[tests/selinux] pr775-checkpolicy-revdeps: test if journal-offline can relabel the journal files

[tests/selinux] pr775-checkpolicy-revdeps: test if journal-offline can relabel the journal files

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : a59d3c04ad3f6a225e12da6ba2dee73ab7ba612d
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2022-12-14T10:03:04+01:00
            Stats  : +33/-1 in 3 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/a59d3c04ad3f6a225e12da6ba2dee73ab7ba612d?branch=pr775-checkpolicy-revdeps

            Log:
            test if journal-offline can relabel the journal files

Recently, the new versions of systemd component revealed that SELinux
prevents the journal-offline command from relabeling (syscall=fsetxattr)
the systemd journal files. The TC reproduces the situation.

Because the relabeling of journal files is an intentional operation,
which happens when the systemd journal is rotated, I believe that
SELinux policy should allow it. The TC looks for appropriate policy
rules.

The TC covers BZ#2075527 and BZ#2152823 and their duplicates.

---
diff --git a/selinux-policy/journalctl-and-similar/Makefile b/selinux-policy/journalctl-and-similar/Makefile
index 65967a4..16b4c1b 100644
--- a/selinux-policy/journalctl-and-similar/Makefile
+++ b/selinux-policy/journalctl-and-similar/Makefile
@@ -68,6 +68,19 @@ $(METADATA): Makefile
 	@echo "Bug:             1685689" >> $(METADATA) # RHEL-8
 	@echo "Bug:             1825894" >> $(METADATA) # RHEL-8
 	@echo "Bug:             2017838" >> $(METADATA) # RHEL-9
+	@echo "Bug:             2075527" >> $(METADATA) # Fedora 37
+	@echo "Bug:             2124427" >> $(METADATA) # Fedora 37
+	@echo "Bug:             2125762" >> $(METADATA) # Fedora 37
+	@echo "Bug:             2137323" >> $(METADATA) # Fedora 37
+	@echo "Bug:             2139623" >> $(METADATA) # Fedora 37
+	@echo "Bug:             2143157" >> $(METADATA) # Fedora 37
+	@echo "Bug:             2143746" >> $(METADATA) # Fedora 37
+	@echo "Bug:             2144150" >> $(METADATA) # Fedora 37
+	@echo "Bug:             2149093" >> $(METADATA) # Fedora 37
+	@echo "Bug:             2149346" >> $(METADATA) # Fedora 37
+	@echo "Bug:             2152544" >> $(METADATA) # Fedora 37
+	@echo "Bug:             2152588" >> $(METADATA) # Fedora 37
+	@echo "Bug:             2152823" >> $(METADATA) # RHEL-9
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/journalctl-and-similar/main.fmf b/selinux-policy/journalctl-and-similar/main.fmf
index ae50c2f..4ce701c 100644
--- a/selinux-policy/journalctl-and-similar/main.fmf
+++ b/selinux-policy/journalctl-and-similar/main.fmf
@@ -41,7 +41,19 @@ link:
   - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1685689
   - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1825894
   - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2017838
-  - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1703241
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2075527
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2124427
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2125762
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2137323
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2139623
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2143157
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2143746
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2144150
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2149093
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2149346
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2152544
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2152588
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2152823
 adjust:
   - enabled: false
     when: distro == rhel-4, rhel-5, rhel-6

diff --git a/selinux-policy/journalctl-and-similar/runtest.sh b/selinux-policy/journalctl-and-similar/runtest.sh
index 7c471e9..527aa23 100755
--- a/selinux-policy/journalctl-and-similar/runtest.sh
+++ b/selinux-policy/journalctl-and-similar/runtest.sh
@@ -98,6 +98,13 @@ rlJournalStart
     rlPhaseEnd
     fi
 
+    if ! rlIsRHEL 7 8 ; then
+    rlPhaseStartTest "bz#2075527 + bz#2152823"
+        rlSESearchRule "allow syslogd_t syslogd_var_run_t : file { relabelfrom relabelto } [ ]"
+        rlRun "journalctl --rotate"
+    rlPhaseEnd
+    fi
+
     rlPhaseStartTest "real scenario -- confined users"
         rlSEConfigureSSH