public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
From: Milos Malik <mmalik@redhat.com>
To: git-commits@fedoraproject.org
Subject: [tests/selinux] pr775-checkpolicy-revdeps: test if systemd-modules-load can read files under /sys/firmware/efi
Date: Fri, 11 Sep 2026 13:18:59 GMT [thread overview]
Message-ID: <178913273933.1.13902650058247775978.tests-selinux-caadab746cf0@fedoraproject.org> (raw)
A new commit has been pushed.
Repo : tests/selinux
Branch : pr775-checkpolicy-revdeps
Commit : caadab746cf0b1dae4b089426462227476d72c3e
Author : Milos Malik <mmalik@redhat.com>
Date : 2021-04-16T09:23:56+02:00
Stats : +11/-0 in 2 file(s)
URL : https://src.fedoraproject.org/tests/selinux/c/caadab746cf0b1dae4b089426462227476d72c3e?branch=pr775-checkpolicy-revdeps
Log:
test if systemd-modules-load can read files under /sys/firmware/efi
According to several BZ reports, the systemd-modules-load program
wants to read /sys/firmware/efi/efivars/SecureBoot-* files.
Unfortunately, SELinux policy denies that access.
The TC reproduces the issue on machines where the EFI variable FS
is mounted (the /sys/firmware/efi/efivars/ directory exists).
I believe the access is needed for correct function of the
systemd-modules-load service. The TC looks for appropriate
policy rule.
The TC covers BZ#1819161 and its duplicates.
---
diff --git a/selinux-policy/systemd-modules-load-and-similar/Makefile b/selinux-policy/systemd-modules-load-and-similar/Makefile
index aeca98e..97e3bb3 100644
--- a/selinux-policy/systemd-modules-load-and-similar/Makefile
+++ b/selinux-policy/systemd-modules-load-and-similar/Makefile
@@ -74,7 +74,12 @@ $(METADATA): Makefile
@echo "Bug: 1697632" >> $(METADATA) # Fedora 30
@echo "Bug: 1698200" >> $(METADATA) # Fedora 30
@echo "Bug: 1699559" >> $(METADATA) # Fedora 30
+ @echo "Bug: 1819161" >> $(METADATA) # Fedora 32
@echo "Bug: 1823246" >> $(METADATA) # RHEL-8
+ @echo "Bug: 1824196" >> $(METADATA) # Fedora 32
+ @echo "Bug: 1829700" >> $(METADATA) # Fedora 32
+ @echo "Bug: 1833502" >> $(METADATA) # Fedora 32
+ @echo "Bug: 1838933" >> $(METADATA) # Fedora 32
rhts-lint $(METADATA)
diff --git a/selinux-policy/systemd-modules-load-and-similar/runtest.sh b/selinux-policy/systemd-modules-load-and-similar/runtest.sh
index b345047..4c896ba 100755
--- a/selinux-policy/systemd-modules-load-and-similar/runtest.sh
+++ b/selinux-policy/systemd-modules-load-and-similar/runtest.sh
@@ -99,6 +99,12 @@ rlJournalStart
rlSESearchRule "allow systemd_modules_load_t bin_t : file { execute execute_no_trans map } [ ]"
rlPhaseEnd
+ rlPhaseStartTest "bz#1819161 + bz#1824196 + bz#1829700 + bz#1833502 + bz#1838933"
+ rlSEMatchPathCon "/sys/firmware/efi" "efivarfs_t"
+ rlSESearchRule "allow systemd_modules_load_t efivarfs_t : file { getattr open read } [ ]"
+ rlSESearchRule "allow systemd_resolved_t efivarfs_t : file { getattr open read } [ ]"
+ rlPhaseEnd
+
rlPhaseStartTest "real scenario -- standalone service"
rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root"
rlRun "echo ${KERNEL_MODULE} > /etc/modules-load.d/${KERNEL_MODULE}.conf"
reply other threads:[~2026-09-11 13:18 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=178913273933.1.13902650058247775978.tests-selinux-caadab746cf0@fedoraproject.org \
--to=mmalik@redhat.com \
--cc=git-commits@fedoraproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox