[PATCH v2] common/config: don't hard-code SELinux context

[PATCH v2] common/config: don't hard-code SELinux context

[Eric Biggers]

From: Eric Biggers <ebiggers@google.com>

If SELinux is enabled, by default xfstests mounts its filesystems with
"-o context=system_u:object_r:nfs_t:s0" so that no SELinux xattrs get
created and interfere with tests.  However, this particular context is
not guaranteed to be available because the context names are a detail of
the SELinux policy.  The SELinux policy on Android systems, for example,
does not have a context with this name.

To fix this without having to manually override SELINUX_MOUNT_OPTIONS,
just grab the SELinux context of the root directory.  This is arbitrary,
but it should always provide a valid context.  And if for some reason
someone is actually running xfstests in a specific SELinux context that
needs files labeled with a particular context, then they may still
override SELINUX_MOUNT_OPTIONS.

Signed-off-by: Eric Biggers <ebiggers@google.com>
---
 common/config | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/common/config b/common/config
index 0c7335ad..5bcf114d 100644
--- a/common/config
+++ b/common/config
@@ -260,11 +260,18 @@ case "$HOSTOS" in
 esac
 
 # SELinux adds extra xattrs which can mess up our expected output.
-# So, mount with a context, and they won't be created
-# # nfs_t is a "liberal" context so we can use it.
+# So, mount with a context, and they won't be created.
+#
+# Since the context= option only accepts contexts defined in the SELinux
+# policy, and different systems may have different policies with
+# different context names, use the context of an existing directory.
+# Assume that any valid context is fine, since xfstests should really
+# only be run from an "unconfined" process, or with SELinux in permissive
+# mode.  But if not, just specify your own SELINUX_MOUNT_OPTIONS.
 if [ -x /usr/sbin/selinuxenabled ] && /usr/sbin/selinuxenabled; then
-	: ${SELINUX_MOUNT_OPTIONS:="-o context=system_u:object_r:nfs_t:s0"}
+	: ${SELINUX_MOUNT_OPTIONS:="-o context=$(stat -c %C /)"}
 	export SELINUX_MOUNT_OPTIONS
+
 fi
 
 # check if mkfs.xfs supports v5 xfs
-- 
2.12.0.367.g23dc2f6d3c-goog

Re: [PATCH v2] common/config: don't hard-code SELinux context

[Eryu Guan]

On Tue, Mar 14, 2017 at 10:55:46AM -0700, Eric Biggers wrote:
> From: Eric Biggers <ebiggers@google.com>
> 
> If SELinux is enabled, by default xfstests mounts its filesystems with
> "-o context=system_u:object_r:nfs_t:s0" so that no SELinux xattrs get
> created and interfere with tests.  However, this particular context is
> not guaranteed to be available because the context names are a detail of
> the SELinux policy.  The SELinux policy on Android systems, for example,
> does not have a context with this name.
> 
> To fix this without having to manually override SELINUX_MOUNT_OPTIONS,
> just grab the SELinux context of the root directory.  This is arbitrary,
> but it should always provide a valid context.  And if for some reason
> someone is actually running xfstests in a specific SELinux context that
> needs files labeled with a particular context, then they may still
> override SELINUX_MOUNT_OPTIONS.
> 
> Signed-off-by: Eric Biggers <ebiggers@google.com>
> ---
>  common/config | 13 ++++++++++---
>  1 file changed, 10 insertions(+), 3 deletions(-)
> 
> diff --git a/common/config b/common/config
> index 0c7335ad..5bcf114d 100644
> --- a/common/config
> +++ b/common/config
> @@ -260,11 +260,18 @@ case "$HOSTOS" in
>  esac
>  
>  # SELinux adds extra xattrs which can mess up our expected output.
> -# So, mount with a context, and they won't be created
> -# # nfs_t is a "liberal" context so we can use it.
> +# So, mount with a context, and they won't be created.
> +#
> +# Since the context= option only accepts contexts defined in the SELinux
> +# policy, and different systems may have different policies with
> +# different context names, use the context of an existing directory.
> +# Assume that any valid context is fine, since xfstests should really
> +# only be run from an "unconfined" process, or with SELinux in permissive
> +# mode.  But if not, just specify your own SELINUX_MOUNT_OPTIONS.
>  if [ -x /usr/sbin/selinuxenabled ] && /usr/sbin/selinuxenabled; then
> -	: ${SELINUX_MOUNT_OPTIONS:="-o context=system_u:object_r:nfs_t:s0"}
> +	: ${SELINUX_MOUNT_OPTIONS:="-o context=$(stat -c %C /)"}
>  	export SELINUX_MOUNT_OPTIONS
> +

I removed this extra empty line and committed patch to stage tree.

Thanks,
Eryu

>  fi
>  
>  # check if mkfs.xfs supports v5 xfs
> -- 
> 2.12.0.367.g23dc2f6d3c-goog
> 
> --
> To unsubscribe from this list: send the line "unsubscribe fstests" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html