[PATCH ima-evm-utils] Experimental fsverity.test related GA CI improvements

[Vitaly Chikunov <vt@altlinux.org>]

From: Mimi Zohar <zohar@linux.ibm.com>

This does not make fsverity.test working on GA CI, though.

- `--device /dev/loop-control' is required for losetup(8) to work.
- `--privileged' is required foo mount(8) to work, and this makes
  `--security-opt seccomp=unconfined' redundant.
- GA container does not have `/sys/kernel/security' mounted which is
  needed for `/sys/kernel/security/integrity/ima/policy'.
- Enable `set -x` in CI as the logs is everything we have to analyze on
  failures.

Signed-off-by: Vitaly Chikunov <vt@altlinux.org>
---
 .github/workflows/ci.yml |  2 +-
 build.sh                 | 12 +++++++++++-
 tests/fsverity.test      |  2 +-
 3 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8223b87..d2afdfe 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -98,7 +98,7 @@ jobs:
     container:
       image: ${{ matrix.container }}
       env: ${{ matrix.env }}
-      options: --security-opt seccomp=unconfined
+      options: --privileged --device /dev/loop-control
 
     steps:
     - name: Show OS
diff --git a/build.sh b/build.sh
index cc5a258..4e2f1bb 100755
--- a/build.sh
+++ b/build.sh
@@ -1,6 +1,16 @@
 #!/bin/sh
 # Copyright (c) 2020 Petr Vorel <pvorel@suse.cz>
 
+if [ -n "$CI" ]; then
+	# If we under CI only thing we can analyze is logs so better to enable
+	# verbosity to a maximum.
+	set -x
+	# This is to make stdout and stderr synchronous in the logs.
+	exec 2>&1
+
+	mount -t securityfs -o rw securityfs /sys/kernel/security
+fi
+
 set -e
 
 CC="${CC:-gcc}"
@@ -100,7 +110,7 @@ if [ $ret -eq 0 ]; then
 	tail -20 tests/boot_aggregate.log
 
 	if [ -f tests/fsverity.log ]; then
-		tail -4 tests/fsverity.log
+		[ -n "$CI" ] && cat tests/fsverity.log || tail tests/fsverity.log
 		grep "skipped" tests/fsverity.log  && \
 		   grep "skipped" tests/fsverity.log | wc -l
 	fi
diff --git a/tests/fsverity.test b/tests/fsverity.test
index def06f8..1bb8362 100755
--- a/tests/fsverity.test
+++ b/tests/fsverity.test
@@ -78,7 +78,7 @@ mount_loopback_file() {
 		exit "$FAIL"
 	fi
 
-	mount -o loop ${TST_IMG} $TST_MNT
+	mount -v -o loop ${TST_IMG} $TST_MNT
 	ret=$?
 
 	if [ "${ret}" -eq 0 ]; then
-- 
2.33.4