public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
From: Milos Malik <mmalik@redhat.com>
To: git-commits@fedoraproject.org
Subject: [tests/selinux] pr775-checkpolicy-revdeps: test if systemd-sleep can create new file in /sys/power directory
Date: Fri, 11 Sep 2026 13:19:15 GMT [thread overview]
Message-ID: <178913275500.1.5449471354248165284.tests-selinux-72a7f9e56568@fedoraproject.org> (raw)
A new commit has been pushed.
Repo : tests/selinux
Branch : pr775-checkpolicy-revdeps
Commit : 72a7f9e56568ef8e15d93eb2286f5f3159aeb294
Author : Milos Malik <mmalik@redhat.com>
Date : 2021-06-29T07:57:48+00:00
Stats : +7/-0 in 2 file(s)
URL : https://src.fedoraproject.org/tests/selinux/c/72a7f9e56568ef8e15d93eb2286f5f3159aeb294?branch=pr775-checkpolicy-revdeps
Log:
test if systemd-sleep can create new file in /sys/power directory
Recent testing of the hybrid-sleep service on RHEL-8 revealed that
SELinux prevents the systemd-sleep process from creating the state
file in /sys/power/ directory.
I believe this action should be allowed, because the behavior is
expected, the scenario is supported and security is not violated.
Unfortunately, the TC cannot reproduce the scenario because it's
difficult to wake up the machine after invoking the hybrid-sleep
service.
The TC looks for appropriate policy rules and file context patterns.
The TC covers BZ#1968610.
---
diff --git a/selinux-policy/swap-file-and-systemd-access/Makefile b/selinux-policy/swap-file-and-systemd-access/Makefile
index 492b8e8..8ec066f 100644
--- a/selinux-policy/swap-file-and-systemd-access/Makefile
+++ b/selinux-policy/swap-file-and-systemd-access/Makefile
@@ -70,6 +70,7 @@ $(METADATA): Makefile
@echo "Bug: 1912385" >> $(METADATA) # Fedora 32
@echo "Bug: 1926536" >> $(METADATA) # RHEL 9
@echo "Bug: 1928539" >> $(METADATA) # Fedora 32
+ @echo "Bug: 1968610" >> $(METADATA) # RHEL 8
rhts-lint $(METADATA)
diff --git a/selinux-policy/swap-file-and-systemd-access/runtest.sh b/selinux-policy/swap-file-and-systemd-access/runtest.sh
index 4a60b43..1bcb508 100755
--- a/selinux-policy/swap-file-and-systemd-access/runtest.sh
+++ b/selinux-policy/swap-file-and-systemd-access/runtest.sh
@@ -83,6 +83,12 @@ rlJournalStart
rlSESearchRule "allow systemd_sleep_t fixed_disk_device_t : blk_file { getattr } [ ]"
rlPhaseEnd
+ rlPhaseStartTest "bz#1968610"
+ rlSEMatchPathCon "/sys/power" "sysfs_t"
+ rlSEMatchPathCon "/sys/power/state" "sysfs_t"
+ rlSESearchRule "allow systemd_sleep_t sysfs_t : dir { add_name create } [ ]"
+ rlPhaseEnd
+
if ${REAL_SCENARIOS} ; then
rlPhaseStartTest "real scenario"
rlRun "rm -f /swapfile"
reply other threads:[~2026-09-11 13:19 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=178913275500.1.5449471354248165284.tests-selinux-72a7f9e56568@fedoraproject.org \
--to=mmalik@redhat.com \
--cc=git-commits@fedoraproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox