[tests/selinux] pr775-checkpolicy-revdeps: add a new sulogin test

[tests/selinux] pr775-checkpolicy-revdeps: add a new sulogin test

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : e58558fe843ece142e0aee70a4fac73819fd4bb6
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2024-03-25T10:33:35+01:00
            Stats  : +80/-0 in 2 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/e58558fe843ece142e0aee70a4fac73819fd4bb6?branch=pr775-checkpolicy-revdeps

            Log:
            add a new sulogin test

A recently filed Fedora bug revealed that SELinux prevents the
sulogin processes from using:
 * the fsetxattr syscall (relabelfrom+relabelto) on /dev/tty*
 * the ioctl syscall (checkpoint_restore capability)

The TC reproduces the situation.

Because the relabel* permissions seem to be necessary for a successful
run of the sulogin command, SELinux policy should allow them.
On the other hand, the checkpoint_restore capability does not seem
to be necessary, which means that SELinux policy should dontaudit it.

The TC covers BZ#2265391.

---
diff --git a/selinux-policy/sulogin-and-similar/main.fmf b/selinux-policy/sulogin-and-similar/main.fmf
new file mode 100644
index 0000000..2211054
--- /dev/null
+++ b/selinux-policy/sulogin-and-similar/main.fmf
@@ -0,0 +1,38 @@
+summary: SELinux interferes with sulogin and related programs
+test: ./runtest.sh
+framework: beakerlib
+contact: Milos Malik <mmalik@redhat.com>
+component:
+  - selinux-policy
+require:
+  - library(selinux-policy/common)
+recommend:
+  - audit
+  - binutils
+  - libselinux-utils
+  - policycoreutils
+  - selinux-policy
+  - selinux-policy-targeted
+  - setools-console
+  - systemd
+  - /usr/sbin/service
+environment:
+    AVC_ERROR: +no_avc_check
+duration: 5m
+enabled: true
+tag:
+  - NoRHEL4
+  - NoRHEL5
+  - NoRHEL6
+  - NoRHEL7
+  - targeted
+link:
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2265391
+adjust:
+  - enabled: false
+    when: distro == rhel-4, rhel-5, rhel-6, rhel-7
+    continue: false
+extra-summary: /CoreOS/selinux-policy/Regression/sulogin-and-similar
+extra-task: /CoreOS/selinux-policy/Regression/sulogin-and-similar
+extra-nitrate: TC#0617279
+id: 3128d079-084d-4c82-a01e-e2a8457a67d0

diff --git a/selinux-policy/sulogin-and-similar/runtest.sh b/selinux-policy/sulogin-and-similar/runtest.sh
new file mode 100755
index 0000000..51a1d85
--- /dev/null
+++ b/selinux-policy/sulogin-and-similar/runtest.sh
@@ -0,0 +1,42 @@
+#!/bin/bash
+# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlRun "rlImport 'selinux-policy/common'" 0,1
+        rlAssertRpm selinux-policy
+        rlAssertRpm selinux-policy-targeted
+        rlAssertRpm systemd
+
+        rlSESetEnforce
+        rlSEStatus
+        rlSESetTimestamp
+        sleep 2
+    rlPhaseEnd
+
+    if ! rlIsRHEL 8 9 ; then
+    rlPhaseStartTest "bz#2265391"
+        rlSEMatchPathCon "/usr/sbin/sulogin" "sulogin_exec_t"
+        rlSESearchRule "dontaudit sulogin_t sulogin_t : capability2 { checkpoint_restore } [ ]"
+        rlSESearchRule "allow sulogin_t tty_device_t : chr_file { relabelfrom relabelto } [ ]"
+    rlPhaseEnd
+    fi
+
+    rlPhaseStartTest "real scenario -- standalone service"
+        rlRun "grep ExecStart= /usr/lib/systemd/system/rescue.service"
+        rlRun "strings /usr/lib/systemd/systemd-sulogin-shell | grep /sbin/sulogin"
+        rlRun "service rescue start"
+        sleep 2
+        rlRun "service rescue status"
+        rlRun "service rescue stop"
+        sleep 2
+        rlRun "service rescue status" 3
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        sleep 2
+        rlSECheckAVC
+    rlPhaseEnd
+rlJournalEnd
+