summaryrefslogtreecommitdiff
path: root/tests/securityselinuxtest.c
Commit message (Collapse)AuthorAgeFilesLines
* Remove backslash alignment attemptsAndrea Bolognani2017-11-031-12/+12
| | | | | | | | | | | | | | | | | | Right-aligning backslashes when defining macros or using complex commands in Makefiles looks cute, but as soon as any changes is required to the code you end up with either distractingly broken alignment or unnecessarily big diffs where most of the changes are just pushing all backslashes a few characters to one side. Generated using $ git grep -El '[[:blank:]][[:blank:]]\\$' | \ grep -E '*\.([chx]|am|mk)$$' | \ while read f; do \ sed -Ei 's/[[:blank:]]*[[:blank:]]\\$/ \\/g' "$f"; \ done Signed-off-by: Andrea Bolognani <abologna@redhat.com>
* tests: Fix leak in securityselinuxtestJohn Ferlan2017-08-231-1/+2
| | | | | | | If we jump to the error: label and @secbuf is allocated, then it's not free'd at all. Found by Coverity
* Fix building domain def in securityselinuxtestJim Fehlig2017-08-211-5/+8
| | | | | | | | | The virDomainDef created by testBuildDomainDef in securityselinuxtest adds a seclabel but does not increment nseclabels. Also, it should populate seclabel->model with 'selinux'. While at it, use the secdef itself to populate values instead of the indirection through def->seclabels[0].
* securityselinuxtest: Don't leak @mgrMichal Privoznik2017-08-101-0/+1
| | | | | | | The security manager is created so that test cases can use it. However, it is never released. Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
* tests: Rename VIRT_TEST_* macros to VIR_TEST_*Andrea Bolognani2017-04-041-1/+1
| | | | | | We use the "vir" prefix pretty consistently in our APIs, both external and internal, which made these macros stood out.
* tests: Rename virtTestRun to virTestRun.Tomáš Ryšavý2016-06-081-13/+13
| | | | This function doesn't follow our convention of naming functions.
* tests: More usage of virGetLastErrorMessage()Jovanka Gulicoska2016-05-191-4/+2
| | | | Use virGetLastErrorMessage() instead of virGetLastError() in tests
* virSecurityManagerNew: Turn array of booleans into flagsMichal Privoznik2015-10-071-1/+3
| | | | | | | | | | | | | | | | So imagine you want to crate new security manager: if (!(mgr = virSecurityManagerNew("selinux", "QEMU", false, true, false, true))); Hard to parse, right? What about this: if (!(mgr = virSecurityManagerNew("selinux", "QEMU", VIR_SECURITY_MANAGER_DEFAULT_CONFINED | VIR_SECURITY_MANAGER_PRIVILEGED))); Now that's better! This is what the commit does. Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
* virSecurityManager: Track if running as privilegedMichal Privoznik2015-09-151-1/+1
| | | | | | | We may want to do some decisions in drivers based on fact if we are running as privileged user or not. Propagate this info there. Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
* conf: Allocate domain definition with the new helperPeter Krempa2015-02-201-1/+1
| | | | | Use the virDomainDefNew() helper to allocate the definition instead of doing it via VIR_ALLOC.
* Indent top-level labels by one space in tests/Ján Tomko2014-03-251-2/+2
|
* Add virLogSource variables to all source filesDaniel P. Berrange2014-03-181-0/+2
| | | | | | | | | Any source file which calls the logging APIs now needs to have a VIR_LOG_INIT("source.name") declaration at the start of the file. This provides a static variable of the virLogSource type. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
* tests: SELinux tests do not need to be skippedMichael Chapman2014-03-071-3/+0
| | | | | | | | With the previous commit's securityselinuxhelper enhancements, the SELinux security manager can be tested even without SELinux enabled on the test system. Signed-off-by: Michael Chapman <mike@very.puzzling.org>
* Remove test case average timingDaniel P. Berrange2013-10-081-1/+1
| | | | | | | The test case average timing code has not been used by any test case ever. Delete it to remove complexity. Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
* Adapt to VIR_ALLOC and virAsprintf in tests/*Michal Privoznik2013-07-101-5/+3
|
* selinux: assume 's0' if the range is emptyJán Tomko2013-06-111-0/+6
| | | | | This fixes a crash: https://bugzilla.redhat.com/show_bug.cgi?id=969878
* tests: fix typo in securityselinuxtestJán Tomko2013-06-041-1/+1
|
* util: move virFile* functions from virutil.c to virfile.cLaine Stump2013-05-101-0/+1
| | | | | | | | | | | | | | | These all existed before virfile.c was created, and for some reason weren't moved. This is mostly straightfoward, although the syntax rule prohibiting write() had to be changed to have an exception for virfile.c instead of virutil.c. This movement pointed out that there is a function called virBuildPath(), and another almost identical function called virFileBuildPath(). They really should be a single function, which I'll take care of as soon as I figure out what the arglist should look like.
