[tests/selinux] pr775-checkpolicy-revdeps: test if numad can use the ipc_owner capability

[tests/selinux] pr775-checkpolicy-revdeps: test if numad can use the ipc_owner capability

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : e1f30f13fb3c8518f5e13e4713a47faf9bf54e26
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2023-10-12T14:33:14+00:00
            Stats  : +13/-3 in 3 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/e1f30f13fb3c8518f5e13e4713a47faf9bf54e26?branch=pr775-checkpolicy-revdeps

            Log:
            test if numad can use the ipc_owner capability

A scenario which combines the numad service, a libvirt VM and the
following libvirt configuration option revealed that SELinux prevents
the numad processes from using the ipc_owner capability:

  <vcpu placement="auto" />

In order to support the whole numad functionality, I believe that
SELinux policy should allow the action. The TC looks for appropriate
policy rule.

The TC covers BZ#2026968 and RHEL-2415.

---
diff --git a/selinux-policy/numad-and-similar/Makefile b/selinux-policy/numad-and-similar/Makefile
index cff1beb..10f6781 100644
--- a/selinux-policy/numad-and-similar/Makefile
+++ b/selinux-policy/numad-and-similar/Makefile
@@ -73,12 +73,14 @@ $(METADATA): Makefile
 	@echo "Confidential:    no" >> $(METADATA)
 	@echo "Destructive:     no" >> $(METADATA)
 	@echo "Environment:     AVC_ERROR=+no_avc_check" >> $(METADATA)
-	@echo "Architectures:   i386 ppc64 x86_64" >> $(METADATA)
-	@echo "Releases:        -RHEL4 -RHELServer5 -RHELClient5" >> $(METADATA)
+	@echo "Architectures:   aarch64 ppc64le x86_64" >> $(METADATA)
+	@echo "Releases:        -RHEL4 -RHEL5" >> $(METADATA)
 	@echo "Bug:             807157" >> $(METADATA) # RHEL-6
 	@echo "Bug:             857086" >> $(METADATA) # RHEL-7
 	@echo "Bug:             1074449" >> $(METADATA) # RHEL-7
 	@echo "Bug:             1118515" >> $(METADATA) # RHEL-7
+	@echo "Bug:             2026968" >> $(METADATA) # Fedora 35
+	@echo "Bug:             RHEL-2415" >> $(METADATA) # RHEL-8
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/numad-and-similar/main.fmf b/selinux-policy/numad-and-similar/main.fmf
index 1164ae8..ec35de1 100644
--- a/selinux-policy/numad-and-similar/main.fmf
+++ b/selinux-policy/numad-and-similar/main.fmf
@@ -39,12 +39,14 @@ link:
   - relates: https://bugzilla.redhat.com/show_bug.cgi?id=857086
   - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1074449
   - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1118515
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2026968
+  - verifies: https://issues.redhat.com/browse/RHEL-2415
 adjust:
   - enabled: false
     when: distro == rhel-4, rhel-5
     continue: false
   - enabled: false
-    when: arch != x86_64 and arch != ppc64 and arch != ppc64le
+    when: arch != x86_64 and arch != aarch64 and arch != ppc64le
     continue: false
 extra-nitrate: TC#0202428
 extra-summary: /CoreOS/selinux-policy/Regression/numad-and-similar

diff --git a/selinux-policy/numad-and-similar/runtest.sh b/selinux-policy/numad-and-similar/runtest.sh
index 27d5b96..d6996f0 100755
--- a/selinux-policy/numad-and-similar/runtest.sh
+++ b/selinux-policy/numad-and-similar/runtest.sh
@@ -98,6 +98,12 @@ rlJournalStart
     rlPhaseEnd
     fi
 
+    if ! rlIsRHEL 5 6 7 ; then
+    rlPhaseStartTest "bz#2026968 + RHEL-2415"
+        rlSESearchRule "allow numad_t numad_t : capability { ipc_owner } [ ]"
+    rlPhaseEnd
+    fi
+
     rlPhaseStartTest "real scenario"
         rlRun "mkdir -p ${MOUNT_POINT}"
         if ! mount | grep -q "cgroup.*cpuset" ; then