It's because chrome browser was restarted by other tests.
we need a workaround before we patch chrome browser.

the same content was being tested via security_SELinuxTest at autotest. so there's no worry if only the tast test is failing.

Down to P2 since it's being tested at security_SELinuxTest

regarding /sys/kernel/config, it's because CrOS boards with older kernel doesn't have it. we can skip it in the test.

Regarding Chrome restarts causing problems, you're referring to the /run/chrome/wayland-0 error, right?

Sorry, I don't completely understand. It looks like the context is "u:object_r:arc_dir:s0" instead of "u:object_r:wayland_socket:s0". How is a Chrome restart causing that to happen?

Chrome stops: delete /run/chrome/wayland-0
Chrome starts: create /run/chrome/wayland-0 and inheritance label from /run/chrome
Arc-setup: relabel /run/chrome/ to correct label.


Standard Chrome OS boot:
1) Chrome starts => wayland-0 labeled same as /run/chrome.
2) Arc-setup => fixes /run/chrome/wayland-0 to u:object_r:wayland_socket:s0  [This is a workaround from mostly Android/ARC++ side to make sure ARC++ can access /run/chrome/wayland-0 as all Chrome OS stuff was not SELinux-aware then]


If any test restarts Chrome browser without re-running arc-setup, newly created wayland-0 will inheritance the label from /run/chrome which is u:object_r:arc_dir:s0.

Obviously some tests running before security.SELinux* is crashing Chrome browser and restarting it, so it's stably failing.

Correction:

Arc-setup: relabel /run/chrome/ (recursively) to correct label.

The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/platform/tast-tests/+/083e0fd2c210df723437d9f2ba351ef4cd759b5d

commit 083e0fd2c210df723437d9f2ba351ef4cd759b5d
Author: Qijiang Fan <fqj@chromium.org>
Date: Thu Sep 20 18:39:44 2018

tast-tests: allow skip se context check for /sys/kernel/config

/sys/kernel/config doesn't not exist on some boards with some older
kernel.

BUG= chromium:884909 
TEST=none

Change-Id: Iebaccb392c59e090d400978a6c1faaf469599498
Reviewed-on: https://chromium-review.googlesource.com/1235873
Commit-Ready: Qijiang Fan <fqj@google.com>
Tested-by: Qijiang Fan <fqj@google.com>
Reviewed-by: Kenny Root <kroot@google.com>

[modify] https://crrev.com/083e0fd2c210df723437d9f2ba351ef4cd759b5d/src/chromiumos/tast/local/bundles/cros/security/selinux_file_label.go

The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/platform2/+/c2631436d989176966235787daf4f371836f5f34

commit c2631436d989176966235787daf4f371836f5f34
Author: Qijiang Fan <fqj@chromium.org>
Date: Fri Sep 21 10:38:18 2018

init/sepolicy: correctly handle labels for /run and /run/chrome.

Label /run at pre-startup stage to cros_run rather than tmpfs.
Compile multiple type_transition rule to let kernel to correctly
assign labels for /run, /run/chrome, and /run/chrome/wayland-0.

BUG=b:116072767,b:80461815, chromium:884909 
TEST=boot, kill chrome browser, start again, and monitor labels.

Change-Id: I8db509c569f32bd8d4b57c8a4faf816a8b254780
Reviewed-on: https://chromium-review.googlesource.com/1235433
Commit-Ready: Qijiang Fan <fqj@google.com>
Tested-by: Qijiang Fan <fqj@google.com>
Reviewed-by: Qijiang Fan <fqj@google.com>

[modify] https://crrev.com/c2631436d989176966235787daf4f371836f5f34/sepolicy/policy/chromeos/cros_browser.te
[modify] https://crrev.com/c2631436d989176966235787daf4f371836f5f34/sepolicy/policy/base/file.te
[modify] https://crrev.com/c2631436d989176966235787daf4f371836f5f34/sepolicy/policy/chromeos/file.te
[modify] https://crrev.com/c2631436d989176966235787daf4f371836f5f34/sepolicy/file_contexts/chromeos_file_contexts
[modify] https://crrev.com/c2631436d989176966235787daf4f371836f5f34/init/upstart/pre-startup.conf

The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/platform/tast-tests/+/8eb9b1bb4fbd53dfbf41e776ef55e69d395a2ccb

commit 8eb9b1bb4fbd53dfbf41e776ef55e69d395a2ccb
Author: Qijiang Fan <fqj@chromium.org>
Date: Fri Sep 28 02:45:13 2018

tast-tests: move wayland socket check to a separate test.

wayland socket depends Chrome on to be started.
Some other tests may kill Chrome browser, which deletes this file.
Wayland socket is created and owned by chrome browser, if there's no
chrome browser running, there won't be such socket.

And adding chrome.New to a test that doesn't depends on
chrome seems weird. (Currently selinux implies arc, which implies
chrome, but things may change in the future).

BUG=b:114172200, chromium:884909 
TEST=tast run DUT security.SELinux*

Change-Id: Icaeb804ca7bb638c3d46876709e13493e2f0c094
Reviewed-on: https://chromium-review.googlesource.com/1245076
Commit-Ready: Qijiang Fan <fqj@google.com>
Tested-by: Qijiang Fan <fqj@google.com>
Reviewed-by: Qijiang Fan <fqj@google.com>
Reviewed-by: Shuhei Takahashi <nya@chromium.org>

[modify] https://crrev.com/8eb9b1bb4fbd53dfbf41e776ef55e69d395a2ccb/src/chromiumos/tast/local/bundles/cros/security/selinux_file_label.go
[add] https://crrev.com/8eb9b1bb4fbd53dfbf41e776ef55e69d395a2ccb/src/chromiumos/tast/local/bundles/cros/security/selinux_file_label_with_chrome.go