public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
From: Milos Malik <mmalik@redhat.com>
To: git-commits@fedoraproject.org
Subject: [tests/selinux] main: test if the bootupd service can talk to SSSD
Date: Mon, 29 Jun 2026 13:09:23 GMT [thread overview]
Message-ID: <178273856341.1.6987817576241879217.tests-selinux-f03d5ff12b0f@fedoraproject.org> (raw)
A new commit has been pushed.
Repo : tests/selinux
Branch : main
Commit : f03d5ff12b0f0e7e13043e356919290493839d48
Author : Milos Malik <mmalik@redhat.com>
Date : 2026-06-29T12:14:27+00:00
Stats : +14/-0 in 3 file(s)
URL : https://src.fedoraproject.org/tests/selinux/c/f03d5ff12b0f0e7e13043e356919290493839d48?branch=main
Log:
test if the bootupd service can talk to SSSD
A recently filed bug report revealed that SELinux prevents the
bootupd service and its children processes from talking to SSSD.
The TC reproduces the situation on machines created by bootc.
In order to support this scenario, I believe that SELinux policy
should allow the necessary access. The TC looks for appropriate
policy rules and file context patterns.
The TC covers RHEL-174888.
---
diff --git a/selinux-policy/bootupd-and-similar/Makefile b/selinux-policy/bootupd-and-similar/Makefile
index 2134c06..68ea1c9 100644
--- a/selinux-policy/bootupd-and-similar/Makefile
+++ b/selinux-policy/bootupd-and-similar/Makefile
@@ -69,6 +69,7 @@ $(METADATA): Makefile
@echo "Bug: RHEL-39514" >> $(METADATA) # RHEL-10
@echo "Bug: RHEL-66584" >> $(METADATA) # RHEL-9
@echo "Bug: RHEL-70849" >> $(METADATA) # RHEL-9
+ @echo "Bug: RHEL-174888" >> $(METADATA) # RHEL-9
rhts-lint $(METADATA)
diff --git a/selinux-policy/bootupd-and-similar/main.fmf b/selinux-policy/bootupd-and-similar/main.fmf
index 6f814d7..52e576e 100644
--- a/selinux-policy/bootupd-and-similar/main.fmf
+++ b/selinux-policy/bootupd-and-similar/main.fmf
@@ -41,6 +41,7 @@ link:
- verifies: https://issues.redhat.com/browse/RHEL-39514
- verifies: https://issues.redhat.com/browse/RHEL-66584
- verifies: https://issues.redhat.com/browse/RHEL-70849
+ - verifies: https://issues.redhat.com/browse/RHEL-174888
adjust+:
- enabled: false
when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8
diff --git a/selinux-policy/bootupd-and-similar/runtest.sh b/selinux-policy/bootupd-and-similar/runtest.sh
index 73e5322..f2b2767 100755
--- a/selinux-policy/bootupd-and-similar/runtest.sh
+++ b/selinux-policy/bootupd-and-similar/runtest.sh
@@ -123,6 +123,18 @@ rlJournalStart
rlSESearchRule "type_transition bootupd_t bootloader_exec_t : process bootloader_t"
rlSESearchRule "allow bootupd_t bootloader_t : process { transition } [ ]"
rlPhaseEnd
+
+ rlPhaseStartTest "RHEL-174888"
+ rlSEMatchPathCon "/usr/bin/lsblk" "bin_t"
+ rlSEMatchPathCon "/etc/passwd" "passwd_file_t"
+ rlSEMatchPathCon "/run/mount/utab" "mount_var_run_t"
+ rlSEMatchPathCon "/var/lib/sss/mc/passwd" "sssd_public_t"
+ rlSEMatchPathCon "/var/lib/sss" "sssd_var_lib_t"
+ rlSESearchRule "allow bootupd_t mount_var_run_t : dir { search } [ ]"
+ rlSESearchRule "allow bootupd_t passwd_file_t : file { getattr open read } [ ]"
+ rlSESearchRule "allow bootupd_t sssd_public_t : dir { search } [ ]"
+ rlSESearchRule "allow bootupd_t sssd_var_lib_t : dir { search } [ ]"
+ rlPhaseEnd
fi
if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then
reply other threads:[~2026-06-29 13:09 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=178273856341.1.6987817576241879217.tests-selinux-f03d5ff12b0f@fedoraproject.org \
--to=mmalik@redhat.com \
--cc=git-commits@fedoraproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox