Conversation
LecrisUT
added
ci | full test
LecrisUT
added
the
status | blocking other work
|
/packit retest-failed |
Signed-off-by: Cristian Le <git@lecris.dev>
LecrisUT
force-pushed
the
chore/revert-flaky/4396
branch
from
e69aeb4 to
9e6c355
Compare
| - how: avc | ||
| result: xfail | ||
| ignore-pattern: | ||
| - "type=AVC.*comm=systemd-coredum.*scontext=system_u:system_r:systemd_coredump_t" |
There was a problem hiding this comment.
Could we add short comment explaining why this ignore-pattern is actually needed?
There was a problem hiding this comment.
The previous tracker a few lines below
because: https://bugzilla.redhat.com/show_bug.cgi?id=2418343
still applies
thrix
left a comment
thrix
left a comment
There was a problem hiding this comment.
Code Review: Partially revert #4396
Reviewed against commit 9e6c355.
Summary
Clean, focused PR that:
- Removes the blanket AVC xfail on mock/multiple-tests for fedora-44+ since BZ#2415701 is resolved in
selinux-policy-43.1-1.fc43 - Replaces the blanket AVC xfail on test/check/coredump with targeted
ignore-patternentries for BZ#2418343
The change from result: xfail to specific ignore-pattern is strictly better — it catches real AVC issues while ignoring known false positives.
Observations
1. Default pattern re-inclusion is correct and necessary
The # From default pattern comment on the type=USER_AVC.*received policyload notice entry is accurate — specifying ignore-pattern explicitly replaces the default list (DEFAULT_IGNORE_PATTERNS in avc.py:75), so the default must be re-added manually. If the defaults change in the future, this test would need updating too.
2. The comm=systemd-coredum truncation is correct
The AVC comm field truncates to 15 characters — systemd-coredump (16 chars) becomes systemd-coredum. The .* suffix handles the rest of the line.
3. @psss's open comment
@psss asked for a short comment explaining why the ignore-pattern is needed. The existing because reference to BZ#2418343 is sufficient, but a one-line inline comment like # systemd-coredump AVC, tracked in BZ below wouldn't hurt for scannability.
Verdict
No issues found. LGTM.
Generated-by: Claude Code
6 participants
selinux-policy-43.1-1.fc43