From: Mimi Zohar <zohar@xxxxxxxxxxxxx>
This does not make fsverity.test working on GA CI, though.
- `--device /dev/loop-control' is required for losetup(8) to work.
- `--privileged' is required foo mount(8) to work, and this makes
`--security-opt seccomp=unconfined' redundant.
- GA container does not have `/sys/kernel/security' mounted which is
needed for `/sys/kernel/security/integrity/ima/policy'.
- Enable `set -x` in CI as the logs is everything we have to analyze on
failures.
Signed-off-by: Vitaly Chikunov <vt@xxxxxxxxxxxx>
---
.github/workflows/ci.yml | 2 +-
build.sh | 12 +++++++++++-
tests/fsverity.test | 2 +-
3 files changed, 13 insertions(+), 3 deletions(-)
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8223b87..d2afdfe 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -98,7 +98,7 @@ jobs:
container:
image: ${{ matrix.container }}
env: ${{ matrix.env }}
- options: --security-opt seccomp=unconfined
+ options: --privileged --device /dev/loop-control
steps:
- name: Show OS
diff --git a/build.sh b/build.sh
index cc5a258..4e2f1bb 100755
--- a/build.sh
+++ b/build.sh
@@ -1,6 +1,16 @@
#!/bin/sh
# Copyright (c) 2020 Petr Vorel <pvorel@xxxxxxx>
+if [ -n "$CI" ]; then
+ # If we under CI only thing we can analyze is logs so better to enable
+ # verbosity to a maximum.
+ set -x
+ # This is to make stdout and stderr synchronous in the logs.
+ exec 2>&1
+
+ mount -t securityfs -o rw securityfs /sys/kernel/security
+fi
+
set -e
CC="${CC:-gcc}"
@@ -100,7 +110,7 @@ if [ $ret -eq 0 ]; then
tail -20 tests/boot_aggregate.log
if [ -f tests/fsverity.log ]; then
- tail -4 tests/fsverity.log
+ [ -n "$CI" ] && cat tests/fsverity.log || tail tests/fsverity.log
grep "skipped" tests/fsverity.log && \
grep "skipped" tests/fsverity.log | wc -l
fi
diff --git a/tests/fsverity.test b/tests/fsverity.test
index def06f8..1bb8362 100755
--- a/tests/fsverity.test
+++ b/tests/fsverity.test
@@ -78,7 +78,7 @@ mount_loopback_file() {
exit "$FAIL"
fi
- mount -o loop ${TST_IMG} $TST_MNT
+ mount -v -o loop ${TST_IMG} $TST_MNT
ret=$?
if [ "${ret}" -eq 0 ]; then
--
2.33.4
