[tests/selinux] pr775-checkpolicy-revdeps: test if fapolicyd can create /var/lib/rpm/.dbenv.lock

[Milos Malik <mmalik@redhat.com>]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : de4d98d2e8fe9048c850267500b1342fa7a3eaf9
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2020-11-02T08:12:02+00:00
            Stats  : +9/-0 in 2 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/de4d98d2e8fe9048c850267500b1342fa7a3eaf9?branch=pr775-checkpolicy-revdeps

            Log:
            test if fapolicyd can create /var/lib/rpm/.dbenv.lock

Recent testing of the fapolicyd service revealed that the service
wants to write to /var/lib/rpm directory and create .dbenv.lock
file there. This action was denied by SELinux because the SELinux policy
brought by fapolicyd is missing an appropriate rule.

I believe this access should be allowed because the fapolicyd service
uses a rpmdb backend which is responsible for such activity.

The automated TC checks if appropriate policy rules are present, but it
does not reproduce the issue (it only appears during a reboot).

The TC covers BZ#1876538.

---
diff --git a/selinux-policy/fapolicyd-and-similar/Makefile b/selinux-policy/fapolicyd-and-similar/Makefile
index aa9fa7a..5ceb8a2 100644
--- a/selinux-policy/fapolicyd-and-similar/Makefile
+++ b/selinux-policy/fapolicyd-and-similar/Makefile
@@ -65,6 +65,7 @@ $(METADATA): Makefile
 	@echo "Releases:        -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA)
 	@echo "Bug:             1865818" >> $(METADATA) # RHEL-8
 	@echo "Bug:             1874491" >> $(METADATA) # Fedora 33
+	@echo "Bug:             1876538" >> $(METADATA) # Fedora 33
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/fapolicyd-and-similar/runtest.sh b/selinux-policy/fapolicyd-and-similar/runtest.sh
index f8ed470..6c48848 100755
--- a/selinux-policy/fapolicyd-and-similar/runtest.sh
+++ b/selinux-policy/fapolicyd-and-similar/runtest.sh
@@ -72,6 +72,14 @@ rlJournalStart
         rlSESearchRule "allow system_dbusd_t fapolicyd_t : dbus { send_msg } [ ]"
     rlPhaseEnd
 
+    rlPhaseStartTest "bz#1876538"
+        rlSEMatchPathCon "/usr/sbin/fapolicyd" ${FILE_CONTEXT}
+        rlSEMatchPathCon "/var/lib/rpm" "rpm_var_lib_t"
+        rlSEMatchPathCon "/var/lib/rpm/.dbenv.lock" "rpm_var_lib_t"
+        rlSESearchRule "allow fapolicyd_t rpm_var_lib_t : dir { write add_name } [ ]"
+        rlSESearchRule "allow fapolicyd_t rpm_var_lib_t : file { create } [ ]"
+    rlPhaseEnd
+
     rlPhaseStartTest "real scenario -- standalone service"
         rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root"
         if ! rlSEDefined ${PROCESS_CONTEXT} ; then