public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
* [tests/selinux] pr775-checkpolicy-revdeps: kernel: add test for CephFS labeling
@ 2026-09-11 13:17 Ondrej Mosnacek
0 siblings, 0 replies; only message in thread
From: Ondrej Mosnacek @ 2026-09-11 13:17 UTC (permalink / raw)
To: git-commits
A new commit has been pushed.
Repo : tests/selinux
Branch : pr775-checkpolicy-revdeps
Commit : 2d4ef6a0da0f4bbf2f320969a0d4f6e55dd47245
Author : Ondrej Mosnacek <omosnace@redhat.com>
Date : 2020-04-21T11:38:54+02:00
Stats : +193/-0 in 3 file(s)
URL : https://src.fedoraproject.org/tests/selinux/c/2d4ef6a0da0f4bbf2f320969a0d4f6e55dd47245?branch=pr775-checkpolicy-revdeps
Log:
kernel: add test for CephFS labeling
The test verifies expected behavior of CephFS security label support
across distros.
Note that for the test to work RHEL, an appropriate Ceph repo must be
installed. A scriptlet that sets this up can be provided via the
INSTALL_SCRIPTLET parameter.
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
---
diff --git a/kernel/labeled-cephfs/Makefile b/kernel/labeled-cephfs/Makefile
new file mode 100644
index 0000000..18f828d
--- /dev/null
+++ b/kernel/labeled-cephfs/Makefile
@@ -0,0 +1,27 @@
+export TEST=/kernel/Regression/selinux-cephfs-labeling
+export TESTVERSION=0.1
+
+FILES=$(METADATA) runtest.sh Makefile
+
+.PHONY: all clean
+
+run: $(FILES)
+ ./runtest.sh
+
+clean:
+
+include /usr/share/rhts/lib/rhts-make.include
+
+$(METADATA): Makefile
+ @echo "Owner: Ondrej Mosnacek <omosnace@redhat.com>" > $(METADATA)
+ @echo "Name: $(TEST)" >> $(METADATA)
+ @echo "TestVersion: $(TESTVERSION)" >> $(METADATA)
+ @echo "Path: $(TEST_DIR)" >> $(METADATA)
+ @echo "Description: Test for correct CephFS SELinux labeling" >> $(METADATA)
+ @echo "Type: Regression" >> $(METADATA)
+ @echo "TestTime: 30m" >> $(METADATA)
+ @echo "Requires: openssh-server openssh-clients python3-pip ceph attr" >> $(METADATA)
+ @echo "Priority: Normal" >> $(METADATA)
+ @echo "License: GPLv2+" >> $(METADATA)
+ @echo "Confidential: no" >> $(METADATA)
+ @echo "Destructive: no" >> $(METADATA)
diff --git a/kernel/labeled-cephfs/main.fmf b/kernel/labeled-cephfs/main.fmf
new file mode 100644
index 0000000..28f1b7a
--- /dev/null
+++ b/kernel/labeled-cephfs/main.fmf
@@ -0,0 +1,9 @@
+path: /kernel/labeled-cephfs
+
+summary: Test for correct CephFS SELinux labeling
+description: |
+ This TC verifies that CephFS security label support works as expected.
+duration: 30m
+relevancy:
+ - "distro < rhel-8: False"
+tier: 2
diff --git a/kernel/labeled-cephfs/runtest.sh b/kernel/labeled-cephfs/runtest.sh
new file mode 100755
index 0000000..83c92f9
--- /dev/null
+++ b/kernel/labeled-cephfs/runtest.sh
@@ -0,0 +1,157 @@
+#!/bin/bash
+# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+
+# Include Beakerlib environment
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+# Optional path to a script that will be sourced in the Install phase.
+# Can be used to set up Ceph repos on RHEL-8.
