|
| 1 | +#!/bin/sh |
| 2 | +# |
| 3 | +# Run the sepgsql regression tests, after making a lot of environmental checks |
| 4 | +# to try to ensure that the SELinux environment is set up appropriately and |
| 5 | +# the database is configured correctly. |
| 6 | +# |
| 7 | +# Note that this must be run against an installed Postgres database. |
| 8 | +# There's no equivalent of "make check", and that wouldn't be terribly useful |
| 9 | +# since much of the value is in checking that you installed sepgsql into |
| 10 | +# your database correctly. |
| 11 | +# |
| 12 | +# This must be run in the contrib/sepgsql directory of a Postgres build tree. |
| 13 | +# |
| 14 | + |
| 15 | +PG_BINDIR=`pg_config --bindir` |
| 16 | + |
| 17 | +echo |
| 18 | +echo"============== checking selinux environment ==============" |
| 19 | + |
| 20 | +# matchpathcon must be present to assess whether the installation environment |
| 21 | +# is OK. |
| 22 | +echo -n"checking for matchpathcon ..." |
| 23 | +if! matchpathcon -n.>/dev/null2>&1;then |
| 24 | +echo"not found" |
| 25 | +echo"" |
| 26 | +echo"The matchpathcon command must be available." |
| 27 | +echo"Please install it or update your PATH to include it" |
| 28 | +echo"(it is typically in '/usr/sbin', which might not be in your PATH)." |
| 29 | +echo"matchpathcon is typically included in the libselinux-utils package." |
| 30 | +exit 1 |
| 31 | +fi |
| 32 | +echo"ok" |
| 33 | + |
| 34 | +# runcon must be present to launch psql using the correct environment |
| 35 | +echo -n"checking for runcon ..." |
| 36 | +if! runcon --help>/dev/null2>&1;then |
| 37 | +echo"not found" |
| 38 | +echo"" |
| 39 | +echo"The runcon command must be available." |
| 40 | +echo"runcon is typically included in the coreutils package." |
| 41 | +echo"" |
| 42 | +exit 1 |
| 43 | +fi |
| 44 | +echo"ok" |
| 45 | + |
| 46 | +# check sestatus too, since that lives in yet another package |
| 47 | +echo -n"checking for sestatus ..." |
| 48 | +if! sestatus>/dev/null2>&1;then |
| 49 | +echo"not found" |
| 50 | +echo"" |
| 51 | +echo"The sestatus command must be available." |
| 52 | +echo"sestatus is typically included in the policycoreutils package." |
| 53 | +echo"" |
| 54 | +exit 1 |
| 55 | +fi |
| 56 | +echo"ok" |
| 57 | + |
| 58 | +# check that the user is running in the unconfined_t domain |
| 59 | +echo -n"checking current user domain ..." |
| 60 | +DOMAIN=`id -Z2>/dev/null| sed's/:/ /g'| awk'{print $3}'` |
| 61 | +echo${DOMAIN:-failed} |
| 62 | +if ["${DOMAIN}"!= unconfined_t ];then |
| 63 | +echo"" |
| 64 | +echo"The regression tests must be launched from the unconfined_t domain." |
| 65 | +echo"" |
| 66 | +echo"The unconfined_t domain is typically the default domain for user" |
| 67 | +echo"shell processes. If the default has been changed on your system," |
| 68 | +echo"you can revert the changes like this:" |
| 69 | +echo"" |
| 70 | +echo"\$ sudo semanage login -d`whoami`" |
| 71 | +echo"" |
| 72 | +echo"Or, you can add a setting to log in using the unconfined_t domain:" |
| 73 | +echo"" |
| 74 | +echo"\$ sudo semanage login -a -s unconfined_u -r s0-s0:c0.c255`whoami`" |
| 75 | +echo"" |
| 76 | +exit 1 |
| 77 | +fi |
| 78 | + |
| 79 | +# SELinux must be configured in enforcing mode |
| 80 | +echo -n"checking selinux operating mode ..." |
| 81 | +CURRENT_MODE=`LANG=C sestatus| grep'^Current mode:'| awk'{print $3}'` |
| 82 | +echo${CURRENT_MODE:-failed} |
| 83 | +if ["${CURRENT_MODE}"= enforcing ];then |
| 84 | +: OK |
| 85 | +elif ["${CURRENT_MODE}"= permissive-o"${CURRENT_MODE}"= disabled ];then |
| 86 | +echo"" |
