[tests/selinux] pr775-checkpolicy-revdeps: test if rpmdb can talk to D-bus and SSSD processes

[tests/selinux] pr775-checkpolicy-revdeps: test if rpmdb can talk to D-bus and SSSD processes

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 430d838dd584b67c868725dc0e7e9218babbfd6c
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2020-12-01T13:03:32+00:00
            Stats  : +28/-1 in 2 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/430d838dd584b67c868725dc0e7e9218babbfd6c?branch=pr775-checkpolicy-revdeps

            Log:
            test if rpmdb can talk to D-bus and SSSD processes

When 'rpmdb --help' is executed in console, there is no output
displayed because of SELinux denials. This issue should be fixed
in SELinux policy via appropriate allow rules.

When 'rpmdb --exportdb' is executed, SELinux denials appear again,
but this time they are related to communication with SSSD and D-bus
daemon. This issue should be fixed in SELinux policy via dontaudit
rules because the access to D-bus and SSSD processes is not necessary
for successful run of rpmdb.

The TC covers BZ#1899548 and its duplicates.

---
diff --git a/selinux-policy/rpmdb-and-similar/Makefile b/selinux-policy/rpmdb-and-similar/Makefile
index c5c0dea..f7d2876 100644
--- a/selinux-policy/rpmdb-and-similar/Makefile
+++ b/selinux-policy/rpmdb-and-similar/Makefile
@@ -54,7 +54,7 @@ $(METADATA): Makefile
 	@echo "Type:            Regression" >> $(METADATA)
 	@echo "TestTime:        10m" >> $(METADATA)
 	@echo "RunFor:          selinux-policy" >> $(METADATA)
-	@echo "Requires:        audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console initscripts" >> $(METADATA)
+	@echo "Requires:        audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console initscripts sssd" >> $(METADATA)
 	@echo "RhtsRequires:    library(selinux-policy/common)" >> $(METADATA)
 	@echo "Environment:     AVC_ERROR=+no_avc_check" >> $(METADATA)
 	@echo "Priority:        Normal" >> $(METADATA)
@@ -63,6 +63,12 @@ $(METADATA): Makefile
 	@echo "Destructive:     no" >> $(METADATA)
 	@echo "Releases:        -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA)
 	@echo "Bug:             1898298" >> $(METADATA) # Fedora 33
+	@echo "Bug:             1899548" >> $(METADATA) # Fedora 33
+	@echo "Bug:             1900383" >> $(METADATA) # Fedora 33
+	@echo "Bug:             1900386" >> $(METADATA) # Fedora 33
+	@echo "Bug:             1900388" >> $(METADATA) # Fedora 33
+	@echo "Bug:             1900390" >> $(METADATA) # Fedora 33
+	@echo "Bug:             1900391" >> $(METADATA) # Fedora 33
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/rpmdb-and-similar/runtest.sh b/selinux-policy/rpmdb-and-similar/runtest.sh
index a40bd81..b4187f8 100755
--- a/selinux-policy/rpmdb-and-similar/runtest.sh
+++ b/selinux-policy/rpmdb-and-similar/runtest.sh
@@ -48,6 +48,7 @@ rlJournalStart
         rlAssertRpm ${SERVICE_PACKAGE}
 
         rlServiceStop ${SERVICE_NAME}
+        rlServiceStart sssd
         rlFileBackup /var/lib/rpm
 
         rlSESetEnforce
@@ -62,6 +63,22 @@ rlJournalStart
         rlSESearchRule "allow rpmdb_t net_conf_t : lnk_file { getattr read } [ ]"
     rlPhaseEnd
 
+    rlPhaseStartTest "bz#1899548"
+        # also covers duplicates: 1900383, 1900386, 1900388, 1900389, 1900390, 1900391
+        rlSEMatchPathCon "/usr/bin/rpmdb" "rpmdb_exec_t"
+        rlSEMatchPathCon "/var/lib/sss/mc/passwd" "sssd_public_t"
+        rlSEMatchPathCon "/var/lib/sss/pipes/nss" "sssd_var_lib_t"
+        rlSEMatchPathCon "/run/dbus/system_bus_socket" "system_dbusd_var_run_t"
+        rlSESearchRule "allow rpmdb_t user_devpts_t : chr_file { read write } [ ]"
+        rlSESearchRule "dontaudit rpmdb_t sssd_public_t : file { getattr open map } [ ]"
+        rlSESearchRule "dontaudit rpmdb_t sssd_var_lib_t : sock_file { write } [ ]"
+        rlSESearchRule "dontaudit rpmdb_t sssd_t : unix_stream_socket { connectto } [ ]"
+        rlSESearchRule "dontaudit rpmdb_t system_dbusd_var_run_t : sock_file { write } [ ]"
+        rlSESearchRule "dontaudit rpmdb_t system_dbusd_t : unix_stream_socket { connectto } [ ]"
+        rlSESearchRule "dontaudit rpmdb_t system_dbusd_t : dbus { send_msg } [ ]"
+        rlSESearchRule "dontaudit system_dbusd_t rpmdb_t : dbus { send_msg } [ ]"
+    rlPhaseEnd
+
     rlPhaseStartTest "real scenario -- standalone service"
         rlRun "touch /var/lib/rpm/.rebuilddb"
         rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} - ${PROCESS_CONTEXT} "start status" 1
@@ -71,7 +88,9 @@ rlJournalStart
     rlPhaseEnd
 
     rlPhaseStartTest "rpmdb executed by root/unconfined_t"
+        rlRun "semodule -DB"
         rlRun "restorecon -Rv /var/lib/rpm"
+        rlRun "ls -Z `which rpmdb`"
         rlRun "rpmdb --help"
         OUTPUT_FILE=`mktemp`
         rlRun "rpmdb --exportdb >& ${OUTPUT_FILE}"
@@ -82,6 +101,7 @@ rlJournalStart
         rlRun "ls -dZ /var/lib/rpm | grep :rpm_var_lib_t"
         rlRun "ls -Z /var/lib/rpm"
         rm -f ${OUTPUT_FILE}
+        rlRun "semodule -B"
     rlPhaseEnd
 
     rlPhaseStartCleanup
@@ -90,6 +110,7 @@ rlJournalStart
 
         rlFileRestore
         rlServiceRestore ${SERVICE_NAME}
+        rlServiceRestore sssd
     rlPhaseEnd
 rlJournalPrintText
 rlJournalEnd