[tests/selinux] pr775-checkpolicy-revdeps: test if journalctl's pager can use the prctl syscall

[tests/selinux] pr775-checkpolicy-revdeps: test if journalctl's pager can use the prctl syscall

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 43db7fa18ab610c0605a82190ef4397385be6f29
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2023-02-08T07:41:01+00:00
            Stats  : +17/-4 in 3 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/43db7fa18ab610c0605a82190ef4397385be6f29?branch=pr775-checkpolicy-revdeps

            Log:
            test if journalctl's pager can use the prctl syscall

TBA later

The TC covers BZ#2136189 and BZ#2153782.

---
diff --git a/selinux-policy/journalctl-and-similar/Makefile b/selinux-policy/journalctl-and-similar/Makefile
index 16b4c1b..bbc6bec 100644
--- a/selinux-policy/journalctl-and-similar/Makefile
+++ b/selinux-policy/journalctl-and-similar/Makefile
@@ -71,6 +71,7 @@ $(METADATA): Makefile
 	@echo "Bug:             2075527" >> $(METADATA) # Fedora 37
 	@echo "Bug:             2124427" >> $(METADATA) # Fedora 37
 	@echo "Bug:             2125762" >> $(METADATA) # Fedora 37
+	@echo "Bug:             2136189" >> $(METADATA) # RHEL-8
 	@echo "Bug:             2137323" >> $(METADATA) # Fedora 37
 	@echo "Bug:             2139623" >> $(METADATA) # Fedora 37
 	@echo "Bug:             2143157" >> $(METADATA) # Fedora 37
@@ -81,6 +82,7 @@ $(METADATA): Makefile
 	@echo "Bug:             2152544" >> $(METADATA) # Fedora 37
 	@echo "Bug:             2152588" >> $(METADATA) # Fedora 37
 	@echo "Bug:             2152823" >> $(METADATA) # RHEL-9
+	@echo "Bug:             2153782" >> $(METADATA) # RHEL-9
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/journalctl-and-similar/main.fmf b/selinux-policy/journalctl-and-similar/main.fmf
index 4ce701c..3a1cdcb 100644
--- a/selinux-policy/journalctl-and-similar/main.fmf
+++ b/selinux-policy/journalctl-and-similar/main.fmf
@@ -44,6 +44,7 @@ link:
   - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2075527
   - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2124427
   - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2125762
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2136189
   - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2137323
   - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2139623
   - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2143157
@@ -54,6 +55,7 @@ link:
   - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2152544
   - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2152588
   - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2152823
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2153782
 adjust:
   - enabled: false
     when: distro == rhel-4, rhel-5, rhel-6

diff --git a/selinux-policy/journalctl-and-similar/runtest.sh b/selinux-policy/journalctl-and-similar/runtest.sh
index 527aa23..c60084c 100755
--- a/selinux-policy/journalctl-and-similar/runtest.sh
+++ b/selinux-policy/journalctl-and-similar/runtest.sh
@@ -106,8 +106,6 @@ rlJournalStart
     fi
 
     rlPhaseStartTest "real scenario -- confined users"
-        rlSEConfigureSSH
-
         rlRun "setsebool ssh_sysadm_login on"
         rlLog "configuration says not to test SELinux users: ${DENIED_USERS}"
         for SELINUX_USER in ${ALLOWED_USERS} ; do
@@ -124,9 +122,20 @@ rlJournalStart
             sleep 10
         done
         rlRun "setsebool ssh_sysadm_login off"
+    rlPhaseEnd
+
+    rlPhaseStartTest "bz#2136189 + bz#2153782"
+        rlSESearchRule "allow journalctl_t journalctl_t : capability { sys_resource } [ ]"
+        rlSESearchRule "allow journalctl_t journalctl_t : process { setrlimit } [ ]"
 
-        rlFileRestore
-        rlRun "service sshd restart"
+        rlRun "setsebool ssh_sysadm_login on"
+        USER_NAME="toor"
+        USER_SECRET="S3kr3t${RANDOM}"
+        rlRun "useradd -o -u 0 -g 0 -Z sysadm_u ${USER_NAME}"
+        rlRun "echo ${USER_SECRET} | passwd --stdin ${USER_NAME}"
+        rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost journalctl -l --pager"
+        rlRun "userdel -rfZ ${USER_NAME}"
+        rlRun "setsebool ssh_sysadm_login off"
     rlPhaseEnd
 
     rlPhaseStartCleanup