3 files changed, 43 insertions, 3 deletions
diff --git a/test/system/050-stop.bats b/test/system/050-stop.bats
index 2ed791429..d809507a5 100644
--- a/test/system/050-stop.bats
+++ b/test/system/050-stop.bats
@@ -119,11 +119,31 @@ load helpers
     # the container's status.
 
     run_podman run --name stopme -d $IMAGE sh -c \
-        "trap 'echo Received SIGTERM, ignoring' SIGTERM; echo READY; while :; do sleep 1; done"
+        "trap 'echo Received SIGTERM, ignoring' SIGTERM; echo READY; while :; do sleep 0.2; done"
 
-    # Stop the container in the background
+    wait_for_ready stopme
+
+    local t0=$SECONDS
+    # Stop the container, but do so in the background so we can inspect
+    # the container status while it's stopping. Use $PODMAN because we
+    # don't want the overhead and error checks of run_podman.
     $PODMAN stop -t 20 stopme &
 
+    # Wait for container to acknowledge the signal. We can't use wait_for_output
+    # because that aborts if .State.Running != true
+    local timeout=5
+    while [[ $timeout -gt 0 ]]; do
+        run_podman logs stopme
+        if [[ "$output" =~ "Received SIGTERM, ignoring" ]]; then
+            break
+        fi
+        timeout=$((timeout - 1))
+        if [[ $timeout -eq 0 ]]; then
+            die "Timed out waiting for container to receive SIGERM"
+        fi
+        sleep 0.5
+    done
+
     # Other commands can acquire the lock
     run_podman ps -a
 
@@ -131,6 +151,13 @@ load helpers
     run_podman inspect --format '{{.State.Status}}' stopme
     is "$output" "stopping" "Status of container should be 'stopping'"
 
+    # Time check: make sure we were able to run 'ps' before the container
+    # exited. If this takes too long, it means ps had to wait for lock.
+    local delta_t=$(( $SECONDS - t0 ))
+    if [[ $delta_t -gt 5 ]]; then
+        die "Operations took too long ($delta_t seconds)"
+    fi
+
     run_podman kill stopme
     run_podman wait stopme
 
diff --git a/test/system/255-auto-update.bats b/test/system/255-auto-update.bats
index 25eaba45b..6fb40f41e 100644
--- a/test/system/255-auto-update.bats
+++ b/test/system/255-auto-update.bats
@@ -261,7 +261,8 @@ EOF
     systemctl enable --now podman-auto-update-$cname.timer
     systemctl list-timers --all
 
-    local expect='Finished Podman auto-update testing service'
+    # While systemd v245 and later uses 'Finished', older versions uses 'Started' for oneshot services
+    local expect='(Finished|Started) Podman auto-update testing service'
     local failed_start=failed
     local count=0
     while [ $count -lt 120 ]; do
diff --git a/test/system/410-selinux.bats b/test/system/410-selinux.bats
index 4ef9c8b30..5ee0e0715 100644
--- a/test/system/410-selinux.bats
+++ b/test/system/410-selinux.bats
@@ -50,6 +50,18 @@ function check_label() {
     check_label "--systemd=always" "container_init_t"
 }
 
+@test "podman selinux: init container with --security-opt type" {
+    check_label "--systemd=always --security-opt=label=type:spc_t" "spc_t"
+}
+
+@test "podman selinux: init container with --security-opt level&type" {
+    check_label "--systemd=always --security-opt=label=level:s0:c1,c2 --security-opt=label=type:spc_t" "spc_t" "s0:c1,c2"
+}
+
+@test "podman selinux: init container with --security-opt level" {
+    check_label "--systemd=always --security-opt=label=level:s0:c1,c2" "container_init_t"  "s0:c1,c2"
+}
+
 @test "podman selinux: pid=host" {
     # FIXME this test fails when run rootless with runc:
     #   Error: container_linux.go:367: starting container process caused: process_linux.go:495: container init caused: readonly path /proc/asound: operation not permitted: OCI permission denied