[tests/selinux] pr775-checkpolicy-revdeps: test if 'hostapd_cli ping' can run as a systemd service

[tests/selinux] pr775-checkpolicy-revdeps: test if 'hostapd_cli ping' can run as a systemd service

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 2b36306eb2f9c81e54c60e7a36b0167e727b0bf6
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2024-10-03T07:48:29+00:00
            Stats  : +6/-1 in 3 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/2b36306eb2f9c81e54c60e7a36b0167e727b0bf6?branch=pr775-checkpolicy-revdeps

            Log:
            test if 'hostapd_cli ping' can run as a systemd service

A recent testing of a documented hostapd + freeradius use case
revealed that SELinux prevents the hostapd processes from writing
to a control socket located in /tmp. The TC reproduces the situation.

In order to support the documented use case, I believe that SELinux
policy should allow the action. The TC looks for appropriate policy
rules and file context patterns.

The TC covers RHEL-59683.

---
diff --git a/selinux-policy/hostapd-and-similar/Makefile b/selinux-policy/hostapd-and-similar/Makefile
index 594646a..4c1c5dd 100644
--- a/selinux-policy/hostapd-and-similar/Makefile
+++ b/selinux-policy/hostapd-and-similar/Makefile
@@ -76,6 +76,7 @@ $(METADATA): Makefile
 	@echo "Bug:             1979968" >> $(METADATA) # RHEL-9
 	@echo "Bug:             1784253" >> $(METADATA) # Fedora 35
 	@echo "Bug:             2032277" >> $(METADATA) # Fedora 35
+	@echo "Bug:             RHEL-59683" >> $(METADATA) # RHEL-9
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/hostapd-and-similar/main.fmf b/selinux-policy/hostapd-and-similar/main.fmf
index 46fb896..aa3ac7a 100644
--- a/selinux-policy/hostapd-and-similar/main.fmf
+++ b/selinux-policy/hostapd-and-similar/main.fmf
@@ -4,6 +4,7 @@ description: |+
 
 contact: Milos Malik <mmalik@redhat.com>
 component:
+  - hostapd
   - selinux-policy
 require:
   - library(selinux-policy/common)
@@ -46,6 +47,7 @@ link:
   - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1784253
   - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2032277
   - relates: https://bugzilla.redhat.com/show_bug.cgi?id=2064688
+  - verifies: https://issues.redhat.com/browse/RHEL-59683
 adjust:
   - enabled: false
     when: arch == s390x

diff --git a/selinux-policy/hostapd-and-similar/runtest.sh b/selinux-policy/hostapd-and-similar/runtest.sh
index d2b2bbd..aee5619 100755
--- a/selinux-policy/hostapd-and-similar/runtest.sh
+++ b/selinux-policy/hostapd-and-similar/runtest.sh
@@ -112,8 +112,10 @@ rlJournalStart
             PROCESS_CONTEXT="unconfined_service_t"
         fi
         rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1
-        rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255
+        rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255
         rlRun "hostapd_cli all_sta"
+        rlRun "systemd-run hostapd_cli ping"
+        sleep 5
         rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1
     rlPhaseEnd