test: Check for AVC denials in the journal

test/test.sh

@@ -57,8 +57,6 @@ if ! [ -n "${reuseinitrd}" ] || ! [ -e "${tmpdir}/vmlinuz" ] || ! [ -e "${tmpdir
 	rm -f "${tmpdir}/done"
 	cat >create-initrd <<'EOF'
 #!/bin/bash
-# Workaround for https://bugzilla.opensuse.org/show_bug.cgi?id=1230912
-# combustion: network
 set -euxo pipefail
 exec &>/dev/ttyS0
 trap '[ $? -eq 0 ] || poweroff -f' EXIT

test/testscript

@@ -1,6 +1,4 @@
 #!/bin/bash
-# Work around for https://bugzilla.opensuse.org/show_bug.cgi?id=1230912
-# combustion: network
 set -euxo pipefail
 exec &>/dev/ttyS0
 # Poweroff immediately on any failure to avoid unnecessary waiting.
@@ -19,13 +17,18 @@ umount /mnt
 cat >>/usr/bin/combustion-validate <<'EOF'
 #!/bin/bash
 set -euxo pipefail
-exec &>/dev/ttyS0
 trap '[ $? -eq 0 ] || poweroff -f' EXIT
 # Print a list of files which have SELinux label mismatches
 if restorecon -nvR -e /.snapshots -e /run / | grep -v wtmpdb | grep "Would relabel"; then
 	echo "Some labels aren't correct?"
 	exit 1
 fi
+# Check that there are no SELinux denials.
+# Can't use ausearch here, that would miss initial boot events.
+if journalctl -b | grep -w avc | grep -w denied; then
+	echo "SELinux denials found"
+	exit 1
+fi
 mount -t 9p -o trans=virtio tmpdir /mnt
 touch /mnt/done
 umount /mnt
@@ -35,6 +38,8 @@ chmod a+x /usr/bin/combustion-validate
 
 cat >>/etc/systemd/system/combustion-validate.service <<'EOF'
 [Service]
+Type=oneshot
+StandardOutput=journal+console
 ExecStart=/usr/bin/combustion-validate
 [Install]
 RequiredBy=default.target