public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
From: Milos Malik <mmalik@redhat.com>
To: git-commits@fedoraproject.org
Subject: [tests/selinux] pr775-checkpolicy-revdeps: test if rtkit-daemon can do sys_nice in user namespaces
Date: Fri, 11 Sep 2026 13:18:47 GMT [thread overview]
Message-ID: <178913272772.1.3037071813798253913.tests-selinux-7420494018f4@fedoraproject.org> (raw)
A new commit has been pushed.
Repo : tests/selinux
Branch : pr775-checkpolicy-revdeps
Commit : 7420494018f451ed2bb7f25ad0662c3090b4a57f
Author : Milos Malik <mmalik@redhat.com>
Date : 2021-01-29T13:50:37+00:00
Stats : +13/-0 in 2 file(s)
URL : https://src.fedoraproject.org/tests/selinux/c/7420494018f451ed2bb7f25ad0662c3090b4a57f?branch=pr775-checkpolicy-revdeps
Log:
test if rtkit-daemon can do sys_nice in user namespaces
SELinux prevents the rtkit-daemon process from setting nice value.
I believe this access is harmless from security point-of-view and
should be allowed. The TC is not able to reproduce the issue, but it
looks for an appropriate SELinux policy rule.
The TC covers BZ#1750024, BZ#1910507 and other duplicates.
---
diff --git a/selinux-policy/rtkit-daemon-and-similar/Makefile b/selinux-policy/rtkit-daemon-and-similar/Makefile
index a3328e9..4e5588f 100644
--- a/selinux-policy/rtkit-daemon-and-similar/Makefile
+++ b/selinux-policy/rtkit-daemon-and-similar/Makefile
@@ -66,7 +66,15 @@ $(METADATA): Makefile
@echo "Bug: 1626982" >> $(METADATA) # RHEL-7
@echo "Bug: 1703241" >> $(METADATA) # RHEL-8
@echo "Bug: 1720546" >> $(METADATA) # RHEL-7
+ @echo "Bug: 1750024" >> $(METADATA) # Fedora 30
+ @echo "Bug: 1752583" >> $(METADATA) # Fedora 31
+ @echo "Bug: 1754408" >> $(METADATA) # Fedora 30
+ @echo "Bug: 1755572" >> $(METADATA) # Fedora 30
+ @echo "Bug: 1756755" >> $(METADATA) # Fedora 30
+ @echo "Bug: 1758097" >> $(METADATA) # Fedora 30
+ @echo "Bug: 1760214" >> $(METADATA) # Fedora 29
@echo "Bug: 1873658" >> $(METADATA) # RHEL-8
+ @echo "Bug: 1910507" >> $(METADATA) # RHEL-8
rhts-lint $(METADATA)
diff --git a/selinux-policy/rtkit-daemon-and-similar/runtest.sh b/selinux-policy/rtkit-daemon-and-similar/runtest.sh
index a0d647b..b6e88e8 100755
--- a/selinux-policy/rtkit-daemon-and-similar/runtest.sh
+++ b/selinux-policy/rtkit-daemon-and-similar/runtest.sh
@@ -91,6 +91,11 @@ rlJournalStart
rlPhaseStartTest "bz#1873658"
rlSESearchRule "allow rtkit_daemon_t rtkit_daemon_t : cap_userns { sys_ptrace } [ ]"
rlPhaseEnd
+
+ rlPhaseStartTest "bz#1750024 + bz#1910507"
+ # this bug has many duplicates among Fedora bugs
+ rlSESearchRule "allow rtkit_daemon_t rtkit_daemon_t : cap_userns { sys_nice } [ ]"
+ rlPhaseEnd
fi
if ! rlIsRHEL 5 6 ; then
reply other threads:[~2026-09-11 13:18 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=178913272772.1.3037071813798253913.tests-selinux-7420494018f4@fedoraproject.org \
--to=mmalik@redhat.com \
--cc=git-commits@fedoraproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox