SELinux Security for TestStand on Linux

How TestStand Uses SELinux

On systems where SELinux runs in Enforcing mode, some executables and libraries that TestStand, Wine, and Mono use require execmod permission.

Instead of changing global SELinux behavior, the installer adds the ni_teststand_policy policy module, creates the teststand_file_t file type, and grants execmod only to files with that label. The installer applies that label only to supported TestStand, Wine, Mono, .NET, and shared ni-wine files in the user environment.

This approach keeps the permission scoped to the files TestStand needs.

When the Installer Applies SELinux Rules

If SELinux runs in Enforcing mode, the installer applies the policy module and file labels during installation and removes them during uninstall.

If SELinux runs in permissive mode or is disabled, the installer skips these changes.

How Custom Files Affect SELinux

The installer labels only the files it installs. If you add your own executables or libraries to the TestStand environment, those files do not automatically receive the teststand_file_t label. On an Enforcing system, SELinux can block those files when TestStand tries to load or run them.

Common symptoms include load failures and SELinux AVC audit entries that mention execmod or execheap. You can review recent denials with the following command:

sudo ausearch -m avc -ts recent

To allow custom files to run in the same environment, apply the teststand_file_t label to the file or directory and restore the label on disk. The following examples show the required commands for content under /home/<username>/.niwine10/....

sudo semanage fcontext -a -t teststand_file_t '/home/<username>/.niwine10/drive_c/path/to/your-file.dll'

sudo restorecon -v '/home/<username>/.niwine10/drive_c/path/to/your-file.dll'

sudo semanage fcontext -a -t teststand_file_t '/home/<username>/.niwine10/drive_c/path/to/your-folder(/.*)?'

sudo restorecon -R -v '/home/<username>/.niwine10/drive_c/path/to/your-folder'

How the Installer Protects Program Files

After installation, the installer returns the Program Files and Program Files (x86) trees in the user environment to root ownership. The installer also makes executables and libraries readable and runnable, but not writable, for a regular user. As a result, only a user with root privileges can modify installed TestStand program files in those locations.