public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
From: Milos Malik <mmalik@redhat.com>
To: git-commits@fedoraproject.org
Subject: [tests/selinux] pr775-checkpolicy-revdeps: test if systemd-homed can read /var/cache/systemd/home/
Date: Fri, 11 Sep 2026 13:22:02 GMT [thread overview]
Message-ID: <178913292292.1.17860067118042078524.tests-selinux-2aa17596925b@fedoraproject.org> (raw)
A new commit has been pushed.
Repo : tests/selinux
Branch : pr775-checkpolicy-revdeps
Commit : 2aa17596925b3e22f3f45aabcf95f66a14476e1d
Author : Milos Malik <mmalik@redhat.com>
Date : 2024-10-04T11:49:13+00:00
Stats : +21/-2 in 3 file(s)
URL : https://src.fedoraproject.org/tests/selinux/c/2aa17596925b3e22f3f45aabcf95f66a14476e1d?branch=pr775-checkpolicy-revdeps
Log:
test if systemd-homed can read /var/cache/systemd/home/
Several recent BZ reports revealed that SELinux prevents the
systemd-homed processes from reading the /var/cache/systemd/home/
directory. The TC reproduces the situation.
In order to support the expected systemd-homed functionality, I believe
that SELinux policy should allow the action. The TC looks for
appropriate policy rules and file context patterns.
The TC covers BZ#2036108 and its duplicates.
---
diff --git a/selinux-policy/systemd-homed/Makefile b/selinux-policy/systemd-homed/Makefile
index d067913..5b03c59 100644
--- a/selinux-policy/systemd-homed/Makefile
+++ b/selinux-policy/systemd-homed/Makefile
@@ -55,7 +55,7 @@ $(METADATA): Makefile
@echo "TestTime: 1h" >> $(METADATA)
@echo "RunFor: selinux-policy" >> $(METADATA)
@echo "RunFor: systemd" >> $(METADATA)
- @echo "Requires: audit expect initscripts systemd libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console" >> $(METADATA)
+ @echo "Requires: audit expect /usr/sbin/service systemd libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console" >> $(METADATA)
@echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA)
@echo "Priority: Normal" >> $(METADATA)
@echo "License: GPLv2" >> $(METADATA)
@@ -64,6 +64,11 @@ $(METADATA): Makefile
@echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA)
@echo "Releases: -RHEL4 -RHEL5" >> $(METADATA)
@echo "Bug: 1809878" >> $(METADATA) # Fedora 32
+ @echo "Bug: 2036108" >> $(METADATA) # Fedora 42
+ @echo "Bug: 2315087" >> $(METADATA) # Fedora 41
+ @echo "Bug: 2316163" >> $(METADATA) # Fedora 41
+ @echo "Bug: 2315812" >> $(METADATA) # Fedora 42
+ @echo "Bug: 2315587" >> $(METADATA) # Fedora 41
rhts-lint $(METADATA)
diff --git a/selinux-policy/systemd-homed/main.fmf b/selinux-policy/systemd-homed/main.fmf
index b2b0cd1..f98dce0 100644
--- a/selinux-policy/systemd-homed/main.fmf
+++ b/selinux-policy/systemd-homed/main.fmf
@@ -7,7 +7,7 @@ require:
recommend:
- audit
- expect
- - initscripts
+ - /usr/sbin/service
- systemd
- libselinux
- libselinux-utils
@@ -20,6 +20,11 @@ environment:
duration: 1h
link:
- relates: https://bugzilla.redhat.com/show_bug.cgi?id=1809878
+ - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2036108
+ - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2315087
+ - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2315587
+ - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2315812
+ - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2316163
adjust:
- enabled: false
when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, rhel-9, centos-stream-8, centos-stream-9
diff --git a/selinux-policy/systemd-homed/runtest.sh b/selinux-policy/systemd-homed/runtest.sh
index 36eb6c5..dd7969d 100755
--- a/selinux-policy/systemd-homed/runtest.sh
+++ b/selinux-policy/systemd-homed/runtest.sh
@@ -216,6 +216,15 @@ rlJournalStart
rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time --input-logs" 1
rlPhaseEnd
+ rlPhaseStartTest "bz#2036108 + bz#2315087"
+ rlSEMatchPathCon "/usr/lib/systemd/systemd-homed" "systemd_homed_exec_t"
+ rlSEMatchPathCon "/var/cache/systemd/" "systemd_cache_t"
+ rlSEMatchPathCon "/var/cache/systemd/home/" "systemd_homed_cache_t"
+ rlSESearchRule "allow systemd_homed_t systemd_homed_cache_t : dir { read } [ ]"
+
+ rlRun "service systemd-homed restart"
+ rlPhaseEnd
+
rlPhaseStartCleanup
rlRun "systemctl disable systemd-homed"
sleep 2
reply other threads:[~2026-09-11 13:22 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=178913292292.1.17860067118042078524.tests-selinux-2aa17596925b@fedoraproject.org \
--to=mmalik@redhat.com \
--cc=git-commits@fedoraproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox