Help with test failures
Orion Poplawski <[email protected]> Wed, 29 May 2024 16:14:11 -0600
| Newsgroups | gmane.linux.redhat.fedora.selinux |
|---|---|
| Organization | NWRA |
| Message-ID | <[email protected]> |
--===============0739537445102164082==
Content-Language: en-US
Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="------------ms050306090807030903090002"
--------------ms050306090807030903090002
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
We have the following PR for zabbix SELinux policy:
https://src.fedoraproject.org/rpms/zabbix/pull-request/10
and we're getting some test failures, but I can't really interpret them.
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::=
:::::::
:: Unsound/dangerous policy practices
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::=
:::::::
:: [ 21:15:26 ] :: [ BEGIN ] :: Running 'semodule -lfull | grep zabbix=
'
:: [ 21:15:26 ] :: [ PASS ] :: Command 'semodule -lfull | grep zabbix=
'
(Expected 0, got 0)
:: [ 21:15:26 ] :: [ BEGIN ] :: Running 'semodule -X 200 --cil -E zabb=
ix'
:: [ 21:15:26 ] :: [ PASS ] :: Command 'semodule -X 200 --cil -E zabb=
ix'
(Expected 0, got 0)
:: [ 21:15:26 ] :: [ BEGIN ] :: Running 'python3 test.py zabbix.cil
policy/zabbix.te'
/var/str/DSP_test/test.py:64: SyntaxWarning: invalid escape sequence '\('=
out =3D subprocess.run(['grep', '-E', '[A-Za-z_]+\(.*\)', te_source_fil=
e],
capture_output=3DTrue, text=3DTrue)
:: [ 21:15:27 ] :: [ FAIL ] :: Command 'python3 test.py zabbix.cil
policy/zabbix.te' (Expected 0, got 4)
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::=
:::::::
:: Duration: 1s
:: Assertions: 2 good, 1 bad
:: RESULT: FAIL (Unsound/dangerous policy practices)
This seems like it might be a python error in the test.
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::=
:::::::
:: SELint static analysis
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::=
:::::::
:: [ 21:15:27 ] :: [ BEGIN ] :: Running 'selint -s -r -d E-005 -d W-00=
4 -d
W-005 -d W-010 -d S-001 -d S-010 --context=3Dbase-policy policy/zabbix.f=
c
policy/zabbix.te 2>&1 | tee /tmp/tmp.DVGZL996ny'
:: [ 21:15:27 ] :: [ PASS ] :: Command 'selint -s -r -d E-005 -d W-00=
4 -d
W-005 -d W-010 -d S-001 -d S-010 --context=3Dbase-policy policy/zabbix.f=
c
policy/zabbix.te 2>&1 | tee /tmp/tmp.DVGZL996ny' (Expected 0, got 0)
:: [ 21:15:27 ] :: [ BEGIN ] :: Running 'grep -v 'F-002' '/tmp/tmp.DVG=
ZL996ny''
:: [ 21:15:27 ] :: [ FAIL ] :: Command 'grep -v 'F-002'
'/tmp/tmp.DVGZL996ny'' (Expected 1, got 0)
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::=
:::::::
:: Duration: 0s
:: Assertions: 1 good, 1 bad
:: RESULT: FAIL (SELint static analysis)
No idea about this.
