Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commita4b3fee

Browse files
committed
Clean up 'chkselinuxenv' script.
Eliminate dependencies on "which", as we don't really need that to beinstalled for proper testing. Don't number the tests, as that increasesthe footprint of every patch that wants to add or remove tests. Makethe test output more informative, so that it's a bit easier to see whatwent right (or wrong). Spelling and grammar improvements.
1 parent10c378f commita4b3fee

File tree

1 file changed

+136
-192
lines changed

1 file changed

+136
-192
lines changed

‎contrib/sepgsql/chkselinuxenv‎

Lines changed: 136 additions & 192 deletions
Original file line numberDiff line numberDiff line change
@@ -9,200 +9,153 @@ PG_DATADIR="$2"
99

1010
echo
1111
echo"============== checking selinux environment =============="
12-
#
13-
# Test.0 - necessary commands for environment checks
14-
#
15-
echo -n"test installed commands ..."
16-
if! which --help>&/dev/null;then
17-
echo"failed"
18-
echo
19-
echo"'which' command was not found, executable or installed."
20-
echo"Please make sure your PATH, or install this command at first."
21-
echo
22-
echo"If yum is available on your system, it will suggest packages"
23-
echo"to be installed:"
24-
echo" # yum provides which"
12+
13+
# matchpathcon must be present to assess whether the installation environment
14+
# is OK.
15+
echo -n"checking for matchpathcon ..."
16+
if! matchpathcon -n.>/dev/null2>&1;then
17+
echo"not found"
18+
echo""
19+
echo"matchpathcon not found; please install it or update your PATH."
2520
exit 1
2621
fi
27-
if! matchpathcon -n />&/dev/null;then
22+
echo"ok"
23+
24+
# runcon must be present to launch psql using the correct environment
25+
echo -n"checking for runcon ..."
26+
if! runcon --help>/dev/null2>&1;then
2827
echo"failed"
29-
echo
30-
echo"'matchpathcon' command was not found, executable or installed."
31-
echo"Please make sure your PATH, or install this command at first."
32-
echo
33-
echo"If yum is available on your system, it will suggest packages"
34-
echo"to be installed:"
35-
echo" # yum provides which"
28+
echo""
29+
echo"The runcon command must exist and be executable; it is used to"
30+
echo"launch psql command with a particular domain. It is typically"
31+
echo"included within the coreutils package."
32+
echo""
3633
exit 1
3734
fi
3835
echo"ok"
3936

40-
#
41-
# Test.1 - must be launched at unconfined_t domain
42-
#
43-
echo -n"test unconfined_t domain ..."
44-
37+
# check that the user is running in the unconfined_t domain
38+
echo -n"checking current user domain ..."
4539
DOMAIN=`id -Z2>/dev/null| sed's/:/ /g'| awk'{print $3}'`
40+
echo${DOMAIN:-failed}
4641
if ["${DOMAIN}"!="unconfined_t" ];then
47-
echo"failed"
48-
echo
49-
echo"This regression test needs to be launched on unconfined_t domain."
50-
echo
51-
echo"The unconfined_t domain is mostly default domain of users' shell"
52-
echo"process. So, we suggest you to revert your special configuration"
53-
echo"on your system, as follows:"
54-
echo
42+
echo""
43+
echo"This regression test must be launched from the unconfined_t domain."
44+
echo""
45+
echo"The unconfined_t domain is typically the default domain for user"
46+
echo"shell processes. If the default has been changed on your system,"
47+
echo"you can revert the changes like this:"
48+
echo""
5549
echo"\$ su -"
5650
echo" # semanage login -d`whoami`"
57-
echo
58-
echo"Or, add a setting tologin asunconfined_t domain"
59-
echo
51+
echo""
52+
echo"Or,you canadd a setting tolog in using theunconfined_t domain:"
53+
echo""
6054
echo"\$ su -"
6155
echo" # semanage login -a -s unconfined_u -r s0-s0:c0.c255`whoami`"
62-
echo
56+
echo""
6357
exit 1
6458
fi
65-
echo"ok"
66-
67-
#
68-
# Test.2 - 'runcon' must exist and be executable
69-
#
70-
echo -n"test runcon command ..."
7159

