| Quickstart
+-----------

Check the TODO file for the current state of the test suite.

Dependencies
------------
audit-test requires the following packages in order to run:

audit-libs-devel
expect
libselinux-devel
selinux-policy-devel

Configure System
----------------
Verify that each ext3 filesystem in /etc/fstab has the “user_xattr” option.

If you do not have an administrative eal user other than the root user, add 
one with the following commands:

# useradd -c "EAL Test User"-g wheel eal

The administrative user’s password must be the same as the root user’s password.
# passwd <root’s password>

If on a LSPP system perform the following additional step:
# semanage login –m –s staff_u –r SystemLow-SystemHigh eal

Make sure vsftpd is available on the system and configured to start in
runlevel 3.  If it is not, configure vsftpd with the following commands: 

On a CAPP machine:
# chkconfig vsftpd on
# service vsftpd start

On a LSPP machine:
# chkconfig vsftpd on
# run_init /etc/init.d/vsftpd start

Configure the Network Test Server
---------------------------------
Configure the Network Test Server according to the instructions in the 
README.netwk_svr file.

Install
-------
Change to root. 
$ /bin/su -

If running on a LSPP system, change your role to "sysadm_r".
# newrole -r sysadm_r

Make the following directory for the tests.  You must use this directory name
and location for the tests to run correctly.
# mkdir /usr/local/eal4_testing
# chmod 755 /usr/local/eal4_testing
# cd /usr/local/eal4_testing

Move the audit-test directory into the newly created /usr/local/eal4_testing
directory.  

Set the directory permissions appropriately to allow the tests to be built 
and run:
# chown -R root:root /usr/local/eal4_testing

Build
-----
# cd /usr/local/eal4_testing/audit-test 

If running on a LSPP system, install the test policy and change to the
"lspp_test_r" role.
# make policy
# newrole –r lspp_test_r

Build the tests.
# make

Or to build the 32-bit tests on an x86_64 box do:
# make MODE=32

Relabel test files.
# make -C utils/selinux-policy relabel verify

Configure the Labeled Networking Tests
--------------------------------------
On the test machine:

From the /usr/local/eal4_testing/audit-test directory, perform the following 
commands to setup the required configuration for the labeled networking tests:

    # export RHOST="localhost"
    # export RHOST6="::1"
    # export LBLNET_SVR_IPV4="<local network test server IPV4 address>"
    # export LBLNET_SVR_IPV6="<local network test server IPV6 address>"
    # export PATH="$PATH:."
    
    # make netconfig

On the network test server:

Confirm that the 
'/usr/local/eal4_testing/audit-test/network/system/client_list.txt' file on 
the network test server contains both the IPv4 and IPv6 addresses of the test 
machine.  

NOTE: If you need to determine the test machine's IP addresses to add to the
client_list.txt file, run the following commands on the test machine:

    # make -C network/system getaddress

Reboot the test machine.

Run Batch Tests
---------------
Login to the system as the administrative user.

The audit tests require you to login as a non-root user in order to verify the
login UID in the audit records.

Change to root. 
$ /bin/su -

If running on a LSPP system, change your role to "lspp_test_r".
# newrole -r lspp_test_r

# cd /usr/local/eal4_testing/audit-test
# export PASSWD=<root/admin user password>

Make sure that the labeled networking tests have been configured according to
the instructions in the previous section. Set the following environment
variables:

# export RHOST="localhost"
# export RHOST6="::1"
# export LBLNET_SVR_IPV4="<local network test server IPV4 address>"
# export LBLNET_SVR_IPV6="<local network test server IPV6 address>"
# export PATH="$PATH:."

In the top level audit-test directory, or in any test sub-directory:

# make run

Or to run the 32-bit tests on an x86_64 box do:
# make MODE=32 run

Note:•The tests must be run from an interactive terminal; running the tests as
a backgrounded task does not work, and will result in spurious test case
failures.

Run Individual Tests
--------------------
You can use run.bash to run a set of tests or a single test case. This must be
done in a test sub-directory.  Before running individual tests please do
a 'make' in the top-level directory.

To run all variations of a given testcase, e.g. to run all the ptrace() tests:
# ./run.bash ptrace

To list all testcases:
# ./run.bash --list

To run a single testcase by number:
# ./run.bash <number>


Workaround for Network Test Failures
------------------------------------
Some test runs may experience network test failures in the labeled IPsec 
tests due to the current implementation of racoon. Use the following 
workaround if you experience these failures. 

1. Reboot the test machine
2. Login as eal
3. Use '/bin/su -' to change to root
4. Use 'newrole -r lspp_test_r' to change to root/lspp_test_r
5. Run 'run_init /etc/rc.local' to re-initialize the IPsec subsystem
6. Run the following commands:
   # export PASSWD=<password>
   # export PPROFILE=lspp
   # export MODE=<whatever you want (64|32), but set it to something>
   # export RHOST="localhost"
   # export RHOST6="::1"
   # export LBLNET_SVR_IPV4="<local network test server IPV4 address>"
   # export LBLNET_SVR_IPV6="<local network test server IPV6 address>"
   # export PATH="$PATH:."
7. Change to the '/usr/local/eal4_testing/audit-test/network' directory
8. Type './run.bash host=remote*type=ipsec'. There may be a few failures;
rerun the command until all of the tests pass. At most, this should be two 
passes.
9. Logoff the system

Re-login into the system and re-run the audit testsuite (or just networking
tests) as following the directions in previous sections of this README.  

Each time you reboot the system and run the network tests, you 
must follow the steps above.  It is also possible, although unlikely, that if 
you wait an excessive period of time between step #8 above and running the 
test suite, the network tests may fail. For that reason, it is recommended that
you do these steps only when you are ready to re-run the test suite.


Other Known Failures
--------------------
In the fail-safe tests, the 'admin_space_left email' and 'space_left email'
tests may fail in CAPP mode if SELInux is enabled and in enforcing mode.  These
tests are not run in LSPP mode.

In the trustedprograms tests, the 'aide_update' test may fail in LSPP mode.  The
aide program reports the changed file in the aide.log, but the return code does
not reflect that there was a change.  This test is not run in CAPP mode.
