If tested on the selinux-next kernel (that has the XFS patch [1]) with the "NFS: Ensure security label is set for root inode" patch [2], then all tests should pass. Anything else will give varying amounts of fails. The filesystem types tested are: ext4, xfs, vfat and nfs4. [1] https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/patch/security/selinux?id=e4cfa05e9bfe286457082477b32ecd17737bdbce [2] https://lore.kernel.org/selinux/20200303225837.1557210-1-smayhew@xxxxxxxxxx/ V2 Changes: 1) Add userdom_search_user_home_content(filesystemdomain) to policy 2) Add Makefile in nfs_filesystem for consistency. 3) Update nfs_filesystem/test text for kernel commit info. 4) Turn off -e flag once in 'function err_exit()' so each cmd completes. Changes from RFC V3: 1) Fixed question mark (?) as the total/planned number of tests (Fix: do not have print statements in BEGIN { }, or any subroutines that are called inside this). 2) nfs.sh now gives line number on all test fails. 3) Policy changes for NFS mnt_t and mounton 4) Added xfslibs-dev and uuid-dev for travis To test fanotify fs watch perms on 5.4+ (will also include tests/notify): 1) Extract the base module (base.cil): semodule -c -E base 2) Edit the following definitions in base.cil to add watch permissions: (common file (ioctl read write ....)) Add: watch watch_mount watch_sb watch_with_perm watch_reads (class filesystem (mount remount ....)) Add: watch 3) Insert modified base module (inserts with default priority 400): semodule -i base.cil 4) Backup, then edit the following definitions in: /usr/share/selinux/devel/include/support/all_perms.spt define(`all_file_perms',`{ ioctl read write .... Add: watch watch_mount watch_sb watch_with_perm watch_reads define(`all_dir_perms',`{ ioctl read write .... Add: watch watch_mount watch_sb watch_with_perm watch_reads define(`all_filesystem_perms',`{ mount remount .... Add: watch 5) 'make test' can now be run. NOTE: Do NOT leave the new base.cil active after tests, as the system may not reboot if in enforcing mode, as various watch permissions will be denied. Revert to the original (priority 100) as follows: semodule -r base make clean make -C policy unload Finally restore the original: /usr/share/selinux/devel/include/support/all_perms.spt Richard Haines (2): selinux-testsuite: Use native filesystem for tests - Part 1 selinux-testsuite: Use native filesystem for tests - Part 2 .travis.yml | 2 + README.md | 15 +- defconfig | 6 + policy/test_filesystem.te | 90 +- policy/test_filesystem_name_trans.te | 6 + policy/test_filesystem_notify.te | 41 +- tests/filesystem/.gitignore | 1 + tests/filesystem/Filesystem.pm | 111 ++- tests/filesystem/Makefile | 3 +- tests/filesystem/test | 1199 +++++++++++++++--------- tests/filesystem/xfs_quotas_test.c | 96 ++ tests/fs_filesystem/Makefile | 3 - tests/fs_filesystem/fsmount.c | 5 +- tests/fs_filesystem/test | 1300 ++++++++++++++++---------- tests/nfs_filesystem/Makefile | 2 + tests/nfs_filesystem/test | 362 +++++++ tests/nfsruntests.pl | 5 + tools/nfs.sh | 127 ++- 18 files changed, 2371 insertions(+), 1003 deletions(-) create mode 100644 tests/filesystem/xfs_quotas_test.c create mode 100644 tests/nfs_filesystem/Makefile create mode 100755 tests/nfs_filesystem/test create mode 100755 tests/nfsruntests.pl -- 2.24.1
