| Message ID | 20170314175546.62834-1-ebiggers3@gmail.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
On Tue, Mar 14, 2017 at 10:55:46AM -0700, Eric Biggers wrote: > From: Eric Biggers <ebiggers@google.com> > > If SELinux is enabled, by default xfstests mounts its filesystems with > "-o context=system_u:object_r:nfs_t:s0" so that no SELinux xattrs get > created and interfere with tests. However, this particular context is > not guaranteed to be available because the context names are a detail of > the SELinux policy. The SELinux policy on Android systems, for example, > does not have a context with this name. > > To fix this without having to manually override SELINUX_MOUNT_OPTIONS, > just grab the SELinux context of the root directory. This is arbitrary, > but it should always provide a valid context. And if for some reason > someone is actually running xfstests in a specific SELinux context that > needs files labeled with a particular context, then they may still > override SELINUX_MOUNT_OPTIONS. > > Signed-off-by: Eric Biggers <ebiggers@google.com> > --- > common/config | 13 ++++++++++--- > 1 file changed, 10 insertions(+), 3 deletions(-) > > diff --git a/common/config b/common/config > index 0c7335ad..5bcf114d 100644 > --- a/common/config > +++ b/common/config > @@ -260,11 +260,18 @@ case "$HOSTOS" in > esac > > # SELinux adds extra xattrs which can mess up our expected output. > -# So, mount with a context, and they won't be created > -# # nfs_t is a "liberal" context so we can use it. > +# So, mount with a context, and they won't be created. > +# > +# Since the context= option only accepts contexts defined in the SELinux > +# policy, and different systems may have different policies with > +# different context names, use the context of an existing directory. > +# Assume that any valid context is fine, since xfstests should really > +# only be run from an "unconfined" process, or with SELinux in permissive > +# mode. But if not, just specify your own SELINUX_MOUNT_OPTIONS. > if [ -x /usr/sbin/selinuxenabled ] && /usr/sbin/selinuxenabled; then > - : ${SELINUX_MOUNT_OPTIONS:="-o context=system_u:object_r:nfs_t:s0"} > + : ${SELINUX_MOUNT_OPTIONS:="-o context=$(stat -c %C /)"} > export SELINUX_MOUNT_OPTIONS > + I removed this extra empty line and committed patch to stage tree. Thanks, Eryu > fi > > # check if mkfs.xfs supports v5 xfs > -- > 2.12.0.367.g23dc2f6d3c-goog > > -- > To unsubscribe from this list: send the line "unsubscribe fstests" in > the body of a message to majordomo@vger.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html -- To unsubscribe from this list: send the line "unsubscribe fstests" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/common/config b/common/config index 0c7335ad..5bcf114d 100644 --- a/common/config +++ b/common/config @@ -260,11 +260,18 @@ case "$HOSTOS" in esac # SELinux adds extra xattrs which can mess up our expected output. -# So, mount with a context, and they won't be created -# # nfs_t is a "liberal" context so we can use it. +# So, mount with a context, and they won't be created. +# +# Since the context= option only accepts contexts defined in the SELinux +# policy, and different systems may have different policies with +# different context names, use the context of an existing directory. +# Assume that any valid context is fine, since xfstests should really +# only be run from an "unconfined" process, or with SELinux in permissive +# mode. But if not, just specify your own SELINUX_MOUNT_OPTIONS. if [ -x /usr/sbin/selinuxenabled ] && /usr/sbin/selinuxenabled; then - : ${SELINUX_MOUNT_OPTIONS:="-o context=system_u:object_r:nfs_t:s0"} + : ${SELINUX_MOUNT_OPTIONS:="-o context=$(stat -c %C /)"} export SELINUX_MOUNT_OPTIONS + fi # check if mkfs.xfs supports v5 xfs