[tests/selinux] pr775-checkpolicy-revdeps: test copy-from,copy-to,reboot commands in systemd-machined test

[tests/selinux] pr775-checkpolicy-revdeps: test copy-from,copy-to,reboot commands in systemd-machined test

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 956f6ef06e55d6cb92006b216b388e5159e53022
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2023-10-20T05:57:09+00:00
            Stats  : +11/-1 in 2 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/956f6ef06e55d6cb92006b216b388e5159e53022?branch=pr775-checkpolicy-revdeps

            Log:
            test copy-from,copy-to,reboot commands in systemd-machined test

As pointed out in BZ#1900869, some of the machinectl commands still
do not work as expected. As a result of manual testing, I added more
policy rules to the testpolicy module which, hopefully, improves the
situation.

---
diff --git a/selinux-policy/systemd-machined-and-similar/runtest.sh b/selinux-policy/systemd-machined-and-similar/runtest.sh
index 42416a7..9a4fa7b 100755
--- a/selinux-policy/systemd-machined-and-similar/runtest.sh
+++ b/selinux-policy/systemd-machined-and-similar/runtest.sh
@@ -107,6 +107,13 @@ rlJournalStart
         rlRun "machinectl list"
         rlRun "machinectl status test"
         rlWatchdog "machinectl login test" 20
+        rlRun "rm -f /tmp/id"
+        rlRun "machinectl copy-to test /usr/bin/id /tmp/id"
+        rlRun "machinectl copy-from test /usr/bin/id /tmp/id"
+        rlRun "machinectl reboot test"
+        sleep 15
+        rlRun "machinectl status test"
+        rlRun "machinectl kill test"
         rlRun "machinectl terminate test"
         rlRun "systemctl stop systemd-nspawn@test"
         # TODO: remove next 2 lines once the BZs are fixed

diff --git a/selinux-policy/systemd-machined-and-similar/testpolicy.cil b/selinux-policy/systemd-machined-and-similar/testpolicy.cil
index 9fa2ced..72b42c7 100644
--- a/selinux-policy/systemd-machined-and-similar/testpolicy.cil
+++ b/selinux-policy/systemd-machined-and-similar/testpolicy.cil
@@ -1,11 +1,14 @@
 ( allow systemd_machined_t unconfined_service_t ( dir ( search )))
 ( allow systemd_machined_t unconfined_service_t ( file ( getattr open read ioctl )))
 ( allow systemd_machined_t unconfined_service_t ( lnk_file ( getattr read )))
-( allow systemd_machined_t systemd_machined_t ( cap_userns ( sys_ptrace sys_admin setgid setuid )))
+( allow systemd_machined_t systemd_machined_t ( cap_userns ( sys_ptrace sys_admin setgid setuid kill )))
 ( allow systemd_machined_t tmpfs_t ( lnk_file ( getattr read )))
 ( allow systemd_machined_t devpts_t ( chr_file ( open read write ioctl )))
 ( allow systemd_machined_t tmpfs_t ( sock_file ( write )))
 ( allow system_dbusd_t devpts_t ( chr_file ( read write )))
 ( allow systemd_machined_t unconfined_service_t ( unix_stream_socket ( connectto )))
 ( allow systemd_machined_t systemd_unit_file_t ( service ( stop )))
+( allow systemd_machined_t tmp_t ( file ( create getattr open write append ioctl setattr )))
+( allow systemd_machined_t tmpfs_t ( file ( create getattr open write append ioctl setattr )))
+( allow systemd_machined_t systemd_machined_t ( capability ( chown fowner fsetid )))