From patchwork Sat Mar 11 00:50:48 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Biggers X-Patchwork-Id: 9618281 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 762826046A for ; Sat, 11 Mar 2017 00:52:48 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 5E35F28763 for ; Sat, 11 Mar 2017 00:52:48 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 501C5287B4; Sat, 11 Mar 2017 00:52:48 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.3 required=2.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, FREEMAIL_FROM, RCVD_IN_DNSWL_HI, RCVD_IN_SORBS_SPAM, T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id E017828763 for ; Sat, 11 Mar 2017 00:52:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932687AbdCKAwm (ORCPT ); Fri, 10 Mar 2017 19:52:42 -0500 Received: from mail-pf0-f194.google.com ([209.85.192.194]:33262 "EHLO mail-pf0-f194.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S933376AbdCKAwh (ORCPT ); Fri, 10 Mar 2017 19:52:37 -0500 Received: by mail-pf0-f194.google.com with SMTP id v190so12418539pfb.0 for ; Fri, 10 Mar 2017 16:52:36 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=mS4IAA9LxEy0j6+CaiGSOjEbG9hbfkUy0eLe0IKWTnk=; b=MbnttLpBojXNlGkPlCSRFSrZiOO/OU32SHFy+JLtp5HJJ2/a9DeMhk+Y9dBdtUG+UQ h6kk7XAX3PTlxCf5oVIO2kBYMUJx8UOm/uvYG0TEhPjctNiwJvKq5RAJCmsHgAeaOmcr N+9QP9xsJfO5eyZ57rlyCvULo0dqgclWmIseFWjZ4y6SN0rv6h0D6+ZDzA6mDa8/Hj8L N8fKugiW169uxma+p4Y7zfvGFSwf1HI1JVlRzsMTR2yW36zAAKB7DX4+LksD1RQoBKP8 60zsyhy+GNUrt30xp0+wtedcJWrF1yKwAdjY1Rh/ga9nqTvWjvPga7o94TxUW0A74APF LXdw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=mS4IAA9LxEy0j6+CaiGSOjEbG9hbfkUy0eLe0IKWTnk=; b=ZfwkAFR1Qengl4Z+QDC0q2SlqsQI6wkTBHkzKMK+jDYUA0zhnQ2+EtkzZ6MM47LQhj BBSREVeicd4qaN5Vw+Gxb4pJ96EFjWtlycTRUQLmDifiKqFeRcwZsxW/f+SZVbuTBtrT DtWl/gv3MSbtOsyyrxME/VvKl++3xCNFhY5WmE0FNizDfmwn0WUOLcqgS7avCBJehnvG w7zSYoDG1x0lIwESF0W/RmTJc5OkoHVrKVrwLkzZ5pLznN4g0LIlInmLNjK8knM5Qg26 C6zjQLzUpoar+YYUf2N9zxYRK1xebgyt8/mDxSKHzTcJm4TnDb5vQy+59CtIRbIgyiIQ QOEg== X-Gm-Message-State: AMke39mNMgnsFOVbmfapgVmmslCtmNGoXGg57w7fUk4+K4TKXa/KfsAAFSqSKErPwn30vA== X-Received: by 10.84.236.9 with SMTP id q9mr29165473plk.96.1489193556457; Fri, 10 Mar 2017 16:52:36 -0800 (PST) Received: from ebiggers-linuxstation.kir.corp.google.com ([100.119.30.131]) by smtp.gmail.com with ESMTPSA id h3sm20685863pfc.82.2017.03.10.16.52.35 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Fri, 10 Mar 2017 16:52:36 -0800 (PST) From: Eric Biggers To: fstests@vger.kernel.org Cc: Theodore Ts'o , Eric Biggers Subject: [PATCH 2/2] common/config: don't hard-code SELinux context Date: Fri, 10 Mar 2017 16:50:48 -0800 Message-Id: <20170311005048.128477-2-ebiggers3@gmail.com> X-Mailer: git-send-email 2.12.0.246.ga2ecc84866-goog In-Reply-To: <20170311005048.128477-1-ebiggers3@gmail.com> References: <20170311005048.128477-1-ebiggers3@gmail.com> Sender: fstests-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: fstests@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Eric Biggers If SELinux is enabled, xfstests mounts its filesystems with "-o context=system_u:object_r:nfs_t:s0" so that no SELinux xattrs get created and interfere with tests. However, this particular context is not guaranteed to be available because the context names are a detail of the SELinux policy. The SELinux policy on Android systems, for example, does not have a context with this name. To fix this, just grab the SELinux context of the root directory. This is arbitrary, but it should always provide a valid context. And any valid context *should* be okay (i.e. we don't necessarily need a "liberal" one), since one would likely encounter many other problems if they were to run xfstests in a confined context with SELinux in enforcing mode. Signed-off-by: Eric Biggers --- common/config | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/common/config b/common/config index fb60216c..ab635767 100644 --- a/common/config +++ b/common/config @@ -259,11 +259,16 @@ case "$HOSTOS" in esac # SELinux adds extra xattrs which can mess up our expected output. -# So, mount with a context, and they won't be created -# # nfs_t is a "liberal" context so we can use it. +# So, mount with a context, and they won't be created. +# +# Since the context= option only accepts contexts defined in the +# SELinux policy, and different systems may have different policies +# with different context names, use the context of an existing +# directory. (Assume that any valid context is fine, since xfstests +# should really only be run from an "unconfined" process, or with +# SELinux in permissive mode.) if [ -x /usr/sbin/selinuxenabled ] && /usr/sbin/selinuxenabled; then - SELINUX_MOUNT_OPTIONS="-o context=system_u:object_r:nfs_t:s0" - export SELINUX_MOUNT_OPTIONS + export SELINUX_MOUNT_OPTIONS="-o context=$(stat -c %C /)" fi # check if mkfs.xfs supports v5 xfs