Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 39be695

Browse files
tglsfdctglsfdc
committed
Take sepgsql regression tests out of the regular regression test mechanism.
Back-port the new "test_sepgsql" script into 9.1 to provide a substitute test mechanism.
1 parent 1679e9f commit 39be695

File tree

3 files changed

+425
-140
lines changed

3 files changed

+425
-140
lines changed

‎contrib/sepgsql/Makefile

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,9 @@ OBJS = hooks.o selinux.o label.o dml.o \
55
schema.o relation.o proc.o
66
DATA_built = sepgsql.sql
77

8-
REGRESS = label dml misc
9-
REGRESS_OPTS = --launcher $(top_builddir)/contrib/sepgsql/launcher
10-
11-
EXTRA_CLEAN = -r tmp *.pp sepgsql-regtest.if sepgsql-regtest.fc
8+
# Note: because we don't tell the Makefile there are any regression tests,
9+
# we have to clean those result files explicitly
10+
EXTRA_CLEAN = -r $(pg_regress_clean_files) tmp/ *.pp sepgsql-regtest.if sepgsql-regtest.fc
1211

1312
ifdef USE_PGXS
1413
PG_CONFIG = pg_config

‎contrib/sepgsql/test_sepgsql

Lines changed: 264 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,264 @@
1+
#!/bin/sh
2+
#
3+
# Run the sepgsql regression tests, after making a lot of environmental checks
4+
# to try to ensure that the SELinux environment is set up appropriately and
5+
# the database is configured correctly.
6+
#
7+
# Note that this must be run against an installed Postgres database.
8+
# There's no equivalent of "make check", and that wouldn't be terribly useful
9+
# since much of the value is in checking that you installed sepgsql into
10+
# your database correctly.
11+
#
12+
# This must be run in the contrib/sepgsql directory of a Postgres build tree.
13+
#
14+
15+
PG_BINDIR=`pg_config --bindir`
16+
17+
echo
18+
echo "============== checking selinux environment =============="
19+
20+
# matchpathcon must be present to assess whether the installation environment
21+
# is OK.
22+
echo -n "checking for matchpathcon ... "
23+
if ! matchpathcon -n . >/dev/null 2>&1; then
24+
echo "not found"
25+
echo ""
26+
echo "The matchpathcon command must be available."
27+
echo "Please install it or update your PATH to include it"
28+
echo "(it is typically in '/usr/sbin', which might not be in your PATH)."
29+
echo "matchpathcon is typically included in the libselinux-utils package."
30+
exit 1
31+
fi
32+
echo "ok"
33+
34+
# runcon must be present to launch psql using the correct environment
35+
echo -n "checking for runcon ... "
36+
if ! runcon --help >/dev/null 2>&1; then
37+
echo "not found"
38+
echo ""
39+
echo "The runcon command must be available."
40+
echo "runcon is typically included in the coreutils package."
41+
echo ""
42+
exit 1
43+
fi
44+
echo "ok"
45+
46+
# check sestatus too, since that lives in yet another package
47+
echo -n "checking for sestatus ... "
48+
if ! sestatus >/dev/null 2>&1; then
49+
echo "not found"
50+
echo ""
51+
echo "The sestatus command must be available."
52+
echo "sestatus is typically included in the policycoreutils package."
53+
echo ""
54+
exit 1
55+
fi
56+
echo "ok"
57+
58+
# check that the user is running in the unconfined_t domain
59+
echo -n "checking current user domain ... "
60+
DOMAIN=`id -Z 2>/dev/null | sed 's/:/ /g' | awk '{print $3}'`
61+
echo ${DOMAIN:-failed}
62+
if [ "${DOMAIN}" != unconfined_t ]; then
63+
echo ""
64+
echo "The regression tests must be launched from the unconfined_t domain."
65+
echo ""
66+
echo "The unconfined_t domain is typically the default domain for user"
67+
echo "shell processes. If the default has been changed on your system,"
68+
echo "you can revert the changes like this:"
69+
echo ""
70+
echo " \$ sudo semanage login -d `whoami`"
71+
echo ""
72+
echo "Or, you can add a setting to log in using the unconfined_t domain:"
73+
echo ""
74+
echo " \$ sudo semanage login -a -s unconfined_u -r s0-s0:c0.c255 `whoami`"
75+
echo ""
76+
exit 1
77+
fi
78+
79+
# SELinux must be configured in enforcing mode
80+
echo -n "checking selinux operating mode ... "
81+
CURRENT_MODE=`LANG=C sestatus | grep '^Current mode:' | awk '{print $3}'`
82+
echo ${CURRENT_MODE:-failed}
83+
if [ "${CURRENT_MODE}" = enforcing ]; then
84+
: OK
85+
elif [ "${CURRENT_MODE}" = permissive -o "${CURRENT_MODE}" = disabled ]; then
86+
echo ""
87+
echo "Before running the regression tests, SELinux must be enabled and"
88+
echo "must be running in enforcing mode."
89+
echo ""
90+
echo "If SELinux is currently running in permissive mode, you can"
91+
echo "switch to enforcing mode using the 'setenforce' command."
92+
echo
93+
echo " \$ sudo setenforce 1"
94+
echo ""
95+
echo "The system default setting is configured in /etc/selinux/config,"
96+
echo "or using a kernel boot parameter."
97+
echo ""
98+
exit 1
99+
else
100+
echo ""
101+
echo "Unable to determine the current selinux operating mode. Please"
102+
echo "verify that the sestatus command is installed and in your PATH."
103+
echo ""
104+
exit 1
105+
fi
106+
107+
# 'sepgsql-regtest' policy module must be loaded
108+
echo -n "checking for sepgsql-regtest policy ... "
109+
SELINUX_MNT=`LANG=C sestatus | grep '^SELinuxfs mount:' | awk '{print $3}'`
110+
if [ "$SELINUX_MNT" = "" ]; then
111+
echo "failed"
112+
echo ""
113+
echo "Unable to find SELinuxfs mount point."
114+
echo ""
115+
echo "The sestatus command should report the location where SELinuxfs"
116+
echo "is mounted, but did not do so."
117+
echo ""
118+
exit 1
119+
fi
120+
if [ ! -e "${SELINUX_MNT}/booleans/sepgsql_regression_test_mode" ]; then
121+
echo "failed"
122+
echo ""
123+
echo "The 'sepgsql-regtest' policy module appears not to be installed."
124+
echo "Without this policy installed, the regression tests will fail."
125+
echo "You can install this module using the following commands:"
126+
echo ""
127+
echo " \$ make -f /usr/share/selinux/devel/Makefile"
128+
echo " \$ sudo semodule -u sepgsql-regtest.pp"
129+
echo ""
130+
echo "To confirm that the policy package is installed, use this command:"
131+
echo ""
132+
echo " \$ sudo semodule -l | grep sepgsql"
133+
echo ""
134+
exit 1
135+
fi
136+
echo "ok"
137+
138+
# Verify that sepgsql_regression_test_mode is active.
139+
echo -n "checking whether policy is enabled ... "
140+
POLICY_STATUS=`getsebool sepgsql_regression_test_mode | awk '{print $3}'`
141+
echo ${POLICY_STATUS:-failed}
142+
if [ "${POLICY_STATUS}" != on ]; then
143+
echo ""
144+
echo "The SELinux boolean 'sepgsql_regression_test_mode' must be"
145+
echo "turned on in order to enable the rules necessary to run the"
146+
echo "regression tests."
147+
echo ""
148+
if [ "${POLICY_STATUS}" = "" ]; then
149+
echo "We attempted to determine the state of this Boolean using"
150+
echo "'getsebool', but that command did not produce the expected"
151+
echo "output. Please verify that getsebool is available and in"
152+
echo "your PATH."
153+
else
154+
echo "You can turn on this variable using the following commands:"
155+
echo ""
156+
echo " \$ sudo setsebool sepgsql_regression_test_mode on"
157+
echo ""
158+
echo "For security reasons, it is suggested that you turn off this"
159+
