From 5c83ec06fa6aa23d8c540e9f5889f31aaf51dfbb Mon Sep 17 00:00:00 2001 From: Florence Blanc-Renaud Date: Fri, 4 Jun 2021 17:08:12 +0200 Subject: [PATCH] ipatests: set selinux context for fips mode In order to test FIPS mode, the test is faking a user-space FIPS environment by creating a file /var/tmp/userspace-fips and bind-mounting this file as /proc/sys/crypto/fips_enabled The security context needs to be properly set otherwise /proc/sys/crypto/fips_enabled inherits the security context unconfined_u:object_r:user_tmp_t:s0 and cannot be read, resulting in the test seeing fips_mode=false. Fixes: https://pagure.io/freeipa/issue/8868 Signed-off-by: Florence Blanc-Renaud Reviewed-By: Rob Crittenden --- ipatests/pytest_ipa/integration/fips.py | 3 +++ 1 file changed, 3 insertions(+) diff --git a/ipatests/pytest_ipa/integration/fips.py b/ipatests/pytest_ipa/integration/fips.py index eef297349..694ec8a99 100644 --- a/ipatests/pytest_ipa/integration/fips.py +++ b/ipatests/pytest_ipa/integration/fips.py @@ -37,6 +37,9 @@ def enable_userspace_fips(host): # fake Kernel FIPS mode with bind mount host.run_command(["mkdir", "-p", FIPS_OVERLAY_DIR]) host.put_file_contents(FIPS_OVERLAY, "1\n") + host.run_command( + ["chcon", "-t", "sysctl_crypto_t", "-u", "system_u", FIPS_OVERLAY] + ) host.run_command( ["mount", "--bind", FIPS_OVERLAY, paths.PROC_FIPS_ENABLED] )