Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
Skip to content

Commit a4b3fee

Browse files
robertmhaasrobertmhaas
committed
Clean up 'chkselinuxenv' script.
Eliminate dependencies on "which", as we don't really need that to be installed for proper testing. Don't number the tests, as that increases the footprint of every patch that wants to add or remove tests. Make the test output more informative, so that it's a bit easier to see what went right (or wrong). Spelling and grammar improvements.
1 parent 10c378f commit a4b3fee

File tree

1 file changed

+136
-192
lines changed

1 file changed

+136
-192
lines changed

‎contrib/sepgsql/chkselinuxenv

+136-192
Original file line numberDiff line numberDiff line change
@@ -9,200 +9,153 @@ PG_DATADIR="$2"
99

1010
echo
1111
echo "============== checking selinux environment =============="
12-
#
13-
# Test.0 - necessary commands for environment checks
14-
#
15-
echo -n "test installed commands ... "
16-
if ! which --help >&/dev/null; then
17-
echo "failed"
18-
echo
19-
echo "'which' command was not found, executable or installed."
20-
echo "Please make sure your PATH, or install this command at first."
21-
echo
22-
echo "If yum is available on your system, it will suggest packages"
23-
echo "to be installed:"
24-
echo " # yum provides which"
12+
13+
# matchpathcon must be present to assess whether the installation environment
14+
# is OK.
15+
echo -n "checking for matchpathcon ... "
16+
if ! matchpathcon -n . >/dev/null 2>&1; then
17+
echo "not found"
18+
echo ""
19+
echo "matchpathcon not found; please install it or update your PATH."
2520
exit 1
2621
fi
27-
if ! matchpathcon -n / >&/dev/null; then
22+
echo "ok"
23+
24+
# runcon must be present to launch psql using the correct environment
25+
echo -n "checking for runcon ... "
26+
if ! runcon --help >/dev/null 2>&1; then
2827
echo "failed"
29-
echo
30-
echo "'matchpathcon' command was not found, executable or installed."
31-
echo "Please make sure your PATH, or install this command at first."
32-
echo
33-
echo "If yum is available on your system, it will suggest packages"
34-
echo "to be installed:"
35-
echo " # yum provides which"
28+
echo ""
29+
echo "The runcon command must exist and be executable; it is used to"
30+
echo "launch psql command with a particular domain. It is typically"
31+
echo "included within the coreutils package."
32+
echo ""
3633
exit 1
3734
fi
3835
echo "ok"
3936

40-
#
41-
# Test.1 - must be launched at unconfined_t domain
42-
#
43-
echo -n "test unconfined_t domain ... "
44-
37+
# check that the user is running in the unconfined_t domain
38+
echo -n "checking current user domain ... "
4539
DOMAIN=`id -Z 2>/dev/null | sed 's/:/ /g' | awk '{print $3}'`
40+
echo ${DOMAIN:-failed}
4641
if [ "${DOMAIN}" != "unconfined_t" ]; then
47-
echo "failed"
48-
echo
49-
echo "This regression test needs to be launched on unconfined_t domain."
50-
echo
51-
echo "The unconfined_t domain is mostly default domain of users' shell"
52-
echo "process. So, we suggest you to revert your special configuration"
53-
echo "on your system, as follows:"
54-
echo
42+
echo ""
43+
echo "This regression test must be launched from the unconfined_t domain."
44+
echo ""
45+
echo "The unconfined_t domain is typically the default domain for user"
46+
echo "shell processes. If the default has been changed on your system,"
47+
echo "you can revert the changes like this:"
48+
echo ""
5549
echo " \$ su -"
5650
echo " # semanage login -d `whoami`"
57-
echo
58-
echo "Or, add a setting to login as unconfined_t domain"
59-
echo
51+
echo ""
52+
echo "Or, you can add a setting to log in using the unconfined_t domain:"
53+
echo ""
6054
echo " \$ su -"
6155
echo " # semanage login -a -s unconfined_u -r s0-s0:c0.c255 `whoami`"
62-
echo
56+
echo ""
6357
exit 1
6458
fi
65-
echo "ok"
66-
67-
#
68-
# Test.2 - 'runcon' must exist and be executable
69-
#
70-
echo -n "test runcon command ... "
7159

