[tests/selinux] pr775-checkpolicy-revdeps: test if ModemManager can create /sys/class/net/*/qmi/pass_through file

[tests/selinux] pr775-checkpolicy-revdeps: test if ModemManager can create /sys/class/net/*/qmi/pass_through file

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 6feeb9872ef4d689bb0de68a84f943de83cd7e6c
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2023-02-03T15:39:14+01:00
            Stats  : +12/-0 in 3 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/6feeb9872ef4d689bb0de68a84f943de83cd7e6c?branch=pr775-checkpolicy-revdeps

            Log:
            test if ModemManager can create /sys/class/net/*/qmi/pass_through file

Recently, various modem users reported that SELinux prevents the
ModemManager service from working with netlink route sockets and
from creating the /sys/class/net/*/qmi/pass_through file. The TC
does not reproduce the situation.

In order to support the full functionality of ModemManager service,
I believe that SELinux policy should allow these actions. The TC
looks for appropriate policy rules.

The TC covers BZ#2145005, BZ#2149560 and BZ#2149954.

---
diff --git a/selinux-policy/ModemManager-and-similar/Makefile b/selinux-policy/ModemManager-and-similar/Makefile
index 46dacc6..e1470f1 100644
--- a/selinux-policy/ModemManager-and-similar/Makefile
+++ b/selinux-policy/ModemManager-and-similar/Makefile
@@ -77,6 +77,9 @@ $(METADATA): Makefile
 	@echo "Bug:             2001144" >> $(METADATA) # Fedora 35
 	@echo "Bug:             2001145" >> $(METADATA) # Fedora 35
 	@echo "Bug:             2036582" >> $(METADATA) # RHEL-9
+	@echo "Bug:             2145005" >> $(METADATA) # Fedora 36
+	@echo "Bug:             2149560" >> $(METADATA) # RHEL-9
+	@echo "Bug:             2149954" >> $(METADATA) # Fedora 37
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/ModemManager-and-similar/main.fmf b/selinux-policy/ModemManager-and-similar/main.fmf
index c3539d8..557b9d5 100644
--- a/selinux-policy/ModemManager-and-similar/main.fmf
+++ b/selinux-policy/ModemManager-and-similar/main.fmf
@@ -49,6 +49,9 @@ link:
   - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2001144
   - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2001145
   - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2036582
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2145005
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2149560
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2149954
 adjust:
   - enabled: false
     when: distro == rhel-4, rhel-5

diff --git a/selinux-policy/ModemManager-and-similar/runtest.sh b/selinux-policy/ModemManager-and-similar/runtest.sh
index b41d316..c72292a 100755
--- a/selinux-policy/ModemManager-and-similar/runtest.sh
+++ b/selinux-policy/ModemManager-and-similar/runtest.sh
@@ -134,6 +134,12 @@ rlJournalStart
         rlSESearchRule "allow modemmanager_t modem_device_t : chr_file { getattr open read write ioctl } [ ]"
         rlSESearchRule "allow modemmanager_t unconfined_t : unix_stream_socket { connectto } [ ]"
     rlPhaseEnd
+
+    rlPhaseStartTest "bz#2145005 + bz#2149560 + bz#2149954"
+        rlSESearchRule "allow modemmanager_t modemmanager_t : netlink_route_socket { create getopt getattr nlmsg_write } [ ]"
+        rlSESearchRule "allow modemmanager_t sysfs_t : dir { write add_name } [ ]"
+        rlSESearchRule "allow modemmanager_t sysfs_t : file { create } [ ]"
+    rlPhaseEnd
     fi
 
     rlPhaseStartCleanup