[tests/selinux] pr775-checkpolicy-revdeps: kernel/selinux-testsuite: patch the policy for restraint

[tests/selinux] pr775-checkpolicy-revdeps: kernel/selinux-testsuite: patch the policy for restraint

[Ondrej Mosnacek]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 08dcaa35346d7d80301a9bb026207f8d70ea2ebe
            Author : Ondrej Mosnacek <omosnace@redhat.com>
            Date   : 2021-09-22T22:41:55+02:00
            Stats  : +4/-0 in 1 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/08dcaa35346d7d80301a9bb026207f8d70ea2ebe?branch=pr775-checkpolicy-revdeps

            Log:
            kernel/selinux-testsuite: patch the policy for restraint

When this test in run via restraint (e.g. on Beaker), it inherits some
file descriptors originating from it, labeled unconfined_service_t. This
leads to a huge amount of denials when test programs are exectuted.

To work around this, add a rule to the policy that allows the test
domains to inherit these descriptors from unconfined_service_t.

Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>

---
diff --git a/kernel/selinux-testsuite/runtest.sh b/kernel/selinux-testsuite/runtest.sh
index b12338c..188c240 100755
--- a/kernel/selinux-testsuite/runtest.sh
+++ b/kernel/selinux-testsuite/runtest.sh
@@ -304,6 +304,10 @@ rlJournalStart
         } | rlRun "tee -a tests/tun_tap/tun_common.h" 0 \
             "Harden tun_tap test against missing defs"
 
+        # needed to avoid a flood of AVCs when run via restraint
+        rlRun "sed -i 's/type unconfined_t;/type unconfined_t, unconfined_service_t;/' policy/test_policy.if" 0
+        rlRun "sed -i 's/\\(allow \\\$1 initrc_t:fd use;\\)/\\1 allow \$1 unconfined_service_t:fd use;/' policy/test_policy.if" 0
+
         exclude_tests=""
         force_tests=""
         for file in ./tests/nnp*/execnnp.c; do