Re: [RFC PATCH 0/1] selinux-testsuite: Test all mount option context types

[Stephen Smalley <sds@tycho.nsa.gov>]

On 2/4/20 9:37 AM, Richard Haines wrote:
> Not sure how useful these tests are but using them as a starter for running
> tests on all supported filesystems (that I could find).
> 
> These test all the *context= mount options by reading /sbin/mkfs.* entries.
> I've failed/passed tests based on what I have seen, however some could be
> wrong.

A few preliminary comments:

- The existence of /sbin/mkfs.foo does not guarantee that the kernel 
config enables the foo filesystem,

- I'm not sure that we really want to test all of these filesystem types 
all the time; my earlier comments were more directed at enabling us to 
apply as many of the existing filesystem + fs_filesystem tests as 
possible to whatever filesystem type is in use as the native/host 
filesystem type in which selinux-testsuite lives as is the case for all 
other tests, so that distributions with different defaults will get 
their own defaults tested automatically (e.g. ext4 vs xfs vs btrfs) when 
run on their distribution and labeled NFS will be fully exercised when 
running nfs.sh,

- Only exercising fsconfig(2) without actually mounting won't tell us if 
the context is actually being applied as expected, unlike the existing 
filesystem tests,

- Fail/pass shouldn't be based on what we happen to see when we run the 
test but on what is known to be the actual correct behavior. Offhand, 
the only cases expected to fail if allowed by policy would be use of any 
of the context mount options in a non-init user namespace (except for 
tmpfs/ramfs/devpts) or use of defcontext= with a filesystem type that 
isn't fs_use_xattr in policy or using native labeling (labeled NFS).

> 
> Notes:
> 1) As I use fsconfig(2), the btrfs tests will always fail as there is a
>     bug somewhere in the kernel (being investigated).
> 2) I have had to disable udisks as that interferes with the tests. You can
>     keep it enabled by ./test -e.
>     I think there is really a problem with udisks getting in the way as I
>     rapidly fsopen(fd), fsconfig(2) close(fd) for each test (on my system
>     this equals 48 times).
> 
> Richard Haines (1):
>    selinux-testsuite: Test all mount option context types
> 
>   policy/test_filesystem.te      |  12 +++
>   tests/Makefile                 |   2 +-
>   tests/filesystem/Filesystem.pm |  19 +++-
>   tests/fs_contexts/.gitignore   |   1 +
>   tests/fs_contexts/Makefile     |  13 +++
>   tests/fs_contexts/fsconfig.c   |  72 ++++++++++++++++
>   tests/fs_contexts/test         | 153 +++++++++++++++++++++++++++++++++
>   7 files changed, 268 insertions(+), 4 deletions(-)
>   create mode 100644 tests/fs_contexts/.gitignore
>   create mode 100644 tests/fs_contexts/Makefile
>   create mode 100644 tests/fs_contexts/fsconfig.c
>   create mode 100755 tests/fs_contexts/test