refpolicy/.github/workflows/validate-policy.yml at main · SELinuxProject/refpolicy · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
name: Validate policy

on:
  workflow_call:
    inputs:
      python-version:
        description: "Python version to use"
        required: true
        type: string
      userspace-artifact-name:
        description: "Name of the userspace artifact to download"
        required: true
        type: string
      setools-artifact-name:
        description: "Name of the setools artifact to download"
        required: true
        type: string
      matrix:
        description: "JSON build matrix from global-vars.yml"
        required: true
        type: string

jobs:
  sechecker:
    runs-on: ubuntu-22.04

    strategy:
      matrix: ${{ fromJSON(inputs.matrix) }}

    env:
      OUTPUT_LOG: validation-${{ matrix.distro }}-${{ matrix.type }}-${{ matrix.monolithic }}-${{ matrix.systemd }}-${{ matrix.direct_initrc }}-${{ matrix.apps-off }}.log

    steps:
      - name: Checkout testing dir of repo
        uses: actions/checkout@v6
        with:
          sparse-checkout: testing

      - name: Install dependencies
        shell: bash
        run: |
          sudo apt-get update -q

      - name: Set up Python
        uses: actions/setup-python@v6
        with:
          python-version: "${{ inputs.python-version }}"

      - name: Download userspace artifact
        uses: actions/download-artifact@v8
        id: dl-userspace
        with:
          name: ${{ inputs.userspace-artifact-name }}

      - name: Unpack userspace artifact
        shell: bash
        run: |
          tar -C "${{ steps.dl-userspace.outputs.download-path }}" -zxvf ${{ inputs.userspace-artifact-name }}

      - name: Download policy artifact
        uses: actions/download-artifact@v8
        id: dl-refpolicy
        with:
          name: refpolicy-${{ matrix.distro }}-${{ matrix.type }}-${{ matrix.monolithic }}-${{ matrix.systemd }}-${{ matrix.direct_initrc }}-${{ matrix.apps-off }}

      - name: Download setools artifact
        uses: actions/download-artifact@v8
        id: dl-setools
        with:
          name: ${{ inputs.setools-artifact-name }}

      - name: Install dependencies
        shell: bash
        run: |
          sudo python -m pip install setools*.whl networkx

      - name: Validate security goals with sechecker
        shell: bash
        id: sechecker
        run: |
          sechecker testing/sechecker.ini ${{ steps.dl-refpolicy.outputs.download-path }}/sepolicy | tee ${{ env.OUTPUT_LOG}}
        env:
          LD_LIBRARY_PATH: "${{steps.dl-userspace.outputs.download-path}}/lib:${{steps.dl-userspace.outputs.download-path}}/usr/lib:${LD_LIBRARY_PATH}"

      - name: Upload artifact
        uses: actions/upload-artifact@v7
        if: ${{ !cancelled() }}
        with:
          name: ${{ env.OUTPUT_LOG}}
          path: ${{ env.OUTPUT_LOG}}
          archive: false
          if-no-files-found: error

      - name: Upload failed build directory artifact
        if: ${{ failure() && runner.debug }}
        uses: actions/upload-artifact@v7
        with:
          name: failed-validation-${{ matrix.distro }}-${{ matrix.type }}-${{ matrix.monolithic }}-${{ matrix.systemd }}-${{ matrix.direct_initrc }}-${{ matrix.apps-off }}
          path: |
            ${{ github.workspace }}