Re: [PATCH 2/2] checkpolicy: add robustness tests for large policy inputs

On Mon, Jul 27, 2026 at 1:53 PM Stephen Smalley
<[email protected]> wrote:
>
> On Mon, Jul 27, 2026 at 11:44 AM Akhil Kohli <[email protected]> wrote:
> >
> > Add expect_robust to the checkmodule negative harness so oversized
> > generated .te and .conf sources are exercised without crashing or
> > hanging. Also cover a module with a large attribute membership set.
> >
> > Fixtures are generated at runtime to keep the repository small. Test
> > size is tunable via LARGE_TE_ALLOWS, LARGE_CONF_ALLOWS,
> > HUGE_ATTR_TYPES, and BAD_DATA_STRESS.
> >
> > Also fix expect_* to return 0 after counting a failure so set -e
> > does not stop the suite early. Same bug affected the older cases;
> > exit status is still non-zero when FAIL != 0.
> >
> > Signed-off-by: Akhil Kohli <[email protected]>
> > ---
> >  .../tests/test_checkmodule_negative.sh        | 178 +++++++++++++++++-
> >  1 file changed, 170 insertions(+), 8 deletions(-)
> >
> > diff --git a/checkpolicy/tests/test_checkmodule_negative.sh b/checkpolicy/tests/test_checkmodule_negative.sh
> > index 6d289a4c..ed7202f5 100755
> > --- a/checkpolicy/tests/test_checkmodule_negative.sh
> > +++ b/checkpolicy/tests/test_checkmodule_negative.sh
> > @@ -136,6 +150,138 @@ expect_fail_unreadable() {
> >         echo ""
> >  }
> >
> > +robust_exit_is_crash() {
> > +       rc="$1"
> > +
> > +       # Fatal signals: SEGV (139), ABRT (134), ILL (132), BUS (135), FPE (136).
> > +       case "${rc}" in
> > +       132|134|135|136|139)
> > +               return 0
>
> You omitted KILL (137), so OOM-kill would pass as finished safely.
> Not sure that's your intent.

Also these patches break CI,
https://github.com/stephensmalley/selinux/actions/runs/30291360086/job/90061649922