[tests/selinux] pr775-checkpolicy-revdeps: test if stalld can read /sys/kernel/security/lockdown

[tests/selinux] pr775-checkpolicy-revdeps: test if stalld can read /sys/kernel/security/lockdown

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 09f8be4247dc7711a965c4aea42226a2880a4051
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2022-11-07T18:28:29+01:00
            Stats  : +7/-0 in 3 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/09f8be4247dc7711a965c4aea42226a2880a4051?branch=pr775-checkpolicy-revdeps

            Log:
            test if stalld can read /sys/kernel/security/lockdown

Recent stalld testing identified the following error messages in the
systemd journal:

  stalld[...]: stalld: Permission denied

Deeper investigation revealed that SELinux prevents the stalld
processes from reading the /sys/kernel/security/lockdown file. The
TC reproduces the situation.

In order to avoid the error messages, I believe that SELinux policy
should allow the access. The TC looks for appropriate policy rules
and file context patterns.

The TC covers BZ#2140673.

---
diff --git a/selinux-policy/stalld-and-similar/Makefile b/selinux-policy/stalld-and-similar/Makefile
index 5eacb61..507e472 100644
--- a/selinux-policy/stalld-and-similar/Makefile
+++ b/selinux-policy/stalld-and-similar/Makefile
@@ -68,6 +68,7 @@ $(METADATA): Makefile
 	@echo "Bug:             2096776" >> $(METADATA) # RHEL-9
 	@echo "Bug:             2102224" >> $(METADATA) # RHEL-9
 	@echo "Bug:             2105038" >> $(METADATA) # RHEL-9
+	@echo "Bug:             2140673" >> $(METADATA) # RHEL-9
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/stalld-and-similar/main.fmf b/selinux-policy/stalld-and-similar/main.fmf
index 8ae96f0..515ad87 100644
--- a/selinux-policy/stalld-and-similar/main.fmf
+++ b/selinux-policy/stalld-and-similar/main.fmf
@@ -37,6 +37,7 @@ link:
   - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2096776
   - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2102224
   - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2105038
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2140673
 adjust:
   - enabled: false
     when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8

diff --git a/selinux-policy/stalld-and-similar/runtest.sh b/selinux-policy/stalld-and-similar/runtest.sh
index ea131ad..909a0b5 100755
--- a/selinux-policy/stalld-and-similar/runtest.sh
+++ b/selinux-policy/stalld-and-similar/runtest.sh
@@ -91,6 +91,11 @@ rlJournalStart
         rlRun "sesearch -s stalld_t -t domain -c process -p setsched -A -ds -dt | grep allow"
     rlPhaseEnd
 
+    rlPhaseStartTest "bz#2140673"
+        rlRun "ls -Z /sys/kernel/security/lockdown | grep :security_t"
+        rlSESearchRule "allow stalld_t security_t : file { getattr open read } [ ]"
+    rlPhaseEnd
+
     rlPhaseStartTest "real scenario -- standalone service"
         if ! rlSEDefined ${PROCESS_CONTEXT} ; then
             PROCESS_CONTEXT="unconfined_service_t"