[tests/selinux] pr775-checkpolicy-revdeps: Add test for ocontext race condition in the kernel

[tests/selinux] pr775-checkpolicy-revdeps: Add test for ocontext race condition in the kernel

[Ondrej Mosnacek]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 5672c531ab4036c351b4e7ed7abee4cd54f9a13e
            Author : Ondrej Mosnacek <omosnace@redhat.com>
            Date   : 2022-01-14T15:20:04+01:00
            Stats  : +102/-0 in 3 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/5672c531ab4036c351b4e7ed7abee4cd54f9a13e?branch=pr775-checkpolicy-revdeps

            Log:
            Add test for ocontext race condition in the kernel

Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>

---
diff --git a/kernel/ocontext-race/Makefile b/kernel/ocontext-race/Makefile
new file mode 100644
index 0000000..966ae43
--- /dev/null
+++ b/kernel/ocontext-race/Makefile
@@ -0,0 +1,6 @@
+# Minimal Makefile for standard-test-roles-beakerlib
+
+R="RhtsRequires: attr"
+run:
+	chmod +x runtest.sh
+	./runtest.sh

diff --git a/kernel/ocontext-race/main.fmf b/kernel/ocontext-race/main.fmf
new file mode 100644
index 0000000..657b38c
--- /dev/null
+++ b/kernel/ocontext-race/main.fmf
@@ -0,0 +1,22 @@
+summary: Regression test for ocontext kernel structure race condition
+description: |
+    Test that a race condition around the kernel's ocontext structures
+    doesn't cause an incorrect label to be assigned to files/mounts.
+contact: Ondrej Mosnacek <omosnace@redhat.com>
+component:
+- kernel
+framework: beakerlib
+require:
+- attr
+duration: 15m
+tier: 2
+enabled: true
+adjust:
+    enabled: false
+    when: distro < rhel-7
+    because: RHEL-6 and below are not worth supporting by this test
+extra-hardware: |
+    keyvalue = PROCESSORS >= 4
+link:
+- verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1969344
+- verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2040196

diff --git a/kernel/ocontext-race/runtest.sh b/kernel/ocontext-race/runtest.sh
new file mode 100755
index 0000000..b7f49ca
--- /dev/null
+++ b/kernel/ocontext-race/runtest.sh
@@ -0,0 +1,74 @@
+#!/bin/bash
+# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# SPDX-License-Identifier: GPLv2
+# Copyright (c) 2022 Red Hat, Inc.
+# Author: Ondrej Mosnacek <omosnace@redhat.com>
+
+# Include Beakerlib environment
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PREFIX=/tmp/repro-
+NTHREADS=8
+TRIALS=20
+
+function get_file_con() {
+    getfattr -h --absolute-names --only-values -n security.selinux "$1" | tr -d '\000'
+}
+
+function strip_mls() {
+    # strip the MLS -- mcstrans might be running, leading to different MLS
+    # fields than expected
+    sed 's/\([^:]*:[^:]*:[^:]*\):.*$/\1/g'
+}
+
+function check_file_con() {
+    rlAssertEquals "Check expected context of $1" \
+        "$(get_file_con "$1" | strip_mls)" \
+        "$(echo "$2" | strip_mls)"
+}
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlRun "uname -r"
+
+        rlRun "test \$(nproc) -ge 4" 0 "Test needs an SMP machine, otherwise it may pass regardless of the bug"
+
+        rlRun "tmpdir=\$(mktemp -d)" 0 "Create a temporary directory"
+
+        prefix="$tmpdir/repro-"
+
+        for (( i = 0; i < $NTHREADS; i++ )); do
+            rlRun "mkdir -p \"\${PREFIX}$i\"" 0 "Create subdirectory #$i"
+        done
+    rlPhaseEnd
+
+for (( k = 0; k < $TRIALS; k++ )); do
+    rlPhaseStartTest "Trial #$k"
+        rlRun "load_policy" 0 "Reload SELinux policy to reset internal state"
+
+        # NOTE: this must be ran in a single rlRun, otherwise beakerlib
+        # overhead decreases the chance of a race condition 
+        rlRun "
+            for (( i = 0; i < $NTHREADS; i++)); do
+                mount -t tmpfs tmpfs \"\${PREFIX}\$i\" &
+            done
+            wait
+        " 0 "Create $NTHREADS tmpfs mounts at once"
+
+        for (( i = 0; i < $NTHREADS; i++)); do
+            rlRun "touch \"\${PREFIX}$i/file\"" 0 "Create a file in dir #$i"
+            check_file_con "$PREFIX$i" "unconfined_u:object_r:user_tmp_t"
+            check_file_con "$PREFIX$i/file" "unconfined_u:object_r:user_tmp_t"
+        done
+
+        for (( i = 0; i < $NTHREADS; i++)); do
+            rlRun "umount \"\${PREFIX}$i\" &" 0 "Unmount dir #$i"
+        done
+    rlPhaseEnd
+done
+
+    rlPhaseStartCleanup
+        rlRun "rm -rf \$tmpdir" 0 "Clean up the temporary directory"
+    rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd