[LTP] [PATCH] swapon04: Report TCONF when SELinux denies loop device I/O

[LTP] [PATCH] swapon04: Report TCONF when SELinux denies loop device I/O

[Wake Liu via ltp]

Kernels without commit f2fed441c69b ("loop: stop using
vfs_iter_{read,write} for buffered I/O") access the loop backing file
through vfs_iter_{read,write}(), which run the LSM file permission
checks with the credentials of the loop worker kernel thread.

swapon04 backs the loop device with a file on the freshly formatted
test filesystem. That file has no SELinux label, and strict policies
such as Android's do not allow the kernel domain to access unlabeled
files. Every I/O on the loop device then fails with EIO and the test
breaks on the first mkswap call:

  tst_cmd.c:114: TBROK: 'mkswap' exited with a non-zero code 1

  avc: denied { read } for comm="kworker/u8:0" dev="loop52" ino=12
    scontext=u:r:kernel:s0 tcontext=u:object_r:unlabeled:s0
    tclass=file permissive=0

This is a policy restriction rather than a swap bug, and it does not
depend on how LTP is built: running the system's losetup and mkswap
on such a file fails the same way. The test passes on the same 6.1
kernel once SELinux is switched to permissive mode, and on a 6.18
kernel in enforcing mode.

A kernel version check would not help, since that commit has been
backported to v6.12.25, and older kernels pass the test when the
policy does not get in the way. Instead, read the first sector of the
loop device in setup() and report TCONF if it fails with EIO while
SELinux is enforcing. On the 6.1 kernel above, ext2, ext3 and ext4
are now skipped, while tmpfs, whose files the kernel domain is
allowed to access, still passes.

Signed-off-by: Wake Liu <wakel@google.com>
---
 testcases/kernel/syscalls/swapon/swapon04.c | 29 +++++++++++++++++++++
 1 file changed, 29 insertions(+)

diff --git a/testcases/kernel/syscalls/swapon/swapon04.c b/testcases/kernel/syscalls/swapon/swapon04.c
index de95849e3..839752dd4 100644
--- a/testcases/kernel/syscalls/swapon/swapon04.c
+++ b/testcases/kernel/syscalls/swapon/swapon04.c
@@ -84,6 +84,33 @@ static struct tcase {
 	},
 };
 
+/*
+ * Kernels without commit f2fed441c69b ("loop: stop using
+ * vfs_iter_{read,write} for buffered I/O") access the backing file through
+ * vfs_iter_{read,write}(), which run LSM permission checks with the
+ * credentials of the loop worker kernel thread. Strict SELinux policies,
+ * such as Android's, do not allow the kernel to access the unlabeled files
+ * on the freshly formatted test filesystem, so any I/O on the loop device
+ * fails with EIO.
+ */
+static void check_loop_io(void)
+{
+	char buf[512];
+	int fd;
+
+	fd = SAFE_OPEN(loop_dev, O_RDONLY);
+	TEST(read(fd, buf, sizeof(buf)));
+	SAFE_CLOSE(fd);
+
+	if (TST_RET == (long)sizeof(buf))
+		return;
+
+	if (TST_RET == -1 && TST_ERR == EIO && tst_selinux_enforcing())
+		tst_brk(TCONF | TTERRNO, "I/O on %s is likely denied by SELinux", loop_dev);
+
+	tst_brk(TBROK | TTERRNO, "read(%s) returned %ld", loop_dev, TST_RET);
+}
+
 static void setup(void)
 {
 	char discard_path[PATH_MAX];
@@ -114,6 +141,8 @@ static void setup(void)
 		tst_brk(TBROK, "Failed to attach %s to %s", loop_dev, BACKING_FILE);
 	loop_attached = 1;
 