In the installability teest:
BAD install: zabbix-1:6.0.30-1.fc41.x86_64 (selinux AVCs)
----
type=3DAVC msg=3Daudit(05/28/2024 21:15:28.247:957) : avc: denied { map=
_read
map_write } for pid=3D4601 comm=3Dselinux-autorel
scontext=3Dsystem_u:system_r:selinux_autorelabel_generator_t:s0
tcontext=3Dsystem_u:system_r:init_t:s0 tclass=3Dbpf permissive=3D0
----
type=3DAVC msg=3Daudit(05/28/2024 21:15:28.254:958) : avc: denied { map=
_read
map_write } for pid=3D4605 comm=3Dsystemd-fstab-g
scontext=3Dsystem_u:system_r:systemd_fstab_generator_t:s0
tcontext=3Dsystem_u:system_r:init_t:s0 tclass=3Dbpf permissive=3D0
----
type=3DAVC msg=3Daudit(05/28/2024 21:15:28.261:959) : avc: denied { map=
_read
map_write } for pid=3D4609 comm=3Dsystemd-gpt-aut
scontext=3Dsystem_u:system_r:systemd_gpt_generator_t:s0
tcontext=3Dsystem_u:system_r:init_t:s0 tclass=3Dbpf permissive=3D0
----
type=3DAVC msg=3Daudit(05/28/2024 21:15:28.273:960) : avc: denied { map=
_read
map_write } for pid=3D4613 comm=3Dsystemd-rc-loca
scontext=3Dsystem_u:system_r:systemd_rc_local_generator_t:s0
tcontext=3Dsystem_u:system_r:init_t:s0 tclass=3Dbpf permissive=3D0
----
type=3DAVC msg=3Daudit(05/28/2024 21:15:28.281:961) : avc: denied { rea=
d } for
pid=3D4615 comm=3Dsystemd-ssh-gen name=3Dvsock dev=3D"devtmpfs" ino=3D388=
scontext=3Dsystem_u:system_r:init_t:s0
tcontext=3Dsystem_u:object_r:vsock_device_t:s0 tclass=3Dchr_file permissi=
ve=3D0
----
type=3DAVC msg=3Daudit(05/28/2024 21:15:28.284:962) : avc: denied { map=
_read
map_write } for pid=3D4619 comm=3Dsystemd-sysv-ge
scontext=3Dsystem_u:system_r:systemd_sysv_generator_t:s0
tcontext=3Dsystem_u:system_r:init_t:s0 tclass=3Dbpf permissive=3D0
and more, but these seem unrelated to the zabbix package.
--=20
Orion Poplawski
he/him/his - surely the least important thing about me
Manager of IT Systems 720-772-5637
NWRA, Boulder/CoRA Office FAX: 303-415-9702
3380 Mitchell Lane [email protected]
Boulder, CO 80301 https://www.nwra.com/
--------------ms050306090807030903090002
Content-Type: application/pkcs7-signature; name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="smime.p7s"
Content-Description: S/MIME Cryptographic Signature
MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCC
ClEwggUVMIID/aADAgECAhEArxwEsqyM/5sAAAAAUc4Y4zANBgkqhkiG9w0BAQsFADCBtDEU
MBIGA1UEChMLRW50cnVzdC5uZXQxQDA+BgNVBAsUN3d3dy5lbnRydXN0Lm5ldC9DUFNfMjA0
OCBpbmNvcnAuIGJ5IHJlZi4gKGxpbWl0cyBsaWFiLikxJTAjBgNVBAsTHChjKSAxOTk5IEVu
dHJ1c3QubmV0IExpbWl0ZWQxMzAxBgNVBAMTKkVudHJ1c3QubmV0IENlcnRpZmljYXRpb24g
QXV0aG9yaXR5ICgyMDQ4KTAeFw0yMDA3MjkxNTQ4MzBaFw0yOTA2MjkxNjE4MzBaMIGlMQsw
CQYDVQQGEwJVUzEWMBQGA1UEChMNRW50cnVzdCwgSW5jLjE5MDcGA1UECxMwd3d3LmVudHJ1
c3QubmV0L0NQUyBpcyBpbmNvcnBvcmF0ZWQgYnkgcmVmZXJlbmNlMR8wHQYDVQQLExYoYykg
MjAxMCBFbnRydXN0LCBJbmMuMSIwIAYDVQQDExlFbnRydXN0IENsYXNzIDIgQ2xpZW50IENB
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxDKNQtCeGZ1bkFoQTLUQACG5B0je
rm6A1v8UUAboda9rRo7npU+tw4yw+nvgGZH98GOtcUnzqBwfqzQZIE5LVOkAk75wCDHeiVOs
V7wk7yqPQtT36pUlXRR20s2nEvobsrRcYUC9X91Xm0RV2MWJGTxlPbno1KUtwizT6oMxogg8
XlmuEi4qCoxe87MxrgqtfuywSQn8py4iHmhkNJ0W46Y9AzFAFveU9ksZNMmX5iKcSN5koIML
WAWYxCJGiQX9o772SUxhAxak+AqZHOLAxn5pAjJXkAOvAJShudzOr+/0fBjOMAvKh/jVXx9Z
UdiLC7k4xljCU3zaJtTb8r2QzQIDAQABo4IBLTCCASkwDgYDVR0PAQH/BAQDAgGGMB0GA1Ud
JQQWMBQGCCsGAQUFBwMEBggrBgEFBQcDAjASBgNVHRMBAf8ECDAGAQH/AgEAMDMGCCsGAQUF
BwEBBCcwJTAjBggrBgEFBQcwAYYXaHR0cDovL29jc3AuZW50cnVzdC5uZXQwMgYDVR0fBCsw
KTAnoCWgI4YhaHR0cDovL2NybC5lbnRydXN0Lm5ldC8yMDQ4Y2EuY3JsMDsGA1UdIAQ0MDIw
MAYEVR0gADAoMCYGCCsGAQUFBwIBFhpodHRwOi8vd3d3LmVudHJ1c3QubmV0L3JwYTAdBgNV
HQ4EFgQUCZGluunyLip1381+/nfK8t5rmyQwHwYDVR0jBBgwFoAUVeSB0RGAvtiJuQijMfmh
JAkWuXAwDQYJKoZIhvcNAQELBQADggEBAD+96RB180Kn0WyBJqFGIFcSJBVasgwIf91HuT9C
k6QKr0wR7sxrMPS0LITeCheQ+Xg0rq4mRXYFNSSDwJNzmU+lcnFjtAmIEctsbu+UldVJN8+h
APANSxRRRvRocbL+YKE3DyX87yBaM8aph8nqUvbXaUiWzlrPEJv2twHDOiGlyEPAhJ0D+MU0
CIfLiwqDXKojK+n/uN6nSQ5tMhWBMMgn9MD+zxp1zIe7uhGhgmVQBZ/zRZKHoEW4Gedf+EYK
W8zYXWsWkUwVlWrj5PzeBnT2bFTdxCXwaRbW6g4/Wb4BYvlgnx1AszH3EJwv+YpEZthgAk4x
ELH2l47+IIO9TUowggU0MIIEHKADAgECAhBOGocb/uu4yQAAAABMPXr3MA0GCSqGSIb3DQEB
CwUAMIGlMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNRW50cnVzdCwgSW5jLjE5MDcGA1UECxMw
d3d3LmVudHJ1c3QubmV0L0NQUyBpcyBpbmNvcnBvcmF0ZWQgYnkgcmVmZXJlbmNlMR8wHQYD
VQQLExYoYykgMjAxMCBFbnRydXN0LCBJbmMuMSIwIAYDVQQDExlFbnRydXN0IENsYXNzIDIg
Q2xpZW50IENBMB4XDTIzMTIxNjIxMTUyNVoXDTI2MTIxNjIxNDUyMlowgbAxCzAJBgNVBAYT
AlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdTZWF0dGxlMSYwJAYDVQQKEx1O
b3J0aFdlc3QgUmVzZWFyY2ggQXNzb2NpYXRlczEbMBkGA1UEYRMSTlRSVVMrV0EtNjAwNTcz
MjUxMTUwFgYDVQQDEw9PcmlvbiBQb3BsYXdza2kwGwYJKoZIhvcNAQkBFg5vcmlvbkBud3Jh
LmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKn5wO5Bjob6bLDahVowly2l
AyCWBHGRq1bSptv7tXpj+Xaci4zpCqRoyqX0Gjpo8BEulUYQK8b7nO7UM3aMLC8H6vyzQ64A
GupPGIKuJg+Qr8jA0ihCVH+duE0bNXfDPTm/8VsXOubmVLPLp0cejxzrEC/RI5l8rdl0sQ+2
QZp9jTlyghB1Rxt2AYVYhVVnRMSJ8RgKp9MLV3qIfHqF1k5MGBIP6rS1afmlGd/yW9IWSB8z
iASPtr/Ml5ObbxtYZG47kCKCS7RF2rI6rGNmK/R6cITRs37dzUfBmagDFV897wAW3tHTyLQM
4vobhmS2UYi8C5voc+I75LYOsvLaXHUCAwEAAaOCAVEwggFNMA4GA1UdDwEB/wQEAwIFoDAd
BgNVHSUEFjAUBggrBgEFBQcDBAYIKwYBBQUHAwIwFAYDVR0gBA0wCzAJBgdngQwBBQMBMGoG
CCsGAQUFBwEBBF4wXDAjBggrBgEFBQcwAYYXaHR0cDovL29jc3AuZW50cnVzdC5uZXQwNQYI
KwYBBQUHMAKGKWh0dHA6Ly9haWEuZW50cnVzdC5uZXQvMjA0OGNsYXNzMnNoYTIuY2VyMDQG
A1UdHwQtMCswKaAnoCWGI2h0dHA6Ly9jcmwuZW50cnVzdC5uZXQvY2xhc3MyY2EuY3JsMBkG
A1UdEQQSMBCBDm9yaW9uQG53cmEuY29tMB8GA1UdIwQYMBaAFAmRpbrp8i4qdd/Nfv53yvLe
a5skMB0GA1UdDgQWBBSZhCz4u7bZ2JjPtNAM8gx3QVEp1zAJBgNVHRMEAjAAMA0GCSqGSIb3
DQEBCwUAA4IBAQA2L6VG0IcimaH24eRr4+L6a/Q51YxInV1pDPt73Lr2uz9CzKWiqWgm6Ioh
O9gSEhDsAYUXED8lkJ3jId9Lo/fDj5M+13S4eChfzFb1VWyA9fBeOE+/zEYrSPQIuRUM324g
PEm8eP/mYaZzHXoA0RJC7jyZlLRdzu/kGqUQDr+81YnkXoyoKc8WeNZnSQSL+LqRvPJCcCTu
JbCdd7C8zYW1dRgh4d9hYooUSsKTsSeDoRkFyqk4ZH0V3PFqa2HiFrdi8h3vpBX44VFddyaa
e+ekomLvvVZWGtJgXWr6VEBo8PTah0fw8BQjCIfFym44D9dulz1YW7E6FRPMSZ7x8X3UMYIE
XzCCBFsCAQEwgbowgaUxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1FbnRydXN0LCBJbmMuMTkw
NwYDVQQLEzB3d3cuZW50cnVzdC5uZXQvQ1BTIGlzIGluY29ycG9yYXRlZCBieSByZWZlcmVu
Y2UxHzAdBgNVBAsTFihjKSAyMDEwIEVudHJ1c3QsIEluYy4xIjAgBgNVBAMTGUVudHJ1c3Qg
Q2xhc3MgMiBDbGllbnQgQ0ECEE4ahxv+67jJAAAAAEw9evcwDQYJYIZIAWUDBAIBBQCgggJ1
MBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTI0MDUyOTIyMTQx
MlowLwYJKoZIhvcNAQkEMSIEIN0SzWiK67mGfBWjGUOyuUlcxtATAH/MHDDx4MYGqnCYMGwG
CSqGSIb3DQEJDzFfMF0wCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQBAjAKBggqhkiG9w0DBzAO
BggqhkiG9w0DAgICAIAwDQYIKoZIhvcNAwICAUAwBwYFKw4DAgcwDQYIKoZIhvcNAwICASgw
gcsGCSsGAQQBgjcQBDGBvTCBujCBpTELMAkGA1UEBhMCVVMxFjAUBgNVBAoTDUVudHJ1c3Qs
IEluYy4xOTA3BgNVBAsTMHd3dy5lbnRydXN0Lm5ldC9DUFMgaXMgaW5jb3Jwb3JhdGVkIGJ5
IHJlZmVyZW5jZTEfMB0GA1UECxMWKGMpIDIwMTAgRW50cnVzdCwgSW5jLjEiMCAGA1UEAxMZ
RW50cnVzdCBDbGFzcyAyIENsaWVudCBDQQIQThqHG/7ruMkAAAAATD169zCBzQYLKoZIhvcN
AQkQAgsxgb2ggbowgaUxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1FbnRydXN0LCBJbmMuMTkw
NwYDVQQLEzB3d3cuZW50cnVzdC5uZXQvQ1BTIGlzIGluY29ycG9yYXRlZCBieSByZWZlcmVu
Y2UxHzAdBgNVBAsTFihjKSAyMDEwIEVudHJ1c3QsIEluYy4xIjAgBgNVBAMTGUVudHJ1c3Qg
Q2xhc3MgMiBDbGllbnQgQ0ECEE4ahxv+67jJAAAAAEw9evcwDQYJKoZIhvcNAQEBBQAEggEA
AOMFJPythgPDyP0ip+mzqxDPXOl6XTibV+KwnxKV+fy3PnVkHl3c/eJDNtYkLMt5EGoR1EeO
36zJ0RokICKnxtdF/F57injiZRjxfoWXNHSWv3csEM5jDunFuj2E+jf0iF0r8V4TZpSqYELR
jX2wh8rlGhdCPttQHNOhkezl9eg0eEMTvCq3TWFjd6/A0aCz0niI7YSZi55PYuHUnjymYmmJ
ALDUWzOoWAIiiiEgFpwX2xcepgH09wfoSOW84vGggWhdIR+W6sBKfWXzgLQH+NXo9YYMazY/
tZ3QY4x1zsxS61Xq00l+xbbGoR1ZITQPCv4cGiI3imtYRx9h/XG9wQAAAAAAAA==
--------------ms050306090807030903090002--
--===============0739537445102164082==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline
LS0KX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18Kc2VsaW51
eCBtYWlsaW5nIGxpc3QgLS0gc2VsaW51eEBsaXN0cy5mZWRvcmFwcm9qZWN0Lm9yZwpUbyB1bnN1
YnNjcmliZSBzZW5kIGFuIGVtYWlsIHRvIHNlbGludXgtbGVhdmVAbGlzdHMuZmVkb3JhcHJvamVj
dC5vcmcKRmVkb3JhIENvZGUgb2YgQ29uZHVjdDogaHR0cHM6Ly9kb2NzLmZlZG9yYXByb2plY3Qu
b3JnL2VuLVVTL3Byb2plY3QvY29kZS1vZi1jb25kdWN0LwpMaXN0IEd1aWRlbGluZXM6IGh0dHBz
Oi8vZmVkb3JhcHJvamVjdC5vcmcvd2lraS9NYWlsaW5nX2xpc3RfZ3VpZGVsaW5lcwpMaXN0IEFy
Y2hpdmVzOiBodHRwczovL2xpc3RzLmZlZG9yYXByb2plY3Qub3JnL2FyY2hpdmVzL2xpc3Qvc2Vs
aW51eEBsaXN0cy5mZWRvcmFwcm9qZWN0Lm9yZwpEbyBub3QgcmVwbHkgdG8gc3BhbSwgcmVwb3J0
IGl0OiBodHRwczovL3BhZ3VyZS5pby9mZWRvcmEtaW5mcmFzdHJ1Y3R1cmUvbmV3X2lzc3VlCg==
--===============0739537445102164082==--