Re: [PATCH] selinux-testsuite: Review and update SCTP tests

[Ondrej Mosnacek <omosnace@redhat.com>]

On Wed, Aug 26, 2020 at 9:16 PM Stephen Smalley
<stephen.smalley.work@gmail.com> wrote:
> On Wed, Aug 26, 2020 at 2:58 PM Stephen Smalley
> <stephen.smalley.work@gmail.com> wrote:
> >
> > On Mon, Aug 24, 2020 at 9:07 AM Ondrej Mosnacek <omosnace@redhat.com> wrote:
> > >
> > > On Tue, Jul 28, 2020 at 10:02 AM Ondrej Mosnacek <omosnace@redhat.com> wrote:
> > > > On Sun, Jul 12, 2020 at 6:00 PM Richard Haines
> > > > <richard_c_haines@btinternet.com> wrote:
> > > > > Reviewed the tests using kernel tree: Documentation/security/SCTP.rst
> > > > >
> > > > > Added tests and policy for connectx(3) handling deny and
> > > > > SCTP_SENDMSG_CONNECT
> > > > > Added test and policy for bindx(3) deny
> > > > > Clarified the server test for ports < 1024
> > > > > Added comments regarding kernel net/sctp code locations to relevant tests
> > > > > Corrected policy for test_sctp_deny_peer_client_t
> > > > > Corrected ip/nf tables comment to deny read packet { recv }
> > > > > Added MCS-constrained type as suggested in [1]
> > > > >
> > > > > [1] https://lore.kernel.org/selinux/20200508154138.24217-7-stephen.smalley.work@gmail.com/
> > > > >
> > > > > Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
> > > > > ---
> > > > >  policy/test_sctp.te        | 43 +++++++++++++++++++++-----
> > > > >  tests/sctp/sctp_bindx.c    |  8 ++---
> > > > >  tests/sctp/sctp_connectx.c | 47 +++++++++++++++++++++--------
> > > > >  tests/sctp/test            | 62 +++++++++++++++++++++++++++++++-------
> > > > >  4 files changed, 126 insertions(+), 34 deletions(-)
> > > >
> > > > Acked-by: Ondrej Mosnacek <omosnace@redhat.com>
> > >
> > > Now applied, thanks!
> >
> > Seems to have broken the testsuite on travis-ci for userspace testing,
> > https://travis-ci.org/github/SELinuxProject/selinux/jobs/721441713#L4656
>
> Looks like it was transient but I haven't seen that failure prior to
> this testsuite commit.

That has been happening relatively often on slow/unstable machines for
as long as I remember. In our downstream testing I managed to reduce
the occurrence of these failures to an acceptable level by increasing
the timeouts in the SCTP test to 4 seconds. I planned to send a patch
to update the timeout values upstream once I get some time-proven
values from our testing. I guess I waited long enough now :) I'll send
a patch to bump them to 4 secs tomorrow.

-- 
Ondrej Mosnacek
Software Engineer, Platform Security - SELinux kernel
Red Hat, Inc.