From Fedora Project Wiki
Description
This test case ensures that the checkpolicy
utility can properly compile SELinux policy source files into a binary format.
Setup
- Install the
checkpolicy
package:sudo dnf install checkpolicy
. - Prepare an SELinux policy source file (for simplicity, you can use an existing
.te
file from the system, or write a basic one).
How to test
- Use
checkpolicy
to compile the policy source file. Assuming your source file is namedmy_policy.te
:checkpolicy -o my_policy.pp my_policy.te
. - Check that the binary policy package
my_policy.pp
was created:ls -l my_policy.pp
. - Optionally, load the policy module to see if it gets accepted by SELinux:
semodule -i my_policy.pp
.
Expected Results
- The
my_policy.pp
binary policy file is generated without any errors. - If you've loaded the policy, it should be accepted by SELinux without errors.
- Running
semodule -l
should list the loaded module (if you chose to load it).
Optional
For advanced testing:
- Intentionally introduce errors into the policy source file to see if
checkpolicy
catches them. - Test more complex policy source files with different types of rules and see if they compile and load successfully.
- Unload the policy module using
semodule -r my_policy
and ensure it's removed.