | exit(1); 35 | } 36 | 37 | rc = fcntl(fd, F_GETFL); 38 | if( rc == -1 ) { 39 | perror("test_fcntl:F_GETFL"); 40 | exit(1); 41 | } 42 | 43 | my_lock.l_type = F_RDLCK; 44 | my_lock.l_start = 0; 45 | my_lock.l_whence = SEEK_CUR; 46 | my_lock.l_len = 0; 47 | 48 | rc = fcntl(fd, F_GETLK, &my_lock); 49 | if( rc == -1 ) { 50 | perror("test_fcntl:F_GETLK"); 51 | exit(1); 52 | } 53 | 54 | close(fd); 55 | exit(0); 56 | 57 | } 58 | -------------------------------------------------------------------------------- /tests/file/test_lock.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include 7 | #include 8 | #include 9 | 10 | /* 11 | * Test the lock file operation on a file whose name is given as the first 12 | * argument. The second argument must be the SID we are to use to test 13 | * the actual lock() operation by changing the SID of the file we are 14 | * given. 15 | */ 16 | int main(int argc, char **argv) 17 | { 18 | 19 | int fd; 20 | int rc; 21 | 22 | if( argc != 3 ) { 23 | printf("usage: %s filename context\n", argv[0]); 24 | exit(2); 25 | } 26 | 27 | fd = open(argv[1], O_RDONLY, 0); 28 | 29 | if(fd == -1) { 30 | perror("test_lock:open"); 31 | exit(2); 32 | } 33 | 34 | rc = fsetfilecon(fd, argv[2]); 35 | if (rc < 0) { 36 | perror("test_lock:fsetfilecon"); 37 | exit(2); 38 | } 39 | 40 | rc = flock(fd, LOCK_EX); 41 | if( rc == -1 ) { 42 | perror("test_lock:LOCK_EX"); 43 | exit(1); 44 | } 45 | 46 | close(fd); 47 | exit(0); 48 | 49 | } 50 | -------------------------------------------------------------------------------- /tests/file/test_mmap.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include 7 | #include 8 | 9 | /* 10 | * Test the mmap file operation on a file whose name is given as the first 11 | * argument. The second argument must be the SID we are to use to test 12 | * the actual mmap() operation by changing the SID of the file we are 13 | * given. 14 | */ 15 | 16 | int main(int argc, char **argv) 17 | { 18 | 19 | int fd; 20 | void *ptr; 21 | int rc; 22 | 23 | if( argc != 3 ) { 24 | printf("usage: %s filename context\n", argv[0]); 25 | exit(2); 26 | } 27 | 28 | fd = open(argv[1], O_RDWR, 0); 29 | 30 | if(fd == -1) { 31 | perror("test_mmap:open"); 32 | exit(2); 33 | } 34 | 35 | rc = fsetfilecon(fd, argv[2]); 36 | if (rc < 0) { 37 | perror("test_mmap:fsetfilecon"); 38 | exit(2); 39 | } 40 | 41 | ptr = mmap(0, 1024, PROT_READ | PROT_WRITE | PROT_EXEC, MAP_SHARED, fd, 42 | getpagesize()); 43 | if( ptr == MAP_FAILED ) { 44 | perror("test_mmap:mmap"); 45 | close(fd); 46 | exit(1); 47 | } 48 | 49 | close(fd); 50 | exit(0); 51 | 52 | } 53 | -------------------------------------------------------------------------------- /tests/file/test_mprotect.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include 7 | #include 8 | 9 | /* 10 | * Test the mprotect file operation on a file whose name is given as the first 11 | * argument. The second argument must be the SID we are to use to test 12 | * the actual mprotect() operation by changing the SID of the file we are 13 | * given. 14 | */ 15 | int main(int argc, char **argv) 16 | { 17 | 18 | int fd; 19 | void *ptr; 20 | int rc; 21 | 22 | if( argc != 3 ) { 23 | printf("usage: %s filename context\n", argv[0]); 24 | exit(2); 25 | } 26 | 27 | fd = open(argv[1], O_RDONLY, 0); 28 | 29 | if(fd == -1) { 30 | perror("test_mprotect:open"); 31 | exit(2); 32 | } 33 | 34 | ptr = mmap(0, 1024, PROT_READ, MAP_SHARED, fd, getpagesize()); 35 | if( ptr == MAP_FAILED ) { 36 | close(fd); 37 | perror("test_mprotect:mmap"); 38 | exit(2); 39 | } 40 | 41 | rc = fsetfilecon(fd, argv[2]); 42 | if (rc < 0) { 43 | perror("test_mprotect:fsetfilecon"); 44 | exit(2); 45 | } 46 | 47 | rc = mprotect(ptr, 1024, PROT_READ); 48 | if( rc == -1 ) { 49 | close(fd); 50 | perror("test_mprotect:mprotect"); 51 | exit(1); 52 | } 53 | 54 | close(fd); 55 | exit(0); 56 | 57 | } 58 | -------------------------------------------------------------------------------- /tests/file/test_nofcntl.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include 7 | 8 | /* 9 | * Test the fcntl file operation on a file whose name is given as the first 10 | * argument. This program expects certain tests to fail, and that failure 11 | * is treated as success and the program continues. 12 | */ 13 | int main(int argc, char **argv) 14 | { 15 | 16 | int fd; 17 | int rc; 18 | struct flock my_lock; 19 | 20 | if( argc != 2 ) { 21 | printf("usage: %s filename\n", argv[0]); 22 | exit(2); 23 | } 24 | 25 | fd = open(argv[1], O_RDONLY | O_APPEND, 0); 26 | 27 | if(fd == -1) { 28 | perror("test_nofcntl:open"); 29 | exit(2); 30 | } 31 | 32 | /* The next two acesses should fail, so if that happens, we return success. */ 33 | 34 | rc = fcntl(fd, F_SETFL, 0); 35 | if( rc != -1 ) { 36 | fprintf(stderr, "test_nofcntl:F_SETFL\n"); 37 | exit(1); 38 | } 39 | 40 | my_lock.l_type = F_RDLCK; 41 | my_lock.l_start = 0; 42 | my_lock.l_whence = SEEK_CUR; 43 | my_lock.l_len = 0; 44 | 45 | rc = fcntl(fd, F_GETLK, &my_lock); 46 | if( rc != -1 ) { 47 | fprintf(stderr, "test_nofcntl:F_GETLK\n"); 48 | exit(1); 49 | } 50 | 51 | close(fd); 52 | exit(0); 53 | 54 | } 55 | -------------------------------------------------------------------------------- /tests/file/test_rw.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include 7 | #include 8 | #include 9 | 10 | /* 11 | * Test the read/write operation on a file whose name is given as the first 12 | * argument. The second argument must be the SID we are to use to test 13 | * the actual read/write() operation by changing the SID of the file we are 14 | * given. 15 | */ 16 | int main(int argc, char **argv) 17 | { 18 | 19 | int fd; 20 | int rc; 21 | char buf[255]; 22 | ssize_t bytes; 23 | 24 | if( argc != 3 ) { 25 | printf("usage: %s filename context\n", argv[0]); 26 | exit(2); 27 | } 28 | 29 | fd = open(argv[1], O_RDWR, 0); 30 | 31 | if(fd == -1) { 32 | perror("test_rw:open"); 33 | exit(2); 34 | } 35 | 36 | rc = fsetfilecon(fd, argv[2]); 37 | if (rc < 0) { 38 | perror("test_rw:fsetfilecon"); 39 | exit(2); 40 | } 41 | 42 | bytes = read(fd, buf, sizeof buf); 43 | if( bytes < 0) { 44 | perror("test_rw:read"); 45 | exit(1); 46 | } 47 | 48 | bytes = write(fd, buf, bytes); 49 | if( bytes < 0) { 50 | perror("test_rw:write"); 51 | exit(1); 52 | } 53 | 54 | close(fd); 55 | exit(0); 56 | 57 | } 58 | -------------------------------------------------------------------------------- /tests/file/test_seek.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include 7 | #include 8 | 9 | /* 10 | * Test the seek file operation on a file whose name is given as the first 11 | * argument. 12 | */ 13 | int main(int argc, char **argv) 14 | { 15 | 16 | int fd; 17 | int rc; 18 | 19 | if( argc != 2 ) { 20 | printf("usage: %s filename\n", argv[0]); 21 | exit(2); 22 | } 23 | 24 | fd = open(argv[1], O_RDONLY, 0); 25 | 26 | if(fd == -1) { 27 | perror("test_seek:open"); 28 | exit(2); 29 | } 30 | 31 | rc = lseek(fd, 10, SEEK_SET); 32 | if( rc == -1 ) { 33 | perror("test_seek:lseek"); 34 | close(fd); 35 | exit(1); 36 | } 37 | 38 | close(fd); 39 | exit(0); 40 | 41 | } 42 | -------------------------------------------------------------------------------- /tests/file/wait_io.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | 6 | /* 7 | * Function to handle SIGIO. 8 | */ 9 | static void sig_io(int signo) 10 | { 11 | printf("wait_io: got sigio\n"); 12 | exit(0); 13 | } 14 | 15 | /* 16 | * This program waits either for a SIGIO signal, or will time out. The 17 | * exit status is 'good' on the SIGIO receive, 'bad' on the timeout. 18 | */ 19 | int main(int argc, char **argv) 20 | { 21 | 22 | struct sigaction siga; 23 | int fd; 24 | 25 | if (argc != 2) { 26 | fprintf(stderr, "wait_io: incorrect number of arguments\n"); 27 | exit(2); 28 | } 29 | 30 | fd = atoi(argv[1]); 31 | 32 | /* 33 | * Set up signal handler for SIGIO. 34 | */ 35 | siga.sa_handler = sig_io; 36 | sigemptyset(&siga.sa_mask); 37 | siga.sa_flags = 0; 38 | sigaction(SIGIO, &siga, NULL); 39 | write(fd, "x", 1); 40 | close(fd); 41 | sleep(5); 42 | printf("wait_io: exiting without receiving sigio\n"); 43 | exit(1); 44 | 45 | } 46 | -------------------------------------------------------------------------------- /tests/filesystem/.gitignore: -------------------------------------------------------------------------------- 1 | mount 2 | umount 3 | quotas_test 4 | statfs_test 5 | fanotify_fs 6 | create_file_change_context 7 | fs_relabel 8 | check_file_context 9 | check_mount_context 10 | create_file 11 | grim_reaper 12 | xfs_quotas_test 13 | native_quotas_test 14 | -------------------------------------------------------------------------------- /tests/filesystem/Makefile: -------------------------------------------------------------------------------- 1 | # Required for local building 2 | #export CFLAGS += -DHAVE_FS_WATCH_PERM 3 | 4 | TARGETS = mount umount quotas_test statfs_test create_file_change_context \ 5 | fs_relabel check_file_context grim_reaper check_mount_context create_file \ 6 | xfs_quotas_test native_quotas_test 7 | 8 | LDLIBS += -lselinux 9 | 10 | ifneq (,$(findstring -DHAVE_FS_WATCH_PERM,$(CFLAGS))) 11 | TARGETS += fanotify_fs 12 | endif 13 | 14 | all: $(TARGETS) 15 | 16 | clean: 17 | rm -f $(TARGETS) 18 | -------------------------------------------------------------------------------- /tests/filesystem/ext4: -------------------------------------------------------------------------------- 1 | . -------------------------------------------------------------------------------- /tests/filesystem/jfs: -------------------------------------------------------------------------------- 1 | . -------------------------------------------------------------------------------- /tests/filesystem/statfs_test.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include 7 | #include 8 | #include 9 | 10 | static void print_usage(char *progname) 11 | { 12 | fprintf(stderr, 13 | "usage: %s -t path [-v]\n" 14 | "Where:\n\t" 15 | "-t Target path to statfs(2)\n\t" 16 | "-v Print information.\n", progname); 17 | exit(-1); 18 | } 19 | 20 | int main(int argc, char *argv[]) 21 | { 22 | int opt, result, save_err; 23 | char *context, *tgt = NULL; 24 | bool verbose = false; 25 | struct statfs statfs_t; 26 | 27 | while ((opt = getopt(argc, argv, "t:v")) != -1) { 28 | switch (opt) { 29 | case 't': 30 | tgt = optarg; 31 | break; 32 | case 'v': 33 | verbose = true; 34 | break; 35 | default: 36 | print_usage(argv[0]); 37 | } 38 | } 39 | 40 | if (!tgt) 41 | print_usage(argv[0]); 42 | 43 | if (verbose) { 44 | result = getcon(&context); 45 | if (result < 0) { 46 | fprintf(stderr, "Failed to obtain process context\n"); 47 | return -1; 48 | } 49 | printf("Process context:\n\t%s\n", context); 50 | free(context); 51 | } 52 | 53 | result = statfs(tgt, &statfs_t); 54 | save_err = errno; 55 | if (result < 0) { 56 | fprintf(stderr, "statfs(2) Failed: %s\n", strerror(errno)); 57 | return save_err; 58 | } 59 | 60 | if (verbose) 61 | printf("statfs(2) returned magic filesystem: 0x%lx\n", 62 | statfs_t.f_type); 63 | 64 | return 0; 65 | } 66 | -------------------------------------------------------------------------------- /tests/filesystem/vfat: -------------------------------------------------------------------------------- 1 | . -------------------------------------------------------------------------------- /tests/filesystem/xfs: -------------------------------------------------------------------------------- 1 | . -------------------------------------------------------------------------------- /tests/fs_filesystem/.gitignore: -------------------------------------------------------------------------------- 1 | fsmount 2 | fspick 3 | move_mount 4 | -------------------------------------------------------------------------------- /tests/fs_filesystem/Makefile: -------------------------------------------------------------------------------- 1 | TARGETS = fsmount fspick move_mount 2 | DEPS = fs_common.c fs_common.h 3 | LDLIBS += -lselinux 4 | USE_FS = ../filesystem 5 | 6 | all: $(TARGETS) 7 | @set -e; for i in $(USE_FS); do $(MAKE) -C $$i all ; done 8 | 9 | clean: 10 | rm -f $(TARGETS) 11 | @set -e; for i in $(USE_FS); do $(MAKE) -C $$i clean ; done 12 | 13 | $(TARGETS): $(DEPS) 14 | -------------------------------------------------------------------------------- /tests/fs_filesystem/ext4: -------------------------------------------------------------------------------- 1 | . -------------------------------------------------------------------------------- /tests/fs_filesystem/fs_common.h: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include 7 | #include 8 | #include 9 | #include 10 | #include 11 | #include 12 | 13 | #ifndef AT_EMPTY_PATH 14 | #define AT_EMPTY_PATH 0x1000 15 | #endif 16 | #ifndef AT_RECURSIVE 17 | #define AT_RECURSIVE 0x8000 18 | #endif 19 | 20 | int fsopen(const char *fs_name, unsigned int flags); 21 | int fsmount(int fsfd, unsigned int flags, unsigned int ms_flags); 22 | int fsconfig(int fsfd, unsigned int cmd, const char *key, 23 | const void *val, int aux); 24 | int move_mount(int from_dfd, const char *from_pathname, int to_dfd, 25 | const char *to_pathname, unsigned int flags); 26 | int open_tree(int dirfd, const char *pathname, unsigned int flags); 27 | int fspick(int dirfd, const char *pathname, unsigned int flags); 28 | 29 | #define MAX_OPS 40 30 | int fsconfig_opts(int fd, char *src, char *tgt, char *opts, bool verbose); 31 | -------------------------------------------------------------------------------- /tests/fs_filesystem/fspick.c: -------------------------------------------------------------------------------- 1 | #include "fs_common.h" 2 | 3 | static void print_usage(char *progname) 4 | { 5 | fprintf(stderr, 6 | "usage: %s -t tgt -o options [-v]\n" 7 | "Where:\n\t" 8 | "-t Target path\n\t" 9 | "-f Filesystem type\n\t" 10 | "-o Options list (comma separated list)\n\t" 11 | "-v Print information.\n", progname); 12 | exit(-1); 13 | } 14 | 15 | int main(int argc, char *argv[]) 16 | { 17 | int opt, result, pfd; 18 | char *context, *tgt = NULL, *opts = NULL; 19 | bool verbose = false; 20 | 21 | while ((opt = getopt(argc, argv, "t:o:v")) != -1) { 22 | switch (opt) { 23 | case 't': 24 | tgt = optarg; 25 | break; 26 | case 'o': 27 | opts = optarg; 28 | break; 29 | case 'v': 30 | verbose = true; 31 | break; 32 | default: 33 | print_usage(argv[0]); 34 | } 35 | } 36 | 37 | if (!tgt || !opts) 38 | print_usage(argv[0]); 39 | 40 | if (verbose) { 41 | result = getcon(&context); 42 | if (result < 0) { 43 | fprintf(stderr, "Failed to obtain process context\n"); 44 | return -1; 45 | } 46 | printf("Process context:\n\t%s\n", context); 47 | free(context); 48 | } 49 | 50 | if (verbose) 51 | printf("Mounting\n\ttgt: %s\n\topts: %s\n", tgt, opts); 52 | 53 | pfd = fspick(AT_FDCWD, tgt, 0); 54 | if (pfd < 0) { 55 | fprintf(stderr, "Failed fspick(2): %s\n", strerror(errno)); 56 | return -1; 57 | } 58 | 59 | /* config_opts() will return 0 or errno from fsconfig(2) */ 60 | result = fsconfig_opts(pfd, NULL, tgt, opts, verbose); 61 | if (result) { 62 | fprintf(stderr, "Failed config_opts\n"); 63 | return result; 64 | } 65 | 66 | close(pfd); 67 | return 0; 68 | } 69 | -------------------------------------------------------------------------------- /tests/fs_filesystem/jfs: -------------------------------------------------------------------------------- 1 | . -------------------------------------------------------------------------------- /tests/fs_filesystem/vfat: -------------------------------------------------------------------------------- 1 | . -------------------------------------------------------------------------------- /tests/fs_filesystem/xfs: -------------------------------------------------------------------------------- 1 | . -------------------------------------------------------------------------------- /tests/glblub/.gitignore: -------------------------------------------------------------------------------- 1 | default_range 2 | -------------------------------------------------------------------------------- /tests/glblub/Makefile: -------------------------------------------------------------------------------- 1 | TARGETS=default_range 2 | 3 | LDLIBS += -lselinux 4 | 5 | all: $(TARGETS) 6 | clean: 7 | rm -f $(TARGETS) 8 | -------------------------------------------------------------------------------- /tests/glblub/default_range.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include 7 | #include 8 | 9 | void run_test(const char *c1, const char *c2, security_class_t tclass, 10 | const char *exp_con) 11 | { 12 | char *buf = NULL; 13 | int ret; 14 | 15 | ret = security_compute_create(c1, c2, tclass, &buf); 16 | if (ret < 0) { 17 | exit(3); 18 | } 19 | 20 | if (exp_con == NULL && buf == NULL) { 21 | return; 22 | } 23 | 24 | if (exp_con == NULL && buf != NULL) { 25 | fprintf(stderr, "expected NULL, got %s\n", buf); 26 | freecon(buf); 27 | exit(3); 28 | } 29 | 30 | if (exp_con != NULL && buf == NULL) { 31 | fprintf(stderr, "expected %s, got NULL\n", exp_con); 32 | exit(3); 33 | } 34 | 35 | if (strcmp(buf, exp_con)) { 36 | fprintf(stderr, "%s did not match expected %s\n", buf, exp_con); 37 | exit(3); 38 | } 39 | 40 | freecon(buf); 41 | 42 | } 43 | 44 | int main(int argc, const char **argv) 45 | { 46 | security_class_t tclass; 47 | const char *exp_con; 48 | 49 | if (argc != 4 && argc != 5) { 50 | fprintf(stderr, "Usage %s [expected]\n", argv[0]); 51 | exit(1); 52 | } 53 | 54 | if (argc == 4) exp_con = NULL; 55 | else exp_con = argv[4]; 56 | 57 | tclass = string_to_security_class(argv[3]); 58 | if (!tclass) { 59 | fprintf(stderr, "Invalid class '%s'\n", argv[3]); 60 | exit(1); 61 | } 62 | 63 | run_test(argv[1], argv[2], tclass, exp_con); 64 | 65 | exit(EXIT_SUCCESS); 66 | } 67 | -------------------------------------------------------------------------------- /tests/inet_socket/.gitignore: -------------------------------------------------------------------------------- 1 | bind 2 | client 3 | connect 4 | server 5 | -------------------------------------------------------------------------------- /tests/inet_socket/Makefile: -------------------------------------------------------------------------------- 1 | TARGETS=client server bind connect 2 | 3 | LDLIBS+= -lselinux 4 | 5 | all: $(TARGETS) 6 | clean: 7 | rm -f $(TARGETS) flag 8 | -------------------------------------------------------------------------------- /tests/inet_socket/calipso-flush: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | # Reset NetLabel configuration to unlabeled after CALIPSO/IPv6 tests. 3 | netlabelctl map del default 4 | netlabelctl calipso del doi:16 5 | netlabelctl map add default protocol:unlbl 6 | -------------------------------------------------------------------------------- /tests/inet_socket/calipso-load: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | # Define a doi for testing loopback for CALIPSO/IPv6. 3 | netlabelctl calipso add pass doi:16 4 | netlabelctl map del default 5 | netlabelctl map add default address:0.0.0.0/0 protocol:unlbl 6 | netlabelctl map add default address:::/0 protocol:unlbl 7 | netlabelctl map add default address:::1 protocol:calipso,16 8 | -------------------------------------------------------------------------------- /tests/inet_socket/cipso-fl-flush: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | # Reset NetLabel configuration to unlabeled for all. 3 | netlabelctl map del default 4 | netlabelctl cipsov4 del doi:1 5 | netlabelctl map add default protocol:unlbl 6 | -------------------------------------------------------------------------------- /tests/inet_socket/cipso-fl-load: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | # Based on http://paulmoore.livejournal.com/7234.html. 3 | # 4 | # Modifications: 5 | # - Only defined the local doi since we are only testing loopback and 6 | # since NetLabel only supports full labeling over loopback (NetLabel 7 | # CIPSOv4 only supports passing MLS labels across the network). 8 | 9 | # Define a localhost/loopback doi and apply it to the loopback address 10 | # so that we get full SELinux labels over IPv4 loopback connections. 11 | netlabelctl cipsov4 add local doi:1 12 | netlabelctl map del default 13 | netlabelctl map add default address:0.0.0.0/0 protocol:unlbl 14 | netlabelctl map add default address:::/0 protocol:unlbl 15 | netlabelctl map add default address:127.0.0.1 protocol:cipsov4,1 16 | -------------------------------------------------------------------------------- /tests/inet_socket/cipso-flush: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | # Reset NetLabel configuration to unlabeled for all. 3 | netlabelctl map del default 4 | netlabelctl cipsov4 del doi:16 5 | netlabelctl map add default protocol:unlbl 6 | -------------------------------------------------------------------------------- /tests/inet_socket/cipso-load-t1: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | # Based on http://paulmoore.livejournal.com/7234.html. 3 | # 4 | # Modifications: 5 | # - Defined a doi for testing loopback for CIPSOv4. 6 | 7 | netlabelctl cipsov4 add pass doi:16 tags:1 8 | netlabelctl map del default 9 | netlabelctl map add default address:0.0.0.0/0 protocol:unlbl 10 | netlabelctl map add default address:::/0 protocol:unlbl 11 | netlabelctl map add default address:127.0.0.1 protocol:cipsov4,16 12 | -------------------------------------------------------------------------------- /tests/inet_socket/cipso-load-t2: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | # Based on http://paulmoore.livejournal.com/7234.html. 3 | # 4 | # Modifications: 5 | # - Defined a doi for testing loopback for CIPSOv4. 6 | 7 | netlabelctl cipsov4 add pass doi:16 tags:2 8 | netlabelctl map del default 9 | netlabelctl map add default address:0.0.0.0/0 protocol:unlbl 10 | netlabelctl map add default address:::/0 protocol:unlbl 11 | netlabelctl map add default address:127.0.0.1 protocol:cipsov4,16 12 | -------------------------------------------------------------------------------- /tests/inet_socket/cipso-load-t5: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | # Based on http://paulmoore.livejournal.com/7234.html. 3 | # 4 | # Modifications: 5 | # - Defined a doi for testing loopback for CIPSOv4. 6 | 7 | netlabelctl cipsov4 add pass doi:16 tags:5 8 | netlabelctl map del default 9 | netlabelctl map add default address:0.0.0.0/0 protocol:unlbl 10 | netlabelctl map add default address:::/0 protocol:unlbl 11 | netlabelctl map add default address:127.0.0.1 protocol:cipsov4,16 12 | -------------------------------------------------------------------------------- /tests/inet_socket/ipsec-flush: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | echo 1 > /proc/sys/net/ipv4/conf/lo/disable_xfrm 3 | echo 1 > /proc/sys/net/ipv4/conf/lo/disable_policy 4 | ip xfrm policy deleteall 5 | ip xfrm policy flush 6 | ip xfrm state flush 7 | -------------------------------------------------------------------------------- /tests/inet_socket/ipsec-load: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | echo 0 > /proc/sys/net/ipv4/conf/lo/disable_xfrm 3 | echo 0 > /proc/sys/net/ipv4/conf/lo/disable_policy 4 | ip xfrm policy flush 5 | ip xfrm state flush 6 | goodclientcon=`secon -u --pid $$`:`secon -r --pid $$`:test_inet_client_t:`secon -m --pid $$` 7 | badclientcon=`secon -u --pid $$`:`secon -r --pid $$`:test_inet_bad_client_t:`secon -m --pid $$` 8 | ip xfrm state add src 127.0.0.1 dst 127.0.0.1 proto ah spi 0x200 ctx $goodclientcon auth sha1 0123456789012345 9 | ip xfrm state add src 127.0.0.1 dst 127.0.0.1 proto ah spi 0x250 ctx $badclientcon auth sha1 0123456789012345 10 | ip xfrm policy add src 127.0.0.1 dst 127.0.0.1 proto tcp dir out ctx "system_u:object_r:test_spd_t:s0" tmpl proto ah mode transport level required 11 | ip xfrm policy add src 127.0.0.1 dst 127.0.0.1 proto udp dir out ctx "system_u:object_r:test_spd_t:s0" tmpl proto ah mode transport level required 12 | 13 | # IPv6 loopback 14 | ip xfrm state add src ::1 dst ::1 proto ah spi 0x200 ctx $goodclientcon auth sha1 0123456789012345 15 | ip xfrm state add src ::1 dst ::1 proto ah spi 0x250 ctx $badclientcon auth sha1 0123456789012345 16 | ip xfrm policy add src ::1 dst ::1 proto tcp dir out ctx "system_u:object_r:test_spd_t:s0" tmpl proto ah mode transport level required 17 | ip xfrm policy add src ::1 dst ::1 proto udp dir out ctx "system_u:object_r:test_spd_t:s0" tmpl proto ah mode transport level required 18 | -------------------------------------------------------------------------------- /tests/inet_socket/iptables-flush: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | # Flush the security table. 3 | iptables -t security -F 4 | iptables -t security -X NEWCONN 5 | ip6tables -t security -F 6 | ip6tables -t security -X NEWCONN 7 | -------------------------------------------------------------------------------- /tests/inet_socket/mptcp: -------------------------------------------------------------------------------- 1 | . -------------------------------------------------------------------------------- /tests/inet_socket/nftables-flush: -------------------------------------------------------------------------------- 1 | delete table ip security 2 | delete table ip6 security 3 | -------------------------------------------------------------------------------- /tests/inet_socket/tcp: -------------------------------------------------------------------------------- 1 | . -------------------------------------------------------------------------------- /tests/inet_socket/udp: -------------------------------------------------------------------------------- 1 | . -------------------------------------------------------------------------------- /tests/infiniband_endport/Makefile: -------------------------------------------------------------------------------- 1 | all: 2 | clean: 3 | -------------------------------------------------------------------------------- /tests/infiniband_endport/ibendport_test.conf: -------------------------------------------------------------------------------- 1 | # InfiniBand endport test configuration file 2 | 3 | # The InfiniBand devices can be determined by inspecting the 4 | # /sys/class/infiniband directory and the ports for a given device can be 5 | # found by inspecting the /sys/class/infiniband//ports directory. 6 | 7 | # Enable(1)/Disable(0) these tests. 8 | SELINUX_INFINIBAND_ENDPORT_TEST=0 9 | 10 | # Device/port pair that should allow access. 11 | # The test uses semanage to allow, because ibendports are all unlabeled by 12 | # default the reference policy. This allows using the same device and port for 13 | # both the pass and fail testing as well. 14 | SELINUX_INFINIBAND_ENDPORT_TEST_ALLOWED=mlx5_3 1 15 | 16 | # Device/port pairs that should deny access. 17 | SELINUX_INFINIBAND_ENDPORT_TEST_DENIED=mlx5_2 1 18 | 19 | -------------------------------------------------------------------------------- /tests/infiniband_pkey/.gitignore: -------------------------------------------------------------------------------- 1 | create_modify_qp 2 | -------------------------------------------------------------------------------- /tests/infiniband_pkey/Makefile: -------------------------------------------------------------------------------- 1 | TARGETS=create_modify_qp 2 | 3 | LDLIBS+= -libverbs 4 | 5 | all: $(TARGETS) 6 | 7 | clean: 8 | rm -f $(TARGETS) 9 | -------------------------------------------------------------------------------- /tests/infiniband_pkey/ibpkey_test.conf: -------------------------------------------------------------------------------- 1 | # InfiniBand PKey test configuration file 2 | 3 | # The InfiniBand devices can be determined by inspecting the 4 | # /sys/class/infiniband directory and the ports for a given device can be 5 | # found by inspecting the /sys/class/infiniband//ports directory. 6 | 7 | # Enable(1)/Disable(0) these tests 8 | SELINUX_INFINIBAND_PKEY_TEST=0 9 | 10 | # InfiniBand device to use. 11 | SELINUX_INFINIBAND_PKEY_TEST_DEV=mlx5_3 12 | 13 | # Physical port on the device to use. 14 | SELINUX_INFINIBAND_PKEY_TEST_PORT=1 15 | 16 | # CSV list of pkey table indexes containing labeled PKeys. 17 | # These will not be allowed. 18 | SELINUX_INFINIBAND_TEST_LABELED_PKEYS= 19 | 20 | # CSV list of pkey table indexes containing unlabeled PKeys. 21 | # This will be allowed, then temporarily labeled to see that they are 22 | # disallowed. 23 | SELINUX_INFINIBAND_TEST_UNLABELED_PKEYS=0 24 | 25 | -------------------------------------------------------------------------------- /tests/inherit/.gitignore: -------------------------------------------------------------------------------- 1 | child 2 | parent 3 | -------------------------------------------------------------------------------- /tests/inherit/Makefile: -------------------------------------------------------------------------------- 1 | TARGETS=child parent 2 | 3 | LDLIBS += -lselinux 4 | 5 | all: $(TARGETS) 6 | clean: 7 | rm -f $(TARGETS) test_file 8 | -------------------------------------------------------------------------------- /tests/inherit/child.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | 7 | int main(int argc, char **argv) 8 | { 9 | char buf[255]; 10 | ssize_t bytes; 11 | int fd, ret; 12 | struct stat sb; 13 | 14 | if (argc != 2) { 15 | fprintf(stderr, "usage: %s fd\n", argv[0]); 16 | exit(-1); 17 | } 18 | 19 | fd = atoi(argv[1]); 20 | 21 | ret = fstat(fd, &sb); 22 | if (ret < 0) { 23 | perror("fstat"); 24 | exit(2); 25 | } 26 | if (sb.st_rdev == 0x103 /* /dev/null */) { 27 | fprintf(stderr, "%s: null device\n", argv[0]); 28 | exit(1); 29 | } 30 | 31 | strcpy(buf, "hello world!\n"); 32 | bytes = write(fd, buf, strlen(buf)); 33 | if (bytes < 0) { 34 | perror("write"); 35 | exit(1); 36 | } 37 | exit(0); 38 | } 39 | -------------------------------------------------------------------------------- /tests/inherit/test: -------------------------------------------------------------------------------- 1 | #!/usr/bin/perl 2 | 3 | use Test; 4 | BEGIN { plan tests => 3 } 5 | 6 | $basedir = $0; 7 | $basedir =~ s|(.*)/[^/]*|$1|; 8 | 9 | # Remove any leftover test file from prior failed runs. 10 | system("rm -rf $basedir/test_file"); 11 | 12 | # Create a test file with the test_inherit_file_t type for use in the tests. 13 | system("touch $basedir/test_file"); 14 | system("chcon -t test_inherit_file_t $basedir/test_file"); 15 | 16 | # Verify that test_inherit_nouse_t cannot inherit the rw fd to the test_file 17 | # from test_inherit_parent_t. 18 | # Should fail on fd use permission. 19 | $result = system( 20 | "runcon -t test_inherit_parent_t -- $basedir/parent test_inherit_nouse_t $basedir/test_file $basedir/child 2>&1" 21 | ); 22 | ok($result); # we expect this to fail. 23 | 24 | # Verify that test_inherit_nowrite_t cannot inherit the rw fd to the test_file 25 | # from test_inherit_parent_t. 26 | # Should fail on file write permission. 27 | $result = system( 28 | "runcon -t test_inherit_parent_t -- $basedir/parent test_inherit_nowrite_t $basedir/test_file $basedir/child 2>&1" 29 | ); 30 | ok($result); # we expect this to fail. 31 | 32 | # Verify that test_inherit_child_t can inherit the rw fd to the test file 33 | # from test_inherit_parent_t. 34 | $result = system( 35 | "runcon -t test_inherit_parent_t -- $basedir/parent test_inherit_child_t $basedir/test_file $basedir/child 2>&1" 36 | ); 37 | ok( $result, 0 ); 38 | 39 | # Cleanup. 40 | system("rm -rf $basedir/test_file"); 41 | -------------------------------------------------------------------------------- /tests/ioctl/.gitignore: -------------------------------------------------------------------------------- 1 | test_ioctl 2 | test_noioctl 3 | test_siocgifindex 4 | test_siocgifname 5 | -------------------------------------------------------------------------------- /tests/ioctl/Makefile: -------------------------------------------------------------------------------- 1 | TARGETS=$(patsubst %.c,%,$(wildcard *.c)) 2 | all: $(TARGETS) 3 | clean: 4 | rm -f $(TARGETS) temp_file 5 | -------------------------------------------------------------------------------- /tests/ioctl/test_siocgifindex.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include 7 | #include 8 | #include 9 | #include 10 | 11 | int main(int argc, char **argv) 12 | { 13 | int sock; 14 | int rc; 15 | struct ifreq val = {}; 16 | 17 | sock = socket(AF_INET, SOCK_DGRAM, 0); 18 | if(sock == -1) { 19 | perror("test_siocgifindex:open"); 20 | exit(1); 21 | } 22 | 23 | rc = ioctl(sock, SIOCGIFINDEX, &val); 24 | if (rc < 0 && errno != ENODEV) { 25 | perror("test_siocgifindex:SIOCGIFINDEX"); 26 | close(sock); 27 | exit(7); 28 | } 29 | 30 | close(sock); 31 | exit(0); 32 | } 33 | -------------------------------------------------------------------------------- /tests/ioctl/test_siocgifname.