[tests/selinux] pr775-checkpolicy-revdeps: test if virt-admin can connect to all virt sub-daemons

[tests/selinux] pr775-checkpolicy-revdeps: test if virt-admin can connect to all virt sub-daemons

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 06b265a3ea6086f3b6391333bae90ef6ee5a15f1
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2024-06-14T18:20:23+00:00
            Stats  : +23/-1 in 3 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/06b265a3ea6086f3b6391333bae90ef6ee5a15f1?branch=pr775-checkpolicy-revdeps

            Log:
            test if virt-admin can connect to all virt sub-daemons

A recently filed bug report revealed that SELinux prevents the
virt-admin command from connecting to various virtualization sub-daemons
using the admin connection. The TC reproduces the situation.

In order to support this virt-admin feature, I believe that SELinux
policy should allow the access. The TC looks for appropriate policy
rules.

The TC covers BZ#2291273.

---
diff --git a/selinux-policy/virtualization-daemons/Makefile b/selinux-policy/virtualization-daemons/Makefile
index ffe4846..2a0aa27 100644
--- a/selinux-policy/virtualization-daemons/Makefile
+++ b/selinux-policy/virtualization-daemons/Makefile
@@ -55,7 +55,7 @@ $(METADATA): Makefile
 	@echo "TestTime:        15m" >> $(METADATA)
 	@echo "RunFor:          libvirt" >> $(METADATA)
 	@echo "RunFor:          selinux-policy" >> $(METADATA)
-	@echo "Requires:        audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console /usr/sbin/service libvirt-daemon libvirt-client libvirt-daemon-driver-interface libvirt-daemon-driver-libxl libvirt-daemon-driver-lxc libvirt-daemon-driver-network libvirt-daemon-driver-nodedev libvirt-daemon-driver-nwfilter libvirt-daemon-driver-qemu libvirt-daemon-driver-secret libvirt-daemon-driver-storage-core libvirt-daemon-driver-vbox">> $(METADATA)
+	@echo "Requires:        audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console /usr/sbin/service libvirt-daemon libvirt-daemon-common libvirt-client libvirt-daemon-driver-interface libvirt-daemon-driver-libxl libvirt-daemon-driver-lxc libvirt-daemon-driver-network libvirt-daemon-driver-nodedev libvirt-daemon-driver-nwfilter libvirt-daemon-driver-qemu libvirt-daemon-driver-secret libvirt-daemon-driver-storage-core libvirt-daemon-driver-vbox">> $(METADATA)
 	@echo "RhtsRequires:    library(selinux-policy/common)" >> $(METADATA)
 	@echo "Environment:     AVC_ERROR=+no_avc_check" >> $(METADATA)
 	@echo "Priority:        Normal" >> $(METADATA)
@@ -63,6 +63,7 @@ $(METADATA): Makefile
 	@echo "Confidential:    no" >> $(METADATA)
 	@echo "Destructive:     no" >> $(METADATA)
 	@echo "Releases:        -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA)
+	@echo "Bug:             2291273" >> $(METADATA) # Fedora 41
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/virtualization-daemons/main.fmf b/selinux-policy/virtualization-daemons/main.fmf
index 77e161b..3df3ce2 100644
--- a/selinux-policy/virtualization-daemons/main.fmf
+++ b/selinux-policy/virtualization-daemons/main.fmf
@@ -20,6 +20,7 @@ recommend:
   - /usr/sbin/service
   - libvirt-client
   - libvirt-daemon
+  - libvirt-daemon-common
   - libvirt-daemon-driver-interface
   - libvirt-daemon-driver-libxl
   - libvirt-daemon-driver-lxc
@@ -34,6 +35,8 @@ environment:
     AVC_ERROR: +no_avc_check
 duration: 15m
 enabled: true
+link:
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2291273
 tag:
   - NoRHEL4
   - NoRHEL5

diff --git a/selinux-policy/virtualization-daemons/runtest.sh b/selinux-policy/virtualization-daemons/runtest.sh
index 042b365..2cae433 100755
--- a/selinux-policy/virtualization-daemons/runtest.sh
+++ b/selinux-policy/virtualization-daemons/runtest.sh
@@ -128,6 +128,7 @@ rlJournalStart
             PROCESS_CONTEXT=`echo ${TUPLE} | cut -d : -f 3`
             if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then
                 rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status" 1
+                rlRun "virt-admin -c ${SERVICE_NAME}:///system exit" 0,1
             fi
         done
         # stop all the services
@@ -141,6 +142,23 @@ rlJournalStart
         done
     rlPhaseEnd
 
+    if seinfo -a | grep -q virt_driver_domain ; then
+    rlPhaseStartTest "bz#2291273"
+        rlSESearchRule "allow virtnetworkd_t unconfined_t : dir { search } [ ]"
+        rlSESearchRule "allow virtnetworkd_t unconfined_t : file { open read } [ ]"
+        rlSESearchRule "allow virtnodedevd_t unconfined_t : dir { search } [ ]"
+        rlSESearchRule "allow virtnodedevd_t unconfined_t : file { open read } [ ]"
+        rlSESearchRule "allow virtnwfilterd_t unconfined_t : dir { search } [ ]"
+        rlSESearchRule "allow virtnwfilterd_t unconfined_t : file { open read } [ ]"
+        rlSESearchRule "allow virtsecretd_t unconfined_t : dir { search } [ ]"
+        rlSESearchRule "allow virtsecretd_t unconfined_t : file { open read } [ ]"
+        rlSESearchRule "allow virtstoraged_t unconfined_t : dir { search } [ ]"
+        rlSESearchRule "allow virtstoraged_t unconfined_t : file { open read } [ ]"
+        rlSESearchRule "allow virtvboxd_t unconfined_t : dir { search } [ ]"
+        rlSESearchRule "allow virtvboxd_t unconfined_t : file { open read } [ ]"
+    rlPhaseEnd
+    fi
+
     rlPhaseStartCleanup
         sleep 2
         rlSECheckAVC