From 9fd7ab50f82c7eaccd2b9daca84e516367f610a2 Mon Sep 17 00:00:00 2001
From: Ed Santiago <santiago@redhat.com>
Date: Mon, 3 May 2021 13:41:53 -0600
Subject: System tests: honor $OCI_RUNTIME (for CI)

Some CI systems set $OCI_RUNTIME as a way to override the
default crun. Integration (e2e) tests honor this, but system
tests were not aware of the convention; this means we haven't
been testing system tests with runc, which means RHEL gating
tests are now failing.

The proper solution would be to edit containers.conf on CI
systems. Sorry, that would involve too much CI-VM work.
Instead, this PR detects $OCI_RUNTIME and creates a dummy
containers.conf file using that runtime.

Add: various skips for tests that don't work with runc.

Refactor: add a helper function so we don't need to do
the complicated 'podman info blah blah .OCIRuntime.blah'
thing in many places.

BUG: we leave a tmp file behind on exit.

Signed-off-by: Ed Santiago <santiago@redhat.com>
---
 test/system/410-selinux.bats | 25 ++++++++++++++-----------
 1 file changed, 14 insertions(+), 11 deletions(-)

(limited to 'test/system/410-selinux.bats')

diff --git a/test/system/410-selinux.bats b/test/system/410-selinux.bats
index 8a690fb48..95233c1e6 100644
--- a/test/system/410-selinux.bats
+++ b/test/system/410-selinux.bats
@@ -51,18 +51,13 @@ function check_label() {
 }
 
 @test "podman selinux: pid=host" {
-    # FIXME FIXME FIXME: Remove these lines once all VMs have >= 2.146.0
-    # (this is ugly, but better than an unconditional skip)
-    skip_if_no_selinux
+    # FIXME this test fails when run rootless with runc:
+    #   Error: container_linux.go:367: starting container process caused: process_linux.go:495: container init caused: readonly path /proc/asound: operation not permitted: OCI permission denied
     if is_rootless; then
-        if [ -x /usr/bin/rpm ]; then
-            cs_version=$(rpm -q --qf '%{version}' container-selinux)
-        else
-            # SELinux not enabled on Ubuntu, so we should never get here
-            die "WHOA! SELinux enabled, but no /usr/bin/rpm!"
-        fi
+        runtime=$(podman_runtime)
+        test "$runtime" == "crun" \
+            || skip "runtime is $runtime; this test requires crun"
     fi
-    # FIXME FIXME FIXME: delete up to here, leaving just check_label
 
     check_label "--pid=host" "spc_t"
 }
@@ -185,10 +180,18 @@ function check_label() {
 @test "podman with nonexistent labels" {
     skip_if_no_selinux
 
+    # runc and crun emit different diagnostics
+    runtime=$(podman_runtime)
+    case "$runtime" in
+        crun) expect="\`/proc/thread-self/attr/exec\`: OCI runtime error: unable to assign security attribute" ;;
+        runc) expect="OCI runtime error: .*: failed to set /proc/self/attr/keycreate on procfs" ;;
+        *)    skip "Unknown runtime '$runtime'";;
+    esac
+
     # The '.*' in the error below is for dealing with podman-remote, which
     # includes "error preparing container <sha> for attach" in output.
     run_podman 126 run --security-opt label=type:foo.bar $IMAGE true
-    is "$output" "Error.*: \`/proc/thread-self/attr/exec\`: OCI runtime error: unable to assign security attribute" "useful diagnostic"
+    is "$output" "Error.*: $expect" "podman emits useful diagnostic on failure"
 }
 
 @test "podman selinux: check relabel" {
-- 
cgit v1.2.3-54-g00ecf