[tests/selinux] pr775-checkpolicy-revdeps: Add test for genfscon fallback support

[tests/selinux] pr775-checkpolicy-revdeps: Add test for genfscon fallback support

[Ondrej Mosnacek]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 6548af6fcf9d0d6bc0a53190f078914fd1fa5513
            Author : Ondrej Mosnacek <omosnace@redhat.com>
            Date   : 2021-03-26T14:30:48+01:00
            Stats  : +67/-0 in 3 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/6548af6fcf9d0d6bc0a53190f078914fd1fa5513?branch=pr775-checkpolicy-revdeps

            Log:
            Add test for genfscon fallback support

This feature is required for proper support of virtiofs with SELinux.
Add a trivial test that verifies that this feature works via a dummy
SELinux module and ramfs mount.

Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>

---
diff --git a/kernel/genfs_fallback/Makefile b/kernel/genfs_fallback/Makefile
new file mode 100644
index 0000000..7abf97c
--- /dev/null
+++ b/kernel/genfs_fallback/Makefile
@@ -0,0 +1,7 @@
+# Minimal Makefile for standard-test-roles-beakerlib
+
+R="RhtsRequires: policycoreutils"
+
+run:
+	chmod +x runtest.sh
+	./runtest.sh

diff --git a/kernel/genfs_fallback/main.fmf b/kernel/genfs_fallback/main.fmf
new file mode 100644
index 0000000..4006f0b
--- /dev/null
+++ b/kernel/genfs_fallback/main.fmf
@@ -0,0 +1,29 @@
+summary: Test genfscon fallback for fs_use_xattr when no xattr support
+description: |
+    Test that a fs_use_xattr filesystem mount falls back to genfscon when it
+    doesn't have xattr support.
+
+    See also:
+    https://lore.kernel.org/selinux/CAFqZXNsGabHBfV36nNAVLJgEzjkBev-O3YZ1vnmXyVoaDdjiHQ@mail.gmail.com/T/
+    https://lore.kernel.org/selinux/20210113123802.63563-1-omosnace@redhat.com/
+contact: Ondrej Mosnacek <omosnace@redhat.com>
+component:
+- kernel
+framework: beakerlib
+require:
+- policycoreutils
+duration: 5m
+tier: 2
+enabled: true
+adjust:
+    enabled: false
+    when: distro < rhel-8.5
+    because: RHEL-8.5 and below are not expected to support this
+adjust:
+    enabled: false
+    when: distro < fedora-35
+    because: This feature may not be supported on kernels in F34 and below
+link:
+- verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1899703
+- verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1915825
+- verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1937297

diff --git a/kernel/genfs_fallback/runtest.sh b/kernel/genfs_fallback/runtest.sh
new file mode 100755
index 0000000..63d8e1e
--- /dev/null
+++ b/kernel/genfs_fallback/runtest.sh
@@ -0,0 +1,31 @@
+#!/bin/bash
+# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# SPDX-License-Identifier: GPLv2
+# Copyright (c) 2021 Red Hat, Inc.
+# Author: Ondrej Mosnacek <omosnace@redhat.com>
+
+# Include Beakerlib environment
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlRun "uname -r"
+
+        rlRun "echo '(fsuse xattr ramfs (system_u object_r fs_t ((s0) (s0))))' >ramfs_xattr.cil"
+        rlRun "semodule -i ramfs_xattr.cil"
+        rlRun "mkdir /mnt/test-ramfs"
+    rlPhaseEnd
+
+    rlPhaseStartTest
+        rlRun "mount -t ramfs none /mnt/test-ramfs"
+        rlRun "[ \"\$(secon -t -f /mnt/test-ramfs)\" = ramfs_t ]"
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        rlRun "umount /mnt/test-ramfs" 0-1
+        rlRun "rmdir /mnt/test-ramfs"
+        rlRun "semodule -r ramfs_xattr"
+        rlRun "rm -f ramfs_xattr.cil"
+    rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd