test: automation for 5 selinux testcases #460
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,27 @@ | ||
| metadata: | ||
| format: Lava-Test Test Definition 1.0 | ||
| name: AUSanity | ||
| description: "Baseline AU Sanity test plan" | ||
| maintainer: | ||
| - vnarapar@qti.qualcomm.com | ||
| os: | ||
| - openembedded | ||
| scope: | ||
| - functional | ||
| devices: | ||
| - rb3gen2/rideSX | ||
|
|
||
| run: | ||
| steps: | ||
| - cd Runner | ||
| - $PWD/suites/Kernel/Security/AVCDenials/run.sh || true | ||
| - $PWD/utils/send-to-lava.sh $PWD/suites/Kernel/Security/AVCDenials/AVCDenials.res || true | ||
| - $PWD/suites/Kernel/Security/CheckGetenforce/run.sh || true | ||
| - $PWD/utils/send-to-lava.sh $PWD/suites/Kernel/Security/CheckGetenforce/CheckGetenforce.res || true | ||
|
Contributor
There was a problem hiding this comment. The plan masks send-to-lava.sh failures with || true. If result submission fails, the plan continues and can hide missing or malformed .res files. Impact: LAVA may not reflect actual test results. Recommended fix: keep || true only on run.sh if needed, but let send-to-lava.sh fail visibly, or explicitly check that each .res exists before submitting. |
||
| - $PWD/suites/Kernel/Security/CheckSestatus/run.sh || true | ||
| - $PWD/utils/send-to-lava.sh $PWD/suites/Kernel/Security/CheckSestatus/CheckSestatus.res || true | ||
| - $PWD/suites/Kernel/Security/SystemctlFailedPerVsEnf/run.sh || true | ||
| - $PWD/utils/send-to-lava.sh $PWD/suites/Kernel/Security/SystemctlFailedPerVsEnf/SystemctlFailedPerVsEnf.res || true | ||
| - $PWD/suites/Kernel/Security/ToggleSetenforce/run.sh || true | ||
| - $PWD/utils/send-to-lava.sh $PWD/suites/Kernel/Security/ToggleSetenforce/ToggleSetenforce.res || true | ||
| - $PWD/utils/result_parse.sh | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,15 @@ | ||
| metadata: | ||
| name: AVCDenials | ||
| format: "Lava-Test Test Definition 1.0" | ||
| description: "Collect logs, fetch and parse AVC Denials" | ||
| os: | ||
| - linux | ||
| scope: | ||
| - functional | ||
|
|
||
| run: | ||
| steps: | ||
| - REPO_PATH=$PWD | ||
| - cd Runner/suites/Kernel/Security/AVCDenials | ||
| - ./run.sh || true | ||
| - $REPO_PATH/Runner/utils/send-to-lava.sh AVCDenials.res |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,29 @@ | ||
| ## AVCDenials — SELinux AVC Denial Log Scan | ||
|
|
||
| ## Overview | ||
|
|
||
| Scans system logs for SELinux Access Vector Cache (AVC) denial messages. This test serves to collect and report any audit denials found, which can indicate SELinux policy issues. | ||
|
|
||
| ## What Is Tested | ||
|
|
||
| | Check | Description | | ||
| |---|---| | ||
| | Audit Log | Scans `/var/log/audit/audit.log` for lines containing "avc" if the file exists. | | ||
| | Kernel Log | Scans the output of the `dmesg` command for lines containing "avc". | | ||
|
|
||
| ## Pass / Fail / Skip Criteria | ||
|
|
||
| - **SKIP**: No audit source is available (neither `/var/log/audit/audit.log` nor the `dmesg` command are found) or dependencies like `grep` are missing. | ||
| - **FAIL**: This test does not fail. It is designed to report data. | ||
| - **PASS**: The test always passes after logging any found AVC denials to `avc_denials.txt`. Its purpose is data collection, not strict validation. | ||
|
|
||
| ## Usage | ||
|
|
||
| ```sh | ||
| ./run.sh | ||
| ``` | ||
|
|
||
| ## Dependencies | ||
|
|
||
| - `grep` | ||
| - `dmesg` (or `/var/log/audit/audit.log` as an alternative audit source) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,95 @@ | ||
| #!/bin/sh | ||
|
|
||
| # Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries. | ||
| # SPDX-License-Identifier: BSD-3-Clause | ||
| # Robustly find and source init_env | ||
| SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)" | ||
| INIT_ENV="" | ||
| SEARCH="$SCRIPT_DIR" | ||
| while [ "$SEARCH" != "/" ]; do | ||
| if [ -f "$SEARCH/init_env" ]; then | ||
| INIT_ENV="$SEARCH/init_env" | ||
| break | ||
| fi | ||
| SEARCH=$(dirname "$SEARCH") | ||
| done | ||
|
|
||
| if [ -z "$INIT_ENV" ]; then | ||
| echo "[ERROR] Could not find init_env (starting at $SCRIPT_DIR)" >&2 | ||
| exit 1 | ||
| fi | ||
|
|
||
| # Only source if not already loaded (idempotent) | ||
| if [ -z "$__INIT_ENV_LOADED" ]; then | ||
| # shellcheck disable=SC1090 | ||
| . "$INIT_ENV" | ||
| fi | ||
| # Always source functestlib.sh, using $TOOLS exported by init_env | ||
| # shellcheck disable=SC1090,SC1091 | ||
| . "$TOOLS/functestlib.sh" | ||
|
|
||
| TESTNAME="AVCDenials" | ||
| test_path=$(find_test_case_by_name "$TESTNAME") | ||
| cd "$test_path" || exit 1 | ||
| # shellcheck disable=SC2034 | ||
|
|
||
| RES_FILE="./$TESTNAME.res" | ||
| rm -f "$RES_FILE" | ||
|
|
||
| AVC_Denials="./avc_denials.txt" | ||
| rm -f "$AVC_Denials" | ||
|
|
||
| if [ -f /var/log/audit/audit.log ]; then | ||
| log_info "Using audit.log" | ||
| elif CHECK_DEPS_NO_EXIT=1 check_dependencies dmesg getenforce; then | ||
| log_info "Using dmesg as audit source and selinux is enabled" | ||
| else | ||
| log_skip "$TESTNAME SKIP: No audit source available" | ||
| echo "$TESTNAME SKIP" > "$RES_FILE" | ||
| exit 0 | ||
| fi | ||
|
|
||
| if ! CHECK_DEPS_NO_EXIT=1 check_dependencies grep dmesg; then | ||
| log_skip "$TESTNAME SKIP: missing dependencies" | ||
| echo "$TESTNAME SKIP" > "$RES_FILE" | ||
| exit 0 | ||
| fi | ||
|
|
||
| default_mode=$(getenforce) | ||
|
Contributor
There was a problem hiding this comment. default_mode=$(getenforce) is called even when the earlier path selected /var/log/audit/audit.log and did not verify that getenforce exists. On systems with audit logs but no getenforce, default_mode can be empty and the test can still continue to PASS. The test result no longer accurately reflects SELinux support/state. Recommended fix: check getenforce explicitly before calling it, or make AVC collection independent from SELinux mode validation and remove this mode check. |
||
|
|
||
| if echo "$default_mode" | grep -qiE "disabled"; then | ||
| log_info "SELinux is $default_mode. Testcase Unsupported." | ||
| log_skip "$TESTNAME SKIP: selinux disabled" | ||
| echo "$TESTNAME SKIP" > "$RES_FILE" | ||
| exit 1 | ||
|
Contributor
There was a problem hiding this comment. The script writes SKIP for SELinux disabled but exits with 1. This conflicts with the repo’s LAVA-friendly convention where the .res file carries PASS/FAIL/SKIP and the script exits 0. Recommended fix: after writing "$TESTNAME SKIP", exit 0. |
||
| fi | ||
|
|
||
| log_info "-----------------------------------------------------------------------------------------" | ||
| log_info "-------------------Starting $TESTNAME Testcase----------------------------" | ||
| log_info "=== Test Initialization ===" | ||
|
|
||
| # Fetch from audit.log | ||
| if [ -f /var/log/audit/audit.log ]; then | ||
| den=$(grep avc /var/log/audit/audit.log) | ||
| log_info "Denials in audit.log: " | ||
| log_info "$den" | ||
| echo "$den" > "$AVC_Denials" | ||
| fi | ||
|
|
||
| # Fetch from dmesg | ||
| if CHECK_DEPS_NO_EXIT=1 check_dependencies dmesg; then | ||
| den=$(dmesg | grep avc) | ||
|
Contributor
There was a problem hiding this comment. Please use scan_dmesg_errors function from functestlib.sh |
||
| log_info "Denials in audit.log: " | ||
| log_info "$den" | ||
| echo "$den" >> "$AVC_Denials" | ||
| fi | ||
|
|
||
| # Making test pass in all conditions | ||
| log_info "Denials saved to log file at $AVC_Denials" | ||
| log_pass "$TESTNAME : PASS" | ||
| echo "$TESTNAME PASS" > "$RES_FILE" | ||
|
|
||
|
|
||
|
|
||
|
|
||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,16 @@ | ||
| metadata: | ||
| name: CheckGetenforce | ||
| format: "Lava-Test Test Definition 1.0" | ||
| description: "Check getenforce command output: Check if selinux is unsupported / enforcing / permissive / disabled" | ||
| os: | ||
| - linux | ||
| scope: | ||
| - functional | ||
|
|
||
| run: | ||
| steps: | ||
| - REPO_PATH=$PWD | ||
| - cd Runner/suites/Kernel/Security/CheckGetenforce | ||
| - ./run.sh || true | ||
| - $REPO_PATH/Runner/utils/send-to-lava.sh CheckGetenforce.res | ||
|
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,28 @@ | ||
| ## CheckGetenforce — SELinux Getenforce Validation | ||
|
|
||
| ## Overview | ||
|
|
||
| Validates the `getenforce` command and checks the current SELinux mode to ensure it is either 'Enforcing' or 'Permissive'. | ||
|
|
||
| ## What Is Tested | ||
|
|
||
| | Check | Description | | ||
| |---|---| | ||
| | `getenforce` command | Verifies the `getenforce` command is available on the system. | | ||
| | Current SELinux Mode | Executes `getenforce` to retrieve the current SELinux mode and validates its state. | | ||
|
|
||
| ## Pass / Fail / Skip Criteria | ||
|
|
||
| - **SKIP**: The `getenforce` command is not found. | ||
| - **FAIL**: The SELinux mode is 'Disabled' or returns an unknown state. | ||
| - **PASS**: The SELinux mode is 'Enforcing' or 'Permissive'. | ||
|
|
||
| ## Usage | ||
|
|
||
| ```sh | ||
| ./run.sh | ||
| ``` | ||
|
|
||
| ## Dependencies | ||
|
|
||
| - `getenforce` command-line utility |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,67 @@ | ||
| #!/bin/sh | ||
|
|
||
| # Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries. | ||
| # SPDX-License-Identifier: BSD-3-Clause | ||
| # Robustly find and source init_env | ||
| SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)" | ||
| INIT_ENV="" | ||
| SEARCH="$SCRIPT_DIR" | ||
| while [ "$SEARCH" != "/" ]; do | ||
| if [ -f "$SEARCH/init_env" ]; then | ||
| INIT_ENV="$SEARCH/init_env" | ||
| break | ||
| fi | ||
| SEARCH=$(dirname "$SEARCH") | ||
| done | ||
|
|
||
| if [ -z "$INIT_ENV" ]; then | ||
| echo "[ERROR] Could not find init_env (starting at $SCRIPT_DIR)" >&2 | ||
| exit 1 | ||
| fi | ||
|
|
||
| # Only source if not already loaded (idempotent) | ||
| if [ -z "${__INIT_ENV_LOADED:-}" ]; then | ||
| # shellcheck disable=SC1090 | ||
| . "$INIT_ENV" | ||
| fi | ||
| # Always source functestlib.sh, using $TOOLS exported by init_env | ||
| # shellcheck disable=SC1090,SC1091 | ||
| . "$TOOLS/functestlib.sh" | ||
