[tests/selinux] pr775-checkpolicy-revdeps: Update anon_inode test for F40

[tests/selinux] pr775-checkpolicy-revdeps: Update anon_inode test for F40

[Zdenek Pytela]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 46ea4b4457213da9dfba93fd1ac18fa5f3e60093
            Author : Zdenek Pytela <zpytela@redhat.com>
            Date   : 2023-10-09T08:25:42+00:00
            Stats  : +8/-0 in 1 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/46ea4b4457213da9dfba93fd1ac18fa5f3e60093?branch=pr775-checkpolicy-revdeps

            Log:
            Update anon_inode test for F40

Previously, selinux-policy allowed all operations on anonymous inodes
for all domains. Since F40, individual types for each anon inode type
(userfaultfd and io_uring for the moment) were defined and common
userfaultfd/io_uring usage was allowed to individual domains.
This test was adjusted to align with the new F40 state.

---
diff --git a/selinux-policy/anon_inode-and-similar/runtest.sh b/selinux-policy/anon_inode-and-similar/runtest.sh
index a58a606..f3fdcaa 100755
--- a/selinux-policy/anon_inode-and-similar/runtest.sh
+++ b/selinux-policy/anon_inode-and-similar/runtest.sh
@@ -62,14 +62,22 @@ rlJournalStart
         rlRun "./reproducer"
         sleep 3
         rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time --input-logs" 1
+	if rlIsFedora '<=39'; then
         rlSESearchRule "allow unconfined_t unconfined_t : anon_inode { write }"
+	fi
         rlRun "rm -f reproducer"
     rlPhaseEnd
 
     rlPhaseStartTest "mmap on io_uring - bz#2025714 + bz#2187745"
+      if rlIsFedora '<=39'; then
         rlSESearchRule "allow unconfined_t unconfined_t : anon_inode { map } [ ]"
         rlSESearchRule "allow svirt_t svirt_t : anon_inode { map } [ ]"
         rlSESearchRule "allow virtd_t virtd_t : anon_inode { map } [ ]"
+      else
+        rlSESearchRule "allow unconfined_t io_uring_t : anon_inode { create getattr map read write } [ ]"
+        rlSESearchRule "allow svirt_t io_uring_t : anon_inode { create getattr map read write } [ ]"
+        rlSESearchRule "allow virtd_t io_uring_t : anon_inode { create getattr map read write } [ ]"
+      fi
 
         rlRun "fio --filename=/root/pokus --iodepth=16 --rw=write --ioengine=io_uring --bs=16k --size=2G --numjobs=30 --runtime=100s --group_reporting=1 --name=mytest" 0-255
     rlPhaseEnd