+	check_loop_io();
+
 	snprintf(discard_path, sizeof(discard_path),
 		 "/sys/block/loop%d/queue/discard_max_bytes", loop_dev_id);
 	if (FILE_SCANF(discard_path, "%lu", &discard_max_bytes) != 0 || discard_max_bytes == 0) {
-- 
2.56.0.385.gd3acb90ef8-goog


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] swapon04: Report TCONF when SELinux denies loop device I/O

[linuxtestproject.agent]

Hi Wake,

On Wed, 14 Oct 2026 09:36:18 +0000, Wake Liu via ltp wrote:
> swapon04: Report TCONF when SELinux denies loop device I/O

Verdict - Reviewed

---
Note:

The agent can sometimes produce false positives although often its
findings are genuine. If you find issues with the review, please
comment this email or ignore the suggestions.

Regards,
LTP AI Reviewer

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] [PATCH] swapon04: Report TCONF when SELinux denies loop device I/O

[Cyril Hrubis]

Hi!
> +/*
> + * Kernels without commit f2fed441c69b ("loop: stop using
> + * vfs_iter_{read,write} for buffered I/O") access the backing file through
> + * vfs_iter_{read,write}(), which run LSM permission checks with the
> + * credentials of the loop worker kernel thread. Strict SELinux policies,
> + * such as Android's, do not allow the kernel to access the unlabeled files
> + * on the freshly formatted test filesystem, so any I/O on the loop device
> + * fails with EIO.
> + */
> +static void check_loop_io(void)
> +{
> +	char buf[512];
> +	int fd;
> +
> +	fd = SAFE_OPEN(loop_dev, O_RDONLY);
> +	TEST(read(fd, buf, sizeof(buf)));
> +	SAFE_CLOSE(fd);
> +
> +	if (TST_RET == (long)sizeof(buf))
> +		return;
> +
> +	if (TST_RET == -1 && TST_ERR == EIO && tst_selinux_enforcing())
> +		tst_brk(TCONF | TTERRNO, "I/O on %s is likely denied by SELinux", loop_dev);

If nothing else we whould check for the selinux as a first thing in the
function.

	if (!tst_selinux_enforcing())
		return;

	fd = SAFE_OPEN(loop_dev, ...);
	...

And the check should be skipped on 6.15 and newer, where this problem
does not happen.

-- 
Cyril Hrubis
chrubis@suse.cz

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

[LTP] [PATCH v2] swapon04: Report TCONF when SELinux denies loop device I/O

[Wake Liu via ltp]

Kernels without commit f2fed441c69b ("loop: stop using
vfs_iter_{read,write} for buffered I/O") access the loop backing file
through vfs_iter_{read,write}(), which run the LSM file permission
checks with the credentials of the loop worker kernel thread.

swapon04 backs the loop device with a file on the freshly formatted
test filesystem. That file has no SELinux label, and strict policies
such as Android's do not allow the kernel domain to access unlabeled
files. Every I/O on the loop device then fails with EIO and the test
breaks on the first mkswap call:

  tst_cmd.c:114: TBROK: 'mkswap' exited with a non-zero code 1

  avc: denied { read } for comm="kworker/u8:0" dev="loop52" ino=12
    scontext=u:r:kernel:s0 tcontext=u:object_r:unlabeled:s0
    tclass=file permissive=0

This is a policy restriction rather than a swap bug, and it does not
depend on how LTP is built: running the system's losetup and mkswap
on such a file fails the same way. The test passes on the same 6.1
kernel once SELinux is switched to permissive mode, and on a 6.18
kernel in enforcing mode.

The commit was merged in v6.15, so v6.15 and newer are not affected.
On older kernels the version alone does not tell whether the test can
run: the commit has been backported to stable kernels such as v6.12.25
and v6.14.4, and kernels without it still pass the test unless the
policy gets in the way.

So on kernels older than v6.15 with SELinux in enforcing mode, read
the first sector of the loop device in setup() and report TCONF if it
fails with EIO. On the 6.1 kernel above, ext2, ext3 and ext4 are now
skipped, while tmpfs, whose files the kernel domain is allowed to
access, still passes.

Signed-off-by: Wake Liu <wakel@google.com>
---
Changes in v2:
- Return early on v6.15 and newer and when SELinux is not enforcing,
  so the loop device is only probed where the denial can happen
  (Cyril).
- Mention v6.15 and the stable backports in the comment and the
  commit message.

v1: https://lore.kernel.org/ltp/20261014093618.1475191-1-wakel@google.com/

 testcases/kernel/syscalls/swapon/swapon04.c | 35 +++++++++++++++++++++
 1 file changed, 35 insertions(+)

diff --git a/testcases/kernel/syscalls/swapon/swapon04.c b/testcases/kernel/syscalls/swapon/swapon04.c
index de95849e3..5f5206d87 100644
--- a/testcases/kernel/syscalls/swapon/swapon04.c
+++ b/testcases/kernel/syscalls/swapon/swapon04.c
@@ -84,6 +84,39 @@ static struct tcase {
 	},
 };
 
+/*
+ * Kernels without commit f2fed441c69b ("loop: stop using
+ * vfs_iter_{read,write} for buffered I/O"), merged in v6.15, access the
+ * backing file through vfs_iter_{read,write}(), which run LSM permission
+ * checks with the credentials of the loop worker kernel thread. Strict
+ * SELinux policies, such as Android's, do not allow the kernel to access
+ * the unlabeled files on the freshly formatted test filesystem, so any I/O
+ * on the loop device fails with EIO.
+ *
+ * The commit has been backported to some stable kernels (e.g. v6.12.25),
+ * so on older kernels the loop device has to be probed.
+ */
+static void check_loop_io(void)
+{
+	char buf[512];
+	int fd;
+
+	if (tst_kvercmp(6, 15, 0) >= 0 || !tst_selinux_enforcing())
+		return;
+
+	fd = SAFE_OPEN(loop_dev, O_RDONLY);
+	TEST(read(fd, buf, sizeof(buf)));
+	SAFE_CLOSE(fd);
+
+	if (TST_RET == (long)sizeof(buf))
+		return;
+
+	if (TST_RET == -1 && TST_ERR == EIO)
+		tst_brk(TCONF | TTERRNO, "I/O on %s is likely denied by SELinux", loop_dev);
+
+	tst_brk(TBROK | TTERRNO, "read(%s) returned %ld", loop_dev, TST_RET);
+}
+
 static void setup(void)
 {
 	char discard_path[PATH_MAX];
@@ -114,6 +147,8 @@ static void setup(void)
 		tst_brk(TBROK, "Failed to attach %s to %s", loop_dev, BACKING_FILE);
 	loop_attached = 1;
 
+	check_loop_io();
+
 	snprintf(discard_path, sizeof(discard_path),
 		 "/sys/block/loop%d/queue/discard_max_bytes", loop_dev_id);
 	if (FILE_SCANF(discard_path, "%lu", &discard_max_bytes) != 0 || discard_max_bytes == 0) {
-- 
2.56.0.176.g3575e65682-goog


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] swapon04: Report TCONF when SELinux denies loop device I/O

[linuxtestproject.agent]

Hi Wake,

On 19 October 2026, Wake Liu wrote:
> swapon04: Report TCONF when SELinux denies loop device I/O

Verdict - Reviewed

---
Note:

The agent can sometimes produce false positives although often its
findings are genuine. If you find issues with the review, please
comment this email or ignore the suggestions.

Regards,
LTP AI Reviewer

-- 
Mailing list info: https://lists.linux.it/listinfo/ltp

Re: [LTP] [PATCH v2] swapon04: Report TCONF when SELinux denies loop device I/O

[Avinesh Kumar via ltp]

Hi,

Reviewed-by: Avinesh Kumar <avinesh.kumar@suse.com>

Regards,
Avinesh


-- 
Mailing list info: https://lists.linux.it/listinfo/ltp