Re: [LTP] [PATCH] swapon04: Report TCONF when SELinux denies loop device I/O

[Cyril Hrubis <chrubis@suse.cz>]

Hi!
> +/*
> + * Kernels without commit f2fed441c69b ("loop: stop using
> + * vfs_iter_{read,write} for buffered I/O") access the backing file through
> + * vfs_iter_{read,write}(), which run LSM permission checks with the
> + * credentials of the loop worker kernel thread. Strict SELinux policies,
> + * such as Android's, do not allow the kernel to access the unlabeled files
> + * on the freshly formatted test filesystem, so any I/O on the loop device
> + * fails with EIO.
> + */
> +static void check_loop_io(void)
> +{
> +	char buf[512];
> +	int fd;
> +
> +	fd = SAFE_OPEN(loop_dev, O_RDONLY);
> +	TEST(read(fd, buf, sizeof(buf)));
> +	SAFE_CLOSE(fd);
> +
> +	if (TST_RET == (long)sizeof(buf))
> +		return;
> +
> +	if (TST_RET == -1 && TST_ERR == EIO && tst_selinux_enforcing())
> +		tst_brk(TCONF | TTERRNO, "I/O on %s is likely denied by SELinux", loop_dev);

If nothing else we whould check for the selinux as a first thing in the
function.

	if (!tst_selinux_enforcing())
		return;

	fd = SAFE_OPEN(loop_dev, ...);
	...

And the check should be skipped on 6.15 and newer, where this problem
does not happen.

-- 
Cyril Hrubis
chrubis@suse.cz

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp