[tests/selinux] pr775-checkpolicy-revdeps: test if exim can send into /var/spool/exim/exim_daemon_notify

[tests/selinux] pr775-checkpolicy-revdeps: test if exim can send into /var/spool/exim/exim_daemon_notify

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 3ea1adb99b738defe626282bd87a6fa2ca0fc504
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2024-01-23T12:57:20+00:00
            Stats  : +14/-1 in 3 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/3ea1adb99b738defe626282bd87a6fa2ca0fc504?branch=pr775-checkpolicy-revdeps

            Log:
            test if exim can send into /var/spool/exim/exim_daemon_notify

A recent exim testing on RHEL-8 and RHEL-9 revealed that SELinux
prevents the exim processes from sending data into the abstract
socket: /var/spool/exim/exim_daemon_notify. The TC reproduces the
situation when executed in the right environment.

In order to support all the expected actions over the daemon
notifier socket, I believe that SELinux policy should allow the
sendto permission. The TC looks for appropriate policy rules and
file context patterns.

The TC covers RHEL-21902 and RHEL-21903.

---
diff --git a/selinux-policy/exim-and-similar/Makefile b/selinux-policy/exim-and-similar/Makefile
index 2bbf5b0..3c8dc5d 100644
--- a/selinux-policy/exim-and-similar/Makefile
+++ b/selinux-policy/exim-and-similar/Makefile
@@ -54,7 +54,7 @@ $(METADATA): Makefile
 	@echo "Type:            Regression" >> $(METADATA)
 	@echo "TestTime:        5m" >> $(METADATA)
 	@echo "RunFor:          selinux-policy" >> $(METADATA)
-	@echo "Requires:        audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted /usr/sbin/service setools-console at exim" >> $(METADATA)
+	@echo "Requires:        audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted /usr/sbin/service setools-console at exim lsof" >> $(METADATA)
 	@echo "RhtsRequires:    library(selinux-policy/common)" >> $(METADATA)
 	@echo "Priority:        Normal" >> $(METADATA)
 	@echo "License:         GPLv2" >> $(METADATA)
@@ -66,6 +66,8 @@ $(METADATA): Makefile
 	@echo "Bug:             1444441" >> $(METADATA) # RHEL-7
 	@echo "Bug:             RHEL-14110" >> $(METADATA) # RHEL-9
 	@echo "Bug:             RHEL-14186" >> $(METADATA) # RHEL-8
+	@echo "Bug:             RHEL-21902" >> $(METADATA) # RHEL-9
+	@echo "Bug:             RHEL-21903" >> $(METADATA) # RHEL-8
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/exim-and-similar/main.fmf b/selinux-policy/exim-and-similar/main.fmf
index 6a63f6d..fed7aad 100644
--- a/selinux-policy/exim-and-similar/main.fmf
+++ b/selinux-policy/exim-and-similar/main.fmf
@@ -20,6 +20,7 @@ recommend:
   - setools-console
   - at
   - exim
+  - lsof
 environment:
     AVC_ERROR: +no_avc_check
 duration: 5m
@@ -39,6 +40,8 @@ link:
   - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1444441
   - verifies: https://issues.redhat.com/browse/RHEL-14110
   - verifies: https://issues.redhat.com/browse/RHEL-14186
+  - verifies: https://issues.redhat.com/browse/RHEL-21902
+  - verifies: https://issues.redhat.com/browse/RHEL-21903
 adjust:
   - enabled: false
     when: distro == rhel-4, rhel-alt-7

diff --git a/selinux-policy/exim-and-similar/runtest.sh b/selinux-policy/exim-and-similar/runtest.sh
index a1067ac..27750e3 100755
--- a/selinux-policy/exim-and-similar/runtest.sh
+++ b/selinux-policy/exim-and-similar/runtest.sh
@@ -85,6 +85,13 @@ rlJournalStart
     rlPhaseEnd
     fi
 
+    if rlIsRHEL 8 9 || rlIsCentOS 8 9 ; then
+    rlPhaseStartTest "RHEL-21902 + RHEL-21903"
+        rlSEMatchPathCon "/var/spool/exim/exim_daemon_notify" "exim_spool_t"
+        rlSESearchRule "allow exim_t exim_t : unix_dgram_socket { sendto } [ ]"
+    rlPhaseEnd
+    fi
+
     rlPhaseStartTest "real scenario -- standalone service"
         rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root"
         if ! rlSEDefined ${PROCESS_CONTEXT} ; then
@@ -92,6 +99,7 @@ rlJournalStart
             PROCESS_CONTEXT="sendmail_t"
         fi
         rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1
+        rlRun "lsof | grep exim_daemon_notify"
         rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255
         rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1
     rlPhaseEnd