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include 7 | #include 8 | #include 9 | #include 10 | 11 | int main(int argc, char **argv) 12 | { 13 | int sock; 14 | int rc; 15 | struct ifreq val = {}; 16 | 17 | sock = socket(AF_INET, SOCK_DGRAM, 0); 18 | if(sock == -1) { 19 | perror("test_siocgifname:socket"); 20 | exit(1); 21 | } 22 | 23 | rc = ioctl(sock, SIOCGIFNAME, &val); 24 | if (rc < 0 && errno != ENODEV) { 25 | perror("test_siocgifname:SIOCGIFNAME"); 26 | close(sock); 27 | exit(7); 28 | } 29 | 30 | close(sock); 31 | exit(0); 32 | } 33 | -------------------------------------------------------------------------------- /tests/key_socket/.gitignore: -------------------------------------------------------------------------------- 1 | key_sock 2 | -------------------------------------------------------------------------------- /tests/key_socket/Makefile: -------------------------------------------------------------------------------- 1 | TARGETS = key_sock 2 | LDLIBS += -lselinux 3 | 4 | all: $(TARGETS) 5 | 6 | clean: 7 | rm -f $(TARGETS) 8 | -------------------------------------------------------------------------------- /tests/key_socket/test: -------------------------------------------------------------------------------- 1 | #!/usr/bin/perl 2 | use Test::More; 3 | 4 | BEGIN { 5 | $basedir = $0; 6 | $basedir =~ s|(.*)/[^/]*|$1|; 7 | 8 | # allow info to be shown during tests 9 | $v = $ARGV[0]; 10 | if ($v) { 11 | if ( $v ne "-v" ) { 12 | plan skip_all => "Invalid option (use -v)"; 13 | } 14 | } 15 | else { 16 | $v = " "; 17 | } 18 | 19 | $result = system "$basedir/key_sock $v 2>&1"; 20 | if ( $result >> 8 eq 97 ) { # EAFNOSUPPORT 21 | plan skip_all => "PF_KEY not supported by kernel"; 22 | } 23 | else { 24 | plan tests => 5; 25 | } 26 | } 27 | 28 | ############ Test key_socket ############# 29 | print "Test key management key_socket\n"; 30 | $result = system "runcon -t test_key_sock_t $basedir/key_sock $v"; 31 | ok( $result eq 0 ); 32 | 33 | # Deny capability { net_admin } - EPERM 34 | $result = 35 | system "runcon -t test_key_sock_no_net_admin_t $basedir/key_sock $v 2>&1"; 36 | ok( $result >> 8 eq 1 ); 37 | 38 | # Deny key_socket { create } - EACCES 39 | $result = 40 | system "runcon -t test_key_sock_no_create_t $basedir/key_sock $v 2>&1"; 41 | ok( $result >> 8 eq 13 ); 42 | 43 | # Deny key_socket { write } - EACCES 44 | $result = system "runcon -t test_key_sock_no_write_t $basedir/key_sock $v 2>&1"; 45 | ok( $result >> 8 eq 13 ); 46 | 47 | # Deny key_socket { read } - EACCES 48 | $result = system "runcon -t test_key_sock_no_read_t $basedir/key_sock $v 2>&1"; 49 | ok( $result >> 8 eq 13 ); 50 | 51 | exit; 52 | -------------------------------------------------------------------------------- /tests/keys/.gitignore: -------------------------------------------------------------------------------- 1 | keyctl 2 | keyctl_relabel 3 | keyring_service 4 | request_keys 5 | -------------------------------------------------------------------------------- /tests/keys/Makefile: -------------------------------------------------------------------------------- 1 | TARGETS = keyctl keyctl_relabel keyring_service request_keys 2 | LDLIBS += -lselinux -lkeyutils 3 | 4 | $(TARGETS): keys_common.h 5 | 6 | all: $(TARGETS) 7 | 8 | clean: 9 | rm -f $(TARGETS) 10 | -------------------------------------------------------------------------------- /tests/kvercmp: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | function kvercmp() 4 | { 5 | ver1=`echo $1 | sed 's/-/./'` 6 | ver2=`echo $2 | sed 's/-/./'` 7 | 8 | ret=0 9 | i=1 10 | while [ 1 ]; do 11 | digit1=`echo $ver1 | cut -d . -f $i` 12 | digit2=`echo $ver2 | cut -d . -f $i` 13 | 14 | if [ -z "$digit1" ]; then 15 | if [ -z "$digit2" ]; then 16 | ret=0 17 | break 18 | else 19 | ret=-1 20 | break 21 | fi 22 | fi 23 | 24 | if [ -z "$digit2" ]; then 25 | ret=1 26 | break 27 | fi 28 | 29 | if [ "$digit1" != "$digit2" ]; then 30 | if [ "$digit1" -lt "$digit2" ]; then 31 | ret=-1 32 | break 33 | fi 34 | ret=1 35 | break 36 | fi 37 | 38 | i=$((i+1)) 39 | done 40 | echo $ret 41 | } 42 | 43 | kvercmp "$1" "$2" 44 | -------------------------------------------------------------------------------- /tests/link/Makefile: -------------------------------------------------------------------------------- 1 | all: 2 | clean: 3 | rm -rf test_dir 4 | -------------------------------------------------------------------------------- /tests/loop.pl: -------------------------------------------------------------------------------- 1 | #!/usr/bin/perl 2 | 3 | $count = shift || 1; 4 | 5 | print "Running all tests $count times\n"; 6 | 7 | for ( $i = 0 ; $i < $count ; $i++ ) { 8 | print "$i: "; 9 | $foo = `./runtests.pl`; 10 | if ( $foo =~ m|All tests successful.\n| ) { 11 | print $'; 12 | } 13 | else { 14 | print "Tests Failed: $'\n"; 15 | } 16 | } 17 | -------------------------------------------------------------------------------- /tests/mac_admin/Makefile: -------------------------------------------------------------------------------- 1 | all: 2 | clean: 3 | rm -rf test_dir test_file 4 | -------------------------------------------------------------------------------- /tests/mkdir/Makefile: -------------------------------------------------------------------------------- 1 | all: 2 | clean: 3 | rm -rf test_dir 4 | -------------------------------------------------------------------------------- /tests/mmap/.gitignore: -------------------------------------------------------------------------------- 1 | mmap_anon_private 2 | mmap_anon_shared 3 | mmap_file_private 4 | mmap_file_shared 5 | mmap_hugetlb_anon_private 6 | mmap_hugetlb_anon_shared 7 | mmap_zero 8 | mprotect_anon_private 9 | mprotect_anon_shared 10 | mprotect_file_private_execmod 11 | mprotect_file_private_rwx 12 | mprotect_file_private_rx 13 | mprotect_file_shared 14 | mprotect_heap 15 | mprotect_hugetlb_anon_private 16 | mprotect_hugetlb_anon_shared 17 | mprotect_stack 18 | mprotect_stack_thread 19 | shmat 20 | -------------------------------------------------------------------------------- /tests/mmap/Makefile: -------------------------------------------------------------------------------- 1 | TARGETS=$(patsubst %.c,%,$(wildcard *.c)) 2 | 3 | LDLIBS += -lpthread 4 | 5 | all: $(TARGETS) 6 | 7 | clean: 8 | rm -f $(TARGETS) temp_file 9 | -------------------------------------------------------------------------------- /tests/mmap/mmap_anon_private.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | 7 | int main(void) 8 | { 9 | char *ptr; 10 | 11 | ptr = mmap(NULL, 4096, PROT_READ | PROT_WRITE | PROT_EXEC, 12 | MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); 13 | if (ptr == MAP_FAILED) { 14 | perror("mmap"); 15 | exit(1); 16 | } 17 | exit(0); 18 | } 19 | 20 | -------------------------------------------------------------------------------- /tests/mmap/mmap_anon_shared.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | 7 | int main(void) 8 | { 9 | char *ptr; 10 | 11 | ptr = mmap(NULL, 4096, PROT_READ | PROT_WRITE | PROT_EXEC, 12 | MAP_SHARED | MAP_ANONYMOUS, -1, 0); 13 | if (ptr == MAP_FAILED) { 14 | perror("mmap"); 15 | exit(1); 16 | } 17 | exit(0); 18 | } 19 | 20 | -------------------------------------------------------------------------------- /tests/mmap/mmap_file_private.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include 7 | 8 | int main(int argc, char **argv) 9 | { 10 | char *ptr; 11 | int fd; 12 | 13 | if (argc != 2) { 14 | fprintf(stderr, "usage: %s file\n", argv[0]); 15 | exit(1); 16 | } 17 | 18 | fd = open(argv[1], O_RDONLY); 19 | if (fd < 0) { 20 | perror(argv[1]); 21 | exit(1); 22 | } 23 | 24 | ptr = mmap(NULL, 4096, PROT_READ | PROT_WRITE | PROT_EXEC, 25 | MAP_PRIVATE, fd, 0); 26 | if (ptr == MAP_FAILED) { 27 | perror("mmap"); 28 | close(fd); 29 | exit(1); 30 | } 31 | close(fd); 32 | exit(0); 33 | } 34 | 35 | -------------------------------------------------------------------------------- /tests/mmap/mmap_file_shared.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include 7 | #include 8 | 9 | void usage(const char *progname) 10 | { 11 | fprintf(stderr, "usage: %s [-r] file\n", progname); 12 | exit(1); 13 | } 14 | 15 | int main(int argc, char **argv) 16 | { 17 | char *ptr; 18 | int fd, opt, prot = PROT_READ | PROT_WRITE | PROT_EXEC; 19 | 20 | while ((opt = getopt(argc, argv, "r")) != -1) { 21 | switch (opt) { 22 | case 'r': 23 | if (personality(READ_IMPLIES_EXEC) == -1) { 24 | perror("personality"); 25 | exit(1); 26 | } 27 | prot &= ~PROT_EXEC; 28 | break; 29 | default: 30 | usage(argv[0]); 31 | break; 32 | } 33 | } 34 | 35 | if ((argc - optind) != 1) 36 | usage(argv[0]); 37 | 38 | fd = open(argv[optind], O_RDWR); 39 | if (fd < 0) { 40 | perror(argv[optind]); 41 | exit(1); 42 | } 43 | 44 | ptr = mmap(NULL, 4096, prot, MAP_SHARED, fd, 0); 45 | if (ptr == MAP_FAILED) { 46 | perror("mmap"); 47 | close(fd); 48 | exit(1); 49 | } 50 | close(fd); 51 | exit(0); 52 | } 53 | 54 | -------------------------------------------------------------------------------- /tests/mmap/mmap_hugetlb_anon_private.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include "utils.h" 7 | 8 | #ifndef MAP_HUGETLB 9 | # define MAP_HUGETLB 0x40000 10 | #endif 11 | 12 | int main(void) 13 | { 14 | char *ptr; 15 | long length = getdefaulthugesize(); 16 | 17 | ptr = mmap(NULL, length, PROT_READ | PROT_WRITE | PROT_EXEC, 18 | MAP_PRIVATE | MAP_ANONYMOUS | MAP_HUGETLB, -1, 0); 19 | if (ptr == MAP_FAILED) { 20 | perror("mmap"); 21 | exit(1); 22 | } 23 | exit(0); 24 | } 25 | -------------------------------------------------------------------------------- /tests/mmap/mmap_hugetlb_anon_shared.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include "utils.h" 7 | 8 | #ifndef MAP_HUGETLB 9 | # define MAP_HUGETLB 0x40000 10 | #endif 11 | 12 | int main(void) 13 | { 14 | char *ptr; 15 | long length = getdefaulthugesize(); 16 | 17 | ptr = mmap(NULL, length, PROT_READ | PROT_WRITE | PROT_EXEC, 18 | MAP_SHARED | MAP_ANONYMOUS | MAP_HUGETLB, -1, 0); 19 | if (ptr == MAP_FAILED) { 20 | perror("mmap"); 21 | exit(1); 22 | } 23 | exit(0); 24 | } 25 | -------------------------------------------------------------------------------- /tests/mmap/mmap_zero.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | 7 | int main(void) 8 | { 9 | char *ptr; 10 | 11 | ptr = mmap(0, 4096, PROT_READ | PROT_WRITE, 12 | MAP_PRIVATE | MAP_ANONYMOUS | MAP_FIXED, -1, 0); 13 | if (ptr == MAP_FAILED) { 14 | perror("mmap"); 15 | exit(1); 16 | } 17 | exit(0); 18 | } 19 | 20 | -------------------------------------------------------------------------------- /tests/mmap/mprotect_anon_private.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | 7 | int main(void) 8 | { 9 | char *ptr; 10 | int rc; 11 | 12 | ptr = mmap(NULL, 4096, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 13 | 0); 14 | if (ptr == MAP_FAILED) { 15 | perror("mmap"); 16 | exit(1); 17 | } 18 | 19 | rc = mprotect(ptr, 4096, PROT_READ | PROT_EXEC); 20 | if (rc < 0) { 21 | perror("mprotect"); 22 | exit(1); 23 | } 24 | exit(0); 25 | } 26 | 27 | -------------------------------------------------------------------------------- /tests/mmap/mprotect_anon_shared.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | 7 | int main(void) 8 | { 9 | char *ptr; 10 | int rc; 11 | 12 | ptr = mmap(NULL, 4096, PROT_READ | PROT_WRITE, MAP_SHARED | MAP_ANONYMOUS, -1, 13 | 0); 14 | if (ptr == MAP_FAILED) { 15 | perror("mmap"); 16 | exit(1); 17 | } 18 | 19 | rc = mprotect(ptr, 4096, PROT_READ | PROT_EXEC); 20 | if (rc < 0) { 21 | perror("mprotect"); 22 | exit(1); 23 | } 24 | exit(0); 25 | } 26 | 27 | -------------------------------------------------------------------------------- /tests/mmap/mprotect_file_private_execmod.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include 7 | #include 8 | 9 | #ifndef READ_IMPLIES_EXEC 10 | #define READ_IMPLIES_EXEC 0x0400000 11 | #endif 12 | 13 | int main(int argc, char **argv) 14 | { 15 | char *ptr; 16 | int rc; 17 | int fd; 18 | 19 | if (argc != 2) { 20 | fprintf(stderr, "usage: %s file\n", argv[0]); 21 | exit(1); 22 | } 23 | 24 | /* clear READ_IMPLIES_EXEC if present, because it skips 25 | * check for FILE__EXECMOD in selinux_file_mprotect() */ 26 | rc = personality(0xffffffff); 27 | if ((rc != -1) && (rc & READ_IMPLIES_EXEC)) { 28 | rc &= ~READ_IMPLIES_EXEC; 29 | personality(rc); 30 | } 31 | 32 | fd = open(argv[1], O_RDONLY); 33 | if (fd < 0) { 34 | perror(argv[1]); 35 | exit(1); 36 | } 37 | 38 | ptr = mmap(NULL, 4096, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 39 | 0); 40 | if (ptr == MAP_FAILED) { 41 | perror("mmap"); 42 | exit(1); 43 | } 44 | 45 | *((char *)ptr) = 42; 46 | 47 | rc = mprotect(ptr, 4096, PROT_READ | PROT_EXEC); 48 | if (rc < 0) { 49 | perror("mprotect"); 50 | exit(1); 51 | } 52 | exit(0); 53 | } 54 | 55 | -------------------------------------------------------------------------------- /tests/mmap/mprotect_file_private_rwx.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include 7 | 8 | int main(int argc, char **argv) 9 | { 10 | char *ptr; 11 | int rc; 12 | int fd; 13 | 14 | if (argc != 2) { 15 | fprintf(stderr, "usage: %s file\n", argv[0]); 16 | exit(1); 17 | } 18 | 19 | fd = open(argv[1], O_RDONLY); 20 | if (fd < 0) { 21 | perror(argv[1]); 22 | exit(1); 23 | } 24 | 25 | ptr = mmap(NULL, 4096, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 26 | 0); 27 | if (ptr == MAP_FAILED) { 28 | perror("mmap"); 29 | exit(1); 30 | } 31 | 32 | rc = mprotect(ptr, 4096, PROT_READ | PROT_WRITE | PROT_EXEC); 33 | if (rc < 0) { 34 | perror("mprotect"); 35 | exit(1); 36 | } 37 | exit(0); 38 | } 39 | 40 | -------------------------------------------------------------------------------- /tests/mmap/mprotect_file_private_rx.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include 7 | 8 | int main(int argc, char **argv) 9 | { 10 | char *ptr; 11 | int rc; 12 | int fd; 13 | 14 | if (argc != 2) { 15 | fprintf(stderr, "usage: %s file\n", argv[0]); 16 | exit(1); 17 | } 18 | 19 | fd = open(argv[1], O_RDONLY); 20 | if (fd < 0) { 21 | perror(argv[1]); 22 | exit(1); 23 | } 24 | 25 | ptr = mmap(NULL, 4096, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 26 | 0); 27 | if (ptr == MAP_FAILED) { 28 | perror("mmap"); 29 | exit(1); 30 | } 31 | 32 | rc = mprotect(ptr, 4096, PROT_READ | PROT_EXEC); 33 | if (rc < 0) { 34 | perror("mprotect"); 35 | exit(1); 36 | } 37 | exit(0); 38 | } 39 | 40 | -------------------------------------------------------------------------------- /tests/mmap/mprotect_file_shared.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include 7 | 8 | int main(int argc, char **argv) 9 | { 10 | char *ptr; 11 | int rc; 12 | int fd; 13 | 14 | if (argc != 2) { 15 | fprintf(stderr, "usage: %s file\n", argv[0]); 16 | exit(1); 17 | } 18 | 19 | fd = open(argv[1], O_RDWR); 20 | if (fd < 0) { 21 | perror(argv[1]); 22 | exit(1); 23 | } 24 | 25 | ptr = mmap(NULL, 4096, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 26 | 0); 27 | if (ptr == MAP_FAILED) { 28 | perror("mmap"); 29 | exit(1); 30 | } 31 | 32 | rc = mprotect(ptr, 4096, PROT_READ | PROT_EXEC); 33 | if (rc < 0) { 34 | perror("mprotect"); 35 | exit(1); 36 | } 37 | exit(0); 38 | } 39 | 40 | -------------------------------------------------------------------------------- /tests/mmap/mprotect_heap.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include 7 | 8 | #ifndef DEFAULT_MMAP_THRESHOLD_MAX 9 | #define DEFAULT_MMAP_THRESHOLD_MAX 512*1024 10 | #endif 11 | 12 | int main(void) 13 | { 14 | void *ptr; 15 | int rc; 16 | int pagesize = getpagesize(); 17 | 18 | rc = mallopt(M_MMAP_THRESHOLD, DEFAULT_MMAP_THRESHOLD_MAX); 19 | if (rc != 1) { 20 | fprintf(stderr, "mallopt failed: %d\n", rc); 21 | exit(1); 22 | } 23 | 24 | rc = posix_memalign(&ptr, pagesize, pagesize); 25 | if (rc) { 26 | fprintf(stderr, "posix_memalign failed: %d\n", rc); 27 | exit(1); 28 | } 29 | 30 | rc = mprotect(ptr, pagesize, PROT_READ | PROT_EXEC); 31 | if (rc < 0) { 32 | perror("mprotect"); 33 | exit(1); 34 | } 35 | exit(0); 36 | } 37 | 38 | -------------------------------------------------------------------------------- /tests/mmap/mprotect_hugetlb_anon_private.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include "utils.h" 7 | 8 | #ifndef MAP_HUGETLB 9 | # define MAP_HUGETLB 0x40000 10 | #endif 11 | 12 | int main(void) 13 | { 14 | char *ptr; 15 | int rc; 16 | long length = getdefaulthugesize(); 17 | 18 | ptr = mmap(NULL, length, PROT_READ | PROT_WRITE, 19 | MAP_PRIVATE | MAP_ANONYMOUS | MAP_HUGETLB, -1, 20 | 0); 21 | if (ptr == MAP_FAILED) { 22 | perror("mmap"); 23 | exit(1); 24 | } 25 | 26 | rc = mprotect(ptr, length, PROT_READ | PROT_EXEC); 27 | if (rc < 0) { 28 | perror("mprotect"); 29 | exit(1); 30 | } 31 | exit(0); 32 | } 33 | -------------------------------------------------------------------------------- /tests/mmap/mprotect_hugetlb_anon_shared.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include "utils.h" 7 | 8 | #ifndef MAP_HUGETLB 9 | # define MAP_HUGETLB 0x40000 10 | #endif 11 | 12 | int main(void) 13 | { 14 | char *ptr; 15 | int rc; 16 | long length = getdefaulthugesize(); 17 | 18 | ptr = mmap(NULL, length, PROT_READ | PROT_WRITE, 19 | MAP_SHARED | MAP_ANONYMOUS | MAP_HUGETLB, -1, 20 | 0); 21 | if (ptr == MAP_FAILED) { 22 | perror("mmap"); 23 | exit(1); 24 | } 25 | 26 | rc = mprotect(ptr, length, PROT_READ | PROT_EXEC); 27 | if (rc < 0) { 28 | perror("mprotect"); 29 | exit(1); 30 | } 31 | exit(0); 32 | } 33 | -------------------------------------------------------------------------------- /tests/mmap/mprotect_stack.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include 7 | 8 | void usage(const char *progname) 9 | { 10 | fprintf(stderr, "usage: %s [-r]\n", progname); 11 | exit(1); 12 | } 13 | 14 | int main(int argc, char **argv) 15 | { 16 | char buf[4096]; 17 | int rc, opt, prot = PROT_READ | PROT_WRITE | PROT_EXEC; 18 | void *ptr; 19 | long pagesize = sysconf(_SC_PAGESIZE); 20 | 21 | while ((opt = getopt(argc, argv, "r")) != -1) { 22 | switch (opt) { 23 | case 'r': 24 | if (personality(READ_IMPLIES_EXEC) == -1) { 25 | perror("personality"); 26 | exit(1); 27 | } 28 | prot &= ~PROT_EXEC; 29 | break; 30 | default: 31 | usage(argv[0]); 32 | break; 33 | } 34 | } 35 | 36 | ptr = (void *) (((unsigned long) buf) & ~(pagesize - 1)); 37 | 38 | rc = mprotect(ptr, pagesize, prot); 39 | if (rc < 0) { 40 | perror("mprotect"); 41 | exit(1); 42 | } 43 | exit(0); 44 | } 45 | 46 | -------------------------------------------------------------------------------- /tests/mmap/mprotect_stack_thread.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include 7 | #include 8 | #include 9 | #include 10 | 11 | static void *test_thread(void *p) 12 | { 13 | char buf[4096]; 14 | int rc; 15 | void *ptr; 16 | long pagesize = sysconf(_SC_PAGESIZE); 17 | 18 | ptr = (void *) (((unsigned long) buf) & ~(pagesize - 1)); 19 | 20 | rc = mprotect(ptr, pagesize, PROT_READ | PROT_WRITE | PROT_EXEC); 21 | if (rc < 0) { 22 | perror("mprotect"); 23 | exit(1); 24 | } 25 | return NULL; 26 | } 27 | 28 | int main(int argc, char **argv) 29 | { 30 | struct utsname uts; 31 | pthread_t thread; 32 | 33 | if (argc != 2) { 34 | fprintf(stderr, "usage: %s [pass|fail]\n", argv[0]); 35 | exit(1); 36 | } 37 | 38 | if (strcmp(argv[1], "pass") && strcmp(argv[1], "fail")) { 39 | fprintf(stderr, "usage: %s [pass|fail]\n", argv[0]); 40 | exit(1); 41 | } 42 | 43 | if (uname(&uts) < 0) { 44 | perror("uname"); 45 | exit(1); 46 | } 47 | 48 | if (!strcmp(argv[1], "fail") && strverscmp(uts.release, "4.7") < 0) { 49 | printf("%s: Kernels < 4.7 do not check execstack on thread stacks, skipping.\n", 50 | argv[0]); 51 | /* pass the test by failing as if it was denied */ 52 | exit(1); 53 | } 54 | 55 | pthread_create(&thread, NULL, test_thread, NULL); 56 | pthread_join(thread, NULL); 57 | exit(0); 58 | } 59 | 60 | -------------------------------------------------------------------------------- /tests/mmap/shmat.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | 7 | int main(void) 8 | { 9 | int shmid, rc = 0; 10 | char *execmem; 11 | 12 | shmid = shmget(IPC_PRIVATE, 4096, IPC_CREAT | 0777); 13 | if (shmid < 0) { 14 | perror("shmget"); 15 | exit(1); 16 | } 17 | execmem = shmat(shmid, 0, SHM_EXEC); 18 | if (execmem == ((void *) - 1)) { 19 | perror("shmat SHM_EXEC"); 20 | rc = 1; 21 | } else { 22 | shmdt(execmem); 23 | } 24 | shmctl(shmid, IPC_RMID, 0); 25 | exit(rc); 26 | } 27 | -------------------------------------------------------------------------------- /tests/mmap/utils.h: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include 7 | 8 | #define MEMINFO "/proc/meminfo" 9 | #define MEMINFO_SIZE 2048 10 | #define ERROR printf 11 | 12 | /* taken from libhugetlbfs library */ 13 | 14 | /* 15 | * Read numeric data from raw and tagged kernel status files. Used to read 16 | * /proc and /sys data (without a tag) and from /proc/meminfo (with a tag). 17 | */ 18 | long file_read_ulong(char *file, const char *tag) 19 | { 20 | int fd; 21 | char buf[MEMINFO_SIZE]; 22 | int len, readerr; 23 | char *p, *q; 24 | long val; 25 | 26 | fd = open(file, O_RDONLY); 27 | if (fd < 0) { 28 | ERROR("Couldn't open %s: %s\n", file, strerror(errno)); 29 | return -1; 30 | } 31 | 32 | len = read(fd, buf, sizeof(buf)); 33 | readerr = errno; 34 | close(fd); 35 | if (len < 0) { 36 | ERROR("Error reading %s: %s\n", file, strerror(readerr)); 37 | return -1; 38 | } 39 | if (len == sizeof(buf)) { 40 | ERROR("%s is too large\n", file); 41 | return -1; 42 | } 43 | buf[len] = '\0'; 44 | 45 | /* Search for a tag if provided */ 46 | if (tag) { 47 | p = strstr(buf, tag); 48 | if (!p) 49 | return -1; /* looks like the line we want isn't there */ 50 | p += strlen(tag); 51 | } else 52 | p = buf; 53 | 54 | val = strtol(p, &q, 0); 55 | if (! isspace(*q)) { 56 | ERROR("Couldn't parse %s value\n", file); 57 | return -1; 58 | } 59 | 60 | return val; 61 | } 62 | 63 | long getdefaulthugesize(void) 64 | { 65 | return file_read_ulong(MEMINFO, "Hugepagesize:") * 1024; 66 | } 67 | -------------------------------------------------------------------------------- /tests/module_load/.gitignore: -------------------------------------------------------------------------------- 1 | finit_load 2 | init_load 3 | modules.order 4 | Module.symvers 5 | *.a 6 | *.o 7 | *.ko 8 | *.cmd 9 | *.mod 10 | *.mod.c 11 | .*.cmd 12 | -------------------------------------------------------------------------------- /tests/module_load/setest_firmware_load.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | 6 | static int __init setest_firmware_request_init(void) 7 | { 8 | const struct firmware *fw; 9 | int result; 10 | 11 | pr_info("INIT - setest_firmware_request\n"); 12 | result = request_firmware(&fw, "dummy-firmware", NULL); 13 | if (result) { 14 | pr_err("request_firmware failed: %d\n", result); 15 | return result; 16 | } 17 | pr_info("request_firmware succeeded\n"); 18 | release_firmware(fw); 19 | return 0; 20 | } 21 | 22 | static void __exit setest_firmware_request_exit(void) 23 | { 24 | pr_info("EXIT - setest_firmware_request\n"); 25 | } 26 | 27 | module_init(setest_firmware_request_init); 28 | module_exit(setest_firmware_request_exit); 29 | MODULE_LICENSE("GPL"); -------------------------------------------------------------------------------- /tests/module_load/setest_module_load.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | 5 | static int __init setest_module_load_init(void) 6 | { 7 | pr_info("INIT - setest_module_load\n"); 8 | return 0; 9 | } 10 | 11 | static void __exit setest_module_load_exit(void) 12 | { 13 | pr_info("EXIT - setest_module_load\n"); 14 | } 15 | 16 | module_init(setest_module_load_init); 17 | module_exit(setest_module_load_exit); 18 | MODULE_LICENSE("GPL"); 19 | -------------------------------------------------------------------------------- /tests/module_load/setest_module_request.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | 5 | static int __init setest_module_request_init(void) 6 | { 7 | int result; 8 | 9 | pr_info("INIT - setest_module_request\n"); 10 | result = request_module_nowait("dummy-module"); 11 | pr_info("request_module() returned: %d\n", result); 12 | return result; 13 | } 14 | 15 | static void __exit setest_module_request_exit(void) 16 | { 17 | pr_info("EXIT - setest_module_request\n"); 18 | } 19 | 20 | module_init(setest_module_request_init); 21 | module_exit(setest_module_request_exit); 22 | MODULE_LICENSE("GPL"); 23 | -------------------------------------------------------------------------------- /tests/mqueue/.gitignore: -------------------------------------------------------------------------------- 1 | mqmgr 2 | mqrcv 3 | mqsnd 4 | -------------------------------------------------------------------------------- /tests/mqueue/Makefile: -------------------------------------------------------------------------------- 1 | TARGETS=$(patsubst %.c,%,$(wildcard *.c)) 2 | LDLIBS += -lrt 3 | all: $(TARGETS) 4 | clean: 5 | rm -f $(TARGETS) 6 | -------------------------------------------------------------------------------- /tests/mqueue/mqmgr.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include 7 | #include 8 | #include 9 | #include 10 | #include 11 | 12 | /* 13 | * Managed the creation and distruction of a posix mqueue. 14 | * The first argument is the name of the mqueue to be managed 15 | * (including starting '/'). The second argument is the 16 | * operation. '1' to create, '0' to remove. 17 | * 18 | */ 19 | int main(int argc, char **argv) 20 | { 21 | 22 | mqd_t fd; 23 | struct mq_attr attr; 24 | 25 | if( argc != 3 ) { 26 | printf("usage: %s <0|1> \n", argv[0]); 27 | exit(2); 28 | } 29 | 30 | /* initialize the queue attributes */ 31 | attr.mq_flags = 0; 32 | attr.mq_maxmsg = 10; 33 | attr.mq_msgsize = 20; 34 | attr.mq_curmsgs = 0; 35 | 36 | 37 | /* unlink the queue if it exists */ 38 | if(argv[2][0] == '0') { 39 | mq_unlink(argv[1]); 40 | } else if(argv[2][0] == '1') { 41 | fd = mq_open(argv[1], O_CREAT, 0664, &attr); 42 | if (fd != -1) { 43 | mq_close(fd); 44 | } else { 45 | printf("mqmgr:create:errno = %d\n", errno); 46 | exit(2); 47 | } 48 | } else { 49 | perror("mqmgr:invalid option"); 50 | exit(2); 51 | } 52 | 53 | exit(0); 54 | 55 | } 56 | -------------------------------------------------------------------------------- /tests/mqueue/mqrcv.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include 7 | #include 8 | 9 | /* 10 | * Tests the reading from a posix mqueue. The first argument is the 11 | * name of the mqueue to be read (including starting '/'). 12 | */ 13 | int main(int argc, char **argv) 14 | { 15 | mqd_t fd; 16 | int size; 17 | char buffer[20]; 18 | if( argc != 2 ) { 19 | printf("usage: %s \n", argv[0]); 20 | return 2; 21 | } 22 | 23 | fd = mq_open(argv[1], O_RDONLY | O_NONBLOCK); 24 | if (fd == -1) { 25 | printf("mqrcv: mq_open: errno = %d\n", errno); 26 | return 2; 27 | } 28 | 29 | size = mq_receive(fd, buffer, 20, NULL); 30 | if (size == -1) { 31 | printf("mqrcv: mq_receive: errno = %d\n", errno); 32 | return 2; 33 | } 34 | 35 | mq_close(fd); 36 | return 0; 37 | } 38 | -------------------------------------------------------------------------------- /tests/mqueue/mqsnd.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include 7 | #include 8 | #include 9 | 10 | #define MSG "TEST MESSAGE" 11 | 12 | /* 13 | * Tests the reading from a posix mqueue. The first argument is the 14 | * name of the mqueue to be read (including starting '/'). 15 | */ 16 | int main(int argc, char **argv) 17 | { 18 | mqd_t fd; 19 | if( argc != 2 ) { 20 | printf("usage: %s \n", argv[0]); 21 | return 2; 22 | } 23 | 24 | fd = mq_open(argv[1], O_WRONLY | O_NONBLOCK); 25 | if (fd == -1) { 26 | printf("mqsnd: mq_open: errno = %d\n", errno); 27 | return 2; 28 | } 29 | 30 | if ( mq_send(fd, MSG, strlen(MSG), 0)) { 31 | printf("mqsnd: mq_send: errno = %d\n", errno); 32 | return 2; 33 | } 34 | 35 | mq_close(fd); 36 | return 0; 37 | } 38 | -------------------------------------------------------------------------------- /tests/msg/.gitignore: -------------------------------------------------------------------------------- 1 | msgctl 2 | msgget 3 | msgrcv 4 | msgsnd 5 | -------------------------------------------------------------------------------- /tests/msg/Makefile: -------------------------------------------------------------------------------- 1 | TARGETS=msgctl msgget msgrcv msgsnd 2 | all: $(TARGETS) 3 | clean: 4 | rm -f $(TARGETS) 5 | -------------------------------------------------------------------------------- /tests/msg/msgctl.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | 7 | int main(int argc, char **argv) 8 | { 9 | int ch; 10 | int key = 0x8888; 11 | int id; 12 | int error; 13 | struct msqid_ds buf; 14 | 15 | while ((ch = getopt(argc, argv, "k:")) != EOF) { 16 | switch (ch) { 17 | case 'k': 18 | key = atoi(optarg); 19 | break; 20 | } 21 | } 22 | 23 | id = msgget(key, IPC_CREAT | 0444); 24 | if (id == -1) 25 | return 1; 26 | 27 | /* 28 | * Equivalent: IPC_STAT, MSG_STAT 29 | * Tests: MSGQ__GETATTR | MSGQ__ASSOCIATE 30 | */ 31 | error = msgctl(id, IPC_STAT, &buf); 32 | printf ("%d", error); 33 | 34 | /* 35 | * Equivalent: IPC_SET 36 | * Tests: MSGQ__SETATTR 37 | */ 38 | error = msgctl(id, IPC_SET, &buf); 39 | printf (" %d", error); 40 | 41 | /* 42 | * Equivalent: IPC_RMID 43 | * Tests: MSGQ__DESTROY 44 | */ 45 | error = msgctl(id, IPC_RMID, 0); 46 | printf (" %d", error); 47 | 48 | printf("\n"); 49 | return 0; 50 | } 51 | -------------------------------------------------------------------------------- /tests/msg/msgget.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | 7 | int main(int argc, char **argv) 8 | { 9 | int ch; 10 | int key = 0x8888; 11 | int id; 12 | int perms = 0444; 13 | 14 | while ((ch = getopt(argc, argv, "k:p:")) != EOF) { 15 | switch (ch) { 16 | case 'k': 17 | key = atoi(optarg); 18 | break; 19 | case 'p': 20 | perms = atoi(optarg); 21 | break; 22 | } 23 | 24 | } 25 | 26 | id = msgget(key, IPC_CREAT | perms); 27 | if (id == -1) 28 | return 1; 29 | printf("msgget succeeded: key = %d, id = %d\n", key, id); 30 | 31 | return 0; 32 | } 33 | -------------------------------------------------------------------------------- /tests/msg/msgrcv.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | 7 | #define MSGMAX 1024 8 | struct msgbuf_test { 9 | long mtype; 10 | char mtext[MSGMAX]; 11 | }; 12 | 13 | int main(int argc, char **argv) 14 | { 15 | int ch; 16 | int key = 0x8888; 17 | int id; 18 | int error; 19 | struct msgbuf_test msgp; 20 | 21 | while ((ch = getopt(argc, argv, "k:")) != EOF) { 22 | switch (ch) { 23 | case 'k': 24 | key = atoi(optarg); 25 | break; 26 | } 27 | } 28 | 29 | id = msgget(key, IPC_CREAT | 0777); 30 | if (id == -1) 31 | return 1; 32 | 33 | error = msgrcv(id, &msgp, MSGMAX, 1, IPC_NOWAIT); 34 | printf("msgrcv: result = %d\n", error); 35 | return error; 36 | } 37 | -------------------------------------------------------------------------------- /tests/msg/msgsnd.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include 7 | 8 | #define MSGMAX 1024 9 | struct msgbuf_test { 10 | long mtype; 11 | char mtext[MSGMAX]; 12 | }; 13 | 14 | int main(int argc, char **argv) 15 | { 16 | int ch; 17 | int key = 0x8888; 18 | int id; 19 | int error; 20 | struct msgbuf_test msgp; 21 | 22 | while ((ch = getopt(argc, argv, "k:")) != EOF) { 23 | switch (ch) { 24 | case 'k': 25 | key = atoi(optarg); 26 | break; 27 | } 28 | } 29 | 30 | id = msgget(key, IPC_CREAT | 0777); 31 | if (id == -1) 32 | return 1; 33 | 34 | memset(&msgp, 'z', sizeof(msgp)); 35 | msgp.mtype = 1; 36 | 37 | error = msgsnd(id, &msgp, MSGMAX, IPC_NOWAIT); 38 | printf("msgsnd: error = %d\n", error); 39 | return error; 40 | } 41 | -------------------------------------------------------------------------------- /tests/netlink_socket/.gitignore: -------------------------------------------------------------------------------- 1 | netlinkcreate 2 | -------------------------------------------------------------------------------- /tests/netlink_socket/Makefile: -------------------------------------------------------------------------------- 1 | TARGETS=$(patsubst %.c,%,$(wildcard *.c)) 2 | all: $(TARGETS) 3 | clean: 4 | rm -f $(TARGETS) 5 | -------------------------------------------------------------------------------- /tests/nfs_filesystem/Makefile: -------------------------------------------------------------------------------- 1 | all: 2 | clean: 3 | -------------------------------------------------------------------------------- /tests/nfsruntests.pl: -------------------------------------------------------------------------------- 1 | #!/usr/bin/perl 2 | use Test::Harness; 3 | 4 | @test = "$ARGV[0]"; 5 | runtests(@test); 6 | -------------------------------------------------------------------------------- /tests/nlmsg/.gitignore: -------------------------------------------------------------------------------- 1 | nlmsg 2 | -------------------------------------------------------------------------------- /tests/nlmsg/Makefile: -------------------------------------------------------------------------------- 1 | TARGETS=nlmsg 2 | 3 | all: $(TARGETS) 4 | clean: 5 | rm -f $(TARGETS) 6 | -------------------------------------------------------------------------------- /tests/nlmsg/nlmsg.