[tests/selinux] pr775-checkpolicy-revdeps: test if systemd-timesyncd can watch the /run/systemd/ directory

[tests/selinux] pr775-checkpolicy-revdeps: test if systemd-timesyncd can watch the /run/systemd/ directory

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : b6e50398b54d34e694e60635d66ff649e67ac133
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2023-03-06T15:59:28+00:00
            Stats  : +16/-7 in 3 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/b6e50398b54d34e694e60635d66ff649e67ac133?branch=pr775-checkpolicy-revdeps

            Log:
            test if systemd-timesyncd can watch the /run/systemd/ directory

The use of the systemd-timesyncd service revealed that SELinux
prevents the systemd-timesyncd processes from watching (syscall =
inotify_add_watch) the /run/systemd/ directory. The TC reproduces
the situation.

In order to successfully start the systemd-timesyncd service in
enforcing mode, I believe that this access should be allowed in
SELinux policy. The TC looks for appropriate policy rules and
file context patterns.

The TC covers BZ#2175137.

---
diff --git a/selinux-policy/systemd-timesyncd-and-similar/Makefile b/selinux-policy/systemd-timesyncd-and-similar/Makefile
index e47a5c9..a5fdcf0 100644
--- a/selinux-policy/systemd-timesyncd-and-similar/Makefile
+++ b/selinux-policy/systemd-timesyncd-and-similar/Makefile
@@ -55,8 +55,7 @@ $(METADATA): Makefile
 	@echo "TestTime:        10m" >> $(METADATA)
 	@echo "RunFor:          selinux-policy" >> $(METADATA)
 	@echo "RunFor:          systemd" >> $(METADATA)
-	@echo "Requires:        audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console systemd-udev initscripts" >> $(METADATA)
-	@echo "Requires:        systemd-timesyncd" >> $(METADATA) # EPEL
+	@echo "Requires:        audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console /usr/sbin/service /usr/lib/systemd/systemd-timesyncd" >> $(METADATA) # EPEL
 	@echo "RhtsRequires:    library(selinux-policy/common)" >> $(METADATA)
 	@echo "Environment:     AVC_ERROR=+no_avc_check" >> $(METADATA)
 	@echo "Priority:        Normal" >> $(METADATA)
@@ -74,6 +73,7 @@ $(METADATA): Makefile
 	@echo "Bug:             1822131" >> $(METADATA) # Fedora 32
 	@echo "Bug:             1869979" >> $(METADATA) # RHEL-8
 	@echo "Bug:             1949315" >> $(METADATA) # Fedora 34
+	@echo "Bug:             2175137" >> $(METADATA) # RHEL-9
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/systemd-timesyncd-and-similar/main.fmf b/selinux-policy/systemd-timesyncd-and-similar/main.fmf
index 4c90d39..9f69db6 100644
--- a/selinux-policy/systemd-timesyncd-and-similar/main.fmf
+++ b/selinux-policy/systemd-timesyncd-and-similar/main.fmf
@@ -16,9 +16,8 @@ recommend:
   - selinux-policy
   - selinux-policy-targeted
   - setools-console
-  - systemd-udev
-  - initscripts
-  - systemd-timesyncd
+  - /usr/sbin/service
+  - /usr/lib/systemd/systemd-timesyncd
 environment:
     AVC_ERROR: +no_avc_check
 duration: 10m
@@ -49,9 +48,13 @@ link:
   - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1869979
   - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1949315
   - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1970865
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2175137
 adjust:
   - enabled: false
     when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7
+    because: the systemd-timesyncd service is not available there
+  - enabled: false
+    when: arch == i386, ppc64, s390
     continue: false
 extra-nitrate: TC#0606395
 extra-summary: /CoreOS/selinux-policy/Regression/systemd-timesyncd-and-similar

diff --git a/selinux-policy/systemd-timesyncd-and-similar/runtest.sh b/selinux-policy/systemd-timesyncd-and-similar/runtest.sh
index 37f186c..46d6731 100755
--- a/selinux-policy/systemd-timesyncd-and-similar/runtest.sh
+++ b/selinux-policy/systemd-timesyncd-and-similar/runtest.sh
@@ -33,7 +33,7 @@ PACKAGE="selinux-policy"
 ROOT_PASSWORD="redhat"
 FILE_PATH="/usr/lib/systemd/systemd-timesyncd"
 FILE_CONTEXT="systemd_timedated_exec_t"
-SERVICE_PACKAGE="systemd-udev"
+SERVICE_PACKAGE=`rpm -qf ${FILE_PATH}`
 SERVICE_NAME="systemd-timesyncd"
 PROCESS_NAME="systemd-timesyncd"
 PROCESS_CONTEXT="systemd_timedated_t"
@@ -109,9 +109,15 @@ rlJournalStart
         rlSESearchRule "allow systemd_timedated_t root_t : dir { watch } [ ]"
         rlSESearchRule "allow systemd_timedated_t var_run_t : dir { watch } [ ]"
     rlPhaseEnd
+
+    rlPhaseStartTest "bz#2175137"
+        rlSEMatchPathCon "/usr/lib/systemd/systemd-timesyncd" "systemd_timedated_exec_t"
+        rlSEMatchPathCon "/run/systemd/" "init_var_run_t"
+        rlSESearchRule "allow systemd_timedated_t init_var_run_t : dir { watch } [ ]"
+    rlPhaseEnd
     fi
 
-    if systemctl list-units | grep -q ${SERVICE_NAME} ; then
+    if systemctl list-unit-files | grep -q ${SERVICE_NAME} ; then
     rlPhaseStartTest "real scenario -- standalone service"
         rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root"
         if ! rlSEDefined ${PROCESS_CONTEXT} ; then