Re: [PATCH v4 0/2] checkpolicy: extend bad-data and robustness tests

On Thu, Jul 30, 2026 at 6:32=E2=80=AFAM Akhil Kohli <[email protected]> wr=
ote:
>
> This is a follow-up to the checkmodule bad-data harness already merged:
>   checkpolicy: add bad data protection tests
>   https://lore.kernel.org/selinux/20260710102906.3059833-1-akkohli@redhat=
.com/
>
> Patch 1 adds negative .te fixtures for duplicate type/attribute
> declarations, type/attribute name conflicts, invalid type names, and
> malformed role/user stanzas. It also runs the negative suite as
> non-root in CI so the unreadable .te case is exercised.
>
> Patch 2 adds expect_robust coverage for oversized generated .te/.conf
> inputs and a large attribute membership set, with tunable sizes.
> Together these bring the harness from 16 to 25 tests
> (1 positive + 21 negative + 3 robust).
>
> Changes since v3:
> - Drop trailing whitespace in run_tests.yml after the semodule-utils
>   non-root block (patch 1).
>
> Tested with:
>   cd checkpolicy
>   make checkmodule checkpolicy LIBSEPOLA=3D../libsepol/src/libsepol.a \
>     CPPFLAGS=3D'-I../libsepol/include'
>   make test LIBSEPOLA=3D../libsepol/src/libsepol.a \
>     CPPFLAGS=3D'-I../libsepol/include'
> Result: roundtrip tests pass; checkmodule negative tests:
> 25 passed, 0 failed.
>
> Akhil Kohli (2):
>   checkpolicy: extend bad-data tests for type, role, and user errors
>   checkpolicy: add robustness tests for large policy inputs
>
>  .github/workflows/run_tests.yml               |  11 +
>  checkpolicy/tests/negative/bad_role.te        |  13 ++
>  checkpolicy/tests/negative/bad_user.te        |  15 ++
>  checkpolicy/tests/negative/dup_attribute.te   |  13 ++
>  checkpolicy/tests/negative/dup_type.te        |  11 +
>  .../tests/negative/invalid_type_name.te       |   9 +
>  .../tests/negative/type_attr_conflict.te      |  10 +
>  .../tests/test_checkmodule_negative.sh        | 205 +++++++++++++++++-
>  8 files changed, 276 insertions(+), 11 deletions(-)
>  create mode 100644 checkpolicy/tests/negative/bad_role.te
>  create mode 100644 checkpolicy/tests/negative/bad_user.te
>  create mode 100644 checkpolicy/tests/negative/dup_attribute.te
>  create mode 100644 checkpolicy/tests/negative/dup_type.te
>  create mode 100644 checkpolicy/tests/negative/invalid_type_name.te
>  create mode 100644 checkpolicy/tests/negative/type_attr_conflict.te

This series has been merged.