Skip to content

Commit 3c23ccc

Browse files
authored
Test also revocation phase in test and update policy
Remove part in packit file for enabling testing of revocation parts in test. Reorder position of run tasks and remove task related with zeromq. Update policy to allow keylime_agent_t socket connection to kernel_t.
1 parent a1ab3fa commit 3c23ccc

File tree

2 files changed

+2
-9
lines changed

2 files changed

+2
-9
lines changed

keylime.te

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -112,6 +112,7 @@ fs_setattr_tmpfs_dirs(keylime_agent_t)
112112
init_dontaudit_stream_connect(keylime_agent_t)
113113

114114
kernel_read_all_proc(keylime_agent_t)
115+
kernel_stream_connect(keylime_agent_t)
115116

116117
userdom_dontaudit_search_user_home_dirs(keylime_agent_t)
117118

packit-ci.fmf

Lines changed: 1 addition & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,6 @@
22

33
summary: run keylime e2e tests on fedora branch
44

5-
environment+:
6-
KEYLIME_TEST_DISABLE_REVOCATION: 1
7-
85
context:
96
swtpm: yes
107
agent: python
@@ -29,10 +26,10 @@
2926
# change IMA policy to simple and run one attestation scenario
3027
# this is to utilize also a different parser
3128
- /setup/configure_kernel_ima_module/ima_policy_simple
29+
- /setup/inject_SELinux_AVC_check
3230
- /functional/basic-attestation-on-localhost
3331
# now change IMA policy to signing and run all tests
3432
- /setup/configure_kernel_ima_module/ima_policy_signing
35-
- /setup/inject_SELinux_AVC_check
3633
- /functional/basic-attestation-on-localhost
3734
- /functional/basic-attestation-with-custom-certificates
3835
- /functional/basic-attestation-with-ima-signatures
@@ -49,11 +46,6 @@
4946
- /functional/db-mysql-sanity-on-localhost
5047
- /functional/tenant-allowlist-sanity
5148
- /functional/measured-boot-swtpm-sanity
52-
# now set zeromq as a default revocation notifier and test it
53-
- /setup/configure_default_revocation_notifier/zeromq
54-
- /functional/basic-attestation-on-localhost
55-
# now set revocation notifier back to agent
56-
- /setup/configure_default_revocation_notifier/agent
5749

5850
execute:
5951
how: tmt

0 commit comments

Comments
 (0)