From: Tom Lane <tgl@sss.pgh.pa.us>
To: pgsql-hackers@lists.postgresql.org
cc: Joe Conway <mail@joeconway.com>
Subject: contrib/sepgsql regression tests have been broken for months
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----- =_aaaaaaaaaa0"
Content-ID: <1613181.1761255319.0@sss.pgh.pa.us>
Date: Thu, 23 Oct 2025 17:36:01 -0400
Message-ID: <1613232.1761255361@sss.pgh.pa.us>
Archived-At: 
 <https://www.postgresql.org/message-id/1613232.1761255361%40sss.pgh.pa.us>
Precedence: bulk

------- =_aaaaaaaaaa0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <1613181.1761255319.1@sss.pgh.pa.us>

I tried to run contrib/sepgsql's regression tests today, and was
rather astonished when they failed.  Investigating, there are
some context lines like "LINE 1: ALTER TABLE regtest_table_4
ALTER COLUMN y TYPE float;" in the test output that were not there
before.  A bit of bisecting showed that the change happened with

65281391a937293db7fa747be218def0e9794550 is the first bad commit
commit 65281391a937293db7fa747be218def0e9794550 (HEAD)
Author: Michael Paquier <michael@paquier.xyz>
Date:   Mon Jan 27 13:51:23 2025 +0900

    Print out error position for some ALTER TABLE ALTER COLUMN type

So, okay, that's a perfectly respectable thing to do, and I can't
really fault Michael or Jian for not having tested its effects on
sepgsql.  But how come it took this long to notice?

I think that rhinoceros is the only BF member testing with
--with-selinux.  Looking at its logs, it is running the sepgsql tests
(as a custom module) in v17 and before, but not in v18 or HEAD.
I suppose that this is a consequence of trying to rely on the
TAP-test infrastructure that was installed by aeb8ea361 (just a few
days before the aforesaid change, as luck would have it).  That TAP
test does work for me, but it does not run on rhinoceros because
(1) there's no --enable-tap-tests in its configure command, and
(2) it doesn't set up environment variable PG_TEST_EXTRA to include
"sepgsql".

Anyway, we seem to need the attached in v18 and HEAD,
and we really ought to get BF coverage going again.

			regards, tom lane


------- =_aaaaaaaaaa0
Content-Type: text/x-diff; name="update-sepgsql-expected-output.patch";
	charset="us-ascii"
Content-ID: <1613181.1761255319.2@sss.pgh.pa.us>
Content-Description: update-sepgsql-expected-output.patch
Content-Transfer-Encoding: quoted-printable

