[tests/selinux] pr775-checkpolicy-revdeps: test if fapolicyd can read /etc/resolv.conf symlink

[tests/selinux] pr775-checkpolicy-revdeps: test if fapolicyd can read /etc/resolv.conf symlink

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 819dc7ffd2d5a5b40e639e0ed425f0e097f79fb6
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2020-10-08T15:10:36+00:00
            Stats  : +10/-2 in 2 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/819dc7ffd2d5a5b40e639e0ed425f0e097f79fb6?branch=pr775-checkpolicy-revdeps

            Log:
            test if fapolicyd can read /etc/resolv.conf symlink

When /etc/resolv.conf is a symlink and the fapolicyd service is started,
then SELinux denials are triggered, because SELinux policy does not
allow the fapolicyd process to read the symlink. This issue should be
fixed via appropriate allow rule in the fapolicyd-selinux package.

The automated TC looks for appropriate allow rule and it also reproduces
the issue.

This TC covers BZ#1865818.

---
diff --git a/selinux-policy/fapolicyd-and-similar/Makefile b/selinux-policy/fapolicyd-and-similar/Makefile
index b0f3de8..d75d14e 100644
--- a/selinux-policy/fapolicyd-and-similar/Makefile
+++ b/selinux-policy/fapolicyd-and-similar/Makefile
@@ -53,6 +53,7 @@ $(METADATA): Makefile
 	@echo "Description:     SELinux interferes with fapolicyd and related programs" >> $(METADATA)
 	@echo "Type:            Regression" >> $(METADATA)
 	@echo "TestTime:        10m" >> $(METADATA)
+	@echo "RunFor:          fapolicyd" >> $(METADATA)
 	@echo "RunFor:          selinux-policy" >> $(METADATA)
 	@echo "Requires:        audit initscripts libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console fapolicyd fapolicyd-selinux" >> $(METADATA)
 	@echo "RhtsRequires:    library(selinux-policy/common)" >> $(METADATA)
@@ -62,6 +63,7 @@ $(METADATA): Makefile
 	@echo "Confidential:    no" >> $(METADATA)
 	@echo "Destructive:     no" >> $(METADATA)
 	@echo "Releases:        -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA)
+	@echo "Bug:             1865818" >> $(METADATA) # RHEL-8
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/fapolicyd-and-similar/runtest.sh b/selinux-policy/fapolicyd-and-similar/runtest.sh
index 0ed555e..3e69b01 100755
--- a/selinux-policy/fapolicyd-and-similar/runtest.sh
+++ b/selinux-policy/fapolicyd-and-similar/runtest.sh
@@ -57,14 +57,20 @@ rlJournalStart
         sleep 2
     rlPhaseEnd
 
+    rlPhaseStartTest "bz#1865818"
+        rlSEMatchPathCon "/usr/sbin/fapolicyd" ${FILE_CONTEXT}
+        rlSEMatchPathCon "/etc/resolv.conf" "net_conf_t"
+        rlSESearchRule "allow ${PROCESS_CONTEXT} net_conf_t : lnk_file { getattr read } [ ]"
+    rlPhaseEnd
+
     rlPhaseStartTest "real scenario -- standalone service"
         rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root"
         if ! rlSEDefined ${PROCESS_CONTEXT} ; then
-            # for RHELs where the SELinux domain does not exist yet
+            # for OSes where the SELinux domain does not exist yet
             PROCESS_CONTEXT="unconfined_service_t"
         fi
         rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1
-	rlRun "restorecon -Rv /run /var"
+        rlRun "restorecon -Rv /run /var"
         rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1
     rlPhaseEnd