Mimi,
On Thu, Dec 01, 2022 at 03:26:54AM +0300, Vitaly Chikunov wrote:
> From: Mimi Zohar <zohar@xxxxxxxxxxxxx>
Forgot to --reset-author.
Thanks,
>
> This does not make fsverity.test working on GA CI, though.
>
> - `--device /dev/loop-control' is required for losetup(8) to work.
> - `--privileged' is required foo mount(8) to work, and this makes
> `--security-opt seccomp=unconfined' redundant.
> - GA container does not have `/sys/kernel/security' mounted which is
> needed for `/sys/kernel/security/integrity/ima/policy'.
> - Enable `set -x` in CI as the logs is everything we have to analyze on
> failures.
>
> Signed-off-by: Vitaly Chikunov <vt@xxxxxxxxxxxx>
> ---
> .github/workflows/ci.yml | 2 +-
> build.sh | 12 +++++++++++-
> tests/fsverity.test | 2 +-
> 3 files changed, 13 insertions(+), 3 deletions(-)
>
> diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
> index 8223b87..d2afdfe 100644
> --- a/.github/workflows/ci.yml
> +++ b/.github/workflows/ci.yml
> @@ -98,7 +98,7 @@ jobs:
> container:
> image: ${{ matrix.container }}
> env: ${{ matrix.env }}
> - options: --security-opt seccomp=unconfined
> + options: --privileged --device /dev/loop-control
>
> steps:
> - name: Show OS
> diff --git a/build.sh b/build.sh
> index cc5a258..4e2f1bb 100755
> --- a/build.sh
> +++ b/build.sh
> @@ -1,6 +1,16 @@
> #!/bin/sh
> # Copyright (c) 2020 Petr Vorel <pvorel@xxxxxxx>
>
> +if [ -n "$CI" ]; then
> + # If we under CI only thing we can analyze is logs so better to enable
> + # verbosity to a maximum.
> + set -x
> + # This is to make stdout and stderr synchronous in the logs.
> + exec 2>&1
> +
> + mount -t securityfs -o rw securityfs /sys/kernel/security
> +fi
> +
> set -e
>
> CC="${CC:-gcc}"
> @@ -100,7 +110,7 @@ if [ $ret -eq 0 ]; then
> tail -20 tests/boot_aggregate.log
>
> if [ -f tests/fsverity.log ]; then
> - tail -4 tests/fsverity.log
> + [ -n "$CI" ] && cat tests/fsverity.log || tail tests/fsverity.log
> grep "skipped" tests/fsverity.log && \
> grep "skipped" tests/fsverity.log | wc -l
> fi
> diff --git a/tests/fsverity.test b/tests/fsverity.test
> index def06f8..1bb8362 100755
> --- a/tests/fsverity.test
> +++ b/tests/fsverity.test
> @@ -78,7 +78,7 @@ mount_loopback_file() {
> exit "$FAIL"
> fi
>
> - mount -o loop ${TST_IMG} $TST_MNT
> + mount -v -o loop ${TST_IMG} $TST_MNT
> ret=$?
>
> if [ "${ret}" -eq 0 ]; then
> --
> 2.33.4
