[tests/selinux] pr775-checkpolicy-revdeps: test if systemd-sleep can sys_ptrace and write to sysfs_t

[tests/selinux] pr775-checkpolicy-revdeps: test if systemd-sleep can sys_ptrace and write to sysfs_t

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : d0c19396bda35e0d8c7e02a5cfc440e141416196
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2020-12-01T18:36:45+00:00
            Stats  : +6/-1 in 2 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/d0c19396bda35e0d8c7e02a5cfc440e141416196?branch=pr775-checkpolicy-revdeps

            Log:
            test if systemd-sleep can sys_ptrace and write to sysfs_t

Recent testing of the new policy for the system-sleep program revealed,
that the program wants the sys_ptrace capability and it also wants to
write to /sys/power directory. Unfortunately, these actions are prevented
by SELinux because SELinux policy does not contain appropriate allow
rules.

This automated TC checks for appropriate SELinux policy rules and it
also reproduces the issue.

This TC covers BZ#1850177.

---
diff --git a/selinux-policy/swap-file-and-systemd-access/Makefile b/selinux-policy/swap-file-and-systemd-access/Makefile
index 786c0d0..dc3fe58 100644
--- a/selinux-policy/swap-file-and-systemd-access/Makefile
+++ b/selinux-policy/swap-file-and-systemd-access/Makefile
@@ -66,6 +66,7 @@ $(METADATA): Makefile
 	@echo "Bug:             1797543" >> $(METADATA) # Fedora 31
 	@echo "Bug:             1798872" >> $(METADATA) # RHEL 8
 	@echo "Bug:             1845594" >> $(METADATA) # Fedora 32
+	@echo "Bug:             1850177" >> $(METADATA) # RHEL 8
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/swap-file-and-systemd-access/runtest.sh b/selinux-policy/swap-file-and-systemd-access/runtest.sh
index 920eee1..fbebe5b 100755
--- a/selinux-policy/swap-file-and-systemd-access/runtest.sh
+++ b/selinux-policy/swap-file-and-systemd-access/runtest.sh
@@ -60,9 +60,13 @@ rlJournalStart
         rlSESearchRule "allow init_t swapfile_t : file { getattr } [ ]"
     rlPhaseEnd
 
-    rlPhaseStartTest "bz#1797543 + bz#1798872"
+    rlPhaseStartTest "bz#1797543 + bz#1798872 + bz#1850177"
         rlSEMatchPathCon "/usr/lib/systemd/systemd-sleep" "systemd_sleep_exec_t"
+        rlSEMatchPathCon "/sys/power" "sysfs_t"
+        rlSEMatchPathCon "/sys/power/state" "sysfs_t"
         rlSESearchRule "allow systemd_sleep_t swapfile_t : file { append getattr ioctl lock open read write } [ ]"
+        rlSESearchRule "allow systemd_sleep_t systemd_sleep_t : capability { sys_ptrace } [ ]"
+        rlSESearchRule "allow systemd_sleep_t sysfs_t : dir { write } [ ]"
     rlPhaseEnd
 
     rlPhaseStartTest "bz#1845594"