[tests/selinux] pr775-checkpolicy-revdeps: test if user can check status of its user manager

[tests/selinux] pr775-checkpolicy-revdeps: test if user can check status of its user manager

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 9cc7eb5ca3c3c26d634d499f7486daa0d3a94aa9
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2021-12-10T14:07:28+01:00
            Stats  : +13/-1 in 2 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/9cc7eb5ca3c3c26d634d499f7486daa0d3a94aa9?branch=pr775-checkpolicy-revdeps

            Log:
            test if user can check status of its user manager

Recent confined users testing revealed that SELinux prevents the
user_u user from checking the status of its user@<UID> service.
The TC reproduces the scenario.

The TC checks the related file context patterns and looks for
appropriate policy rules which make this scenario working again.

The TC covers BZ#2017838.

---
diff --git a/selinux-policy/journalctl-and-similar/Makefile b/selinux-policy/journalctl-and-similar/Makefile
index 255fcdf..65967a4 100644
--- a/selinux-policy/journalctl-and-similar/Makefile
+++ b/selinux-policy/journalctl-and-similar/Makefile
@@ -67,6 +67,7 @@ $(METADATA): Makefile
 	@echo "Bug:             1288255" >> $(METADATA) # RHEL-7
 	@echo "Bug:             1685689" >> $(METADATA) # RHEL-8
 	@echo "Bug:             1825894" >> $(METADATA) # RHEL-8
+	@echo "Bug:             2017838" >> $(METADATA) # RHEL-9
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/journalctl-and-similar/runtest.sh b/selinux-policy/journalctl-and-similar/runtest.sh
index 95e5d64..d7b8fd7 100755
--- a/selinux-policy/journalctl-and-similar/runtest.sh
+++ b/selinux-policy/journalctl-and-similar/runtest.sh
@@ -90,6 +90,15 @@ rlJournalStart
         rlSESearchRule "allow journalctl_t journalctl_t : process { setrlimit } [ ]"
     rlPhaseEnd
 
+    if ! rlIsFedora ; then
+    rlPhaseStartTest "bz#2017838"
+        rlSEMatchPathCon "/run/log/journal/somehash/system.journal" "syslogd_var_run_t"
+        rlSEMatchPathCon "/var/lib/systemd/catalog/database" "init_var_lib_t"
+        rlSESearchRule "allow user_t init_var_lib_t : file { open read map } [ ]"
+        rlSESearchRule "allow user_t syslogd_var_run_t : file { open read map } [ ]"
+    rlPhaseEnd
+    fi
+
     rlPhaseStartTest "real scenario -- confined users"
         rlSEConfigureSSH
 
@@ -103,6 +112,8 @@ rlJournalStart
             rlRun "usermod -G systemd-journal ${USER_NAME}"
             rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost journalctl -n 10 --no-pager --user"
             rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost journalctl -n 10 --no-pager --system"
+            USER_ID=`id -u ${USER_NAME}`
+            rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost systemctl status user@${USER_ID}"
             rlRun "userdel -rfZ ${USER_NAME}"
             sleep 10
         done
@@ -114,7 +125,7 @@ rlJournalStart
 
     rlPhaseStartCleanup
         sleep 2
-        rlSECheckAVC
+        rlSECheckAVC --ignore 'type=AVC .* create .*systemd.* scontext=.*:user_t:.* tcontext=.*:user_tmp_t:.* tclass=dir'
     rlPhaseEnd
 rlJournalPrintText
 rlJournalEnd