[GabrielPdoCarmo]

Pull Request Description

This PR adds SELinux status detection to the OperatingSystem class.

Changes include:

• Implemented getSELinuxStatus() using filesystem information without privileged commands.
• Added public constants for enforcing, permissive, unavailable, and unknown.
• Added PHPUnit tests covering valid, invalid, empty, and missing SELinux status files.
• Updated the README with a usage example and return value descriptions.

Related Issue

Issue Number: #2

Closes #2

Pull Request Type

• Feature

Pull request checklist

• Did you explain or provide a way of how can we test your code?
• Did you provide a general summary of your changes?
• Try to limit your pull request to one type, submit multiple pull requests if needed
• I implemented tests that cover my contribution

Testing

Run the unit tests using:

composer test:unit

Results:

• 9 tests passed.
• 15 assertions.
• No failures.

PHP version: 8.3.35
PHPUnit version: 11.2.7

[vitormattos]

Thanks for the update!

Could you add a few tests for getSELinuxStatus() when PHP has open_basedir enabled?

open_basedir limits which directories PHP can access. We need to make sure the method handles these cases correctly:

1. File inside an allowed directory: Create a temporary directory with sys/fs/selinux/enforce containing 1. Set open_basedir to allow this directory. The method should return SELINUX_ENFORCING.

2. File outside the allowed directories: Create the same file containing 1, but set open_basedir to allow only a different directory. The method should return SELINUX_UNKNOWN without PHP warnings. It should not return SELINUX_UNAVAILABLE, because PHP cannot check whether the file exists.

3. File does not exist: Set open_basedir to allow a temporary directory where the SELinux status file does not exist. The method should return SELINUX_UNAVAILABLE.

Please create the test files before enabling the restrictions. Run the restricted tests in separate PHP processes so that open_basedir does not affect other tests. PHPUnit supports this with #[RunInSeparateProcess].

Could you add these tests and run them with the current implementation first? I expect the first two cases to fail.

After confirming the failures, please fix the method and run the tests again to verify the results.

Thanks!

[GabrielPdoCarmo]

Hi! Thanks for the feedback!

I've added the three requested tests covering open_basedir restrictions.

I ran the tests before applying the fix and confirmed that the first two cases failed, as expected.

After updating the implementation, all tests passed successfully (12 tests, 36 assertions).

The changes have been pushed and are ready for review.

Thanks again!

[vitormattos]

Follow-up review of the latest changes. See the inline comment for two additional path-handling regression scenarios.

[vitormattos]

Hi @GabrielPdoCarmo,

Thank you for contributing SELinux status detection to whatosami, especially for addressing the open_basedir restrictions and filesystem path edge cases during review. The additional regression tests make this functionality more reliable.

We also appreciate your contributions to LibreSign's PHPUnit tests and developer documentation. Thank you for helping improve different parts of the LibreSign ecosystem!

We'd love to hear about your experience contributing. Was anything unclear or unnecessarily difficult? What could we improve?

You can share your feedback through our short, optional survey:

https://ls.librecode.coop/index.php/645932?lang=en&source=github-first-merged-pr&repository=whatosami

You're always welcome to contribute again and join our community: https://t.me/LibreSign

Thanks again for your contributions!