From: Tom Lane <tgl@sss.pgh.pa.us>
To: Joe Conway <mail@joeconway.com>
cc: Andrew Dunstan <andrew@dunslane.net>,
        Jacob Champion <jacob.champion@enterprisedb.com>,
        pgsql-hackers@lists.postgresql.org
Subject: Re: contrib/sepgsql regression tests have been broken for months
In-reply-to: <2919479.1761779546@sss.pgh.pa.us>
References: <1613232.1761255361@sss.pgh.pa.us>
 <2e327a21-9954-4d05-aa9e-3b7fe926f39f@joeconway.com>
 <371f0ee1-8507-46e0-9090-6df2b14f0cd8@joeconway.com>
 <081073df-32ff-498c-abeb-2e5590888ad9@joeconway.com>
 <CAOYmi+mppi5iSgyVFv007o6YRh-4oFcP=v3Tv4VjGLxT9R7rWA@mail.gmail.com>
 <b485587f-c3ea-4089-b526-92dcd1809f6e@joeconway.com>
 <66541690-91c2-48e6-9c99-12c9af25012b@joeconway.com>
 <2919479.1761779546@sss.pgh.pa.us>
Comments: In-reply-to Tom Lane <tgl@sss.pgh.pa.us>
	message dated "Wed, 29 Oct 2025 19:12:26 -0400"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <2922180.1761780963.1@sss.pgh.pa.us>
Date: Wed, 29 Oct 2025 19:36:03 -0400
Message-ID: <2922181.1761780963@sss.pgh.pa.us>
Archived-At: 
 <https://www.postgresql.org/message-id/2922181.1761780963%40sss.pgh.pa.us>
Precedence: bulk

I wrote:
> ... I think the expectation is that you turned on
> sepgsql_regression_test_mode manually before enabling this buildfarm
> test.  I don't understand how < 18 would be passing if it weren't on,
> so the likely bet is that the test_sepgsql script is mistaken about
> how it's checking that.  Said script does work for me, but maybe
> RHEL7's getsebool output is different from later versions?

No, wait ... test_sepgsql is what we were using before, but 18 and
HEAD should be running contrib/sepgsql/t/001_sepgsql.pl.  And
rhino's HEAD run does reflect that:

[15:04:03.343](0.010s) # checking selinux environment
[15:04:03.343](0.000s) # checking for matchpathcon
[15:04:03.353](0.010s) # checking for runcon
[15:04:03.361](0.008s) # checking for sestatus
[15:04:03.366](0.005s) # checking current user domain
[15:04:03.372](0.006s) # current user domain is 'unconfined_t'
[15:04:03.373](0.000s) # checking selinux operating mode
[15:04:03.380](0.007s) # current operating mode is 'enforcing'
[15:04:03.380](0.000s) # checking for sepgsql-regtest policy
[15:04:03.387](0.007s) # checking whether policy is enabled
[15:04:03.391](0.005s) # sepgsql_regression_test_mode is 'off'
[15:04:03.392](0.000s) # 
# The SELinux boolean 'sepgsql_regression_test_mode' must be
# turned on in order to enable the rules necessary to run the
# regression tests.

I poked around in the buildfarm client and was surprised to
find that the old TestSepgsql.pm module does in fact expect
to have sudo privileges, and it seems to install, enable,
and eventually remove the sepgsql-regtest kernel module.

I thought we were trying to get rid of that requirement though.
(For sure, you won't ever see me running the buildfarm
client under a sudo-capable account.)  I think the new idea
is to leave the module installed and active, which is kind
of problematic if we want to also use TestSepgsql.pm in the
back branches.

I also don't quite understand how 001_sepgsql.pl's "checking for
sepgsql-regtest policy" test is passing if the previous
TestSepgsql.pm run removed that module ...

			regards, tom lane