[tests/selinux] main: Test that rhsmcertd have access to gconf_home_t site-packages

[tests/selinux] main: Test that rhsmcertd have access to gconf_home_t site-packages

[Veronika Syncakova]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : main
            Commit : 5cc4776f3bd646657718ba6d4af2c4ab5b9075d8
            Author : Veronika Syncakova <veva.syncakova@gmail.com>
            Date   : 2026-07-22T13:31:26+00:00
            Stats  : +69/-0 in 2 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/5cc4776f3bd646657718ba6d4af2c4ab5b9075d8?branch=main

            Log:
            Test that rhsmcertd have access to gconf_home_t site-packages

Test case for RHEL-106483

---
diff --git a/selinux-policy/rhsmcertd-and-similar/main.fmf b/selinux-policy/rhsmcertd-and-similar/main.fmf
new file mode 100644
index 0000000..283c71f
--- /dev/null
+++ b/selinux-policy/rhsmcertd-and-similar/main.fmf
@@ -0,0 +1,28 @@
+summary: Test that rhsmcertd have access to gconf_home_t site-packages
+description: |+
+    rhsmcertd is denied read access to /root/.local/lib/pythonX.Y/site-packages/
+    which has gconf_home_t context. This occurs when user runs 'pip install --user' from root.
+
+contact: Veronika Syncakova <vsyncako@redhat.com>
+component:
+  - selinux-policy
+require:
+  - library(selinux-policy/common)
+recommend:
+  - audit
+  - selinux-policy
+  - python3
+  - python3-pip
+duration: 15m
+enabled: true
+tag:
+  - NoRHEL7
+  - NoRHEL8
+environment:
+    AVC_ERROR: +no_avc_check
+link:
+  - verifies: https://redhat.atlassian.net/browse/RHEL-106483
+adjust+:
+  - enabled: false
+    when: distro < rhel-9
+    continue: false

diff --git a/selinux-policy/rhsmcertd-and-similar/runtest.sh b/selinux-policy/rhsmcertd-and-similar/runtest.sh
new file mode 100755
index 0000000..82942d5
--- /dev/null
+++ b/selinux-policy/rhsmcertd-and-similar/runtest.sh
@@ -0,0 +1,41 @@
+#!/bin/bash
+# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGE="selinux-policy"
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlRun "rlImport 'selinux-policy/common'" 0
+        rlAssertRpm ${PACKAGE}
+        rlAssertRpm ${PACKAGE}-targeted
+
+        rlSESetTimestamp
+
+        # Install required packages
+        rlRun "dnf install -y python3-pip" 0
+        rlFileBackup --clean /root/.local
+    rlPhaseEnd
+
+    rlPhaseStartTest "RHEL-106483"
+        # Create /root/.local/lib/pythonX.Y/site-packages/ with gconf_home_t context
+        rlRun "pip3 install --user abcd" 0 "pip install creates site-packages"
+        SITE_PACKAGES=$(find /root/.local/lib -type d -name "site-packages" 2>/dev/null | head -1)
+        rlAssertExists "${SITE_PACKAGES}"
+
+        # Set SELinux to permissive to log AVCs without blocking
+        rlRun "setenforce 0" 0 "Set SELinux to permissive mode"
+        rlRun "runcon -t rhsmcertd_t -r system_r -u system_u -- /usr/bin/python3 -c 'import sys'" 0
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        # Restore backed up files (removes /root/.local if it didn't exist before)
+        rlFileRestore
+        rlSECheckAVC --ignore 'type=AVC .* entrypoint .*runcon .*:rhsmcertd_t:'
+        # Restore SELinux to enforcing mode
+        rlRun "setenforce 1" 0 "Restore SELinux to enforcing mode"
+
+    rlPhaseEnd
+
+rlJournalEnd