diff mbox series

[v3] generic: new test to verify selinux label of whiteout inode

Message ID 20220901143459.3883118-1-zlang@kernel.org (mailing list archive)
State New, archived
Headers show
Series [v3] generic: new test to verify selinux label of whiteout inode | expand

Commit Message

Zorro Lang Sept. 1, 2022, 2:34 p.m. UTC 
A but on XFS cause renameat2() with flags=RENAME_WHITEOUT doesn't
apply an selinux label. That's quite different with other fs (e.g.
ext4, tmpfs).

Signed-off-by: Zorro Lang <zlang@kernel.org>
---

V1 -> V2:
1) Add "whiteout" group
2) Add commit ID which fix that bug
3) Rebase to latest fstests for-next branch

V2 -> V3:
Rebase to latest fstests for-next branch again

Thanks,
Zorro

 tests/generic/695     | 64 +++++++++++++++++++++++++++++++++++++++++++
 tests/generic/695.out |  2 ++
 2 files changed, 66 insertions(+)
 create mode 100755 tests/generic/695
 create mode 100644 tests/generic/695.out

Comments

Murphy Zhou Sept. 2, 2022, 12:44 a.m. UTC | #1 
On Thu, Sep 1, 2022 at 10:47 PM Zorro Lang <zlang@kernel.org> wrote:
>
> A but on XFS cause renameat2() with flags=RENAME_WHITEOUT doesn't
       ^ bug
> apply an selinux label. That's quite different with other fs (e.g.
> ext4, tmpfs).
>
> Signed-off-by: Zorro Lang <zlang@kernel.org>
> ---
>
> V1 -> V2:
> 1) Add "whiteout" group
> 2) Add commit ID which fix that bug
> 3) Rebase to latest fstests for-next branch
>
> V2 -> V3:
> Rebase to latest fstests for-next branch again
>
> Thanks,
> Zorro
>
>  tests/generic/695     | 64 +++++++++++++++++++++++++++++++++++++++++++
>  tests/generic/695.out |  2 ++
>  2 files changed, 66 insertions(+)
>  create mode 100755 tests/generic/695
>  create mode 100644 tests/generic/695.out
>
> diff --git a/tests/generic/695 b/tests/generic/695
> new file mode 100755
> index 00000000..f04d4b3d
> --- /dev/null
> +++ b/tests/generic/695
> @@ -0,0 +1,64 @@
> +#! /bin/bash
> +# SPDX-License-Identifier: GPL-2.0
> +# Copyright (c) 2022 Red Hat, Copyright.  All Rights Reserved.
> +#
> +# FS QA Test No. 695
> +#
> +# Verify selinux label can be kept after RENAME_WHITEOUT. This is
> +# a regression test for:
> +#   70b589a37e1a ("xfs: add selinux labels to whiteout inodes")
> +#
> +. ./common/preamble
> +_begin_fstest auto quick rename attr whiteout
> +
> +# Import common functions.
> +. ./common/attr
> +. ./common/renameat2
> +
> +# real QA test starts here
> +_supported_fs generic
> +_require_scratch
> +_require_attrs
> +_require_renameat2 whiteout
> +
> +_fixed_by_kernel_commit 70b589a37e1a \
> +       xfs: add selinux labels to whiteout inodes
> +
> +get_selinux_label()
> +{
> +       local label
> +
> +       label=`_getfattr --absolute-names -n security.selinux $@ | sed -n 's/security.selinux=\"\(.*\)\"/\1/p'`

Just curious, why `` instead of $() ? I see the latter is preferred in
many articles.

