[LTP] [PATCH] swapon04: Report TCONF when SELinux denies loop device I/O

[Wake Liu via ltp <ltp@lists.linux.it>]

Kernels without commit f2fed441c69b ("loop: stop using
vfs_iter_{read,write} for buffered I/O") access the loop backing file
through vfs_iter_{read,write}(), which run the LSM file permission
checks with the credentials of the loop worker kernel thread.

swapon04 backs the loop device with a file on the freshly formatted
test filesystem. That file has no SELinux label, and strict policies
such as Android's do not allow the kernel domain to access unlabeled
files. Every I/O on the loop device then fails with EIO and the test
breaks on the first mkswap call:

  tst_cmd.c:114: TBROK: 'mkswap' exited with a non-zero code 1

  avc: denied { read } for comm="kworker/u8:0" dev="loop52" ino=12
    scontext=u:r:kernel:s0 tcontext=u:object_r:unlabeled:s0
    tclass=file permissive=0

This is a policy restriction rather than a swap bug, and it does not
depend on how LTP is built: running the system's losetup and mkswap
on such a file fails the same way. The test passes on the same 6.1
kernel once SELinux is switched to permissive mode, and on a 6.18
kernel in enforcing mode.

A kernel version check would not help, since that commit has been
backported to v6.12.25, and older kernels pass the test when the
policy does not get in the way. Instead, read the first sector of the
loop device in setup() and report TCONF if it fails with EIO while
SELinux is enforcing. On the 6.1 kernel above, ext2, ext3 and ext4
are now skipped, while tmpfs, whose files the kernel domain is
allowed to access, still passes.

Signed-off-by: Wake Liu <wakel@google.com>
---
 testcases/kernel/syscalls/swapon/swapon04.c | 29 +++++++++++++++++++++
 1 file changed, 29 insertions(+)

diff --git a/testcases/kernel/syscalls/swapon/swapon04.c b/testcases/kernel/syscalls/swapon/swapon04.c
index de95849e3..839752dd4 100644
--- a/testcases/kernel/syscalls/swapon/swapon04.c
+++ b/testcases/kernel/syscalls/swapon/swapon04.c
@@ -84,6 +84,33 @@ static struct tcase {
 	},
 };
 
+/*
+ * Kernels without commit f2fed441c69b ("loop: stop using
+ * vfs_iter_{read,write} for buffered I/O") access the backing file through
+ * vfs_iter_{read,write}(), which run LSM permission checks with the
+ * credentials of the loop worker kernel thread. Strict SELinux policies,
+ * such as Android's, do not allow the kernel to access the unlabeled files
+ * on the freshly formatted test filesystem, so any I/O on the loop device
+ * fails with EIO.
+ */
+static void check_loop_io(void)
+{
+	char buf[512];
+	int fd;
+
+	fd = SAFE_OPEN(loop_dev, O_RDONLY);
+	TEST(read(fd, buf, sizeof(buf)));
+	SAFE_CLOSE(fd);
+
+	if (TST_RET == (long)sizeof(buf))
+		return;
+
+	if (TST_RET == -1 && TST_ERR == EIO && tst_selinux_enforcing())
+		tst_brk(TCONF | TTERRNO, "I/O on %s is likely denied by SELinux", loop_dev);
+
+	tst_brk(TBROK | TTERRNO, "read(%s) returned %ld", loop_dev, TST_RET);
+}
+
 static void setup(void)
 {
 	char discard_path[PATH_MAX];
@@ -114,6 +141,8 @@ static void setup(void)
 		tst_brk(TBROK, "Failed to attach %s to %s", loop_dev, BACKING_FILE);
 	loop_attached = 1;
 
+	check_loop_io();
+
 	snprintf(discard_path, sizeof(discard_path),
 		 "/sys/block/loop%d/queue/discard_max_bytes", loop_dev_id);
 	if (FILE_SCANF(discard_path, "%lu", &discard_max_bytes) != 0 || discard_max_bytes == 0) {
-- 
2.56.0.385.gd3acb90ef8-goog


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp