[tests/selinux] pr775-checkpolicy-revdeps: test if systemd-modules-load can work with /dev/kmsg and systemd-journal

[tests/selinux] pr775-checkpolicy-revdeps: test if systemd-modules-load can work with /dev/kmsg and systemd-journal

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : d121114f70414815336f6d304cb086ab8650511a
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2022-08-15T16:48:26+02:00
            Stats  : +14/-0 in 3 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/d121114f70414815336f6d304cb086ab8650511a?branch=pr775-checkpolicy-revdeps

            Log:
            test if systemd-modules-load can work with /dev/kmsg and systemd-journal

Recent RDMA testing revealed that systemd-modules-load processes
cannot use openat syscall on /dev/kmsg and cannot use connect syscall
on /run/systemd/journal/socket because SELinux denies that. The
TC reproduces the situation when executed on a machine equipped
with RDMA (Infiniband) HW.

Because this scenario should work, I believe that SELinux policy
should allow above-mentioned actions. The TC looks for appropriate
policy rules and file context patterns.

The TC covers BZ#2088257 and BZ#2088258.

---
diff --git a/selinux-policy/systemd-modules-load-and-similar/Makefile b/selinux-policy/systemd-modules-load-and-similar/Makefile
index 8631adb..d53ce0c 100644
--- a/selinux-policy/systemd-modules-load-and-similar/Makefile
+++ b/selinux-policy/systemd-modules-load-and-similar/Makefile
@@ -82,6 +82,8 @@ $(METADATA): Makefile
 	@echo "Bug:             1838933" >> $(METADATA) # Fedora 32
 	@echo "Bug:             1942267" >> $(METADATA) # Fedora 32
 	@echo "Bug:             1972372" >> $(METADATA) # RHEL 9
+	@echo "Bug:             2088257" >> $(METADATA) # RHEL-9
+	@echo "Bug:             2088258" >> $(METADATA) # RHEL-9
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/systemd-modules-load-and-similar/main.fmf b/selinux-policy/systemd-modules-load-and-similar/main.fmf
index 0adedeb..1e18e2e 100644
--- a/selinux-policy/systemd-modules-load-and-similar/main.fmf
+++ b/selinux-policy/systemd-modules-load-and-similar/main.fmf
@@ -51,6 +51,8 @@ link:
   - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1942267
   - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1972372
   - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1850953
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2088257
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2088258
 adjust:
   - enabled: false
     when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7

diff --git a/selinux-policy/systemd-modules-load-and-similar/runtest.sh b/selinux-policy/systemd-modules-load-and-similar/runtest.sh
index b7bc865..2e250b4 100755
--- a/selinux-policy/systemd-modules-load-and-similar/runtest.sh
+++ b/selinux-policy/systemd-modules-load-and-similar/runtest.sh
@@ -130,6 +130,16 @@ rlJournalStart
         fi
     rlPhaseEnd
 
+    if ! rlIsRHEL 8 ; then
+    rlPhaseStartTest "bz#2088257 + bz#2088258"
+        rlSEMatchPathCon "/usr/lib/systemd/systemd-modules-load" "systemd_modules_load_exec_t"
+        rlSEMatchPathCon "/dev/kmsg" "kmsg_device_t"
+        rlSEMatchPathCon "/run/systemd/journal/socket" "syslogd_var_run_t"
+        rlSESearchRule "allow systemd_modules_load_t syslogd_t : unix_dgram_socket { sendto } [ ]"
+        rlSESearchRule "allow systemd_modules_load_t kmsg_device_t : chr_file { write } [ ]"
+    rlPhaseEnd
+    fi
+
     rlPhaseStartCleanup
         sleep 2
         rlSECheckAVC