72-
CMD_RUNCON="`which runcon2>/dev/null`"
73-
if [!-x"${CMD_RUNCON}" ];then
74-
echo"failed"
75-
echo
76-
echo"The runcon must exist and be executable; it is internally used to"
77-
echo"launch psql command with a particular domain. It is mostly included"
78-
echo"within coreutils package. So, our suggestion is to install the latest"
79-
echo"version of this package."
80-
echo
81-
exit 1
82-
fi
83-
echo"ok"
84-
85-
#
86-
# Test.3 - 'sestatus' must exist and be executable
87-
#
88-
echo -n"test sestatus command ..."
89-
90-
CMD_SESTATUS="`which sestatus2>/dev/null`"
91-
if [!-x"${CMD_SESTATUS}" ];then
92-
echo"failed"
93-
echo
94-
echo"The sestatus should exist and be executable; it is internally used to"
95-
echo"this checks; to show configuration of SELinux. It is mostly included"
96-
echo"within policycoreutils package. So, our suggestion is to install the"
97-
echo"latest version of this package."
98-
echo
60+
# SELinux must be configured to enforcing mode
61+
echo -n"checking selinux operating mode ..."
62+
CURRENT_MODE=`env LANG=C sestatus| grep'Current mode:'| awk'{print $3}'`
63+
echo${CURRENT_MODE:-failed}
64+
if ["${CURRENT_MODE}"!= enforcing ];then
65+
if ["${CURRENT_MODE}"= permissive-o"${CURRENT_MODE}"= disabled ];then
66+
echo""
67+
echo"Before running the regression tests, SELinux must be enabled and"
68+
echo"must be running in enforcing mode."
69+
echo""
70+
echo"If SELinux is currently running in permissive mode, you can"
71+
echo"switch to enforcing command using the 'setenforce' command."
72+
echo
73+
echo"\$ su -"
74+
echo" # setenforce 1"
75+
echo""
76+
echo"The system default setting is configured in /etc/selinux/config,"
77+
echo"or using a kernel bool parameter."
78+
echo""
79+
else
80+
echo""
81+
echo"Unable to determine the current selinux operating mode. Please"
82+
echo"verify that the sestatus command is installed and in your PATH."
83+
echo""
84+
fi
9985
exit 1
10086
fi
101-
echo"ok"
102-
103-
#
104-
# Test.4 - 'getsebool' must exist and be executable
105-
#
106-
echo -n"test getsebool command ..."
107-
108-
CMD_GETSEBOOL="`which getsebool`"
109-
if [!-x"${CMD_GETSEBOOL}" ];then
110-
echo"failed"
111-
echo
112-
echo"The getsebool should exist and be executable; it is internally used to"
113-
echo"this checks; to show current setting of SELinux boolean variables."
114-
echo"It is mostly included within libselinux-utils package. So, our suggestion"
115-
echo"is to install the latest version of this package."
116-
echo
117-
exit 1
118-
fi
119-
echo"ok"
120-
121-
#
122-
# Test.5 - SELinux must be configured to enforcing mode
123-
#
124-
echo -n"test enforcing mode ..."
12587

