DRAFT for CI: Add RootFS and SMACK support for id, ls, mkdir, mkfifo, mknod

[ChrisDryden]

This Draft PR is to provide a reference for the other PR's that will make up the steps to enable SMACK and RootFS support and GNU testing in the CI.

This PR needs to be broken down into three separate PR's but hoping to keep this one around to show how when all of the proposed changes are combined it allows you to run and pass the SMACK GNU tests.

[codspeed-hq]

CodSpeed Performance Report

Merging #9866 will degrade performance by 5.5%

_{Comparing ChrisDryden:smack-support (b7809ea) with main (efa1aa7)}

Summary

❌ 9 regressions
✅ 118 untouched
⏩ 6 skipped¹

⚠️ Please fix the performance issues or acknowledge them on CodSpeed.

Benchmarks breakdown

	Benchmark	BASE	HEAD	Efficiency
❌	wc_bytes_synthetic[500]	181.7 µs	188.5 µs	-3.65%
❌	b64_decode_synthetic	166.2 µs	171.7 µs	-3.2%
❌	b64_decode_ignore_garbage_synthetic	163.1 µs	170 µs	-4.07%
❌	b64_encode_synthetic	161.8 µs	169.9 µs	-4.81%
❌	cksum_blake3	207.9 µs	214.4 µs	-3.01%
❌	mv_force_overwrite	144.3 ms	150.7 ms	-4.22%
❌	mv_single_file	135.5 ms	140.8 ms	-3.72%
❌	rm_single_file	119.4 ms	125.1 ms	-4.58%
❌	factor_multiple_u64s[2]	212.5 ms	224.9 ms	-5.5%

Footnotes

1. 6 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

[sylvestre]

Please split it into several PR.
26 modified files is a bit too much. Thanks

[ChrisDryden]

This is just a working draft for now, mostly related to the CI stuff with a bunch of debugging info, will split it and clean it up a ton if it ends up being successful

[sylvestre]

OK, then, please don't open the PR. We have too many and it makes our life much harder to keep track of them

[ChrisDryden]

What's the best way for me to run the CI stuff, thats all I'm testing now?

…

On Fri, Dec 26, 2025 at 10:09 AM Sylvestre Ledru ***@***.***> wrote: *sylvestre* left a comment (uutils/coreutils#9866) <#9866 (comment)> OK, then, please don't open the PR. We have too many and it makes our life much harder to keep track of them — Reply to this email directly, view it on GitHub <#9866 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AGM5PJTS2CVQYIFD6VKVMF34DV2UPAVCNFSM6AAAAACQCJ5G7KVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTMOJTGE4DSNZZGU> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[ChrisDryden]

/home/runner/work/coreutils/coreutils/gnu/tests/mkdir/smack-no-root.sh
Running: id/smack.sh
  PASS: id/smack.sh
Running: mkdir/smack-root.sh
  PASS: mkdir/smack-root.sh
Running: mkdir/smack-no-root.sh
  PASS: mkdir/smack-no-root.sh
Done. Results in /home/runner/work/coreutils/coreutils/gnu/tests-smack

Quite a PITA to get QEMU to work but by making a base arch linux distribution and only copying over the binaries that are referenced, it makes it that it can run in 3 minutes

[sylvestre]

What's the best way for me to run the CI stuff, thats all I'm testing now?

If you push to main in your fork, it should start the ci

You can update the github files to have the Ci run on other branches too

…
On Fri, Dec 26, 2025 at 10:09 AM Sylvestre Ledru @.> wrote: sylvestre left a comment (uutils/coreutils#9866) <#9866 (comment)> OK, then, please don't open the PR. We have too many and it makes our life much harder to keep track of them — Reply to this email directly, view it on GitHub <#9866 (comment)>, or unsubscribe https://github.com/notifications/unsubscribe-auth/AGM5PJTS2CVQYIFD6VKVMF34DV2UPAVCNFSM6AAAAACQCJ5G7KVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTMOJTGE4DSNZZGU . You are receiving this because you authored the thread.Message ID: @.>

[oech3]

Quite a PITA to get QEMU to work but by making a base arch linux distribution and only copying over the binaries that are referenced, it makes it that it can run in 3 minutes

Any chance to reduce time for SELinux too?

[github-actions]

GNU testsuite comparison:

Congrats! The gnu test tests/id/smack is now passing!
Congrats! The gnu test tests/mkdir/smack-no-root is now passing!
Congrats! The gnu test tests/mkdir/smack-root is now passing!

[ChrisDryden]

I think the main issue in the SELinux example is that the program is compiled within the emulator instead of compiled outside the emulator and copied over. You can definitely make the SELinux distribution smaller by only compiling a subset of the binaries that are used

[oech3]

About subset, #9567 was previously working well and saved 5min +. But broken now...

[ChrisDryden]

To break this down I think the three stages are first adding the fix for ls: #9868 since that utility is actually used to determine whether the environment supports smack. Then I can follow up with a cleaned up and minimal script for running the smack tests which will be able to show the tests moving from skip to fail. Then the last step is actually adding the code changes for fixing the other utilities.

The one tricky part is that we do not have an environment currently where we can run our regular rust integration tests that supports smack, I would like to build rust smack integration tests in the long run but they would require building out the CI support.

[oech3]

Any Linux distribution supporting SELinux and smack at 1 kernel? 3 VM for GNU tests is too large...

[sylvestre]

sorry, it needs to be rebased

[ChrisDryden]

This is the last PR to fully implement these changes, #9910 after that one is in I can follow up with the RootFS tests