[tests/selinux] pr775-checkpolicy-revdeps: test if systemd-rfkill can use the bpf capability

[tests/selinux] pr775-checkpolicy-revdeps: test if systemd-rfkill can use the bpf capability

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 677e8492b98881b2f14532ef3500c2ffbddc3900
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2022-12-02T19:48:14+01:00
            Stats  : +10/-1 in 3 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/677e8492b98881b2f14532ef3500c2ffbddc3900?branch=pr775-checkpolicy-revdeps

            Log:
            test if systemd-rfkill can use the bpf capability

Recent RHEL-9.2 instalation testing revealed that SELinux prevents
the systemd-rfkill processes from using the bpf capability. The TC
does not reproduce the situation unless the right HW is available.

In order to support the full functionality of the systemd-rfkill
program, I believe that SELinux policy should allow this action.
The TC looks for appropriate policy rule.

The TC covers BZ#2149390.

---
diff --git a/selinux-policy/systemd-rfkill-and-similar/Makefile b/selinux-policy/systemd-rfkill-and-similar/Makefile
index 1c92453..05acb33 100644
--- a/selinux-policy/systemd-rfkill-and-similar/Makefile
+++ b/selinux-policy/systemd-rfkill-and-similar/Makefile
@@ -72,6 +72,7 @@ $(METADATA): Makefile
 	@echo "Bug:             1557595" >> $(METADATA) # Fedora 27
 	@echo "Bug:             1638981" >> $(METADATA) # Fedora 29
 	@echo "Bug:             1661724" >> $(METADATA) # Fedora 30
+	@echo "Bug:             2149390" >> $(METADATA) # RHEL-9
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/systemd-rfkill-and-similar/main.fmf b/selinux-policy/systemd-rfkill-and-similar/main.fmf
index 8fb5e1e..827d38a 100644
--- a/selinux-policy/systemd-rfkill-and-similar/main.fmf
+++ b/selinux-policy/systemd-rfkill-and-similar/main.fmf
@@ -45,6 +45,7 @@ link:
   - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1557595
   - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1638981
   - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1661724
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2149390
 adjust:
   - enabled: false
     when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7

diff --git a/selinux-policy/systemd-rfkill-and-similar/runtest.sh b/selinux-policy/systemd-rfkill-and-similar/runtest.sh
index 73addd0..cbebe00 100755
--- a/selinux-policy/systemd-rfkill-and-similar/runtest.sh
+++ b/selinux-policy/systemd-rfkill-and-similar/runtest.sh
@@ -47,6 +47,7 @@ rlJournalStart
         rlAssertRpm ${SERVICE_PACKAGE}
         rlRun "rpm -qa kernel\*"
         rlRun "uname -r"
+        rlRun "yum -y install kernel-modules-`uname -r`"
 
         rlServiceStop ${SERVICE_NAME}
         rlFileBackup /etc/shadow
@@ -101,6 +102,12 @@ rlJournalStart
         rlSESearchRule "allow systemd_rfkill_t syslogd_t : unix_dgram_socket { sendto } [ ]"
     rlPhaseEnd
 
+    if [ -f /sys/fs/selinux/class/capability2/perms/bpf ] ; then
+    rlPhaseStartTest "bz#2149390"
+        rlSESearchRule "allow systemd_rfkill_t systemd_rfkill_t : capability2 { bpf } [ ]"
+    rlPhaseEnd
+    fi
+
     rlPhaseStartTest "real scenario -- standalone service"
         rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root"
         if ! rlSEDefined ${PROCESS_CONTEXT} ; then
@@ -111,7 +118,7 @@ rlJournalStart
         fi
         rlRun "modprobe rfkill"
         rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1
-        rlRun "restorecon -Rv /run /var" 0-255
+        rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255
         rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1
     rlPhaseEnd