[tests/selinux] main: Test if crashing process in a nspawn container triggers an AVC denial.

[Veronika Syncakova <veva.syncakova@gmail.com>]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : main
            Commit : d5072cf5edd612760c73364cf7c33d2930b61473
            Author : Veronika Syncakova <veva.syncakova@gmail.com>
            Date   : 2026-07-22T13:28:07+00:00
            Stats  : +85/-0 in 2 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/d5072cf5edd612760c73364cf7c33d2930b61473?branch=main

            Log:
            Test if crashing process in a nspawn container triggers an AVC denial.

If a process crashes in an nspawn container started either via machinectl start or systemd-nspawn -bD ...
it triggers an AVC denial, even if the container is under /var/lib/machines/.

Tests RHEL-139983

---
diff --git a/selinux-policy/systemd-nspawn-coredump/main.fmf b/selinux-policy/systemd-nspawn-coredump/main.fmf
new file mode 100644
index 0000000..b183587
--- /dev/null
+++ b/selinux-policy/systemd-nspawn-coredump/main.fmf
@@ -0,0 +1,26 @@
+summary: SELinux interferes with coredump access in systemd-nspawn containers
+description: |+
+    Test for RHEL-139983 - coredump directory access in systemd-nspawn containers
+
+contact: Veronika Syncakova <vsyncako@redhat.com>
+component:
+  - selinux-policy
+require:
+  - library(selinux-policy/common)
+  - systemd
+  - systemd-container
+recommend:
+  - audit
+  - libselinux
+  - setools-console
+environment:
+    AVC_ERROR: +no_avc_check
+duration: 15m
+enabled: true
+tag:
+  - NoRHEL8
+link:
+  - verifies: https://redhat.atlassian.net/browse/RHEL-139983
+adjust+:
+  - enabled: false
+    when: distro < rhel-9

diff --git a/selinux-policy/systemd-nspawn-coredump/runtest.sh b/selinux-policy/systemd-nspawn-coredump/runtest.sh
new file mode 100755
index 0000000..f59d945
--- /dev/null
+++ b/selinux-policy/systemd-nspawn-coredump/runtest.sh
@@ -0,0 +1,59 @@
+#!/bin/bash
+# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGE="selinux-policy"
+INSTALL_OPTION=""
+if dnf --help | grep -q use-host-config ; then
+    INSTALL_OPTION="${INSTALL_OPTION} --use-host-config"
+fi
+if dnf install --help | grep -q skip-broken ; then
+    INSTALL_OPTION="${INSTALL_OPTION} --skip-broken"
+fi
+if dnf install --help | grep -q skip-unavailable ; then
+    INSTALL_OPTION="${INSTALL_OPTION} --skip-unavailable"
+fi
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlRun "rlImport 'selinux-policy/common'" 0,1
+        rlAssertRpm ${PACKAGE}
+        rlAssertRpm systemd-container
+        rlSESetEnforce
+        rlSESetTimestamp
+    rlPhaseEnd
+
+    rlPhaseStartTest "RHEL-139983"
+        rlRun "mkdir -p /var/lib/machines/foo"
+        rlRun "dnf install -y --installroot /var/lib/machines/foo --nogpgcheck systemd-udev ${INSTALL_OPTION}"
+        
+        rlRun "systemd-nspawn -bD /var/lib/machines/foo >/dev/null 2>&1 &"
+        sleep 2
+        rlRun -s  "systemd-run -q --wait --pipe -M foo ls -lZ /run/systemd/coredump 2>&1"
+        rlAssertNotGrep "user_tmp_t" "$rlRun_LOG" -i
+        # Crash should not cause coredump avc
+        rlRun "systemd-run -q --wait --pipe -M foo bash -xc 'kill -SEGV \$\$\$\$'" 1-255
+        rlRun "machinectl terminate foo"
+        sleep 2
+        rlRun "rm -f /run/systemd/machines/foo"
+        sleep 2
+
+        # Same scenario but container started with machinectl
+        rlRun "machinectl start foo"
+        sleep 2
+        rlRun -s  "systemd-run -q --wait --pipe -M foo ls -lZ /run/systemd/coredump 2>&1"
+        rlAssertNotGrep "tmpfs_t" "$rlRun_LOG" -i
+        rlRun "systemd-run -q --wait --pipe -M foo bash -xc 'kill -SEGV \$\$\$\$'" 1-255
+        rlRun "machinectl terminate foo"
+        sleep 2
+        rlRun "rm -f /run/systemd/machines/foo"
+        rlRun "rm -rf /var/lib/machines/foo"
+        rm -f $rlRun_LOG
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        rlSECheckAVC
+    rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd