From 28bc41bfcc89715936ab7ff9dbfd4dcec25395f6 Mon Sep 17 00:00:00 2001 From: Tim Meusel Date: Thu, 29 Jun 2023 09:55:23 +0200 Subject: [PATCH] migrater to beaker_puppet_helpers --- spec/acceptance/class_disabled_spec.rb | 10 +-- spec/acceptance/class_spec.rb | 4 +- .../selinux_module_refpolicy_spec.rb | 4 +- spec/spec_helper_acceptance.rb | 70 +------------------ spec/support/acceptance/helper_methods.rb | 30 ++++++++ 5 files changed, 42 insertions(+), 76 deletions(-) create mode 100644 spec/support/acceptance/helper_methods.rb diff --git a/spec/acceptance/class_disabled_spec.rb b/spec/acceptance/class_disabled_spec.rb index b8ae65c4..b5d48eca 100644 --- a/spec/acceptance/class_disabled_spec.rb +++ b/spec/acceptance/class_disabled_spec.rb @@ -11,14 +11,14 @@ # On Debian, SELinux is disabled by default. This first step brings it up to # par with EL and exercises the Debian-specific code. context 'when switching from unknown mode to permissive' do - let(:pp) do + let(:manifest) do <<-EOS class { 'selinux': mode => 'permissive' } EOS end context 'before reboot' do - it_behaves_like 'a idempotent resource' + it_behaves_like 'an idempotent resource' describe package(policy_package_for(hosts)) do it { is_expected.to be_installed } @@ -57,7 +57,7 @@ class { 'selinux': mode => 'disabled' } shell('setenforce Enforcing && test "$(getenforce)" = "Enforcing"') end - it_behaves_like 'a idempotent resource' + it_behaves_like 'an idempotent resource' describe file('/etc/selinux/config') do its(:content) { is_expected.to match(%r{^SELINUX=disabled$}) } @@ -95,14 +95,14 @@ class { 'selinux': mode => 'disabled' } end context 'when switching from disabled to permissive' do - let(:pp) do + let(:manifest) do <<-EOS class { 'selinux': mode => 'permissive' } EOS end context 'before reboot' do - it_behaves_like 'a idempotent resource' + it_behaves_like 'an idempotent resource' describe file('/etc/selinux/config') do its(:content) { is_expected.to match(%r{^SELINUX=permissive$}) } diff --git a/spec/acceptance/class_spec.rb b/spec/acceptance/class_spec.rb index dcdf1d36..4e06ff5a 100644 --- a/spec/acceptance/class_spec.rb +++ b/spec/acceptance/class_spec.rb @@ -7,7 +7,7 @@ ensure_permissive_mode_on(hosts) end - let(:pp) do + let(:manifest) do <<-EOS $have_selinux_ruby_library = #{have_selinux_ruby_library(hosts) ? 'true' : 'false'} @@ -105,7 +105,7 @@ class file { read getattr }; # We should really add something for it to purge, but we can't because # semanage doesn't even exist at the start. maybe a separate spec run after this? - it_behaves_like 'a idempotent resource' + it_behaves_like 'an idempotent resource' describe package(policy_package_for(hosts)) do it { is_expected.to be_installed } diff --git a/spec/acceptance/selinux_module_refpolicy_spec.rb b/spec/acceptance/selinux_module_refpolicy_spec.rb index 543c3d2f..676c9848 100644 --- a/spec/acceptance/selinux_module_refpolicy_spec.rb +++ b/spec/acceptance/selinux_module_refpolicy_spec.rb @@ -12,7 +12,7 @@ ensure_permissive_mode_on(hosts) end - let(:pp) do + let(:manifest) do <<-EOS class { 'selinux': } @@ -62,5 +62,5 @@ class { 'selinux': } EOS end - it_behaves_like 'a idempotent resource' + it_behaves_like 'an idempotent resource' end diff --git a/spec/spec_helper_acceptance.rb b/spec/spec_helper_acceptance.rb index ba77b1c2..42ecdb41 100644 --- a/spec/spec_helper_acceptance.rb +++ b/spec/spec_helper_acceptance.rb @@ -1,71 +1,7 @@ # frozen_string_literal: true -require 'beaker-rspec' -require 'beaker-puppet' -require 'beaker/puppet_install_helper' -require 'beaker/module_install_helper' +require 'voxpupuli/acceptance/spec_helper_acceptance' -def policy_package_for(hosts) - case hosts[0]['platform'] - when %r{^debian} - 'selinux-policy-default' - else - 'selinux-policy-targeted' - end -end +configure_beaker -def have_selinux_ruby_library(hosts) - hosts[0]['platform'] !~ %r{^debian} -end - -run_puppet_install_helper unless ENV['BEAKER_provision'] == 'no' - -RSpec.configure do |c| - # Readable test descriptions - c.formatter = :documentation - - # Configure all nodes in nodeset - c.before :suite do - install_module - install_module_dependencies - - # Relabelling fails because systemd tries to connect the script's STDIN to - # a serial port that doesn't exist (in Vagrant, at least). Work around like - # in https://bugs.centos.org/view.php?id=13213 - hosts.each do |host| - next unless host['platform'] =~ %r{^el-7} - - on host, 'sed -i -e "s/console=tty0 console=ttyS0,115200/console=tty0/" /etc/default/grub' - on host, 'cat /etc/default/grub' - on host, 'grub2-mkconfig -o /boot/grub2/grub.cfg' - end - end - - c.filter_run_excluding requires_selinux_ruby_library: true unless have_selinux_ruby_library(hosts) -end - -shared_examples 'a idempotent resource' do - it 'applies with no errors' do - apply_manifest(pp, catch_failures: true) - end - - it 'applies a second time without changes' do - apply_manifest(pp, catch_changes: true) - end -end - -def ensure_permissive_mode_on(hosts) - hosts.each do |host| - host.execute('getenforce') do |result| - mode = result.stdout.strip - if mode != 'Permissive' - host.execute('sed -i "s/SELINUX=.*/SELINUX=permissive/" /etc/selinux/config') - if mode == 'Disabled' - host.reboot - else - host.execute('setenforce Permissive && test "$(getenforce)" = "Permissive"') - end - end - end - end -end +Dir['./spec/support/acceptance/**/*.rb'].sort.each { |f| require f } diff --git a/spec/support/acceptance/helper_methods.rb b/spec/support/acceptance/helper_methods.rb new file mode 100644 index 00000000..222e3afc --- /dev/null +++ b/spec/support/acceptance/helper_methods.rb @@ -0,0 +1,30 @@ +# frozen_string_literal: true + +def policy_package_for(hosts) + case hosts[0]['platform'] + when %r{^debian} + 'selinux-policy-default' + else + 'selinux-policy-targeted' + end +end + +def have_selinux_ruby_library(hosts) + hosts[0]['platform'] !~ %r{^debian} +end + +def ensure_permissive_mode_on(hosts) + hosts.each do |host| + host.execute('getenforce') do |result| + mode = result.stdout.strip + if mode != 'Permissive' + host.execute('sed -i "s/SELINUX=.*/SELINUX=permissive/" /etc/selinux/config') + if mode == 'Disabled' + host.reboot + else + host.execute('setenforce Permissive && test "$(getenforce)" = "Permissive"') + end + end + end + end +end