[tests/selinux] pr775-checkpolicy-revdeps: test if systemd-sleep can create new file in /sys/power directory

[tests/selinux] pr775-checkpolicy-revdeps: test if systemd-sleep can create new file in /sys/power directory

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 72a7f9e56568ef8e15d93eb2286f5f3159aeb294
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2021-06-29T07:57:48+00:00
            Stats  : +7/-0 in 2 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/72a7f9e56568ef8e15d93eb2286f5f3159aeb294?branch=pr775-checkpolicy-revdeps

            Log:
            test if systemd-sleep can create new file in /sys/power directory

Recent testing of the hybrid-sleep service on RHEL-8 revealed that
SELinux prevents the systemd-sleep process from creating the state
file in /sys/power/ directory.

I believe this action should be allowed, because the behavior is
expected, the scenario is supported and security is not violated.

Unfortunately, the TC cannot reproduce the scenario because it's
difficult to wake up the machine after invoking the hybrid-sleep
service.

The TC looks for appropriate policy rules and file context patterns.

The TC covers BZ#1968610.

---
diff --git a/selinux-policy/swap-file-and-systemd-access/Makefile b/selinux-policy/swap-file-and-systemd-access/Makefile
index 492b8e8..8ec066f 100644
--- a/selinux-policy/swap-file-and-systemd-access/Makefile
+++ b/selinux-policy/swap-file-and-systemd-access/Makefile
@@ -70,6 +70,7 @@ $(METADATA): Makefile
 	@echo "Bug:             1912385" >> $(METADATA) # Fedora 32
 	@echo "Bug:             1926536" >> $(METADATA) # RHEL 9
 	@echo "Bug:             1928539" >> $(METADATA) # Fedora 32
+	@echo "Bug:             1968610" >> $(METADATA) # RHEL 8
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/swap-file-and-systemd-access/runtest.sh b/selinux-policy/swap-file-and-systemd-access/runtest.sh
index 4a60b43..1bcb508 100755
--- a/selinux-policy/swap-file-and-systemd-access/runtest.sh
+++ b/selinux-policy/swap-file-and-systemd-access/runtest.sh
@@ -83,6 +83,12 @@ rlJournalStart
         rlSESearchRule "allow systemd_sleep_t fixed_disk_device_t : blk_file { getattr } [ ]"
     rlPhaseEnd
 
+    rlPhaseStartTest "bz#1968610"
+        rlSEMatchPathCon "/sys/power" "sysfs_t"
+        rlSEMatchPathCon "/sys/power/state" "sysfs_t"
+        rlSESearchRule "allow systemd_sleep_t sysfs_t : dir { add_name create } [ ]"
+    rlPhaseEnd
+
     if ${REAL_SCENARIOS} ; then
     rlPhaseStartTest "real scenario"
         rlRun "rm -f /swapfile"