[tests/selinux] pr775-checkpolicy-revdeps: test if sysadm_u can run dmidecode via sudo

[tests/selinux] pr775-checkpolicy-revdeps: test if sysadm_u can run dmidecode via sudo

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 12ea165a341b5e0890fbb72d6866d38f7f6fee24
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2024-02-06T14:24:00+00:00
            Stats  : +27/-0 in 3 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/12ea165a341b5e0890fbb72d6866d38f7f6fee24?branch=pr775-checkpolicy-revdeps

            Log:
            test if sysadm_u can run dmidecode via sudo

A recently filed customer case revealed that SELinux prevents the
sysadm_u users from running the dmidecode command via sudo which
has the input/output logging enabled. The following error message
appears during the action:

  sudo: unable to open /var: Permission denied

The TC reproduces the situation.

In order to support the above-mentioned configuration, I believe that
SELinux policy should allow the necessary actions. The TC looks for
appropriate policy rules and file context patterns.

The TC covers RHEL-16104.

---
diff --git a/selinux-policy/dmidecode-and-similar/Makefile b/selinux-policy/dmidecode-and-similar/Makefile
index 6de3c03..03a223f 100644
--- a/selinux-policy/dmidecode-and-similar/Makefile
+++ b/selinux-policy/dmidecode-and-similar/Makefile
@@ -68,6 +68,7 @@ $(METADATA): Makefile
 	@echo "Bug:             1300799" >> $(METADATA) # RHEL-7
 	@echo "Bug:             1608480" >> $(METADATA) # RHEL-7
 	@echo "Bug:             1926696" >> $(METADATA) # Fedora 34
+	@echo "Bug:             RHEL-16104" >> $(METADATA) # RHEL-9
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/dmidecode-and-similar/main.fmf b/selinux-policy/dmidecode-and-similar/main.fmf
index 3c7d84d..21e4f79 100644
--- a/selinux-policy/dmidecode-and-similar/main.fmf
+++ b/selinux-policy/dmidecode-and-similar/main.fmf
@@ -41,6 +41,7 @@ link:
   - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1300799
   - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1608480
   - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1926696
+  - verifies: https://issues.redhat.com/browse/RHEL-16104
 adjust:
   - enabled: false
     when: distro == rhel-4

diff --git a/selinux-policy/dmidecode-and-similar/runtest.sh b/selinux-policy/dmidecode-and-similar/runtest.sh
index 51caa22..3b3d0bf 100755
--- a/selinux-policy/dmidecode-and-similar/runtest.sh
+++ b/selinux-policy/dmidecode-and-similar/runtest.sh
@@ -132,6 +132,31 @@ rlJournalStart
         done
     rlPhaseEnd
 
+    rlPhaseStartTest "RHEL-16104"
+        rlSEMatchPathCon "/var" "var_t"
+        rlSEMatchPathCon "/var/log" "var_log_t"
+        rlSEMatchPathCon "/var/log/sudo-io" "sudo_log_t"
+        rlSESearchRule "allow sysadm_sudo_t var_t : dir { read } [ ]"
+        rlSESearchRule "allow sysadm_sudo_t var_log_t : dir { read } [ ]"
+        rlSESearchRule "allow sysadm_sudo_t sudo_log_t : dir { read } [ ]"
+        rlRun "setsebool ssh_sysadm_login on"
+        rlRun "useradd -Z sysadm_u -G wheel sysadm-user"
+        USER_SECRET="S3kr3t${RANDOM}"
+        rlRun "echo ${USER_SECRET} | passwd --stdin sysadm-user"
+        rlRun "echo -en 'Defaults log_output\nDefaults log_input\nDefaults iolog_dir=/var/log/sudo-io\nsysadm-user ALL=(ALL) NOPASSWD: ALL\n' > /etc/sudoers.d/sysadm-user"
+        rlRun "rm -rf /var/log/sudo-io"
+        rlRun -s "./ssh.exp sysadm-user ${USER_SECRET} localhost sudo dmidecode"
+        rlRun "grep DMI $rlRun_LOG"
+        rlRun "rm -f $rlRun_LOG"
+        rlRun "rm -rf /var/log/sudo-io"
+        rlRun -s "./ssh.exp sysadm-user ${USER_SECRET} localhost sudo -r sysadm_r dmidecode"
+        rlRun "grep DMI $rlRun_LOG"
+        rlRun "rm -f $rlRun_LOG"
+        rlRun "rm -f /etc/sudoers.d/sysadm-user"
+        rlRun "userdel -rfZ sysadm-user"
+        rlRun "setsebool ssh_sysadm_login off"
+    rlPhaseEnd
+
     rlPhaseStartCleanup
         sleep 2
         rlSECheckAVC