72-
CMD_RUNCON="`which runcon 2>/dev/null`"
73-
if [ ! -x "${CMD_RUNCON}" ]; then
74-
echo "failed"
75-
echo
76-
echo "The runcon must exist and be executable; it is internally used to"
77-
echo "launch psql command with a particular domain. It is mostly included"
78-
echo "within coreutils package. So, our suggestion is to install the latest"
79-
echo "version of this package."
80-
echo
81-
exit 1
82-
fi
83-
echo "ok"
84-
85-
#
86-
# Test.3 - 'sestatus' must exist and be executable
87-
#
88-
echo -n "test sestatus command ... "
89-
90-
CMD_SESTATUS="`which sestatus 2>/dev/null`"
91-
if [ ! -x "${CMD_SESTATUS}" ]; then
92-
echo "failed"
93-
echo
94-
echo "The sestatus should exist and be executable; it is internally used to"
95-
echo "this checks; to show configuration of SELinux. It is mostly included"
96-
echo "within policycoreutils package. So, our suggestion is to install the"
97-
echo "latest version of this package."
98-
echo
60+
# SELinux must be configured to enforcing mode
61+
echo -n "checking selinux operating mode ... "
62+
CURRENT_MODE=`env LANG=C sestatus | grep 'Current mode:' | awk '{print $3}'`
63+
echo ${CURRENT_MODE:-failed}
64+
if [ "${CURRENT_MODE}" != enforcing ]; then
65+
if [ "${CURRENT_MODE}" = permissive -o "${CURRENT_MODE}" = disabled ]; then
66+
echo ""
67+
echo "Before running the regression tests, SELinux must be enabled and"
68+
echo "must be running in enforcing mode."
69+
echo ""
70+
echo "If SELinux is currently running in permissive mode, you can"
71+
echo "switch to enforcing command using the 'setenforce' command."
72+
echo
73+
echo " \$ su -"
74+
echo " # setenforce 1"
75+
echo ""
76+
echo "The system default setting is configured in /etc/selinux/config,"
77+
echo "or using a kernel bool parameter."
78+
echo ""
79+
else
80+
echo ""
81+
echo "Unable to determine the current selinux operating mode. Please"
82+
echo "verify that the sestatus command is installed and in your PATH."
83+
echo ""
84+
fi
9985
exit 1
10086
fi
101-
echo "ok"
102-
103-
#
104-
# Test.4 - 'getsebool' must exist and be executable
105-
#
106-
echo -n "test getsebool command ... "
107-
108-
CMD_GETSEBOOL="`which getsebool`"
109-
if [ ! -x "${CMD_GETSEBOOL}" ]; then
110-
echo "failed"
111-
echo
112-
echo "The getsebool should exist and be executable; it is internally used to"
113-
echo "this checks; to show current setting of SELinux boolean variables."
114-
echo "It is mostly included within libselinux-utils package. So, our suggestion"
115-
echo "is to install the latest version of this package."
116-
echo
117-
exit 1
118-
fi
119-
echo "ok"
120-
121-
#
122-
# Test.5 - SELinux must be configured to enforcing mode
123-
#
124-
echo -n "test enforcing mode ... "
12587

