[tests/selinux] pr775-checkpolicy-revdeps: test if systemd-sysctl can read files under /run/sysctl.d/

[tests/selinux] pr775-checkpolicy-revdeps: test if systemd-sysctl can read files under /run/sysctl.d/

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 917da0db4b3d51f66b167e02e070ab28f81e52da
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2024-09-19T10:04:46+00:00
            Stats  : +15/-1 in 3 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/917da0db4b3d51f66b167e02e070ab28f81e52da?branch=pr775-checkpolicy-revdeps

            Log:
            test if systemd-sysctl can read files under /run/sysctl.d/

A recently filed issue revealed that SELinux prevents the
systemd-sysctl from reading the files stored under the /run/sysctl.d/
directory. The TC reproduces the situation.

In order to support this documented sysctl specific location,
I believe that SELinux policy should allow the action. The TC
looks for SELinux denials that may appear when reproducing the
scenario.

The TC covers RHEL-56988 and RHEL-58380.

---
diff --git a/selinux-policy/systemd-sysctl-and-similar/Makefile b/selinux-policy/systemd-sysctl-and-similar/Makefile
index 5b5981e..fbb3c30 100644
--- a/selinux-policy/systemd-sysctl-and-similar/Makefile
+++ b/selinux-policy/systemd-sysctl-and-similar/Makefile
@@ -64,6 +64,8 @@ $(METADATA): Makefile
 	@echo "Releases:        -RHEL4 -RHEL6 -RHEL7 -RHELClient5 -RHELServer5" >> $(METADATA)
 	@echo "Bug:             2056207" >> $(METADATA) # Fedora 36
 	@echo "Bug:             2056999" >> $(METADATA) # RHEL-9
+	@echo "Bug:             RHEL-56988" >> $(METADATA) # RHEL-9
+	@echo "Bug:             RHEL-58380" >> $(METADATA) # RHEL-10
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/systemd-sysctl-and-similar/main.fmf b/selinux-policy/systemd-sysctl-and-similar/main.fmf
index 6ae3010..996e1d7 100644
--- a/selinux-policy/systemd-sysctl-and-similar/main.fmf
+++ b/selinux-policy/systemd-sysctl-and-similar/main.fmf
@@ -29,6 +29,8 @@ tag:
 link:
   - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2056207
   - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2056999
+  - verifies: https://issues.redhat.com/browse/RHEL-56988
+  - verifies: https://issues.redhat.com/browse/RHEL-58380
 adjust:
   - enabled: false
     when: distro == rhel-4, rhel-5, rhel-6, rhel-7

diff --git a/selinux-policy/systemd-sysctl-and-similar/runtest.sh b/selinux-policy/systemd-sysctl-and-similar/runtest.sh
index e7ef474..4667ee4 100755
--- a/selinux-policy/systemd-sysctl-and-similar/runtest.sh
+++ b/selinux-policy/systemd-sysctl-and-similar/runtest.sh
@@ -59,11 +59,21 @@ rlJournalStart
         rlRun "ls -Z /proc/sys/kernel/kptr_restrict | grep :proc_security_t"
         rlSESearchRule "allow systemd_sysctl_t proc_security_t : file { read } [ ]"
     rlPhaseEnd
+
+    rlPhaseStartTest "RHEL-56988 + RHEL-58380"
+        rlRun "man sysctl.d | grep /run/sysctl"
+        rlRun "mkdir -pZ /run/sysctl.d"
+        rlRun "echo 'net.ipv4.conf.eno1.rp_filter=0' > /run/sysctl.d/51-rp_filter.conf"
+        rlRun "restorecon -Rv /run/sysctl.d"
+        rlRun "service systemd-sysctl stop"
+        rlRun "service systemd-sysctl start"
+        rlRun "service systemd-sysctl status" 0,3
+    rlPhaseEnd
     fi
 
     rlPhaseStartTest "real scenario"
         rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "start status" 1
-        rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255
+        rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255
         rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "restart status stop status" 1
     rlPhaseEnd