[tests/selinux] pr775-checkpolicy-revdeps: kernel/synflood: refactor main test condition

[tests/selinux] pr775-checkpolicy-revdeps: kernel/synflood: refactor main test condition

[Ondrej Mosnacek]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : e38ed68c9f73c40a79b1b007e055b006ccb108a7
            Author : Ondrej Mosnacek <omosnace@redhat.com>
            Date   : 2021-01-19T14:04:27+01:00
            Stats  : +24/-8 in 1 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/e38ed68c9f73c40a79b1b007e055b006ccb108a7?branch=pr775-checkpolicy-revdeps

            Log:
            kernel/synflood: refactor main test condition

It turns out there is too much variability in the percent values across
arches/machines, so give up on the general approach (checking that all
SELinux functions are below some hard limit) and instead focus only on
selinux_peerlbl_enabled() and compare its position with other functions.

In case selinux_peerlbl_enabled() is not found in /proc/kallsyms, it is
inlined into other functions, so we need to check selinux_ip_postroute()
instead of selinux_peerlbl_enabled().

Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>

---
diff --git a/kernel/synflood/runtest.sh b/kernel/synflood/runtest.sh
index e01b1a4..c8535c2 100755
--- a/kernel/synflood/runtest.sh
+++ b/kernel/synflood/runtest.sh
@@ -12,7 +12,12 @@ TEST_PORT=8080
 FG_URL="https://github.com/brendangregg/FlameGraph"
 FG_DIR="FlameGraph"
 
-LIMIT="1%"
+function isBefore() {
+    local target="$1"
+    local reference="$2"
+
+    grep -E "$target|$reference" | head -n 1 | grep -q "$target"
+}
 
 rlJournalStart
 if [ $(nproc) -lt 8 ]; then
@@ -42,19 +47,30 @@ else
         rlRun "perf record -o perf.data -ag -- sleep 10s" 0 \
             "Capture perf data for 10s"
         rlRun "kill \$(jobs -p)" 0 "Kill background processes"
-        rlRun "perf report -i perf.data -g none --pretty raw -F overhead,symbol | grep -E '\\[k\\] (selinux|security)_'"
-        top_percent="$(perf report -i perf.data -g none --pretty raw -F overhead,symbol | \
-            grep -E '\[k\] (selinux|security)_' | head -n 1 | awk '{ print $1 }')"
-        rlRun "[ \"\$({ echo \$top_percent; echo $LIMIT; } | sort -n | tail -n 1)\" = $LIMIT ]" 0 \
-            "Check that no SELinux function takes up more than $LIMIT of CPU time"
+        rlRun "perf report -i perf.data -g none --pretty raw -F overhead,symbol | \
+            grep -E '\\[k\\] (selinux|security)_' | tee perf-report.txt"
+
+        if grep -q selinux_peerlbl_enabled /proc/kallsyms; then
+            rlLog "selinux_peerlbl_enabled() found in /proc/kallsyms"
+            target_func=selinux_peerlbl_enabled
+        else
+            rlLog "selinux_peerlbl_enabled() NOT found in /proc/kallsyms (ergo it's inlined)"
+            # if selinux_peerlbl_enabled() is inlined, then the extra overhead
+            # shows up in selinux_ip_postroute() and selinux_socket_sock_rcv_skb()
+            target_func=selinux_ip_postroute
+        fi
+        rlRun "cat perf-report.txt | isBefore security_netlbl_sid_to_secattr $target_func" 0 \
+            "Check that $target_func() has lower impact than security_netlbl_sid_to_secattr()"
     rlPhaseEnd
 
     rlPhaseStartCleanup
         rlRun "perf script -i perf.data | $FG_DIR/stackcollapse-perf.pl | $FG_DIR/flamegraph.pl > flamegraph.svg"
         rlRun "xz -T0 perf.data"
 
-        rlFileSubmit "perf.data.xz"
-        rlFileSubmit "flamegraph.svg"
+        for file in "perf.data.xz" "flamegraph.svg" "perf-report.txt"; do
+            rlFileSubmit "$file"
+            rlRun "rm -f $file"
+        done
     rlPhaseEnd
 fi
 rlJournalPrintText