[tests/selinux] pr775-checkpolicy-revdeps: test if systemd-notify can send into /run/systemd/notify

[tests/selinux] pr775-checkpolicy-revdeps: test if systemd-notify can send into /run/systemd/notify

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 156e7d934e2422c8d59325c0192b3d34e97479d1
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2024-02-21T08:26:44+00:00
            Stats  : +29/-2 in 4 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/156e7d934e2422c8d59325c0192b3d34e97479d1?branch=pr775-checkpolicy-revdeps

            Log:
            test if systemd-notify can send into /run/systemd/notify

A recently filed customer case revealed that SELinux prevents the
systemd-notify processes from sending data into UDP socket (to a
process waiting on the other side of /run/systemd/notify socket).
The TC reproduces the situation.

In order to support the expected functions of systemd services
(especially type=notify), I believe that SELinux policy should
allow the actions. The TC looks for appropriate policy rules and
file context patterns.

The TC covers RHEL-25514 and RHEL-25605.

---
diff --git a/selinux-policy/systemd-notify-and-similar/Makefile b/selinux-policy/systemd-notify-and-similar/Makefile
index 2e2d3d3..24161e3 100644
--- a/selinux-policy/systemd-notify-and-similar/Makefile
+++ b/selinux-policy/systemd-notify-and-similar/Makefile
@@ -29,7 +29,7 @@ export TESTVERSION=1.0
 
 BUILT_FILES=
 
-FILES=$(METADATA) runtest.sh Makefile PURPOSE local-notifier.service notifier.sh
+FILES=$(METADATA) runtest.sh Makefile PURPOSE local-notifier.service notifier.sh reproducer.service
 
 .PHONY: all install download clean
 
@@ -61,8 +61,10 @@ $(METADATA): Makefile
 	@echo "License:         GPLv2" >> $(METADATA)
 	@echo "Confidential:    no" >> $(METADATA)
 	@echo "Destructive:     no" >> $(METADATA)
-	@echo "Releases:        -RHEL4 -RHEL5 -RHEL6" >> $(METADATA)
+	@echo "Releases:        -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA)
 	@echo "Bug:             1903305" >> $(METADATA) # Fedora 33
+	@echo "Bug:             RHEL-25514" >> $(METADATA) # RHEL-9
+	@echo "Bug:             RHEL-25605" >> $(METADATA) # RHEL-8
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/systemd-notify-and-similar/main.fmf b/selinux-policy/systemd-notify-and-similar/main.fmf
index 70183bc..76e04c2 100644
--- a/selinux-policy/systemd-notify-and-similar/main.fmf
+++ b/selinux-policy/systemd-notify-and-similar/main.fmf
@@ -20,6 +20,8 @@ recommend:
   - setools-console
   - systemd
   - /usr/sbin/service
+environment:
+    AVC_ERROR: +no_avc_check
 duration: 10m
 enabled: true
 tag:
@@ -33,6 +35,8 @@ tag:
 tier: '2'
 link:
   - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1903305
+  - verifies: https://issues.redhat.com/browse/RHEL-25514
+  - verifies: https://issues.redhat.com/browse/RHEL-25605
 adjust:
   - enabled: false
     when: distro == rhel-4, rhel-5, rhel-6, rhel-7

diff --git a/selinux-policy/systemd-notify-and-similar/reproducer.service b/selinux-policy/systemd-notify-and-similar/reproducer.service
new file mode 100644
index 0000000..58ec78c
--- /dev/null
+++ b/selinux-policy/systemd-notify-and-similar/reproducer.service
@@ -0,0 +1,5 @@
+[Service]
+Type=notify
+NotifyAccess=all
+ExecStart=/bin/sh -c "sleep 3; systemd-notify --ready; sleep 30"
+

diff --git a/selinux-policy/systemd-notify-and-similar/runtest.sh b/selinux-policy/systemd-notify-and-similar/runtest.sh
index 59a2908..d9cfbe7 100755
--- a/selinux-policy/systemd-notify-and-similar/runtest.sh
+++ b/selinux-policy/systemd-notify-and-similar/runtest.sh
@@ -103,6 +103,22 @@ rlJournalStart
         rlRun "systemctl daemon-reload"
     rlPhaseEnd
 
+    rlPhaseStartTest "RHEL-25514 + RHEL-25605"
+        rlSEMatchPathCon "/usr/bin/systemd-notify" "systemd_notify_exec_t"
+        rlSEMatchPathCon "/run/systemd/notify" "init_var_run_t"
+        rlSESearchRule "allow systemd_notify_t systemd_notify_t : capability { sys_admin } [ ]"
+        rlSESearchRule "allow systemd_notify_t kernel_t : unix_dgram_socket { sendto } [ ]"
+
+        rlRun "cp -f ./reproducer.service /etc/systemd/system/"
+        rlRun "systemctl daemon-reload"
+        rlRun "service reproducer start"
+        rlRun -s "service reproducer status -l"
+        rlRun "grep -i 'failed.*notify.*permission.*denied' $rlRun_LOG" 1
+        rm -f $rlRun_LOG
+        rlRun "rm -f /etc/systemd/system/reproducer.service"
+        rlRun "systemctl daemon-reload"
+    rlPhaseEnd
+
     rlPhaseStartCleanup
         sleep 2
         rlSECheckAVC