Re: [PATCH 1/2] checkpolicy: extend bad-data tests for type, role, and user errors

On Mon, Jul 27, 2026 at 11:44 AM Akhil Kohli <[email protected]> wrote:
>
> Add negative .te fixtures for duplicate type/attribute declarations,
> type/attribute name conflicts, invalid type names, and malformed role
> and user stanzas. Run checkmodule negative tests as non-root in CI so
> the unreadable .te case is exercised outside root-only skips.
>
> Signed-off-by: Akhil Kohli <[email protected]>
> ---
> diff --git a/checkpolicy/tests/negative/bad_user.te b/checkpolicy/tests/negative/bad_user.te
> new file mode 100644
> index 00000000..e7460dd7
> --- /dev/null
> +++ b/checkpolicy/tests/negative/bad_user.te
> @@ -0,0 +1,3 @@
> +module bad_user 1.0;
> +
> +user bad_user_u garbage_token;

This won't reach the garbage_token because it fails on token "user"
due to lacking any avrule_decls, e.g. require { }.
Not sure if that was your intent.