Regards~

> +       if [ ${PIPESTATUS[0]} -ne 0 -o -z "$label" ];then
> +               _fail "Fail to get selinux label: $label"
> +       fi
> +       echo $label
> +}
> +
> +_scratch_mkfs >> $seqres.full 2>&1
> +# SELINUX_MOUNT_OPTIONS will be set in common/config if selinux is enabled
> +if [ -z "$SELINUX_MOUNT_OPTIONS" ]; then
> +       _notrun "Require selinux to be enabled"
> +fi
> +# This test need to verify selinux labels in objects, so unset this selinux
> +# mount option
> +export SELINUX_MOUNT_OPTIONS=""
> +_scratch_mount
> +
> +touch $SCRATCH_MNT/f1
> +echo "Before RENAME_WHITEOUT" >> $seqres.full
> +ls -lZ $SCRATCH_MNT >> $seqres.full 2>&1
> +# Expect f1 and f2 have same label after RENAME_WHITEOUT
> +$here/src/renameat2 -w $SCRATCH_MNT/f1 $SCRATCH_MNT/f2
> +echo "After RENAME_WHITEOUT" >> $seqres.full
> +ls -lZ $SCRATCH_MNT >> $seqres.full 2>&1
> +label1=`get_selinux_label $SCRATCH_MNT/f1`
> +label2=`get_selinux_label $SCRATCH_MNT/f2`
> +if [ "$label1" != "$label2" ];then
> +       echo "$label1 != $label2"
> +fi
> +
> +echo "Silence is golden"
> +# success, all done
> +status=0
> +exit
> diff --git a/tests/generic/695.out b/tests/generic/695.out
> new file mode 100644
> index 00000000..1332ff16
> --- /dev/null
> +++ b/tests/generic/695.out
> @@ -0,0 +1,2 @@
> +QA output created by 695
> +Silence is golden
> --
> 2.31.1
>
Zorro Lang Sept. 2, 2022, 1:35 a.m. UTC | #2 
On Fri, Sep 02, 2022 at 08:44:21AM +0800, Murphy Zhou wrote:
> On Thu, Sep 1, 2022 at 10:47 PM Zorro Lang <zlang@kernel.org> wrote:
> >
> > A but on XFS cause renameat2() with flags=RENAME_WHITEOUT doesn't
>        ^ bug

Sure, will fix

> > apply an selinux label. That's quite different with other fs (e.g.
> > ext4, tmpfs).
> >
> > Signed-off-by: Zorro Lang <zlang@kernel.org>
> > ---
> >
> > V1 -> V2:
> > 1) Add "whiteout" group
> > 2) Add commit ID which fix that bug
> > 3) Rebase to latest fstests for-next branch
> >
> > V2 -> V3:
> > Rebase to latest fstests for-next branch again
> >
> > Thanks,
> > Zorro
> >
> >  tests/generic/695     | 64 +++++++++++++++++++++++++++++++++++++++++++
> >  tests/generic/695.out |  2 ++
> >  2 files changed, 66 insertions(+)
> >  create mode 100755 tests/generic/695
> >  create mode 100644 tests/generic/695.out
> >
> > diff --git a/tests/generic/695 b/tests/generic/695
> > new file mode 100755
> > index 00000000..f04d4b3d
> > --- /dev/null
> > +++ b/tests/generic/695
> > @@ -0,0 +1,64 @@
> > +#! /bin/bash
> > +# SPDX-License-Identifier: GPL-2.0
> > +# Copyright (c) 2022 Red Hat, Copyright.  All Rights Reserved.
> > +#
> > +# FS QA Test No. 695
> > +#
> > +# Verify selinux label can be kept after RENAME_WHITEOUT. This is
> > +# a regression test for:
> > +#   70b589a37e1a ("xfs: add selinux labels to whiteout inodes")
> > +#
> > +. ./common/preamble
> > +_begin_fstest auto quick rename attr whiteout
> > +
> > +# Import common functions.
> > +. ./common/attr
> > +. ./common/renameat2
> > +
> > +# real QA test starts here
> > +_supported_fs generic
> > +_require_scratch
> > +_require_attrs
> > +_require_renameat2 whiteout
> > +
> > +_fixed_by_kernel_commit 70b589a37e1a \
> > +       xfs: add selinux labels to whiteout inodes
> > +
> > +get_selinux_label()
> > +{
> > +       local label
> > +
> > +       label=`_getfattr --absolute-names -n security.selinux $@ | sed -n 's/security.selinux=\"\(.*\)\"/\1/p'`
> 
> Just curious, why `` instead of $() ? I see the latter is preferred in
> many articles.

Haha, nothing special reason, just get used to it, without too much thinking.
I'll replace  `` to $() in this case.