126-
CURRENT_MODE=`env LANG=C ${CMD_SESTATUS} | grep 'Current mode:' | awk '{print $3}'`
127-
if [ "${CURRENT_MODE}" != "enforcing" ]; then
128-
echo "failed"
129-
echo
130-
echo "SELinux must be configured to 'enforcing' mode."
131-
echo "You can switch SELinux to enforcing mode using setenforce command,"
132-
echo "as follows:"
133-
echo
134-
echo " \$ su -"
135-
echo " # setenforce 1"
136-
echo
137-
echo "The system default setting is configured at /etc/selinux/config,"
138-
echo "or kernel bool parameter. Please also check it, if you see this"
139-
echo "message although you didn't switch to permissive mode."
140-
echo
141-
exit 1
88+
# 'sepgsql-regtest' policy module must be loaded
89+
echo -n "checking for sepgsql-regtest policy ... "
90+
SELINUX_MNT=`env LANG=C sestatus 2>/dev/null | grep '^SELinuxfs mount:' | awk '{print $3}'`
91+
if [ "$SELINUX_MNT" = "" ]; then
92+
echo "failed"
93+
echo ""
94+
echo "Unable to find SELinuxfs mount point."
95+
echo ""
96+
echo "The sestatus command should report the location where SELinuxfs"
97+
echo "is mounted, but did not do so."
98+
echo ""
99+
exit 1
142100
fi
143-
echo "ok"
144-
145-
#
146-
# Test.6 - 'sepgsql-regtest' policy module must be loaded
147-
#
148-
echo -n "test sepgsql-regtest policy ... "
149-
150-
SELINUX_MNT=`env LANG=C ${CMD_SESTATUS} | grep '^SELinuxfs mount:' | awk '{print $3}'`
151101
if [ ! -e ${SELINUX_MNT}/booleans/sepgsql_regression_test_mode ]; then
152102
echo "failed"
153-
echo
154-
echo "The 'sepgsql-regtest' policy module must be installed; that provide"
155-
echo "a set of special rules for this regression test."
156-
echo "You can install this module as follows:"
157-
echo
103+
echo ""
104+
echo "The 'sepgsql-regtest' policy module appears not to be installed."
105+
echo "Without this policy installed, the regression tests will fail."
106+
echo "You can install this module using the following commands:"
107+
echo ""
158108
echo " \$ make -f /usr/share/selinux/devel/Makefile -C contrib/selinux"
159109
echo " \$ su"
160110
echo " # semodule -i contrib/sepgsql/sepgsql-regtest.pp"
161-
echo
162-
echo "Then, you can confirm the policy package being installed, as follows:"
163-
echo
111+
echo ""
112+
echo "To confirm that policy package is installed, use this command:"
113+
echo ""
164114
echo " # semodule -l | grep sepgsql"
165-
echo
115+
echo ""
166116
exit 1
167117
fi
168118
echo "ok"
169119

170-
#
171-
# Test.7 - 'sepgsql_regression_test_mode' must be turned on
172-
#
173-
echo -n "test selinux boolean ... "
174-
175-
if ! ${CMD_GETSEBOOL} sepgsql_regression_test_mode | grep -q ' on$'; then
176-
echo "failed"
177-
echo
178-
echo "The boolean variable of 'sepgsql_regression_test_mode' must be"
179-
echo "turned. It affects an internal state of SELinux policy, then"
180-
echo "a set of rules to run regression test will be activated."
181-
echo "You can turn on this variable as follows:"
182-
echo
183-
echo " \$ su -"
184-
echo " # setsebool sepgsql_regression_test_mode 1"
185-
echo
186-
echo "Also note that we recommend to turn off this variable after the"
187-
echo "regression test, because it activates unnecessary rules."
188-
echo
120+
# Verify that sepgsql_regression_test_mode is active.
121+
echo -n "checking whether policy is enabled ... "
122+
POLICY_STATUS=`getsebool sepgsql_regression_test_mode | awk '{print $3}'`
123+
echo ${POLICY_STATUS:-failed}
124+
if [ "${POLICY_STATUS}" != "on" ]; then
125+
echo ""
126+
echo "The SELinux boolean 'sepgsql_regression_test_mode' must be"
127+
echo "turned on in order to enable the rules necessary to run the"
128+
echo "regression tests."
129+
echo ""
130+
if "${POLICY_STATUS}" = ""; then
131+
echo "We attempted to determine the state of this Boolean using"
132+
echo "'getsebool', but that command did not produce the expected"
133+
echo "output. Please verify that getsebool is available and in"
134+
echo "your PATH."
135+
else
136+
echo "You can turn on this variable using the following commands:"
137+
echo ""
138+
echo " \$ su -"
139+
echo " # setsebool sepgsql_regression_test_mode 1"
140+
echo ""
141+
echo "For security reasons, it is suggested that you turn off this"
142+
echo "variable when regression testing is complete and the associated"
143+
echo "rules are no longer needed."
144+
fi
145+
echo ""
189146
exit 1
190147
fi
191-
echo "ok"
192-
193-
#
194-
# Test.8 - 'psql' command must be executable by test domain
195-
#
196-
echo -n "test execution of psql ... "
197148

