[PATCH v3 0/2] checkpolicy: extend bad-data and robustness tests

This is a follow-up to the checkmodule bad-data harness already merged:
  checkpolicy: add bad data protection tests
  https://lore.kernel.org/selinux/[email protected]/
Patch 1 adds negative .te fixtures for duplicate type/attribute
declarations, type/attribute name conflicts, invalid type names, and
malformed role/user stanzas. It also runs the negative suite as
non-root in CI so the unreadable .te case is exercised (root can still
read mode 000 files).
Patch 2 adds expect_robust coverage for oversized generated .te/.conf
inputs and a large attribute membership set, with tunable sizes. It
also fixes expect_* helpers to return 0 after counting a failure so
set -e does not abort the suite early; the script exit status is still
non-zero when FAIL != 0.
Together these bring the harness from 16 to 25 tests
(1 positive + 21 negative + 3 robust).
Changes since v2:
- bad_user.te: add a require block and scaffolding so checkmodule fails
  on garbage_token rather than on the bare "user" keyword (missing
  avrule_decls / require).
- Move non-root CI BASEDIR soft-resolve into patch 1 so each patch
  passes CI on its own.
- Brief comments on bad_user.te / bad_role.te clarifying the intended
  failure.
Tested with:
  cd checkpolicy
  make checkmodule checkpolicy LIBSEPOLA=../libsepol/src/libsepol.a \
    CPPFLAGS='-I../libsepol/include'
  make test LIBSEPOLA=../libsepol/src/libsepol.a \
    CPPFLAGS='-I../libsepol/include'
Result: roundtrip tests pass; checkmodule negative tests:
25 passed, 0 failed.

Akhil Kohli (2):
  checkpolicy: extend bad-data tests for type, role, and user errors
  checkpolicy: add robustness tests for large policy inputs

 .github/workflows/run_tests.yml               |  11 +
 checkpolicy/tests/negative/bad_role.te        |  13 ++
 checkpolicy/tests/negative/bad_user.te        |  15 ++
 checkpolicy/tests/negative/dup_attribute.te   |  13 ++
 checkpolicy/tests/negative/dup_type.te        |  11 +
 .../tests/negative/invalid_type_name.te       |   9 +
 .../tests/negative/type_attr_conflict.te      |  10 +
 .../tests/test_checkmodule_negative.sh        | 205 +++++++++++++++++-
 8 files changed, 276 insertions(+), 11 deletions(-)
 create mode 100644 checkpolicy/tests/negative/bad_role.te
 create mode 100644 checkpolicy/tests/negative/bad_user.te
 create mode 100644 checkpolicy/tests/negative/dup_attribute.te
 create mode 100644 checkpolicy/tests/negative/dup_type.te
 create mode 100644 checkpolicy/tests/negative/invalid_type_name.te
 create mode 100644 checkpolicy/tests/negative/type_attr_conflict.te

-- 
2.55.0