[tests/selinux] pr775-checkpolicy-revdeps: test if fio utility can use io_uring:cmd on NVME devices

[tests/selinux] pr775-checkpolicy-revdeps: test if fio utility can use io_uring:cmd on NVME devices

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : af206491b2a6ceae9d8c7e593b2a3917b3629d5d
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2023-10-23T09:41:49+00:00
            Stats  : +9/-2 in 4 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/af206491b2a6ceae9d8c7e593b2a3917b3629d5d?branch=pr775-checkpolicy-revdeps

            Log:
            test if fio utility can use io_uring:cmd on NVME devices

A recent fio testing performed on machines which have NVME devices
revealed that SELinux prevents the fio processes from using the cmd
permission of the io_uring class. The TC reproduces the situation
on such machines.

In order to support the io_uring functionality of the fio utility,
I believe that SELinux policy should allow this action. The TC
looks for appropriate policy rules and file context patterns.

The TC covers RHEL-11792.

---
diff --git a/selinux-policy/anon_inode-and-similar/Makefile b/selinux-policy/anon_inode-and-similar/Makefile
index 416a2b6..d9db08b 100644
--- a/selinux-policy/anon_inode-and-similar/Makefile
+++ b/selinux-policy/anon_inode-and-similar/Makefile
@@ -67,6 +67,7 @@ $(METADATA): Makefile
 	@echo "Bug:             2027660" >> $(METADATA) # RHEL-9
 	@echo "Bug:             2025714" >> $(METADATA) # Fedora 35
 	@echo "Bug:             2187745" >> $(METADATA) # RHEL-9
+	@echo "Bug:             RHEL-11792" >> $(METADATA) # RHEL-9
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/anon_inode-and-similar/PURPOSE b/selinux-policy/anon_inode-and-similar/PURPOSE
index 7799186..3267a57 100644
--- a/selinux-policy/anon_inode-and-similar/PURPOSE
+++ b/selinux-policy/anon_inode-and-similar/PURPOSE
@@ -1,4 +1,4 @@
 PURPOSE of /CoreOS/selinux-policy/Regression/anon_inode-and-similar
 Author: Amith Kumar <apeetham@redhat.com>
 
-SELinux denials affect processes that deals with anon_inode tclass.
+SELinux denials affect processes that deals with anon_inode and io_uring classes.

diff --git a/selinux-policy/anon_inode-and-similar/main.fmf b/selinux-policy/anon_inode-and-similar/main.fmf
index b40664b..c0f4965 100644
--- a/selinux-policy/anon_inode-and-similar/main.fmf
+++ b/selinux-policy/anon_inode-and-similar/main.fmf
@@ -33,6 +33,7 @@ link:
   - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2027660
   - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2025714
   - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2187745
+  - verifies: https://issues.redhat.com/browse/RHEL-11792
 adjust:
   - enabled: false
     when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8

diff --git a/selinux-policy/anon_inode-and-similar/runtest.sh b/selinux-policy/anon_inode-and-similar/runtest.sh
index f3fdcaa..8d83518 100755
--- a/selinux-policy/anon_inode-and-similar/runtest.sh
+++ b/selinux-policy/anon_inode-and-similar/runtest.sh
@@ -69,7 +69,7 @@ rlJournalStart
     rlPhaseEnd
 
     rlPhaseStartTest "mmap on io_uring - bz#2025714 + bz#2187745"
-      if rlIsFedora '<=39'; then
+      if rlIsFedora '<=39' || rlIsRHEL 9 ; then
         rlSESearchRule "allow unconfined_t unconfined_t : anon_inode { map } [ ]"
         rlSESearchRule "allow svirt_t svirt_t : anon_inode { map } [ ]"
         rlSESearchRule "allow virtd_t virtd_t : anon_inode { map } [ ]"
@@ -82,6 +82,11 @@ rlJournalStart
         rlRun "fio --filename=/root/pokus --iodepth=16 --rw=write --ioengine=io_uring --bs=16k --size=2G --numjobs=30 --runtime=100s --group_reporting=1 --name=mytest" 0-255
     rlPhaseEnd
 
+    rlPhaseStartTest "RHEL-11792"
+        rlSEMatchPathCon "/dev/ng0n1" "fixed_disk_device_t"
+        rlSESearchRule "allow unconfined_t fixed_disk_device_t : io_uring { cmd } [ ]"
+    rlPhaseEnd
+
     rlPhaseStartCleanup
         sleep 2
         rlSECheckAVC