test: ensure disabled selinux test restores system state #292
Conversation
Save the state and the policy before the test, and ensure we restore that after the test. Put the cleanup block in a `always` so that it will always be executed, even if the test fails. Signed-off-by: Rich Megginson <rmeggins@redhat.com>
Reviewer's GuideThis PR refactors the SELinux-disabled test playbook to capture and restore the system's original SELinux policy and mode, wraps the test steps in a block with an File-Level Changes
Possibly linked issues
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
|
[citest] |
|
[citest_bad] |
| name: linux-system-roles.selinux | ||
| vars: | ||
| selinux_policy: targeted | ||
| selinux_state: enforcing |
There was a problem hiding this comment.
Maybe use {{ __save_policy }} and {{ _save_state }} ?
There was a problem hiding this comment.
Ok - but then I don't understand what this code is trying to do - is it trying to change the state and the policy? If the policy is already the same as __save_policy and the state is already the same as __save_state, then what will this do?
There was a problem hiding this comment.
at this moment, /etc/selinux/config is copied from selinux.config with SELINUX=disabled and SELINUXTYPE=targeted
this test should check whether the switch from disabled to enforcing triggers selinux_reboot_required
There was a problem hiding this comment.
The same trigger should happen with switch from disabled to permissive
But to make it clear the combination would be better I guess:
selinux_policy: {{ __save_policy }}
selinux_state: enforcing
There was a problem hiding this comment.
The problem with selinux_policy: targeted is that it expects selinux-policy-targeted to be installed. If it's not installed, the test fails:
# cp -r /var/lib/selinux/targeted/ /var/lib/selinux/test
# cp -r /etc/selinux/targeted/ /etc/selinux/test
# sed -i 's/=targeted/=test/' /etc/selinux/config
# reboot
# mv /etc/selinux/targeted /etc/selinux/targeted-
# mv /var/lib/selinux/targeted /var/lib/selinux/targeted-
# ansible-playbook -i localhost, -c local tests_selinux_disabled.yml
TASK [Remove Linux System Roles SELinux User] **************************************************************************************************************
fatal: [localhost]: FAILED! => {"changed": false, "msg": "userdel: failure while writing changes to /etc/passwd\n", "name": "sar-user", "rc": 1}
In this case tests_selinux_modules_checksum.yml would fail as well as it has uses hard coded targeted
|
It seems to me that it should be sufficient to |
Please check latest commit |
|
I tested the last commit and in general it works for me. I have only comments to hardcoded |
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #292 +/- ##
=====================================
Coverage ? 0
=====================================
Files ? 0
Lines ? 0
Branches ? 0
=====================================
Hits ? 0
Misses ? 0
Partials ? 0 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
2 participants
Save the state and the policy before the test, and ensure we
restore that after the test.
Put the cleanup block in a
alwaysso that it will always beexecuted, even if the test fails.
Signed-off-by: Rich Megginson rmeggins@redhat.com
Summary by Sourcery
Improve the disabled SELinux test by capturing pre-test system state and enforcing cleanup in an always block to guarantee restoration of SELinux configuration, mountpoints, and test user regardless of test outcome
Enhancements:
Tests: