public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
From: Milos Malik <mmalik@redhat.com>
To: git-commits@fedoraproject.org
Subject: [tests/selinux] main: test if virtqemud can execute udevadm
Date: Tue, 18 Aug 2026 13:06:59 GMT [thread overview]
Message-ID: <178705841928.1.13987220599296185332.tests-selinux-534e38f96fde@fedoraproject.org> (raw)
A new commit has been pushed.
Repo : tests/selinux
Branch : main
Commit : 534e38f96fde1c88ae9881ffea6c9fc592e82c71
Author : Milos Malik <mmalik@redhat.com>
Date : 2026-08-18T13:01:14+00:00
Stats : +11/-0 in 3 file(s)
URL : https://src.fedoraproject.org/tests/selinux/c/534e38f96fde1c88ae9881ffea6c9fc592e82c71?branch=main
Log:
test if virtqemud can execute udevadm
Recent virt-install testing with various USB devices revealed
SELinux denials which are triggered when the virtqemud process
executes the udevadm command. The TC reproduces the situation.
In order to support this functionality, I believe that SELinux
policy should allow the execution and transition to the udev_t
domain. The TC looks for appropriate policy rules and file
context patterns.
The TC covers RHEL-236185.
---
diff --git a/selinux-policy/virt-install-additional/Makefile b/selinux-policy/virt-install-additional/Makefile
index 20b3ae0..1a55b01 100644
--- a/selinux-policy/virt-install-additional/Makefile
+++ b/selinux-policy/virt-install-additional/Makefile
@@ -76,6 +76,7 @@ $(METADATA): Makefile
@echo "Bug: RHEL-76104" >> $(METADATA) # RHEL-10
@echo "Bug: RHEL-98559" >> $(METADATA) # RHEL-10
@echo "Bug: RHEL-101417" >> $(METADATA) # RHEL-10
+ @echo "Bug: RHEL-236185" >> $(METADATA) # RHEL-10
rhts-lint $(METADATA)
diff --git a/selinux-policy/virt-install-additional/main.fmf b/selinux-policy/virt-install-additional/main.fmf
index 38032e7..cdd36ae 100644
--- a/selinux-policy/virt-install-additional/main.fmf
+++ b/selinux-policy/virt-install-additional/main.fmf
@@ -54,6 +54,7 @@ link:
- verifies: https://issues.redhat.com/browse/RHEL-76104
- verifies: https://issues.redhat.com/browse/RHEL-98559
- verifies: https://issues.redhat.com/browse/RHEL-101417
+ - verifies: https://issues.redhat.com/browse/RHEL-236185
adjust+:
- enabled: false
when: distro == rhel-4, rhel-5, rhel-6, rhel-7
diff --git a/selinux-policy/virt-install-additional/runtest.sh b/selinux-policy/virt-install-additional/runtest.sh
index 313e7a4..35afc89 100755
--- a/selinux-policy/virt-install-additional/runtest.sh
+++ b/selinux-policy/virt-install-additional/runtest.sh
@@ -367,6 +367,15 @@ rlJournalStart
rlRun "service virtqemud stop"
rlPhaseEnd
+ rlPhaseStartTest "RHEL-236185"
+ rlSEMatchPathCon "/usr/bin/udevadm" "udev_exec_t"
+ if seinfo -a | grep -q virt_driver_domain ; then
+ rlSESearchRule "allow virtqemud_t udev_exec_t : file { execute map } [ ]"
+ rlSESearchRule "type_transition virtqemud_t udev_exec_t : process udev_t"
+ rlSESearchRule "allow virtqemud_t udev_t : process { transition } [ ]"
+ fi
+ rlPhaseEnd
+
rlPhaseStartCleanup
sleep 2
rlSECheckAVC
reply other threads:[~2026-08-18 13:06 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=178705841928.1.13987220599296185332.tests-selinux-534e38f96fde@fedoraproject.org \
--to=mmalik@redhat.com \
--cc=git-commits@fedoraproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox