[tests/selinux] pr775-checkpolicy-revdeps: add new systemd-creds test

[tests/selinux] pr775-checkpolicy-revdeps: add new systemd-creds test

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 9c17ff1ea707291c6052b26c55f6cc6a5c80f903
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2022-06-27T13:36:09+00:00
            Stats  : +198/-0 in 5 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/9c17ff1ea707291c6052b26c55f6cc6a5c80f903?branch=pr775-checkpolicy-revdeps

            Log:
            add new systemd-creds test

One of the new systemd features allows passing secret credentials
to various services, but SELinux prevents all sd-mkdcreds processes
running as init_t from accessing all /dev/shm/.#cred* files. The
TC reproduces the situation.

In order to support this systemd feature, SELinux policy should allow
these actions. The TC looks for appropriate policy rules and file
context patterns.

The TC covers BZ#2096857 and BZ#2097681.

---
diff --git a/selinux-policy/systemd-creds/Makefile b/selinux-policy/systemd-creds/Makefile
new file mode 100644
index 0000000..83eda9d
--- /dev/null
+++ b/selinux-policy/systemd-creds/Makefile
@@ -0,0 +1,69 @@
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Makefile of /CoreOS/selinux-policy/Regression/systemd-creds
+#   Description: SELinux interferes with services which use credentials
+#   Author: Milos Malik <mmalik@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2022 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+export TEST=/CoreOS/selinux-policy/Regression/systemd-creds
+export TESTVERSION=1.0
+
+BUILT_FILES=
+
+FILES=$(METADATA) runtest.sh Makefile PURPOSE dmesg.service
+
+.PHONY: all install download clean
+
+run: $(FILES) build
+	./runtest.sh
+
+build: $(BUILT_FILES)
+	chmod a+x runtest.sh
+	chcon -t bin_t runtest.sh
+
+clean:
+	rm -f *~ $(BUILT_FILES)
+
+include /usr/share/rhts/lib/rhts-make.include
+
+$(METADATA): Makefile
+	@echo "Owner:           Milos Malik <mmalik@redhat.com>" > $(METADATA)
+	@echo "Name:            $(TEST)" >> $(METADATA)
+	@echo "TestVersion:     $(TESTVERSION)" >> $(METADATA)
+	@echo "Path:            $(TEST_DIR)" >> $(METADATA)
+	@echo "Description:     SELinux interferes with services which use credentials" >> $(METADATA)
+	@echo "Type:            Regression" >> $(METADATA)
+	@echo "TestTime:        10m" >> $(METADATA)
+	@echo "RunFor:          selinux-policy" >> $(METADATA)
+	@echo "Requires:        audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console systemd" >> $(METADATA)
+	@echo "RhtsRequires:    library(selinux-policy/common)" >> $(METADATA)
+	@echo "Environment:     AVC_ERROR=+no_avc_check" >> $(METADATA)
+	@echo "Priority:        Normal" >> $(METADATA)
+	@echo "License:         GPLv2" >> $(METADATA)
+	@echo "Confidential:    no" >> $(METADATA)
+	@echo "Destructive:     no" >> $(METADATA)
+	@echo "Releases:        -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA)
+	@echo "Bug:             2096857" >> $(METADATA) # Fedora 36
+	@echo "Bug:             2097681" >> $(METADATA) # Fedora 36
+
+	rhts-lint $(METADATA)
+

diff --git a/selinux-policy/systemd-creds/PURPOSE b/selinux-policy/systemd-creds/PURPOSE
new file mode 100644
index 0000000..ca6475f
--- /dev/null
+++ b/selinux-policy/systemd-creds/PURPOSE
@@ -0,0 +1,9 @@
+PURPOSE of /CoreOS/selinux-policy/Regression/systemd-creds
+Author: Milos Malik <mmalik@redhat.com>
+
+SELinux interferes with services which use credentials:
+ * LoadCredential=
+ * LoadCredentialEncrypted=
+
+More about this systemd feature can be found at https://systemd.io/CREDENTIALS/
+

diff --git a/selinux-policy/systemd-creds/dmesg.service b/selinux-policy/systemd-creds/dmesg.service
new file mode 100644
index 0000000..661f441
--- /dev/null
+++ b/selinux-policy/systemd-creds/dmesg.service
@@ -0,0 +1,4 @@
+[Service]
+ExecStart=/usr/bin/dmesg
+LoadCredentialEncrypted=bar:/bar
+

diff --git a/selinux-policy/systemd-creds/main.fmf b/selinux-policy/systemd-creds/main.fmf
new file mode 100644
index 0000000..11d0693
--- /dev/null
+++ b/selinux-policy/systemd-creds/main.fmf
@@ -0,0 +1,36 @@
+summary: SELinux interferes with services which use credentials
+description: |+
+    SELinux interferes with services which use credentials
+
+contact: Milos Malik <mmalik@redhat.com>
+component:
+  - selinux-policy
+require:
+  - library(selinux-policy/common)
+recommend:
+  - audit
+  - libselinux
+  - libselinux-utils
+  - policycoreutils
+  - selinux-policy
+  - selinux-policy-targeted
+  - setools-console
+  - systemd
+environment:
+    AVC_ERROR: +no_avc_check
+duration: 10m
+enabled: true
+tag:
+  - Tier2
+  - Tier2se
+tier: '2'
+adjust:
+  - enabled: false
+    when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8
+    because: the systemd-creds program is not available there
+link:
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2096857
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2097681
+extra-nitrate: TC#0613921
+extra-summary: /CoreOS/selinux-policy/Regression/systemd-creds
+extra-task: /CoreOS/selinux-policy/Regression/systemd-creds

diff --git a/selinux-policy/systemd-creds/runtest.sh b/selinux-policy/systemd-creds/runtest.sh
new file mode 100755
index 0000000..643f9df
--- /dev/null
+++ b/selinux-policy/systemd-creds/runtest.sh
@@ -0,0 +1,80 @@
+#!/bin/bash
+# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   runtest.sh of /CoreOS/selinux-policy/Regression/systemd-creds
+#   Description: SELinux interferes with services which use credentials
+#   Author: Milos Malik <mmalik@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2022 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include Beaker environment
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGE="selinux-policy"
+SERVICE_PACKAGE="systemd"
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlRun "rlImport 'selinux-policy/common'"
+        rlSESatisfyRequires
+        rlAssertRpm ${PACKAGE}
+        rlAssertRpm ${PACKAGE}-targeted
+        rlAssertRpm ${SERVICE_PACKAGE}
+
+        rlRun "cp dmesg.service /etc/systemd/system/"
+        rlRun "systemctl daemon-reload"
+
+        rlSESetEnforce
+        rlSEStatus
+        rlSESetTimestamp
+        sleep 2
+    rlPhaseEnd
+
+    rlPhaseStartTest "bz#2096857 + bz#2097681"
+        rlSEMatchPathCon "/usr/bin/systemd-creds" "bin_t"
+        rlRun "seinfo --genfscon | grep :ramfs_t"
+        rlSESearchRule "allow init_t ramfs_t : file { read write open setattr rename create } [ ]"
+    rlPhaseEnd
+
+    rlPhaseStartTest "a systemd service loading credentials"
+        rlRun "echo hello > /foo"
+        rlRun "ls -alZ /foo"
+        rlRun "systemd-creds encrypt /foo /bar"
+        rlRun "ls -alZ /bar"
+        rlRun "systemctl start dmesg.service" 0-255
+        rlRun "systemctl status dmesg.service" 0-255
+        rlRun "systemctl stop dmesg.service" 0-255
+        rlRun "systemctl status dmesg.service" 0-255
+        rlRun "rm -f /foo /bar"
+        rlRun "systemd-run -P --wait -p LoadCredential=abc:/etc/hosts systemd-creds cat abc"
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        sleep 2
+        rlSECheckAVC
+
+        rlRun "rm -f /etc/systemd/system/dmesg.service"
+        rlRun "systemctl daemon-reload"
+    rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd
+