@@ -3,11 +3,21 @@
# This test performs capability tests for file operations.
#
-use Test;
-BEGIN { plan tests => 10 }
+use Test::More;
-$basedir = $0;
-$basedir =~ s|(.*)/[^/]*|$1|;
+BEGIN {
+ $basedir = $0;
+ $basedir =~ s|(.*)/[^/]*|$1|;
+
+ $isnfs = `stat -f --print %T $basedir`;
+
+ if ( $isnfs eq "nfs" ) {
+ plan skip_all => "file capabilities not supported over NFS";
+ }
+ else {
+ plan tests => 10;
+ }
+}
# Clean up from a previous run
system "rm -f $basedir/temp_file 2>&1";
@@ -20,12 +30,12 @@ system "rm -f $basedir/temp_file2 2>&1";
system "touch $basedir/temp_file 2>&1";
$result =
system "runcon -t test_fcap_t -- chown daemon $basedir/temp_file 2>&1";
-ok( $result, 0 );
+ok( $result eq 0 );
# CAP_FOWNER
system "chown daemon.tty $basedir/temp_file 2>&1";
$result = system "runcon -t test_fcap_t -- chmod 0400 $basedir/temp_file 2>&1";
-ok( $result, 0 );
+ok( $result eq 0 );
# CAP_FSETID
$fn = "$basedir/temp_file";
@@ -42,12 +52,12 @@ ok($result);
# CAP_LEASE
$result = system
"runcon -t test_fcap_t -- $basedir/test_lease $basedir/temp_file 2>&1";
-ok( $result, 0 );
+ok( $result eq 0 );
# CAP_MKNOD
$result =
system "runcon -t test_fcap_t -- mknod $basedir/temp_file2 c 5 5 2>&1";
-ok( $result, 0 );
+ok( $result eq 0 );
# Cleanup time.
system "rm -f $basedir/temp_file 2>&1";
@@ -79,7 +89,7 @@ if ( $mode eq ( stat($fn) )[2] ) {
}
# prior mode should be same as current mode
-ok( $result, 0 );
+ok( $result eq 0 );
# CAP_LEASE - Needs DAC_OVERRIDE
$result = system
@@ -1,13 +1,23 @@
#!/usr/bin/perl
#
-# This test performs checks for network-related capabilties.
+# This test performs checks for system-related capabilties.
#
use Test;
-BEGIN { plan tests => 8 }
-$basedir = $0;
-$basedir =~ s|(.*)/[^/]*|$1|;
+BEGIN {
+ $basedir = $0;
+ $basedir =~ s|(.*)/[^/]*|$1|;
+
+ $isnfs = `stat -f --print %T $basedir`;
+
+ $test_count = 7;
+ if ( $isnfs ne "nfs" ) {
+ $test_count += 1;
+ }
+
+ plan tests => $test_count;
+}
# Clean up from a previous run
system "rm -f $basedir/temp_file 2>&1";
@@ -16,11 +26,15 @@ system "rm -f $basedir/temp_file 2>&1";
# Tests for the good domain.
#
-# CAP_SYS_RAWIO
-system "touch $basedir/temp_file 2>&1";
-$result =
- system "runcon -t test_scap_t -- $basedir/test_rawio $basedir/temp_file 2>&1";
-ok( $result, 0 );
+if ( $isnfs ne "nfs" ) {
+
+ # CAP_SYS_RAWIO
+ system "touch $basedir/temp_file 2>&1";
+ $result =
+ system
+ "runcon -t test_scap_t -- $basedir/test_rawio $basedir/temp_file 2>&1";
+ ok( $result, 0 );
+}
# CAP_SYS_CHROOT
$result = system "runcon -t test_scap_t -- $basedir/test_chroot $basedir/ 2>&1";
@@ -4,10 +4,20 @@
#
use Test;
-BEGIN { plan tests => 16 }
-$basedir = $0;
-$basedir =~ s|(.*)/[^/]*|$1|;
+BEGIN {
+ $basedir = $0;
+ $basedir =~ s|(.*)/[^/]*|$1|;
+
+ $isnfs = `stat -f --print %T $basedir`;
+
+ $test_count = 15;
+ if ( $isnfs ne "nfs" ) {
+ $test_count++;
+ }
+
+ plan tests => $test_count;
+}
#
# Clean up from a previous run
@@ -72,9 +82,11 @@ $result = system
"runcon -t test_fileop_t -- $basedir/test_mprotect $basedir/temp_file $good_file_sid 2>&1";
ok( $result, 0 );
-$result = system
+if ( $isnfs ne "nfs" ) {
+ $result = system
"runcon -t test_fileop_t -- $basedir/test_lock $basedir/temp_file $good_file_sid 2>&1";
-ok( $result, 0 );
+ ok( $result, 0 );
+}
$result = system
"runcon -t test_fileop_t -- $basedir/test_rw $basedir/temp_file $good_file_sid 2>&1";
@@ -1,10 +1,15 @@
#!/usr/bin/perl
use Test;
-BEGIN { plan tests => 8 }
-$basedir = $0;
-$basedir =~ s|(.*)/[^/]*|$1|;
+BEGIN {
+ $basedir = $0;
+ $basedir =~ s|(.*)/[^/]*|$1|;
+
+ $isnfs = `stat -f --print %T $basedir`;
+
+ plan tests => 8;
