Skip to content

remove unnecessary code #17

remove unnecessary code

remove unnecessary code #17

Workflow file for this run

name: Build tests
on: [push, pull_request]
env:
# Minimum versions to build refpolicy.
PYTHON_VERSION: "3.10"
SELINUX_USERSPACE_VERSION: checkpolicy-3.2
USERSPACE_SRC: "selinux-src"
# branch for sechecker
SECHECKER_VERSION: "4.4"
SETOOLS_SRC: "setools-src"
jobs:
lint:
runs-on: ubuntu-22.04
steps:
- uses: actions/checkout@v4
# This version should be the minimum required to run the fc checker
# or the standard Python version on Ubuntu.
- name: Set up Python
uses: actions/setup-python@v5
with:
python-version: "${{env.PYTHON_VERSION}}"
- name: Install dependencies
run: |
sudo apt-get update -q
sudo apt-get install -qy autoconf-archive bison flex libconfuse-dev uthash-dev
- name: Checkout SELint
uses: actions/checkout@v4
with:
repository: SELinuxProject/selint
ref: 'v1.5.0'
path: selint
- name: Build SELint
run: |
cd selint/
./autogen.sh
./configure --without-check
make -j$(nproc)
sudo make install
- name: Create generated policy files
run: |
make conf
make generate
- name: Run file context checker
run: python3 -t -t -E -W error testing/check_fc_files.py
- name: Run SELint
run: |
# disable C-005 (Permissions in av rule or class declaration not ordered) for now: needs fixing
# disable C-008 (Conditional expression identifier from foreign module) for now: needs fixing
# disable W-005 (Interface call from module not in optional_policy block): refpolicy does not follow this rule
selint --source --recursive --summary --fail --disable C-005 --disable C-008 --disable W-005 policy
build:
runs-on: ubuntu-22.04
strategy:
fail-fast: false
matrix:
build-opts:
- {type: standard, distro: gentoo, monolithic: y, systemd: y, direct_initrc: n}
- {type: standard, distro: gentoo, monolithic: y, systemd: n, direct_initrc: n}
- {type: standard, distro: gentoo, monolithic: n, systemd: y, direct_initrc: n}
- {type: standard, distro: gentoo, monolithic: n, systemd: n, direct_initrc: n}
- {type: mcs, distro: gentoo, monolithic: y, systemd: y, direct_initrc: n}
- {type: mcs, distro: gentoo, monolithic: y, systemd: n, direct_initrc: n}
- {type: mcs, distro: gentoo, monolithic: n, systemd: y, direct_initrc: n}
- {type: mcs, distro: gentoo, monolithic: n, systemd: n, direct_initrc: n}
- {type: mls, distro: gentoo, monolithic: y, systemd: y, direct_initrc: n}
- {type: mls, distro: gentoo, monolithic: y, systemd: n, direct_initrc: n}
- {type: mls, distro: gentoo, monolithic: n, systemd: y, direct_initrc: n}
- {type: mls, distro: gentoo, monolithic: n, systemd: n, direct_initrc: n}
- {type: standard, distro: gentoo, monolithic: y, systemd: y, apps-off: unconfined, direct_initrc: n}
- {type: standard, distro: gentoo, monolithic: y, systemd: n, apps-off: unconfined, direct_initrc: n}
- {type: mcs, distro: gentoo, monolithic: y, systemd: y, apps-off: unconfined, direct_initrc: n}
- {type: mcs, distro: gentoo, monolithic: y, systemd: n, apps-off: unconfined, direct_initrc: n}
- {type: mls, distro: gentoo, monolithic: y, systemd: y, apps-off: unconfined, direct_initrc: n}
- {type: mls, distro: gentoo, monolithic: y, systemd: n, apps-off: unconfined, direct_initrc: n}
- {type: standard, distro: gentoo, monolithic: y, systemd: y, direct_initrc: y}
- {type: standard, distro: gentoo, monolithic: y, systemd: n, direct_initrc: y}
- {type: standard, distro: gentoo, monolithic: n, systemd: y, direct_initrc: y}
- {type: standard, distro: gentoo, monolithic: n, systemd: n, direct_initrc: y}
- {type: mcs, distro: gentoo, monolithic: y, systemd: y, direct_initrc: y}
- {type: mcs, distro: gentoo, monolithic: y, systemd: n, direct_initrc: y}
- {type: mcs, distro: gentoo, monolithic: n, systemd: y, direct_initrc: y}
- {type: mcs, distro: gentoo, monolithic: n, systemd: n, direct_initrc: y}
- {type: mls, distro: gentoo, monolithic: y, systemd: y, direct_initrc: y}
- {type: mls, distro: gentoo, monolithic: y, systemd: n, direct_initrc: y}
- {type: mls, distro: gentoo, monolithic: n, systemd: y, direct_initrc: y}
- {type: mls, distro: gentoo, monolithic: n, systemd: n, direct_initrc: y}
- {type: standard, distro: gentoo, monolithic: y, systemd: y, apps-off: unconfined, direct_initrc: y}
- {type: standard, distro: gentoo, monolithic: y, systemd: n, apps-off: unconfined, direct_initrc: y}
- {type: mcs, distro: gentoo, monolithic: y, systemd: y, apps-off: unconfined, direct_initrc: y}
- {type: mcs, distro: gentoo, monolithic: y, systemd: n, apps-off: unconfined, direct_initrc: y}
- {type: mls, distro: gentoo, monolithic: y, systemd: y, apps-off: unconfined, direct_initrc: y}
- {type: mls, distro: gentoo, monolithic: y, systemd: n, apps-off: unconfined, direct_initrc: y}
steps:
- name: Checkout Reference Policy
uses: actions/checkout@v4
- name: Checkout SELinux userspace tools and libs
uses: actions/checkout@v4
with:
repository: SELinuxProject/selinux
ref: "${{env.SELINUX_USERSPACE_VERSION}}"
path: "${{env.USERSPACE_SRC}}"
- name: Checkout setools
uses: actions/checkout@v4
with:
repository: SELinuxProject/setools
ref: "${{env.SECHECKER_VERSION}}"
path: "${{env.SETOOLS_SRC}}"
# This should be the minimum required Python version to build refpolicy.
# or the standard Python version on Ubuntu.
- name: Set up Python
uses: actions/setup-python@v5
with:
python-version: "${{env.PYTHON_VERSION}}"
- name: Install dependencies
run: |
sudo apt-get update -q
sudo apt-get install -qy \
bison \
flex \
gettext \
libaudit-dev \
libbz2-dev \
libpcre3-dev \
libxml2-utils \
swig
- name: Configure environment
run: |
echo "DESTDIR=/tmp/refpolicy" >> $GITHUB_ENV
echo "PYTHON=python" >> $GITHUB_ENV
echo "TEST_TOOLCHAIN=/tmp/selinux" >> $GITHUB_ENV
echo "TYPE=${{matrix.build-opts.type}}" >> $GITHUB_ENV
echo "DISTRO=${{matrix.build-opts.distro}}" >> $GITHUB_ENV
echo "MONOLITHIC=${{matrix.build-opts.monolithic}}" >> $GITHUB_ENV
echo "SYSTEMD=${{matrix.build-opts.systemd}}" >> $GITHUB_ENV
echo "APPS_OFF=${{matrix.build-opts.apps-off}}" >> $GITHUB_ENV
echo "DIRECT_INITRC=${{matrix.build-opts.direct_initrc}}" >> $GITHUB_ENV
echo "WERROR=y" >> $GITHUB_ENV
- name: Build toolchain
run: |
# Download current SELinux userspace tools and libraries
git clone https://github.com/SELinuxProject/selinux.git ${TEST_TOOLCHAIN_SRC} -b ${SELINUX_USERSPACE_VERSION}
# Drop secilc to break xmlto dependence (secilc isn't used here anyway)
sed -i -e 's/secilc//' ${TEST_TOOLCHAIN_SRC}/Makefile
echo "DIRECT_INITRC=${{matrix.build-opts.direct_initrc}}" >> $GITHUB_ENV
# Drop sepolicy to break setools dependence (sepolicy isn't used anyway)
sed -i -e 's/sepolicy//' ${TEST_TOOLCHAIN_SRC}/policycoreutils/Makefile
# Drop restorecond to break glib dependence
sed -i -e 's/ restorecond//' ${TEST_TOOLCHAIN_SRC}/policycoreutils/Makefile
# Drop sandbox to break libcap-ng dependence
sed -i -e 's/ sandbox//' ${TEST_TOOLCHAIN_SRC}/policycoreutils/Makefile
# Compile and install SELinux toolchain
make OPT_SUBDIRS=semodule-utils DESTDIR=${TEST_TOOLCHAIN} -C ${TEST_TOOLCHAIN_SRC} install
- name: Build refpolicy
run: |
# Drop build.conf settings to listen to env vars
sed -r -i -e '/(MONOLITHIC|TYPE|DISTRO|SYSTEMD|DIRECT_INITRC|WERROR)/d' build.conf
make bare
make conf
make
make validate
- name: Build docs
run: |
make xml
make html
- name: Test installation
run: |
make install
make install-headers
make install-src
make install-docs
make install-udica-templates
make install-appconfig
# This skips some combinations to keep GitHub actions runtime lower by
# eliminating duplicate analyses.
- name: Validate security goals
run: |
if [[ $MONOLITHIC == "y" ]] && [[ $TYPE != "standard" ]] && [[ $APPS_OFF ]] && [[ $SYSTEMD == "y" ]]; then
policy_file=$(make MONOLITHIC=y --eval='output_filename: ; @echo $(polver)' output_filename)
sechecker testing/sechecker.ini "${policy_file}"
else
echo "Skipped"
fi