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include 7 | #include 8 | #include 9 | 10 | int main(int argc, char *argv[]) 11 | { 12 | int i, rc; 13 | int fd; 14 | unsigned char data[512]; 15 | struct nlmsghdr *nh[3]; 16 | struct sockaddr_nl sa; 17 | struct iovec iov; 18 | struct msghdr msg; 19 | 20 | memset(&sa, 0, sizeof(sa)); 21 | sa.nl_family = AF_NETLINK; 22 | 23 | memset(data, 0, sizeof(data)); 24 | iov.iov_base = data; 25 | iov.iov_len = 3 * NLMSG_SPACE(0); 26 | 27 | for (i = 0; i < 3; i++) { 28 | nh[i] = (struct nlmsghdr *)(data + (i * NLMSG_SPACE(0))); 29 | nh[i]->nlmsg_len = NLMSG_HDRLEN; 30 | } 31 | nh[0]->nlmsg_type = RTM_GETLINK; // nlmsg_read 32 | nh[1]->nlmsg_type = RTM_SETLINK; // nlmsg_write 33 | nh[2]->nlmsg_type = RTM_GETADDR; // nlmsg_read 34 | 35 | memset(&msg, 0, sizeof(msg)); 36 | msg.msg_name = &sa; 37 | msg.msg_namelen = sizeof(sa); 38 | msg.msg_iov = &iov; 39 | msg.msg_iovlen = 1; 40 | 41 | fd = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE); 42 | rc = sendmsg(fd, &msg, 0); 43 | 44 | if (rc < 0) { 45 | perror("sendmsg"); 46 | exit(-1); 47 | } 48 | exit(0); 49 | } 50 | 51 | -------------------------------------------------------------------------------- /tests/nlmsg/test: -------------------------------------------------------------------------------- 1 | #!/usr/bin/perl 2 | # 3 | # This test exercises the netlink extended perms support 4 | # 5 | 6 | use Test; 7 | 8 | BEGIN { 9 | $test_count = 2; 10 | plan tests => $test_count; 11 | } 12 | 13 | $basedir = $0; 14 | $basedir =~ s|(.*)/[^/]*|$1|; 15 | 16 | # 17 | # Attempt to send the netlink messages from the allowed domain. 18 | # 19 | $result = system "runcon -t test_nlmsg_xperm_t -- $basedir/nlmsg 2>&1"; 20 | ok( $result, 0 ); 21 | 22 | # 23 | # Attempt to send the netlink messages from the not-allowed domain. 24 | # 25 | $result = system "runcon -t test_nlmsg_noxperm_t -- $basedir/nlmsg 2>&1"; 26 | ok($result); 27 | 28 | exit; 29 | -------------------------------------------------------------------------------- /tests/nnp_nosuid/.gitignore: -------------------------------------------------------------------------------- 1 | checkcon 2 | execnnp 3 | -------------------------------------------------------------------------------- /tests/nnp_nosuid/Makefile: -------------------------------------------------------------------------------- 1 | TARGETS=execnnp checkcon 2 | 3 | LDLIBS += -lselinux 4 | 5 | all: $(TARGETS) 6 | clean: 7 | rm -f $(TARGETS) true 8 | -------------------------------------------------------------------------------- /tests/nnp_nosuid/checkcon.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include 7 | #include 8 | 9 | int main(int argc, char **argv) 10 | { 11 | char *con = NULL; 12 | context_t c; 13 | const char *type; 14 | int rc; 15 | 16 | if (argc != 2) { 17 | fprintf(stderr, "usage: %s expected-type\n", argv[0]); 18 | exit(-1); 19 | } 20 | 21 | if (getcon(&con) < 0) { 22 | perror("getcon"); 23 | exit(-1); 24 | } 25 | 26 | c = context_new(con); 27 | if (!c) { 28 | perror("context_new"); 29 | exit(-1); 30 | } 31 | 32 | type = context_type_get(c); 33 | if (!type) { 34 | perror("context_type_get"); 35 | exit(-1); 36 | 37 | } 38 | 39 | rc = strcmp(type, argv[1]); 40 | exit(rc); 41 | } 42 | -------------------------------------------------------------------------------- /tests/notify/.gitignore: -------------------------------------------------------------------------------- 1 | test_inotify 2 | test_fanotify 3 | -------------------------------------------------------------------------------- /tests/notify/Makefile: -------------------------------------------------------------------------------- 1 | TARGETS=test_inotify test_fanotify 2 | 3 | all: $(TARGETS) 4 | clean: 5 | rm -rf $(TARGETS) watch_me watch_dir 6 | -------------------------------------------------------------------------------- /tests/notify/test_inotify.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | 6 | int main(int argc, char *argv[]) 7 | { 8 | if (argc < 2) { 9 | fprintf(stderr, "Usage: test_inotify [-r] file_name\n"); 10 | exit(1); 11 | } 12 | 13 | int fd, wd, arg; 14 | int mask = IN_MODIFY; 15 | 16 | while ((arg = getopt(argc, argv, "pr")) != -1) { 17 | switch (arg) { 18 | case 'r': 19 | mask |= IN_ACCESS; 20 | break; 21 | default: 22 | fprintf(stderr, "Usage: test_inotify [-r] file_name\n"); 23 | exit(1); 24 | } 25 | } 26 | 27 | // get new file descriptor for inotify access 28 | fd = inotify_init(); 29 | if (fd < 0) { 30 | perror("inotify_init:bad file descriptor"); 31 | exit(1); 32 | } 33 | 34 | // set watch on file and get watch descriptor for accessing events on it 35 | wd = inotify_add_watch(fd, argv[optind], mask); 36 | 37 | if (wd < 0) { 38 | perror("test_inotify:watch denied"); 39 | exit(1); 40 | } 41 | 42 | exit(0); 43 | } 44 | -------------------------------------------------------------------------------- /tests/open/.gitignore: -------------------------------------------------------------------------------- 1 | append2write 2 | fopen 3 | -------------------------------------------------------------------------------- /tests/open/Makefile: -------------------------------------------------------------------------------- 1 | TARGETS=append2write fopen 2 | 3 | all: $(TARGETS) 4 | clean: 5 | rm -f $(TARGETS) test_file 6 | -------------------------------------------------------------------------------- /tests/open/append2write.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include 7 | 8 | int main(int argc, char **argv) 9 | { 10 | int fd, rc; 11 | 12 | if (argc != 2) { 13 | fprintf(stderr, "usage: %s path", argv[0]); 14 | exit(1); 15 | } 16 | 17 | fd = open(argv[1], O_WRONLY | O_APPEND); 18 | if (fd < 0) { 19 | perror(argv[1]); 20 | exit(1); 21 | } 22 | 23 | rc = fcntl(fd, F_SETFL, 0); 24 | if (rc < 0) { 25 | perror("fcntl"); 26 | exit(1); 27 | } 28 | close (fd); 29 | exit(0); 30 | } 31 | -------------------------------------------------------------------------------- /tests/open/fopen.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include 7 | 8 | int main(int argc, char **argv) 9 | { 10 | FILE *fp; 11 | if (argc != 3) { 12 | fprintf(stderr, "usage: %s path mode", argv[0]); 13 | exit(1); 14 | } 15 | fp = fopen(argv[1], argv[2]); 16 | if (!fp) { 17 | perror(argv[1]); 18 | exit(1); 19 | } 20 | fclose(fp); 21 | exit(0); 22 | } 23 | -------------------------------------------------------------------------------- /tests/os_detect: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | if [[ -r /etc/redhat-release ]]; then 4 | ver=$(cat /etc/redhat-release | sed -ne '/^Red Hat Enterprise Linux/p') 5 | if [[ -n $ver ]]; then 6 | echo "$ver" | \ 7 | sed -e 's/Red Hat Enterprise Linux[ \ta-zA-Z]*\([0-9]\+\).*/RHEL\1/' 8 | fi 9 | fi 10 | -------------------------------------------------------------------------------- /tests/overlay/.gitignore: -------------------------------------------------------------------------------- 1 | access 2 | -------------------------------------------------------------------------------- /tests/overlay/Makefile: -------------------------------------------------------------------------------- 1 | TARGETS=$(patsubst %.c,%,$(wildcard *.c)) 2 | all: $(TARGETS) 3 | clean: 4 | rm -f $(TARGETS) 5 | -------------------------------------------------------------------------------- /tests/overlay/access.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | 6 | int main(int argc, const char **argv) 7 | { 8 | if (argc != 3 || (strcmp(argv[2], "R_OK") && strcmp(argv[2], "W_OK"))) { 9 | fprintf(stderr, "Usage %s R_OK|W_OK\n", argv[0]); 10 | return EINVAL; 11 | } 12 | 13 | errno = 0; 14 | access(argv[1], strcmp(argv[2], "R_OK") == 0 ? R_OK : W_OK); 15 | return errno; 16 | } 17 | -------------------------------------------------------------------------------- /tests/overlay/append: -------------------------------------------------------------------------------- 1 | #! /bin/sh 2 | echo "append" > $1 3 | -------------------------------------------------------------------------------- /tests/overlay/badentrypoint: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | id -Z 3 | -------------------------------------------------------------------------------- /tests/overlay/cleanup-overlay: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | BASEDIR=$1 4 | 5 | cleanup (){ 6 | umount $BASEDIR/container1/merged 2> /dev/null 7 | rm -rf $BASEDIR/container1/ $BASEDIR/lower/ 8 | } 9 | 10 | #Main script 11 | [ -z "$BASEDIR" ] && BASEDIR=$PWD 12 | cleanup 13 | -------------------------------------------------------------------------------- /tests/overlay/goodentrypoint: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | id -Z 3 | -------------------------------------------------------------------------------- /tests/perf_event/.gitignore: -------------------------------------------------------------------------------- 1 | perf_event 2 | -------------------------------------------------------------------------------- /tests/perf_event/Makefile: -------------------------------------------------------------------------------- 1 | TARGETS = perf_event 2 | LDLIBS += -lselinux 3 | 4 | all: $(TARGETS) 5 | 6 | clean: 7 | rm -f $(TARGETS) 8 | -------------------------------------------------------------------------------- /tests/pol_detect: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | 3 | if [ $# -ne 1 ]; then 4 | echo "Usage $0 " 5 | exit 1 6 | fi 7 | 8 | # This is heuristic but seems unlikely to be wrong, 9 | # the kernel initial sid should always be SystemHigh 10 | # and SystemHigh is normally s15 11 | level=$(cat $1/initial_contexts/kernel | tr '\0' '\n' | cut -d: -f4) 12 | 13 | if [ -z $level ]; then echo "NON-MLS" 14 | elif [ $level = 's0' ]; then echo "MCS" 15 | elif [ $level = 's15' ]; then echo "MLS" 16 | else echo "UNKNOWN" 17 | fi 18 | -------------------------------------------------------------------------------- /tests/prlimit/.gitignore: -------------------------------------------------------------------------------- 1 | child 2 | parent 3 | -------------------------------------------------------------------------------- /tests/prlimit/Makefile: -------------------------------------------------------------------------------- 1 | TARGETS=parent child 2 | 3 | LDLIBS += -lselinux 4 | 5 | all: $(TARGETS) 6 | clean: 7 | rm -f $(TARGETS) 8 | -------------------------------------------------------------------------------- /tests/prlimit/child.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | 5 | int main(void) 6 | { 7 | char buf[1]; 8 | int rc; 9 | 10 | buf[0] = 0; 11 | rc = write(1, buf, sizeof buf); 12 | if (rc < 0) { 13 | perror("write"); 14 | exit(-1); 15 | } 16 | rc = read(0, buf, sizeof buf); 17 | if (rc < 0) { 18 | perror("read"); 19 | exit(-1); 20 | } 21 | exit(0); 22 | } 23 | -------------------------------------------------------------------------------- /tests/ptrace/.gitignore: -------------------------------------------------------------------------------- 1 | ptrace 2 | -------------------------------------------------------------------------------- /tests/ptrace/Makefile: -------------------------------------------------------------------------------- 1 | all: ptrace 2 | clean: 3 | rm -f ptrace flag 4 | -------------------------------------------------------------------------------- /tests/ptrace/ptrace.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | 7 | int main(int argc, char **argv) 8 | { 9 | int rc; 10 | int pid; 11 | pid = atoi(argv[1]); 12 | 13 | rc = ptrace(PTRACE_ATTACH, pid, 0, 0); 14 | 15 | if(rc < 0) { 16 | exit(1); 17 | } else { 18 | wait(NULL); 19 | rc = ptrace(PTRACE_DETACH, pid, 0, 0); 20 | if (rc < 0) { 21 | perror("PTRACE_DETACH"); 22 | exit(1); 23 | } 24 | } 25 | exit(0); 26 | } 27 | 28 | -------------------------------------------------------------------------------- /tests/ptrace/test: -------------------------------------------------------------------------------- 1 | #!/usr/bin/perl 2 | 3 | use Test; 4 | BEGIN { plan tests => 2 } 5 | 6 | $basedir = $0; 7 | $basedir =~ s|(.*)/[^/]*|$1|; 8 | 9 | # Start the process to be traced. 10 | system("mkfifo $basedir/flag"); 11 | if ( ( $pid = fork() ) == 0 ) { 12 | exec 13 | "exec runcon -t test_ptrace_traced_t sh -c 'echo >$basedir/flag; while :; do :; done'"; 14 | exit; 15 | } 16 | 17 | # Wait for it to start. 18 | open( my $f, "<", "$basedir/flag" ); 19 | my $rin = ''; 20 | vec( $rin, fileno($f), 1 ) = 1; 21 | select( $rin, undef, undef, 5 ); 22 | close($f); 23 | 24 | # Verify that the nottracer domain cannot attach to the process. 25 | # Should fail on the ptrace permission check. 26 | $result = system "runcon -t test_ptrace_nottracer_t $basedir/ptrace $pid"; 27 | ok($result); # we expect this to fail. 28 | 29 | # Verify that the tracer domain can trace to the process. 30 | $result = system "runcon -t test_ptrace_tracer_t $basedir/ptrace $pid"; 31 | ok( $result, 0 ); 32 | 33 | # Kill the process. 34 | kill KILL, $pid; 35 | 36 | # Clean up. 37 | system "rm -f $basedir/flag"; 38 | 39 | exit; 40 | -------------------------------------------------------------------------------- /tests/readlink/Makefile: -------------------------------------------------------------------------------- 1 | all: 2 | clean: 3 | rm -f test_file test_symlink 4 | -------------------------------------------------------------------------------- /tests/readlink/test: -------------------------------------------------------------------------------- 1 | #!/usr/bin/perl 2 | 3 | use Test; 4 | BEGIN { plan tests => 3 } 5 | 6 | $basedir = $0; 7 | $basedir =~ s|(.*)/[^/]*|$1|; 8 | 9 | # Remove any leftover test files from prior failed runs. 10 | system("rm -rf $basedir/test_file $basedir/test_symlink"); 11 | 12 | # Create a test file. 13 | system("touch $basedir/test_file 2>&1"); 14 | system("chcon -t test_readlink_file_t $basedir/test_file 2>&1"); 15 | 16 | # Create a test symbolic link to the test file. 17 | system("ln -sf test_file $basedir/test_symlink 2>&1"); 18 | system("chcon -h -t test_readlink_link_t $basedir/test_symlink 2>&1"); 19 | 20 | # Verify that test_readlink_t can read and follow this link. 21 | $result = system("runcon -t test_readlink_t -- ls -Ll $basedir/test_symlink"); 22 | ok( $result, 0 ); 23 | 24 | # Verify that test_noreadlink_t cannot read or follow this link. 25 | $result = 26 | system("runcon -t test_noreadlink_t -- ls -l $basedir/test_symlink 2>&1"); 27 | ok($result); 28 | $result = 29 | system("runcon -t test_noreadlink_t -- ls -Ll $basedir/test_symlink 2>&1"); 30 | ok($result); 31 | 32 | # Cleanup. 33 | system("rm -rf $basedir/test_file $basedir/test_symlink"); 34 | 35 | -------------------------------------------------------------------------------- /tests/relabel/Makefile: -------------------------------------------------------------------------------- 1 | all: 2 | clean: 3 | rm -f test_file 4 | -------------------------------------------------------------------------------- /tests/relabel/test: -------------------------------------------------------------------------------- 1 | #!/usr/bin/perl 2 | 3 | use Test; 4 | BEGIN { plan tests => 3 } 5 | 6 | $basedir = $0; 7 | $basedir =~ s|(.*)/[^/]*|$1|; 8 | 9 | # Remove any leftover test file from prior failed runs. 10 | system("rm -rf $basedir/test_file"); 11 | 12 | # Create a test file with the test_relabel_oldtype_t type for use in the tests. 13 | system("touch $basedir/test_file"); 14 | system("chcon -t test_relabel_oldtype_t $basedir/test_file"); 15 | 16 | # Verify that test_relabel_t can relabel the file. 17 | $result = system( 18 | "runcon -t test_relabel_t -- chcon -t test_relabel_newtype_t $basedir/test_file 2>&1" 19 | ); 20 | ok( $result, 0 ); 21 | 22 | # Revert. 23 | system("chcon -t test_relabel_oldtype_t $basedir/test_file"); 24 | 25 | # Verify that test_norelabelfrom_t cannot relabel the file. 26 | # Should fail on the relabelfrom permission check to the original type. 27 | $result = system( 28 | "runcon -t test_norelabelfrom_t -- chcon -t test_relabel_newtype_t $basedir/test_file 2>&1" 29 | ); 30 | ok($result); 31 | 32 | # Verify that test_norelabelto_t cannot relabel the file to the new type. 33 | # Should fail on the relabelto permission check to the new type. 34 | $result = system( 35 | "runcon -t test_norelabelto_t -- chcon -t test_relabel_newtype_t $basedir/test_file 2>&1" 36 | ); 37 | ok($result); 38 | 39 | # Cleanup. 40 | system("rm -rf $basedir/test_file"); 41 | 42 | -------------------------------------------------------------------------------- /tests/rename/Makefile: -------------------------------------------------------------------------------- 1 | all: 2 | clean: 3 | rm -rf src_dir dst_dir 4 | -------------------------------------------------------------------------------- /tests/runtests.pl: -------------------------------------------------------------------------------- 1 | #!/usr/bin/perl 2 | 3 | use Test::Harness; 4 | 5 | @dirs = split( / /, $ENV{SUBDIRS} ); 6 | 7 | for (@dirs) { 8 | push @scripts, "$_/test"; 9 | } 10 | 11 | $output = `id`; 12 | $output =~ /uid=\d+\((\w+)\).*context=(\w+):(\w+):(\w+)/ 13 | || die("Can't determine user's id\n"); 14 | $unixuser = $1; 15 | $user = $2; 16 | $role = $3; 17 | $type = $4; 18 | 19 | print "Running as user $unixuser with context $2:$3:$4\n\n"; 20 | 21 | if ( ( $role ne "sysadm_r" && $role ne "unconfined_r" && $role ne "system_r" ) 22 | || $unixuser ne "root" ) 23 | { 24 | print 25 | "These tests are intended to be run as root, in the sysadm_r or unconfined_r role\n"; 26 | exit; 27 | } 28 | 29 | $output = `getenforce`; 30 | chop $output; 31 | if ( $output ne "Enforcing" && $output ne "enforcing" ) { 32 | print "These tests are intended to be run in enforcing mode only.\n"; 33 | print "Run 'setenforce 1' to switch to enforcing mode.\n"; 34 | exit; 35 | } 36 | 37 | runtests(@scripts); 38 | 39 | -------------------------------------------------------------------------------- /tests/rxdir/Makefile: -------------------------------------------------------------------------------- 1 | all: 2 | clean: 3 | rm -rf test_dir 4 | -------------------------------------------------------------------------------- /tests/rxdir/test: -------------------------------------------------------------------------------- 1 | #!/usr/bin/perl 2 | 3 | use Test; 4 | BEGIN { plan tests => 4 } 5 | 6 | $basedir = $0; 7 | $basedir =~ s|(.*)/[^/]*|$1|; 8 | 9 | # Remove any leftover test directory from prior failed runs. 10 | system("rm -rf $basedir/test_dir"); 11 | 12 | # Create a test dir with the test_rxdir_dir_t type for use in the tests. 13 | system("mkdir $basedir/test_dir"); 14 | system("chcon -t test_rxdir_dir_t $basedir/test_dir"); 15 | 16 | # Touch a file in the directory. 17 | system("touch $basedir/test_dir/test_file"); 18 | 19 | # Verify that test_rdir_t can read but not search the directory. 20 | $result = system("runcon -t test_rdir_t -- ls $basedir/test_dir 2>&1"); 21 | ok( $result, 0 ); 22 | $result = 23 | system("runcon -t test_rdir_t -- ls $basedir/test_dir/test_file 2>&1"); 24 | ok($result); 25 | 26 | # Verify that test_xdir_t can search but not read the directory. 27 | $result = 28 | system("runcon -t test_xdir_t -- ls $basedir/test_dir/test_file 2>&1"); 29 | ok( $result, 0 ); 30 | $result = system("runcon -t test_xdir_t -- ls $basedir/test_dir 2>&1"); 31 | ok($result); 32 | 33 | # Cleanup. 34 | system("rm -rf $basedir/test_dir"); 35 | 36 | -------------------------------------------------------------------------------- /tests/sctp/.gitignore: -------------------------------------------------------------------------------- 1 | sctp_asconf_params_client 2 | sctp_asconf_params_server 3 | sctp_bind 4 | sctp_bindx 5 | sctp_client 6 | sctp_connectx 7 | sctp_peeloff_client 8 | sctp_peeloff_server 9 | sctp_server 10 | -------------------------------------------------------------------------------- /tests/sctp/Makefile: -------------------------------------------------------------------------------- 1 | TARGETS = sctp_client sctp_server sctp_bind sctp_bindx sctp_connectx \ 2 | sctp_asconf_params_client sctp_asconf_params_server \ 3 | sctp_peeloff_client sctp_peeloff_server 4 | 5 | DEPS = sctp_common.c sctp_common.h 6 | CFLAGS ?= -Wall 7 | 8 | LDLIBS += -lselinux -lsctp 9 | 10 | all: $(TARGETS) 11 | 12 | clean: 13 | rm -f $(TARGETS) flag 14 | 15 | $(TARGETS): $(DEPS) 16 | -------------------------------------------------------------------------------- /tests/sctp/calipso-flush: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | # Reset NetLabel configuration to unlabeled after CALIPSO/IPv6 tests. 3 | netlabelctl map del default 4 | netlabelctl calipso del doi:16 5 | netlabelctl map add default protocol:unlbl 6 | -------------------------------------------------------------------------------- /tests/sctp/calipso-load: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | # Define a doi for testing loopback for CALIPSO/IPv6. 3 | netlabelctl calipso add pass doi:16 4 | netlabelctl map del default 5 | netlabelctl map add default address:0.0.0.0/0 protocol:unlbl 6 | netlabelctl map add default address:::/0 protocol:unlbl 7 | netlabelctl map add default address:::1 protocol:calipso,16 8 | -------------------------------------------------------------------------------- /tests/sctp/cipso-fl-flush: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | 3 | netlabelctl map del default 4 | netlabelctl cipsov4 del doi:1 5 | netlabelctl map add default protocol:unlbl 6 | -------------------------------------------------------------------------------- /tests/sctp/cipso-fl-load: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | 3 | netlabelctl cipsov4 add local doi:1 4 | netlabelctl map del default 5 | netlabelctl map add default address:0.0.0.0/0 protocol:unlbl 6 | netlabelctl map add default address:::/0 protocol:unlbl 7 | netlabelctl map add default address:127.0.0.1 protocol:cipsov4,1 8 | -------------------------------------------------------------------------------- /tests/sctp/cipso-flush: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | # Reset NetLabel configuration to unlabeled for all after CIPSO/IPv4 tests. 3 | netlabelctl map del default 4 | netlabelctl cipsov4 del doi:16 5 | netlabelctl map add default protocol:unlbl 6 | -------------------------------------------------------------------------------- /tests/sctp/cipso-load-t1: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | 3 | netlabelctl cipsov4 add pass doi:16 tags:1 4 | netlabelctl map del default 5 | netlabelctl map add default address:0.0.0.0/0 protocol:unlbl 6 | netlabelctl map add default address:::/0 protocol:unlbl 7 | netlabelctl map add default address:127.0.0.1 protocol:cipsov4,16 8 | -------------------------------------------------------------------------------- /tests/sctp/cipso-load-t2: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | 3 | netlabelctl cipsov4 add pass doi:16 tags:2 4 | netlabelctl map del default 5 | netlabelctl map add default address:0.0.0.0/0 protocol:unlbl 6 | netlabelctl map add default address:::/0 protocol:unlbl 7 | netlabelctl map add default address:127.0.0.1 protocol:cipsov4,16 8 | -------------------------------------------------------------------------------- /tests/sctp/cipso-load-t5: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | 3 | netlabelctl cipsov4 add pass doi:16 tags:5 4 | netlabelctl map del default 5 | netlabelctl map add default address:0.0.0.0/0 protocol:unlbl 6 | netlabelctl map add default address:::/0 protocol:unlbl 7 | netlabelctl map add default address:127.0.0.1 protocol:cipsov4,16 8 | -------------------------------------------------------------------------------- /tests/sctp/fb-deny-label-flush: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | 3 | netlabelctl map del default 4 | netlabelctl map add default protocol:unlbl 5 | netlabelctl unlbl del interface:lo address:127.0.0.0/8 label:system_u:object_r:netlabel_sctp_peer_t:s0 6 | netlabelctl unlbl del interface:lo address:::1/128 label:system_u:object_r:deny_assoc_sctp_peer_t:s0 7 | -------------------------------------------------------------------------------- /tests/sctp/fb-deny-label-load: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | 3 | netlabelctl map del default 4 | netlabelctl map add default address:0.0.0.0/0 protocol:unlbl 5 | netlabelctl map add default address:::/0 protocol:unlbl 6 | netlabelctl unlbl add interface:lo address:127.0.0.0/8 label:system_u:object_r:netlabel_sctp_peer_t:s0 7 | netlabelctl unlbl add interface:lo address:::1/128 label:system_u:object_r:deny_assoc_sctp_peer_t:s0 8 | -------------------------------------------------------------------------------- /tests/sctp/fb-label-flush: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | 3 | netlabelctl map del default 4 | netlabelctl map add default protocol:unlbl 5 | netlabelctl unlbl del interface:lo address:127.0.0.0/8 label:system_u:object_r:netlabel_sctp_peer_t:s0 6 | netlabelctl unlbl del interface:lo address:::1/128 label:system_u:object_r:netlabel_sctp_peer_t:s0 7 | -------------------------------------------------------------------------------- /tests/sctp/fb-label-load: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | 3 | netlabelctl map del default 4 | netlabelctl map add default address:0.0.0.0/0 protocol:unlbl 5 | netlabelctl map add default address:::/0 protocol:unlbl 6 | netlabelctl unlbl add interface:lo address:127.0.0.0/8 label:system_u:object_r:netlabel_sctp_peer_t:s0 7 | netlabelctl unlbl add interface:lo address:::1/128 label:system_u:object_r:netlabel_sctp_peer_t:s0 8 | #netlabelctl -p unlbl list 9 | -------------------------------------------------------------------------------- /tests/sctp/iptables-flush: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | # Flush the security table after IPv4 and IPv6 tests. 3 | iptables -t security -F 4 | ip6tables -t security -F 5 | -------------------------------------------------------------------------------- /tests/sctp/iptables-load: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | ############################ SECMARK IPTABLE ENTRIES ######################## 3 | # 4 | # Flush the security table first: 5 | iptables -t security -F 6 | ip6tables -t security -F 7 | 8 | #-------------- INPUT IP Stream --------------------# 9 | # These rules will replace the above context if sctp ports 1024:1035 are found in the packets: 10 | iptables -t security -A INPUT -i lo -p sctp -m multiport --port 1024:1035 -j SECMARK --selctx system_u:object_r:test_sctp_server_packet_t:s0 11 | 12 | iptables -t security -A INPUT -m state --state ESTABLISHED,RELATED -j CONNSECMARK --save 13 | 14 | ip6tables -t security -A INPUT -i lo -p sctp -m multiport --port 1024:1035 -j SECMARK --selctx system_u:object_r:test_sctp_server_packet_t:s0 15 | 16 | ip6tables -t security -A INPUT -m state --state ESTABLISHED,RELATED -j CONNSECMARK --save 17 | 18 | #-------------- OUTPUT IP Stream --------------------# 19 | # These rules will replace the above context if sctp ports 1024:1035 are found in the packets: 20 | iptables -t security -A OUTPUT -o lo -p sctp -m multiport --port 1024:1035 -j SECMARK --selctx system_u:object_r:test_sctp_server_packet_t:s0 21 | 22 | iptables -t security -A OUTPUT -m state --state ESTABLISHED,RELATED -j CONNSECMARK --save 23 | 24 | ip6tables -t security -A OUTPUT -o lo -p sctp -m multiport --port 1024:1035 -j SECMARK --selctx system_u:object_r:test_sctp_server_packet_t:s0 25 | 26 | ip6tables -t security -A OUTPUT -m state --state ESTABLISHED,RELATED -j CONNSECMARK --save 27 | 28 | -------------------------------------------------------------------------------- /tests/sctp/nftables-flush: -------------------------------------------------------------------------------- 1 | delete table ip security 2 | delete table ip6 security 3 | -------------------------------------------------------------------------------- /tests/sctp/sctp_common.h: -------------------------------------------------------------------------------- 1 | #ifndef _GNU_SOURCE 2 | #define _GNU_SOURCE /* For poll(2) POLLRDHUP - Detect client close(2) */ 3 | #endif 4 | 5 | #include 6 | #include 7 | #include 8 | #include 9 | #include 10 | #include 11 | #include 12 | #include 13 | #include 14 | #include 15 | #include 16 | #include 17 | #include 18 | #include 19 | #include 20 | #include 21 | #include 22 | 23 | enum event_ret { 24 | EVENT_OK, 25 | EVENT_ADDR_MATCH, 26 | EVENT_SHUTDOWN, 27 | EVENT_NO_AUTH 28 | }; 29 | 30 | int cmp_context_mls(const char *a, const char *b); 31 | int cmp_context_type_mls(const char *a, const char *b); 32 | void print_context(int fd, char *text); 33 | void print_addr_info(struct sockaddr *sin, char *text); 34 | char *get_ip_option(int fd, bool ipv4, socklen_t *opt_len); 35 | void print_ip_option(int fd, bool ipv4, char *text); 36 | int set_subscr_events(int fd, int data_io, int assoc, int addr, int shutd); 37 | int handle_event(void *buf, char *cmp_addr, sctp_assoc_t *assoc_id, 38 | bool verbose, char *text); 39 | -------------------------------------------------------------------------------- /tests/secretmem/.gitignore: -------------------------------------------------------------------------------- 1 | secretmem 2 | -------------------------------------------------------------------------------- /tests/secretmem/Makefile: -------------------------------------------------------------------------------- 1 | TARGETS=secretmem 2 | 3 | all: $(TARGETS) 4 | clean: 5 | rm -f $(TARGETS) 6 | -------------------------------------------------------------------------------- /tests/secretmem/test: -------------------------------------------------------------------------------- 1 | #!/usr/bin/perl 2 | 3 | use Test::More; 4 | 5 | BEGIN { 6 | $basedir = $0; 7 | $basedir =~ s|(.*)/[^/]*|$1|; 8 | 9 | $result = 10 | system "runcon -t test_nocreate_secretmem_t $basedir/secretmem check"; 11 | if ( $result ne 0 ) { 12 | plan skip_all => "memfd_secret(2) not available"; 13 | } 14 | else { 15 | plan tests => 6; 16 | } 17 | } 18 | 19 | $result = system "runcon -t test_nocreate_secretmem_t $basedir/secretmem"; 20 | ok( $result >> 8 eq 1 ); 21 | 22 | $result = system "runcon -t test_create_secretmem_t $basedir/secretmem"; 23 | ok( $result eq 0 ); 24 | 25 | $result = system "runcon -t test_create_secretmem_t $basedir/secretmem wx"; 26 | ok( $result >> 8 eq 1 ); 27 | 28 | $result = system "runcon -t test_create_wx_secretmem_t $basedir/secretmem wx"; 29 | ok( $result >> 8 eq 1 ); 30 | 31 | $result = 32 | system "runcon -t test_nocreate_transition_secretmem_t $basedir/secretmem"; 33 | ok( $result >> 8 eq 1 ); 34 | 35 | $result = 36 | system "runcon -t test_create_transition_secretmem_t $basedir/secretmem"; 37 | ok( $result eq 0 ); 38 | 39 | exit; 40 | -------------------------------------------------------------------------------- /tests/sem/.gitignore: -------------------------------------------------------------------------------- 1 | getinfo 2 | semctl 3 | semget 4 | semop 5 | -------------------------------------------------------------------------------- /tests/sem/Makefile: -------------------------------------------------------------------------------- 1 | TARGETS=$(patsubst %.c,%,$(wildcard *.c)) 2 | all: $(TARGETS) 3 | clean: 4 | rm -f $(TARGETS) 5 | -------------------------------------------------------------------------------- /tests/sem/getinfo.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | 7 | #if defined(__GNU_LIBRARY__) && !defined(_SEM_SEMUN_UNDEFINED) 8 | /* union semun is defined by including */ 9 | #else 10 | /* according to X/OPEN we have to define it ourselves */ 11 | union semun { 12 | int val; /* value for SETVAL */ 13 | struct semid_ds *buf; /* buffer for IPC_STAT, IPC_SET */ 14 | unsigned short int *array; /* array for GETALL, SETALL */ 15 | struct seminfo *__buf; /* buffer for IPC_INFO */ 16 | }; 17 | #endif 18 | 19 | int main(int argc, char **argv) 20 | { 21 | int error; 22 | union semun arg; 23 | struct seminfo seminfo; 24 | 25 | arg.array = (ushort *) &seminfo; 26 | error = semctl(0, 0, SEM_INFO, arg); 27 | printf ("semctl: SEM_INFO result = %d\n", error); 28 | 29 | return (error < 0); 30 | } 31 | -------------------------------------------------------------------------------- /tests/sem/semget.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | 7 | int main(int argc, char **argv) 8 | { 9 | int ch; 10 | int num = 1; 11 | int key = 0x8888; 12 | int id; 13 | 14 | while ((ch = getopt(argc, argv, "k:-n:")) != EOF) { 15 | switch (ch) { 16 | case 'k': 17 | key = atoi(optarg); 18 | break; 19 | case 'n': 20 | num = atoi(optarg); 21 | break; 22 | } 23 | } 24 | 25 | id = semget(key, num, IPC_CREAT | 0777); 26 | if (id == -1) 27 | return 1; 28 | printf("semget succeeded: key = %d, id = %d\n", key, id); 29 | 30 | return 0; 31 | } 32 | -------------------------------------------------------------------------------- /tests/sem/semop.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | 7 | int main(int argc, char **argv) 8 | { 9 | int ch; 10 | int num = 1; 11 | int key = 0x8888; 12 | int id; 13 | int error; 14 | struct sembuf buf; 15 | 16 | while ((ch = getopt(argc, argv, "k:-n:")) != EOF) { 17 | switch (ch) { 18 | case 'k': 19 | key = atoi(optarg); 20 | break; 21 | case 'n': 22 | num = atoi(optarg); 23 | break; 24 | } 25 | } 26 | 27 | id = semget(key, num, IPC_CREAT | 0777); 28 | if (id == -1) 29 | return 1; 30 | 31 | buf.sem_num = 0; 32 | buf.sem_op = 1; 33 | buf.sem_flg = IPC_NOWAIT; 34 | error = semop(id, &buf, 1); 35 | printf("semop: returned %d\n", error); 36 | return error; 37 | } 38 | -------------------------------------------------------------------------------- /tests/setattr/Makefile: -------------------------------------------------------------------------------- 1 | all: 2 | clean: 3 | rm -f test_file 4 | -------------------------------------------------------------------------------- /tests/setattr/test: -------------------------------------------------------------------------------- 1 | #!