+INSTALL_SCRIPTLET="${INSTALL_SCRIPTLET:-/dev/null}"
+
+function check_config() {
+ [ -f "/lib/modules/$(uname -r)/config" ] && \
+ grep -q "^CONFIG_CEPH_FS_SECURITY_LABEL=y\$" "/lib/modules/$(uname -r)/config"
+}
+
+function get_file_con() {
+ getfattr --absolute-names --only-values -n security.selinux "$1" | tr -d '\000'
+}
+
+function strip_mls() {
+ # strip the MLS -- mcstrans might be running, leading to different MLS
+ # fields than expected
+ sed 's/\([^:]*:[^:]*:[^:]*\):.*$/\1/g'
+}
+
+function check_file_con() {
+ rlAssertEquals "Check expected context of $1" \
+ "$(get_file_con "$1" | strip_mls)" \
+ "$(echo "$2" | strip_mls)"
+}
+
+function rlIsEL() {
+ rlIsRHEL "$@" || rlIsCentOS "$@"
+}
+
+rlJournalStart
+ source "$INSTALL_SCRIPTLET"
+
+ rlPhaseStartSetup
+ HOSTNAME="$(hostname)"
+
+ rlRun "pip3 install --user ceph-deploy"
+ rlRun "export PATH=\"\$HOME/.local/bin:\$PATH\""
+ if rlIsFedora '>=32'; then
+ # work around Python 3.8 deprecated functions until this is resolved:
+ # https://tracker.ceph.com/issues/44849
+ rlRun "sed -i '/linux_distribution = /d;s/linux_distribution()/(\"Fedora\", \"32\", \"Thirty Two\")/' \"\$HOME\"/.local/lib/*/site-packages/ceph_deploy/hosts/remotes.py"
+ fi
+
+ if ! [ -f "$HOME/.ssh/id_rsa.pub" ]; then
+ rlRun "rm -f \"\$HOME/.ssh/id_rsa\""
+ rlRun "cat /dev/zero | ssh-keygen -q -N '' >/dev/null"
+ fi
+ rlRun "cat \"\$HOME/.ssh/id_rsa.pub\" >> \"\$HOME/.ssh/authorized_keys\""
+ rlRun "ssh -o 'StrictHostKeyChecking no' \$USER@$HOSTNAME true"
+
+ rlRun "tmpdir=\"\$(mktemp -d)\""
+ rlRun "pushd \"\$tmpdir\""
+ rlRun "ceph-deploy new $HOSTNAME"
+ rlRun "echo 'osd crush chooseleaf type = 0' >> ceph.conf"
+ rlRun "echo 'osd pool default size = 1' >> ceph.conf"
+ rlRun "echo 'mon allow pool delete = true' >> ceph.conf"
+
+ rlRun "ceph-deploy --overwrite-conf mon create $HOSTNAME"
+ rlRun "ceph-deploy gatherkeys $HOSTNAME"
+ rlRun "ceph-deploy mgr create $HOSTNAME"
+ rlRun "ceph-deploy mds create $HOSTNAME"
+ rlRun "cp ceph.client.admin.keyring /etc/ceph/"
+
+ rlRun "UUID=\$(uuidgen)"
+ rlRun "OSD_SECRET=\$(ceph-authtool --gen-print-key)"
+ rlRun "cp ceph.bootstrap-osd.keyring /var/lib/ceph/bootstrap-osd/ceph.keyring"
+ rlRun "ID=\$(echo \"{\\\"cephx_secret\\\": \\\"\$OSD_SECRET\\\"}\" | ceph osd new \$UUID -i - -n client.bootstrap-osd -k /var/lib/ceph/bootstrap-osd/ceph.keyring)"
+ rlRun "mkdir /var/lib/ceph/osd/ceph-\$ID"
+ rlRun "ceph-authtool --create-keyring /var/lib/ceph/osd/ceph-\$ID/keyring --name osd.\$ID --add-key \$OSD_SECRET"
+ rlRun "ceph-osd -i \$ID --mkfs --osd-uuid \$UUID"
+ rlRun "chown -R ceph:ceph /var/lib/ceph/osd/ceph-\$ID"
+ rlRun "systemctl enable ceph-osd@\$ID"
+ rlRun "systemctl start ceph-osd@\$ID"
+
+ rlRun "ceph osd pool create cephfs_data 64"
+ rlRun "ceph osd pool create cephfs_metadata 64"
+
+ rlRun "ceph fs new cephfs cephfs_metadata cephfs_data"
+
+ rlLog "Waiting for pools to become active..."