* Adapt to VIR_STRDUP and VIR_STRNDUP in tests/*Michal Privoznik2013-05-101-4/+5
|
* virutil: Move string related functions to virstring.cMichal Privoznik2013-05-021-2/+1
| | | | | | | | The source code base needs to be adapted as well. Some files include virutil.h just for the string related functions (here, the include is substituted to match the new file), some include virutil.h without any need (here, the include is removed), and some require both.
* Fix parsing of SELinux ranges without a categoryDaniel P. Berrange2013-03-141-0/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | Normally libvirtd should run with a SELinux label system_u:system_r:virtd_t:s0-s0:c0.c1023 If a user manually runs libvirtd though, it is sometimes possible to get into a situation where it is running system_u:system_r:init_t:s0 The SELinux security driver isn't expecting this and can't parse the security label since it lacks the ':c0.c1023' part causing it to complain internal error Cannot parse sensitivity level in s0 This updates the parser to cope with this, so if no category is present, libvirtd will hardcode the equivalent of c0.c1023. Now this won't work if SELinux is in Enforcing mode, but that's not an issue, because the user can only get into this problem if in Permissive mode. This means they can now start VMs in Permissive mode without hitting that parsing error Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
* tests: uniformly report test failuresEric Blake2013-02-251-3/+3
| | | | | | | | | | | | | | | | testutils.c likes to print summaries after a test completes, including if it failed. But if the test outright exit()s, this summary is skipped. Enforce that we return instead of exit. * cfg.mk (sc_prohibit_exit_in_tests): New syntax check. * tests/commandhelper.c (main): Fix offenders. * tests/qemumonitorjsontest.c (mymain): Likewise. * tests/seclabeltest.c (main): Likewise. * tests/securityselinuxlabeltest.c (mymain): Likewise. * tests/securityselinuxtest.c (mymain): Likewise. * tests/testutils.h (VIRT_TEST_MAIN_PRELOAD): Likewise. * tests/testutils.c (virtTestMain): Likewise. (virtTestCaptureProgramOutput): Use symbolic name.
* Rename virterror.c virterror_internal.h to virerror.{c,h}Daniel P. Berrange2012-12-211-1/+1
|
* Rename util.{c,h} to virutil.{c,h}Daniel P. Berrange2012-12-211-1/+1
|
* Rename memory.{c,h} to viralloc.{c,h}Daniel P. Berrange2012-12-211-1/+1
|
* Rename logging.{c,h} to virlog.{c,h}Daniel P. Berrange2012-12-211-1/+1
|
* Fix SELinux security label testDaniel P. Berrange2012-12-191-0/+1
| | | | | | If securityselinuxtest was run on a system with newer SELinux policy it would fail, due to using svirt_tcg_t instead of svirt_t. Fixing the domain type to be KVM avoids this issue.
* selinux: Use raw contextsMartin Kletzander2012-10-121-1/+1
| | | | | | | | | | | | | | | | | | | | | | | We are currently able to work only with non-translated SELinux contexts, but we are using functions that work with translated contexts throughout the code. This patch swaps all SELinux context translation relative calls with their raw sisters to avoid parsing problems. The problems can be experienced with mcstrans for example. The difference is that if you have translations enabled (yum install mcstrans; service mcstrans start), fgetfilecon_raw() will get you something like 'system_u:object_r:virt_image_t:s0', whereas fgetfilecon() will return 'system_u:object_r:virt_image_t:SystemLow' that we cannot parse. I was trying to confirm that the _raw variants were here since the dawn of time, but the only thing I see now is that it was imported together in the upstream repo [1] from svn, so before 2008. Thanks Laurent Bigonville for finding this out. [1] http://oss.tresys.com/git/selinux.git
* maint: fix up copyright notice inconsistenciesEric Blake2012-09-201-2/+1
| | | | | | | | | https://www.gnu.org/licenses/gpl-howto.html recommends that the 'If not, see <url>.' phrase be a separate sentence. * tests/securityselinuxhelper.c: Remove doubled line. * tests/securityselinuxtest.c: Likewise. * globally: s/; If/. If/
* Add test case for SELinux label generationDaniel P. Berrange2012-08-211-0/+327
This test case validates the correct generation of SELinux labels for VMs, wrt the current process label. Since we can't actually change the label of the test program process, we create a shared library libsecurityselinuxhelper.so which overrides the getcon() and setcon() libselinux.so functions. When started the test case will check to see if LD_PRELOAD is set, and if not, it will re-exec() itself setting LD_PRELOAD=libsecurityselinuxhelper.so Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
View Lorry Controller Status