summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--init.cfg18
-rwxr-xr-xtests/cp/cp-a-selinux.sh4
-rwxr-xr-xtests/install/install-Z-selinux.sh7
-rwxr-xr-xtests/misc/chcon.sh1
-rwxr-xr-xtests/misc/selinux.sh3
-rwxr-xr-xtests/mkdir/restorecon.sh7
6 files changed, 26 insertions, 14 deletions
diff --git a/init.cfg b/init.cfg
index db861944c..f2950efb0 100644
--- a/init.cfg
+++ b/init.cfg
@@ -128,6 +128,15 @@ require_selinux_()
esac
}
+# Return the SELinux type component if available
+get_selinux_type() { ls -Zd "$1" | sed -n 's/.*:\(.*_t\)[: ].*/\1/p'; }
+
+# Whether SELinux Multi Level Security is enabled
+mls_enabled_() {
+ sestatus 2>&1 |
+ grep 'Policy MLS status:.*enabled' > /dev/null
+}
+
# Skip this test if we're not in SELinux "enforcing" mode.
require_selinux_enforcing_()
{
@@ -637,10 +646,13 @@ skip_if_mcstransd_is_running_()
# and if it's running, skip this test.
__ctx=$(stat --printf='%C\n' .) || framework_failure_
case $__ctx in
- *:*:*:*) ;; # four components is ok
- *) # anything else probably means mcstransd is running
- skip_ "unexpected context '$__ctx'; turn off mcstransd" ;;
+ *:*:*:*) __ctx_ok=1 ;; # four components is ok
+ *:*:*) # three components is ok too if there is no MLS
+ mls_enabled_ && __ctk_ok=1 ;;
esac
+
+ test "$__ctx_ok" ||
+ skip_ "unexpected context '$__ctx'; turn off mcstransd"
}
# Skip the current test if umask doesn't work as usual.
diff --git a/tests/cp/cp-a-selinux.sh b/tests/cp/cp-a-selinux.sh
index 89735b65a..391595218 100755
--- a/tests/cp/cp-a-selinux.sh
+++ b/tests/cp/cp-a-selinux.sh
@@ -28,7 +28,8 @@ cwd=$(pwd)
cleanup_() { cd /; umount "$cwd/mnt"; }
# This context is special: it works even when mcstransd isn't running.
-ctx=root:object_r:tmp_t:s0
+ctx='root:object_r:tmp_t'
+mls_enabled_ && ctx="$ctx:s0"
# Check basic functionality - before check on fixed context mount
touch c || framework_failure_
@@ -62,7 +63,6 @@ grep $ctx ed_ctx &&
{ ls -lZd restore/existing_dir; fail=1; }
# Check restorecon (-Z) functionality for file and directory
-get_selinux_type() { ls -Zd "$1" | sed -n 's/.*:\(.*_t\):.*/\1/p'; }
# Also make a dir with our known context
mkdir c_d || framework_failure_
chcon $ctx c_d || framework_failure_
diff --git a/tests/install/install-Z-selinux.sh b/tests/install/install-Z-selinux.sh
index 9c3b6420b..c63a47862 100755
--- a/tests/install/install-Z-selinux.sh
+++ b/tests/install/install-Z-selinux.sh
@@ -21,11 +21,10 @@
print_ver_ ginstall
require_selinux_
-
-get_selinux_type() { ls -Zd "$1" | sed -n 's/.*:\(.*_t\):.*/\1/p'; }
-
mkdir subdir || framework_failure_
-chcon 'root:object_r:tmp_t:s0' subdir || framework_failure_
+ctx='root:object_r:tmp_t'
+mls_enabled_ && ctx="$ctx:s0"
+chcon "$ctx" subdir || framework_failure_
cd subdir
# Since in a tmp_t dir, dirs can be created as user_tmp_t ...
diff --git a/tests/misc/chcon.sh b/tests/misc/chcon.sh
index bd40fbc7d..c99021907 100755
--- a/tests/misc/chcon.sh
+++ b/tests/misc/chcon.sh
@@ -21,6 +21,7 @@ print_ver_ chcon
require_root_
require_selinux_
skip_if_mcstransd_is_running_
+mls_enabled_ || skip_ 'MLS is disabled'
mkdir -p d/sub/s2 || framework_failure_
touch f g d/sub/1 d/sub/2 || framework_failure_
diff --git a/tests/misc/selinux.sh b/tests/misc/selinux.sh
index a9515680a..28c05c4f8 100755
--- a/tests/misc/selinux.sh
+++ b/tests/misc/selinux.sh
@@ -30,7 +30,8 @@ mkfifo_or_skip_ p
# special context that works both with and without mcstransd
-ctx=root:object_r:tmp_t:s0
+ctx='root:object_r:tmp_t'
+mls_enabled_ && ctx="$ctx:s0"
chcon $ctx f d p ||
skip_ '"chcon '$ctx' ..." failed'
diff --git a/tests/mkdir/restorecon.sh b/tests/mkdir/restorecon.sh
index 0e7f03bc9..49e72196f 100755
--- a/tests/mkdir/restorecon.sh
+++ b/tests/mkdir/restorecon.sh
@@ -20,11 +20,10 @@
print_ver_ mkdir mknod mkfifo
require_selinux_
-
-get_selinux_type() { ls -Zd "$1" | sed -n 's/.*:\(.*_t\):.*/\1/p'; }
-
mkdir subdir || framework_failure_
-chcon 'root:object_r:tmp_t:s0' subdir || framework_failure_
+ctx='root:object_r:tmp_t'
+mls_enabled_ && ctx="$ctx:s0"
+chcon "$ctx" subdir || framework_failure_
cd subdir
# --- mkdir -Z ---