[tests/selinux] pr775-checkpolicy-revdeps: test if usbmuxd can call statfs on /sys filesystem

[tests/selinux] pr775-checkpolicy-revdeps: test if usbmuxd can call statfs on /sys filesystem

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 30ada8fa616fa77e57cd83414ff2871832067bd0
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2021-05-20T10:01:59+00:00
            Stats  : +6/-0 in 2 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/30ada8fa616fa77e57cd83414ff2871832067bd0?branch=pr775-checkpolicy-revdeps

            Log:
            test if usbmuxd can call statfs on /sys filesystem

Recent testing revealed that the usbmuxd service triggers SELinux
denials during its start. SELinux prevented the usbmuxd process
from accessing the /sys filesystem. The TC reproduces the situation.

I believe this access should be allowed in SELinux policy. The TC
looks for appropriate policy rules.

The TC covers BZ#1930992.

---
diff --git a/selinux-policy/usbmuxd-and-similar/Makefile b/selinux-policy/usbmuxd-and-similar/Makefile
index bb52aaf..f960b22 100644
--- a/selinux-policy/usbmuxd-and-similar/Makefile
+++ b/selinux-policy/usbmuxd-and-similar/Makefile
@@ -65,6 +65,7 @@ $(METADATA): Makefile
 	@echo "Releases:        -RHEL4 -RHEL5 -RHEL6" >> $(METADATA)
 	@echo "Bug:             1521054" >> $(METADATA) # RHEL-7
 	@echo "Bug:             1582205" >> $(METADATA) # RHEL-7
+	@echo "Bug:             1930992" >> $(METADATA) # Fedora 33
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/usbmuxd-and-similar/runtest.sh b/selinux-policy/usbmuxd-and-similar/runtest.sh
index 7c9729b..9f63eda 100755
--- a/selinux-policy/usbmuxd-and-similar/runtest.sh
+++ b/selinux-policy/usbmuxd-and-similar/runtest.sh
@@ -75,6 +75,11 @@ rlJournalStart
         rlSESearchRule "allow usbmuxd_t udev_var_run_t : file { getattr open read } [ ]"
     rlPhaseEnd
 
+    rlPhaseStartTest "bz#1930992"
+        rlSEMatchPathCon "/sys" "sysfs_t"
+        rlSESearchRule "allow usbmuxd_t sysfs_t : filesystem { getattr } [ ]"
+    rlPhaseEnd
+
     rlPhaseStartTest "real scenario"
         rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root"
         if ! rlSEDefined ${PROCESS_CONTEXT} ; then