[tests/selinux] pr775-checkpolicy-revdeps: test if systemd-sleep can getattr() a partition

[tests/selinux] pr775-checkpolicy-revdeps: test if systemd-sleep can getattr() a partition

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : c0c790f80127dcbdabe73f92ad617fdffcaa6eaa
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2021-03-11T10:54:30+00:00
            Stats  : +7/-0 in 2 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/c0c790f80127dcbdabe73f92ad617fdffcaa6eaa?branch=pr775-checkpolicy-revdeps

            Log:
            test if systemd-sleep can getattr() a partition

Hibernation which uses a swap partition instead of a swap file fails
because SELinux prevents systemd-sleep from getattr operation on the
swap partition. This is a common configuration, which means that
SELinux policy should allow it.

The TC does not reproduce the scenario, it only looks for appropriate
policy rules.

The TC covers BZ#1928539, BZ#1912385, BZ#1926536.

---
diff --git a/selinux-policy/swap-file-and-systemd-access/Makefile b/selinux-policy/swap-file-and-systemd-access/Makefile
index dc3fe58..492b8e8 100644
--- a/selinux-policy/swap-file-and-systemd-access/Makefile
+++ b/selinux-policy/swap-file-and-systemd-access/Makefile
@@ -67,6 +67,9 @@ $(METADATA): Makefile
 	@echo "Bug:             1798872" >> $(METADATA) # RHEL 8
 	@echo "Bug:             1845594" >> $(METADATA) # Fedora 32
 	@echo "Bug:             1850177" >> $(METADATA) # RHEL 8
+	@echo "Bug:             1912385" >> $(METADATA) # Fedora 32
+	@echo "Bug:             1926536" >> $(METADATA) # RHEL 9
+	@echo "Bug:             1928539" >> $(METADATA) # Fedora 32
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/swap-file-and-systemd-access/runtest.sh b/selinux-policy/swap-file-and-systemd-access/runtest.sh
index 6ce368d..4a60b43 100755
--- a/selinux-policy/swap-file-and-systemd-access/runtest.sh
+++ b/selinux-policy/swap-file-and-systemd-access/runtest.sh
@@ -79,6 +79,10 @@ rlJournalStart
     rlPhaseEnd
     fi
 
+    rlPhaseStartTest "bz#1912385 + bz#1926536 + bz#1928539"
+        rlSESearchRule "allow systemd_sleep_t fixed_disk_device_t : blk_file { getattr } [ ]"
+    rlPhaseEnd
+
     if ${REAL_SCENARIOS} ; then
     rlPhaseStartTest "real scenario"
         rlRun "rm -f /swapfile"