On 2/4/20 9:37 AM, Richard Haines wrote:
Not sure how useful these tests are but using them as a starter for running
tests on all supported filesystems (that I could find).
These test all the *context= mount options by reading /sbin/mkfs.* entries.
I've failed/passed tests based on what I have seen, however some could be
wrong.
A few preliminary comments:
- The existence of /sbin/mkfs.foo does not guarantee that the kernel
config enables the foo filesystem,
- I'm not sure that we really want to test all of these filesystem types
all the time; my earlier comments were more directed at enabling us to
apply as many of the existing filesystem + fs_filesystem tests as
possible to whatever filesystem type is in use as the native/host
filesystem type in which selinux-testsuite lives as is the case for all
other tests, so that distributions with different defaults will get
their own defaults tested automatically (e.g. ext4 vs xfs vs btrfs) when
run on their distribution and labeled NFS will be fully exercised when
running nfs.sh,
- Only exercising fsconfig(2) without actually mounting won't tell us if
the context is actually being applied as expected, unlike the existing
filesystem tests,
- Fail/pass shouldn't be based on what we happen to see when we run the
test but on what is known to be the actual correct behavior. Offhand,
the only cases expected to fail if allowed by policy would be use of any
of the context mount options in a non-init user namespace (except for
tmpfs/ramfs/devpts) or use of defcontext= with a filesystem type that
isn't fs_use_xattr in policy or using native labeling (labeled NFS).
Notes:
1) As I use fsconfig(2), the btrfs tests will always fail as there is a
bug somewhere in the kernel (being investigated).
2) I have had to disable udisks as that interferes with the tests. You can
keep it enabled by ./test -e.
I think there is really a problem with udisks getting in the way as I
rapidly fsopen(fd), fsconfig(2) close(fd) for each test (on my system
this equals 48 times).
Richard Haines (1):
selinux-testsuite: Test all mount option context types
policy/test_filesystem.te | 12 +++
tests/Makefile | 2 +-
tests/filesystem/Filesystem.pm | 19 +++-
tests/fs_contexts/.gitignore | 1 +
tests/fs_contexts/Makefile | 13 +++
tests/fs_contexts/fsconfig.c | 72 ++++++++++++++++
tests/fs_contexts/test | 153 +++++++++++++++++++++++++++++++++
7 files changed, 268 insertions(+), 4 deletions(-)
create mode 100644 tests/fs_contexts/.gitignore
create mode 100644 tests/fs_contexts/Makefile
create mode 100644 tests/fs_contexts/fsconfig.c
create mode 100755 tests/fs_contexts/test