diff --git a/contrib/sepgsql/expected/ddl.out b/contrib/sepgsql/expected/d=
dl.out
index 7e8deae4f93..accb903f5ce 100644
--- a/contrib/sepgsql/expected/ddl.out
+++ b/contrib/sepgsql/expected/ddl.out
@@ -304,6 +304,8 @@ ALTER TABLE regtest_table_4 ALTER COLUMN y TYPE float;
 LOG:  SELinux: allowed { search } scontext=3Dunconfined_u:unconfined_r:se=
pgsql_regtest_superuser_t:s0 tcontext=3Dunconfined_u:object_r:sepgsql_sche=
ma_t:s0 tclass=3Ddb_schema name=3D"regtest_schema" permissive=3D0
 LOG:  SELinux: allowed { search } scontext=3Dunconfined_u:unconfined_r:se=
pgsql_regtest_superuser_t:s0 tcontext=3Dsystem_u:object_r:sepgsql_schema_t=
:s0 tclass=3Ddb_schema name=3D"public" permissive=3D0
 LOG:  SELinux: allowed { search } scontext=3Dunconfined_u:unconfined_r:se=
pgsql_regtest_superuser_t:s0 tcontext=3Dsystem_u:object_r:sepgsql_schema_t=
:s0 tclass=3Ddb_schema name=3D"pg_catalog" permissive=3D0
+LINE 1: ALTER TABLE regtest_table_4 ALTER COLUMN y TYPE float;
+                                                        ^
 LOG:  SELinux: allowed { search } scontext=3Dunconfined_u:unconfined_r:se=
pgsql_regtest_superuser_t:s0 tcontext=3Dsystem_u:object_r:sepgsql_schema_t=
:s0 tclass=3Ddb_schema name=3D"pg_catalog" permissive=3D0
 LOG:  SELinux: allowed { setattr } scontext=3Dunconfined_u:unconfined_r:s=
epgsql_regtest_superuser_t:s0 tcontext=3Dunconfined_u:object_r:sepgsql_tab=
le_t:s0 tclass=3Ddb_column name=3D"regtest_schema.regtest_table_4.y" permi=
ssive=3D0
 LOG:  SELinux: allowed { execute } scontext=3Dunconfined_u:unconfined_r:s=
epgsql_regtest_superuser_t:s0 tcontext=3Dsystem_u:object_r:sepgsql_proc_ex=
ec_t:s0 tclass=3Ddb_procedure name=3D"pg_catalog.float8(integer)" permissi=
ve=3D0
@@ -388,7 +390,11 @@ ALTER TABLE regtest_ptable_4 ALTER COLUMN y TYPE floa=
t;
 LOG:  SELinux: allowed { search } scontext=3Dunconfined_u:unconfined_r:se=
pgsql_regtest_superuser_t:s0 tcontext=3Dunconfined_u:object_r:sepgsql_sche=
ma_t:s0 tclass=3Ddb_schema name=3D"regtest_schema" permissive=3D0
 LOG:  SELinux: allowed { search } scontext=3Dunconfined_u:unconfined_r:se=
pgsql_regtest_superuser_t:s0 tcontext=3Dsystem_u:object_r:sepgsql_schema_t=
:s0 tclass=3Ddb_schema name=3D"public" permissive=3D0
 LOG:  SELinux: allowed { search } scontext=3Dunconfined_u:unconfined_r:se=
pgsql_regtest_superuser_t:s0 tcontext=3Dsystem_u:object_r:sepgsql_schema_t=
:s0 tclass=3Ddb_schema name=3D"pg_catalog" permissive=3D0
+LINE 1: ALTER TABLE regtest_ptable_4 ALTER COLUMN y TYPE float;
+                                                         ^
 LOG:  SELinux: allowed { search } scontext=3Dunconfined_u:unconfined_r:se=
pgsql_regtest_superuser_t:s0 tcontext=3Dsystem_u:object_r:sepgsql_schema_t=
:s0 tclass=3Ddb_schema name=3D"pg_catalog" permissive=3D0
+LINE 1: ALTER TABLE regtest_ptable_4 ALTER COLUMN y TYPE float;
+                                                         ^
 LOG:  SELinux: allowed { search } scontext=3Dunconfined_u:unconfined_r:se=
pgsql_regtest_superuser_t:s0 tcontext=3Dsystem_u:object_r:sepgsql_schema_t=
:s0 tclass=3Ddb_schema name=3D"pg_catalog" permissive=3D0
 LOG:  SELinux: allowed { setattr } scontext=3Dunconfined_u:unconfined_r:s=
epgsql_regtest_superuser_t:s0 tcontext=3Dunconfined_u:object_r:sepgsql_tab=
le_t:s0 tclass=3Ddb_column name=3D"regtest_schema.regtest_ptable_4.y" perm=
issive=3D0
 LOG:  SELinux: allowed { search } scontext=3Dunconfined_u:unconfined_r:se=
pgsql_regtest_superuser_t:s0 tcontext=3Dsystem_u:object_r:sepgsql_schema_t=
:s0 tclass=3Ddb_schema name=3D"pg_catalog" permissive=3D0

------- =_aaaaaaaaaa0--