public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
From: Milos Malik <mmalik@redhat.com>
To: git-commits@fedoraproject.org
Subject: [tests/selinux] pr775-checkpolicy-revdeps: test if systemd-sleep can sys_ptrace and write to sysfs_t
Date: Fri, 11 Sep 2026 13:18:30 GMT [thread overview]
Message-ID: <178913271081.1.4469955072579340704.tests-selinux-d0c19396bda3@fedoraproject.org> (raw)
A new commit has been pushed.
Repo : tests/selinux
Branch : pr775-checkpolicy-revdeps
Commit : d0c19396bda35e0d8c7e02a5cfc440e141416196
Author : Milos Malik <mmalik@redhat.com>
Date : 2020-12-01T18:36:45+00:00
Stats : +6/-1 in 2 file(s)
URL : https://src.fedoraproject.org/tests/selinux/c/d0c19396bda35e0d8c7e02a5cfc440e141416196?branch=pr775-checkpolicy-revdeps
Log:
test if systemd-sleep can sys_ptrace and write to sysfs_t
Recent testing of the new policy for the system-sleep program revealed,
that the program wants the sys_ptrace capability and it also wants to
write to /sys/power directory. Unfortunately, these actions are prevented
by SELinux because SELinux policy does not contain appropriate allow
rules.
This automated TC checks for appropriate SELinux policy rules and it
also reproduces the issue.
This TC covers BZ#1850177.
---
diff --git a/selinux-policy/swap-file-and-systemd-access/Makefile b/selinux-policy/swap-file-and-systemd-access/Makefile
index 786c0d0..dc3fe58 100644
--- a/selinux-policy/swap-file-and-systemd-access/Makefile
+++ b/selinux-policy/swap-file-and-systemd-access/Makefile
@@ -66,6 +66,7 @@ $(METADATA): Makefile
@echo "Bug: 1797543" >> $(METADATA) # Fedora 31
@echo "Bug: 1798872" >> $(METADATA) # RHEL 8
@echo "Bug: 1845594" >> $(METADATA) # Fedora 32
+ @echo "Bug: 1850177" >> $(METADATA) # RHEL 8
rhts-lint $(METADATA)
diff --git a/selinux-policy/swap-file-and-systemd-access/runtest.sh b/selinux-policy/swap-file-and-systemd-access/runtest.sh
index 920eee1..fbebe5b 100755
--- a/selinux-policy/swap-file-and-systemd-access/runtest.sh
+++ b/selinux-policy/swap-file-and-systemd-access/runtest.sh
@@ -60,9 +60,13 @@ rlJournalStart
rlSESearchRule "allow init_t swapfile_t : file { getattr } [ ]"
rlPhaseEnd
- rlPhaseStartTest "bz#1797543 + bz#1798872"
+ rlPhaseStartTest "bz#1797543 + bz#1798872 + bz#1850177"
rlSEMatchPathCon "/usr/lib/systemd/systemd-sleep" "systemd_sleep_exec_t"
+ rlSEMatchPathCon "/sys/power" "sysfs_t"
+ rlSEMatchPathCon "/sys/power/state" "sysfs_t"
rlSESearchRule "allow systemd_sleep_t swapfile_t : file { append getattr ioctl lock open read write } [ ]"
+ rlSESearchRule "allow systemd_sleep_t systemd_sleep_t : capability { sys_ptrace } [ ]"
+ rlSESearchRule "allow systemd_sleep_t sysfs_t : dir { write } [ ]"
rlPhaseEnd
rlPhaseStartTest "bz#1845594"
reply other threads:[~2026-09-11 13:18 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=178913271081.1.4469955072579340704.tests-selinux-d0c19396bda3@fedoraproject.org \
--to=mmalik@redhat.com \
--cc=git-commits@fedoraproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox