From 9a9cd30255bc42e2c9ea5d6c4e3cca550f567f99 Mon Sep 17 00:00:00 2001 From: Christian Heimes Date: Wed, 23 Sep 2020 15:22:00 +0200 Subject: [PATCH] Verify freeipa-selinux's ipa module is loaded ipa-custodia tests will fail if the ipa.pp override module from freeipa-selinux is not correctly installed, loaded, and enabled. Signed-off-by: Christian Heimes Reviewed-By: Francois Cami --- ipaplatform/base/paths.py | 1 + .../test_integration/test_installation.py | 19 +++++++++++++++++++ 2 files changed, 20 insertions(+) diff --git a/ipaplatform/base/paths.py b/ipaplatform/base/paths.py index 3c8665c84..f7055fabc 100644 --- a/ipaplatform/base/paths.py +++ b/ipaplatform/base/paths.py @@ -267,6 +267,7 @@ class BasePathNamespace: RESTORECON = "/usr/sbin/restorecon" SELINUXENABLED = "/usr/sbin/selinuxenabled" SETSEBOOL = "/usr/sbin/setsebool" + SEMODULE = "/usr/sbin/semodule" SMBD = "/usr/sbin/smbd" USERADD = "/usr/sbin/useradd" FONTS_DIR = "/usr/share/fonts" diff --git a/ipatests/test_integration/test_installation.py b/ipatests/test_integration/test_installation.py index 019df391f..f66c1477d 100644 --- a/ipatests/test_integration/test_installation.py +++ b/ipatests/test_integration/test_installation.py @@ -1019,6 +1019,25 @@ class TestInstallMaster(IntegrationTest): [paths.IPA_CUSTODIA_CHECK, self.master.hostname] ) + @pytest.mark.skipif( + paths.SEMODULE is None, reason="test requires semodule command" + ) + def test_ipa_selinux_policy(self): + # check that freeipa-selinux's policy module is loaded and + # not disabled + result = self.master.run_command( + [paths.SEMODULE, "-lfull"] + ) + # prio module pp [disabled] + # 100: default priority + # 200: decentralized SELinux policy priority + entries = { + tuple(line.split()) + for line in result.stdout_text.split('\n') + if line.strip() + } + assert ('200', 'ipa', 'pp') in entries + class TestInstallMasterKRA(IntegrationTest):