[tests/selinux] pr775-checkpolicy-revdeps: test if cups-pdf can connect to /run/systemd/userdb/io.systemd.DynamicUser

[tests/selinux] pr775-checkpolicy-revdeps: test if cups-pdf can connect to /run/systemd/userdb/io.systemd.DynamicUser

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 23c3caa982fb1c8262d9bd4f05b98995057c1bf3
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2023-08-30T15:02:03+02:00
            Stats  : +6/-0 in 3 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/23c3caa982fb1c8262d9bd4f05b98995057c1bf3?branch=pr775-checkpolicy-revdeps

            Log:
            test if cups-pdf can connect to /run/systemd/userdb/io.systemd.DynamicUser

A recent samba and cups-pdf testing revealed that SELinux prevents
the cups-pdf processes from connecting to UNIX stream socket:
 * /run/systemd/userdb/io.systemd.DynamicUser (kernel_t)

The TC reproduces the situation.

In order to support the whole cups-pdf functionality, I believe that
SELinux policy should allow the action. The TC looks for appropriate
policy rules.

The TC covers BZ#2234765.

---
diff --git a/selinux-policy/cups-pdf-and-similar/Makefile b/selinux-policy/cups-pdf-and-similar/Makefile
index b3668ab..c5b6428 100644
--- a/selinux-policy/cups-pdf-and-similar/Makefile
+++ b/selinux-policy/cups-pdf-and-similar/Makefile
@@ -72,6 +72,7 @@ $(METADATA): Makefile
 	@echo "Bug:             1594271" >> $(METADATA) # Fedora 28
 	@echo "Bug:             1700442" >> $(METADATA) # Fedora 28
 	@echo "Bug:             1832521" >> $(METADATA) # Fedora 32
+	@echo "Bug:             2234765" >> $(METADATA) # RHEL-9
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/cups-pdf-and-similar/main.fmf b/selinux-policy/cups-pdf-and-similar/main.fmf
index 45a71bd..b037121 100644
--- a/selinux-policy/cups-pdf-and-similar/main.fmf
+++ b/selinux-policy/cups-pdf-and-similar/main.fmf
@@ -43,6 +43,7 @@ link:
   - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1594271
   - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1700442
   - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1832521
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2234765
 adjust:
   - enabled: false
     when: distro == rhel-4, rhel-5, rhel-6, rhel-alt-7

diff --git a/selinux-policy/cups-pdf-and-similar/runtest.sh b/selinux-policy/cups-pdf-and-similar/runtest.sh
index 9820e7d..86c5aab 100755
--- a/selinux-policy/cups-pdf-and-similar/runtest.sh
+++ b/selinux-policy/cups-pdf-and-similar/runtest.sh
@@ -109,6 +109,10 @@ rlJournalStart
     rlPhaseStartTest "bz#1832521"
         rlSESearchRule "allow cups_pdf_t cups_pdf_t : unix_dgram_socket { create connect } [ ]"
     rlPhaseEnd
+
+    rlPhaseStartTest "bz#2234765"
+        rlSESearchRule "allow cups_pdf_t kernel_t : unix_stream_socket { connectto } [ ]"
+    rlPhaseEnd
     fi
 
     rlPhaseStartTest "real scenario -- confined users"