| 87 | +echo"Before running the regression tests, SELinux must be enabled and" |
| 88 | +echo"must be running in enforcing mode." |
| 89 | +echo"" |
| 90 | +echo"If SELinux is currently running in permissive mode, you can" |
| 91 | +echo"switch to enforcing mode using the 'setenforce' command." |
| 92 | +echo |
| 93 | +echo"\$ sudo setenforce 1" |
| 94 | +echo"" |
| 95 | +echo"The system default setting is configured in /etc/selinux/config," |
| 96 | +echo"or using a kernel boot parameter." |
| 97 | +echo"" |
| 98 | +exit 1 |
| 99 | +else |
| 100 | +echo"" |
| 101 | +echo"Unable to determine the current selinux operating mode. Please" |
| 102 | +echo"verify that the sestatus command is installed and in your PATH." |
| 103 | +echo"" |
| 104 | +exit 1 |
| 105 | +fi |
| 106 | + |
| 107 | +# 'sepgsql-regtest' policy module must be loaded |
| 108 | +echo -n"checking for sepgsql-regtest policy ..." |
| 109 | +SELINUX_MNT=`LANG=C sestatus| grep'^SELinuxfs mount:'| awk'{print $3}'` |
| 110 | +if ["$SELINUX_MNT"="" ];then |
| 111 | +echo"failed" |
| 112 | +echo"" |
| 113 | +echo"Unable to find SELinuxfs mount point." |
| 114 | +echo"" |
| 115 | +echo"The sestatus command should report the location where SELinuxfs" |
| 116 | +echo"is mounted, but did not do so." |
| 117 | +echo"" |
| 118 | +exit 1 |
| 119 | +fi |
| 120 | +if [!-e"${SELINUX_MNT}/booleans/sepgsql_regression_test_mode" ];then |
| 121 | +echo"failed" |
| 122 | +echo"" |
| 123 | +echo"The 'sepgsql-regtest' policy module appears not to be installed." |
| 124 | +echo"Without this policy installed, the regression tests will fail." |
| 125 | +echo"You can install this module using the following commands:" |
| 126 | +echo"" |
| 127 | +echo"\$ make -f /usr/share/selinux/devel/Makefile" |
| 128 | +echo"\$ sudo semodule -u sepgsql-regtest.pp" |
| 129 | +echo"" |
| 130 | +echo"To confirm that the policy package is installed, use this command:" |
| 131 | +echo"" |
| 132 | +echo"\$ sudo semodule -l | grep sepgsql" |
| 133 | +echo"" |
| 134 | +exit 1 |
| 135 | +fi |
| 136 | +echo"ok" |
| 137 | + |
| 138 | +# Verify that sepgsql_regression_test_mode is active. |
| 139 | +echo -n"checking whether policy is enabled ..." |
| 140 | +POLICY_STATUS=`getsebool sepgsql_regression_test_mode| awk'{print $3}'` |
| 141 | +echo${POLICY_STATUS:-failed} |
| 142 | +if ["${POLICY_STATUS}"!= on ];then |
| 143 | +echo"" |
| 144 | +echo"The SELinux boolean 'sepgsql_regression_test_mode' must be" |
| 145 | +echo"turned on in order to enable the rules necessary to run the" |
| 146 | +echo"regression tests." |
| 147 | +echo"" |
| 148 | +if ["${POLICY_STATUS}"="" ];then |
| 149 | +echo"We attempted to determine the state of this Boolean using" |
| 150 | +echo"'getsebool', but that command did not produce the expected" |
| 151 | +echo"output. Please verify that getsebool is available and in" |
| 152 | +echo"your PATH." |
| 153 | +else |
| 154 | +echo"You can turn on this variable using the following commands:" |
| 155 | +echo"" |
| 156 | +echo"\$ sudo setsebool sepgsql_regression_test_mode on" |
| 157 | +echo"" |
| 158 | +echo"For security reasons, it is suggested that you turn off this" |
| 159 | +echo"variable when regression testing is complete and the associated" |
| 160 | +echo"rules are no longer needed." |
| 161 | +fi |
| 162 | +echo"" |
| 163 | +exit 1 |
| 164 | +fi |
| 165 | + |
| 166 | +# 'psql' command must be executable from test domain |
| 167 | +echo -n"checking whether we can run psql ..." |
| 168 | +CMD_PSQL="${PG_BINDIR}/psql" |
| 169 | +if [!-e"${CMD_PSQL}" ];then |
| 170 | +echo"not found" |
| 171 | +echo |
| 172 | +echo"${CMD_PSQL} was not found." |
