[tests/selinux] pr775-checkpolicy-revdeps: test if unconfined process can lockdown kernel for integrity purposes

[tests/selinux] pr775-checkpolicy-revdeps: test if unconfined process can lockdown kernel for integrity purposes

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : f422258a047a9f4568b7326e9db771a579122841
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2021-05-13T13:00:14+00:00
            Stats  : +6/-0 in 2 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/f422258a047a9f4568b7326e9db771a579122841?branch=pr775-checkpolicy-revdeps

            Log:
            test if unconfined process can lockdown kernel for integrity purposes

SELinux policy recently introduced a new lockdown class which contains
2 permissions: integrity and confidentiality.
As you know, processes labeled as unconfined_t should be allowed to
use all permissions from all classes, because they are not confined.
Unfortunately, our internal testing revealed that processes running
as unconfined_t are not allowed to use integrity permission.

The TC does not reproduce the scenario, it only checks the existence
of appropriate allow rules.

The TC covers BZ#1929332 and BZ#1933134.

---
diff --git a/selinux-policy/lockdown-class/Makefile b/selinux-policy/lockdown-class/Makefile
index 5d3e856..135635d 100644
--- a/selinux-policy/lockdown-class/Makefile
+++ b/selinux-policy/lockdown-class/Makefile
@@ -63,6 +63,8 @@ $(METADATA): Makefile
 	@echo "Destructive:     no" >> $(METADATA)
 	@echo "Releases:        -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA)
 	@echo "Bug:             1915184" >> $(METADATA) # Fedora rawhide
+	@echo "Bug:             1929332" >> $(METADATA) # RHEL-9
+	@echo "Bug:             1933134" >> $(METADATA) # RHEL-9
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/lockdown-class/runtest.sh b/selinux-policy/lockdown-class/runtest.sh
index 09efc90..a8376a2 100755
--- a/selinux-policy/lockdown-class/runtest.sh
+++ b/selinux-policy/lockdown-class/runtest.sh
@@ -51,6 +51,10 @@ rlJournalStart
         rlRun "seinfo -c lockdown -x | grep integrity"
     rlPhaseEnd
 
+    rlPhaseStartTest "bz#1929332 + bz#1933134"
+        rlSESearchRule "allow unconfined_t unconfined_t : lockdown { integrity } [ ]"
+    rlPhaseEnd
+
     rlPhaseStartCleanup
         sleep 2
         rlSECheckAVC