[tests/selinux] pr775-checkpolicy-revdeps: test if new dhcpcd instance can kill an old instance

[tests/selinux] pr775-checkpolicy-revdeps: test if new dhcpcd instance can kill an old instance

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 4f44f21f576c326266b6c8cca427b702310ae76c
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2024-09-18T15:47:51+00:00
            Stats  : +15/-0 in 3 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/4f44f21f576c326266b6c8cca427b702310ae76c?branch=pr775-checkpolicy-revdeps

            Log:
            test if new dhcpcd instance can kill an old instance

Because the ISC dhcp is no longer maintained by upstream, the dhcpcd
package is used as a replacement. Unfortunately, SELinux prevents
a new dhcpcd instance from communicating to and terminating the old one.
The TC does not reproduce the situation.

In order to support the intented dhcpcd functionality, I believe that
SELinux policy should allow these actions. The TC looks for appropriate
policy rules and file context patterns.

The TC covers RHEL-33081 and RHEL-43417.

---
diff --git a/selinux-policy/dhcpcd-and-similar/Makefile b/selinux-policy/dhcpcd-and-similar/Makefile
index e124576..4b3f11f 100644
--- a/selinux-policy/dhcpcd-and-similar/Makefile
+++ b/selinux-policy/dhcpcd-and-similar/Makefile
@@ -67,6 +67,8 @@ $(METADATA): Makefile
 	@echo "Bug:             RHEL-15326" >> $(METADATA) # RHEL-9
 	@echo "Bug:             2269708" >> $(METADATA) # Fedora 40
 	@echo "Bug:             2270733" >> $(METADATA) # Fedora 41
+	@echo "Bug:             RHEL-33081" >> $(METADATA) # RHEL-10
+	@echo "Bug:             RHEL-43417" >> $(METADATA) # RHEL-10
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/dhcpcd-and-similar/main.fmf b/selinux-policy/dhcpcd-and-similar/main.fmf
index ff2cbf1..6592423 100644
--- a/selinux-policy/dhcpcd-and-similar/main.fmf
+++ b/selinux-policy/dhcpcd-and-similar/main.fmf
@@ -34,6 +34,8 @@ link:
   - verifies: https://issues.redhat.com/browse/RHEL-15326
   - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2269708
   - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2270733
+  - verifies: https://issues.redhat.com/browse/RHEL-33081
+  - verifies: https://issues.redhat.com/browse/RHEL-43417
 adjust:
   - enabled: false
     when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7

diff --git a/selinux-policy/dhcpcd-and-similar/runtest.sh b/selinux-policy/dhcpcd-and-similar/runtest.sh
index f1fb91c..ba9ea50 100755
--- a/selinux-policy/dhcpcd-and-similar/runtest.sh
+++ b/selinux-policy/dhcpcd-and-similar/runtest.sh
@@ -98,6 +98,17 @@ rlJournalStart
     rlPhaseEnd
     fi
 
+    if rlIsRHEL 10 || rlIsCentOS 10 ; then
+    rlPhaseStartTest "RHEL-33081"
+        rlSEMatchPathCon "/run/dhcpcd/eth0-4.unpriv.sock" "dhcpc_var_run_t"
+        rlSESearchRule "allow dhcpc_t dhcpc_t : unix_stream_socket { connectto } [ ]"
+    rlPhaseEnd
+
+    rlPhaseStartTest "RHEL-43417"
+        rlSESearchRule "allow dhcpc_t dhcpc_t : capability { kill } [ ]"
+    rlPhaseEnd
+    fi
+
     rlPhaseStartTest "real scenario -- standalone service"
         rlRun "ip netns add test-ns"
         rlRun "ip netns del test-ns"