[tests/selinux] pr775-checkpolicy-revdeps: look for additional systemd-sleep rules

[tests/selinux] pr775-checkpolicy-revdeps: look for additional systemd-sleep rules

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 59f9aeedbff2b488c8b54aefcaec66fc99669fdf
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2020-12-03T16:29:23+01:00
            Stats  : +5/-1 in 1 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/59f9aeedbff2b488c8b54aefcaec66fc99669fdf?branch=pr775-checkpolicy-revdeps

            Log:
            look for additional systemd-sleep rules

Additional SELinux denials were found during systemd-sleep testing
process. Unfortunately, SELinux policy rules which fix these denials
were not tested in this TC. Now, they are.

---
diff --git a/selinux-policy/swap-file-and-systemd-access/runtest.sh b/selinux-policy/swap-file-and-systemd-access/runtest.sh
index 84339ff..6ce368d 100755
--- a/selinux-policy/swap-file-and-systemd-access/runtest.sh
+++ b/selinux-policy/swap-file-and-systemd-access/runtest.sh
@@ -64,8 +64,12 @@ rlJournalStart
         rlSEMatchPathCon "/sys/power" "sysfs_t"
         rlSEMatchPathCon "/sys/power/state" "sysfs_t"
         rlSESearchRule "allow systemd_sleep_t swapfile_t : file { append getattr ioctl lock open read write } [ ]"
-        rlSESearchRule "allow systemd_sleep_t systemd_sleep_t : capability { sys_ptrace } [ ]"
+        rlSESearchRule "dontaudit systemd_sleep_t systemd_sleep_t : capability { sys_ptrace } [ ]"
         rlSESearchRule "allow systemd_sleep_t sysfs_t : dir { write } [ ]"
+        rlSESearchRule "allow systemd_sleep_t sysfs_t : file { getattr open write } [ ]"
+        rlSESearchRule "allow systemd_sleep_t systemd_sleep_t : capability { sys_resource } [ ]"
+        rlSESearchRule "allow systemd_sleep_t kmsg_device_t : chr_file { write } [ ]"
+        rlSESearchRule "allow systemd_sleep_t kernel_t : unix_dgram_socket { sendto } [ ]"
     rlPhaseEnd
 
     if rlIsFedora ; then