[PATCH v2 1/2] testsuite: provide support for testing labeled NFS

[PATCH v2 1/2] testsuite: provide support for testing labeled NFS

[Stephen Smalley]

Provide instructions in the README.md file, the required kernel config
options in defconfig, and a nfs.sh script for running the testsuite
within a labeled NFS mount.  This depends on the previous change to
enable running over labeled NFS without failures.

This completes the first part of
https://github.com/SELinuxProject/selinux-testsuite/issues/32.

What remains unfinished is adding tests that context mounts are properly
honored, with and without security_label in exports, for NFS, and
default labeling of NFS when neither security_label nor context mounts
are used (i.e. genfscon default of nfs_t).

Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
---
v2 moves nfs.sh under tools/.  As before, these two patches depend
on the previous one ("testsuite:enable running over labeled NFS") in order
to allow the testsuite to pass on NFS mounts.

 README.md    | 41 +++++++++++++++++++++++++++++++++++++++++
 defconfig    | 10 ++++++++++
 tools/nfs.sh | 13 +++++++++++++
 3 files changed, 64 insertions(+)
 create mode 100755 tools/nfs.sh

diff --git a/README.md b/README.md
index 4352796edb2d..e02ae9ac6d6f 100644
--- a/README.md
+++ b/README.md
@@ -118,6 +118,47 @@ the tests:
 	tests/infiniband_pkey/ibpkey_test.conf
 	tests/infiniband_endport/ibendport_test.conf
 
+#### NFS
+
+It is possible to run most of the tests within a labeled NFS mount in
+order to exercise the NFS security labeling functionality.  Certain
+tests have been excluded from such testing due to differences between
+NFS and local filesystems; these tests will be automatically skipped.
+
+You will need to install an additional package, the package below
+is for Fedora/RHEL but other Linux distributions should have a similar
+package:
+
+* nfs-utils _(for `nfsd', `exportfs', and other NFS-related programs)_
+
+On a modern Fedora system you can install this dependency with the
+following command:
+
+	# dnf install nfs-utils
+
+If your distribution does not use systemd as its init system, you will
+need to customize the nfs.sh script found in the tools directory to
+correctly start and stop the nfs server.  You may also choose to not
+start/stop the nfs-server as part of the script by removing those lines
+if you are already using NFS for other reasons.
+
+Before running the tests in a labeled NFS mount, first ensure that you
+can run them successfully on a local filesystem following the standard
+instructions further below.  Any failures that occur on a local
+filesystem should also typically be expected when running over NFS.
+
+To run the tests within a labeled NFS mount, you can run the
+nfs.sh script while in the selinux-testsuite directory:
+
+       # cd selinux-testsuite
+       # ./tools/nfs.sh
+
+The script will start the nfs-server, export the mount containing the
+testsuite directory with the security_label option to localhost, mount
+it via NFSv4.2 on /mnt/selinux-testsuite, switch to that directory,
+and run the testsuite there.  After completion, it will unmount and
+unexport the mount and then stop the nfs-server.
+
 ## Running the Tests
 
 Create a shell with the `unconfined_r` or `sysadm_r` role and the Linux
diff --git a/defconfig b/defconfig
index 7cb6a2ca7f71..8419e40b79dc 100644
--- a/defconfig
+++ b/defconfig
@@ -94,3 +94,13 @@ CONFIG_TRACEPOINTS=y
 CONFIG_BLK_DEV_LOOP=m
 CONFIG_BLK_DEV_LOOP_MIN_COUNT=0
 CONFIG_QFMT_V2=y
+
+# Test labeled NFS.
+# This is not required for SELinux operation itself.
+CONFIG_NFS_FS=m
+CONFIG_NFS_V4=m
+CONFIG_NFS_V4_2=y
+CONFIG_NFS_V4_SECURITY_LABEL=y
+CONFIG_NFSD=m
+CONFIG_NFSD_V4=y
+CONFIG_NFSD_V4_SECURITY_LABEL=y
diff --git a/tools/nfs.sh b/tools/nfs.sh
new file mode 100755
index 000000000000..31c66c377cae
--- /dev/null
+++ b/tools/nfs.sh
@@ -0,0 +1,13 @@
+#!/bin/sh -e
+MOUNT=`stat --print %m .`
+TESTDIR=`pwd`
+systemctl start nfs-server
+exportfs -orw,no_root_squash,security_label localhost:$MOUNT
+mkdir -p /mnt/selinux-testsuite
+mount -t nfs -o vers=4.2 localhost:$TESTDIR /mnt/selinux-testsuite
+pushd /mnt/selinux-testsuite
+make test
+popd
+umount /mnt/selinux-testsuite
+exportfs -u localhost:$MOUNT
+systemctl stop nfs-server
-- 
2.24.1

[PATCH v2 2/2] testsuite: add further nfs tests

[Stephen Smalley]

In addition to testing full NFS security labeling support,
make sure that context mounts continue to work independent
of whether the mount was exported with security_label, and
add a simple test of the default NFS file labeling.

