From 3f427f45352d35cbd4c10e70d868b167ec8a6eb9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jan=20Rod=C3=A1k?= Date: Mon, 25 May 2026 12:31:26 +0200 Subject: [PATCH] Skip pasta forwarder tests pending passt SELinux fix MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The pasta_t SELinux domain is denied { create } for pasta.sock on ifconfig_var_run_t directories. Disable all pasta forwarder tests (BATS + e2e) until a new passt release ships the fix. Signed-off-by: Jan Rodák --- test/e2e/run_networking_test.go | 2 ++ test/system/500-networking.bats | 6 ++++++ 2 files changed, 8 insertions(+) diff --git a/test/e2e/run_networking_test.go b/test/e2e/run_networking_test.go index 5906bd5adf..d694679606 100644 --- a/test/e2e/run_networking_test.go +++ b/test/e2e/run_networking_test.go @@ -1060,6 +1060,8 @@ EXPOSE 2004-2005/tcp`, ALPINE) configurePortForwarder := func(forwarder string) { GinkgoHelper() if forwarder == "pasta" { + // TODO: enable after new passt release with SELinux fix for pasta.sock (pasta_t + ifconfig_var_run_t) + Skip("disabled: pasta SELinux policy denies pasta.sock creation (needs passt release with fix)") if !isRootless() { Skip("pasta port forwarding requires rootless") } diff --git a/test/system/500-networking.bats b/test/system/500-networking.bats index a0aa3a6d55..12256db917 100644 --- a/test/system/500-networking.bats +++ b/test/system/500-networking.bats @@ -433,7 +433,9 @@ EOCONF } # bats test_tags=ci:parallel +# TODO: enable after new passt release with SELinux fix for pasta.sock (pasta_t + ifconfig_var_run_t) @test "podman network reload - pasta forwarder" { + skip "disabled: pasta SELinux policy denies pasta.sock creation (needs passt release with fix)" skip_if_remote "podman network reload does not have remote support" is_rootless || skip "pasta port forwarder requires rootless" type -P pesto >/dev/null || skip "pesto not available" @@ -644,7 +646,9 @@ EOCONF } # bats test_tags=ci:parallel +# TODO: enable after new passt release with SELinux fix for pasta.sock (pasta_t + ifconfig_var_run_t) @test "podman network connect/disconnect with port forwarding - pasta forwarder" { + skip "disabled: pasta SELinux policy denies pasta.sock creation (needs passt release with fix)" is_rootless || skip "pasta port forwarder requires rootless" type -P pesto >/dev/null || skip "pesto not available" _test_network_connect_disconnect pasta @@ -756,7 +760,9 @@ EOCONF } # bats test_tags=ci:parallel +# TODO: enable after new passt release with SELinux fix for pasta.sock (pasta_t + ifconfig_var_run_t) @test "podman network after restart - pasta forwarder" { + skip "disabled: pasta SELinux policy denies pasta.sock creation (needs passt release with fix)" is_rootless || skip "pasta port forwarder requires rootless" type -P pesto >/dev/null || skip "pesto not available" _test_network_after_restart pasta