[tests/selinux] pr775-checkpolicy-revdeps: test if systemd-homed can read /var/cache/systemd/home/

[tests/selinux] pr775-checkpolicy-revdeps: test if systemd-homed can read /var/cache/systemd/home/

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 2aa17596925b3e22f3f45aabcf95f66a14476e1d
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2024-10-04T11:49:13+00:00
            Stats  : +21/-2 in 3 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/2aa17596925b3e22f3f45aabcf95f66a14476e1d?branch=pr775-checkpolicy-revdeps

            Log:
            test if systemd-homed can read /var/cache/systemd/home/

Several recent BZ reports revealed that SELinux prevents the
systemd-homed processes from reading the /var/cache/systemd/home/
directory. The TC reproduces the situation.

In order to support the expected systemd-homed functionality, I believe
that SELinux policy should allow the action. The TC looks for
appropriate policy rules and file context patterns.

The TC covers BZ#2036108 and its duplicates.

---
diff --git a/selinux-policy/systemd-homed/Makefile b/selinux-policy/systemd-homed/Makefile
index d067913..5b03c59 100644
--- a/selinux-policy/systemd-homed/Makefile
+++ b/selinux-policy/systemd-homed/Makefile
@@ -55,7 +55,7 @@ $(METADATA): Makefile
 	@echo "TestTime:        1h" >> $(METADATA)
 	@echo "RunFor:          selinux-policy" >> $(METADATA)
 	@echo "RunFor:          systemd" >> $(METADATA)
-	@echo "Requires:        audit expect initscripts systemd libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console" >> $(METADATA)
+	@echo "Requires:        audit expect /usr/sbin/service systemd libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console" >> $(METADATA)
 	@echo "RhtsRequires:    library(selinux-policy/common)" >> $(METADATA)
 	@echo "Priority:        Normal" >> $(METADATA)
 	@echo "License:         GPLv2" >> $(METADATA)
@@ -64,6 +64,11 @@ $(METADATA): Makefile
 	@echo "Environment:     AVC_ERROR=+no_avc_check" >> $(METADATA)
 	@echo "Releases:        -RHEL4 -RHEL5" >> $(METADATA)
 	@echo "Bug:             1809878" >> $(METADATA) # Fedora 32
+	@echo "Bug:             2036108" >> $(METADATA) # Fedora 42
+	@echo "Bug:             2315087" >> $(METADATA) # Fedora 41
+	@echo "Bug:             2316163" >> $(METADATA) # Fedora 41
+	@echo "Bug:             2315812" >> $(METADATA) # Fedora 42
+	@echo "Bug:             2315587" >> $(METADATA) # Fedora 41
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/systemd-homed/main.fmf b/selinux-policy/systemd-homed/main.fmf
index b2b0cd1..f98dce0 100644
--- a/selinux-policy/systemd-homed/main.fmf
+++ b/selinux-policy/systemd-homed/main.fmf
@@ -7,7 +7,7 @@ require:
 recommend:
   - audit
   - expect
-  - initscripts
+  - /usr/sbin/service
   - systemd
   - libselinux
   - libselinux-utils
@@ -20,6 +20,11 @@ environment:
 duration: 1h
 link:
   - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1809878
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2036108
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2315087
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2315587
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2315812
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2316163
 adjust:
   - enabled: false
     when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, rhel-9, centos-stream-8, centos-stream-9

diff --git a/selinux-policy/systemd-homed/runtest.sh b/selinux-policy/systemd-homed/runtest.sh
index 36eb6c5..dd7969d 100755
--- a/selinux-policy/systemd-homed/runtest.sh
+++ b/selinux-policy/systemd-homed/runtest.sh
@@ -216,6 +216,15 @@ rlJournalStart
         rlRun "ausearch -m AVC -m USER_AVC --start $tst_Time --input-logs" 1
     rlPhaseEnd
 
+    rlPhaseStartTest "bz#2036108 + bz#2315087"
+        rlSEMatchPathCon "/usr/lib/systemd/systemd-homed" "systemd_homed_exec_t"
+        rlSEMatchPathCon "/var/cache/systemd/" "systemd_cache_t"
+        rlSEMatchPathCon "/var/cache/systemd/home/" "systemd_homed_cache_t"
+        rlSESearchRule "allow systemd_homed_t systemd_homed_cache_t : dir { read } [ ]"
+
+        rlRun "service systemd-homed restart"
+    rlPhaseEnd
+
     rlPhaseStartCleanup
         rlRun "systemctl disable systemd-homed"
         sleep 2