common/config: don't hard-code SELinux context
PATCH v2 1/1 common/config: don't hard-code SELinux context
From: Eric Biggers <[email protected]>
If SELinux is enabled, by default xfstests mounts its filesystems with "-o context=system_u:object_r:nfs_t:s0" so that no SELinux xattrs get created and interfere with tests. However, this particular context is not guaranteed to be available because the context names are a detail of the SELinux policy. The SELinux policy on Android systems, for example, does not have a context with this name.
To fix this without having to manually override SELINUX_MOUNT_OPTIONS, just grab the SELinux context of the root directory. This is arbitrary, but it should always provide a valid context. And if for some reason someone is actually running xfstests in a specific SELinux context that needs files labeled with a particular context, then they may still override SELINUX_MOUNT_OPTIONS.
--- common/config | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-)
common/config +10 -3
@@ -260,11 +260,18 @@ case "$HOSTOS" in esac # SELinux adds extra xattrs which can mess up our expected output. -# So, mount with a context, and they won't be created -# # nfs_t is a "liberal" context so we can use it. +# So, mount with a context, and they won't be created. +# +# Since the context= option only accepts contexts defined in the SELinux +# policy, and different systems may have different policies with +# different context names, use the context of an existing directory. +# Assume that any valid context is fine, since xfstests should really +# only be run from an "unconfined" process, or with SELinux in permissive +# mode. But if not, just specify your own SELINUX_MOUNT_OPTIONS. if [ -x /usr/sbin/selinuxenabled ] && /usr/sbin/selinuxenabled; then - : ${SELINUX_MOUNT_OPTIONS:="-o context=system_u:object_r:nfs_t:s0"} + : ${SELINUX_MOUNT_OPTIONS:="-o context=$(stat -c %C /)"} export SELINUX_MOUNT_OPTIONS + fi # check if mkfs.xfs supports v5 xfs
Signature · 1 line
2.12.0.367.g23dc2f6d3c-goog
Quoted 34 lines · Eric Biggers
From: Eric Biggers <[email protected]>
If SELinux is enabled, by default xfstests mounts its filesystems with "-o context=system_u:object_r:nfs_t:s0" so that no SELinux xattrs get created and interfere with tests. However, this particular context is not guaranteed to be available because the context names are a detail of the SELinux policy. The SELinux policy on Android systems, for example, does not have a context with this name.
To fix this without having to manually override
SELINUX_MOUNT_OPTIONS, just grab the SELinux context of the root directory. This is arbitrary, but it should always provide a valid context. And if for some reason someone is actually running xfstests in a specific SELinux context that needs files labeled with a particular context, then they may still overrideSELINUX_MOUNT_OPTIONS.Signed-off-by Eric Biggers <[email protected]>--- common/config | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-)common/config +3
-2@@ -260,11 +260,18 @@ case "$HOSTOS" in esac # SELinux adds extra xattrs which can mess up our expected output. -# So, mount with a context, and they won't be created -# # nfs_t is a "liberal" context so we can use it. +# So, mount with a context, and they won't be created. +# +# Since the context= option only accepts contexts defined in the SELinux
common/config case "$HOSTOS" in · line 274
Quoted 10 lines
common/config +7
-1+# policy, and different systems may have different policies with +# different context names, use the context of an existing directory. +# Assume that any valid context is fine, since xfstests should really +# only be run from an "unconfined" process, or with SELinux in permissive +# mode. But if not, just specify your own SELINUX_MOUNT_OPTIONS. if [ -x /usr/sbin/selinuxenabled ] && /usr/sbin/selinuxenabled; then - : ${SELINUX_MOUNT_OPTIONS:="-o context=system_u:object_r:nfs_t:s0"} + : ${SELINUX_MOUNT_OPTIONS:="-o context=$(stat -c %C /)"} export SELINUX_MOUNT_OPTIONS +
I removed this extra empty line and committed patch to stage tree.
Thanks,
Eryu
Quoted 10 lines
common/config +0
-0fi # check if mkfs.xfs supports v5 xfsSignature · 6 lines
2.12.0.367.g23dc2f6d3c-goog -- To unsubscribe from this list: send the line "unsubscribe fstests" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html