| 173 | +echo"Check your PostgreSQL installation." |
| 174 | +echo |
| 175 | +exit 1 |
| 176 | +fi |
| 177 | +runcon -t sepgsql_regtest_user_t"${CMD_PSQL}" --help>& /dev/null |
| 178 | +if [$?-ne 0 ];then |
| 179 | +echo"failed" |
| 180 | +echo |
| 181 | +echo"${CMD_PSQL} must be executable from the" |
| 182 | +echo"sepgsql_regtest_user_t domain. That domain has restricted privileges" |
| 183 | +echo"compared to unconfined_t, so the problem may be the psql file's" |
| 184 | +echo"SELinux label. Try" |
| 185 | +echo |
| 186 | + PSQL_T=`matchpathcon -n"${CMD_PSQL}"| sed's/:/ /g'| awk'{print $3}'` |
| 187 | +if ["${PSQL_T}"="user_home_t" ];then |
| 188 | +# Installation appears to be in /home directory |
| 189 | +echo"\$ sudo restorecon -R${PG_BINDIR}" |
| 190 | +echo |
| 191 | +echo"Or, using chcon" |
| 192 | +echo |
| 193 | +echo"\$ sudo chcon -t user_home_t${CMD_PSQL}" |
| 194 | +else |
| 195 | +echo"\$ sudo restorecon -R${PG_BINDIR}" |
| 196 | +echo |
| 197 | +echo"Or, using chcon" |
| 198 | +echo |
| 199 | +echo"\$ sudo chcon -t bin_t${CMD_PSQL}" |
| 200 | +fi |
| 201 | +echo |
| 202 | +exit 1 |
| 203 | +fi |
| 204 | +echo"ok" |
| 205 | + |
| 206 | +# loadable module must be installed and not configured to permissive mode |
| 207 | +echo -n"checking sepgsql installation ..." |
| 208 | +VAL="`${CMD_PSQL} -t -c'SHOW sepgsql.permissive' template12>/dev/null`" |
| 209 | +RETVAL="$?" |
| 210 | +if [$RETVAL-eq 2 ];then |
| 211 | +echo"failed" |
| 212 | +echo"" |
| 213 | +echo"Could not connect to the database server." |
| 214 | +echo"Please check your PostgreSQL installation." |
| 215 | +echo"" |
| 216 | +exit 1 |
| 217 | +elif [$RETVAL-ne 0 ];then |
| 218 | +echo"failed" |
| 219 | +echo"" |
| 220 | +echo"The sepgsql module does not appear to be loaded. Please verify" |
| 221 | +echo"that the 'shared_preload_libraries' setting in postgresql.conf" |
| 222 | +echo"includes 'sepgsql', and then restart the server." |
| 223 | +echo"" |
| 224 | +echo"See Installation section of the contrib/sepgsql documentation." |
| 225 | +echo"" |
| 226 | +exit 1 |
| 227 | +elif!echo"$VAL"| grep -q'off$';then |
| 228 | +echo"failed" |
| 229 | +echo"" |
| 230 | +echo"The parameter 'sepgsql.permissive' is set to 'on'. It must be" |
| 231 | +echo"turned off before running the regression tests." |
| 232 | +echo"" |
| 233 | +exit 1 |
| 234 | +fi |
| 235 | +echo"ok" |
| 236 | + |
| 237 | +# template1 database must be labeled |
| 238 | +# NOTE: this test is wrong; we really ought to be checking template0. |
| 239 | +# But we can't connect to that without extra pushups, and it's not worth it. |
| 240 | +echo -n"checking for labels in template1 ..." |
| 241 | +NUM=`${CMD_PSQL} -At -c'SELECT count(*) FROM pg_catalog.pg_seclabel' template12>/dev/null` |
| 242 | +if [-z"${NUM}" ];then |
| 243 | +echo"failed" |
| 244 | +echo"" |
| 245 | +echo"In order to test sepgsql, initial labels must be assigned within" |
| 246 | +echo"the 'template1' database. These labels will be copied into the" |
| 247 | +echo"regression test database." |
| 248 | +echo"" |
| 249 | +echo"See Installation section of the contrib/sepgsql documentation." |
| 250 | +echo"" |
| 251 | +exit 1 |
| 252 | +fi |
| 253 | +echo"found${NUM}" |
| 254 | + |
| 255 | +# |
| 256 | +# checking complete - let's run the tests |
| 257 | +# |
| 258 | + |
| 259 | +echo |
| 260 | +echo"============== running sepgsql regression tests ==============" |
| 261 | + |
| 262 | +make REGRESS="label dml misc" REGRESS_OPTS="--launcher ./launcher" installcheck |
| 263 | + |
| 264 | +# exit with the exit code provided by "make" |