tests/mac_admin: disable test of getting undefined label on nfs

We already had a workaround in the test script to expect a different
result on NFS to the unique aspects of labeled NFS, but this
workaround won't work when/if SELinux namespaces are enabled
(due to the introduction of the global SID table and its
correct preservation of the original context value) and was
really only papering over the lack of support. Just disable
this particular test when run on NFS filesystems.

Signed-off-by: Stephen Smalley <[email protected]>

Author: stephensmalley

tests/mac_admin/test

@@ -7,8 +7,12 @@ BEGIN {
     $basedir =~ s|(.*)/[^/]*|$1|;
 
     $isnfs = `stat -f --print %T $basedir`;
-
-    plan tests => 8;
+    if ( $isnfs ne "nfs" ) {
+        plan tests => 8;
+    }
+    else {
+        plan tests => 7;
+    }
 }
 
 # Verify that test_mac_admin_t can relabel a file to an undefined context.
@@ -38,15 +42,14 @@ $result = system(
 );
 ok( $result, 0 );    # we expect this to succeed.
 
-# Verify that test_mac_admin_t sees the undefined label value.
-$result = `runcon -t test_mac_admin_t -- secon -t -f $basedir/test_dir 2>&1`;
-chomp($result);
 if ( $isnfs ne "nfs" ) {
+
+    # Verify that test_mac_admin_t sees the undefined label value.
+    $result =
+      `runcon -t test_mac_admin_t -- secon -t -f $basedir/test_dir 2>&1`;
+    chomp($result);
     ok( $result, "UNDEFINED" );
 }
-else {
-    ok( $result, "unlabeled_t" );
-}
 
 # Verify that test_no_mac_admin_t sees the unlabeled context.
 $result = `runcon -t test_no_mac_admin_t -- secon -t -f $basedir/test_dir 2>&1`;