[tests/selinux] pr775-checkpolicy-revdeps: test if targetd can search under /proc/sys/net/

[tests/selinux] pr775-checkpolicy-revdeps: test if targetd can search under /proc/sys/net/

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 38125be1724e058d54023f0c23831c7b53d030bb
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2023-07-13T09:46:10+02:00
            Stats  : +19/-4 in 3 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/38125be1724e058d54023f0c23831c7b53d030bb?branch=pr775-checkpolicy-revdeps

            Log:
            test if targetd can search under /proc/sys/net/

Recent targetd testing revealed that SELinux prevents the targetd
process from searching under the /proc/sys/net/ directory and reading
the /proc/sys/net/ipv6/conf/all/disable_ipv6 file. The TC reproduces
the situation.

In order to support the expected functionality of the targetd service,
I believe that SELinux policy should allow above-mentioned actions.
The TC looks for appropriate policy rules and file context patterns.

The TC covers BZ#2222199.

---
diff --git a/selinux-policy/targetd-and-similar/Makefile b/selinux-policy/targetd-and-similar/Makefile
index 3303609..85311e7 100644
--- a/selinux-policy/targetd-and-similar/Makefile
+++ b/selinux-policy/targetd-and-similar/Makefile
@@ -72,6 +72,7 @@ $(METADATA): Makefile
 	@echo "Bug:             1569663" >> $(METADATA) # RHEL-8
 	@echo "Bug:             2062183" >> $(METADATA) # RHEL-8
 	@echo "Bug:             2203720" >> $(METADATA) # RHEL-8
+	@echo "Bug:             2222199" >> $(METADATA) # Fedora rawhide
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/targetd-and-similar/main.fmf b/selinux-policy/targetd-and-similar/main.fmf
index 90a3e75..b4f15f5 100644
--- a/selinux-policy/targetd-and-similar/main.fmf
+++ b/selinux-policy/targetd-and-similar/main.fmf
@@ -45,6 +45,7 @@ link:
   - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1569663
   - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2062183
   - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2203720
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2222199
 adjust:
   - enabled: true
     when: distro == rhel-7, rhel-8, fedora

diff --git a/selinux-policy/targetd-and-similar/runtest.sh b/selinux-policy/targetd-and-similar/runtest.sh
index 605daf6..35fb247 100755
--- a/selinux-policy/targetd-and-similar/runtest.sh
+++ b/selinux-policy/targetd-and-similar/runtest.sh
@@ -30,7 +30,6 @@
 . /usr/share/beakerlib/beakerlib.sh || exit 1
 
 PACKAGE="selinux-policy"
-ROOT_PASSWORD="redhat"
 FILE_PATH="/usr/bin/targetd"
 FILE_CONTEXT="targetd_exec_t"
 SERVICE_PACKAGE="targetd"
@@ -154,6 +153,19 @@ rlJournalStart
         rlSESearchRule "dontaudit targetd_t httpd_config_t : dir { search } [ ]"
     rlPhaseEnd
 
+    rlPhaseStartTest "bz#2222199"
+        rlSEMatchPathCon "/usr/bin/targetd" "targetd_exec_t"
+        if [ -f /proc/sys/net/ipv6/conf/all/disable_ipv6 ] ; then
+            rlRun "ls -dZ /proc/sys/net | grep :sysctl_net_t"
+            rlRun "ls -dZ /proc/sys/net/ipv6 | grep :sysctl_net_t"
+            rlRun "ls -dZ /proc/sys/net/ipv6/conf | grep :sysctl_net_t"
+            rlRun "ls -dZ /proc/sys/net/ipv6/conf/all | grep :sysctl_net_t"
+            rlRun "ls -Z /proc/sys/net/ipv6/conf/all/disable_ipv6 | grep :sysctl_net_t"
+        fi
+        rlSESearchRule "allow targetd_t sysctl_net_t : dir { search } [ ]"
+        rlSESearchRule "allow targetd_t sysctl_net_t : file { getattr open read } [ ]"
+    rlPhaseEnd
+
     rlPhaseStartTest "real scenario -- standalone service"
         rlRun "rm -f /etc/target/saveconfig.json"
         rlRun "rm -f /etc/target/targetd.yaml"
@@ -168,15 +180,16 @@ rlJournalStart
         rlRun "losetup ${LOOP_DEVICE} ${LOOP_FILE}"
         rlRun "vgcreate vg-targetd ${LOOP_DEVICE}"
         rlRun "vgdisplay"
-        rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root"
         if ! rlSEDefined ${PROCESS_CONTEXT} ; then
             # for RHELs where the SELinux domain does not exist yet
             PROCESS_CONTEXT="initrc_t"
         fi
-        rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1
+        rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1
         rlRun "targetcli ls"
         rlRun "targetcli version"
-        rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1
+        rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status" 1
+        rlRun "restorecon -Rv /etc /var /run -e /var/ARTIFACTS" 0-255
+        rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "stop status" 1
         rlRun "vgremove vg-targetd"
         rlRun "losetup -d ${LOOP_DEVICE}"
         rlRun "rm -f ${LOOP_FILE}"