#8541 Nightly failure (fed33) in test_installation.py::TestInstallMaster::test_selinux_avcs
Closed: fixed by frenaud. Opened by frenaud.

Issue

The nightly test test_installation.py::TestInstallMaster::test_selinux_avcs is failing on fedora 33 (on master branch: PR 5187 and ipa-4-8 branch, PR 5188).

Test logs:

self = <ipatests.test_integration.test_installation.TestInstallMaster object at 0x7fc8907d54f0>
    @pytest.mark.skipif(
        not platformtasks.is_selinux_enabled(),
        reason="Test needs SELinux enabled")
    def test_selinux_avcs(self):
        # Use journalctl instead of ausearch. The ausearch command is not
        # installed by default and journalctl gives us all AVCs.
>       result = self.master.run_command([
            "journalctl", "--full", "--grep=AVC", "--since=yesterday"
        ])
test_integration/test_installation.py:903: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
self = <ipatests.pytest_ipa.integration.host.Host master.ipa.test (master)>
argv = ['journalctl', '--full', '--grep=AVC', '--since=yesterday']
set_env = True, stdin_text = None, log_stdout = True, raiseonerr = True
cwd = None, bg = False, encoding = 'utf-8', ok_returncode = 0
    def run_command(self, argv, set_env=True, stdin_text=None,
                    log_stdout=True, raiseonerr=True,
                    cwd=None, bg=False, encoding='utf-8', ok_returncode=0):
        """Wrapper around run_command to log stderr on raiseonerr=True
        :param ok_returncode: return code considered to be correct,
                              you can pass an integer or sequence of integers
        """
        result = super().run_command(
            argv, set_env=set_env, stdin_text=stdin_text,
            log_stdout=log_stdout, raiseonerr=False, cwd=cwd, bg=bg,
            encoding=encoding
        )
        # in FIPS mode SSH may print noise to stderr, remove the string
        # "FIPS mode initialized" + optional newline.
        result.stderr_bytes = FIPS_NOISE_RE.sub(b'', result.stderr_bytes)
        try:
            result_ok = result.returncode in ok_returncode
        except TypeError:
            result_ok = result.returncode == ok_returncode
        if not result_ok and raiseonerr:
            result.log.error('stderr: %s', result.stderr_text)
>           raise subprocess.CalledProcessError(
                result.returncode, argv,
                result.stdout_text, result.stderr_text
            )
E           subprocess.CalledProcessError: Command '['journalctl', '--full', '--grep=AVC', '--since=yesterday']' returned non-zero exit status 1.
pytest_ipa/integration/host.py:200: CalledProcessError
 ------------------------------Captured stderr call------------------------------ 
ipa: ERROR: stderr: 
 -------------------------------Captured log call-------------------------------- 
INFO     ipatests.pytest_ipa.integration.host.Host.master.IPAOpenSSHTransport:transport.py:391 RUN ['journalctl', '--full', '--grep=AVC', '--since=yesterday']
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd161:transport.py:513 RUN ['journalctl', '--full', '--grep=AVC', '--since=yesterday']
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd161:transport.py:557 -- Logs begin at Fri 2020-10-09 19:37:58 UTC, end at Fri 2020-10-09 19:58:50 UTC. --
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd161:transport.py:557 -- No entries --
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd161:transport.py:217 Exit code: 1
ERROR    ipatests.pytest_ipa.integration.host.Host.master.cmd161:host.py:199 stderr:

The test is calling journalctl --full --grep=AVC--since=yesterdayand fails because the command exits with return code 1.
On fedora 33, the command doesn't find any AVC and returns 1, but the test is expecting journalctl to return 0, meaning finding at least one AVC.

Simple fix: use raiseonerr=False in run_command to be prepared for a successful return code when there is no AVC.


Metadata Update from @frenaud:
- Issue assigned to frenaud

Metadata Update from @frenaud:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/5194

master:

  • cb7d09642205cba07ef614065d106f7f84d8921b ipatests: properly handle journalctl return code

ipa-4-8:

  • 8bce174e3d38e12e5bc1427eda44fcd29587a07a ipatests: properly handle journalctl return code

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)

Metadata