Thanks,
Zorro

> 
> Regards~
> 
> > +       if [ ${PIPESTATUS[0]} -ne 0 -o -z "$label" ];then
> > +               _fail "Fail to get selinux label: $label"
> > +       fi
> > +       echo $label
> > +}
> > +
> > +_scratch_mkfs >> $seqres.full 2>&1
> > +# SELINUX_MOUNT_OPTIONS will be set in common/config if selinux is enabled
> > +if [ -z "$SELINUX_MOUNT_OPTIONS" ]; then
> > +       _notrun "Require selinux to be enabled"
> > +fi
> > +# This test need to verify selinux labels in objects, so unset this selinux
> > +# mount option
> > +export SELINUX_MOUNT_OPTIONS=""
> > +_scratch_mount
> > +
> > +touch $SCRATCH_MNT/f1
> > +echo "Before RENAME_WHITEOUT" >> $seqres.full
> > +ls -lZ $SCRATCH_MNT >> $seqres.full 2>&1
> > +# Expect f1 and f2 have same label after RENAME_WHITEOUT
> > +$here/src/renameat2 -w $SCRATCH_MNT/f1 $SCRATCH_MNT/f2
> > +echo "After RENAME_WHITEOUT" >> $seqres.full
> > +ls -lZ $SCRATCH_MNT >> $seqres.full 2>&1
> > +label1=`get_selinux_label $SCRATCH_MNT/f1`
> > +label2=`get_selinux_label $SCRATCH_MNT/f2`
> > +if [ "$label1" != "$label2" ];then
> > +       echo "$label1 != $label2"
> > +fi
> > +
> > +echo "Silence is golden"
> > +# success, all done
> > +status=0
> > +exit
> > diff --git a/tests/generic/695.out b/tests/generic/695.out
> > new file mode 100644
> > index 00000000..1332ff16
> > --- /dev/null
> > +++ b/tests/generic/695.out
> > @@ -0,0 +1,2 @@
> > +QA output created by 695
> > +Silence is golden
> > --
> > 2.31.1
> >
>
diff mbox series

Patch

diff --git a/tests/generic/695 b/tests/generic/695
new file mode 100755
index 00000000..f04d4b3d
--- /dev/null
+++ b/tests/generic/695
@@ -0,0 +1,64 @@ 
+#! /bin/bash
+# SPDX-License-Identifier: GPL-2.0
+# Copyright (c) 2022 Red Hat, Copyright.  All Rights Reserved.
+#
+# FS QA Test No. 695
+#
+# Verify selinux label can be kept after RENAME_WHITEOUT. This is
+# a regression test for:
+#   70b589a37e1a ("xfs: add selinux labels to whiteout inodes")
+#
+. ./common/preamble
+_begin_fstest auto quick rename attr whiteout
+
+# Import common functions.
+. ./common/attr
+. ./common/renameat2
+
+# real QA test starts here
+_supported_fs generic
+_require_scratch
+_require_attrs
+_require_renameat2 whiteout
+
+_fixed_by_kernel_commit 70b589a37e1a \
+	xfs: add selinux labels to whiteout inodes
+
+get_selinux_label()
+{
+	local label
+
+	label=`_getfattr --absolute-names -n security.selinux $@ | sed -n 's/security.selinux=\"\(.*\)\"/\1/p'`
+	if [ ${PIPESTATUS[0]} -ne 0 -o -z "$label" ];then
+		_fail "Fail to get selinux label: $label"
+	fi
+	echo $label
+}
+
+_scratch_mkfs >> $seqres.full 2>&1
+# SELINUX_MOUNT_OPTIONS will be set in common/config if selinux is enabled
+if [ -z "$SELINUX_MOUNT_OPTIONS" ]; then
+	_notrun "Require selinux to be enabled"
+fi
+# This test need to verify selinux labels in objects, so unset this selinux
+# mount option
+export SELINUX_MOUNT_OPTIONS=""
+_scratch_mount
+
+touch $SCRATCH_MNT/f1
+echo "Before RENAME_WHITEOUT" >> $seqres.full
+ls -lZ $SCRATCH_MNT >> $seqres.full 2>&1
+# Expect f1 and f2 have same label after RENAME_WHITEOUT
+$here/src/renameat2 -w $SCRATCH_MNT/f1 $SCRATCH_MNT/f2
+echo "After RENAME_WHITEOUT" >> $seqres.full
+ls -lZ $SCRATCH_MNT >> $seqres.full 2>&1
+label1=`get_selinux_label $SCRATCH_MNT/f1`
+label2=`get_selinux_label $SCRATCH_MNT/f2`
+if [ "$label1" != "$label2" ];then
+	echo "$label1 != $label2"
+fi
+
+echo "Silence is golden"
+# success, all done
+status=0
+exit
diff --git a/tests/generic/695.out b/tests/generic/695.out
new file mode 100644
index 00000000..1332ff16
--- /dev/null
+++ b/tests/generic/695.out
@@ -0,0 +1,2 @@ 
+QA output created by 695
+Silence is golden