126-
CURRENT_MODE=`env LANG=C${CMD_SESTATUS}| grep'Current mode:'| awk'{print $3}'`
127-
if ["${CURRENT_MODE}"!="enforcing" ];then
128-
echo"failed"
129-
echo
130-
echo"SELinux must be configured to 'enforcing' mode."
131-
echo"You can switch SELinux to enforcing mode using setenforce command,"
132-
echo"as follows:"
133-
echo
134-
echo"\$ su -"
135-
echo" # setenforce 1"
136-
echo
137-
echo"The system default setting is configured at /etc/selinux/config,"
138-
echo"or kernel bool parameter. Please also check it, if you see this"
139-
echo"message although you didn't switch to permissive mode."
140-
echo
141-
exit 1
88+
# 'sepgsql-regtest' policy module must be loaded
89+
echo -n"checking for sepgsql-regtest policy ..."
90+
SELINUX_MNT=`env LANG=C sestatus2>/dev/null| grep'^SELinuxfs mount:'| awk'{print $3}'`
91+
if ["$SELINUX_MNT"="" ];then
92+
echo"failed"
93+
echo""
94+
echo"Unable to find SELinuxfs mount point."
95+
echo""
96+
echo"The sestatus command should report the location where SELinuxfs"
97+
echo"is mounted, but did not do so."
98+
echo""
99+
exit 1
142100
fi
143-
echo"ok"
144-
145-
#
146-
# Test.6 - 'sepgsql-regtest' policy module must be loaded
147-
#
148-
echo -n"test sepgsql-regtest policy ..."
149-
150-
SELINUX_MNT=`env LANG=C${CMD_SESTATUS}| grep'^SELinuxfs mount:'| awk'{print $3}'`
151101
if [!-e${SELINUX_MNT}/booleans/sepgsql_regression_test_mode ];then
152102
echo"failed"
153-
echo
154-
echo"The 'sepgsql-regtest' policy modulemust be installed; that provide"
155-
echo"a set of special rules for this regression test."
156-
echo"You can install this moduleas follows:"
157-
echo
103+
echo""
104+
echo"The 'sepgsql-regtest' policy moduleappears not to be installed."
105+
echo"Without this policy installed, the regression tests will fail."
106+
echo"You can install this moduleusing the following commands:"
107+
echo""
158108
echo"\$ make -f /usr/share/selinux/devel/Makefile -C contrib/selinux"
159109
echo"\$ su"
160110
echo" # semodule -i contrib/sepgsql/sepgsql-regtest.pp"
161-
echo
162-
echo"Then, you canconfirmthe policy packagebeing installed,as follows:"
163-
echo
111+
echo""
112+
echo"Toconfirmthat policy packageis installed,use this command:"
113+
echo""
164114
echo" # semodule -l | grep sepgsql"
165-
echo
115+
echo""
166116
exit 1
167117
fi
168118
echo"ok"
169119

170-
#
171-
# Test.7 - 'sepgsql_regression_test_mode' must be turned on
172-
#
173-
echo -n"test selinux boolean ..."
174-
175-
if!${CMD_GETSEBOOL} sepgsql_regression_test_mode| grep -q' on$';then
176-
echo"failed"
177-
echo
178-
echo"The boolean variable of 'sepgsql_regression_test_mode' must be"
179-
echo"turned. It affects an internal state of SELinux policy, then"
180-
echo"a set of rules to run regression test will be activated."
181-
echo"You can turn on this variable as follows:"
182-
echo
183-
echo"\$ su -"
184-
echo" # setsebool sepgsql_regression_test_mode 1"
185-
echo
186-
echo"Also note that we recommend to turn off this variable after the"
187-
echo"regression test, because it activates unnecessary rules."
188-
echo
120+
# Verify that sepgsql_regression_test_mode is active.
121+
echo -n"checking whether policy is enabled ..."
122+
POLICY_STATUS=`getsebool sepgsql_regression_test_mode| awk'{print $3}'`
123+
echo${POLICY_STATUS:-failed}
124+
if ["${POLICY_STATUS}"!="on" ];then
125+
echo""
126+
echo"The SELinux boolean 'sepgsql_regression_test_mode' must be"
127+
echo"turned on in order to enable the rules necessary to run the"
128+
echo"regression tests."
129+
echo""
130+
if"${POLICY_STATUS}" ="";then
131+
echo"We attempted to determine the state of this Boolean using"
132+
echo"'getsebool', but that command did not produce the expected"
133+
echo"output. Please verify that getsebool is available and in"
134+
echo"your PATH."
135+
else
136+
echo"You can turn on this variable using the following commands:"
137+
echo""
138+
echo"\$ su -"
139+
echo" # setsebool sepgsql_regression_test_mode 1"
140+
echo""
141+
echo"For security reasons, it is suggested that you turn off this"
142+
echo"variable when regression testing is complete and the associated"
143+
echo"rules are no longer needed."
144+
fi
145+
echo""
189146
exit 1
190147
fi
191-
echo"ok"
192-
193-
#
194-
# Test.8 - 'psql' command must be executable by test domain
195-
#
196-
echo -n"test execution of psql ..."
197148

