Re: contrib/sepgsql regression tests are a no-go

I wrote:
> I think it should be possible to still use all the existing testing
> infrastructure if the check/test script does something like
>     make REGRESS="label dml misc" check

I've now worked through the process of actually running the sepgsql
regression tests, and I must say that I had no idea how utterly invasive
they were --- the idea that they could ever be part of a default "make
check" sequence is even more ridiculous than I thought before.

Accordingly, the attached patch does what I suggested above, namely dike
out the Makefile's knowledge of how to run the regression tests and put
it into the chkselinuxenv script.  It would be appropriate to rename that
script to something like "test_sepgsql", but I didn't do that yet to
reduce the displayed size of the patch.

I have not touched the documentation, either.  One thing I'd like to do
is adjust both the SGML documentation and the hints printed by the
script to uniformly use "sudo ...root-privileged-command..." rather than
recommending use of "su".  I don't like the latter because it makes it
less than clear exactly which commands require root, encourages you to
forget to switch out of root mode, and IMO is against local policy on
any well-run box.  I recognize however that that might be mostly my
own preferences showing --- what do others think?

Comments?

            regards, tom lane

diff --git a/contrib/sepgsql/Makefile b/contrib/sepgsql/Makefile
index 033c41a..140419a 100644
*** a/contrib/sepgsql/Makefile
--- b/contrib/sepgsql/Makefile
*************** OBJS = hooks.o selinux.o uavc.o label.o
*** 5,15 ****
      database.o schema.o relation.o proc.o
  DATA_built = sepgsql.sql

! REGRESS = label dml misc
! REGRESS_PREP = check_selinux_environment
! REGRESS_OPTS = --launcher $(top_builddir)/contrib/sepgsql/launcher
!
! EXTRA_CLEAN = -r tmp *.pp sepgsql-regtest.if sepgsql-regtest.fc

  ifdef USE_PGXS
  PG_CONFIG = pg_config
--- 5,13 ----
      database.o schema.o relation.o proc.o
  DATA_built = sepgsql.sql

! # Note: because we don't tell the Makefile there are any regression tests,
! # we have to clean those result files explicitly
! EXTRA_CLEAN = -r $(pg_regress_clean_files) tmp *.pp sepgsql-regtest.if sepgsql-regtest.fc

  ifdef USE_PGXS
  PG_CONFIG = pg_config
*************** include $(top_srcdir)/contrib/contrib-gl
*** 23,28 ****
  endif

  SHLIB_LINK += -lselinux
-
- check_selinux_environment:
-     @$(top_builddir)/contrib/sepgsql/chkselinuxenv "$(bindir)" "$(datadir)"
--- 21,23 ----
diff --git a/contrib/sepgsql/chkselinuxenv b/contrib/sepgsql/chkselinuxenv
index a7c81b2..2eeeb67 100755
*** a/contrib/sepgsql/chkselinuxenv
--- b/contrib/sepgsql/chkselinuxenv
***************
*** 1,11 ****
  #!/bin/sh
  #
! # SELinux environment checks to ensure configuration of the operating system
! # satisfies prerequisites to run regression test.
! # If incorrect settings are found, this script suggest user a hint.
  #
! PG_BINDIR="$1"
! PG_DATADIR="$2"

  echo
  echo "============== checking selinux environment           =============="
--- 1,18 ----
  #!/bin/sh
  #
! # Run the sepgsql regression tests, after making a lot of environmental checks
! # to try to ensure that the SELinux environment is set up appropriately and
! # the database is configured correctly.
  #
! # Note that this must be run against an installed Postgres database.
! # There's no equivalent of "make check", and that wouldn't be terribly useful
! # since much of the value is in checking that you installed sepgsql into
! # your database correctly.
! #
! # This must be run in the contrib/sepgsql directory of a Postgres build tree.
! #
!
! PG_BINDIR=`pg_config --bindir`

  echo
  echo "============== checking selinux environment           =============="
*************** fi
*** 224,230 ****
  echo "found ${NUM}"

  #
! # check complete -
  #
! echo ""
! exit 0
--- 231,242 ----
  echo "found ${NUM}"

  #
! # checking complete - let's run the tests
  #
!
! echo
! echo "============== running sepgsql regression tests       =============="
!
! make REGRESS="label dml misc" REGRESS_OPTS="--launcher ./launcher" installcheck
!
! # exit with the exit code provided by "make"