[tests/selinux] pr775-checkpolicy-revdeps: add basic test coverage of the libvirt-dbus service

[Milos Malik <mmalik@redhat.com>]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 1ea9253e5851d2632488c0ea92a9a09f830ad936
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2024-07-26T09:18:37+00:00
            Stats  : +221/-0 in 4 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/1ea9253e5851d2632488c0ea92a9a09f830ad936?branch=pr775-checkpolicy-revdeps

            Log:
            add basic test coverage of the libvirt-dbus service

A recent cockpit + selinux-policy testing revealed that SELinux
prevents libvirt-dbus processes from connecting to virtqemud
processes. The TC reproduces the situation.

The libvirt-dbus service is confined by SELinux now. The TC covers
basic scenarios in which the service is used. The TC looks for
appropriate policy rules and file context patterns.

The TC covers RHEL-46893.

---
diff --git a/selinux-policy/libvirt-dbus-and-similar/Makefile b/selinux-policy/libvirt-dbus-and-similar/Makefile
new file mode 100644
index 0000000..6ad5719
--- /dev/null
+++ b/selinux-policy/libvirt-dbus-and-similar/Makefile
@@ -0,0 +1,69 @@
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Makefile of /CoreOS/selinux-policy/Regression/libvirt-dbus-and-similar
+#   Description: SELinux interferes with libvirt-dbus and related programs
+#   Author: Milos Malik <mmalik@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2024 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+export TEST=/CoreOS/selinux-policy/Regression/libvirt-dbus-and-similar
+export TESTVERSION=1.0
+
+BUILT_FILES=
+
+FILES=$(METADATA) runtest.sh Makefile PURPOSE
+
+.PHONY: all install download clean
+
+run: $(FILES) build
+	./runtest.sh
+
+build: $(BUILT_FILES)
+	chmod a+x runtest.sh
+	chcon -t bin_t runtest.sh
+
+clean:
+	rm -f *~ $(BUILT_FILES)
+
+include /usr/share/rhts/lib/rhts-make.include
+
+$(METADATA): Makefile
+	@echo "Owner:           Milos Malik <mmalik@redhat.com>" > $(METADATA)
+	@echo "Name:            $(TEST)" >> $(METADATA)
+	@echo "TestVersion:     $(TESTVERSION)" >> $(METADATA)
+	@echo "Path:            $(TEST_DIR)" >> $(METADATA)
+	@echo "Description:     SELinux interferes with libvirt-dbus and related programs" >> $(METADATA)
+	@echo "Type:            Regression" >> $(METADATA)
+	@echo "TestTime:        15m" >> $(METADATA)
+	@echo "RunFor:          selinux-policy" >> $(METADATA)
+	@echo "RunFor:          libvirt-dbus" >> $(METADATA)
+	@echo "Requires:        audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console libvirt-dbus /usr/sbin/service" >> $(METADATA)
+	@echo "RhtsRequires:    library(selinux-policy/common)" >> $(METADATA)
+	@echo "Priority:        Normal" >> $(METADATA)
+	@echo "License:         GPLv2" >> $(METADATA)
+	@echo "Confidential:    no" >> $(METADATA)
+	@echo "Destructive:     no" >> $(METADATA)
+	@echo "Environment:     AVC_ERROR=+no_avc_check" >> $(METADATA)
+	@echo "Releases:        -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA)
+	@echo "Bug:             RHEL-46893" >> $(METADATA) # RHEL-10
+
+	rhts-lint $(METADATA)
+

diff --git a/selinux-policy/libvirt-dbus-and-similar/PURPOSE b/selinux-policy/libvirt-dbus-and-similar/PURPOSE
new file mode 100644
index 0000000..94dfc9b
--- /dev/null
+++ b/selinux-policy/libvirt-dbus-and-similar/PURPOSE
@@ -0,0 +1,5 @@
+PURPOSE of /CoreOS/selinux-policy/Regression/libvirt-dbus-and-similar
+Author: Milos Malik <mmalik@redhat.com>
+
+SELinux interferes with libvirt-dbus and related programs.
+

diff --git a/selinux-policy/libvirt-dbus-and-similar/main.fmf b/selinux-policy/libvirt-dbus-and-similar/main.fmf
new file mode 100644
index 0000000..c5e8620
--- /dev/null
+++ b/selinux-policy/libvirt-dbus-and-similar/main.fmf
@@ -0,0 +1,38 @@
+summary: SELinux interferes with libvirt-dbus and related programs
+description: |+
+    SELinux interferes with libvirt-dbus and related programs.
+
+contact: Milos Malik <mmalik@redhat.com>
+component:
+  - selinux-policy
+require:
+  - library(selinux-policy/common)
+recommend:
+  - audit
+  - libselinux
+  - libselinux-utils
+  - policycoreutils
+  - selinux-policy
+  - selinux-policy-targeted
+  - setools-console
+  - libvirt-dbus
+  - /usr/sbin/service
+environment:
+    AVC_ERROR: +no_avc_check
+duration: 15m
+enabled: true
+tag:
+  - NoRHEL4
+  - NoRHEL5
+  - NoRHEL6
+  - NoRHEL7
+  - targeted
+  - NoRHIVOS
+link:
+  - verifies: https://issues.redhat.com/browse/RHEL-46893
+adjust:
+  - enabled: false
+    when: distro == rhel-4, rhel-5, rhel-6, rhel-7
+    because: the libvirt-dbus package is not available there
+extra-summary: /CoreOS/selinux-policy/Regression/libvirt-dbus-and-similar
+extra-task: /CoreOS/selinux-policy/Regression/libvirt-dbus-and-similar

