[LU-14199] sanity-selinux test 21a fails with 'client mount without sending sepol should be refused'

• Type: Bug
• Resolution: Fixed
• Priority: Minor
• Fix Version/s: Lustre 2.14.0
• Affects Version/s: Lustre 2.14.0
• Labels: rhel8.3 security
• Environment: RHEL8.3 client/server
• Severity: 3
• Assignee: Sebastien Buisson
• Reporter: James Nunez (Inactive)

Description

sanity-selinux test_21a fails for RHEL 8.3 client/server testing in review-dne-selinux.

Looking at the logs for the failure at https://testing.whamcloud.com/test_sets/75526e78-6eda-4900-995c-b361935c3e9f , the suite_log shows the test output

CMD: trevis-200vm4 /usr/sbin/lctl set_param -P nodemap.c0.sepol=
On mds4, c0.sepol = 
On mds3, c0.sepol = 
On mds2, c0.sepol = 
On mds1, c0.sepol = 
Starting client: trevis-200vm1.trevis.whamcloud.com:  -o user_xattr,flock trevis-200vm4@tcp:/lustre /mnt/lustre
CMD: trevis-200vm1.trevis.whamcloud.com mkdir -p /mnt/lustre
CMD: trevis-200vm1.trevis.whamcloud.com mount -t lustre -o user_xattr,flock trevis-200vm4@tcp:/lustre /mnt/lustre
 sanity-selinux test_21a: @@@@@@ FAIL: client mount without sending sepol should be refused 
  Trace dump:
  = /usr/lib64/lustre/tests/test-framework.sh:6257:error()
  = /usr/lib64/lustre/tests/sanity-selinux.sh:604:test_21a()

Sebastien took a look at this and had the following comments:
It comes from the following command in the test script:

do_facet mgs $LCTL set_param -P nodemap.$nm.sepol="$sepol"

and the sepol variable is obtained from:

sepol=$(l_getsepol | cut -d':' -f2- | xargs)

On my RHEL 8.2 test system it goes like this:

# l_getsepol | cut -d':' -f2- | xargs
1:targeted:31:309ea33f4ea67b3baf7354d797d41a5330eb7c7653e66bcc928ea62268b7aa08

so the test is expected to set a non empty value for the sepol parameter on the nodemap, and the fact that it fails breaks the rest of the test. So it seems there is a problem with this command in RHEL 8.3

In addition, we see sanity-selinux test 21b fail in the same way with

CMD: trevis-200vm4 /usr/sbin/lctl set_param -P nodemap.c0.sepol=
On mds4, c0.sepol = 
On mds3, c0.sepol = 
On mds2, c0.sepol = 
On mds1, c0.sepol = 
 sanity-selinux test_21b: @@@@@@ FAIL: touch (1) 
  Trace dump:
  = /usr/lib64/lustre/tests/test-framework.sh:6257:error()
  = /usr/lib64/lustre/tests/sanity-selinux.sh:688:test_21b()