+ for (( i = 0; i < 30; i++ )); do
+ ceph mds stat | grep -q '=up:active' && break
+ sleep 0.5s
+ done
+ rlRun "ceph mds stat | grep '=up:active'"
+ rlRun "ceph fs ls"
+ rlRun "ceph -s"
+
+ rlRun "SECRET=\"\$(ceph auth print-key client.admin)\""
+ rlRun "mkdir -p /mnt/myceph"
+ rlRun "mount -t ceph $HOSTNAME:6789:/ /mnt/myceph -o name=admin,secret=\$SECRET"
+ rlPhaseEnd
+
+ rlPhaseStartTest
+ SEUSER="$(id -Z | cut -d ':' -f 1)"
+
+ if rlIsFedora '>=32'; then
+ # F32 and above - full xattr handling
+ # See: https://github.com/fedora-selinux/selinux-policy/pull/289
+ rlRun "check_config" 0 "Check if kernel support is present"
+ check_file_con "/mnt/myceph" "system_u:object_r:unlabeled_t:s0"
+ rlRun "mkdir /mnt/myceph/test"
+ check_file_con "/mnt/myceph/test" "$SEUSER:object_r:unlabeled_t:s0"
+ rlRun "chcon system_u:object_r:usr_t:s0 /mnt/myceph/test"
+ check_file_con "/mnt/myceph/test" "system_u:object_r:usr_t:s0"
+ rlRun "touch /mnt/myceph/test/file"
+ check_file_con "/mnt/myceph/test/file" "$SEUSER:object_r:usr_t:s0"
+ elif rlIsEL '>=8.3'; then
+ # RHEL-8 - genfscon + xattr handling
+ # See: https://bugzilla.redhat.com/show_bug.cgi?id=1823764
+ # and: https://bugzilla.redhat.com/show_bug.cgi?id=1814689
+ rlRun "check_config" 0 "Check if kernel support is present"
+ check_file_con "/mnt/myceph" "system_u:object_r:cephfs_t:s0"
+ rlRun "mkdir /mnt/myceph/test"
+ check_file_con "/mnt/myceph/test" "$SEUSER:object_r:cephfs_t:s0"
+ rlRun "chcon system_u:object_r:usr_t:s0 /mnt/myceph/test"
+ check_file_con "/mnt/myceph/test" "system_u:object_r:usr_t:s0"
+ rlRun "touch /mnt/myceph/test/file"
+ check_file_con "/mnt/myceph/test/file" "$SEUSER:object_r:usr_t:s0"
+ else
+ # F31 and below - just genfscon
+ check_file_con "/mnt/myceph" "system_u:object_r:cephfs_t:s0"
+ rlRun "mkdir /mnt/myceph/test"
+ check_file_con "/mnt/myceph/test" "system_u:object_r:cephfs_t:s0"
+ rlRun "chcon system_u:object_r:usr_t:s0 /mnt/myceph/test" 1
+ check_file_con "/mnt/myceph/test" "system_u:object_r:cephfs_t:s0"
+ rlRun "touch /mnt/myceph/test/file"
+ check_file_con "/mnt/myceph/test/file" "system_u:object_r:cephfs_t:s0"
+ fi
+ rlPhaseEnd
+
+ rlPhaseStartCleanup
+ rlRun "umount /mnt/myceph" 0-255
+ rlRun "rm -rf /mnt/myceph"
+
+ rlRun "systemctl stop ceph-mds@*"
+ rlRun "ceph fs rm cephfs --yes-i-really-mean-it"
+ rlRun "ceph osd pool delete cephfs_data cephfs_data --yes-i-really-really-mean-it"
+ rlRun "ceph osd pool delete cephfs_metadata cephfs_metadata --yes-i-really-really-mean-it"
+ rlRun "ceph osd down \$ID"
+ rlRun "ceph osd rm \$ID"
+ rlRun "ceph auth del osd.\$ID"
+ rlRun "systemctl stop ceph-osd@*"
+ rlRun "systemctl stop ceph-mon@*"
+ rlRun "systemctl stop ceph-mgr@*"
+ rlRun "rm -rf /var/lib/ceph/osd/ceph-$ID"
+
+ rlRun "rm -rf \"\$tmpdir\""
+ rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2026-09-11 13:17 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-09-11 13:17 [tests/selinux] pr775-checkpolicy-revdeps: kernel: add test for CephFS labeling Ondrej Mosnacek
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox