apfs/apfstests
0
0
Fork 0
mirror of https://github.com/linux-apfs/apfstests.git synced 2026-05-01 15:01:44 -07:00
Code Issues Packages Projects Releases Wiki Activity

common/config: don't hard-code SELinux context

Browse Source 
If SELinux is enabled, by default xfstests mounts its filesystems
with "-o context=system_u:object_r:nfs_t:s0" so that no SELinux
xattrs get created and interfere with tests.  However, this
particular context is not guaranteed to be available because the
context names are a detail of the SELinux policy.  The SELinux
policy on Android systems, for example, does not have a context with
this name.

To fix this without having to manually override
SELINUX_MOUNT_OPTIONS, just grab the SELinux context of the root
directory.  This is arbitrary, but it should always provide a valid
context.  And if for some reason someone is actually running
xfstests in a specific SELinux context that needs files labeled with
a particular context, then they may still override
SELINUX_MOUNT_OPTIONS.

Signed-off-by: Eric Biggers <ebiggers@google.com>
Reviewed-by: Eryu Guan <eguan@redhat.com>
Signed-off-by: Eryu Guan <eguan@redhat.com>
This commit is contained in:
Eric Biggers
2017-03-14 10:55:46 -07:00
committed by Eryu Guan
parent b4d26d4052
commit de88e28a1d
1 changed files with 9 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
common/config
+9 -3
View File
@@ -260,10 +260,16 @@ case "$HOSTOS" in
esac
# SELinux adds extra xattrs which can mess up our expected output.
# So, mount with a context, and they won't be created
# # nfs_t is a "liberal" context so we can use it.
# So, mount with a context, and they won't be created.
#
# Since the context= option only accepts contexts defined in the SELinux
# policy, and different systems may have different policies with
# different context names, use the context of an existing directory.
# Assume that any valid context is fine, since xfstests should really
# only be run from an "unconfined" process, or with SELinux in permissive
# mode. But if not, just specify your own SELINUX_MOUNT_OPTIONS.
if [ -x /usr/sbin/selinuxenabled ] && /usr/sbin/selinuxenabled; then
: ${SELINUX_MOUNT_OPTIONS:="-o context=system_u:object_r:nfs_t:s0"}
: ${SELINUX_MOUNT_OPTIONS:="-o context=$(stat -c %C /)"}
export SELINUX_MOUNT_OPTIONS
fi