From Fedora Project Wiki

Description

This test case ensures that the checkpolicy utility can properly compile SELinux policy source files into a binary format.

Setup

  1. Install the checkpolicy package: sudo dnf install checkpolicy.
  2. Prepare an SELinux policy source file (for simplicity, you can use an existing .te file from the system, or write a basic one).

How to test

  1. Use checkpolicy to compile the policy source file. Assuming your source file is named my_policy.te: checkpolicy -o my_policy.pp my_policy.te.
  2. Check that the binary policy package my_policy.pp was created: ls -l my_policy.pp.
  3. Optionally, load the policy module to see if it gets accepted by SELinux: semodule -i my_policy.pp.

Expected Results

  1. The my_policy.pp binary policy file is generated without any errors.
  2. If you've loaded the policy, it should be accepted by SELinux without errors.
  3. Running semodule -l should list the loaded module (if you chose to load it).

Optional

For advanced testing:

  1. Intentionally introduce errors into the policy source file to see if checkpolicy catches them.
  2. Test more complex policy source files with different types of rules and see if they compile and load successfully.
  3. Unload the policy module using semodule -r my_policy and ensure it's removed.