[tests/selinux] pr775-checkpolicy-revdeps: test if perf (running as sysadm_t) can use the bpf syscall

[tests/selinux] pr775-checkpolicy-revdeps: test if perf (running as sysadm_t) can use the bpf syscall

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 57b58b0d590140adcf48cbc3320468b5dd40ce05
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2023-08-11T07:59:52+00:00
            Stats  : +8/-2 in 3 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/57b58b0d590140adcf48cbc3320468b5dd40ce05?branch=pr775-checkpolicy-revdeps

            Log:
            test if perf (running as sysadm_t) can use the bpf syscall

A recent perf + perf_event testing revealed that SELinux prevents the
sysadm_u user from using the bpf syscall (permission: prog_run, class:
bpf) when running the perf program. The TC reproduces the situation.

In order to enable the sysadm_u user to use all perf features, I believe
that SELinux policy should allow this action. The TC looks for
appropriate policy rules.

The TC covers BZ#2229936.

---
diff --git a/selinux-policy/perf_event-and-related/Makefile b/selinux-policy/perf_event-and-related/Makefile
index 4aaea9a..5b736d9 100644
--- a/selinux-policy/perf_event-and-related/Makefile
+++ b/selinux-policy/perf_event-and-related/Makefile
@@ -54,7 +54,7 @@ $(METADATA): Makefile
 	@echo "Type:            Regression" >> $(METADATA)
 	@echo "TestTime:        10m" >> $(METADATA)
 	@echo "RunFor:          selinux-policy" >> $(METADATA)
-	@echo "Requires:        audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console perf expect openssh-clients initscripts" >> $(METADATA)
+	@echo "Requires:        audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console perf expect openssh-clients /usr/sbin/service" >> $(METADATA)
 	@echo "RhtsRequires:    library(selinux-policy/common)" >> $(METADATA)
 	@echo "Environment:     AVC_ERROR=+no_avc_check" >> $(METADATA)
 	@echo "Priority:        Normal" >> $(METADATA)
@@ -64,6 +64,7 @@ $(METADATA): Makefile
 	@echo "Releases:        -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA)
 	@echo "Bug:             1901957" >> $(METADATA) # Fedora 34
 	@echo "Bug:             1901958" >> $(METADATA) # RHEL-8
+	@echo "Bug:             2229936" >> $(METADATA) # RHEL-9
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/perf_event-and-related/main.fmf b/selinux-policy/perf_event-and-related/main.fmf
index 4e794c4..2241095 100644
--- a/selinux-policy/perf_event-and-related/main.fmf
+++ b/selinux-policy/perf_event-and-related/main.fmf
@@ -18,7 +18,7 @@ recommend:
   - perf
   - expect
   - openssh-clients
-  - initscripts
+  - /usr/sbin/service
 environment:
     AVC_ERROR: +no_avc_check
 duration: 10m
@@ -34,6 +34,7 @@ link:
   - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1901958
   - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2019929
   - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2070982
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2229936
 adjust:
   - enabled: false
     when: distro == rhel-4, rhel-5, rhel-6, rhel-7

diff --git a/selinux-policy/perf_event-and-related/runtest.sh b/selinux-policy/perf_event-and-related/runtest.sh
index 987d2a5..944ee91 100755
--- a/selinux-policy/perf_event-and-related/runtest.sh
+++ b/selinux-policy/perf_event-and-related/runtest.sh
@@ -64,6 +64,10 @@ rlJournalStart
         rlSESearchRule "allow sysadm_t sysadm_t : perf_event { open cpu kernel read write } [ ]"
     rlPhaseEnd
 
+    rlPhaseStartTest "bz#2229936"
+        rlSESearchRule "allow sysadm_t kernel_t : bpf { prog_run } [ ]"
+    rlPhaseEnd
+
     rlPhaseStartTest "real scenario -- perf tool under root"
         rlRun "perf record -o /dev/null echo test"
         rlRun "seinfo -c perf_event -x"