[tests/selinux] pr775-checkpolicy-revdeps: test if stalld can use sched_setattr on kernel

[tests/selinux] pr775-checkpolicy-revdeps: test if stalld can use sched_setattr on kernel

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 606eccfd7518983b65d081d21233c3a1366fa323
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2022-06-30T09:51:02+02:00
            Stats  : +6/-0 in 3 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/606eccfd7518983b65d081d21233c3a1366fa323?branch=pr775-checkpolicy-revdeps

            Log:
            test if stalld can use sched_setattr on kernel

Recent stalld testing revealed that SELinux prevents the stalld
processes from using the sched_setattr syscall on the running
kernel threads. The TC does not reproduce the situation.

In order to avoid the SELinux denials and support all functions
of the stalld service, SELinux policy should allow the use of
sched_setattr syscall. The TC looks for appropriate policy rules.

The TC covers BZ#2102224.

---
diff --git a/selinux-policy/stalld-and-similar/Makefile b/selinux-policy/stalld-and-similar/Makefile
index b15214c..b42a334 100644
--- a/selinux-policy/stalld-and-similar/Makefile
+++ b/selinux-policy/stalld-and-similar/Makefile
@@ -66,6 +66,7 @@ $(METADATA): Makefile
 	@echo "Bug:             2042614" >> $(METADATA) # RHEL-9
 	@echo "Bug:             2092864" >> $(METADATA) # RHEL-9
 	@echo "Bug:             2096776" >> $(METADATA) # RHEL-9
+	@echo "Bug:             2102224" >> $(METADATA) # RHEL-9
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/stalld-and-similar/main.fmf b/selinux-policy/stalld-and-similar/main.fmf
index 23f4aaf..1d17a08 100644
--- a/selinux-policy/stalld-and-similar/main.fmf
+++ b/selinux-policy/stalld-and-similar/main.fmf
@@ -35,6 +35,7 @@ link:
   - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2042614
   - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2092864
   - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2096776
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2102224
 adjust:
   - enabled: false
     when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8

diff --git a/selinux-policy/stalld-and-similar/runtest.sh b/selinux-policy/stalld-and-similar/runtest.sh
index 28ebee0..217f598 100755
--- a/selinux-policy/stalld-and-similar/runtest.sh
+++ b/selinux-policy/stalld-and-similar/runtest.sh
@@ -82,6 +82,10 @@ rlJournalStart
         rlSESearchRule "allow stalld_t kernel_t : process { getsched } [ ]"
     rlPhaseEnd
 
+    rlPhaseStartTest "bz#2102224"
+        rlSESearchRule "allow stalld_t kernel_t : process { setsched } [ ]"
+    rlPhaseEnd
+
     rlPhaseStartTest "real scenario -- standalone service"
         if ! rlSEDefined ${PROCESS_CONTEXT} ; then
             PROCESS_CONTEXT="unconfined_service_t"