[tests/selinux] pr775-checkpolicy-revdeps: test if ping can bind an ICMP socket to node_t

[tests/selinux] pr775-checkpolicy-revdeps: test if ping can bind an ICMP socket to node_t

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 8fb3f91a5e25abc6d08512366ff40b2f60a0b99a
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2020-06-23T13:08:58+02:00
            Stats  : +14/-0 in 2 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/8fb3f91a5e25abc6d08512366ff40b2f60a0b99a?branch=pr775-checkpolicy-revdeps

            Log:
            test if ping can bind an ICMP socket to node_t

The ping command recognizes -I option, which allows to
specify either a device name or an address. If an address
is used then ping triggers an SELinux denial and terminates
with one of the following error messages:

  ping: bind: Permission denied
  ping: bind icmp socket: Permission denied

The issue is caused by SELinux policy (too strict) and affects both
confined and unconfined users. This automated TC is able to reproduce
the issue. I believe the issue should be fixed via appropriate allow
rule.

This TC covers bugs: BZ#1803759, BZ#1810403, BZ#1848929.

---
diff --git a/selinux-policy/ping-and-similar/Makefile b/selinux-policy/ping-and-similar/Makefile
index 596183a..5f9f4de 100644
--- a/selinux-policy/ping-and-similar/Makefile
+++ b/selinux-policy/ping-and-similar/Makefile
@@ -64,6 +64,9 @@ $(METADATA): Makefile
 	@echo "Releases:        -RHEL4" >> $(METADATA)
 	@echo "Bug:             1552128" >> $(METADATA) # RHEL-8
 	@echo "Bug:             1596065" >> $(METADATA) # RHEL-7
+	@echo "Bug:             1803759" >> $(METADATA) # Fedora 31
+	@echo "Bug:             1810403" >> $(METADATA) # Fedora 31
+	@echo "Bug:             1848929" >> $(METADATA) # Fedora 33
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/ping-and-similar/runtest.sh b/selinux-policy/ping-and-similar/runtest.sh
index 95df243..83a004f 100755
--- a/selinux-policy/ping-and-similar/runtest.sh
+++ b/selinux-policy/ping-and-similar/runtest.sh
@@ -79,6 +79,15 @@ rlJournalStart
     rlPhaseEnd
     fi
 
+    if rlIsFedora '>=31' ; then
+    rlPhaseStartTest "bz#1803759 + bz#1810403 + bz#1848929"
+        # when unconfined users run ping, there is no transition to ping_t
+        rlSESearchRule "allow unconfined_t node_t : icmp_socket { node_bind } [ ]"
+        # when confined users run ping, a transition to ping_t happens
+        rlSESearchRule "allow ping_t node_t : icmp_socket { node_bind } [ ]"
+    rlPhaseEnd
+    fi
+
     # this phase is useful if you want to run some commands under confined users
     rlPhaseStartTest "real scenario -- confined users"
         rlRun "setsebool ssh_sysadm_login on"
@@ -89,6 +98,7 @@ rlJournalStart
             rlRun "useradd -Z ${SELINUX_USER} ${USER_NAME}"
             rlRun "echo ${USER_SECRET} | passwd --stdin ${USER_NAME}"
             rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost ${FILE_PATH} -w 10 127.0.0.1"
+            rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost ${FILE_PATH} -c1 -W5 -I 0.0.0.0 127.0.0.1"
             rlRun "userdel -rfZ ${USER_NAME}"
         done
         rlRun "setsebool user_ping off"
@@ -98,6 +108,7 @@ rlJournalStart
     # this phase is useful if there is a transition from initrc_t to ${PROCESS_CONTEXT} but there is no initscript or systemd unit file
     rlPhaseStartTest "real scenario -- runcon under root"
         rlRun "runcon system_u:system_r:initrc_t:s0 /bin/bash -c \"${FILE_PATH} -w 10 127.0.0.1\""
+        rlRun "runcon system_u:system_r:initrc_t:s0 /bin/bash -c \"${FILE_PATH} -c1 -W5 -I 0.0.0.0 127.0.0.1\""
     rlPhaseEnd
 
     rlPhaseStartCleanup