[tests/selinux] pr775-checkpolicy-revdeps: test if systemd-timesyncd can read files in /sys/firmware/efi/efivars

[tests/selinux] pr775-checkpolicy-revdeps: test if systemd-timesyncd can read files in /sys/firmware/efi/efivars

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : ce2e88d63c08ae259ca73bfe51a7c62093e3156b
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2020-09-17T15:00:35+00:00
            Stats  : +5/-0 in 2 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/ce2e88d63c08ae259ca73bfe51a7c62093e3156b?branch=pr775-checkpolicy-revdeps

            Log:
            test if systemd-timesyncd can read files in /sys/firmware/efi/efivars

This automated TC found SELinux denials during testing of systemd-timesyncd
service on a machine where SecureBoot was configured. As of now, SELinux
policy does not allow the systemd-timesyncd process to read files labeled
efivarfs_t (stored in /sys/firmware/efi/efivars directory).

I believe this issue should be fixed in selinux-policy component via
appropriate allow rule.

The automated TC covers BZ#1869979.

---
diff --git a/selinux-policy/systemd-timesyncd-and-similar/Makefile b/selinux-policy/systemd-timesyncd-and-similar/Makefile
index abe7ae7..25410b7 100644
--- a/selinux-policy/systemd-timesyncd-and-similar/Makefile
+++ b/selinux-policy/systemd-timesyncd-and-similar/Makefile
@@ -72,6 +72,7 @@ $(METADATA): Makefile
 	@echo "Bug:             1666222" >> $(METADATA) # Fedora 29
 	@echo "Bug:             1694272" >> $(METADATA) # Fedora 29
 	@echo "Bug:             1822131" >> $(METADATA) # Fedora 32
+	@echo "Bug:             1869979" >> $(METADATA) # RHEL-8
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/systemd-timesyncd-and-similar/runtest.sh b/selinux-policy/systemd-timesyncd-and-similar/runtest.sh
index c4e4251..18950fe 100755
--- a/selinux-policy/systemd-timesyncd-and-similar/runtest.sh
+++ b/selinux-policy/systemd-timesyncd-and-similar/runtest.sh
@@ -98,6 +98,10 @@ rlJournalStart
         rlSESearchRule "allow init_t systemd_timedated_t : process2 { nnp_transition } [ ]"
     rlPhaseEnd
 
+    rlPhaseStartTest "bz#1869979"
+        rlSESearchRule "allow systemd_timedated_t efivarfs_t : file { getattr open read } [ ]"
+    rlPhaseEnd
+
     rlPhaseStartTest "real scenario -- standalone service"
         rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root"
         if ! rlSEDefined ${PROCESS_CONTEXT} ; then