[tests/selinux] pr775-checkpolicy-revdeps: test if fapolicyd can watch* various mount points

[Milos Malik <mmalik@redhat.com>]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 69871d74cc78569e129c2f4b83fc0b06c2984a10
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2021-05-20T10:47:43+00:00
            Stats  : +16/-0 in 2 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/69871d74cc78569e129c2f4b83fc0b06c2984a10?branch=pr775-checkpolicy-revdeps

            Log:
            test if fapolicyd can watch* various mount points

Recent testing of fapolicyd with the latest SELinux policy, which
introduced various watch* permission, revealed that SELinux prevents
the fapolicyd from using fanotify_mark syscall on various mount
points like /dev/shm, /boot etc. The TC reproduces the situation
and it also looks for appropriate policy rules.

I believe these actions should be allowed, because they are expected
from the fapolicyd process.

The TC covers BZ#1932225.

---
diff --git a/selinux-policy/fapolicyd-and-similar/Makefile b/selinux-policy/fapolicyd-and-similar/Makefile
index 5ceb8a2..cdfcfed 100644
--- a/selinux-policy/fapolicyd-and-similar/Makefile
+++ b/selinux-policy/fapolicyd-and-similar/Makefile
@@ -66,6 +66,7 @@ $(METADATA): Makefile
 	@echo "Bug:             1865818" >> $(METADATA) # RHEL-8
 	@echo "Bug:             1874491" >> $(METADATA) # Fedora 33
 	@echo "Bug:             1876538" >> $(METADATA) # Fedora 33
+	@echo "Bug:             1932225" >> $(METADATA)
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/fapolicyd-and-similar/runtest.sh b/selinux-policy/fapolicyd-and-similar/runtest.sh
index 720f008..6709ce5 100755
--- a/selinux-policy/fapolicyd-and-similar/runtest.sh
+++ b/selinux-policy/fapolicyd-and-similar/runtest.sh
@@ -88,6 +88,21 @@ rlJournalStart
         rlSESearchRule "allow fapolicyd_t rpm_var_lib_t : file { create } [ ]"
     rlPhaseEnd
 
+    if seinfo --common file -x | grep -q watch ; then
+    rlPhaseStartTest "bz#1932225"
+        rlSEMatchPathCon "/boot" "boot_t"
+        rlSEMatchPathCon "/" "root_t"
+        rlSEMatchPathCon "/dev/shm" "tmpfs_t"
+        rlSEMatchPathCon "/tmp" "tmp_t"
+        rlSEMatchPathCon "/run/user/0" "user_tmp_t"
+        rlSESearchRule "allow fapolicyd_t boot_t : dir { watch_mount watch_with_perm } [ ]"
+        rlSESearchRule "allow fapolicyd_t root_t : dir { watch_mount watch_with_perm } [ ]"
+        rlSESearchRule "allow fapolicyd_t tmpfs_t : dir { watch_mount watch_with_perm } [ ]"
+        rlSESearchRule "allow fapolicyd_t tmp_t : dir { watch_mount watch_with_perm } [ ]"
+        rlSESearchRule "allow fapolicyd_t user_tmp_t : dir { watch_mount watch_with_perm } [ ]"
+    rlPhaseEnd
+    fi
+
     rlPhaseStartTest "real scenario -- standalone service"
         rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root"
         if ! rlSEDefined ${PROCESS_CONTEXT} ; then