System tests: tighten 'is' operator

Fix day-one sloppiness: when I first wrote this framework
it compared strings using 'expr', not '=', to be more
forgiving of extra cruft in output. This was a bad decision.
It means that warnings or additional text are ignored:

    is "all is ok, NOT!"  "all is ok"  <-- this would pass

Solution: tighten up the 'is' check. Use '=' (direct
compare) first. If it fails, look for wild cards ('*')
or character classes ('[') in the expect string. If
so, and only then, use 'expr'. And, thanks to a clever
suggestion from Luap99, include '(using expr)' in the
error message when we do so; this could make it easier
for a developer to understand a string mismatch.

This change exposes a lot of instances in which we weren't
doing proper comparisons. Fix those. Thankfully, there
weren't as many as I'd feared.

Also, and completely unrelated, add '-T' flag to bats
helper, for showing timing results. (I will open this
as a separate PR if requested. I too find it offensive
to jumble together unrelated commits.)

Signed-off-by: Ed Santiago <santiago@redhat.com>

1 files changed, 12 insertions, 7 deletions

diff --git a/test/system/410-selinux.bats b/test/system/410-selinux.bats
index 0f7c35c65..7f7f23000 100644
--- a/test/system/410-selinux.bats
+++ b/test/system/410-selinux.bats
@@ -29,7 +29,7 @@ function check_label() {
     if [ -n "$2" ]; then
         # e.g. from the above example -> "s0:c45,c745"
         range=$(cut -d: -f4,5 <<<"$context")
-        is "$range" "$2" "SELinux range"
+        is "$range" "$2^@" "SELinux range"
     fi
 }
 
@@ -101,7 +101,7 @@ function check_label() {
                --security-opt label=level:s0 \
                $IMAGE sh -c 'while test ! -e /stop; do sleep 0.1; done'
     run_podman inspect --format='{{ .HostConfig.SecurityOpt }}' myc
-    is "$output" "\[label=type:spc_t,label=level:s0 seccomp=unconfined]" \
+    is "$output" "[label=type:spc_t,label=level:s0 seccomp=unconfined]" \
       "'podman inspect' preserves all --security-opts"
 
     run_podman exec myc touch /stop
@@ -117,6 +117,10 @@ function check_label() {
     # must use a pid namespace and not join an existing one.
     skip_if_rootless_cgroupsv1
 
+    if [[ $(podman_runtime) == "runc" ]]; then
+        skip "some sort of runc bug, not worth fixing (#11784)"
+    fi
+
     run_podman run -d --name myctr $IMAGE top
     run_podman exec myctr cat -v /proc/self/attr/current
     context_c1="$output"
@@ -225,24 +229,25 @@ function check_label() {
 
     run_podman run -v $tmpdir:/test $IMAGE cat /proc/self/attr/current
     run ls -dZ ${tmpdir}
-    is "$output" ${LABEL} "No Relabel Correctly"
+    is "$output" "${LABEL} ${tmpdir}" "No Relabel Correctly"
 
     run_podman run -v $tmpdir:/test:z --security-opt label=disable $IMAGE cat /proc/self/attr/current
     run ls -dZ $tmpdir
-    is "$output" ${RELABEL} "Privileged Relabel Correctly"
+    is "$output" "${RELABEL} $tmpdir" "Privileged Relabel Correctly"
 
     run_podman run -v $tmpdir:/test:z --privileged $IMAGE cat /proc/self/attr/current
     run ls -dZ $tmpdir
-    is "$output" ${RELABEL} "Privileged Relabel Correctly"
+    is "$output" "${RELABEL} $tmpdir" "Privileged Relabel Correctly"
 
     run_podman run -v $tmpdir:/test:Z $IMAGE cat /proc/self/attr/current
     level=$(secon -l $output)
     run ls -dZ $tmpdir
-    is "$output" "system_u:object_r:container_file_t:$level" "Confined Relabel Correctly"
+    is "$output" "system_u:object_r:container_file_t:$level $tmpdir" \
+       "Confined Relabel Correctly"
 
     run_podman run -v $tmpdir:/test:z $IMAGE cat /proc/self/attr/current
     run ls -dZ $tmpdir
-    is "$output" ${RELABEL} "Shared Relabel Correctly"
+    is "$output" "${RELABEL} $tmpdir" "Shared Relabel Correctly"
 }
 
 # vim: filetype=sh