| Message ID | 20200130201107.4152-2-sds@tycho.nsa.gov (mailing list archive) |
|---|---|
| State | Superseded |
| Headers | show |
| Series | [v2,1/2] testsuite: provide support for testing labeled NFS | expand |
On 1/30/20 3:11 PM, Stephen Smalley wrote: > In addition to testing full NFS security labeling support, > make sure that context mounts continue to work independent > of whether the mount was exported with security_label, and > add a simple test of the default NFS file labeling. > > With the previous changes, this completes addressing > https://github.com/SELinuxProject/selinux-testsuite/issues/32 > > Fixes: https://github.com/SELinuxProject/selinux-testsuite/issues/32 > Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> > --- > v2 moves nfs.sh under the tools/ directory and also updates > README.md for the additional tests. As before, these patches > depend on "testsuite: enable running over labeled NFS" to > enable the testsuite to pass on NFS mounts. > > README.md | 5 ++++- > tools/nfs.sh | 38 ++++++++++++++++++++++++++++++++++++++ > 2 files changed, 42 insertions(+), 1 deletion(-) > > diff --git a/README.md b/README.md > index e02ae9ac6d6f..64f80c8fd493 100644 > --- a/README.md > +++ b/README.md > @@ -156,7 +156,10 @@ nfs.sh script while in the selinux-testsuite directory: > The script will start the nfs-server, export the mount containing the > testsuite directory with the security_label option to localhost, mount > it via NFSv4.2 on /mnt/selinux-testsuite, switch to that directory, > -and run the testsuite there. After completion, it will unmount and > +and run the testsuite there. After running the testsuite, the script > +will also perform tests of context mounts with and without the > +security_label export option and will test default NFS file labeling > +in the absence of any options. When finished, it will unmount and > unexport the mount and then stop the nfs-server. > > ## Running the Tests > diff --git a/tools/nfs.sh b/tools/nfs.sh > index 31c66c377cae..a82c4069d76d 100755 > --- a/tools/nfs.sh > +++ b/tools/nfs.sh > @@ -2,6 +2,8 @@ > MOUNT=`stat --print %m .` > TESTDIR=`pwd` > systemctl start nfs-server > + > +# Run the full testsuite on a labeled NFS mount. > exportfs -orw,no_root_squash,security_label localhost:$MOUNT > mkdir -p /mnt/selinux-testsuite > mount -t nfs -o vers=4.2 localhost:$TESTDIR /mnt/selinux-testsuite > @@ -9,5 +11,41 @@ pushd /mnt/selinux-testsuite > make test > popd > umount /mnt/selinux-testsuite > + > +# Test context mounts when exported with security_label. > +mount -t nfs -o vers=4.2,context=system_u:object_r:etc_t:s0 localhost:$TESTDIR /mnt/selinux-testsuite > +echo "Testing context mount of a security_label export." > +fctx=`secon -t -f /mnt/selinux-testsuite/nfs.sh` Oops. Will fix. > +if [ "$fctx" != "etc_t" ]; then > + echo "Context mount failed: got $fctx instead of etc_t." > + exit 1 > +fi > +umount /mnt/selinux-testsuite > +exportfs -u localhost:$MOUNT > + > +# Test context mounts when not exported with security_label. > +exportfs -orw,no_root_squash localhost:$MOUNT > +mount -t nfs -o vers=4.2,context=system_u:object_r:etc_t:s0 localhost:$TESTDIR /mnt/selinux-testsuite > +echo "Testing context mount of a non-security_label export." > +fctx=`secon -t -f /mnt/selinux-testsuite/nfs.sh` > +if [ "$fctx" != "etc_t" ]; then > + echo "Context mount failed: got $fctx instead of etc_t." > + exit 1 > +fi > +umount /mnt/selinux-testsuite > + > +# Test non-context mount when not exported with security_label. > +mount -t nfs -o vers=4.2 localhost:$TESTDIR /mnt/selinux-testsuite > +echo "Testing non-context mount of a non-security_label export." > +fctx=`secon -t -f /mnt/selinux-testsuite/nfs.sh` > +if [ "$fctx" != "nfs_t" ]; then > + echo "Context mount failed: got $fctx instead of nfs_t." > + exit 1 > +fi > +umount /mnt/selinux-testsuite > + > +# All done. > +echo "Done" > exportfs -u localhost:$MOUNT > +rmdir /mnt/selinux-testsuite > systemctl stop nfs-server >
diff --git a/README.md b/README.md index e02ae9ac6d6f..64f80c8fd493 100644 --- a/README.md +++ b/README.md @@ -156,7 +156,10 @@ nfs.sh script while in the selinux-testsuite directory: The script will start the nfs-server, export the mount containing the testsuite directory with the security_label option to localhost, mount it via NFSv4.2 on /mnt/selinux-testsuite, switch to that directory, -and run the testsuite there. After completion, it will unmount and +and run the testsuite there. After running the testsuite, the script +will also perform tests of context mounts with and without the +security_label export option and will test default NFS file labeling +in the absence of any options. When finished, it will unmount and unexport the mount and then stop the nfs-server. ## Running the Tests diff --git a/tools/nfs.sh b/tools/nfs.sh index 31c66c377cae..a82c4069d76d 100755 --- a/tools/nfs.sh +++ b/tools/nfs.sh @@ -2,6 +2,8 @@ MOUNT=`stat --print %m .` TESTDIR=`pwd` systemctl start nfs-server + +# Run the full testsuite on a labeled NFS mount. exportfs -orw,no_root_squash,security_label localhost:$MOUNT mkdir -p /mnt/selinux-testsuite mount -t nfs -o vers=4.2 localhost:$TESTDIR /mnt/selinux-testsuite @@ -9,5 +11,41 @@ pushd /mnt/selinux-testsuite make test popd umount /mnt/selinux-testsuite + +# Test context mounts when exported with security_label. +mount -t nfs -o vers=4.2,context=system_u:object_r:etc_t:s0 localhost:$TESTDIR /mnt/selinux-testsuite +echo "Testing context mount of a security_label export." +fctx=`secon -t -f /mnt/selinux-testsuite/nfs.sh` +if [ "$fctx" != "etc_t" ]; then + echo "Context mount failed: got $fctx instead of etc_t." + exit 1 +fi +umount /mnt/selinux-testsuite +exportfs -u localhost:$MOUNT + +# Test context mounts when not exported with security_label. +exportfs -orw,no_root_squash localhost:$MOUNT +mount -t nfs -o vers=4.2,context=system_u:object_r:etc_t:s0 localhost:$TESTDIR /mnt/selinux-testsuite +echo "Testing context mount of a non-security_label export." +fctx=`secon -t -f /mnt/selinux-testsuite/nfs.sh` +if [ "$fctx" != "etc_t" ]; then + echo "Context mount failed: got $fctx instead of etc_t." + exit 1 +fi +umount /mnt/selinux-testsuite + +# Test non-context mount when not exported with security_label. +mount -t nfs -o vers=4.2 localhost:$TESTDIR /mnt/selinux-testsuite +echo "Testing non-context mount of a non-security_label export." +fctx=`secon -t -f /mnt/selinux-testsuite/nfs.sh` +if [ "$fctx" != "nfs_t" ]; then + echo "Context mount failed: got $fctx instead of nfs_t." + exit 1 +fi +umount /mnt/selinux-testsuite + +# All done. +echo "Done" exportfs -u localhost:$MOUNT +rmdir /mnt/selinux-testsuite systemctl stop nfs-server
In addition to testing full NFS security labeling support, make sure that context mounts continue to work independent of whether the mount was exported with security_label, and add a simple test of the default NFS file labeling. With the previous changes, this completes addressing https://github.com/SELinuxProject/selinux-testsuite/issues/32 Fixes: https://github.com/SELinuxProject/selinux-testsuite/issues/32 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> --- v2 moves nfs.sh under the tools/ directory and also updates README.md for the additional tests. As before, these patches depend on "testsuite: enable running over labeled NFS" to enable the testsuite to pass on NFS mounts. README.md | 5 ++++- tools/nfs.sh | 38 ++++++++++++++++++++++++++++++++++++++ 2 files changed, 42 insertions(+), 1 deletion(-)