[tests/selinux] pr775-checkpolicy-revdeps: test if rtkit-daemon can do sys_nice in user namespaces

[tests/selinux] pr775-checkpolicy-revdeps: test if rtkit-daemon can do sys_nice in user namespaces

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 7420494018f451ed2bb7f25ad0662c3090b4a57f
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2021-01-29T13:50:37+00:00
            Stats  : +13/-0 in 2 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/7420494018f451ed2bb7f25ad0662c3090b4a57f?branch=pr775-checkpolicy-revdeps

            Log:
            test if rtkit-daemon can do sys_nice in user namespaces

SELinux prevents the rtkit-daemon process from setting nice value.
I believe this access is harmless from security point-of-view and
should be allowed. The TC is not able to reproduce the issue, but it
looks for an appropriate SELinux policy rule.

The TC covers BZ#1750024, BZ#1910507 and other duplicates.

---
diff --git a/selinux-policy/rtkit-daemon-and-similar/Makefile b/selinux-policy/rtkit-daemon-and-similar/Makefile
index a3328e9..4e5588f 100644
--- a/selinux-policy/rtkit-daemon-and-similar/Makefile
+++ b/selinux-policy/rtkit-daemon-and-similar/Makefile
@@ -66,7 +66,15 @@ $(METADATA): Makefile
 	@echo "Bug:             1626982" >> $(METADATA) # RHEL-7
 	@echo "Bug:             1703241" >> $(METADATA) # RHEL-8
 	@echo "Bug:             1720546" >> $(METADATA) # RHEL-7
+	@echo "Bug:             1750024" >> $(METADATA) # Fedora 30
+	@echo "Bug:             1752583" >> $(METADATA) # Fedora 31
+	@echo "Bug:             1754408" >> $(METADATA) # Fedora 30
+	@echo "Bug:             1755572" >> $(METADATA) # Fedora 30
+	@echo "Bug:             1756755" >> $(METADATA) # Fedora 30
+	@echo "Bug:             1758097" >> $(METADATA) # Fedora 30
+	@echo "Bug:             1760214" >> $(METADATA) # Fedora 29
 	@echo "Bug:             1873658" >> $(METADATA) # RHEL-8
+	@echo "Bug:             1910507" >> $(METADATA) # RHEL-8
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/rtkit-daemon-and-similar/runtest.sh b/selinux-policy/rtkit-daemon-and-similar/runtest.sh
index a0d647b..b6e88e8 100755
--- a/selinux-policy/rtkit-daemon-and-similar/runtest.sh
+++ b/selinux-policy/rtkit-daemon-and-similar/runtest.sh
@@ -91,6 +91,11 @@ rlJournalStart
     rlPhaseStartTest "bz#1873658"
         rlSESearchRule "allow rtkit_daemon_t rtkit_daemon_t : cap_userns { sys_ptrace } [ ]"
     rlPhaseEnd
+
+    rlPhaseStartTest "bz#1750024 + bz#1910507"
+        # this bug has many duplicates among Fedora bugs
+        rlSESearchRule "allow rtkit_daemon_t rtkit_daemon_t : cap_userns { sys_nice } [ ]"
+    rlPhaseEnd
     fi
 
     if ! rlIsRHEL 5 6 ; then