[tests/selinux] pr775-checkpolicy-revdeps: test if stalld can use sched_getattr on kernel

[tests/selinux] pr775-checkpolicy-revdeps: test if stalld can use sched_getattr on kernel

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 341a2e48cabe3aadd6499feb8f04ca0c3b8472d1
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2022-06-14T16:36:47+02:00
            Stats  : +6/-0 in 3 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/341a2e48cabe3aadd6499feb8f04ca0c3b8472d1?branch=pr775-checkpolicy-revdeps

            Log:
            test if stalld can use sched_getattr on kernel

Recent stalld testing revealed that SELinux prevents the stalld processes
from using the sched_getattr syscall on the running kernel. The TC
does not reproduce the situation.

In order to fix the SELinux denials, SELinux policy should either
allow or dontaudit the use of sched_getattr syscall. The TC looks
for appropriate policy rules.

The TC covers BZ#2096776.

---
diff --git a/selinux-policy/stalld-and-similar/Makefile b/selinux-policy/stalld-and-similar/Makefile
index 71dd28f..b15214c 100644
--- a/selinux-policy/stalld-and-similar/Makefile
+++ b/selinux-policy/stalld-and-similar/Makefile
@@ -65,6 +65,7 @@ $(METADATA): Makefile
 	@echo "Releases:        -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA)
 	@echo "Bug:             2042614" >> $(METADATA) # RHEL-9
 	@echo "Bug:             2092864" >> $(METADATA) # RHEL-9
+	@echo "Bug:             2096776" >> $(METADATA) # RHEL-9
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/stalld-and-similar/main.fmf b/selinux-policy/stalld-and-similar/main.fmf
index 4aa8e13..23f4aaf 100644
--- a/selinux-policy/stalld-and-similar/main.fmf
+++ b/selinux-policy/stalld-and-similar/main.fmf
@@ -34,6 +34,7 @@ tier: '2'
 link:
   - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2042614
   - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2092864
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2096776
 adjust:
   - enabled: false
     when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8

diff --git a/selinux-policy/stalld-and-similar/runtest.sh b/selinux-policy/stalld-and-similar/runtest.sh
index 8624863..28ebee0 100755
--- a/selinux-policy/stalld-and-similar/runtest.sh
+++ b/selinux-policy/stalld-and-similar/runtest.sh
@@ -78,6 +78,10 @@ rlJournalStart
         rlSESearchRule "allow stalld_t stalld_t : process { setsched } [ ]"
     rlPhaseEnd
 
+    rlPhaseStartTest "bz#2096776"
+        rlSESearchRule "allow stalld_t kernel_t : process { getsched } [ ]"
+    rlPhaseEnd
+
     rlPhaseStartTest "real scenario -- standalone service"
         if ! rlSEDefined ${PROCESS_CONTEXT} ; then
             PROCESS_CONTEXT="unconfined_service_t"