149+
# 'psql' command must be executable by test domain
150+
echo -n"checking whether we can run psql ..."
198151
CMD_PSQL="${PG_BINDIR}/psql"
199-
${CMD_RUNCON} -t sepgsql_regtest_user_t${CMD_PSQL} --help>& /dev/null
152+
runcon -t sepgsql_regtest_user_t${CMD_PSQL} --help>& /dev/null
200153
if [$?-ne 0 ];then
201154
echo"failed"
202155
echo
203-
echo"The${CMD_PSQL} must be executableby sepgsql_regtest_user_t"
204-
echo"domain.Ithas restricted privileges compared to unconfined_t,"
205-
echo"so you should ensurewhether this command is labeled correctly."
156+
echo"${CMD_PSQL} must be executablefrom the sepgsql_regtest_user_t"
157+
echo"domain.The domainhas restricted privileges compared to"
158+
echo"unconfined_t,so you should ensurethat it is labeled correctly."
206159
echo
207160
echo"\$ su - (not needed, if you owns installation directory)"
208161
EXPECT_PSQL=`matchpathcon -n${CMD_PSQL}| sed's/:/ /g'| awk'{print $3}'`
@@ -226,61 +179,52 @@ if [ $? -ne 0 ]; then
226179
fi
227180
echo"ok"
228181

229-
#
230-
# Test.9 - 'sepgsql' must be installed
231-
# and, not configured to permissive mode
232-
#
233-
echo -n"test sepgsql installation ..."
234-
182+
# loadable module must be installed and not configured to permissive mode
183+
echo -n"checking sepgsql installation ..."
235184
VAL="`${CMD_PSQL} template1 -tc'SHOW sepgsql.permissive'2>/dev/null`"
236185
RETVAL="$?"
237186
if [$RETVAL-eq 2 ];then
238187
echo"failed"
239-
echo
240-
echo"The postgresql server process is not connectable."
241-
echo"Please check your installation first, rather than selinux settings."
242-
echo
188+
echo""
189+
echo"Unable to connect to the server. Please check your installation."
190+
echo""
243191
exit 1
244192
elif [$RETVAL-ne 0 ];then
245193
echo"failed"
246-
echo
247-
echo"The sepgsql module was not loaded. So, our recommendation is to"
248-
echo"confirm 'shared_preload_libraries' setting in postgresql.conf,"
249-
echo"then restart server process."
250-
echo"It must have '\$libdir/sepgsql' at least."
251-
echo
194+
echo""
195+
echo"The 'sepgsql' module does not appear to be loaded. Please verify"
196+
echo"that the 'shared_preload_libraries' setting in postgresql.conf"
197+
echo"includes sepgsql, and then stop and restart the server."
198+
echo""
252199
exit 1
253200
elif!echo"$VAL"| grep -q'off$';then
254201
echo"failed"
255-
echo
256-
echo"The GUC variable 'sepgsql.permissive' was set to 'on', although"
257-
echo"system configuration is enforcing mode."
258-
echo"You should eliminate this setting from postgresql.conf, then"
259-
echo"restart server process."
260-
echo
202+
echo""
203+
echo"The GUC variable 'sepgsql.permissive' is set to 'on'. It must be"
204+
echo"turned off before running the regression tests."
205+
echo""
261206
exit 1
262207
fi
263208
echo"ok"
264209

265-
#
266-
# Test.10 - 'template1' database must be labeled
267-
#
268-
echo -n"test template1 database ..."
269-
270-
NUM=`${CMD_PSQL} template1 -tc'SELECT count(*) FROM pg_catalog.pg_seclabel'2>/dev/null`
210+
# template1 database must be labeled
211+
echo -n"checking for labels in template1 ..."
212+
NUM=`${CMD_PSQL} template1 -Atc'SELECT count(*) FROM pg_catalog.pg_seclabel'2>/dev/null`
271213
if [-z"${NUM}"-o"$NUM"-eq 0 ];then
272-
echo"failed!"
273-
echo
274-
echo"Initial labels must be assigned on the 'template1' database; that shall"
275-
echo"be copied to the database for regression test."
214+
echo"failed"
215+
echo""
216+
echo"In order to regression test sepgsql, initial labels must be assigned"
217+
echo"on the 'template1' database. These labels will be copied into the"
218+
echo"regression test database."
219+
echo""
276220
echo"See Installation section of the PostgreSQL documentation."
277-
echo
221+
echo""
278222
exit 1
279223
fi
280-
echo"ok"
224+
echo"found${NUM}"
281225

282226
#
283227
# check complete -
284228
#
285-
echo
229+
echo""
286230
exit 0

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp