[tests/selinux] pr775-checkpolicy-revdeps: test if logwatch's sendmail can search for disable_ipv6

[tests/selinux] pr775-checkpolicy-revdeps: test if logwatch's sendmail can search for disable_ipv6

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 2e11118f7af6224dfbff12a203d2c868fa9f8d26
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2024-05-02T14:24:12+00:00
            Stats  : +19/-5 in 3 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/2e11118f7af6224dfbff12a203d2c868fa9f8d26?branch=pr775-checkpolicy-revdeps

            Log:
            test if logwatch's sendmail can search for disable_ipv6

A recent SELinux policy + logwatch testing revealed that SELinux
prevents the sendmail process (executed by the logwatch timer) from
searching the /proc/sys/net/ipv6/conf/all/ directory and finding
the disable_ipv6 file. The TC reproduces the situation on machines
with special IPv6 configuration.

In order to avoid unnecessary SELinux denials being triggered during
the situation, I believe that SELinux policy should allow the access.
The TC looks for appropriate rules and file context patterns.

The TC covers BZ#2183432 and RHEL-34135.

---
diff --git a/selinux-policy/logwatch-and-similar/Makefile b/selinux-policy/logwatch-and-similar/Makefile
index 857441b..2c3dd3b 100644
--- a/selinux-policy/logwatch-and-similar/Makefile
+++ b/selinux-policy/logwatch-and-similar/Makefile
@@ -52,7 +52,7 @@ $(METADATA): Makefile
 	@echo "Path:            $(TEST_DIR)" >> $(METADATA)
 	@echo "Description:     SELinux interferes with logwatch and related programs" >> $(METADATA)
 	@echo "Type:            Regression" >> $(METADATA)
-	@echo "TestTime:        10m" >> $(METADATA)
+	@echo "TestTime:        15m" >> $(METADATA)
 	@echo "RunFor:          selinux-policy" >> $(METADATA)
 	@echo "Requires:        audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console logwatch sendmail /usr/sbin/service" >> $(METADATA)
 	@echo "RhtsRequires:    library(selinux-policy/common)" >> $(METADATA)
@@ -62,7 +62,9 @@ $(METADATA): Makefile
 	@echo "Confidential:    no" >> $(METADATA)
 	@echo "Destructive:     no" >> $(METADATA)
 	@echo "Releases:        -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA)
+	@echo "Bug:             2183432" >> $(METADATA) # Fedora 38
 	@echo "Bug:             2270484" >> $(METADATA) # Fedora 40
+	@echo "Bug:             RHEL-34135" >> $(METADATA) # RHEL-9
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/logwatch-and-similar/main.fmf b/selinux-policy/logwatch-and-similar/main.fmf
index 7fe58e0..dbdaf89 100644
--- a/selinux-policy/logwatch-and-similar/main.fmf
+++ b/selinux-policy/logwatch-and-similar/main.fmf
@@ -20,7 +20,7 @@ recommend:
   - /usr/sbin/service
 environment:
     AVC_ERROR: +no_avc_check
-duration: 10m
+duration: 15m
 enabled: true
 tag:
   - NoRHEL4
@@ -33,10 +33,12 @@ tag:
   - targeted
 tier: '3'
 link:
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2183432
+  - verifies: https://issues.redhat.com/browse/RHEL-34135
   - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2270484
 adjust:
   - enabled: false
-    when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8
+    when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8
     because: the logwatch service is not available there
 extra-summary: /CoreOS/selinux-policy/Regression/logwatch-and-similar
 extra-task: /CoreOS/selinux-policy/Regression/logwatch-and-similar

diff --git a/selinux-policy/logwatch-and-similar/runtest.sh b/selinux-policy/logwatch-and-similar/runtest.sh
index 016d5a8..fe1de30 100755
--- a/selinux-policy/logwatch-and-similar/runtest.sh
+++ b/selinux-policy/logwatch-and-similar/runtest.sh
@@ -45,7 +45,7 @@ rlJournalStart
         rlAssertRpm ${SERVICE_PACKAGE}
 
         rlServiceStop ${SERVICE_NAME}
-        rlFileBackup /etc/shadow
+        rlFileBackup /usr/lib/systemd/system/logwatch.timer
 
         rlSESetEnforce
         rlSEStatus
@@ -53,6 +53,12 @@ rlJournalStart
         sleep 2
     rlPhaseEnd
 
+    rlPhaseStartTest "bz#2183432 + RHEL-34135"
+        rlRun "ls -Z /proc/sys/net/ipv6/conf/all/disable_ipv6 | grep :sysctl_net_t"
+        rlSESearchRule "allow logwatch_mail_t sysctl_net_t : dir { search } [ ]"
+        rlSESearchRule "allow logwatch_mail_t sysctl_net_t : file { getattr open read } [ ]"
+    rlPhaseEnd
+
     if ! rlIsRHEL 9 ; then
     rlPhaseStartTest "bz#2270484"
         rlSEMatchPathCon "/usr/share/logwatch/scripts/logwatch.pl" "logwatch_exec_t"
@@ -78,7 +84,11 @@ rlJournalStart
         rlRun "systemctl enable ${SERVICE_NAME}.timer"
         rlRun "systemctl start ${SERVICE_NAME}.timer"
         rlRun "systemctl list-timers --all"
-        rlRun "sleep 5s"
+        NEXT_TIME=`date -d "now + 1 minute" "+%H:%M"`
+        rlRun "sed -i 's/AccuracySec=.*$/AccuracySec=1s\nOnCalendar=*-*-* $NEXT_TIME/' /usr/lib/systemd/system/${SERVICE_NAME}.timer"
+        rlRun "systemctl daemon-reload"
+        rlRun "systemctl list-timers --all"
+        rlRun "sleep 2m"
         rlRun "systemctl stop ${SERVICE_NAME}.timer"
         rlRun "systemctl disable ${SERVICE_NAME}.timer"
     rlPhaseEnd