[tests/selinux] pr775-checkpolicy-revdeps: test if dhcpcd can use the bpf capability

[tests/selinux] pr775-checkpolicy-revdeps: test if dhcpcd can use the bpf capability

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : f477da1bf52d3f657b7005a86b65e59766213f53
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2023-11-08T08:35:33+00:00
            Stats  : +14/-4 in 3 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/f477da1bf52d3f657b7005a86b65e59766213f53?branch=pr775-checkpolicy-revdeps

            Log:
            test if dhcpcd can use the bpf capability

A recent dhcpcd testing revealed that SELinux denials appear when
the dhcpcd service (in default configuration) is started on RHEL-9.
The TC reproduces the situation.

In order to avoid such SELinux denials, I believe that SELinux policy
should either allow or dontaudit them. The TC looks for appropriate
policy rules.

The TC covers RHEL-15326.

---
diff --git a/selinux-policy/dhcpcd-and-similar/Makefile b/selinux-policy/dhcpcd-and-similar/Makefile
index 4259442..c714f6f 100644
--- a/selinux-policy/dhcpcd-and-similar/Makefile
+++ b/selinux-policy/dhcpcd-and-similar/Makefile
@@ -64,6 +64,7 @@ $(METADATA): Makefile
 	@echo "Releases:        -RHEL4 -RHEL5 -RHEL6" >> $(METADATA)
 	@echo "Bug:             1585971" >> $(METADATA) # Fedora 28
 	@echo "Bug:             1602343" >> $(METADATA) # Fedora 28
+	@echo "Bug:             RHEL-15326" >> $(METADATA) # RHEL-9
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/dhcpcd-and-similar/main.fmf b/selinux-policy/dhcpcd-and-similar/main.fmf
index 97f512c..0f9dc46 100644
--- a/selinux-policy/dhcpcd-and-similar/main.fmf
+++ b/selinux-policy/dhcpcd-and-similar/main.fmf
@@ -29,10 +29,11 @@ tag:
 link:
   - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1585971
   - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1602343
+  - verifies: https://issues.redhat.com/browse/RHEL-15326
 adjust:
   - enabled: false
-    when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7, rhel-8, rhel-9
-    continue: false
+    when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7
+    because: the dhcpcd package is not available there
 extra-nitrate: TC#0574611
 extra-summary: /CoreOS/selinux-policy/Regression/dhcpcd-and-similar
 extra-task: /CoreOS/selinux-policy/Regression/dhcpcd-and-similar

diff --git a/selinux-policy/dhcpcd-and-similar/runtest.sh b/selinux-policy/dhcpcd-and-similar/runtest.sh
index 79fad7a..9b9e133 100755
--- a/selinux-policy/dhcpcd-and-similar/runtest.sh
+++ b/selinux-policy/dhcpcd-and-similar/runtest.sh
@@ -40,7 +40,7 @@ PROCESS_CONTEXT="dhcpc_t"
 
 rlJournalStart
     rlPhaseStartSetup
-        if rlIsRHEL ; then
+        if rlIsRHEL 4 5 6 ; then
             rlLog "Not applicable to this OS version."
             rlJournalEnd
             exit 0
@@ -85,6 +85,12 @@ rlJournalStart
         rlSESearchRule "allow dhcpc_t dhcpc_var_run_t : sock_file { create unlink }"
     rlPhaseEnd
 
+    if rlIsRHEL 9 || rlIsCentOS 9 ; then
+    rlPhaseStartTest "RHEL-15326"
+        rlSESearchRule "allow dhcpc_t dhcpc_t : capability2 { bpf } [ ]"
+    rlPhaseEnd
+    fi
+
     rlPhaseStartTest "real scenario -- standalone service"
         rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root"
         if ! rlSEDefined ${PROCESS_CONTEXT} ; then
@@ -94,7 +100,9 @@ rlJournalStart
                 PROCESS_CONTEXT="unconfined_service_t"
             fi
         fi
-        rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status restart status stop status" 1
+        rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1
+        rlRun "restorecon -Rv /etc /var /run -e /var/ARTIFACTS" 0-255
+        rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1
     rlPhaseEnd
 
     rlPhaseStartCleanup