From Fedora Project Wiki
Description
This test case ensures that the checkpolicy utility can properly compile SELinux policy source files into a binary format.
Setup
- Install the
checkpolicypackage:sudo dnf install checkpolicy. - Prepare an SELinux policy source file (for simplicity, you can use an existing
.tefile from the system, or write a basic one).
How to test
- Use
checkpolicyto compile the policy source file. Assuming your source file is namedmy_policy.te:checkpolicy -o my_policy.pp my_policy.te. - Check that the binary policy package
my_policy.ppwas created:ls -l my_policy.pp. - Optionally, load the policy module to see if it gets accepted by SELinux:
semodule -i my_policy.pp.
Expected Results
- The
my_policy.ppbinary policy file is generated without any errors. - If you've loaded the policy, it should be accepted by SELinux without errors.
- Running
semodule -lshould list the loaded module (if you chose to load it).
Optional
For advanced testing:
- Intentionally introduce errors into the policy source file to see if
checkpolicycatches them. - Test more complex policy source files with different types of rules and see if they compile and load successfully.
- Unload the policy module using
semodule -r my_policyand ensure it's removed.
