[tests/selinux] pr775-checkpolicy-revdeps: test if smbcontrol can work with netlink_route_socket + udp_socket

[tests/selinux] pr775-checkpolicy-revdeps: test if smbcontrol can work with netlink_route_socket + udp_socket

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 32c565fc64cad5e0ff5d88bb50a7809e4098b7e4
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2021-12-07T19:07:37+00:00
            Stats  : +10/-0 in 2 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/32c565fc64cad5e0ff5d88bb50a7809e4098b7e4?branch=pr775-checkpolicy-revdeps

            Log:
            test if smbcontrol can work with netlink_route_socket + udp_socket

Recent smbcontrol testing revealed that SELinux prevents the program
from creating and using netlink_route sockets and UDP sockets. The TC
reproduces the situation.

Even though the smbcontrol program did not require such permissions
in previous versions, I believe that SELinux policy should allow the
program to do these actions. Otherwise, the following error messages
will keep on appearing:

  ERROR: Could not determine network interfaces, you must use a interfaces config line

The TC covers BZ#2025931, BZ#2027740, BZ#2027751.

---
diff --git a/selinux-policy/smbcontrol-and-similar/Makefile b/selinux-policy/smbcontrol-and-similar/Makefile
index ff42946..853e5b3 100644
--- a/selinux-policy/smbcontrol-and-similar/Makefile
+++ b/selinux-policy/smbcontrol-and-similar/Makefile
@@ -65,6 +65,9 @@ $(METADATA): Makefile
 	@echo "Bug:             1326621" >> $(METADATA) # RHEL-6
 	@echo "Bug:             1574518" >> $(METADATA) # RHEL-8
 	@echo "Bug:             1574521" >> $(METADATA) # RHEL-7
+	@echo "Bug:             2025931" >> $(METADATA) # Fedora 35
+	@echo "Bug:             2027740" >> $(METADATA) # RHEL-8
+	@echo "Bug:             2027751" >> $(METADATA) # RHEL-9
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/smbcontrol-and-similar/runtest.sh b/selinux-policy/smbcontrol-and-similar/runtest.sh
index be1dd40..864888f 100755
--- a/selinux-policy/smbcontrol-and-similar/runtest.sh
+++ b/selinux-policy/smbcontrol-and-similar/runtest.sh
@@ -86,6 +86,13 @@ rlJournalStart
     rlPhaseEnd
     fi
 
+    if ! rlIsRHEL 5 6 7 ; then
+    rlPhaseStartTest "bz#2025931 + bz#2027740 + bz#2027751"
+        rlSESearchRule "allow smbcontrol_t smbcontrol_t : netlink_route_socket { create bind getattr nlmsg_read} [ ]"
+        rlSESearchRule "allow smbcontrol_t smbcontrol_t : udp_socket { create ioctl } [ ]"
+    rlPhaseEnd
+    fi
+
     rlPhaseStartTest "real scenario"
         if ! rlIsRHEL 5 6 ; then
             rlRun "ls -Z /var/lib/samba/lock"