[tests/selinux] pr775-checkpolicy-revdeps: test if systemd-localed can create /etc/X11/xorg.conf.d/

[tests/selinux] pr775-checkpolicy-revdeps: test if systemd-localed can create /etc/X11/xorg.conf.d/

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 1e53ae882349cf40ce883d5ef93377cc641411f5
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2023-10-03T13:52:57+00:00
            Stats  : +86/-0 in 2 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/1e53ae882349cf40ce883d5ef93377cc641411f5?branch=pr775-checkpolicy-revdeps

            Log:
            test if systemd-localed can create /etc/X11/xorg.conf.d/

A recently filed bug report revealed that SELinux prevents the
systemd-localed processes from creating the /etc/X11/xorg.conf.d
directory if it does not exist. The TC reproduces the situation.

In order to enable the legacy systemd-localed functionality,
I believe that SELinux policy should allow the action. The TC
looks for appropriate policy rules and file context patterns.

The TC covers BZ#2240159.

---
diff --git a/selinux-policy/systemd-localed/main.fmf b/selinux-policy/systemd-localed/main.fmf
new file mode 100644
index 0000000..7049593
--- /dev/null
+++ b/selinux-policy/systemd-localed/main.fmf
@@ -0,0 +1,35 @@
+summary: SELinux interferes with systemd-localed and localectl
+test: ./test.sh
+framework: beakerlib
+contact: Milos Malik <mmalik@redhat.com>
+component:
+  - selinux-policy
+require:
+  - library(selinux-policy/common)
+recommend:
+  - audit
+  - libselinux
+  - libselinux-utils
+  - policycoreutils
+  - selinux-policy
+  - selinux-policy-targeted
+  - setools-console
+  - /usr/sbin/service
+  - systemd
+environment:
+    AVC_ERROR: +no_avc_check
+duration: 10m
+enabled: true
+tag:
+  - NoRHEL4
+  - NoRHEL5
+  - NoRHEL6
+  - NoRHEL7
+  - targeted
+link:
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2240159
+adjust:
+  - enabled: false
+    when: distro == rhel-4, rhel-5, rhel-6, rhel-7
+    continue: false
+

diff --git a/selinux-policy/systemd-localed/test.sh b/selinux-policy/systemd-localed/test.sh
new file mode 100755
index 0000000..84ba7d2
--- /dev/null
+++ b/selinux-policy/systemd-localed/test.sh
@@ -0,0 +1,51 @@
+#!/bin/bash
+# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGE="selinux-policy"
+SERVICE_PACKAGE="systemd"
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlRun "rlImport 'selinux-policy/common'"
+        rlAssertRpm ${PACKAGE}
+        rlAssertRpm ${PACKAGE}-targeted
+        rlAssertRpm ${SERVICE_PACKAGE}
+
+        rlServiceStop systemd-localed
+        rlFileBackup --clean --missing-ok /etc/X11/xorg.conf.d
+
+        rlSESetEnforce
+        rlSEStatus
+        rlSESetTimestamp
+        sleep 2
+    rlPhaseEnd
+
+    rlPhaseStartTest "bz#2240159"
+        rlSEMatchPathCon "/usr/lib/systemd/systemd-localed" "systemd_localed_exec_t"
+        rlSEMatchPathCon "/etc/X11/xorg.conf.d" "xserver_etc_t"
+        rlSESearchRule "allow systemd_localed_t xserver_etc_t : dir { create } [ ]"
+    rlPhaseEnd
+
+    rlPhaseStartTest "real scenario -- bz#2240159"
+        if [ -d /etc/X11/xorg.conf.d ] ; then
+            rlRun "rpm -qf /etc/X11/xorg.conf.d" 0,1
+            rlRun "rm -rf /etc/X11/xorg.conf.d"
+        fi
+        rlRun "service systemd-localed start"
+        rlRun "service systemd-localed status"
+        rlRun "localectl set-x11-keymap us"
+        rlRun "ls -lZ /etc/X11/xorg.conf.d"
+        rlRun "service systemd-localed stop"
+        rlRun "service systemd-localed status" 3
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        sleep 2
+        rlSECheckAVC
+
+        rlFileRestore
+        rlServiceRestore systemd-localed
+    rlPhaseEnd
+rlJournalEnd
+