[tests/selinux] pr775-checkpolicy-revdeps: test if smbcontrol can read the /proc/net/unix file

[tests/selinux] pr775-checkpolicy-revdeps: test if smbcontrol can read the /proc/net/unix file

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 9329983a575d4176258195dd689e81baf24c086f
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2022-01-06T10:51:50+01:00
            Stats  : +6/-0 in 2 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/9329983a575d4176258195dd689e81baf24c086f?branch=pr775-checkpolicy-revdeps

            Log:
            test if smbcontrol can read the /proc/net/unix file

Recent smbcontrol testing in certain environments revealed that
the smbcontrol process wants to read the /proc/net/unix file, but
SELinux denies that access. The TC reproduces the situation.

Not sure why the smbcontrol process wants to access the /proc/net/unix
file, but current SELinux policy allows a lot of SELinux domains to
read that file, which means that the behavior is pretty common.
The TC looks for appropriate allow rule.

The TC covers BZ#2033873.

---
diff --git a/selinux-policy/smbcontrol-and-similar/Makefile b/selinux-policy/smbcontrol-and-similar/Makefile
index 853e5b3..14bc31f 100644
--- a/selinux-policy/smbcontrol-and-similar/Makefile
+++ b/selinux-policy/smbcontrol-and-similar/Makefile
@@ -68,6 +68,7 @@ $(METADATA): Makefile
 	@echo "Bug:             2025931" >> $(METADATA) # Fedora 35
 	@echo "Bug:             2027740" >> $(METADATA) # RHEL-8
 	@echo "Bug:             2027751" >> $(METADATA) # RHEL-9
+	@echo "Bug:             2033873" >> $(METADATA) # RHEL-8
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/smbcontrol-and-similar/runtest.sh b/selinux-policy/smbcontrol-and-similar/runtest.sh
index 864888f..1d618bc 100755
--- a/selinux-policy/smbcontrol-and-similar/runtest.sh
+++ b/selinux-policy/smbcontrol-and-similar/runtest.sh
@@ -91,6 +91,11 @@ rlJournalStart
         rlSESearchRule "allow smbcontrol_t smbcontrol_t : netlink_route_socket { create bind getattr nlmsg_read} [ ]"
         rlSESearchRule "allow smbcontrol_t smbcontrol_t : udp_socket { create ioctl } [ ]"
     rlPhaseEnd
+
+    rlPhaseStartTest "bz#2033873"
+        rlSEMatchPathCon "/proc/net/unix" "proc_net_t"
+        rlSESearchRule "allow smbcontrol_t proc_net_t : file { getattr open read } [ ]"
+    rlPhaseEnd
     fi
 
     rlPhaseStartTest "real scenario"