/usr/bin/perl 2 | 3 | use Test; 4 | BEGIN { plan tests => 4 } 5 | 6 | $basedir = $0; 7 | $basedir =~ s|(.*)/[^/]*|$1|; 8 | 9 | # Remove any leftover test file from prior failed runs. 10 | system("rm -rf $basedir/test_file"); 11 | 12 | # Create a test file with the test_setattr_file_t type for use in the tests. 13 | system("touch $basedir/test_file"); 14 | system("chcon -t test_setattr_file_t $basedir/test_file"); 15 | 16 | # Verify that test_setattr_t can set attributes on the file. 17 | $result = system("runcon -t test_setattr_t chown root $basedir/test_file 2>&1"); 18 | ok( $result, 0 ); 19 | $result = system("runcon -t test_setattr_t chmod 0755 $basedir/test_file 2>&1"); 20 | ok( $result, 0 ); 21 | 22 | # Verify that test_nosetattr_t cannot set attributes on the file. 23 | $result = 24 | system("runcon -t test_nosetattr_t chown nobody $basedir/test_file 2>&1"); 25 | ok($result); 26 | $result = 27 | system("runcon -t test_nosetattr_t chmod 0644 $basedir/test_file 2>&1"); 28 | ok($result); 29 | 30 | # Cleanup. 31 | system("rm -rf $basedir/test_file"); 32 | 33 | -------------------------------------------------------------------------------- /tests/setnice/.gitignore: -------------------------------------------------------------------------------- 1 | child 2 | parent 3 | -------------------------------------------------------------------------------- /tests/setnice/Makefile: -------------------------------------------------------------------------------- 1 | TARGETS=parent child 2 | 3 | LDLIBS += -lselinux 4 | 5 | all: $(TARGETS) 6 | clean: 7 | rm -f $(TARGETS) 8 | -------------------------------------------------------------------------------- /tests/setnice/child.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | 5 | int main(void) 6 | { 7 | char buf[1]; 8 | int rc; 9 | 10 | buf[0] = 0; 11 | rc = write(1, buf, sizeof buf); 12 | if (rc < 0) { 13 | perror("write"); 14 | exit(-1); 15 | } 16 | rc = read(0, buf, sizeof buf); 17 | if (rc < 0) { 18 | perror("read"); 19 | exit(-1); 20 | } 21 | exit(0); 22 | } 23 | 24 | -------------------------------------------------------------------------------- /tests/setnice/test: -------------------------------------------------------------------------------- 1 | #!/usr/bin/perl 2 | 3 | use Test; 4 | BEGIN { plan tests => 2 } 5 | 6 | $basedir = $0; 7 | $basedir =~ s|(.*)/[^/]*|$1|; 8 | 9 | # Verify that test_setnice_change_t can have nice set by test_setnice_set_t 10 | $result = system( 11 | "runcon -t test_setnice_change_t $basedir/parent test_setnice_set_t $basedir/child 2>&1" 12 | ); 13 | ok( $result, 0 ); # we expect this to succeed. 14 | 15 | # Verify that test_setnice_change_t cannot have nice set by test_setnice_noset_t 16 | # Should fail on setsched permission. 17 | $result = system( 18 | "runcon -t test_setnice_change_t $basedir/parent test_setnice_noset_t $basedir/child 2>&1" 19 | ); 20 | ok($result); # we expect this to fail. 21 | -------------------------------------------------------------------------------- /tests/shm/.gitignore: -------------------------------------------------------------------------------- 1 | shmat 2 | shmctl 3 | shmget 4 | -------------------------------------------------------------------------------- /tests/shm/Makefile: -------------------------------------------------------------------------------- 1 | TARGETS=$(patsubst %.c,%,$(wildcard *.c)) 2 | all: $(TARGETS) 3 | clean: 4 | rm -f $(TARGETS) 5 | -------------------------------------------------------------------------------- /tests/shm/shmat.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include 7 | 8 | int main(int argc, char **argv) 9 | { 10 | int ch; 11 | int key = 0x8888; 12 | int id; 13 | int error; 14 | char *buf; 15 | 16 | while ((ch = getopt(argc, argv, "k:")) != -1) { 17 | switch (ch) { 18 | case 'k': 19 | key = atoi(optarg); 20 | break; 21 | } 22 | } 23 | 24 | id = shmget(key, 2048, IPC_CREAT | 0777); 25 | if (id == -1) 26 | return 1; 27 | 28 | buf = shmat(id, 0, 0); 29 | error = (buf == (void *) - 1) ? -1 : 0; 30 | printf("shmat: buf=%p, returned %d\n", buf, error); 31 | return error; 32 | } 33 | -------------------------------------------------------------------------------- /tests/shm/shmctl.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include 7 | 8 | int main(int argc, char **argv) 9 | { 10 | int ch; 11 | int key = 0x8888; 12 | int id; 13 | int error; 14 | struct shmid_ds buf; 15 | 16 | while ((ch = getopt(argc, argv, "k:")) != -1) { 17 | switch (ch) { 18 | case 'k': 19 | key = atoi(optarg); 20 | break; 21 | } 22 | } 23 | 24 | id = shmget(key, 2048, IPC_CREAT | 0777); 25 | if (id == -1) 26 | return 1; 27 | 28 | /* 29 | * Equivalent: IPC_STAT, SHM_STAT 30 | * Tests: SHM__GETATTR | SHM__ASSOCIATE 31 | */ 32 | error = shmctl(id, IPC_STAT, &buf); 33 | printf ("%d", error); 34 | 35 | /* 36 | * Equivalent: IPC_SET 37 | * Tests: SHM__SETATTR 38 | */ 39 | error = shmctl(id, IPC_SET, &buf); 40 | printf (" %d", error); 41 | 42 | 43 | /* 44 | * Equivalent: SHM_LOCK, SHM_UNLOCK 45 | * Tests: SHM__LOCK 46 | */ 47 | error = shmctl(id, SHM_LOCK, NULL); 48 | printf (" %d", error); 49 | 50 | /* 51 | * Equivalent: IPC_RMID 52 | * Tests: SHM__DESTROY 53 | */ 54 | error = shmctl(id, IPC_RMID, NULL); 55 | printf (" %d", error); 56 | 57 | printf("\n"); 58 | return 0; 59 | } 60 | -------------------------------------------------------------------------------- /tests/shm/shmget.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include 7 | 8 | int main(int argc, char **argv) 9 | { 10 | int ch; 11 | int key = 0x8888; 12 | int id; 13 | 14 | while ((ch = getopt(argc, argv, "k:")) != -1) { 15 | switch (ch) { 16 | case 'k': 17 | key = atoi(optarg); 18 | break; 19 | } 20 | } 21 | 22 | id = shmget(key, 2048, IPC_CREAT | 0777); 23 | if (id == -1) 24 | return 1; 25 | printf("shmget succeeded: key = %d, id = %d\n", key, id); 26 | 27 | return 0; 28 | } 29 | -------------------------------------------------------------------------------- /tests/sigkill/.gitignore: -------------------------------------------------------------------------------- 1 | server 2 | -------------------------------------------------------------------------------- /tests/sigkill/Makefile: -------------------------------------------------------------------------------- 1 | all: server 2 | clean: 3 | rm -f server flag 4 | -------------------------------------------------------------------------------- /tests/sigkill/server.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | 5 | void handler(int sig) 6 | { 7 | return; 8 | } 9 | 10 | int main(int argc, char **argv) 11 | { 12 | struct sigaction sa; 13 | int i; 14 | FILE *f; 15 | 16 | if (argc != 2) { 17 | fprintf(stderr, "Need flag file argument!\n"); 18 | exit(1); 19 | } 20 | 21 | sa.sa_handler = handler; 22 | sigemptyset(&sa.sa_mask); 23 | sa.sa_flags = 0; 24 | for (i = 0; i < 32; i++) { 25 | sigaction(i, &sa, NULL); 26 | } 27 | 28 | f = fopen(argv[1], "w"); 29 | if (!f) { 30 | perror("Flag file open"); 31 | exit(1); 32 | } 33 | fprintf(f, "listening\n"); 34 | fclose(f); 35 | 36 | while (1) 37 | ; 38 | } 39 | -------------------------------------------------------------------------------- /tests/stat/Makefile: -------------------------------------------------------------------------------- 1 | all: 2 | clean: 3 | rm -f test_file 4 | -------------------------------------------------------------------------------- /tests/stat/test: -------------------------------------------------------------------------------- 1 | #!/usr/bin/perl 2 | 3 | use Test; 4 | BEGIN { plan tests => 2 } 5 | 6 | $basedir = $0; 7 | $basedir =~ s|(.*)/[^/]*|$1|; 8 | 9 | # Remove any leftover test file from prior failed runs. 10 | system("rm -rf $basedir/test_file"); 11 | 12 | # Create a test file with the test_stat_file_t type for use in the tests. 13 | system("touch $basedir/test_file"); 14 | system("chcon -t test_stat_file_t $basedir/test_file"); 15 | 16 | # Verify that test_stat_t can get attributes on the file. 17 | $result = system("runcon -t test_stat_t -- ls -l $basedir/test_file 2>&1"); 18 | ok( $result, 0 ); 19 | 20 | # Verify that test_nostat_t cannot get attributes on the file. 21 | $result = system("runcon -t test_nostat_t -- ls -l $basedir/test_file 2>&1"); 22 | ok($result); 23 | 24 | # Cleanup. 25 | system("rm -rf $basedir/test_file"); 26 | 27 | -------------------------------------------------------------------------------- /tests/sysctl/Makefile: -------------------------------------------------------------------------------- 1 | all: 2 | clean: 3 | -------------------------------------------------------------------------------- /tests/sysctl/test: -------------------------------------------------------------------------------- 1 | #!/usr/bin/perl 2 | 3 | use Test; 4 | BEGIN { plan tests => 4 } 5 | 6 | $sysctl = "vm.swappiness"; 7 | $val1 = "20"; 8 | $val2 = "21"; 9 | $val3 = "22"; 10 | $oldval = `/sbin/sysctl -n $sysctl`; 11 | 12 | # set to a known value 13 | system "/sbin/sysctl -w $sysctl=$val1"; 14 | 15 | $result = system "runcon -t test_sysctl_t -- /sbin/sysctl -n $sysctl 2>&1"; 16 | ok( $result, 0 ); 17 | 18 | $result = 19 | system "runcon -t test_sysctl_t -- /sbin/sysctl -w $sysctl=$val2 2>&1"; 20 | ok( $result, 0 ); 21 | 22 | $result = system "runcon -t test_nosysctl_t -- /sbin/sysctl -n $sysctl 2>&1"; 23 | ok($result); 24 | 25 | $result = 26 | system "runcon -t test_nosysctl_t -- /sbin/sysctl -w $sysctl=$val3 2>&1"; 27 | ok($result); 28 | 29 | # restore original value 30 | system "/sbin/sysctl -w $sysctl=$oldval"; 31 | 32 | exit; 33 | -------------------------------------------------------------------------------- /tests/task_create/.gitignore: -------------------------------------------------------------------------------- 1 | parent 2 | -------------------------------------------------------------------------------- /tests/task_create/Makefile: -------------------------------------------------------------------------------- 1 | TARGETS=parent 2 | 3 | all: $(TARGETS) 4 | clean: 5 | rm -f $(TARGETS) 6 | -------------------------------------------------------------------------------- /tests/task_create/parent.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | 6 | int main(void) 7 | { 8 | int pid; 9 | 10 | if ((pid = fork()) < 0) { 11 | perror("fork"); 12 | exit(1); 13 | } 14 | fprintf(stderr, "%d\n", pid); 15 | exit(0); 16 | } 17 | -------------------------------------------------------------------------------- /tests/task_create/test: -------------------------------------------------------------------------------- 1 | #!/usr/bin/perl 2 | 3 | use Test; 4 | BEGIN { plan tests => 2 } 5 | 6 | $basedir = $0; 7 | $basedir =~ s|(.*)/[^/]*|$1|; 8 | 9 | # Verify that test_create_yes_t can fork. 10 | $result = system("runcon -t test_create_yes_t -- $basedir/parent 2>&1"); 11 | ok( $result, 0 ); 12 | 13 | # Verify that test_create_no_t cannot fork. 14 | $result = system("runcon -t test_create_no_t -- $basedir/parent 2>&1"); 15 | ok($result); 16 | 17 | exit; 18 | 19 | -------------------------------------------------------------------------------- /tests/task_getpgid/.gitignore: -------------------------------------------------------------------------------- 1 | source 2 | -------------------------------------------------------------------------------- /tests/task_getpgid/Makefile: -------------------------------------------------------------------------------- 1 | all: source 2 | clean: 3 | rm -f source flag 4 | -------------------------------------------------------------------------------- /tests/task_getpgid/source.c: -------------------------------------------------------------------------------- 1 | #ifndef _GNU_SOURCE 2 | #define _GNU_SOURCE 3 | #endif 4 | #include 5 | #include 6 | #include 7 | 8 | int main(int argc, char *argv[]) 9 | { 10 | pid_t pid, group_id; 11 | 12 | if (argc != 2) { 13 | fprintf(stderr, "Usage: %s pid\n", argv[0]); 14 | exit(-1); 15 | } 16 | pid = (pid_t) atol(argv[1]); 17 | printf("pid = %d \n", pid); 18 | if ((group_id = getpgid(pid)) < 0) { 19 | perror("getpgid"); 20 | exit(1); 21 | } 22 | printf("group ID = %d\n", group_id); 23 | exit(0); 24 | } 25 | -------------------------------------------------------------------------------- /tests/task_getpgid/test: -------------------------------------------------------------------------------- 1 | #!/usr/bin/perl 2 | 3 | use Test; 4 | BEGIN { plan tests => 2 } 5 | 6 | $basedir = $0; 7 | $basedir =~ s|(.*)/[^/]*|$1|; 8 | 9 | # Start the target process. 10 | system("mkfifo $basedir/flag"); 11 | if ( ( $pid = fork() ) == 0 ) { 12 | exec 13 | "exec runcon -t test_getpgid_target_t sh -c 'echo >$basedir/flag; while :; do :; done'"; 14 | } 15 | 16 | # Wait for it to start. 17 | open( my $f, "<", "$basedir/flag" ); 18 | my $rin = ''; 19 | vec( $rin, fileno($f), 1 ) = 1; 20 | select( $rin, undef, undef, 5 ); 21 | close($f); 22 | 23 | # Verify that test_getpgid_yes_t can get the target's process group ID. 24 | $result = system "runcon -t test_getpgid_yes_t -- $basedir/source $pid 2>&1"; 25 | ok( $result, 0 ); 26 | 27 | # Verify that test_getpgid_no_t cannot get the target's process group ID. 28 | $result = system "runcon -t test_getpgid_no_t -- $basedir/source $pid 2>&1"; 29 | ok($result); 30 | 31 | # Kill the target 32 | kill KILL, $pid; 33 | 34 | # Clean up. 35 | system "rm -f $basedir/flag"; 36 | 37 | exit; 38 | -------------------------------------------------------------------------------- /tests/task_getscheduler/.gitignore: -------------------------------------------------------------------------------- 1 | source 2 | -------------------------------------------------------------------------------- /tests/task_getscheduler/Makefile: -------------------------------------------------------------------------------- 1 | all: source 2 | clean: 3 | rm -f source flag 4 | -------------------------------------------------------------------------------- /tests/task_getscheduler/source.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | 6 | int main(int argc, char *argv[]) 7 | { 8 | pid_t pid; 9 | int policy; 10 | 11 | if (argc != 2) { 12 | fprintf(stderr, "Usage: %s pid\n", argv[0]); 13 | exit(-1); 14 | } 15 | pid = (pid_t) atol(argv[1]); 16 | printf("pid = %d \n", pid); 17 | if ((policy = sched_getscheduler(pid)) < 0) { 18 | perror("sched_getscheduler"); 19 | exit(1); 20 | } 21 | printf("policy = %d\n", policy); 22 | exit(0); 23 | } 24 | -------------------------------------------------------------------------------- /tests/task_getscheduler/test: -------------------------------------------------------------------------------- 1 | #!/usr/bin/perl 2 | 3 | use Test; 4 | BEGIN { plan tests => 2 } 5 | 6 | $basedir = $0; 7 | $basedir =~ s|(.*)/[^/]*|$1|; 8 | 9 | # Start the target process. 10 | system("mkfifo $basedir/flag"); 11 | if ( ( $pid = fork() ) == 0 ) { 12 | exec 13 | "exec runcon -t test_getsched_target_t sh -c 'echo >$basedir/flag; while :; do :; done'"; 14 | } 15 | 16 | # Wait for it to start. 17 | open( my $f, "<", "$basedir/flag" ); 18 | my $rin = ''; 19 | vec( $rin, fileno($f), 1 ) = 1; 20 | select( $rin, undef, undef, 5 ); 21 | close($f); 22 | 23 | # Verify that test_getsched_yes_t can get the scheduling. 24 | # SCHED_OTHER 0 priority must == 0 25 | # SCHED_FIFO 1 priority 1..99 26 | # SCHED_RR 2 priority 1..99 27 | $result = system "runcon -t test_getsched_yes_t -- $basedir/source $pid 2>&1"; 28 | ok( $result, 0 ); 29 | 30 | # Verify that test_getsched_no_t cannot get the scheduling. 31 | $result = system "runcon -t test_getsched_no_t -- $basedir/source $pid 2>&1"; 32 | ok($result); 33 | 34 | # Kill the target 35 | kill KILL, $pid; 36 | 37 | # Clean up. 38 | system "rm -f $basedir/flag"; 39 | 40 | exit; 41 | -------------------------------------------------------------------------------- /tests/task_getsid/.gitignore: -------------------------------------------------------------------------------- 1 | source 2 | -------------------------------------------------------------------------------- /tests/task_getsid/Makefile: -------------------------------------------------------------------------------- 1 | all: source 2 | clean: 3 | rm -f source flag 4 | -------------------------------------------------------------------------------- /tests/task_getsid/source.c: -------------------------------------------------------------------------------- 1 | #ifndef _GNU_SOURCE 2 | #define _GNU_SOURCE 3 | #endif 4 | #include 5 | #include 6 | #include 7 | 8 | int main(int argc, char *argv[]) 9 | { 10 | pid_t pid, session_id; 11 | 12 | if (argc != 2) { 13 | fprintf(stderr, "Usage: %s pid\n", argv[0]); 14 | exit(-1); 15 | } 16 | pid = (pid_t) atol(argv[1]); 17 | printf("pid = %d \n", pid); 18 | if ((session_id = getsid(pid)) < 0) { 19 | perror("getsid"); 20 | exit(1); 21 | } 22 | printf("session ID = %d\n", session_id); 23 | exit(0); 24 | } 25 | -------------------------------------------------------------------------------- /tests/task_getsid/test: -------------------------------------------------------------------------------- 1 | #!