[tests/selinux] pr775-checkpolicy-revdeps: test if smtpctl can connect to /run/smtpd.sock

[tests/selinux] pr775-checkpolicy-revdeps: test if smtpctl can connect to /run/smtpd.sock

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 3ef0170d87ed14ae44cd4fbd5120699d7c5734e0
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2023-11-02T13:22:12+00:00
            Stats  : +10/-1 in 3 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/3ef0170d87ed14ae44cd4fbd5120699d7c5734e0?branch=pr775-checkpolicy-revdeps

            Log:
            test if smtpctl can connect to /run/smtpd.sock

A recent opensmtpd testing revealed that SELinux prevents the smtpctl
processes from connecting to the /run/smtpd.sock socket. The TC
reproduces the situation.

In order to support the basic function of sending emails via opensmtpd
means, I believe that SELinux policy should allow the above-mentioned
action. The TC looks for appropriate policy rules and file context
patterns.

The TC covers BZ#2246115.

---
diff --git a/selinux-policy/opensmtpd-and-similar/Makefile b/selinux-policy/opensmtpd-and-similar/Makefile
index 8d7690f..a59edb8 100644
--- a/selinux-policy/opensmtpd-and-similar/Makefile
+++ b/selinux-policy/opensmtpd-and-similar/Makefile
@@ -54,7 +54,7 @@ $(METADATA): Makefile
 	@echo "Type:            Regression" >> $(METADATA)
 	@echo "TestTime:        10m" >> $(METADATA)
 	@echo "RunFor:          selinux-policy" >> $(METADATA)
-	@echo "Requires:        audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console opensmtpd /usr/sbin/service" >> $(METADATA)
+	@echo "Requires:        audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console opensmtpd /usr/sbin/service mailx" >> $(METADATA)
 	@echo "RhtsRequires:    library(selinux-policy/common)" >> $(METADATA)
 	@echo "Environment:     AVC_ERROR=+no_avc_check" >> $(METADATA)
 	@echo "Priority:        Normal" >> $(METADATA)
@@ -63,6 +63,7 @@ $(METADATA): Makefile
 	@echo "Destructive:     no" >> $(METADATA)
 	@echo "Releases:        -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA)
 	@echo "Bug:             2208696" >> $(METADATA) # Fedora 38
+	@echo "Bug:             2246115" >> $(METADATA) # Fedora rawhide
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/opensmtpd-and-similar/main.fmf b/selinux-policy/opensmtpd-and-similar/main.fmf
index 064e88a..b014b17 100644
--- a/selinux-policy/opensmtpd-and-similar/main.fmf
+++ b/selinux-policy/opensmtpd-and-similar/main.fmf
@@ -17,6 +17,7 @@ recommend:
   - setools-console
   - opensmtpd
   - /usr/sbin/service
+  - mailx
 environment:
     AVC_ERROR: +no_avc_check
 duration: 10m
@@ -29,6 +30,7 @@ tag:
   - targeted
 link:
   - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2208696
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2246115
 adjust:
   - enabled: false
     when: distro == rhel-4, rhel-5, rhel-6, rhel-7

diff --git a/selinux-policy/opensmtpd-and-similar/runtest.sh b/selinux-policy/opensmtpd-and-similar/runtest.sh
index 6ce1a6e..27df5cd 100755
--- a/selinux-policy/opensmtpd-and-similar/runtest.sh
+++ b/selinux-policy/opensmtpd-and-similar/runtest.sh
@@ -62,7 +62,13 @@ rlJournalStart
         rlSESearchRule "allow sendmail_t sendmail_var_run_t : sock_file { create setattr unlink write } [ ]"
     rlPhaseEnd
 
+    rlPhaseStartTest "bz#2246115"
+        rlSEMatchPathCon "/run/smtpd.sock" "sendmail_var_run_t"
+        rlSESearchRule "allow sendmail_t sendmail_t : unix_stream_socket { connectto } [ ]"
+    rlPhaseEnd
+
     rlPhaseStartTest "real scenario -- standalone service"
+        rlRun "sestatus | mailx -s test-email root@localhost"
         if ! ls -Z ${FILE_PATH} | grep -q ${FILE_CONTEXT} ; then
             # for environments where the service is not yet confined
             PROCESS_CONTEXT="unconfined_service_t"