echo "variable when regression testing is complete and the associated"
160+
echo "rules are no longer needed."
161+
fi
162+
echo ""
163+
exit 1
164+
fi
165+
166+
# 'psql' command must be executable from test domain
167+
echo -n "checking whether we can run psql ... "
168+
CMD_PSQL="${PG_BINDIR}/psql"
169+
if [ ! -e "${CMD_PSQL}" ]; then
170+
echo "not found"
171+
echo
172+
echo "${CMD_PSQL} was not found."
173+
echo "Check your PostgreSQL installation."
174+
echo
175+
exit 1
176+
fi
177+
runcon -t sepgsql_regtest_user_t "${CMD_PSQL}" --help >& /dev/null
178+
if [ $? -ne 0 ]; then
179+
echo "failed"
180+
echo
181+
echo "${CMD_PSQL} must be executable from the"
182+
echo "sepgsql_regtest_user_t domain. That domain has restricted privileges"
183+
echo "compared to unconfined_t, so the problem may be the psql file's"
184+
echo "SELinux label. Try"
185+
echo
186+
PSQL_T=`matchpathcon -n "${CMD_PSQL}" | sed 's/:/ /g' | awk '{print $3}'`
187+
if [ "${PSQL_T}" = "user_home_t" ]; then
188+
# Installation appears to be in /home directory
189+
echo " \$ sudo restorecon -R ${PG_BINDIR}"
190+
echo
191+
echo "Or, using chcon"
192+
echo
193+
echo " \$ sudo chcon -t user_home_t ${CMD_PSQL}"
194+
else
195+
echo " \$ sudo restorecon -R ${PG_BINDIR}"
196+
echo
197+
echo "Or, using chcon"
198+
echo
199+
echo " \$ sudo chcon -t bin_t ${CMD_PSQL}"
200+
fi
201+
echo
202+
exit 1
203+
fi
204+
echo "ok"
205+
206+
# loadable module must be installed and not configured to permissive mode
207+
echo -n "checking sepgsql installation ... "
208+
VAL="`${CMD_PSQL} -t -c 'SHOW sepgsql.permissive' template1 2>/dev/null`"
209+
RETVAL="$?"
210+
if [ $RETVAL -eq 2 ]; then
211+
echo "failed"
212+
echo ""
213+
echo "Could not connect to the database server."
214+
echo "Please check your PostgreSQL installation."
215+
echo ""
216+
exit 1
217+
elif [ $RETVAL -ne 0 ]; then
218+
echo "failed"
219+
echo ""
220+
echo "The sepgsql module does not appear to be loaded. Please verify"
221+
echo "that the 'shared_preload_libraries' setting in postgresql.conf"
222+
echo "includes 'sepgsql', and then restart the server."
223+
echo ""
224+
echo "See Installation section of the contrib/sepgsql documentation."
225+
echo ""
226+
exit 1
227+
elif ! echo "$VAL" | grep -q 'off$'; then
228+
echo "failed"
229+
echo ""
230+
echo "The parameter 'sepgsql.permissive' is set to 'on'. It must be"
231+
echo "turned off before running the regression tests."
232+
echo ""
233+
exit 1
234+
fi
235+
echo "ok"
236+
237+
# template1 database must be labeled
238+
# NOTE: this test is wrong; we really ought to be checking template0.
239+
# But we can't connect to that without extra pushups, and it's not worth it.
240+
echo -n "checking for labels in template1 ... "
241+
NUM=`${CMD_PSQL} -At -c 'SELECT count(*) FROM pg_catalog.pg_seclabel' template1 2>/dev/null`
242+
if [ -z "${NUM}" ]; then
243+
echo "failed"
244+
echo ""
245+
echo "In order to test sepgsql, initial labels must be assigned within"
246+
echo "the 'template1' database. These labels will be copied into the"
247+
echo "regression test database."
248+
echo ""
249+
echo "See Installation section of the contrib/sepgsql documentation."
250+
echo ""
251+
exit 1
252+
fi
253+
echo "found ${NUM}"
254+
255+
#
256+
# checking complete - let's run the tests
257+
#
258+
259+
echo
260+
echo "============== running sepgsql regression tests =============="
261+
262+
make REGRESS="label dml misc" REGRESS_OPTS="--launcher ./launcher" installcheck
263+
264+
# exit with the exit code provided by "make"

0 commit comments

Comments
 (0)