/usr/bin/perl 2 | 3 | use Test; 4 | BEGIN { plan tests => 2 } 5 | 6 | $basedir = $0; 7 | $basedir =~ s|(.*)/[^/]*|$1|; 8 | 9 | # Start the target process. 10 | system("mkfifo $basedir/flag"); 11 | if ( ( $pid = fork() ) == 0 ) { 12 | exec 13 | "exec runcon -t test_getsid_target_t sh -c 'echo >$basedir/flag; while :; do :; done'"; 14 | } 15 | 16 | # Wait for it to start. 17 | open( my $f, "<", "$basedir/flag" ); 18 | my $rin = ''; 19 | vec( $rin, fileno($f), 1 ) = 1; 20 | select( $rin, undef, undef, 5 ); 21 | close($f); 22 | 23 | # Verify that test_getsid_yes_t can get the session ID. 24 | $result = system "runcon -t test_getsid_yes_t -- $basedir/source $pid 2>&1"; 25 | ok( $result, 0 ); 26 | 27 | # Verify that test_getsid_no_t cannot get the session ID. 28 | $result = system "runcon -t test_getsid_no_t -- $basedir/source $pid 2>&1"; 29 | ok($result); 30 | 31 | # Kill the target 32 | kill KILL, $pid; 33 | 34 | # Clean up. 35 | system "rm -f $basedir/flag"; 36 | 37 | exit; 38 | -------------------------------------------------------------------------------- /tests/task_setnice/Makefile: -------------------------------------------------------------------------------- 1 | all: 2 | clean: 3 | rm -f flag 4 | -------------------------------------------------------------------------------- /tests/task_setnice/test: -------------------------------------------------------------------------------- 1 | #!/usr/bin/perl 2 | 3 | use Test; 4 | BEGIN { plan tests => 4 } 5 | 6 | $basedir = $0; 7 | $basedir =~ s|(.*)/[^/]*|$1|; 8 | 9 | # Start the process that will have its priority changed. 10 | system("mkfifo $basedir/flag"); 11 | if ( ( $pid = fork() ) == 0 ) { 12 | exec 13 | "exec runcon -t test_setsched_target_t sh -c 'echo >$basedir/flag; while :; do :; done'"; 14 | } 15 | 16 | # Wait for it to start. 17 | open( my $f, "<", "$basedir/flag" ); 18 | my $rin = ''; 19 | vec( $rin, fileno($f), 1 ) = 1; 20 | select( $rin, undef, undef, 5 ); 21 | close($f); 22 | 23 | # Verify that test_setsched_yes_t can change the priority up and down. 24 | $result = system "runcon -t test_setsched_yes_t -- renice +10 -p $pid 2>&1"; 25 | ok( $result, 0 ); 26 | 27 | # Giving the process a higher priority (lower nice number) requires the 28 | # sys_nice capability 29 | $result = system "runcon -t test_setsched_yes_t -- renice -20 -p $pid 2>&1"; 30 | ok( $result, 0 ); 31 | 32 | # Verify that test_setsched_no_t cannot change the priority up or down. 33 | $result = system "runcon -t test_setsched_no_t -- renice +10 -p $pid 2>&1"; 34 | ok($result); 35 | $result = system "runcon -t test_setsched_no_t -- renice -20 -p $pid 2>&1"; 36 | ok($result); 37 | 38 | # Kill the target 39 | kill KILL, $pid; 40 | 41 | # Clean up. 42 | system "rm -f $basedir/flag"; 43 | 44 | exit; 45 | -------------------------------------------------------------------------------- /tests/task_setpgid/.gitignore: -------------------------------------------------------------------------------- 1 | source 2 | -------------------------------------------------------------------------------- /tests/task_setpgid/Makefile: -------------------------------------------------------------------------------- 1 | TARGETS=source 2 | 3 | all: $(TARGETS) 4 | clean: 5 | rm -f $(TARGETS) 6 | -------------------------------------------------------------------------------- /tests/task_setpgid/source.c: -------------------------------------------------------------------------------- 1 | #ifndef _GNU_SOURCE 2 | #define _GNU_SOURCE 3 | #endif 4 | #include 5 | #include 6 | #include 7 | #include 8 | 9 | int main(void) 10 | { 11 | pid_t pid, group_id; 12 | 13 | pid = getpid(); 14 | if ((group_id = getpgid(pid)) < 0) { 15 | perror("getpgid"); 16 | exit(-1); 17 | } 18 | printf("Group ID = %d\n", group_id); 19 | if (setpgid(pid, pid) < 0) { 20 | perror("setpgid"); 21 | exit(1); 22 | } 23 | if ((group_id = getpgid(pid)) < 0) { 24 | perror("getpgid"); 25 | exit(-1); 26 | } 27 | printf("Group ID = %d\n", group_id); 28 | printf("pid = %d\n", pid); 29 | exit(0); 30 | } 31 | -------------------------------------------------------------------------------- /tests/task_setpgid/test: -------------------------------------------------------------------------------- 1 | #!/usr/bin/perl 2 | 3 | use Test; 4 | BEGIN { plan tests => 2 } 5 | 6 | $basedir = $0; 7 | $basedir =~ s|(.*)/[^/]*|$1|; 8 | 9 | # Verify that test_setpgid_yes_t can setpgid. 10 | $result = system("runcon -t test_setpgid_yes_t -- $basedir/source 2>&1"); 11 | ok( $result, 0 ); 12 | 13 | # Verify that test_setpgid_no_t cannot setpgid. 14 | $result = system("runcon -t test_setpgid_no_t -- $basedir/source 2>&1"); 15 | ok($result); 16 | 17 | exit; 18 | 19 | -------------------------------------------------------------------------------- /tests/task_setscheduler/.gitignore: -------------------------------------------------------------------------------- 1 | source 2 | -------------------------------------------------------------------------------- /tests/task_setscheduler/Makefile: -------------------------------------------------------------------------------- 1 | all: source 2 | clean: 3 | rm -f source flag 4 | -------------------------------------------------------------------------------- /tests/task_setscheduler/source.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | 6 | int main(int argc, char *argv[]) 7 | { 8 | pid_t pid; 9 | int policy; 10 | struct sched_param p; 11 | 12 | if (argc != 4) { 13 | fprintf(stderr, "Usage: %s pid policy priority\n", argv[0]); 14 | exit(-1); 15 | } 16 | pid = atol(argv[1]); 17 | policy = atol(argv[2]); 18 | if (policy > 2) { 19 | policy = SCHED_OTHER; /* the default scheduler */ 20 | } 21 | p.sched_priority = atol(argv[3]); 22 | printf("pid = %d \t policy = %d \t priority = %d\n", 23 | pid, policy, p.sched_priority); 24 | if (sched_setscheduler(pid, policy, &p) < 0) { 25 | perror("sched_setscheduler"); 26 | exit(1); 27 | } 28 | 29 | exit(0); 30 | } 31 | -------------------------------------------------------------------------------- /tests/task_setscheduler/test: -------------------------------------------------------------------------------- 1 | #!/usr/bin/perl 2 | 3 | use Test; 4 | BEGIN { plan tests => 2 } 5 | 6 | $basedir = $0; 7 | $basedir =~ s|(.*)/[^/]*|$1|; 8 | 9 | # Start the process that will have its priority and scheduling changed. 10 | system("mkfifo $basedir/flag"); 11 | if ( ( $pid = fork() ) == 0 ) { 12 | exec 13 | "exec runcon -t test_setsched_target_t sh -c 'echo >$basedir/flag; while :; do sleep 1; done'"; 14 | } 15 | 16 | # Wait for it to start. 17 | open( my $f, "<", "$basedir/flag" ); 18 | my $rin = ''; 19 | vec( $rin, fileno($f), 1 ) = 1; 20 | select( $rin, undef, undef, 5 ); 21 | close($f); 22 | 23 | $cgroup_cpu = "/sys/fs/cgroup/cpu/tasks"; 24 | if ( -w $cgroup_cpu ) { 25 | 26 | # We can only set the scheduler policy fo SCHED_{RR,FIFO} in the root 27 | # cgroup so move our target process to the root cgroup. 28 | open( my $fd, ">>", $cgroup_cpu ); 29 | print $fd $pid; 30 | close $fd; 31 | } 32 | 33 | # Verify that test_setsched_yes_t can change the scheduling. 34 | # SCHED_OTHER 0 priority must == 0 35 | # SCHED_FIFO 1 priority 1..99 36 | # SCHED_RR 2 priority 1..99 37 | $result = 38 | system "runcon -t test_setsched_yes_t -- $basedir/source $pid 2 1 2>&1"; 39 | ok( $result, 0 ); 40 | 41 | # Verify that test_setsched_no_t cannot change the scheduling. 42 | $result = 43 | system "runcon -t test_setsched_no_t -- $basedir/source $pid 2 1 2>&1"; 44 | ok($result); 45 | 46 | # Kill the target 47 | kill KILL, $pid; 48 | 49 | # Clean up. 50 | system "rm -f $basedir/flag"; 51 | 52 | exit; 53 | -------------------------------------------------------------------------------- /tests/tun_tap/.gitignore: -------------------------------------------------------------------------------- 1 | tun_tap 2 | tun_relabel 3 | -------------------------------------------------------------------------------- /tests/tun_tap/Makefile: -------------------------------------------------------------------------------- 1 | TARGETS = tun_tap tun_relabel 2 | DEPS = tun_common.c tun_common.h 3 | LDLIBS += -lselinux 4 | 5 | all: $(TARGETS) 6 | 7 | clean: 8 | rm -f $(TARGETS) 9 | 10 | $(TARGETS): $(DEPS) 11 | -------------------------------------------------------------------------------- /tests/tun_tap/tun_common.h: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include 7 | #include 8 | #include 9 | #include 10 | #include 11 | #include 12 | #include 13 | #include 14 | 15 | extern int open_dev(int *fd, char *test_str, bool verbose); 16 | extern int setiff(int fd, struct ifreq *ifr, bool verbose); 17 | /* Persistent state 'op': 0 = unset, 1 = set */ 18 | extern int persist(int fd, int op, char *name, bool verbose); 19 | /* Queue state 'op': 0 = IFF_DETACH_QUEUE, 1 = IFF_ATTACH_QUEUE */ 20 | extern int tunsetqueue(int fd, int op, char *name, bool verbose); 21 | extern int switch_context(const char *newcon, bool verbose); 22 | extern void del_tuntap_name(int fd, char *context, char *name, bool verbose); 23 | -------------------------------------------------------------------------------- /tests/unix_socket/.gitignore: -------------------------------------------------------------------------------- 1 | client 2 | server 3 | socketpair 4 | -------------------------------------------------------------------------------- /tests/unix_socket/Makefile: -------------------------------------------------------------------------------- 1 | TARGETS=client server socketpair 2 | 3 | LDLIBS+= -lselinux 4 | 5 | all: $(TARGETS) 6 | clean: 7 | rm -f $(TARGETS) flag test_client_sock test_server_sock 8 | -------------------------------------------------------------------------------- /tests/userfaultfd/.gitignore: -------------------------------------------------------------------------------- 1 | userfaultfd 2 | -------------------------------------------------------------------------------- /tests/userfaultfd/Makefile: -------------------------------------------------------------------------------- 1 | TARGETS=userfaultfd 2 | 3 | LDLIBS += -lpthread 4 | 5 | all: $(TARGETS) 6 | clean: 7 | rm -f $(TARGETS) 8 | -------------------------------------------------------------------------------- /tests/userfaultfd/test: -------------------------------------------------------------------------------- 1 | #!/usr/bin/perl 2 | 3 | use Test::More; 4 | 5 | BEGIN { 6 | $basedir = $0; 7 | $basedir =~ s|(.*)/[^/]*|$1|; 8 | 9 | $result = system 10 | "runcon -t test_notransition_uffd_t $basedir/userfaultfd test_notransition_uffd_t"; 11 | if ( $result >> 8 == 8 ) { 12 | plan skip_all => "SELinux support for userfaultfd not present"; 13 | } 14 | else { 15 | plan tests => 9; 16 | } 17 | } 18 | 19 | $result = system 20 | "runcon -t test_notransition_uffd_t $basedir/userfaultfd test_notransition_uffd_t"; 21 | ok( $result eq 0 ); 22 | 23 | $result = system "runcon -t test_uffd_t $basedir/userfaultfd uffd_t"; 24 | ok( $result eq 0 ); 25 | 26 | $result = system "runcon -t test_nocreate_uffd_t $basedir/userfaultfd uffd_t"; 27 | ok( $result >> 8 eq 1 ); 28 | 29 | $result = system "runcon -t test_nogetattr_uffd_t $basedir/userfaultfd uffd_t"; 30 | ok( $result >> 8 eq 2 ); 31 | 32 | $result = system "runcon -t test_noioctl_uffd_t $basedir/userfaultfd uffd_t"; 33 | ok( $result >> 8 eq 4 ); 34 | 35 | $result = system "runcon -t test_api_ioctl_uffd_t $basedir/userfaultfd uffd_t"; 36 | ok( $result >> 8 eq 5 ); 37 | 38 | $result = system "runcon -t test_noread_uffd_t $basedir/userfaultfd uffd_t"; 39 | ok( $result >> 8 eq 6 ); 40 | 41 | $result = 42 | system "runcon -t test_register_ioctl_uffd_t $basedir/userfaultfd uffd_t"; 43 | ok( $result >> 8 eq 7 ); 44 | 45 | $result = system "runcon -t test_copy_ioctl_uffd_t $basedir/userfaultfd uffd_t"; 46 | ok( $result eq 0 ); 47 | 48 | exit; 49 | -------------------------------------------------------------------------------- /tests/vsock_socket/.gitignore: -------------------------------------------------------------------------------- 1 | client 2 | server 3 | -------------------------------------------------------------------------------- /tests/vsock_socket/Makefile: -------------------------------------------------------------------------------- 1 | TARGETS=client server 2 | 3 | LDLIBS+= -lselinux 4 | 5 | all: $(TARGETS) 6 | clean: 7 | rm -f $(TARGETS) flag 8 | -------------------------------------------------------------------------------- /tests/watchkey/.gitignore: -------------------------------------------------------------------------------- 1 | watchkey 2 | -------------------------------------------------------------------------------- /tests/watchkey/Makefile: -------------------------------------------------------------------------------- 1 | TARGETS = watchkey 2 | LDLIBS += -lselinux 3 | 4 | all: $(TARGETS) 5 | 6 | clean: 7 | rm -f $(TARGETS) 8 | -------------------------------------------------------------------------------- /tests/watchkey/test: -------------------------------------------------------------------------------- 1 | #!/usr/bin/perl 2 | use Test::More; 3 | 4 | BEGIN { 5 | $basedir = $0; 6 | $basedir =~ s|(.*)/[^/]*|$1|; 7 | 8 | # allow info to be shown during tests 9 | $v = $ARGV[0]; 10 | if ($v) { 11 | if ( $v ne "-v" ) { 12 | plan skip_all => "Invalid option (use -v)"; 13 | } 14 | } 15 | else { 16 | $v = " "; 17 | } 18 | 19 | $result = system "runcon -t test_watchkey_t $basedir/watchkey $v -c"; 20 | 21 | # check if O_NOTIFICATION_PIPE is supported - ENOPKG 22 | if ( $result >> 8 eq 65 ) { 23 | plan skip_all => 24 | "pipe2(2) does not support O_NOTIFICATION_PIPE; CONFIG_WATCH_QUEUE probably not set"; 25 | } 26 | else { 27 | plan tests => 2; 28 | } 29 | } 30 | 31 | $result = system "runcon -t test_watchkey_t $basedir/watchkey $v"; 32 | ok( $result eq 0 ); 33 | 34 | # Deny key { view } - EACCES 35 | $result = system "runcon -t test_watchkey_no_view_t $basedir/watchkey $v 2>&1"; 36 | ok( $result >> 8 eq 13 ); 37 | 38 | exit; 39 | -------------------------------------------------------------------------------- /tmt/README.md: -------------------------------------------------------------------------------- 1 | # TMT test plans for selinux-testsuite 2 | 3 | This directory contains basic "test plans" for running the selinux-testsuite via the [TMT tool](https://tmt.readthedocs.io/en/stable/). They are primarily intended for the GitHub-Actions-driven CI, but they can be also used directly through `tmt`: 4 | 5 | ```bash 6 | tmt run [-e STS_ROOT_DOMAIN=...] [-e STS_KERNEL=...] \ 7 | plans -f 'tag:-ci' --all provision -h ... 8 | ``` 9 | 10 | See `tmt run provision --help` for information about possible provisioning methods (most useful are `local`, `connect`, or `virtual.testcloud`). 11 | 12 | Possible values for the `STS_ROOT_DOMAIN` env parameter are: 13 | * `unconfined_t` - run the testsuite as an unconfined root. 14 | * `sysadm_t` - run the testsuite as a `sysadm_u:sysadm_r:sysadm_t:...` root. 15 | 16 | Possible values for the `STS_KERNEL` env parameter are: 17 | * `default` - try to use the kernel currently booted on the test machine. 18 | * `latest` - update to the latest kernel available in the repos and boot it. 19 | * `secnext` - install the "secnext" kernel from https://repo.paul-moore.com/ and boot it. 20 | * `local` - use the currently booted kernel and don't try to install additional kernel RPMs - useful for e.g. locally built and installed kernels. 21 | -------------------------------------------------------------------------------- /tmt/plans.fmf: -------------------------------------------------------------------------------- 1 | /run: 2 | summary: Run the testsuite 3 | discover: 4 | how: fmf 5 | filter: tag:-ci 6 | execute: 7 | how: tmt 8 | /run-ci: 9 | summary: Run the CI for the testsuite 10 | tag: [ci] 11 | discover: 12 | how: fmf 13 | execute: 14 | how: tmt 15 | --------------------------------------------------------------------------------