[tests/selinux] pr775-checkpolicy-revdeps: test if bootupd can search under /boot/efi/EFI

[tests/selinux] pr775-checkpolicy-revdeps: test if bootupd can search under /boot/efi/EFI

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 4b66a7926655ad17f617336eee04275390f70ad7
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2023-06-29T12:30:36+02:00
            Stats  : +9/-1 in 3 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/4b66a7926655ad17f617336eee04275390f70ad7?branch=pr775-checkpolicy-revdeps

            Log:
            test if bootupd can search under /boot/efi/EFI

Recent bootupd testing revealed SELinux denials which were triggered
because the bootupd process wanted to use the following access:
 * getattr (syscall=statx) on /boot/efi directory (dosfs_t)
 * search (syscall=openat) on /boot/efi/EFI directory (dosfs_t)

The TC reproduces the situation on machines where /boot/efi/EFI is
mounted accordingly.

In order to enable the expected functionality of the bootupd service,
I believe that SELinux policy should allow the accesses mentioned
above. The TC looks for appropriate policy rules.

The TC covers BZ#2218106.

---
diff --git a/selinux-policy/bootupd-and-similar/Makefile b/selinux-policy/bootupd-and-similar/Makefile
index 77a2f71..d83b326 100644
--- a/selinux-policy/bootupd-and-similar/Makefile
+++ b/selinux-policy/bootupd-and-similar/Makefile
@@ -64,6 +64,7 @@ $(METADATA): Makefile
 	@echo "Releases:        -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA)
 	@echo "Bug:             2029478" >> $(METADATA) # RHEL-9
 	@echo "Bug:             2044508" >> $(METADATA) # RHEL-9
+	@echo "Bug:             2218106" >> $(METADATA) # Fedora rawhide
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/bootupd-and-similar/main.fmf b/selinux-policy/bootupd-and-similar/main.fmf
index 2b38dc4..d7b2163 100644
--- a/selinux-policy/bootupd-and-similar/main.fmf
+++ b/selinux-policy/bootupd-and-similar/main.fmf
@@ -33,6 +33,7 @@ tier: '3'
 link:
   - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2029478
   - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2044508
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2218106
 adjust:
   - enabled: false
     when: distro == rhel-4, rhel-5, rhel-6, rhel-7

diff --git a/selinux-policy/bootupd-and-similar/runtest.sh b/selinux-policy/bootupd-and-similar/runtest.sh
index 86594fa..5064abc 100755
--- a/selinux-policy/bootupd-and-similar/runtest.sh
+++ b/selinux-policy/bootupd-and-similar/runtest.sh
@@ -62,6 +62,12 @@ rlJournalStart
         rlSESearchRule "type_transition ${SOURCE_TYPE} ${FILE_CONTEXT} : process ${PROCESS_CONTEXT} $BOOLEANS"
     rlPhaseEnd
 
+    rlPhaseStartTest "bz#2218106"
+        rlSEMatchPathCon "/usr/libexec/bootupd" "bootupd_exec_t"
+        rlRun "ls -RlZ /boot/efi"
+        rlSESearchRule "allow bootupd_t dosfs_t : dir { getattr search } [ ]"
+    rlPhaseEnd
+
     rlPhaseStartTest "real scenario -- standalone service"
         if ! rlSEDefined ${PROCESS_CONTEXT} ; then
             # for RHELs where the SELinux domain does not exist yet
@@ -80,7 +86,7 @@ rlJournalStart
         sleep 1
         rlRun "bootupctl status" 0,1
         rlRun "bootupctl validate" 0,1
-        rlRun "lsblk -O"
+        rlRun "lsblk"
         rlRun "systemctl stop ${SERVICE_NAME}.socket"
         rlRun "systemctl disable ${SERVICE_NAME}.socket"
     rlPhaseEnd