Experimental fsverity.test related GA CI improvements

This does not make fsverity.test working on GA CI, though.

- `--device /dev/loop-control' is required for losetup(8) to work.
- `--privileged' is required foo mount(8) to work, and this makes
  `--security-opt seccomp=unconfined' redundant.
- GA container does not have `/sys/kernel/security' mounted which is
  needed for `/sys/kernel/security/integrity/ima/policy'.
- Enable `set -x` in CI as the logs is everything we have to analyze on
  failures.

Update: with these changes and the UML kernel support, the fsverity.test
is working properly.

Signed-off-by: Vitaly Chikunov <vt@altlinux.org>
[zohar@linux.ibm.com: updated patch description]
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>

.github/workflows/ci.yml

@@ -98,7 +98,7 @@ jobs:
     container:
       image: ${{ matrix.container }}
       env: ${{ matrix.env }}
-      options: --security-opt seccomp=unconfined
+      options: --privileged --device /dev/loop-control
 
     steps:
     - name: Show OS

build.sh

@@ -1,6 +1,16 @@
 #!/bin/sh
 # Copyright (c) 2020 Petr Vorel <pvorel@suse.cz>
 
+if [ -n "$CI" ]; then
+	# If we under CI only thing we can analyze is logs so better to enable
+	# verbosity to a maximum.
+	set -x
+	# This is to make stdout and stderr synchronous in the logs.
+	exec 2>&1
+
+	mount -t securityfs -o rw securityfs /sys/kernel/security
+fi
+
 set -e
 
 CC="${CC:-gcc}"
@@ -100,7 +110,7 @@ if [ $ret -eq 0 ]; then
 	tail -20 tests/boot_aggregate.log
 
 	if [ -f tests/fsverity.log ]; then
-		tail -4 tests/fsverity.log
+		[ -n "$CI" ] && cat tests/fsverity.log || tail tests/fsverity.log
 		grep "skipped" tests/fsverity.log  && \
 		   grep "skipped" tests/fsverity.log | wc -l
 	fi

tests/fsverity.test

@@ -78,7 +78,7 @@ mount_loopback_file() {
 		exit "$FAIL"
 	fi
 
-	mount -o loop ${TST_IMG} $TST_MNT
+	mount -v -o loop ${TST_IMG} $TST_MNT
 	ret=$?
 
 	if [ "${ret}" -eq 0 ]; then