[tests/selinux] pr775-checkpolicy-revdeps: test if dhclient-script can access /run/chrony-dhcp/ and its content

[tests/selinux] pr775-checkpolicy-revdeps: test if dhclient-script can access /run/chrony-dhcp/ and its content

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 7710067379c87637e0314c382f2269d91f77cbf8
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2022-06-28T08:47:39+00:00
            Stats  : +21/-2 in 3 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/7710067379c87637e0314c382f2269d91f77cbf8?branch=pr775-checkpolicy-revdeps

            Log:
            test if dhclient-script can access /run/chrony-dhcp/ and its content

Frequent use of the dhclient program in various environments revealed
that SELinux prevents the /etc/dhcp/dhclient.d/chrony.sh script from
appending to files stored in the /run/chrony-dhcp/ directory. The TC
reproduces the situation.

Because the /etc/dhcp/dhclient.d/chrony.sh script is brought by the
chrony package and the scripts in the /etc/dhcp/dhclient.d/ directory
are by default executed by the dhclient-script program, I believe that
SELinux policy should allow the access. The TC looks for appropriate
policy rules and file context patterns.

The TC covers BZ#2035117, BZ#2093709 and BZ#2094155.

---
diff --git a/selinux-policy/dhclient-and-similar/Makefile b/selinux-policy/dhclient-and-similar/Makefile
index 4779e3c..e372ff7 100644
--- a/selinux-policy/dhclient-and-similar/Makefile
+++ b/selinux-policy/dhclient-and-similar/Makefile
@@ -63,6 +63,9 @@ $(METADATA): Makefile
 	@echo "Destructive:     no" >> $(METADATA)
 	@echo "Releases:        -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA)
 	@echo "Bug:             1897388" >> $(METADATA) # Fedora 33
+	@echo "Bug:             2035117" >> $(METADATA) # Fedora 35
+	@echo "Bug:             2093709" >> $(METADATA) # Fedora 36
+	@echo "Bug:             2094155" >> $(METADATA) # RHEL-9
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/dhclient-and-similar/main.fmf b/selinux-policy/dhclient-and-similar/main.fmf
index 0504956..9c98fb1 100644
--- a/selinux-policy/dhclient-and-similar/main.fmf
+++ b/selinux-policy/dhclient-and-similar/main.fmf
@@ -22,6 +22,10 @@ environment:
     AVC_ERROR: +no_avc_check
 duration: 10m
 link:
-  - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1897388
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1897388
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2035117
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2093709
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2094155
 extra-summary: /CoreOS/selinux-policy/Regression/dhclient-and-similar
 extra-task: /CoreOS/selinux-policy/Regression/dhclient-and-similar
+extra-nitrate: TC#0613884

diff --git a/selinux-policy/dhclient-and-similar/runtest.sh b/selinux-policy/dhclient-and-similar/runtest.sh
index 9639e39..8b988d6 100755
--- a/selinux-policy/dhclient-and-similar/runtest.sh
+++ b/selinux-policy/dhclient-and-similar/runtest.sh
@@ -30,7 +30,6 @@
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 
 PACKAGE="selinux-policy"
-ROOT_PASSWORD="redhat"
 SERVICE_PACKAGE="chrony"
 SERVICE_NAME="chronyd"
 
@@ -45,6 +44,7 @@ rlJournalStart
         rlAssertRpm ${SERVICE_PACKAGE}
 
         rlServiceStart ${SERVICE_NAME}
+        rlFileBackup /run/chrony-dhcp
 
         rlSESetEnforce
         rlSEStatus
@@ -60,19 +60,31 @@ rlJournalStart
         rlSESearchRule "type_transition dhcpc_t chronyc_exec_t : process chronyc_t"
         rlSESearchRule "allow dhcpc_t chronyc_t : process { transition } [ ]"
     rlPhaseEnd
+
+    rlPhaseStartTest "bz#2035117 + bz#2093709 + bz#2094155"
+        rlSEMatchPathCon "/usr/sbin/dhclient-script" "dhcpc_exec_t"
+        rlSEMatchPathCon "/run/chrony-dhcp" "chronyd_var_run_t"
+        rlSEMatchPathCon "/run/chrony-dhcp/eth0.sources" "chronyd_var_run_t"
+        rlSESearchRule "type_transition dhcpc_t var_run_t : dir chronyd_var_run_t chrony-dhcp"
+        rlSESearchRule "allow dhcpc_t chronyd_var_run_t : dir { read write } [ ]"
+        rlSESearchRule "allow dhcpc_t chronyd_var_run_t : file { create getattr append } [ ]"
+    rlPhaseEnd
     fi
 
     rlPhaseStartTest "real scenario"
+        rlRun "rm -rf /run/chrony-dhcp"
         rlRun "dhclient"
         DHCLIENT_PID=`pgrep dhclient`
         rlRun "ps -efZ | grep dhclient"
         rlRun "ps -efZ | grep ':dhcpc_t:.*dhclient'"
+        rlRun "ls -alZ /run/chrony-dhcp"
     rlPhaseEnd
 
     rlPhaseStartCleanup
         sleep 2
         rlSECheckAVC
         kill ${DHCLIENT_PID}
+        rlFileRestore
         rlServiceRestore ${SERVICE_NAME}
     rlPhaseEnd
 rlJournalPrintText