[tests/selinux] main: test if virtqemud can execute udevadm

[tests/selinux] main: test if virtqemud can execute udevadm

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : main
            Commit : 534e38f96fde1c88ae9881ffea6c9fc592e82c71
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2026-08-18T13:01:14+00:00
            Stats  : +11/-0 in 3 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/534e38f96fde1c88ae9881ffea6c9fc592e82c71?branch=main

            Log:
            test if virtqemud can execute udevadm

Recent virt-install testing with various USB devices revealed
SELinux denials which are triggered when the virtqemud process
executes the udevadm command. The TC reproduces the situation.

In order to support this functionality, I believe that SELinux
policy should allow the execution and transition to the udev_t
domain. The TC looks for appropriate policy rules and file
context patterns.

The TC covers RHEL-236185.

---
diff --git a/selinux-policy/virt-install-additional/Makefile b/selinux-policy/virt-install-additional/Makefile
index 20b3ae0..1a55b01 100644
--- a/selinux-policy/virt-install-additional/Makefile
+++ b/selinux-policy/virt-install-additional/Makefile
@@ -76,6 +76,7 @@ $(METADATA): Makefile
 	@echo "Bug:             RHEL-76104" >> $(METADATA) # RHEL-10
 	@echo "Bug:             RHEL-98559" >> $(METADATA) # RHEL-10
 	@echo "Bug:             RHEL-101417" >> $(METADATA) # RHEL-10
+	@echo "Bug:             RHEL-236185" >> $(METADATA) # RHEL-10
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/virt-install-additional/main.fmf b/selinux-policy/virt-install-additional/main.fmf
index 38032e7..cdd36ae 100644
--- a/selinux-policy/virt-install-additional/main.fmf
+++ b/selinux-policy/virt-install-additional/main.fmf
@@ -54,6 +54,7 @@ link:
   - verifies: https://issues.redhat.com/browse/RHEL-76104
   - verifies: https://issues.redhat.com/browse/RHEL-98559
   - verifies: https://issues.redhat.com/browse/RHEL-101417
+  - verifies: https://issues.redhat.com/browse/RHEL-236185
 adjust+:
   - enabled: false
     when: distro == rhel-4, rhel-5, rhel-6, rhel-7

diff --git a/selinux-policy/virt-install-additional/runtest.sh b/selinux-policy/virt-install-additional/runtest.sh
index 313e7a4..35afc89 100755
--- a/selinux-policy/virt-install-additional/runtest.sh
+++ b/selinux-policy/virt-install-additional/runtest.sh
@@ -367,6 +367,15 @@ rlJournalStart
         rlRun "service virtqemud stop"
     rlPhaseEnd
 
+    rlPhaseStartTest "RHEL-236185"
+        rlSEMatchPathCon "/usr/bin/udevadm" "udev_exec_t"
+        if seinfo -a | grep -q virt_driver_domain ; then
+            rlSESearchRule "allow virtqemud_t udev_exec_t : file { execute map } [ ]"
+            rlSESearchRule "type_transition virtqemud_t udev_exec_t : process udev_t"
+            rlSESearchRule "allow virtqemud_t udev_t : process { transition } [ ]"
+        fi
+    rlPhaseEnd
+
     rlPhaseStartCleanup
         sleep 2
         rlSECheckAVC