[PATCH v2 0/2] checkpolicy: extend bad-data and robustness tests

This is a follow-up to the checkmodule bad-data harness already merged:

  checkpolicy: add bad data protection tests
  https://lore.kernel.org/selinux/[email protected]/

Patch 1 adds negative .te fixtures for duplicate type/attribute
declarations, type/attribute name conflicts, invalid type names, and
malformed role/user stanzas. It also runs the negative suite as
non-root in CI so the unreadable .te case is exercised (root can still
read mode 000 files).

Patch 2 adds expect_robust coverage for oversized generated .te/.conf
inputs and a large attribute membership set, with tunable sizes. It
also fixes expect_* helpers to return 0 after counting a failure so
set -e does not abort the suite early; the script exit status is still
non-zero when FAIL != 0.

Together these bring the harness from 16 to 25 tests
(1 positive + 21 negative + 3 robust).

Changes since v1:
- Fix non-root CI BASEDIR resolution when cd to the script dir fails
  under /home/runner/work (Actions failure).
- Treat exit 137 (SIGKILL, including OOM-kill) as a crash in
  expect_robust.
- Drop internal section/PDF markers from comments and test labels.
- Keep both semodule-utils and checkpolicy non-root CI blocks in
  run_tests.yml when applying onto current main.

Tested with:
  cd checkpolicy
  make checkmodule checkpolicy LIBSEPOLA=../libsepol/src/libsepol.a \
    CPPFLAGS='-I../libsepol/include'
  make test LIBSEPOLA=../libsepol/src/libsepol.a \
    CPPFLAGS='-I../libsepol/include'

Result: roundtrip tests pass; checkmodule negative tests:
25 passed, 0 failed.

Also verified via GitHub Actions on the fork branch (full matrix green),
including the checkpolicy bad-data (non-root) step.

Akhil Kohli (2):
  checkpolicy: extend bad-data tests for type, role, and user errors
  checkpolicy: add robustness tests for large policy inputs

 .github/workflows/run_tests.yml               |  11 +
 checkpolicy/tests/negative/bad_role.te        |  12 +
 checkpolicy/tests/negative/bad_user.te        |   3 +
 checkpolicy/tests/negative/dup_attribute.te   |  13 ++
 checkpolicy/tests/negative/dup_type.te        |  11 +
 .../tests/negative/invalid_type_name.te       |   9 +
 .../tests/negative/type_attr_conflict.te      |  10 +
 .../tests/test_checkmodule_negative.sh        | 205 +++++++++++++++++-
 8 files changed, 263 insertions(+), 11 deletions(-)
 create mode 100644 checkpolicy/tests/negative/bad_role.te
 create mode 100644 checkpolicy/tests/negative/bad_user.te
 create mode 100644 checkpolicy/tests/negative/dup_attribute.te
 create mode 100644 checkpolicy/tests/negative/dup_type.te
 create mode 100644 checkpolicy/tests/negative/invalid_type_name.te
 create mode 100644 checkpolicy/tests/negative/type_attr_conflict.te

-- 
2.55.0