Re: [PATCH 2/2] checkpolicy/tests: Modify tests to check handling of initial sids

On Tue, Nov 4, 2025 at 3:52=E2=80=AFPM James Carter <[email protected]> wro=
te:
>
> For policy_allonce.conf and policy_allonce_xen.conf declare the
> first three initial sids, but only assign a context to the first
> and third. This will cause the second initial sid to be dropped
> from the binary policy and cause the handling of a gap in the
> initial sids to be tested.
>
> Update the expected and expected_opt policies to reflect the new
> expected resulting policies.
>
> Signed-off-by: James Carter <[email protected]>

Acked-by: Stephen Smalley <[email protected]>
Tested-by: Stephen Smalley <[email protected]>

> ---
>  checkpolicy/tests/policy_allonce.conf                  | 3 +++
>  checkpolicy/tests/policy_allonce.expected.conf         | 3 +++
>  checkpolicy/tests/policy_allonce.expected_opt.conf     | 3 +++
>  checkpolicy/tests/policy_allonce_xen.conf              | 3 +++
>  checkpolicy/tests/policy_allonce_xen.expected.conf     | 3 +++
>  checkpolicy/tests/policy_allonce_xen.expected_opt.conf | 3 +++
>  6 files changed, 18 insertions(+)
>
> diff --git a/checkpolicy/tests/policy_allonce.conf b/checkpolicy/tests/po=
licy_allonce.conf
> index 4b1edb4f..5e09f74b 100644
> --- a/checkpolicy/tests/policy_allonce.conf
> +++ b/checkpolicy/tests/policy_allonce.conf
> @@ -7,6 +7,8 @@ class dir
>  class file
>  class process
>  sid kernel
> +sid security
> +sid unlabeled
>  common COMMON1 { CPERM1 }
>  class CLASS1 { PERM1 ioctl }
>  class CLASS2 inherits COMMON1
> @@ -64,6 +66,7 @@ constrain CLASS1 { PERM1 } (u1 =3D=3D u2 or (r1 =3D=3D =
r2 and t1 =3D=3D t2));
>  # sameuser will be turned into (u1 =3D=3D u2)
>  validatetrans CLASS2 sameuser and t3 =3D=3D ATTR1;
>  sid kernel USER1:ROLE1:TYPE1
> +sid unlabeled USER1:ROLE1:TYPE1
>  # fscon statements are not dumped
>  fscon 2 3 USER1:ROLE1:TYPE1 USER1:ROLE1:TYPE1
>  fs_use_xattr btrfs USER1:ROLE1:TYPE1;
> diff --git a/checkpolicy/tests/policy_allonce.expected.conf b/checkpolicy=
/tests/policy_allonce.expected.conf
> index 17eff98c..a88d8785 100644
> --- a/checkpolicy/tests/policy_allonce.expected.conf
> +++ b/checkpolicy/tests/policy_allonce.expected.conf
> @@ -7,6 +7,8 @@ class dir
>  class file
>  class process
>  sid kernel
> +sid security
> +sid unlabeled
>  common COMMON1 { CPERM1 }
>  class CLASS1 { PERM1 ioctl }
>  class CLASS2 inherits COMMON1
> @@ -72,6 +74,7 @@ user USER1 roles ROLE1;
>  constrain CLASS1 { PERM1 } (u1 =3D=3D u2 or (r1 =3D=3D r2 and t1 =3D=3D =
t2));
>  validatetrans CLASS2 (u1 =3D=3D u2 and t3 =3D=3D ATTR1);
>  sid kernel USER1:ROLE1:TYPE1
> +sid unlabeled USER1:ROLE1:TYPE1
>  fs_use_xattr btrfs USER1:ROLE1:TYPE1;
>  fs_use_trans devpts USER1:ROLE1:TYPE1;
>  fs_use_task pipefs USER1:ROLE1:TYPE1;
> diff --git a/checkpolicy/tests/policy_allonce.expected_opt.conf b/checkpo=
licy/tests/policy_allonce.expected_opt.conf
> index 6b0f73fe..3d21c310 100644
> --- a/checkpolicy/tests/policy_allonce.expected_opt.conf
