[tests/selinux] pr775-checkpolicy-revdeps: test if ksmctl process can create /sys/kernel/mm/ksm/run file

[tests/selinux] pr775-checkpolicy-revdeps: test if ksmctl process can create /sys/kernel/mm/ksm/run file

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : b322ded7698608fcf39a047f25297e6b9913b31f
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2022-06-09T15:32:49+00:00
            Stats  : +20/-2 in 3 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/b322ded7698608fcf39a047f25297e6b9913b31f?branch=pr775-checkpolicy-revdeps

            Log:
            test if ksmctl process can create /sys/kernel/mm/ksm/run file

Recent use of the ksm service revealed that SELinux prevents the
ksmctl process from creating the run file in the /sys/kernel/mm/ksm/
directory. The TC reproduces the situation.

The ksmctl binary contains the following locations (the strings command
found them):
 * /sys/kernel/mm/ksm/run
 * /sys/kernel/mm/ksm/max_kernel_pages

In order to make the ksm service fully functional, I believe that
SELinux policy should allow the create access to these files. The
TC looks for appropriate policy rules and file context patterns.

The TC covers BZ#2091416, BZ#2091417 and BZ#2091418.

---
diff --git a/selinux-policy/ksm-and-similar/Makefile b/selinux-policy/ksm-and-similar/Makefile
index 9ff17b0..9a107c7 100644
--- a/selinux-policy/ksm-and-similar/Makefile
+++ b/selinux-policy/ksm-and-similar/Makefile
@@ -63,6 +63,9 @@ $(METADATA): Makefile
 	@echo "Destructive:     no" >> $(METADATA)
 	@echo "Releases:        -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA)
 	@echo "Bug:             2021131" >> $(METADATA) # RHEL-9
+	@echo "Bug:             2091416" >> $(METADATA) # Fedora 36
+	@echo "Bug:             2091417" >> $(METADATA) # Fedora 36
+	@echo "Bug:             2091418" >> $(METADATA) # Fedora 36
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/ksm-and-similar/main.fmf b/selinux-policy/ksm-and-similar/main.fmf
index ebab863..64fcdfe 100644
--- a/selinux-policy/ksm-and-similar/main.fmf
+++ b/selinux-policy/ksm-and-similar/main.fmf
@@ -1,6 +1,6 @@
 summary: SELinux interferes with ksm and related programs
 description: |+
-    SELinux interferes with ksm and related programs.
+    SELinux interferes with the ksm service (the ksmctl program) and related programs.
 
 contact: Milos Malik <mmalik@redhat.com>
 component:
@@ -26,12 +26,19 @@ tag:
   - NoRHEL5
   - NoRHEL6
   - NoRHEL7
+  - Tier2
+  - Tier2se
   - targeted
+tier: '2'
 link:
-  - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2021131
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2021131
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2091416
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2091417
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2091418
 adjust:
   - enabled: false
     when: distro == rhel-4, rhel-5, rhel-6, rhel-7
     continue: false
+extra-nitrate: TC#0613684
 extra-summary: /CoreOS/selinux-policy/Regression/ksm-and-similar
 extra-task: /CoreOS/selinux-policy/Regression/ksm-and-similar

diff --git a/selinux-policy/ksm-and-similar/runtest.sh b/selinux-policy/ksm-and-similar/runtest.sh
index 4e19de9..21d276f 100755
--- a/selinux-policy/ksm-and-similar/runtest.sh
+++ b/selinux-policy/ksm-and-similar/runtest.sh
@@ -69,6 +69,14 @@ rlJournalStart
         rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS"
         rlSESearchRule "allow ${PROCESS_CONTEXT} sysfs_t : dir { write } [ ]"
     rlPhaseEnd
+
+    rlPhaseStartTest "bz#2091416 + bz#2091417 + bz#2091418"
+        rlSEMatchPathCon "/usr/libexec/ksmctl" "ksm_exec_t"
+        rlSEMatchPathCon "/sys/kernel/mm/ksm" "sysfs_t"
+        rlSEMatchPathCon "/sys/kernel/mm/ksm/run" "sysfs_t"
+        rlSESearchRule "allow ksm_t sysfs_t : dir { write add_name } [ ]"
+        rlSESearchRule "allow ksm_t sysfs_t : file { create } [ ]"
+    rlPhaseEnd
     fi
 
     rlPhaseStartTest "real scenario -- standalone service"