[PATCH] xfstests: mount xfs with a context when selinux is on

[PATCH] xfstests: mount xfs with a context when selinux is on

[Eric Sandeen]

When selinux is on, we get tons of new xattrs, which messes
up all kinds of output.

The simplest way out of this, for now, seems to be to just mount
with a global context instead and skip writing the extra xattrs.

I've been using this internally on Fedora and RHEL for a while now.

Signed-off-by: Eric Sandeen <sandeen@sandeen.net>
---

diff --git a/189 b/189
index 8f1c0e1..e91d5cd 100755
--- a/189
+++ b/189
@@ -45,7 +45,8 @@ _cleanup()
 _scratch_filter()
 {
 	sed -e "s#$SCRATCH_DEV#SCRATCH_DEV#" \
-	    -e "s#$SCRATCH_MNT#SCRATCH_MNT#"
+	    -e "s#$SCRATCH_MNT#SCRATCH_MNT#" \
+	    -e "s#,context.*s0\"##"
 }
 
 _check_mount()
diff --git a/common.rc b/common.rc
index c76bcde..ca2cd2c 100644
--- a/common.rc
+++ b/common.rc
@@ -47,8 +47,16 @@ _ls_l()
 
 _mount_opts()
 {
+    # SELinux adds extra xattrs which can mess up our expected output.
+    # So, mount with a context, and they won't be created
+    # nfs_t is a "liberal" context so we can use it.
+    if [ -x /usr/sbin/selinuxenabled ] && /usr/sbin/selinuxenabled; then
+	SELINUX_MOUNT_OPTIONS="-o context=system_u:object_r:nfs_t:s0"
+    fi
+
     case $FSTYP in
     xfs)
+	export SELINUX_MOUNT_OPTIONS
 	export MOUNT_OPTIONS=$XFS_MOUNT_OPTIONS
 	;;
     udf)
@@ -214,7 +222,7 @@ _scratch_mount_options()
 {
     _scratch_options mount
 
-    echo $SCRATCH_OPTIONS $MOUNT_OPTIONS $* $SCRATCH_DEV $SCRATCH_MNT
+    echo $SCRATCH_OPTIONS $MOUNT_OPTIONS $SELINUX_MOUNT_OPTIONS $* $SCRATCH_DEV $SCRATCH_MNT
 }
 
 _scratch_mount()
@@ -236,7 +244,7 @@ _scratch_remount()
 _test_mount()
 {
     _test_options mount
-    _mount -t $FSTYP $TEST_OPTIONS $TEST_FS_MOUNT_OPTS $* $TEST_DEV $TEST_DIR
+    _mount -t $FSTYP $TEST_OPTIONS $TEST_FS_MOUNT_OPTS $SELINUX_MOUNT_OPTIONS $* $TEST_DEV $TEST_DIR
 }
 
 _scratch_mkfs_options()


_______________________________________________
xfs mailing list
xfs@oss.sgi.com
http://oss.sgi.com/mailman/listinfo/xfs

Re: [PATCH] xfstests: mount xfs with a context when selinux is on

[Dave Chinner]

On Wed, Feb 17, 2010 at 01:12:24PM -0600, Eric Sandeen wrote:
> When selinux is on, we get tons of new xattrs, which messes
> up all kinds of output.
> 
> The simplest way out of this, for now, seems to be to just mount
> with a global context instead and skip writing the extra xattrs.
> 
> I've been using this internally on Fedora and RHEL for a while now.
> 
> Signed-off-by: Eric Sandeen <sandeen@sandeen.net>

I know very little about selinux, so while the code changes look OK
I have no idea if the context change is All Goodness.

> --- a/common.rc
> +++ b/common.rc
> @@ -47,8 +47,16 @@ _ls_l()
>  
>  _mount_opts()
>  {
> +    # SELinux adds extra xattrs which can mess up our expected output.
> +    # So, mount with a context, and they won't be created
> +    # nfs_t is a "liberal" context so we can use it.
> +    if [ -x /usr/sbin/selinuxenabled ] && /usr/sbin/selinuxenabled; then
> +	SELINUX_MOUNT_OPTIONS="-o context=system_u:object_r:nfs_t:s0"
> +    fi
> +

i.e. is t_nfs a context specific to a RHEL/Fedora setup, or is it a
generic context that other distro's also define?

Cheers,

Dave.
-- 
Dave Chinner
david@fromorbit.com

_______________________________________________
xfs mailing list
xfs@oss.sgi.com
http://oss.sgi.com/mailman/listinfo/xfs

Re: [PATCH] xfstests: mount xfs with a context when selinux is on

[Eric Sandeen]

