[tests/selinux] pr775-checkpolicy-revdeps: test if exim can create dirs under /var/spool/exim/input/

[tests/selinux] pr775-checkpolicy-revdeps: test if exim can create dirs under /var/spool/exim/input/

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : cb9ae062ac02b0bca42a21146255c7f2c9fc686b
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2023-10-23T15:54:21+00:00
            Stats  : +24/-6 in 3 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/cb9ae062ac02b0bca42a21146255c7f2c9fc686b?branch=pr775-checkpolicy-revdeps

            Log:
            test if exim can create dirs under /var/spool/exim/input/

A recently filed customer report revealed that SELinux prevents
the exim's sendmail program from creating new directories under the
/var/spool/exim/input/ directory. The TC reproduces the situation.

In order to support the whole functionality of exim (especially the
split_spool_directory configuration option), I believe that SELinux
policy should allow the action. The TC looks for appropriate policy
rules and file context patterns.

The TC covers RHEL-14110 and RHEL-14186.

---
diff --git a/selinux-policy/exim-and-similar/Makefile b/selinux-policy/exim-and-similar/Makefile
index fe0c535..2bbf5b0 100644
--- a/selinux-policy/exim-and-similar/Makefile
+++ b/selinux-policy/exim-and-similar/Makefile
@@ -1,7 +1,7 @@
 # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 #
 #   Makefile of /CoreOS/selinux-policy/Regression/exim-and-similar
-#   Description: the service was running as initrc_t or init_t, now it is confined by SELinux
+#   Description: SELinux interferes with exim and related programs
 #   Author: Milos Malik <mmalik@redhat.com>
 #
 # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
@@ -50,11 +50,11 @@ $(METADATA): Makefile
 	@echo "Name:            $(TEST)" >> $(METADATA)
 	@echo "TestVersion:     $(TESTVERSION)" >> $(METADATA)
 	@echo "Path:            $(TEST_DIR)" >> $(METADATA)
-	@echo "Description:     the service was running as initrc_t or init_t, now it is confined by SELinux" >> $(METADATA)
+	@echo "Description:     SELinux interferes with exim and related programs" >> $(METADATA)
 	@echo "Type:            Regression" >> $(METADATA)
 	@echo "TestTime:        5m" >> $(METADATA)
 	@echo "RunFor:          selinux-policy" >> $(METADATA)
-	@echo "Requires:        audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted /usr/sbin/service setools-console glib2 exim" >> $(METADATA)
+	@echo "Requires:        audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted /usr/sbin/service setools-console at exim" >> $(METADATA)
 	@echo "RhtsRequires:    library(selinux-policy/common)" >> $(METADATA)
 	@echo "Priority:        Normal" >> $(METADATA)
 	@echo "License:         GPLv2" >> $(METADATA)
@@ -64,6 +64,8 @@ $(METADATA): Makefile
 	@echo "Releases:        -RHEL4" >> $(METADATA)
 	@echo "Bug:             1025315" >> $(METADATA) # RHEL-6
 	@echo "Bug:             1444441" >> $(METADATA) # RHEL-7
+	@echo "Bug:             RHEL-14110" >> $(METADATA) # RHEL-9
+	@echo "Bug:             RHEL-14186" >> $(METADATA) # RHEL-8
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/exim-and-similar/main.fmf b/selinux-policy/exim-and-similar/main.fmf
index a1e0788..f6a3948 100644
--- a/selinux-policy/exim-and-similar/main.fmf
+++ b/selinux-policy/exim-and-similar/main.fmf
@@ -1,4 +1,4 @@
-summary: the service was running as initrc_t or init_t, now it is confined by SELinux
+summary: SELinux interferes with exim and related programs
 description: |+
     SELinux interferes with exim and related programs.
 
@@ -18,7 +18,7 @@ recommend:
   - selinux-policy-targeted
   - /usr/sbin/service
   - setools-console
-  - glib2
+  - at
   - exim
 environment:
     AVC_ERROR: +no_avc_check
@@ -37,6 +37,8 @@ tag:
 link:
   - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1025315
   - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1444441
+  - verifies: https://issues.redhat.com/browse/RHEL-14110
+  - verifies: https://issues.redhat.com/browse/RHEL-14186
 adjust:
   - enabled: false
     when: distro == rhel-4, rhel-alt-7

diff --git a/selinux-policy/exim-and-similar/runtest.sh b/selinux-policy/exim-and-similar/runtest.sh
index 7d080a5..a1067ac 100755
--- a/selinux-policy/exim-and-similar/runtest.sh
+++ b/selinux-policy/exim-and-similar/runtest.sh
@@ -3,7 +3,7 @@
 # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 #
 #   runtest.sh of /CoreOS/selinux-policy/Regression/exim-and-similar
-#   Description: the service was running as initrc_t or init_t, now it is confined by SELinux
+#   Description: SELinux interferes with exim and related programs
 #   Author: Milos Malik <mmalik@redhat.com>
 #
 # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
@@ -48,6 +48,7 @@ rlJournalStart
 
         rlServiceStop ${SERVICE_NAME}
         rlFileBackup /etc/shadow
+        rlFileBackup /etc/exim/exim.conf
 
         rlSESetEnforce
         rlSEStatus
@@ -95,6 +96,19 @@ rlJournalStart
         rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1
     rlPhaseEnd
 
+    rlPhaseStartTest "real scenario -- RHEL-14110 + RHEL-14186"
+        rlSEMatchPathCon "/var/spool/exim/input" "exim_spool_t"
+        rlSESearchRule "allow system_mail_t exim_spool_t : dir { create } [ ]"
+        rlRun "sed -i 's/^.*\(split_spool_directory\).*=.*$/\1 = true/' /etc/exim/exim.conf"
+        rlRun "service exim start"
+        rlRun "service atd start"
+        rlRun "echo '/usr/bin/id -Z' | at now"
+        sleep 15s
+        rlRun "ls -lZ /var/spool/exim/input"
+        rlRun "service atd stop"
+        rlRun "service exim stop"
+    rlPhaseEnd
+
     rlPhaseStartCleanup
         sleep 2
         rlSECheckAVC