[tests/selinux] pr775-checkpolicy-revdeps: test if systemd-timesyncd can watch the / directory

[tests/selinux] pr775-checkpolicy-revdeps: test if systemd-timesyncd can watch the / directory

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : ca4b8c77c1f3afd237b06bf05bc3df8d19f12188
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2021-04-28T06:34:56+00:00
            Stats  : +8/-0 in 2 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/ca4b8c77c1f3afd237b06bf05bc3df8d19f12188?branch=pr775-checkpolicy-revdeps

            Log:
            test if systemd-timesyncd can watch the / directory

Recent testing revealed, that systemd-timesyncd service wants to
use the inotify_add_watch syscall on the root directory during boot.
Unfortunately, SELinux policy denies that access.
I believe that the access is harmless and should be allowed.
The TC looks for appropriate policy rule.

The TC covers BZ#1949315.

---
diff --git a/selinux-policy/systemd-timesyncd-and-similar/Makefile b/selinux-policy/systemd-timesyncd-and-similar/Makefile
index 25410b7..e47a5c9 100644
--- a/selinux-policy/systemd-timesyncd-and-similar/Makefile
+++ b/selinux-policy/systemd-timesyncd-and-similar/Makefile
@@ -73,6 +73,7 @@ $(METADATA): Makefile
 	@echo "Bug:             1694272" >> $(METADATA) # Fedora 29
 	@echo "Bug:             1822131" >> $(METADATA) # Fedora 32
 	@echo "Bug:             1869979" >> $(METADATA) # RHEL-8
+	@echo "Bug:             1949315" >> $(METADATA) # Fedora 34
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/systemd-timesyncd-and-similar/runtest.sh b/selinux-policy/systemd-timesyncd-and-similar/runtest.sh
index 18950fe..9fc18cf 100755
--- a/selinux-policy/systemd-timesyncd-and-similar/runtest.sh
+++ b/selinux-policy/systemd-timesyncd-and-similar/runtest.sh
@@ -102,6 +102,13 @@ rlJournalStart
         rlSESearchRule "allow systemd_timedated_t efivarfs_t : file { getattr open read } [ ]"
     rlPhaseEnd
 
+    rlPhaseStartTest "bz#1949315"
+        rlSEMatchPathCon "/" "root_t"
+        rlSEMatchPathCon "/run" "var_run_t"
+        rlSESearchRule "allow systemd_timedated_t root_t : dir { watch } [ ]"
+        rlSESearchRule "allow systemd_timedated_t var_run_t : dir { watch } [ ]"
+    rlPhaseEnd
+
     rlPhaseStartTest "real scenario -- standalone service"
         rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root"
         if ! rlSEDefined ${PROCESS_CONTEXT} ; then