[tests/selinux] pr775-checkpolicy-revdeps: test if stalld process can use sched_setattr syscall

[tests/selinux] pr775-checkpolicy-revdeps: test if stalld process can use sched_setattr syscall

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : b0e50d2418c4f4309f3e39f9db012c69ff55491e
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2022-06-06T13:34:21+00:00
            Stats  : +12/-1 in 3 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/b0e50d2418c4f4309f3e39f9db012c69ff55491e?branch=pr775-checkpolicy-revdeps

            Log:
            test if stalld process can use sched_setattr syscall

The following messages found in the systemd journal revealed that
the stalld service cannot perform all operations it wants:

stalld[...]: boost_with_deadline failed to boost pid 0: Operation not permitted
stalld[...]: boost_with_fifo failed to boost pid 0: Operation not permitted
stalld[...]: boost_with_deadline failed to boost pid 0: Permission denied
stalld[...]: boost_with_fifo failed to boost pid 0: Permission denied

Unfortunately, SELinux policy contains a dontaudit rule which hides
SELinux denials triggered by the stalld service in this situation.

In order to fix the issue, SELinux policy should allow the sys_nice
capability and the setsched permission to the stalld_t labeled processes.
The TC runs the stalld service and looks for such rules.

The TC covers BZ#2092864.

---
diff --git a/selinux-policy/stalld-and-similar/Makefile b/selinux-policy/stalld-and-similar/Makefile
index 4a4124a..71dd28f 100644
--- a/selinux-policy/stalld-and-similar/Makefile
+++ b/selinux-policy/stalld-and-similar/Makefile
@@ -64,6 +64,7 @@ $(METADATA): Makefile
 	@echo "Destructive:     no" >> $(METADATA)
 	@echo "Releases:        -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA)
 	@echo "Bug:             2042614" >> $(METADATA) # RHEL-9
+	@echo "Bug:             2092864" >> $(METADATA) # RHEL-9
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/stalld-and-similar/main.fmf b/selinux-policy/stalld-and-similar/main.fmf
index a1196b2..4aa8e13 100644
--- a/selinux-policy/stalld-and-similar/main.fmf
+++ b/selinux-policy/stalld-and-similar/main.fmf
@@ -32,7 +32,8 @@ tag:
   - targeted
 tier: '2'
 link:
-  - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2042614
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2042614
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2092864
 adjust:
   - enabled: false
     when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8

diff --git a/selinux-policy/stalld-and-similar/runtest.sh b/selinux-policy/stalld-and-similar/runtest.sh
index 0624de5..8624863 100755
--- a/selinux-policy/stalld-and-similar/runtest.sh
+++ b/selinux-policy/stalld-and-similar/runtest.sh
@@ -73,25 +73,34 @@ rlJournalStart
         rlSESearchRule "allow ${PROCESS_CONTEXT} debugfs_t : file { getattr open read } [ ]"
     rlPhaseEnd
 
+    rlPhaseStartTest "bz#2092864"
+        rlSESearchRule "allow stalld_t stalld_t : capability { sys_nice } [ ]"
+        rlSESearchRule "allow stalld_t stalld_t : process { setsched } [ ]"
+    rlPhaseEnd
+
     rlPhaseStartTest "real scenario -- standalone service"
         if ! rlSEDefined ${PROCESS_CONTEXT} ; then
             PROCESS_CONTEXT="unconfined_service_t"
         fi
         rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1
         rlRun "sed -i 's/^LOGGING=.*$/LOGGING=--log_syslog/' /etc/sysconfig/stalld"
+        rlRun "journalctl -u ${SERVICE_NAME} > before.txt"
         rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status" 1
         rlRun "sed -i 's/^LOGGING=.*$/LOGGING=--log_kmsg/' /etc/sysconfig/stalld"
+        rlRun "journalctl -u ${SERVICE_NAME} > after.txt"
         rlRun "setsebool domain_can_write_kmsg on"
         rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status" 1
         rlRun "restorecon -Rv /run /var" 0-255
         rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "stop status" 1
         rlRun "setsebool domain_can_write_kmsg off"
+        rlRun "diff before.txt after.txt | grep -i -e 'operation not permitted' -e 'permission denied'" 1
     rlPhaseEnd
 
     rlPhaseStartCleanup
         sleep 2
         rlSECheckAVC
 
+        rm -f before.txt after.txt
         rlFileRestore
         rlServiceRestore ${SERVICE_NAME}
     rlPhaseEnd