particle-os/debian-forge
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

stage(selinux): move to schema_2 to allow adding mounts/devices

Browse source 
This is a preparation to allow adding mounts/devices to the users
stage so that we can eventually support bootc install to-filesystem.
This commit is contained in:
Michael Vogt 2024-04-05 10:13:03 +02:00 • committed by Achilleas Koutsou
parent 72a2334fbe
commit ba85d30cee
3 changed files with 35 additions and 32 deletions
Download patch file Download diff file Expand all files Collapse all files

56
stages/org.osbuild.selinux.meta.json
View file

@ -17,34 +17,36 @@
"capabilities": [ "capabilities": [
"CAP_MAC_ADMIN" "CAP_MAC_ADMIN"
], ],
"schema": { "schema_2": {
"additionalProperties": false, "options": {
"required": [ "additionalProperties": false,
"file_contexts" "required": [
], "file_contexts"
"properties": { ],
"file_contexts": { "properties": {
"type": "string", "file_contexts": {
"description": "Path to the active SELinux policy's `file_contexts`" "type": "string",
}, "description": "Path to the active SELinux policy's `file_contexts`"
"exclude_paths": { },
"type": "array", "exclude_paths": {
"description": "Paths to exclude when setting labels via file_contexts", "type": "array",
"items": { "description": "Paths to exclude when setting labels via file_contexts",
"type": "string" "items": {
"type": "string"
}
},
"labels": {
"type": "object",
"description": "Labels to set of the specified files or folders",
"items": {
"type": "object"
}
},
"force_autorelabel": {
"type": "boolean",
"description": "Do not use. Forces auto-relabelling on first boot.",
"default": false
} }
},
"labels": {
"type": "object",
"description": "Labels to set of the specified files or folders",
"items": {
"type": "object"
}
},
"force_autorelabel": {
"type": "boolean",
"description": "Do not use. Forces auto-relabelling on first boot.",
"default": false
} }
} }
} }

4
stages/test/test_selinux.py
View file

@ -12,7 +12,7 @@ STAGE_NAME = "org.osbuild.selinux"
def get_test_input(test_data, implicit_file_contexts=True): def get_test_input(test_data, implicit_file_contexts=True):
test_input = { test_input = {
"name": STAGE_NAME, "type": STAGE_NAME,
"options": {} "options": {}
} }
if implicit_file_contexts: if implicit_file_contexts:
@ -32,7 +32,6 @@ def get_test_input(test_data, implicit_file_contexts=True):
({"labels": "xxx"}, "'xxx' is not of type 'object'"), ({"labels": "xxx"}, "'xxx' is not of type 'object'"),
({"force_autorelabel": "foo"}, "'foo' is not of type 'boolean'"), ({"force_autorelabel": "foo"}, "'foo' is not of type 'boolean'"),
]) ])
@pytest.mark.parametrize("stage_schema", ["1"], indirect=True)
def test_schema_validation_selinux(stage_schema, test_data, expected_err): def test_schema_validation_selinux(stage_schema, test_data, expected_err):
res = stage_schema.validate(get_test_input(test_data)) res = stage_schema.validate(get_test_input(test_data))
if expected_err == "": if expected_err == "":
@ -42,7 +41,6 @@ def test_schema_validation_selinux(stage_schema, test_data, expected_err):
testutil.assert_jsonschema_error_contains(res, expected_err, expected_num_errs=1) testutil.assert_jsonschema_error_contains(res, expected_err, expected_num_errs=1)
@pytest.mark.parametrize("stage_schema", ["1"], indirect=True)
def test_schema_validation_selinux_file_context_required(stage_schema): def test_schema_validation_selinux_file_context_required(stage_schema):
res = stage_schema.validate(get_test_input({}, implicit_file_contexts=False)) res = stage_schema.validate(get_test_input({}, implicit_file_contexts=False))
assert res.valid is False assert res.valid is False

7
stages/test/test_users.py
View file

@ -4,8 +4,11 @@ from unittest.mock import patch
import pytest import pytest
from osbuild.testutil import assert_jsonschema_error_contains, make_fake_tree, mock_command from osbuild.testutil import (
assert_jsonschema_error_contains,
make_fake_tree,
mock_command,
)
STAGE_NAME = "org.osbuild.users" STAGE_NAME = "org.osbuild.users"