[tests/selinux] pr775-checkpolicy-revdeps: test if usbmuxd can access /proc/1/environ file

[tests/selinux] pr775-checkpolicy-revdeps: test if usbmuxd can access /proc/1/environ file

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : bcdbcff58c78061b5df757024ce26f7fc2c4f080
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2021-05-20T10:01:59+00:00
            Stats  : +8/-0 in 2 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/bcdbcff58c78061b5df757024ce26f7fc2c4f080?branch=pr775-checkpolicy-revdeps

            Log:
            test if usbmuxd can access /proc/1/environ file

Recent testing revealed that the usbmuxd service triggers SELinux
denials during its start. SELinux prevented the usbmuxd process
from accessing the /proc/1/environ file. The TC reproduces the
situation.

I believe this access should be dontaudited in SELinux policy,
because it is not necessary. The TC looks for appropriate policy
rules.

The TC covers BZ#1959747.

---
diff --git a/selinux-policy/usbmuxd-and-similar/Makefile b/selinux-policy/usbmuxd-and-similar/Makefile
index c05b47b..d397168 100644
--- a/selinux-policy/usbmuxd-and-similar/Makefile
+++ b/selinux-policy/usbmuxd-and-similar/Makefile
@@ -67,6 +67,7 @@ $(METADATA): Makefile
 	@echo "Bug:             1582205" >> $(METADATA) # RHEL-7
 	@echo "Bug:             1930992" >> $(METADATA) # Fedora 33
 	@echo "Bug:             1936705" >> $(METADATA) # Fedora 34
+	@echo "Bug:             1959747" >> $(METADATA) # Fedora 35
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/usbmuxd-and-similar/runtest.sh b/selinux-policy/usbmuxd-and-similar/runtest.sh
index 2905f19..b94e525 100755
--- a/selinux-policy/usbmuxd-and-similar/runtest.sh
+++ b/selinux-policy/usbmuxd-and-similar/runtest.sh
@@ -85,6 +85,13 @@ rlJournalStart
         rlSESearchRule "allow usbmuxd_t cgroup_t : filesystem { getattr } [ ]"
     rlPhaseEnd
 
+    rlPhaseStartTest "bz#1959747"
+        rlRun "ls -dZ /proc/1 | grep :init_t"
+        rlRun "ls -Z /proc/1/environ | grep :init_t"
+        rlSESearchRule "dontaudit usbmuxd_t init_t : dir { search } [ ]"
+        rlSESearchRule "dontaudit usbmuxd_t init_t : file { getattr open read ioctl } [ ]"
+    rlPhaseEnd
+
     rlPhaseStartTest "real scenario"
         rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root"
         if ! rlSEDefined ${PROCESS_CONTEXT} ; then