Project

General

Profile

Actions
Copy link

action #173638

open

action #166613: Yast default selected LSM changes from Apparmor to SELinux, existing openQA test fails in first_boot

[security][tumbleweed] Test also 'targeted' selinux policy on Tumbleweed

Added by tjyrinki_suse about 22 hours ago. Updated about 17 hours ago.

Status:
Workable
Priority:
Normal
Assignee:
-
Category:
-
Target version:
-
Start date:
Due date:
% Done:

0%

Estimated time:
8.00 h
Difficulty:
Tags:
selinux

Description

Currently we test targeted policy on SLE Micro, and minimal otherwise. With selinux becoming the new default in Tumbleweed, we should test also targeted in Tumbleweed, not just the minimal.

Acceptance Criteria

  1. Add targeted selinux policy testing to Tumbleweed

Further Information

https://github.com/os-autoinst/os-autoinst-distri-opensuse/blob/master/lib/selinuxtest.pm#L31

https://bugzilla.suse.com/show_bug.cgi?id=1234037

Actions
Copy link
 #1

Updated by tjyrinki_suse about 19 hours ago

  • Estimated time set to 8.00 h
Actions
Copy link
 #2

Updated by cahu about 17 hours ago ยท Edited

  • Parent task set to #166613

Please note, when we enable SELinux by default in tumbleweed, the default policy will be in targeted mode and enforcing.

There are a few points:

  • the policy will then already be enabled directly after the installation, so tests for "if enabling works" should only be run for scenarios where it is not yet enabled (e.g. UPGRADE from old tumbleweed and the user wants to switch from apparmor to selinux or UPGRADE from old leap that has apparmor); there we should test if manually switching from apparmor works to selinux targeted enforcing and minimum enforcing (the user guide: https://en.opensuse.org/Portal:SELinux/Setup#Setup_SELinux_on_existing_tumbleweed_systems).
  • in general, ( the most important thing ) when SELinux is enabled the audit log should be checked for AVC,USER_AVC,SELINUX_ERR,USER_SELINUX_ERR entries in the audit log after every test in the whole openQA test set so that we can see if policy changes break the functionality; this is partially already done, so it makes sense to check where it is not the case
  • the toolchain tests should also be done in targeted mode (currently they seem to be done in minimum only)
  • testing switching from targeted to minimum and back should be done (with audit log)

Please let me know if you need more infos :)
Please also refer to the tracker ticket: https://progress.opensuse.org/issues/166613

Actions
Copy link
 #3

Updated by cahu about 17 hours ago

ah and just to make sure: the apparmor tests should still continue to be run if apparmor is selected in the installer, so please do not drop them

not sure if @dimstar or @jsegitz have any more points

Actions
Copy link

Also available in: Atom PDF