Dave Chinner wrote:
> On Wed, Feb 17, 2010 at 01:12:24PM -0600, Eric Sandeen wrote:
>> When selinux is on, we get tons of new xattrs, which messes
>> up all kinds of output.
>>
>> The simplest way out of this, for now, seems to be to just mount
>> with a global context instead and skip writing the extra xattrs.
>>
>> I've been using this internally on Fedora and RHEL for a while now.
>>
>> Signed-off-by: Eric Sandeen <sandeen@sandeen.net>
> 
> I know very little about selinux, so while the code changes look OK
> I have no idea if the context change is All Goodness.
> 
>> --- a/common.rc
>> +++ b/common.rc
>> @@ -47,8 +47,16 @@ _ls_l()
>>  
>>  _mount_opts()
>>  {
>> +    # SELinux adds extra xattrs which can mess up our expected output.
>> +    # So, mount with a context, and they won't be created
>> +    # nfs_t is a "liberal" context so we can use it.
>> +    if [ -x /usr/sbin/selinuxenabled ] && /usr/sbin/selinuxenabled; then
>> +	SELINUX_MOUNT_OPTIONS="-o context=system_u:object_r:nfs_t:s0"
>> +    fi
>> +
> 
> i.e. is t_nfs a context specific to a RHEL/Fedora setup, or is it a
> generic context that other distro's also define?

I'll ask; I think this is what they told me to use last time, but I
didn't ask if it was policy-specific...

-Eric

> Cheers,
> 
> Dave.

_______________________________________________
xfs mailing list
xfs@oss.sgi.com
http://oss.sgi.com/mailman/listinfo/xfs

Re: [PATCH] xfstests: mount xfs with a context when selinux is on

[Eric Sandeen]

Eric Sandeen wrote:
> Dave Chinner wrote:
>> On Wed, Feb 17, 2010 at 01:12:24PM -0600, Eric Sandeen wrote:
>>> When selinux is on, we get tons of new xattrs, which messes
>>> up all kinds of output.
>>>
>>> The simplest way out of this, for now, seems to be to just mount
>>> with a global context instead and skip writing the extra xattrs.
>>>
>>> I've been using this internally on Fedora and RHEL for a while now.
>>>
>>> Signed-off-by: Eric Sandeen <sandeen@sandeen.net>
>> I know very little about selinux, so while the code changes look OK
>> I have no idea if the context change is All Goodness.
>>
>>> --- a/common.rc
>>> +++ b/common.rc
>>> @@ -47,8 +47,16 @@ _ls_l()
>>>  
>>>  _mount_opts()
>>>  {
>>> +    # SELinux adds extra xattrs which can mess up our expected output.
>>> +    # So, mount with a context, and they won't be created
>>> +    # nfs_t is a "liberal" context so we can use it.
>>> +    if [ -x /usr/sbin/selinuxenabled ] && /usr/sbin/selinuxenabled; then
>>> +	SELINUX_MOUNT_OPTIONS="-o context=system_u:object_r:nfs_t:s0"
>>> +    fi
>>> +
>> i.e. is t_nfs a context specific to a RHEL/Fedora setup, or is it a
>> generic context that other distro's also define?
> 
> I'll ask; I think this is what they told me to use last time, but I
> didn't ask if it was policy-specific...

our selinux guys still recommend this context as suitably generic.

-Eric

_______________________________________________
xfs mailing list
xfs@oss.sgi.com
http://oss.sgi.com/mailman/listinfo/xfs

Re: [PATCH] xfstests: mount xfs with a context when selinux is on

[Dave Chinner]

On Thu, Feb 18, 2010 at 04:54:05PM -0600, Eric Sandeen wrote:
> Eric Sandeen wrote:
> > Dave Chinner wrote:
> >> On Wed, Feb 17, 2010 at 01:12:24PM -0600, Eric Sandeen wrote:
> >>> When selinux is on, we get tons of new xattrs, which messes
> >>> up all kinds of output.
> >>>
> >>> The simplest way out of this, for now, seems to be to just mount
> >>> with a global context instead and skip writing the extra xattrs.
> >>>
> >>> I've been using this internally on Fedora and RHEL for a while now.
> >>>
> >>> Signed-off-by: Eric Sandeen <sandeen@sandeen.net>
> >> I know very little about selinux, so while the code changes look OK
> >> I have no idea if the context change is All Goodness.
> >>
> >>> --- a/common.rc
> >>> +++ b/common.rc
> >>> @@ -47,8 +47,16 @@ _ls_l()
> >>>  
> >>>  _mount_opts()
> >>>  {
> >>> +    # SELinux adds extra xattrs which can mess up our expected output.
> >>> +    # So, mount with a context, and they won't be created
> >>> +    # nfs_t is a "liberal" context so we can use it.
> >>> +    if [ -x /usr/sbin/selinuxenabled ] && /usr/sbin/selinuxenabled; then
> >>> +	SELINUX_MOUNT_OPTIONS="-o context=system_u:object_r:nfs_t:s0"
> >>> +    fi
> >>> +
> >> i.e. is t_nfs a context specific to a RHEL/Fedora setup, or is it a
> >> generic context that other distro's also define?
> > 
> > I'll ask; I think this is what they told me to use last time, but I
> > didn't ask if it was policy-specific...
> 
> our selinux guys still recommend this context as suitably generic.

OK. Consider it:

Reviewed-by: Dave Chinner <david@fromorbit.com>

-- 
Dave Chinner
david@fromorbit.com

_______________________________________________
xfs mailing list
xfs@oss.sgi.com
http://oss.sgi.com/mailman/listinfo/xfs