From: Richard Haines <richard_c_haines@btinternet.com>
To: Stephen Smalley <sds@tycho.nsa.gov>, selinux@vger.kernel.org
Subject: Re: [PATCH V3 1/1] selinux-testsuite: Add filesystem tests
Date: Tue, 14 Jan 2020 12:08:38 +0000 [thread overview]
Message-ID: <d3f5277099d63f1c68269444a29beadaf248b34a.camel@btinternet.com> (raw)
In-Reply-To: <d68f2230-38da-ef6a-fa67-5631fb88f9a0@tycho.nsa.gov>
On Mon, 2020-01-13 at 14:01 -0500, Stephen Smalley wrote:
> On 1/13/20 1:32 PM, Richard Haines wrote:
> > On Mon, 2020-01-13 at 10:45 -0500, Stephen Smalley wrote:
> > > On 1/12/20 2:24 PM, Richard Haines wrote:
> > > > Test filesystem permissions, setfscreatecon(3), file { quotaon
> > > > }
> > > > and
> > > > changing file context via 'name type_transition rule'.
> > > >
> > > > From kernels 5.5 filesystem { watch } is also tested.
> > > >
> > > > Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
> > >
> > > Aside from the travis-ci build failure when trying to build the
> > > test
> > > policy against upstream refpolicy, this looks good to me. NB you
> > > can
> > > reproduce such failures yourself by creating your own github
> > > clone
> > > of
> > > selinux-testsuite, enabling travis-ci on your clone, and pushing
> > > your
> > > change to a branch of our clone.
> > >
> > > Possible room for improvement (but I won't insist) might include:
> > > - test non-name based type transition rule with a different type
> > > and
> > > confirm that both files are createdi in the right type (i.e. make
> > > sure
> > > we are actually matching on the component name),
> > > - test two different name-based type transition rules that only
> > > differ
> > > in name (similar),
> > > - add tests for the new mount API, fsopen(), fspick(), fsmount().
> > >
> > > These could all be done as separate patches later.
> >
> > If you are in no hurry for these tests I'll do them for V4.
> >
> > I found a helpful example in samples/vfs/test-fsmount.c for fsmount
> > and
> > fsopen. Also see they were added in 5.1
>
> Up to you; they can always be done as a separate follow-up patch
> later.
> The new syscalls don't appear to have been wired up until v5.2.
After some thought and play time I've come to the following:
1) I'll submit V4 with the non & named-based trans rules + other
changes today.
2) As tests/filesystem is testing mount(2) / umount(2) I thought it
best to submit a separate patch for the new fs* apis and put them in
tests/fs_filesystem for 5.2
next prev parent reply other threads:[~2020-01-14 12:08 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-01-12 19:24 [PATCH V3 0/1] selinux-testsuite: Add filesystem tests Richard Haines
2020-01-12 19:24 ` [PATCH V3 1/1] " Richard Haines
2020-01-13 15:45 ` Stephen Smalley
2020-01-13 18:32 ` Richard Haines
2020-01-13 19:01 ` Stephen Smalley
2020-01-14 12:08 ` Richard Haines [this message]
2020-01-13 16:57 ` [PATCH V3 0/1] " Stephen Smalley
2020-01-13 18:34 ` Richard Haines
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=d3f5277099d63f1c68269444a29beadaf248b34a.camel@btinternet.com \
--to=richard_c_haines@btinternet.com \
--cc=sds@tycho.nsa.gov \
--cc=selinux@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.