mirror of
https://github.com/libguestfs/libguestfs.git
synced 2026-03-22 07:03:38 +00:00
89b5dabf8d
test-relabel.pl performs a full SELinux relabelling of the phony guest, and the selinux_relabel API does not work if the "selinuxrelabel" feature is not available.
142 lines
4.1 KiB
Perl
Executable File
142 lines
4.1 KiB
Perl
Executable File
#!/usr/bin/env perl
|
|
# Copyright (C) 2016 Red Hat Inc.
|
|
#
|
|
# This program is free software; you can redistribute it and/or modify
|
|
# it under the terms of the GNU General Public License as published by
|
|
# the Free Software Foundation; either version 2 of the License, or
|
|
# (at your option) any later version.
|
|
#
|
|
# This program is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU General Public License
|
|
# along with this program; if not, write to the Free Software
|
|
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
|
|
|
use strict;
|
|
use warnings;
|
|
|
|
use Sys::Guestfs;
|
|
|
|
my $prog = $0;
|
|
$prog =~ s{.*/}{};
|
|
|
|
# Because we parse error message strings below.
|
|
$ENV{LANG} = "C";
|
|
|
|
if ($ENV{"SKIP_TEST_RELABEL_PL"}) {
|
|
print "$prog: test skipped because environment variable is set.\n";
|
|
exit 77
|
|
}
|
|
|
|
# SELinux labelling won't work (and can be skipped) if SELinux isn't
|
|
# installed on the host.
|
|
if (! -f "/etc/selinux/config" || ! -x "/usr/sbin/load_policy") {
|
|
print "$prog: test skipped because SELinux is not available.\n";
|
|
exit 77
|
|
}
|
|
|
|
# Create a filesystem.
|
|
my $g = Sys::Guestfs->new ();
|
|
|
|
$g->add_drive_scratch (256*1024*1024);
|
|
$g->launch ();
|
|
|
|
# If Linux extended attrs aren't available then we cannot test this.
|
|
unless ($g->feature_available (["linuxxattrs"])) {
|
|
print "$prog: test skipped because 'linuxxattrs' feature not available.\n";
|
|
$g->close ();
|
|
exit 77
|
|
}
|
|
|
|
# If SELinux relabelling is not available then we cannot test this.
|
|
unless ($g->feature_available (["selinuxrelabel"])) {
|
|
print "$prog: test skipped because 'selinuxrelabel' feature not available.\n";
|
|
$g->close ();
|
|
exit 77
|
|
}
|
|
|
|
$g->part_disk ("/dev/sda", "mbr");
|
|
$g->mkfs ("ext4", "/dev/sda1");
|
|
|
|
$g->mount_options ("user_xattr", "/dev/sda1", "/");
|
|
|
|
# Create some files and directories that we want to have relabelled.
|
|
$g->mkdir ("/bin");
|
|
$g->touch ("/bin/ls");
|
|
$g->mkdir ("/etc");
|
|
$g->mkdir ("/tmp");
|
|
$g->touch ("/tmp/test");
|
|
$g->mkdir ("/var");
|
|
$g->mkdir ("/var/log");
|
|
$g->touch ("/var/log/messages");
|
|
|
|
# Create a spec file.
|
|
# This doesn't test the optional file_type field. XXX
|
|
# See also file_contexts(5).
|
|
$g->write ("/etc/file_contexts", <<'EOF');
|
|
/.* system_u:object_r:default_t:s0
|
|
/bin/.* system_u:object_r:bin_t:s0
|
|
/etc/.* system_u:object_r:etc_t:s0
|
|
/etc/file_contexts <<none>>
|
|
/tmp/.* <<none>>
|
|
/var/.* system_u:object_r:var_t:s0
|
|
/var/log/.* system_u:object_r:var_log_t:s0
|
|
EOF
|
|
|
|
# Do the relabel.
|
|
$g->selinux_relabel ("/etc/file_contexts", "/", force => 1);
|
|
|
|
# Check the labels were set correctly.
|
|
my $errors = 0;
|
|
|
|
sub check_label
|
|
{
|
|
my $file = shift;
|
|
my $expected_label = shift;
|
|
|
|
my $actual_label = $g->lgetxattr ($file, "security.selinux");
|
|
# The label returned from lgetxattr has \0 appended.
|
|
if ("$expected_label\0" ne $actual_label) {
|
|
print STDERR "$prog: expected label on file $file: expected=$expected_label actual=$actual_label\n";
|
|
$errors++;
|
|
}
|
|
}
|
|
|
|
sub check_label_none
|
|
{
|
|
my $file = shift;
|
|
my $r;
|
|
|
|
eval {
|
|
$r = $g->lgetxattr ($file, "security.selinux");
|
|
};
|
|
if (defined $r) {
|
|
print STDERR "$prog: expecting no label on file $file, but got $r\n";
|
|
$errors++;
|
|
} elsif ($@) {
|
|
if ($@ !~ /No data available/) {
|
|
print STDERR "$prog: expecting an error reading label from file $file, but got $@\n";
|
|
$errors++;
|
|
}
|
|
}
|
|
}
|
|
|
|
check_label ("/bin", "system_u:object_r:default_t:s0");
|
|
check_label ("/bin/ls", "system_u:object_r:bin_t:s0");
|
|
check_label ("/etc", "system_u:object_r:default_t:s0");
|
|
check_label_none ("/etc/file_contexts");
|
|
check_label ("/tmp", "system_u:object_r:default_t:s0");
|
|
check_label_none ("/tmp/test");
|
|
check_label ("/var", "system_u:object_r:default_t:s0");
|
|
check_label ("/var/log", "system_u:object_r:var_t:s0");
|
|
check_label ("/var/log/messages", "system_u:object_r:var_log_t:s0");
|
|
|
|
# Finish up.
|
|
$g->shutdown ();
|
|
$g->close ();
|
|
|
|
exit ($errors == 0 ? 0 : 1);
|