[tests/selinux] pr775-checkpolicy-revdeps: test if rpmdb can read /etc/resolv.conf symlink

[tests/selinux] pr775-checkpolicy-revdeps: test if rpmdb can read /etc/resolv.conf symlink

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 90f769d4b40023fecf05e4455ca3deb9970966eb
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2020-11-25T08:37:47+00:00
            Stats  : +7/-0 in 2 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/90f769d4b40023fecf05e4455ca3deb9970966eb?branch=pr775-checkpolicy-revdeps

            Log:
            test if rpmdb can read /etc/resolv.conf symlink

The rpmdb process executed by the rpmdb-rebuild service wants to
read the /etc/resolv.conf symlink, but SELinux denies that access,
because SELinux policy does not allow that. This TC is able to
reproduce the issue.

I believe this issue should be fixed in selinux-policy component
via appropriate allow rule.

The TC covers BZ#1898298.

---
diff --git a/selinux-policy/rpmdb-and-similar/Makefile b/selinux-policy/rpmdb-and-similar/Makefile
index db3b9b1..c5c0dea 100644
--- a/selinux-policy/rpmdb-and-similar/Makefile
+++ b/selinux-policy/rpmdb-and-similar/Makefile
@@ -62,6 +62,7 @@ $(METADATA): Makefile
 	@echo "Confidential:    no" >> $(METADATA)
 	@echo "Destructive:     no" >> $(METADATA)
 	@echo "Releases:        -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA)
+	@echo "Bug:             1898298" >> $(METADATA) # Fedora 33
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/rpmdb-and-similar/runtest.sh b/selinux-policy/rpmdb-and-similar/runtest.sh
index 18cd66d..50f1b3e 100755
--- a/selinux-policy/rpmdb-and-similar/runtest.sh
+++ b/selinux-policy/rpmdb-and-similar/runtest.sh
@@ -54,6 +54,12 @@ rlJournalStart
         sleep 2
     rlPhaseEnd
 
+    rlPhaseStartTest "bz#1898298"
+        rlSEMatchPathCon "/usr/bin/rpmdb" "rpmdb_exec_t"
+        rlSEMatchPathCon "/etc/resolv.conf" "net_conf_t"
+        rlSESearchRule "allow rpmdb_t net_conf_t : lnk_file { getattr read } [ ]"
+    rlPhaseEnd
+
     rlPhaseStartTest "real scenario -- standalone service"
         rlRun "touch /var/lib/rpm/.rebuilddb"
         rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} - ${PROCESS_CONTEXT} "start status" 1