[tests/selinux] pr775-checkpolicy-revdeps: test if dhcpcd can read the /run/netns directory

[tests/selinux] pr775-checkpolicy-revdeps: test if dhcpcd can read the /run/netns directory

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : cf326c1181d3e527a0578a73b4393120347184d8
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2024-03-21T16:08:34+00:00
            Stats  : +16/-1 in 3 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/cf326c1181d3e527a0578a73b4393120347184d8?branch=pr775-checkpolicy-revdeps

            Log:
            test if dhcpcd can read the /run/netns directory

A recent dhcpcd + selinux-policy testing revealed that SELinux
prevents the dhcpcd processes from reading the /run/netns directory
when it exists. The TC reproduces the situation.

In order to support the expected dhcpcd functionality, I believe
that SELinux policy should allow the access. The TC looks for
appropriate policy rules and file context patterns.

The TC covers BZ#2269708 and BZ#2270733.

---
diff --git a/selinux-policy/dhcpcd-and-similar/Makefile b/selinux-policy/dhcpcd-and-similar/Makefile
index c714f6f..e124576 100644
--- a/selinux-policy/dhcpcd-and-similar/Makefile
+++ b/selinux-policy/dhcpcd-and-similar/Makefile
@@ -54,7 +54,7 @@ $(METADATA): Makefile
 	@echo "Type:            Regression" >> $(METADATA)
 	@echo "TestTime:        10m" >> $(METADATA)
 	@echo "RunFor:          selinux-policy" >> $(METADATA)
-	@echo "Requires:        audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console dhcpcd /usr/sbin/service" >> $(METADATA)
+	@echo "Requires:        audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console dhcpcd /usr/sbin/service iproute" >> $(METADATA)
 	@echo "RhtsRequires:    library(selinux-policy/common)" >> $(METADATA)
 	@echo "Environment:     AVC_ERROR=+no_avc_check" >> $(METADATA)
 	@echo "Priority:        Normal" >> $(METADATA)
@@ -65,6 +65,8 @@ $(METADATA): Makefile
 	@echo "Bug:             1585971" >> $(METADATA) # Fedora 28
 	@echo "Bug:             1602343" >> $(METADATA) # Fedora 28
 	@echo "Bug:             RHEL-15326" >> $(METADATA) # RHEL-9
+	@echo "Bug:             2269708" >> $(METADATA) # Fedora 40
+	@echo "Bug:             2270733" >> $(METADATA) # Fedora 41
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/dhcpcd-and-similar/main.fmf b/selinux-policy/dhcpcd-and-similar/main.fmf
index 0f9dc46..c6bb75e 100644
--- a/selinux-policy/dhcpcd-and-similar/main.fmf
+++ b/selinux-policy/dhcpcd-and-similar/main.fmf
@@ -17,6 +17,7 @@ recommend:
   - setools-console
   - dhcpcd
   - /usr/sbin/service
+  - iproute
 environment:
     AVC_ERROR: +no_avc_check
 duration: 10m
@@ -30,6 +31,8 @@ link:
   - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1585971
   - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1602343
   - verifies: https://issues.redhat.com/browse/RHEL-15326
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2269708
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2270733
 adjust:
   - enabled: false
     when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7

diff --git a/selinux-policy/dhcpcd-and-similar/runtest.sh b/selinux-policy/dhcpcd-and-similar/runtest.sh
index 9b9e133..ca7370e 100755
--- a/selinux-policy/dhcpcd-and-similar/runtest.sh
+++ b/selinux-policy/dhcpcd-and-similar/runtest.sh
@@ -91,7 +91,17 @@ rlJournalStart
     rlPhaseEnd
     fi
 
+    if ! rlIsRHEL 8 ; then
+    rlPhaseStartTest "bz#2269708 + bz#2270733"
+        rlSEMatchPathCon "/run/netns" "ifconfig_var_run_t"
+        rlSESearchRule "allow dhcpc_t ifconfig_var_run_t : dir { read } [ ]"
+    rlPhaseEnd
+    fi
+
     rlPhaseStartTest "real scenario -- standalone service"
+        rlRun "ip netns add test-ns"
+        rlRun "ip netns del test-ns"
+        rlRun "ls -lZR /run/netns"
         rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root"
         if ! rlSEDefined ${PROCESS_CONTEXT} ; then
             if rlIsRHEL 5 6 ; then