diff --git a/selinux-policy/libvirt-dbus-and-similar/runtest.sh b/selinux-policy/libvirt-dbus-and-similar/runtest.sh
new file mode 100755
index 0000000..a624305
--- /dev/null
+++ b/selinux-policy/libvirt-dbus-and-similar/runtest.sh
@@ -0,0 +1,109 @@
+#!/bin/bash
+# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   runtest.sh of /CoreOS/selinux-policy/Regression/libvirt-dbus-and-similar
+#   Description: SELinux interferes with libvirt-dbus and related programs
+#   Author: Milos Malik <mmalik@redhat.com>
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+#
+#   Copyright (c) 2024 Red Hat, Inc. All rights reserved.
+#
+#   This copyrighted material is made available to anyone wishing
+#   to use, modify, copy, or redistribute it subject to the terms
+#   and conditions of the GNU General Public License version 2.
+#
+#   This program is distributed in the hope that it will be
+#   useful, but WITHOUT ANY WARRANTY; without even the implied
+#   warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+#   PURPOSE. See the GNU General Public License for more details.
+#
+#   You should have received a copy of the GNU General Public
+#   License along with this program; if not, write to the Free
+#   Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+#   Boston, MA 02110-1301, USA.
+#
+# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+# Include Beaker environment
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGE="selinux-policy"
+FILE_PATH="/usr/sbin/libvirt-dbus"
+SERVICE_PACKAGE="libvirt-dbus"
+SERVICE_NAME="libvirt-dbus"
+PROCESS_NAME="libvirt-dbus"
+
+if seinfo -t | grep -q virt_dbus ; then
+    FILE_CONTEXT="virt_dbus_exec_t"
+    PROCESS_CONTEXT="virt_dbus_t"
+else
+    FILE_CONTEXT="bin_t"
+    PROCESS_CONTEXT="unconfined_service_t"
+fi
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlRun "rlImport 'selinux-policy/common'" 0,1
+        rlSESatisfyRequires
+        rlAssertRpm ${PACKAGE}
+        rlAssertRpm ${PACKAGE}-targeted
+        rlAssertRpm ${SERVICE_PACKAGE}
+
+        rlServiceStop ${SERVICE_NAME}
+        rlRun "yum -y install libvirt\* --skip-broken"
+
+        rlSESetEnforce
+        rlSEStatus
+        rlSESetTimestamp
+        sleep 2
+    rlPhaseEnd
+
+    rlPhaseStartTest "RHEL-46893"
+        rlSEMatchPathCon ${FILE_PATH} ${FILE_CONTEXT}
+        rlSESearchRule "allow virt_dbus_t virtqemud_t : unix_stream_socket { connectto } [ ]"
+        rlSESearchRule "allow virtqemud_t virt_dbus_t : dir { search } [ ]"
+        rlSESearchRule "allow virtqemud_t virt_dbus_t : file { getattr open read } [ ]"
+    rlPhaseEnd
+
+    rlPhaseStartTest "real scenario -- standalone service"
+        rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1
+        rlRun "restorecon -Rv /var /run -e /var/ARTIFACTS" 0-255
+        rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1
+    rlPhaseEnd
+
+    rlPhaseStartTest "real scenario -- communication with other virt* services"
+        for VIRT_SERVICE in virtinterfaced virtlxcd virtnetworkd virtnodedevd virtnwfilterd virtproxyd virtqemud virtsecretd virtstoraged virtvboxd ; do
+            if [ -f /usr/lib/systemd/system/${VIRT_SERVICE}.service ] ; then
+                rlRun "service ${VIRT_SERVICE} start"
+            fi
+        done
+
+        AVAIL_DAEMONS="QEMU"
+        if [ -f /usr/lib/systemd/system/virtlxcd.service ] ; then
+            AVAIL_DAEMONS="LXC QEMU"
+        fi
+
+        for DAEMON in ${AVAIL_DAEMONS} ; do
+            for METHOD in ListDomains ListInterfaces ListNWFilters ListNetworks ListNodeDevices ListSecrets ListStoragePools ; do
+                rlRun "busctl call org.libvirt /org/libvirt/${DAEMON} org.libvirt.Connect ${METHOD} u 0" 0,1
+            done
+        done
+
+        for VIRT_SERVICE in virtinterfaced virtlxcd virtnetworkd virtnodedevd virtnwfilterd virtproxyd virtqemud virtsecretd virtstoraged virtvboxd ; do
+            if [ -f /usr/lib/systemd/system/${VIRT_SERVICE}.service ] ; then
+                rlRun "service ${VIRT_SERVICE} stop"
+            fi
+        done
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        sleep 2
+        rlSECheckAVC
+
+        rlServiceRestore ${SERVICE_NAME}
+    rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd
+