Flaky test on Fedora: TestKeyLabel: write /proc/self/attr/keycreate: permission denied
#222
Comments
|
I spent some time looking at it this week, and it seems that
Here's a quick repro: [kir@kir-tp1 selinux]$ pwd
/home/kir/git/opencontainers/selinux
[kir@kir-tp1 selinux]$ go test -count 1000 -run KeyLabel ./go-selinux/label/I run it on my Fedora 41 laptop and I'm getting frequent failures. If you don't, feel free to increase count or run it again. I also tried to add retries (into two different places) and it doesn't help. Here's my ugly retrials+debug code: diff --git a/go-selinux/selinux_linux.go b/go-selinux/selinux_linux.go
index be139a4..7702596 100644
--- a/go-selinux/selinux_linux.go
+++ b/go-selinux/selinux_linux.go
@@ -16,6 +16,7 @@ import (
"strconv"
"strings"
"sync"
+ "time"
"github.com/opencontainers/selinux/pkg/pwalkdir"
"golang.org/x/sys/unix"
@@ -437,12 +438,22 @@ func writeCon(fpath, val string) error {
return err
}
+ i := 0
+again:
if val != "" {
_, err = out.Write([]byte(val))
} else {
_, err = out.Write(nil)
}
if err != nil {
+ if errors.Is(err, unix.EACCES) {
+ i++
+ if i < 10 {
+ print("writeCon: got EACCES, retry ", i, "\n")
+ time.Sleep(100 * time.Nanosecond)
+ goto again
+ }
+ }
return err
}
return nil
@@ -711,12 +722,21 @@ func peerLabel(fd uintptr) (string, error) {
// setKeyLabel takes a process label and tells the kernel to assign the
// label to the next kernel keyring that gets created
func setKeyLabel(label string) error {
- err := writeCon("/proc/self/attr/keycreate", label)
- if errors.Is(err, os.ErrNotExist) {
- return nil
- }
- if label == "" && errors.Is(err, os.ErrPermission) {
- return nil
+ var err error
+ for i := 0; i < 25; i++ {
+ err = writeCon("/proc/self/attr/keycreate", label)
+ if errors.Is(err, os.ErrNotExist) {
+ return nil
+ }
+ if errors.Is(err, unix.EACCES) {
+ print("setKeyLabel: got EACCES, retry ", i, "\n")
+ time.Sleep(10 * time.Nanosecond)
+ continue
+ }
+ if label == "" && errors.Is(err, os.ErrPermission) {
+ return nil
+ }
+ return err
}
return err
}Here's what I'm seeing: I also tried using The fact that this only |
The issue seems to happen on AlmaLinux 8 too |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Originally posted by @AkihiroSuda in #221 (comment)
The text was updated successfully, but these errors were encountered: