diff mbox

[RFC] selinux-testsuite: check the "expand-check" setting in semanage.conf

Message ID 152641822270.15123.8804483748550258349.stgit@chester (mailing list archive)
State Accepted
Headers show

Commit Message

Paul Moore May 15, 2018, 9:03 p.m. UTC
From: Paul Moore <paul@paul-moore.com>

If expand-check is non-zero in semanage.conf the policy load will likely fail,
try to provide a more helpful error to users running the tests.

Signed-off-by: Paul Moore <paul@paul-moore.com>
---
 policy/Makefile |   12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

Comments

Petr Lautrbach May 16, 2018, 7:31 a.m. UTC | #1
On Tue, May 15, 2018 at 05:03:42PM -0400, Paul Moore wrote:
> From: Paul Moore <paul@paul-moore.com>
> 
> If expand-check is non-zero in semanage.conf the policy load will likely fail,
> try to provide a more helpful error to users running the tests.
> 
> Signed-off-by: Paul Moore <paul@paul-moore.com>
> ---
>  policy/Makefile |   12 ++++++++++--
>  1 file changed, 10 insertions(+), 2 deletions(-)
> 
> diff --git a/policy/Makefile b/policy/Makefile
> index 8ed5e46..cc022e3 100644
> --- a/policy/Makefile
> +++ b/policy/Makefile
> @@ -87,6 +87,14 @@ build: $(BUILD_TARGET)
>  load: $(LOAD_TARGET)
>  unload: $(UNLOAD_TARGET)
>  
> +expand_check:
> +	# Test for "expand-check = 0" in /etc/selinux/semanage.conf
> +	@cat /etc/selinux/semanage.conf | \
> +		sed -n 's/^[ \t]*expand-check[ \t]*=[ \t]*0/OK/p' | \
> +		grep -q "OK" || \
> +		(echo "ERROR: set 'expand-check = 0' in semanage.conf"; \
> +		 /bin/false)
> +

You can use grep directly:

+ grep -q '^[ \t]*expand-check[ \t]*=[ \t]*0' /etc/selinux/semanage.conf || \
+      (echo "ERROR: set 'expand-check = 0' in semanage.conf";
+      /bin/false)


>  build_rhel: $(TARGETS)
>  	# RHEL specific policy build
>  	$(MAKE) -C redhat/$(RHEL_VERS) all
> @@ -103,11 +111,11 @@ build_general: $(TARGETS)
>  		echo "ERROR: You must have selinux-policy-devel installed."; \
>  	fi
>  
> -load_rhel: all
> +load_rhel: expand_check all
>  	# RHEL specific policy load
>  	$(MAKE) -C redhat/$(RHEL_VERS) load
>  
> -load_general: all
> +load_general: expand_check all
>  	# General policy load
>  	@-/usr/sbin/setsebool allow_domain_fd_use=0
>  	$(SEMODULE) -i test_policy/test_policy.pp
> 
>
Stephen Smalley May 16, 2018, 12:48 p.m. UTC | #2
On 05/16/2018 03:31 AM, Petr Lautrbach wrote:
> On Tue, May 15, 2018 at 05:03:42PM -0400, Paul Moore wrote:
>> From: Paul Moore <paul@paul-moore.com>
>>
>> If expand-check is non-zero in semanage.conf the policy load will likely fail,
>> try to provide a more helpful error to users running the tests.
>>
>> Signed-off-by: Paul Moore <paul@paul-moore.com>
>> ---
>>  policy/Makefile |   12 ++++++++++--
>>  1 file changed, 10 insertions(+), 2 deletions(-)
>>
>> diff --git a/policy/Makefile b/policy/Makefile
>> index 8ed5e46..cc022e3 100644
>> --- a/policy/Makefile
>> +++ b/policy/Makefile
>> @@ -87,6 +87,14 @@ build: $(BUILD_TARGET)
>>  load: $(LOAD_TARGET)
>>  unload: $(UNLOAD_TARGET)
>>  
>> +expand_check:
>> +	# Test for "expand-check = 0" in /etc/selinux/semanage.conf
>> +	@cat /etc/selinux/semanage.conf | \
>> +		sed -n 's/^[ \t]*expand-check[ \t]*=[ \t]*0/OK/p' | \
>> +		grep -q "OK" || \
>> +		(echo "ERROR: set 'expand-check = 0' in semanage.conf"; \
>> +		 /bin/false)
>> +
> 
> You can use grep directly:
> 
> + grep -q '^[ \t]*expand-check[ \t]*=[ \t]*0' /etc/selinux/semanage.conf || \
> +      (echo "ERROR: set 'expand-check = 0' in semanage.conf";
> +      /bin/false)

And you should probably put the full path for the file in the error message.

> 
>>  build_rhel: $(TARGETS)
>>  	# RHEL specific policy build
>>  	$(MAKE) -C redhat/$(RHEL_VERS) all
>> @@ -103,11 +111,11 @@ build_general: $(TARGETS)
>>  		echo "ERROR: You must have selinux-policy-devel installed."; \
>>  	fi
>>  
>> -load_rhel: all
>> +load_rhel: expand_check all
>>  	# RHEL specific policy load
>>  	$(MAKE) -C redhat/$(RHEL_VERS) load
>>  
>> -load_general: all
>> +load_general: expand_check all
>>  	# General policy load
>>  	@-/usr/sbin/setsebool allow_domain_fd_use=0
>>  	$(SEMODULE) -i test_policy/test_policy.pp
>>
>>
Paul Moore May 17, 2018, 3:15 p.m. UTC | #3
On Wed, May 16, 2018 at 8:48 AM, Stephen Smalley <sds@tycho.nsa.gov> wrote:
> On 05/16/2018 03:31 AM, Petr Lautrbach wrote:
>> On Tue, May 15, 2018 at 05:03:42PM -0400, Paul Moore wrote:
>>> From: Paul Moore <paul@paul-moore.com>
>>>
>>> If expand-check is non-zero in semanage.conf the policy load will likely fail,
>>> try to provide a more helpful error to users running the tests.
>>>
>>> Signed-off-by: Paul Moore <paul@paul-moore.com>
>>> ---
>>>  policy/Makefile |   12 ++++++++++--
>>>  1 file changed, 10 insertions(+), 2 deletions(-)
>>>
>>> diff --git a/policy/Makefile b/policy/Makefile
>>> index 8ed5e46..cc022e3 100644
>>> --- a/policy/Makefile
>>> +++ b/policy/Makefile
>>> @@ -87,6 +87,14 @@ build: $(BUILD_TARGET)
>>>  load: $(LOAD_TARGET)
>>>  unload: $(UNLOAD_TARGET)
>>>
>>> +expand_check:
>>> +    # Test for "expand-check = 0" in /etc/selinux/semanage.conf
>>> +    @cat /etc/selinux/semanage.conf | \
>>> +            sed -n 's/^[ \t]*expand-check[ \t]*=[ \t]*0/OK/p' | \
>>> +            grep -q "OK" || \
>>> +            (echo "ERROR: set 'expand-check = 0' in semanage.conf"; \
>>> +             /bin/false)
>>> +
>>
>> You can use grep directly:

Yes, you're correct.  I have an old habit of using sed for regex
processing as I used to work on a lot of systems where grep didn't
handle regular expressions.

Fixed.

> And you should probably put the full path for the file in the error message.

I figured that comment above (it is displayed when running 'make
test') was enough, but adding the full path couldn't hurt.

Fixed, and pushed to selinux-testsuite/master.  Thanks to both of you
for the quick review.
diff mbox

Patch

diff --git a/policy/Makefile b/policy/Makefile
index 8ed5e46..cc022e3 100644
--- a/policy/Makefile
+++ b/policy/Makefile
@@ -87,6 +87,14 @@  build: $(BUILD_TARGET)
 load: $(LOAD_TARGET)
 unload: $(UNLOAD_TARGET)
 
+expand_check:
+	# Test for "expand-check = 0" in /etc/selinux/semanage.conf
+	@cat /etc/selinux/semanage.conf | \
+		sed -n 's/^[ \t]*expand-check[ \t]*=[ \t]*0/OK/p' | \
+		grep -q "OK" || \
+		(echo "ERROR: set 'expand-check = 0' in semanage.conf"; \
+		 /bin/false)
+
 build_rhel: $(TARGETS)
 	# RHEL specific policy build
 	$(MAKE) -C redhat/$(RHEL_VERS) all
@@ -103,11 +111,11 @@  build_general: $(TARGETS)
 		echo "ERROR: You must have selinux-policy-devel installed."; \
 	fi
 
-load_rhel: all
+load_rhel: expand_check all
 	# RHEL specific policy load
 	$(MAKE) -C redhat/$(RHEL_VERS) load
 
-load_general: all
+load_general: expand_check all
 	# General policy load
 	@-/usr/sbin/setsebool allow_domain_fd_use=0
 	$(SEMODULE) -i test_policy/test_policy.pp