Re: [PATCH 2/2] checkpolicy: add robustness tests for large policy inputs

On Mon, Jul 27, 2026 at 11:44 AM Akhil Kohli <[email protected]> wrote:
>
> Add expect_robust to the checkmodule negative harness so oversized
> generated .te and .conf sources are exercised without crashing or
> hanging. Also cover a module with a large attribute membership set.
>
> Fixtures are generated at runtime to keep the repository small. Test
> size is tunable via LARGE_TE_ALLOWS, LARGE_CONF_ALLOWS,
> HUGE_ATTR_TYPES, and BAD_DATA_STRESS.
>
> Also fix expect_* to return 0 after counting a failure so set -e
> does not stop the suite early. Same bug affected the older cases;
> exit status is still non-zero when FAIL != 0.
>
> Signed-off-by: Akhil Kohli <[email protected]>
> ---
>  .../tests/test_checkmodule_negative.sh        | 178 +++++++++++++++++-
>  1 file changed, 170 insertions(+), 8 deletions(-)
>
> diff --git a/checkpolicy/tests/test_checkmodule_negative.sh b/checkpolicy/tests/test_checkmodule_negative.sh
> index 6d289a4c..ed7202f5 100755
> --- a/checkpolicy/tests/test_checkmodule_negative.sh
> +++ b/checkpolicy/tests/test_checkmodule_negative.sh
> @@ -136,6 +150,138 @@ expect_fail_unreadable() {
>         echo ""
>  }
>
> +robust_exit_is_crash() {
> +       rc="$1"
> +
> +       # Fatal signals: SEGV (139), ABRT (134), ILL (132), BUS (135), FPE (136).
> +       case "${rc}" in
> +       132|134|135|136|139)
> +               return 0

You omitted KILL (137), so OOM-kill would pass as finished safely.
Not sure that's your intent.