[tests/selinux] pr775-checkpolicy-revdeps: test if systemd-machined can create socket in /run/systemd/machine/

[tests/selinux] pr775-checkpolicy-revdeps: test if systemd-machined can create socket in /run/systemd/machine/

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 96d9e69fc47566421d6fdd28ac6f3222b7380dad
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2024-07-26T09:48:20+00:00
            Stats  : +23/-1 in 4 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/96d9e69fc47566421d6fdd28ac6f3222b7380dad?branch=pr775-checkpolicy-revdeps

            Log:
            test if systemd-machined can create socket in /run/systemd/machine/

Recent cockpit + systemd + selinux-policy testing revealed that
SELinux prevents the systemd-machined process (started by the
machinectl command) from doing the following actions:
 * creating the /run/systemd/machine directory
 * creating the /run/systemd/machine/io.systemd.Machine socket
 * unlinking the /run/systemd/machine/io.systemd.Machine socket
The TC reproduces the situation.

In order to support the basic machinectl functions, I believe that
SELinux policy allow these actions. The TC looks for appropriate
policy rules and file context patterns.

The TC covers RHEL-49567.

---
diff --git a/selinux-policy/systemd-machined-and-similar/Makefile b/selinux-policy/systemd-machined-and-similar/Makefile
index 35c7767..cb3f07b 100644
--- a/selinux-policy/systemd-machined-and-similar/Makefile
+++ b/selinux-policy/systemd-machined-and-similar/Makefile
@@ -66,6 +66,7 @@ $(METADATA): Makefile
 	@echo "Bug:             1847545" >> $(METADATA) # Fedora 32
 	@echo "Bug:             1900869" >> $(METADATA) # Fedora 33
 	@echo "Bug:             1900888" >> $(METADATA) # Fedora 35
+	@echo "Bug:             RHEL-49567" >> $(METADATA) # RHEL-10
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/systemd-machined-and-similar/PURPOSE b/selinux-policy/systemd-machined-and-similar/PURPOSE
index 1734b44..5f4a9e8 100644
--- a/selinux-policy/systemd-machined-and-similar/PURPOSE
+++ b/selinux-policy/systemd-machined-and-similar/PURPOSE
@@ -3,3 +3,4 @@ Author: Milos Malik <mmalik@redhat.com>
 
 SELinux interferes with systemd-machined and related programs.
 
+Related programs: machinectl.

diff --git a/selinux-policy/systemd-machined-and-similar/main.fmf b/selinux-policy/systemd-machined-and-similar/main.fmf
index 778b593..617fc5e 100644
--- a/selinux-policy/systemd-machined-and-similar/main.fmf
+++ b/selinux-policy/systemd-machined-and-similar/main.fmf
@@ -34,6 +34,7 @@ link:
   - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1847545
   - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1900869
   - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=1900888
+  - verifies: https://issues.redhat.com/browse/RHEL-49567
 adjust:
   - enabled: false
     when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7

diff --git a/selinux-policy/systemd-machined-and-similar/runtest.sh b/selinux-policy/systemd-machined-and-similar/runtest.sh
index 54b3bb2..422908e 100755
--- a/selinux-policy/systemd-machined-and-similar/runtest.sh
+++ b/selinux-policy/systemd-machined-and-similar/runtest.sh
@@ -36,6 +36,16 @@ SERVICE_PACKAGE="systemd-container"
 SERVICE_NAME="systemd-machined"
 PROCESS_NAME="systemd-machined"
 PROCESS_CONTEXT="systemd_machined_t"
+INSTALL_OPTION=""
+if yum --help | grep -q use-host-config ; then
+    INSTALL_OPTION="${INSTALL_OPTION} --use-host-config"
+fi
+if yum install --help | grep -q skip-broken ; then
+    INSTALL_OPTION="${INSTALL_OPTION} --skip-broken"
+fi
+if yum install --help | grep -q skip-unavailable ; then
+    INSTALL_OPTION="${INSTALL_OPTION} --skip-unavailable"
+fi
 
 rlJournalStart
     if [ ! -f ${FILE_PATH} ] ; then
@@ -85,6 +95,15 @@ rlJournalStart
     rlPhaseEnd
     fi
 
+    rlPhaseStartTest "RHEL-49567"
+        rlSEMatchPathCon "/usr/lib/systemd/systemd-machined" "systemd_machined_exec_t"
+        rlSEMatchPathCon "/run/systemd/machine" "systemd_machined_var_run_t"
+        rlSEMatchPathCon "/run/systemd/machine/io.systemd.Machine" "systemd_machined_var_run_t"
+        rlSESearchRule "allow systemd_machined_t systemd_machined_var_run_t : dir { create } [ ]"
+        rlSESearchRule "allow systemd_machined_t systemd_machined_var_run_t : sock_file { create unlink } [ ]"
+        rlRun "machinectl"
+    rlPhaseEnd
+
     rlPhaseStartTest "real scenario -- standalone service"
         if ! rlSEDefined ${PROCESS_CONTEXT} ; then
             PROCESS_CONTEXT="unconfined_service_t"
@@ -96,7 +115,7 @@ rlJournalStart
 
     rlPhaseStartTest "real scenario -- bz#1900869 + bz#1900888"
         rlRun "mkdir -pZ /var/lib/machines/test"
-        rlRun "dnf -y --installroot=/var/lib/machines/test/ install dhcp-client dnf filesystem glibc glibc-langpack-en glibc-langpack-de iproute iputils less passwd systemd vim-minimal"
+        rlRun "dnf -y --installroot=/var/lib/machines/test/ install dhcp-client dnf filesystem glibc glibc-langpack-en glibc-langpack-de iproute iputils less passwd systemd vim-minimal ${INSTALL_OPTION}"
         rlRun "du -sh /var/lib/machines/test"
         # TODO: remove next 2 lines once the BZs are fixed
         rlRun "semodule -i testpolicy.cil"