[tests/selinux] pr775-checkpolicy-revdeps: test if stacctl and stafctl work as expected

[tests/selinux] pr775-checkpolicy-revdeps: test if stacctl and stafctl work as expected

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : ac2bb3d8e0a52009799fe17376219387e0c0c252
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2023-09-20T15:58:59+02:00
            Stats  : +12/-3 in 4 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/ac2bb3d8e0a52009799fe17376219387e0c0c252?branch=pr775-checkpolicy-revdeps

            Log:
            test if stacctl and stafctl work as expected

A recent testing of new policy for the stacd and stafd services
revealed that SELinux prevents the stacctl and stafctl programs
from communicating with the daemons via D-bus (send_msg permission).
The TC reproduces the situation.

In order to support the D-bus communication in both directions
(unconfined -> stas_t, stas_t -> unconfined_t), I believe that
SELinux policy should allow the action. The TC looks for appropriate
policy rules.

The TC covers RHEL-1557.

---
diff --git a/selinux-policy/nvme-stas-and-similar/Makefile b/selinux-policy/nvme-stas-and-similar/Makefile
index e528da4..b2e07cb 100644
--- a/selinux-policy/nvme-stas-and-similar/Makefile
+++ b/selinux-policy/nvme-stas-and-similar/Makefile
@@ -64,6 +64,7 @@ $(METADATA): Makefile
 	@echo "Destructive:     no" >> $(METADATA)
 	@echo "Releases:        -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA)
 	@echo "Bug:             2111414" >> $(METADATA) # RHEL-9
+	@echo "Bug:             RHEL-1557" >> $(METADATA) # RHEL-9
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/nvme-stas-and-similar/PURPOSE b/selinux-policy/nvme-stas-and-similar/PURPOSE
index 5f9b111..a0cc42a 100644
--- a/selinux-policy/nvme-stas-and-similar/PURPOSE
+++ b/selinux-policy/nvme-stas-and-similar/PURPOSE
@@ -1,5 +1,6 @@
 PURPOSE of /CoreOS/selinux-policy/Regression/nvme-stas-and-similar
 Author: Milos Malik <mmalik@redhat.com>
 
-SELinux interferes with NVME sta* services
+SELinux interferes with stacd, stafd services.
+SELinux also affects the stacctl and stafctl programs.
 

diff --git a/selinux-policy/nvme-stas-and-similar/main.fmf b/selinux-policy/nvme-stas-and-similar/main.fmf
index 0e83395..76b2ef4 100644
--- a/selinux-policy/nvme-stas-and-similar/main.fmf
+++ b/selinux-policy/nvme-stas-and-similar/main.fmf
@@ -32,6 +32,7 @@ tag:
   - targeted
 link:
   - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2111414
+  - verifies: https://issues.redhat.com/browse/RHEL-1557
 adjust:
   - enabled: false
     when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8

diff --git a/selinux-policy/nvme-stas-and-similar/runtest.sh b/selinux-policy/nvme-stas-and-similar/runtest.sh
index a86991e..725e2e9 100755
--- a/selinux-policy/nvme-stas-and-similar/runtest.sh
+++ b/selinux-policy/nvme-stas-and-similar/runtest.sh
@@ -54,7 +54,7 @@ rlJournalStart
     rlPhaseEnd
 
     if rlSEDefined "${FILE_CONTEXT} ${PROCESS_CONTEXT}" ; then
-    rlPhaseStartTest "bz#2111414"
+    rlPhaseStartTest "bz#2111414 + RHEL-1557"
         rlSEMatchPathCon "/usr/sbin/stacd" "${FILE_CONTEXT}"
         rlSEMatchPathCon "/usr/sbin/stafd" "${FILE_CONTEXT}"
         rlSEMatchPathCon "/dev/nvme-fabrics" "fixed_disk_device_t"
@@ -82,6 +82,8 @@ rlJournalStart
         rlSESearchRule "allow stas_t udev_var_run_t : dir { add_name remove_name write } [ ]"
         rlSESearchRule "allow stas_t udev_var_run_t : file { create getattr ioctl open unlink write } [ ]"
         rlSESearchRule "allow stas_t stas_var_run_t : file { getattr ioctl open read write } [ ]"
+        rlSESearchRule "allow unconfined_t nvme_stas_t : dbus { send_msg } [ ]"
+        rlSESearchRule "allow nvme_stas_t unconfined_t : dbus { send_msg } [ ]"
     rlPhaseEnd
     fi
 
@@ -95,14 +97,18 @@ rlJournalStart
             fi
         done
         if ! rlSEDefined ${PROCESS_CONTEXT} ; then
-            # for RHELs where the SELinux domain does not exist yet
+            # for environments where the SELinux domain does not exist yet
             PROCESS_CONTEXT="unconfined_service_t"
         fi
         rlRun "mkdir -p /etc/nvme"
         rlRun "touch /etc/nvme/hostid"
         rlRun "touch /etc/nvme/hostnqn"
         rlSEService - stafd stafd ${PROCESS_CONTEXT} "start status" 1
+        rlRun "stafctl status"
+        rlRun "stafctl ls"
         rlSEService - stacd stacd ${PROCESS_CONTEXT} "start status" 1
+        rlRun "stacctl status"
+        rlRun "stacctl ls"
         rlRun "stasadm -v"
         rlRun "stasadm hostid"
         rlRun "stasadm hostnqn"