| Message ID | 20200204143707.318337-1-richard_c_haines@btinternet.com (mailing list archive) |
|---|---|
| Headers | show |
| Series | selinux-testsuite: Test all mount option context types | expand |
On 2/4/20 9:37 AM, Richard Haines wrote: > Not sure how useful these tests are but using them as a starter for running > tests on all supported filesystems (that I could find). > > These test all the *context= mount options by reading /sbin/mkfs.* entries. > I've failed/passed tests based on what I have seen, however some could be > wrong. A few preliminary comments: - The existence of /sbin/mkfs.foo does not guarantee that the kernel config enables the foo filesystem, - I'm not sure that we really want to test all of these filesystem types all the time; my earlier comments were more directed at enabling us to apply as many of the existing filesystem + fs_filesystem tests as possible to whatever filesystem type is in use as the native/host filesystem type in which selinux-testsuite lives as is the case for all other tests, so that distributions with different defaults will get their own defaults tested automatically (e.g. ext4 vs xfs vs btrfs) when run on their distribution and labeled NFS will be fully exercised when running nfs.sh, - Only exercising fsconfig(2) without actually mounting won't tell us if the context is actually being applied as expected, unlike the existing filesystem tests, - Fail/pass shouldn't be based on what we happen to see when we run the test but on what is known to be the actual correct behavior. Offhand, the only cases expected to fail if allowed by policy would be use of any of the context mount options in a non-init user namespace (except for tmpfs/ramfs/devpts) or use of defcontext= with a filesystem type that isn't fs_use_xattr in policy or using native labeling (labeled NFS). > > Notes: > 1) As I use fsconfig(2), the btrfs tests will always fail as there is a > bug somewhere in the kernel (being investigated). > 2) I have had to disable udisks as that interferes with the tests. You can > keep it enabled by ./test -e. > I think there is really a problem with udisks getting in the way as I > rapidly fsopen(fd), fsconfig(2) close(fd) for each test (on my system > this equals 48 times). > > Richard Haines (1): > selinux-testsuite: Test all mount option context types > > policy/test_filesystem.te | 12 +++ > tests/Makefile | 2 +- > tests/filesystem/Filesystem.pm | 19 +++- > tests/fs_contexts/.gitignore | 1 + > tests/fs_contexts/Makefile | 13 +++ > tests/fs_contexts/fsconfig.c | 72 ++++++++++++++++ > tests/fs_contexts/test | 153 +++++++++++++++++++++++++++++++++ > 7 files changed, 268 insertions(+), 4 deletions(-) > create mode 100644 tests/fs_contexts/.gitignore > create mode 100644 tests/fs_contexts/Makefile > create mode 100644 tests/fs_contexts/fsconfig.c > create mode 100755 tests/fs_contexts/test