With the previous changes, this completes addressing
https://github.com/SELinuxProject/selinux-testsuite/issues/32

Fixes: https://github.com/SELinuxProject/selinux-testsuite/issues/32
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
---
v2 moves nfs.sh under the tools/ directory and also updates
README.md for the additional tests. As before, these patches
depend on "testsuite: enable running over labeled NFS" to
enable the testsuite to pass on NFS mounts.

 README.md    |  5 ++++-
 tools/nfs.sh | 38 ++++++++++++++++++++++++++++++++++++++
 2 files changed, 42 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index e02ae9ac6d6f..64f80c8fd493 100644
--- a/README.md
+++ b/README.md
@@ -156,7 +156,10 @@ nfs.sh script while in the selinux-testsuite directory:
 The script will start the nfs-server, export the mount containing the
 testsuite directory with the security_label option to localhost, mount
 it via NFSv4.2 on /mnt/selinux-testsuite, switch to that directory,
-and run the testsuite there.  After completion, it will unmount and
+and run the testsuite there.  After running the testsuite, the script
+will also perform tests of context mounts with and without the
+security_label export option and will test default NFS file labeling
+in the absence of any options.  When finished, it will unmount and
 unexport the mount and then stop the nfs-server.
 
 ## Running the Tests
diff --git a/tools/nfs.sh b/tools/nfs.sh
index 31c66c377cae..a82c4069d76d 100755
--- a/tools/nfs.sh
+++ b/tools/nfs.sh
@@ -2,6 +2,8 @@
 MOUNT=`stat --print %m .`
 TESTDIR=`pwd`
 systemctl start nfs-server
+
+# Run the full testsuite on a labeled NFS mount.
 exportfs -orw,no_root_squash,security_label localhost:$MOUNT
 mkdir -p /mnt/selinux-testsuite
 mount -t nfs -o vers=4.2 localhost:$TESTDIR /mnt/selinux-testsuite
@@ -9,5 +11,41 @@ pushd /mnt/selinux-testsuite
 make test
 popd
 umount /mnt/selinux-testsuite
+
+# Test context mounts when exported with security_label.
+mount -t nfs -o vers=4.2,context=system_u:object_r:etc_t:s0 localhost:$TESTDIR /mnt/selinux-testsuite
+echo "Testing context mount of a security_label export."
+fctx=`secon -t -f /mnt/selinux-testsuite/nfs.sh`
+if [ "$fctx" != "etc_t" ]; then
+    echo "Context mount failed: got $fctx instead of etc_t."
+    exit 1
+fi
+umount /mnt/selinux-testsuite
+exportfs -u localhost:$MOUNT
+
+# Test context mounts when not exported with security_label.
+exportfs -orw,no_root_squash localhost:$MOUNT
+mount -t nfs -o vers=4.2,context=system_u:object_r:etc_t:s0 localhost:$TESTDIR /mnt/selinux-testsuite
+echo "Testing context mount of a non-security_label export."
+fctx=`secon -t -f /mnt/selinux-testsuite/nfs.sh`
+if [ "$fctx" != "etc_t" ]; then
+    echo "Context mount failed: got $fctx instead of etc_t."
+    exit 1
+fi
+umount /mnt/selinux-testsuite
+
+# Test non-context mount when not exported with security_label.
+mount -t nfs -o vers=4.2 localhost:$TESTDIR /mnt/selinux-testsuite
+echo "Testing non-context mount of a non-security_label export."
+fctx=`secon -t -f /mnt/selinux-testsuite/nfs.sh`
+if [ "$fctx" != "nfs_t" ]; then
+    echo "Context mount failed: got $fctx instead of nfs_t."
+    exit 1
+fi
+umount /mnt/selinux-testsuite
+
+# All done.
+echo "Done"
 exportfs -u localhost:$MOUNT
+rmdir /mnt/selinux-testsuite
 systemctl stop nfs-server
-- 
2.24.1

Re: [PATCH v2 2/2] testsuite: add further nfs tests

[Stephen Smalley]