+}
# Verify that test_mac_admin_t can relabel a file to an undefined context.
system("rm -f $basedir/test_file; touch $basedir/test_file");
@@ -36,7 +41,12 @@ ok( $result, 0 ); # we expect this to succeed.
# Verify that test_mac_admin_t sees the undefined label value.
$result = `runcon -t test_mac_admin_t -- secon -t -f $basedir/test_dir 2>&1`;
chomp($result);
-ok( $result, "UNDEFINED" );
+if ( $isnfs ne "nfs" ) {
+ ok( $result, "UNDEFINED" );
+}
+else {
+ ok( $result, "unlabeled_t" );
+}
# Verify that test_no_mac_admin_t sees the unlabeled context.
$result = `runcon -t test_no_mac_admin_t -- secon -t -f $basedir/test_dir 2>&1`;
@@ -2,10 +2,18 @@
use Test::More;
BEGIN {
+ $basedir = $0;
+ $basedir =~ s|(.*)/[^/]*|$1|;
+
+ $isnfs = `stat -f --print %T $basedir`;
+
# check if kernel supports overlayfs and SELinux labeling
if ( system("grep -q security_inode_copy_up /proc/kallsyms") ) {
plan skip_all => "overlayfs not supported with SELinux in this kernel";
}
+ elsif ( $isnfs eq "nfs" ) {
+ plan skip_all => "overlayfs upperdir not supported on NFS";
+ }
else {
plan tests => 119;
}
@@ -695,9 +703,6 @@ sub test_93_1 {
return;
}
-$basedir = $0;
-$basedir =~ s|(.*)/[^/]*|$1|;
-
cleanup();
sub nocontext_test {
Certain tests cannot succeed on nfs and therefore should be skipped in that case. This allows the testsuite to be run on a labeled NFS mount as described below without triggering any (additional) failures relative to running on a local filesystem like ext4. The tests that are skipped or modified and the corresponding rationale is: file: 1 test skipped - flock not supported over NFS capable_file: all tests skipped - file capabilities not supported over NFS capable_sys: 1 test skipped - CAP_SYS_RAWIO not supported over NFS overlay: all tests skipped - NFS not supported as an upperdir mac_admin: one test modified - undefined contexts not exported over NFS This partly addresses https://github.com/SELinuxProject/selinux-testsuite/issues/32. Test sequence for labeled NFS is: $ cat nfs.sh MOUNT=/home # must be a top-level mount TESTDIR=$MOUNT/path/to/selinux-testsuite systemctl start nfs-server exportfs -orw,no_root_squash,security_label localhost:$MOUNT mkdir -p /mnt/selinux-testsuite mount -t nfs -o vers=4.2 localhost:$TESTDIR /mnt/selinux-testsuite pushd /mnt/selinux-testsuite make test popd umount /mnt/selinux-testsuite exportfs -u localhost:$MOUNT systemctl stop nfs-server Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> --- tests/capable_file/test | 28 +++++++++++++++++++--------- tests/capable_sys/test | 32 +++++++++++++++++++++++--------- tests/file/test | 22 +++++++++++++++++----- tests/mac_admin/test | 18 ++++++++++++++---- tests/overlay/test | 11 ++++++++--- 5 files changed, 81 insertions(+), 30 deletions(-)