Re: [PATCH 2/2] checkpolicy: add robustness tests for large policy inputs

Thanks for the note on exit 137 (OOM/KILL).
Addressed in v2 along with the non-root CI BASEDIR fix:
https://lore.kernel.org/selinux/[email protected]/T/#u


On Mon, Jul 27, 2026 at 8:00 PM Stephen Smalley
<[email protected]> wrote:
>
> On Mon, Jul 27, 2026 at 1:53 PM Stephen Smalley
> <[email protected]> wrote:
> >
> > On Mon, Jul 27, 2026 at 11:44 AM Akhil Kohli <[email protected]> wrote:
> > >
> > > Add expect_robust to the checkmodule negative harness so oversized
> > > generated .te and .conf sources are exercised without crashing or
> > > hanging. Also cover a module with a large attribute membership set.
> > >
> > > Fixtures are generated at runtime to keep the repository small. Test
> > > size is tunable via LARGE_TE_ALLOWS, LARGE_CONF_ALLOWS,
> > > HUGE_ATTR_TYPES, and BAD_DATA_STRESS.
> > >
> > > Also fix expect_* to return 0 after counting a failure so set -e
> > > does not stop the suite early. Same bug affected the older cases;
> > > exit status is still non-zero when FAIL != 0.
> > >
> > > Signed-off-by: Akhil Kohli <[email protected]>
> > > ---
> > >  .../tests/test_checkmodule_negative.sh        | 178 +++++++++++++++++-
> > >  1 file changed, 170 insertions(+), 8 deletions(-)
> > >
> > > diff --git a/checkpolicy/tests/test_checkmodule_negative.sh b/checkpolicy/tests/test_checkmodule_negative.sh
> > > index 6d289a4c..ed7202f5 100755
> > > --- a/checkpolicy/tests/test_checkmodule_negative.sh
> > > +++ b/checkpolicy/tests/test_checkmodule_negative.sh
> > > @@ -136,6 +150,138 @@ expect_fail_unreadable() {
> > >         echo ""
> > >  }
> > >
> > > +robust_exit_is_crash() {
> > > +       rc="$1"
> > > +
> > > +       # Fatal signals: SEGV (139), ABRT (134), ILL (132), BUS (135), FPE (136).
> > > +       case "${rc}" in
> > > +       132|134|135|136|139)
> > > +               return 0
> >
> > You omitted KILL (137), so OOM-kill would pass as finished safely.
> > Not sure that's your intent.
>
> Also these patches break CI,
> https://github.com/stephensmalley/selinux/actions/runs/30291360086/job/90061649922
>