On 1/30/20 3:11 PM, Stephen Smalley wrote:
In addition to testing full NFS security labeling support,
make sure that context mounts continue to work independent
of whether the mount was exported with security_label, and
add a simple test of the default NFS file labeling.
With the previous changes, this completes addressing
https://github.com/SELinuxProject/selinux-testsuite/issues/32
Fixes: https://github.com/SELinuxProject/selinux-testsuite/issues/32
Signed-off-by: Stephen Smalley <sds@xxxxxxxxxxxxx>
---
v2 moves nfs.sh under the tools/ directory and also updates
README.md for the additional tests. As before, these patches
depend on "testsuite: enable running over labeled NFS" to
enable the testsuite to pass on NFS mounts.
README.md | 5 ++++-
tools/nfs.sh | 38 ++++++++++++++++++++++++++++++++++++++
2 files changed, 42 insertions(+), 1 deletion(-)
diff --git a/README.md b/README.md
index e02ae9ac6d6f..64f80c8fd493 100644
--- a/README.md
+++ b/README.md
@@ -156,7 +156,10 @@ nfs.sh script while in the selinux-testsuite directory:
The script will start the nfs-server, export the mount containing the
testsuite directory with the security_label option to localhost, mount
it via NFSv4.2 on /mnt/selinux-testsuite, switch to that directory,
-and run the testsuite there. After completion, it will unmount and
+and run the testsuite there. After running the testsuite, the script
+will also perform tests of context mounts with and without the
+security_label export option and will test default NFS file labeling
+in the absence of any options. When finished, it will unmount and
unexport the mount and then stop the nfs-server.
## Running the Tests
diff --git a/tools/nfs.sh b/tools/nfs.sh
index 31c66c377cae..a82c4069d76d 100755
--- a/tools/nfs.sh
+++ b/tools/nfs.sh
@@ -2,6 +2,8 @@
MOUNT=`stat --print %m .`
TESTDIR=`pwd`
systemctl start nfs-server
+
+# Run the full testsuite on a labeled NFS mount.
exportfs -orw,no_root_squash,security_label localhost:$MOUNT
mkdir -p /mnt/selinux-testsuite
mount -t nfs -o vers=4.2 localhost:$TESTDIR /mnt/selinux-testsuite
@@ -9,5 +11,41 @@ pushd /mnt/selinux-testsuite
make test
popd
umount /mnt/selinux-testsuite
+
+# Test context mounts when exported with security_label.
+mount -t nfs -o vers=4.2,context=system_u:object_r:etc_t:s0 localhost:$TESTDIR /mnt/selinux-testsuite
+echo "Testing context mount of a security_label export."
+fctx=`secon -t -f /mnt/selinux-testsuite/nfs.sh`
Oops. Will fix.
+if [ "$fctx" != "etc_t" ]; then
+ echo "Context mount failed: got $fctx instead of etc_t."
+ exit 1
+fi
+umount /mnt/selinux-testsuite
+exportfs -u localhost:$MOUNT
+
+# Test context mounts when not exported with security_label.
+exportfs -orw,no_root_squash localhost:$MOUNT
+mount -t nfs -o vers=4.2,context=system_u:object_r:etc_t:s0 localhost:$TESTDIR /mnt/selinux-testsuite
+echo "Testing context mount of a non-security_label export."
+fctx=`secon -t -f /mnt/selinux-testsuite/nfs.sh`
+if [ "$fctx" != "etc_t" ]; then
+ echo "Context mount failed: got $fctx instead of etc_t."
+ exit 1
+fi
+umount /mnt/selinux-testsuite
+
+# Test non-context mount when not exported with security_label.
+mount -t nfs -o vers=4.2 localhost:$TESTDIR /mnt/selinux-testsuite
+echo "Testing non-context mount of a non-security_label export."
+fctx=`secon -t -f /mnt/selinux-testsuite/nfs.sh`
+if [ "$fctx" != "nfs_t" ]; then
+ echo "Context mount failed: got $fctx instead of nfs_t."
+ exit 1
+fi
+umount /mnt/selinux-testsuite
+
+# All done.
+echo "Done"
exportfs -u localhost:$MOUNT
+rmdir /mnt/selinux-testsuite
systemctl stop nfs-server
