[tests/selinux] pr775-checkpolicy-revdeps: test if confined nfsdcld runs without SELinux denials

[tests/selinux] pr775-checkpolicy-revdeps: test if confined nfsdcld runs without SELinux denials

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 5d4b68dee6a386b4a24cbfc25c5b36504c287223
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2020-09-01T11:14:48+02:00
            Stats  : +9/-0 in 2 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/5d4b68dee6a386b4a24cbfc25c5b36504c287223?branch=pr775-checkpolicy-revdeps

            Log:
            test if confined nfsdcld runs without SELinux denials

The automated TC runs the nfsdcld service and it also checks for
the existence of appropriate SELinux policy rules and definitions.

The TC covers BZ#1834234.

---
diff --git a/selinux-policy/nfsdcld-and-similar/Makefile b/selinux-policy/nfsdcld-and-similar/Makefile
index a0383b2..0de572a 100644
--- a/selinux-policy/nfsdcld-and-similar/Makefile
+++ b/selinux-policy/nfsdcld-and-similar/Makefile
@@ -62,6 +62,7 @@ $(METADATA): Makefile
 	@echo "Confidential:    no" >> $(METADATA)
 	@echo "Destructive:     no" >> $(METADATA)
 	@echo "Releases:        -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA)
+	@echo "Bug:             1834234" >> $(METADATA) # Fedora 32
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/nfsdcld-and-similar/runtest.sh b/selinux-policy/nfsdcld-and-similar/runtest.sh
index e0e64c2..0fd7a54 100755
--- a/selinux-policy/nfsdcld-and-similar/runtest.sh
+++ b/selinux-policy/nfsdcld-and-similar/runtest.sh
@@ -56,6 +56,14 @@ rlJournalStart
         sleep 2
     rlPhaseEnd
 
+    rlPhaseStartTest "bz#1834234"
+        rlSEMatchPathCon "/usr/sbin/nfsdcld" "rpcd_exec_t"
+        rlSESearchRule "allow init_t rpcd_exec_t : file { getattr open read execute } [ ]"
+        rlSESearchRule "type_transition init_t rpcd_exec_t : process rpcd_t"
+        rlSESearchRule "allow init_t rpcd_t : process { transition } [ ]"
+        rlSESearchRule "allow rpcd_t nfsd_fs_t : file { getattr open read } [ ]"
+    rlPhaseEnd
+
     rlPhaseStartTest "real scenario -- standalone service"
         rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root"
         if ! rlSEDefined ${PROCESS_CONTEXT} ; then