149+
# 'psql' command must be executable by test domain
150+
echo -n "checking whether we can run psql ... "
198151
CMD_PSQL="${PG_BINDIR}/psql"
199-
${CMD_RUNCON} -t sepgsql_regtest_user_t ${CMD_PSQL} --help >& /dev/null
152+
runcon -t sepgsql_regtest_user_t ${CMD_PSQL} --help >& /dev/null
200153
if [ $? -ne 0 ]; then
201154
echo "failed"
202155
echo
203-
echo "The ${CMD_PSQL} must be executable by sepgsql_regtest_user_t"
204-
echo "domain. It has restricted privileges compared to unconfined_t,"
205-
echo "so you should ensure whether this command is labeled correctly."
156+
echo "${CMD_PSQL} must be executable from the sepgsql_regtest_user_t"
157+
echo "domain. The domain has restricted privileges compared to"
158+
echo "unconfined_t, so you should ensure that it is labeled correctly."
206159
echo
207160
echo " \$ su - (not needed, if you owns installation directory)"
208161
EXPECT_PSQL=`matchpathcon -n ${CMD_PSQL} | sed 's/:/ /g' | awk '{print $3}'`
@@ -226,61 +179,52 @@ if [ $? -ne 0 ]; then
226179
fi
227180
echo "ok"
228181

229-
#
230-
# Test.9 - 'sepgsql' must be installed
231-
# and, not configured to permissive mode
232-
#
233-
echo -n "test sepgsql installation ... "
234-
182+
# loadable module must be installed and not configured to permissive mode
183+
echo -n "checking sepgsql installation ... "
235184
VAL="`${CMD_PSQL} template1 -tc 'SHOW sepgsql.permissive' 2>/dev/null`"
236185
RETVAL="$?"
237186
if [ $RETVAL -eq 2 ]; then
238187
echo "failed"
239-
echo
240-
echo "The postgresql server process is not connectable."
241-
echo "Please check your installation first, rather than selinux settings."
242-
echo
188+
echo ""
189+
echo "Unable to connect to the server. Please check your installation."
190+
echo ""
243191
exit 1
244192
elif [ $RETVAL -ne 0 ]; then
245193
echo "failed"
246-
echo
247-
echo "The sepgsql module was not loaded. So, our recommendation is to"
248-
echo "confirm 'shared_preload_libraries' setting in postgresql.conf,"
249-
echo "then restart server process."
250-
echo "It must have '\$libdir/sepgsql' at least."
251-
echo
194+
echo ""
195+
echo "The 'sepgsql' module does not appear to be loaded. Please verify"
196+
echo "that the 'shared_preload_libraries' setting in postgresql.conf"
197+
echo "includes sepgsql, and then stop and restart the server."
198+
echo ""
252199
exit 1
253200
elif ! echo "$VAL" | grep -q 'off$'; then
254201
echo "failed"
255-
echo
256-
echo "The GUC variable 'sepgsql.permissive' was set to 'on', although"
257-
echo "system configuration is enforcing mode."
258-
echo "You should eliminate this setting from postgresql.conf, then"
259-
echo "restart server process."
260-
echo
202+
echo ""
203+
echo "The GUC variable 'sepgsql.permissive' is set to 'on'. It must be"
204+
echo "turned off before running the regression tests."
205+
echo ""
261206
exit 1
262207
fi
263208
echo "ok"
264209

265-
#
266-
# Test.10 - 'template1' database must be labeled
267-
#
268-
echo -n "test template1 database ... "
269-
270-
NUM=`${CMD_PSQL} template1 -tc 'SELECT count(*) FROM pg_catalog.pg_seclabel' 2>/dev/null`
210+
# template1 database must be labeled
211+
echo -n "checking for labels in template1 ... "
212+
NUM=`${CMD_PSQL} template1 -Atc 'SELECT count(*) FROM pg_catalog.pg_seclabel' 2>/dev/null`
271213
if [ -z "${NUM}" -o "$NUM" -eq 0 ]; then
272-
echo "failed!"
273-
echo
274-
echo "Initial labels must be assigned on the 'template1' database; that shall"
275-
echo "be copied to the database for regression test."
214+
echo "failed"
215+
echo ""
216+
echo "In order to regression test sepgsql, initial labels must be assigned"
217+
echo "on the 'template1' database. These labels will be copied into the"
218+
echo "regression test database."
219+
echo ""
276220
echo "See Installation section of the PostgreSQL documentation."
277-
echo
221+
echo ""
278222
exit 1
279223
fi
280-
echo "ok"
224+
echo "found ${NUM}"
281225

282226
#
283227
# check complete -
284228
#
285-
echo
229+
echo ""
286230
exit 0

0 commit comments

Comments
 (0)