|
|
||
| TESTNAME="CheckGetenforce" | ||
| test_path=$(find_test_case_by_name "$TESTNAME") | ||
| cd "$test_path" || exit 1 | ||
| # shellcheck disable=SC2034 | ||
|
|
||
| RES_FILE="./$TESTNAME.res" | ||
|
|
||
| if ! CHECK_DEPS_NO_EXIT=1 check_dependencies getenforce; then | ||
| log_skip "$TESTNAME SKIP: missing dependencies" | ||
| echo "$TESTNAME SKIP" > "$RES_FILE" | ||
| exit 0 | ||
| fi | ||
|
|
||
| log_info "-----------------------------------------------------------------------------------------" | ||
| log_info "-------------------Starting $TESTNAME Testcase----------------------------" | ||
| log_info "=== Test Initialization ===" | ||
| op=$(getenforce) | ||
| log_info "Getenforce output: $op" | ||
|
|
||
| echo "SELINUX Default Mode is $op" > getenforce.txt | ||
|
|
||
| if [ "$op" = "Enforcing" ] || [ "$op" = "Permissive" ]; then | ||
| log_info "SELinux is $op. Testcase PASS." | ||
| log_pass "$TESTNAME : PASS" | ||
| echo "$TESTNAME PASS" > "$RES_FILE" | ||
| exit 0 | ||
| elif [ "$op" = "Disabled" ]; then | ||
| log_info "SELinux is Disabled. Testcase FAIL." | ||
| log_fail "$TESTNAME : FAIL" | ||
| echo "$TESTNAME FAIL" > "$RES_FILE" | ||
| exit 1 | ||
|
Contributor
There was a problem hiding this comment. Here as well.. it should be |
||
| else | ||
| log_fail "Unknown SELinux state: $op. Testcase FAIL." | ||
| log_fail "$TESTNAME : FAIL" | ||
| echo "$TESTNAME FAIL" > "$RES_FILE" | ||
| exit 1 | ||
| fi | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,16 @@ | ||
| metadata: | ||
| name: CheckSestatus | ||
| format: "Lava-Test Test Definition 1.0" | ||
| description: "Check sestatus command output: Check if selinux is in enforcing / permissive / disabled" | ||
| os: | ||
| - linux | ||
| scope: | ||
| - functional | ||
|
|
||
| run: | ||
| steps: | ||
| - REPO_PATH=$PWD | ||
| - cd Runner/suites/Kernel/Security/CheckSestatus | ||
| - ./run.sh || true | ||
| - $REPO_PATH/Runner/utils/send-to-lava.sh CheckSestatus.res | ||
|
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,31 @@ | ||
| ## CheckSestatus — SELinux Status Validation | ||
|
|
||
| ## Overview | ||
|
|
||
| Validates the output of the `sestatus` command to ensure that SELinux is active and running in a valid mode. | ||
|
|
||
| ## What Is Tested | ||
|
|
||
| | Check | Description | | ||
| |---|---| | ||
| | `sestatus` command | Executes the `sestatus` command to get a detailed report of the SELinux status. | | ||
| | Current Mode | Parses the `sestatus` output to verify that the 'Current mode' is either 'enforcing' or 'permissive'. | | ||
|
|
||
| ## Pass / Fail / Skip Criteria | ||
|
|
||
| - **SKIP**: The `sestatus` or `getenforce` command is not available. | ||
| - **FAIL**: The `sestatus` output does not report the 'Current mode' as 'enforcing' or 'permissive'. | ||
| - **PASS**: The 'Current mode' in the `sestatus` output is confirmed to be either 'enforcing' or 'permissive'. | ||
|
|
||
| ## Usage | ||
|
|
||
| ```sh | ||
| ./run.sh | ||
| ``` | ||
|
|
||
| ## Dependencies | ||
|
|
||
| - `sestatus` | ||
| - `getenforce` | ||
| - `grep` | ||
| - `awk` |
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The plan metadata name is AUSanity and description is Baseline AU Sanity test plan.
Recommended fix: rename to something like Security_Test or SELinux_Security_Test, and update the description accordingly.