Re: [PATCH v2 1/2] checkpolicy: extend bad-data tests for type, role, and user errors

On Mon, Jul 27, 2026 at 6:33 PM Akhil Kohli <[email protected]> wrote:
>
> Add negative .te fixtures for duplicate type/attribute declarations,
> type/attribute name conflicts, invalid type names, and malformed role
> and user stanzas. Run checkmodule negative tests as non-root in CI so
> the unreadable .te case is exercised outside root-only skips.
>
> Signed-off-by: Akhil Kohli <[email protected]>
> ---
>
> diff --git a/checkpolicy/tests/negative/bad_role.te b/checkpolicy/tests/negative/bad_role.te
> new file mode 100644
> index 00000000..3aae2719
> --- /dev/null
> +++ b/checkpolicy/tests/negative/bad_role.te
> @@ -0,0 +1,12 @@
> +module bad_role 1.0;
> +
> +require {
> +       type foo_t;
> +       class file { read };
> +}
> +
> +role bad_role_r types ;
> +
> +type foo_t;
> +
> +allow foo_t foo_t:file read;
> diff --git a/checkpolicy/tests/negative/bad_user.te b/checkpolicy/tests/negative/bad_user.te
> new file mode 100644
> index 00000000..e7460dd7
> --- /dev/null
> +++ b/checkpolicy/tests/negative/bad_user.te
> @@ -0,0 +1,3 @@
> +module bad_user 1.0;
> +
> +user bad_user_u garbage_token;

You might have missed my earlier comment, but again:
this fails NOT on "garbage_token" but on "user" because of
the lack of any "requires" block to meet the grammar
requirement for avrule_decls. Is that intentional?