On 1/30/20 3:11 PM, Stephen Smalley wrote:
> In addition to testing full NFS security labeling support,
> make sure that context mounts continue to work independent
> of whether the mount was exported with security_label, and
> add a simple test of the default NFS file labeling.
> 
> With the previous changes, this completes addressing
> https://github.com/SELinuxProject/selinux-testsuite/issues/32
> 
> Fixes: https://github.com/SELinuxProject/selinux-testsuite/issues/32
> Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
> ---
> v2 moves nfs.sh under the tools/ directory and also updates
> README.md for the additional tests. As before, these patches
> depend on "testsuite: enable running over labeled NFS" to
> enable the testsuite to pass on NFS mounts.
> 
>   README.md    |  5 ++++-
>   tools/nfs.sh | 38 ++++++++++++++++++++++++++++++++++++++
>   2 files changed, 42 insertions(+), 1 deletion(-)
> 
> diff --git a/README.md b/README.md
> index e02ae9ac6d6f..64f80c8fd493 100644
> --- a/README.md
> +++ b/README.md
> @@ -156,7 +156,10 @@ nfs.sh script while in the selinux-testsuite directory:
>   The script will start the nfs-server, export the mount containing the
>   testsuite directory with the security_label option to localhost, mount
>   it via NFSv4.2 on /mnt/selinux-testsuite, switch to that directory,
> -and run the testsuite there.  After completion, it will unmount and
> +and run the testsuite there.  After running the testsuite, the script
> +will also perform tests of context mounts with and without the
> +security_label export option and will test default NFS file labeling
> +in the absence of any options.  When finished, it will unmount and
>   unexport the mount and then stop the nfs-server.
>   
>   ## Running the Tests
> diff --git a/tools/nfs.sh b/tools/nfs.sh
> index 31c66c377cae..a82c4069d76d 100755
> --- a/tools/nfs.sh
> +++ b/tools/nfs.sh
> @@ -2,6 +2,8 @@
>   MOUNT=`stat --print %m .`
>   TESTDIR=`pwd`
>   systemctl start nfs-server
> +
> +# Run the full testsuite on a labeled NFS mount.
>   exportfs -orw,no_root_squash,security_label localhost:$MOUNT
>   mkdir -p /mnt/selinux-testsuite
>   mount -t nfs -o vers=4.2 localhost:$TESTDIR /mnt/selinux-testsuite
> @@ -9,5 +11,41 @@ pushd /mnt/selinux-testsuite
>   make test
>   popd
>   umount /mnt/selinux-testsuite
> +
> +# Test context mounts when exported with security_label.
> +mount -t nfs -o vers=4.2,context=system_u:object_r:etc_t:s0 localhost:$TESTDIR /mnt/selinux-testsuite
> +echo "Testing context mount of a security_label export."
> +fctx=`secon -t -f /mnt/selinux-testsuite/nfs.sh`

Oops.  Will fix.

> +if [ "$fctx" != "etc_t" ]; then
> +    echo "Context mount failed: got $fctx instead of etc_t."
> +    exit 1
> +fi
> +umount /mnt/selinux-testsuite
> +exportfs -u localhost:$MOUNT
> +
> +# Test context mounts when not exported with security_label.
> +exportfs -orw,no_root_squash localhost:$MOUNT
> +mount -t nfs -o vers=4.2,context=system_u:object_r:etc_t:s0 localhost:$TESTDIR /mnt/selinux-testsuite
> +echo "Testing context mount of a non-security_label export."
> +fctx=`secon -t -f /mnt/selinux-testsuite/nfs.sh`
> +if [ "$fctx" != "etc_t" ]; then
> +    echo "Context mount failed: got $fctx instead of etc_t."
> +    exit 1
> +fi
> +umount /mnt/selinux-testsuite
> +
> +# Test non-context mount when not exported with security_label.
> +mount -t nfs -o vers=4.2 localhost:$TESTDIR /mnt/selinux-testsuite
> +echo "Testing non-context mount of a non-security_label export."
> +fctx=`secon -t -f /mnt/selinux-testsuite/nfs.sh`
> +if [ "$fctx" != "nfs_t" ]; then
> +    echo "Context mount failed: got $fctx instead of nfs_t."
> +    exit 1
> +fi
> +umount /mnt/selinux-testsuite
> +
> +# All done.
> +echo "Done"
>   exportfs -u localhost:$MOUNT
> +rmdir /mnt/selinux-testsuite
>   systemctl stop nfs-server
>