Misc fixes and virtme-ng support

[cgzones]

With the following patches the testsuite runs successfully in a virtme-ng environment. A minimal virtme-ng default kernel configuration was used combined with the testsuite's included defconfig.

Also while working on failed testcases I tweaked some scripts and test code.

Test result:

Running as user root with context unconfined_u:unconfined_r:unconfined_t
                                                                               
domain_trans/test ........... ok   
entrypoint/test ............. ok                                                                                                                              
execshare/test .............. ok   
exectrace/test .............. ok                         
execute_no_trans/test ....... ok   
fdreceive/test .............. ok                           
inherit/test ................ ok   
link/test ................... ok                                                                                                                              
mkdir/test .................. ok                                                                                                                              
msg/test .................... ok                                                                                                                              
open/test ................... ok                                                                                                                              
ptrace/test ................. ok                                                                                                                              
readlink/test ............... ok                                                                                                                              
relabel/test ................ ok                          
rename/test ................. ok   
rxdir/test .................. ok
sem/test .................... ok     
setattr/test ................ ok   
setnice/test ................ ok   
shm/test .................... ok     
sigkill/test ................ ok     
stat/test ................... ok   
sysctl/test ................. ok   
task_create/test ............ ok   
task_setnice/test ........... ok   
task_setscheduler/test ...... ok   
task_getscheduler/test ...... ok   
task_getsid/test ............ ok   
task_getpgid/test ........... ok   
task_setpgid/test ........... ok   
file/test ................... ok     
ioctl/test .................. ok   
capable_file/test ........... ok     
capable_net/test ............ ok   
capable_sys/test ............ ok   
dyntrans/test ............... ok   
dyntrace/test ............... ok   
bounds/test ................. ok     
nnp_nosuid/test ............. ok     
mmap/test ................... ok     
unix_socket/test ............ ok     
inet_socket/tcp/test ........ ok     
inet_socket/udp/test ........ ok     
overlay/test ................ skipped: overlayfs upperdir not supported on NFS and OverlayFS
checkreqprot/test ........... ok   
mqueue/test ................. skipped: mqueue filesystem not supported/mounted
mac_admin/test .............. ok   
atsecure/test ............... ok   
infiniband_endport/test ..... skipped: test not configured
infiniband_pkey/test ........ skipped: test not configured
cap_userns/test ............. skipped: CLONE_NEWUSER not supported
extended_socket_class/test .. ok   
sctp/test ................... skipped: SCTP not supported
netlink_socket/test ......... ok   
prlimit/test ................ ok   
binder/test ................. ok   
bpf/test .................... ok     
keys/test ................... ok     
key_socket/test ............. ok   
glblub/test ................. ok   
cgroupfs_label/test ......... ok   
notify/test ................. ok   
module_load/test ............ ok   
tun_tap/test ................ skipped: No TUN/TAP support
perf_event/test ............. ok   
filesystem/xfs/test ......... ok     
filesystem/vfat/test ........ ok     
fs_filesystem/xfs/test ...... ok     
fs_filesystem/vfat/test ..... ok     
watchkey/test ............... ok   
userfaultfd/test ............ skipped: SELinux support for userfaultfd not present
vsock_socket/test ........... skipped: vsock socket family not supported
secretmem/test .............. ok
inet_socket/mptcp/test ...... skipped: protocol mptcp not supported
All tests successful.
Files=74, Tests=673, 75 wallclock secs ( 0.24 usr  0.41 sys +  3.39 cusr 15.81 csys = 19.85 CPU)
Result: PASS

The included policy needs to be tweaked (not included in this pull request):

diff --git a/policy/test_global.te b/policy/test_global.te
index 0078485..7125036 100644
--- a/policy/test_global.te
+++ b/policy/test_global.te
@@ -189,3 +189,26 @@ ifdef(`lockdown_defined', `allow $1 self:lockdown confidentiality;')
 define(`allow_userns_create',
 ifdef(`user_namespace_defined', `allow $1 self:user_namespace create;')
 )
+
+
+# virtme
+gen_require(`
+       type kernel_t, unconfined_t, unlabeled_t, virtiofs_t;
+')
+
+# tty since virtme starts with kernel_t after load_policy
+kernel_use_fds(testsuite_domain)
+
+fs_search_tmpfs(testsuite_domain)
+allow testsuite_domain virtiofs_t:dir search_dir_perms;
+allow testsuite_domain virtiofs_t:file { entrypoint execute execute_no_trans map read_file_perms };
+allow testsuite_domain virtiofs_t:lnk_file read_lnk_file_perms;
+
+fs_getattr_tmpfs(test_filesystem_t)
+# fs_manage_tmpfs_dirs
+allow test_overlay_mounter_t tmpfs_t:dir { read write };
+
+allow kernel_t self:capability2 mac_admin;
+allow { kernel_t unconfined_t } virtiofs_t:system module_load;
+
+fs_associate_tmpfs(unlabeled_t)

Also to speed up the development cycle I used the following two scripts:

tools/vng_stage1.sh

#!/bin/sh

set -eux

SCRIPTDIR=$(dirname "$0")

cd /

load_policy -i

setenforce 0

restorecon -RF -T0 /dev

# transition out of initial kernel sid
runcon -u unconfined_u -r unconfined_r -t unconfined_t /bin/bash "${SCRIPTDIR}/vng_stage2.sh"

tools/vng_stage2.sh

#!/bin/sh

set -eux

SCRIPTDIR=$(dirname "$0")

cd /

setenforce 1

# display some system status information
dmesg | tail -n 40
id
sestatus

cd "${SCRIPTDIR}/../"

make test -j"$(nproc)" || true

/bin/bash -i

[WOnder93]

Haven't yet had a chance to go through all the changes, but this part seems to make the ioctl test fail under NFS (see tools/nfs.sh). Can you look into it?

[cgzones]

Thanks for spotting, fixed via

        /*
	 * This one should hit the FILE__GETATTR or FILE__IOCTL test.
	 * FIGETBSZ is not available on overlayfs,
	 * and FS_IOC_GETFLAGS is not available on NFS.
	 */
	rc = ioctl(fd, FIGETBSZ, &val);
	if( rc < 0 ) {
		if(errno == EINVAL) {
			rc = ioctl(fd, FS_IOC_GETFLAGS, &val);
		}

		if( rc < 0 ) {
			perror("test_ioctl:FIGETBSZ/FS_IOC_GETFLAGS");
			exit(1);
		}
	}