> +++ b/checkpolicy/tests/policy_allonce.expected_opt.conf
> @@ -7,6 +7,8 @@ class dir
>  class file
>  class process
>  sid kernel
> +sid security
> +sid unlabeled
>  common COMMON1 { CPERM1 }
>  class CLASS1 { PERM1 ioctl }
>  class CLASS2 inherits COMMON1
> @@ -72,6 +74,7 @@ user USER1 roles ROLE1;
>  constrain CLASS1 { PERM1 } (u1 =3D=3D u2 or (r1 =3D=3D r2 and t1 =3D=3D =
t2));
>  validatetrans CLASS2 (u1 =3D=3D u2 and t3 =3D=3D ATTR1);
>  sid kernel USER1:ROLE1:TYPE1
> +sid unlabeled USER1:ROLE1:TYPE1
>  fs_use_xattr btrfs USER1:ROLE1:TYPE1;
>  fs_use_trans devpts USER1:ROLE1:TYPE1;
>  fs_use_task pipefs USER1:ROLE1:TYPE1;
> diff --git a/checkpolicy/tests/policy_allonce_xen.conf b/checkpolicy/test=
s/policy_allonce_xen.conf
> index 6402683a..dfdf979f 100644
> --- a/checkpolicy/tests/policy_allonce_xen.conf
> +++ b/checkpolicy/tests/policy_allonce_xen.conf
> @@ -6,6 +6,8 @@ class dir
>  class file
>  class process
>  sid kernel
> +sid dom0
> +sid domio
>  common COMMON1 { CPERM1 }
>  class CLASS1 { PERM1 }
>  class CLASS2 inherits COMMON1
> @@ -53,6 +55,7 @@ user USER1 roles ROLE1;
>  constrain CLASS1 { PERM1 } (u1 =3D=3D u2 or (r1 =3D=3D r2 and t1 =3D=3D =
t2));
>  validatetrans CLASS2 sameuser and t3 =3D=3D ATTR1;
>  sid kernel USER1:ROLE1:TYPE1
> +sid domio USER1:ROLE1:TYPE1
>  pirqcon 13 USER1:ROLE1:TYPE1
>  iomemcon 13 USER1:ROLE1:TYPE1
>  iomemcon 23-31 USER1:ROLE1:TYPE1
> diff --git a/checkpolicy/tests/policy_allonce_xen.expected.conf b/checkpo=
licy/tests/policy_allonce_xen.expected.conf
> index a4573ccb..e72517f4 100644
> --- a/checkpolicy/tests/policy_allonce_xen.expected.conf
> +++ b/checkpolicy/tests/policy_allonce_xen.expected.conf
> @@ -6,6 +6,8 @@ class dir
>  class file
>  class process
>  sid xen
> +sid dom0
> +sid domio
>  common COMMON1 { CPERM1 }
>  class CLASS1 { PERM1 }
>  class CLASS2 inherits COMMON1
> @@ -56,6 +58,7 @@ user USER1 roles ROLE1;
>  constrain CLASS1 { PERM1 } (u1 =3D=3D u2 or (r1 =3D=3D r2 and t1 =3D=3D =
t2));
>  validatetrans CLASS2 (u1 =3D=3D u2 and t3 =3D=3D ATTR1);
>  sid xen USER1:ROLE1:TYPE1
> +sid domio USER1:ROLE1:TYPE1
>  pirqcon 13 USER1:ROLE1:TYPE1
>  iomemcon 0xd USER1:ROLE1:TYPE1
>  iomemcon 0x17-0x1f USER1:ROLE1:TYPE1
> diff --git a/checkpolicy/tests/policy_allonce_xen.expected_opt.conf b/che=
ckpolicy/tests/policy_allonce_xen.expected_opt.conf
> index 8fd3b226..932ff1f8 100644
> --- a/checkpolicy/tests/policy_allonce_xen.expected_opt.conf
> +++ b/checkpolicy/tests/policy_allonce_xen.expected_opt.conf
> @@ -6,6 +6,8 @@ class dir
>  class file
>  class process
>  sid xen
> +sid dom0
> +sid domio
>  common COMMON1 { CPERM1 }
>  class CLASS1 { PERM1 }
>  class CLASS2 inherits COMMON1
> @@ -52,6 +54,7 @@ user USER1 roles ROLE1;
>  constrain CLASS1 { PERM1 } (u1 =3D=3D u2 or (r1 =3D=3D r2 and t1 =3D=3D =
t2));
>  validatetrans CLASS2 (u1 =3D=3D u2 and t3 =3D=3D ATTR1);
>  sid xen USER1:ROLE1:TYPE1
> +sid domio USER1:ROLE1:TYPE1
>  pirqcon 13 USER1:ROLE1:TYPE1
>  iomemcon 0xd USER1:ROLE1:TYPE1
>  iomemcon 0x17-0x1f USER1:ROLE1:TYPE1
> --
> 2.50.0
>