Skip to content

ci: an attempt to run the tests under ASan/UBsan on GHActions #320

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 1 commit into from
Closed

ci: an attempt to run the tests under ASan/UBsan on GHActions #320

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 26 additions & 16 deletions .github/workflows/run_tests.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,9 @@ jobs:
python-ruby-version: {python: 3.9, ruby: 2.7, other: linker-bfd}
- compiler: clang
python-ruby-version: {python: 3.9, ruby: 2.7, other: linker-gold}
include:
- compiler: gcc
python-ruby-version: {python: 3.9, ruby: 2.7, other: sanitizers}

steps:
- uses: actions/checkout@v2
Expand Down Expand Up @@ -88,6 +91,11 @@ jobs:
elif [ "${{ matrix.python-ruby-version.other }}" = "test-debug" ] ; then
# Test hat debug build works fine
EXPLICIT_MAKE_VARS="DEBUG=1"
elif [ "${{ matrix.python-ruby-version.other }}" = "sanitizers" ] ; then
sanitizers='-fsanitize=address,undefined'
EXPLICIT_MAKE_VARS="CFLAGS='-g -I$DESTDIR/usr/include $sanitizers' LDFLAGS='-L$DESTDIR/usr/lib $sanitizers' LDLIBS= CPPFLAGS= OPT_SUBDIRS="
echo "ASAN_OPTIONS=strict_string_checks=1:detect_stack_use_after_return=1:check_initialization_order=1:strict_init_order=1" >> $GITHUB_ENV
echo "UBSAN_OPTIONS=print_stacktrace=1:print_summary=1:halt_on_error=1" >> $GITHUB_ENV
else
EXPLICIT_MAKE_VARS=
fi
Expand Down Expand Up @@ -139,18 +147,18 @@ jobs:
- name: Run tests
run: |
echo "::group::make install"
make -j$(nproc) install $EXPLICIT_MAKE_VARS -k
eval make -j$(nproc) install $EXPLICIT_MAKE_VARS -k
echo "::endgroup::"
echo "::group::make install-pywrap"
make -j$(nproc) install-pywrap $EXPLICIT_MAKE_VARS -k
eval make -j$(nproc) install-pywrap $EXPLICIT_MAKE_VARS -k
echo "::endgroup::"
echo "::group::make install-rubywrap"
make -j$(nproc) install-rubywrap $EXPLICIT_MAKE_VARS -k
eval make -j$(nproc) install-rubywrap $EXPLICIT_MAKE_VARS -k
echo "::endgroup::"

# Now that everything is installed, run "make all" to build everything which may have not been built
echo "::group::make all"
make -j$(nproc) all $EXPLICIT_MAKE_VARS -k
eval make -j$(nproc) all $EXPLICIT_MAKE_VARS -k
echo "::endgroup::"

# Set up environment variables for the tests and show variables (to help debugging issues)
Expand All @@ -164,26 +172,28 @@ jobs:

# Run tests
echo "::group::make test"
make test $EXPLICIT_MAKE_VARS
eval make test $EXPLICIT_MAKE_VARS
echo "::endgroup::"

# Test Python and Ruby wrappers
echo "::group::Test Python and Ruby wrappers"
$PYTHON -c 'import selinux;import selinux.audit2why;import semanage;print(selinux.is_selinux_enabled())'
$RUBY -e 'require "selinux";require "semanage";puts Selinux::is_selinux_enabled()'
echo "::endgroup::"

# Run Python linter, but not on the downloaded refpolicy
echo "::group::scripts/run-flake8"
./scripts/run-flake8
echo "::endgroup::"
if [ "${{ matrix.python-ruby-version.other }}" != "sanitizers" ] ; then
# Test Python and Ruby wrappers
echo "::group::Test Python and Ruby wrappers"
$PYTHON -c 'import selinux;import selinux.audit2why;import semanage;print(selinux.is_selinux_enabled())'
$RUBY -e 'require "selinux";require "semanage";puts Selinux::is_selinux_enabled()'
echo "::endgroup::"

# Run Python linter, but not on the downloaded refpolicy
echo "::group::scripts/run-flake8"
./scripts/run-flake8
echo "::endgroup::"
fi

echo "::group::Test .gitignore and make clean distclean"
# Remove every installed files
rm -rf "$DESTDIR"
# Test that "git status" looks clean, or print a clear error message
git status --short | sed -n 's/^??/error: missing .gitignore entry for/p' | (! grep '^')
# Clean up everything and show which file needs to be added to "make clean"
make clean distclean $EXPLICIT_MAKE_VARS
eval make clean distclean $EXPLICIT_MAKE_VARS
git ls-files --ignored --others --exclude-standard | sed 's/^/error: "make clean distclean" did not remove /' | (! grep '^')
echo "::endgroup::"
10 changes: 8 additions & 2 deletions libsepol/tests/Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,4 @@
ENV ?= env
M4 ?= m4
MKDIR ?= mkdir
EXE ?= libsepol-tests
Expand Down Expand Up @@ -44,10 +45,15 @@ clean:
rm -f $(objs) $(EXE)
rm -f $(policies)
rm -f policies/test-downgrade/policy.hi policies/test-downgrade/policy.lo


# mkdir is run in a clean environment created by env -i to avoid failing under ASan with:
#
# ASan runtime does not come first in initial library list;
# you should either link runtime to your application or manually preload it with LD_PRELOAD
#
# when the source code is built with ASan
test: $(EXE) $(policies)
$(MKDIR) -p policies/test-downgrade
$(ENV) -i $(MKDIR) -p policies/test-downgrade
../../checkpolicy/checkpolicy -M policies/test-cond/refpolicy-base.conf -o policies/test-downgrade/policy.hi
./$(EXE)

Expand Down