0002-Add-sandboxed-cluster-for-sepgsql-regression-tests.patch

From 53fb4c662347311ef6e21ca4c82b64c358f2096b Mon Sep 17 00:00:00 2001
From: Mike Palmiotto <mike.palmiotto@crunchydata.com>
Date: Fri, 19 Jul 2019 14:29:22 -0400
Subject: [PATCH 2/2] Add sandboxed cluster for sepgsql regression tests

---
 contrib/sepgsql/test_sepgsql | 47 ++++++++++++++++++++++++++++++++----
 1 file changed, 42 insertions(+), 5 deletions(-)

diff --git a/contrib/sepgsql/test_sepgsql b/contrib/sepgsql/test_sepgsql
index 7530363d2c..d14a1c28bc 100755
--- a/contrib/sepgsql/test_sepgsql
+++ b/contrib/sepgsql/test_sepgsql
@@ -15,7 +15,43 @@
 PG_BINDIR=`pg_config --bindir`
 
 # we must move to contrib/sepgsql directory to run pg_regress correctly
-cd `dirname $0`
+cd `dirname $0` || exit 1
+
+# Shut down existing test cluster and delete tmp directory if we have it
+if [ -d tmp/ ]; then
+    # Make sure we don't have a lingering regression test cluster installed
+    $PG_BINDIR/pg_ctl -D tmp -o "-p 15432" stop
+
+    sudo rm -rf tmp/
+fi
+
+# Iniitalize our test environment
+if ! $PG_BINDIR/pg_ctl initdb -D tmp; then
+    echo "test cluster initdb error"
+    exit 1
+fi
+
+echo "shared_preload_libraries = 'sepgsql'" >> tmp/postgresql.conf
+
+for DBNAME in template0 template1 postgres;
+do
+    $PG_BINDIR/postgres --single -F -c exit_on_error=true -p 15432 -D tmp/ $DBNAME \
+    < sepgsql.sql > /dev/null
+done
+
+# Reload the policy module
+if ! sudo make -f /usr/share/selinux/devel/Makefile reload; then
+    echo "policy reload error"
+    echo ""
+    echo "Unable to build sepgsql-regtest policy module."
+    echo "Please check that you have the selinux policy source installed."
+    echo "The development source is typically included in selinux-policy-devel package."
+    exit 1
+fi
+
+if ! $PG_BINDIR/pg_ctl --log=tmp/sepgsql.log -D tmp -o "-p 15432" start; then
+    exit 1
+fi
 
 echo
 echo "============== checking selinux environment           =============="
@@ -139,7 +175,7 @@ fi
 echo "ok"
 
 # Verify that sepgsql_regression_test_mode is active.
-echo -n "checking whether policy is enabled  ... "
+echo -n "checking whether sepgsql_regression_test_mode policy boolean is enabled  ... "
 POLICY_STATUS=`getsebool sepgsql_regression_test_mode | awk '{print $3}'`
 echo ${POLICY_STATUS:-failed}
 if [ "${POLICY_STATUS}" != on ]; then
@@ -166,6 +202,7 @@ if [ "${POLICY_STATUS}" != on ]; then
     exit 1
 fi
 POLICY_STATUS=`getsebool sepgsql_enable_users_ddl | awk '{print $3}'`
+echo -n "checking whether sepgsql_enable_users_ddl policy boolean is enabled  ... "
 echo ${POLICY_STATUS:-failed}
 if [ "${POLICY_STATUS}" != on ]; then
     echo ""
@@ -233,7 +270,7 @@ echo "ok"
 
 # loadable module must be installed and not configured to permissive mode
 echo -n "checking sepgsql installation       ... "
-VAL="`${CMD_PSQL} -X -t -c 'SHOW sepgsql.permissive' template1 2>/dev/null`"
+VAL="`${CMD_PSQL} -p 15432 -X -t -c 'SHOW sepgsql.permissive' template1 2>/dev/null`"
 RETVAL="$?"
 if [ $RETVAL -eq 2 ]; then
     echo "failed"
@@ -266,7 +303,7 @@ echo "ok"
 # NOTE: this test is wrong; we really ought to be checking template0.
 # But we can't connect to that without extra pushups, and it's not worth it.
 echo -n "checking for labels in template1    ... "
-NUM=`${CMD_PSQL} -XAt -c 'SELECT count(*) FROM pg_catalog.pg_seclabel' template1 2>/dev/null`
+NUM=`${CMD_PSQL} -p 15432 -XAt -c 'SELECT count(*) FROM pg_catalog.pg_seclabel' template1 2>/dev/null`
 if [ -z "${NUM}" ]; then
     echo "failed"
     echo ""
@@ -287,6 +324,6 @@ echo "found ${NUM}"
 echo
 echo "============== running sepgsql regression tests       =============="
 
-make REGRESS="label dml ddl alter misc" REGRESS_OPTS="--launcher ./launcher" installcheck
+make REGRESS="label dml ddl alter misc" REGRESS_OPTS="--port=15432 --launcher ./launcher" installcheck
 
 # exit with the exit code provided by "make"
-- 
2.21.0