Security-Enhanced Linux

This directory contains the functional test suite for the LSM-based SELinux security module. Please refer to the test report available in doc/tests for complete documentation for this test suite. This README only covers a subset of that report, specifically the sections on running the tests and adding new tests. Your kernel should have been built with the configuration options specified by the defconfig file in this directory to run this testsuite. If you already have a working kernel configuration you can merge the provided defconfig file with your existing kernel .config file (or one generated via e.g. make localmodconfig or other commands) using the kernel ./scripts/kconfig/merge config.sh script as follows: Some of the config options may not be set in the final config because they are unnecessary based on your base config, e.g. you only need the CONFIG FS SECURITY option to be enabled for the particular filesystem type being used for the testing. You should not enable any other security modules in your kernel configuration unless you use the security= option to select a module at boot time. Only one primary security module may be active at a time. perl-Test (test harness used by the testsuite) perl-Test-Harness (test harness used by the testsuite) perl-Test-Simple (for Test::More ) perl-lib (for lib ; split out from perl-interpreter since Fedora 33) selinux-policy-devel (to build the test policy) gcc (to build the test programs) libselinux-devel (to build some of the test programs) net-tools (for ifconfig , used by capable net/test ) netlabel tools (to load NetLabel configuration during inet socket tests) iptables-nft (to load the iptables SECMARK rules during inet socket tests) lksctp-tools-devel (to build the SCTP test programs) attr (tools used by the overlayfs tests) libbpf-devel (tools used by the bpf tests) keyutils-libs-devel (tools used by the keys tests) kernel-devel (used by the kernel module tests) quota, xfsprogs-devel and libuuid-devel (used by the filesystem tests) e2fsprogs (used by the ext4 filesystem tests) f2fs-tools (used by the f2fs filesystem tests) jfsutils (used by the jfs filesystem tests) dosfstools (used by the vfat filesystem tests) btrfs-progs (used by the btrfs filesystem tests) nftables (used by inet socket and sctp tests if ver = 9.3 for secmark testing ) rdma-core-devel (to build the ibpkey test program) liburing-devel (to build the iouring test program) On Debian, you must first take steps to install and activate SELinux since it is not enabled in the default install. Make sure to backup your system first if you care about any local data. If this shows something other than "unconfined u:unconfined r:unconfined t:s0-s0:c0.c1023", you will need to first fix labeling or policy problems in your base system before proceeding. Make sure that your shell context is correct and you can switch to enforcing mode without breaking your system before proceeding. git clone cd netlabel tools sudo apt-get install autotools-dev autoconf automake libtool pkg-config libnl-3-dev libnl-genl-3-dev ./autogen.sh ./configure --prefix=/usr make sudo make install The testsuite requires a pre-existing base policy configuration of SELinux, using the reference policy as the baseline. It also requires the core SELinux userland packages ( libsepol , checkpolicy , libselinux , policycoreutils , and if using modular policy, libsemanage ) to be installed. The test scripts also rely upon the SELinux extensions being integrated into the coreutils package, with support for the chcon and runcon commands as well as the SELinux options to existing utilities such as ls and mkdir . The InfiniBand tests require specialized hardware and are not enabled by default. If you have InfiniBand hardware on your system and wish to enable the InfiniBand tests you will need to install some additional packages, the list below is for Fedora/RHEL but other Linux distributions should have similar packages: Once the necessary packages have b