[tests/selinux] pr775-checkpolicy-revdeps: test if virtqemud can use sched_getaffinity syscall on VM

[tests/selinux] pr775-checkpolicy-revdeps: test if virtqemud can use sched_getaffinity syscall on VM

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 25874c879b02bdc9425bac8146478c006aeae4fb
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2024-12-09T10:50:38+00:00
            Stats  : +48/-9 in 3 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/25874c879b02bdc9425bac8146478c006aeae4fb?branch=pr775-checkpolicy-revdeps

            Log:
            test if virtqemud can use sched_getaffinity syscall on VM

A recent virt* and selinux-policy testing revealed that rpc-virtqemud
process triggers SELinux denial as a reaction to the "virsh vcpuinfo"
command. The TC reproduces the situation.

In order to provide the detailed domain vcpu information successfully,
I believe that SELinux policy should allow this action. The TC looks
for appropriate policy rules.

The TC covers RHEL-69920.

---
diff --git a/selinux-policy/virt-install-additional/Makefile b/selinux-policy/virt-install-additional/Makefile
index 10abc7e..bc05e84 100644
--- a/selinux-policy/virt-install-additional/Makefile
+++ b/selinux-policy/virt-install-additional/Makefile
@@ -54,7 +54,7 @@ $(METADATA): Makefile
 	@echo "Type:            Regression" >> $(METADATA)
 	@echo "TestTime:        20m" >> $(METADATA)
 	@echo "RunFor:          selinux-policy" >> $(METADATA)
-	@echo "Requires:        audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted /usr/sbin/service setools-console virt-install numad nbdkit" >> $(METADATA)
+	@echo "Requires:        audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted /usr/sbin/service setools-console virt-install libvirt-client numad nbdkit" >> $(METADATA)
 	@echo "RhtsRequires:    library(selinux-policy/common)" >> $(METADATA)
 	@echo "Environment:     AVC_ERROR=+no_avc_check" >> $(METADATA)
 	@echo "Priority:        Normal" >> $(METADATA)
@@ -69,6 +69,7 @@ $(METADATA): Makefile
 	@echo "Bug:             RHEL-65383" >> $(METADATA) # RHEL-10
 	@echo "Bug:             RHEL-65789" >> $(METADATA) # RHEL-10
 	@echo "Bug:             RHEL-69118" >> $(METADATA) # RHEL-10
+	@echo "Bug:             RHEL-69920" >> $(METADATA) # RHEL-10
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/virt-install-additional/main.fmf b/selinux-policy/virt-install-additional/main.fmf
index 970a87d..07b77d2 100644
--- a/selinux-policy/virt-install-additional/main.fmf
+++ b/selinux-policy/virt-install-additional/main.fmf
@@ -19,6 +19,7 @@ recommend:
   - /usr/sbin/service
   - setools-console
   - virt-install
+  - libvirt-client
   - numad
   - nbdkit
 environment:
@@ -40,6 +41,7 @@ link:
   - verifies: https://issues.redhat.com/browse/RHEL-65383
   - verifies: https://issues.redhat.com/browse/RHEL-65789
   - verifies: https://issues.redhat.com/browse/RHEL-69118
+  - verifies: https://issues.redhat.com/browse/RHEL-69920
 adjust:
   - enabled: false
     when: distro == rhel-4, rhel-5, rhel-6, rhel-7
@@ -49,3 +51,5 @@ adjust:
     continue: false
 extra-summary: /CoreOS/selinux-policy/Regression/virt-install-additional
 extra-task: /CoreOS/selinux-policy/Regression/virt-install-additional
+extra-nitrate: TC#0617996
+id: a2688b1a-bb0f-4489-bfd0-ef573d832d8a

diff --git a/selinux-policy/virt-install-additional/runtest.sh b/selinux-policy/virt-install-additional/runtest.sh
index d6dbcdf..f903568 100755
--- a/selinux-policy/virt-install-additional/runtest.sh
+++ b/selinux-policy/virt-install-additional/runtest.sh
@@ -48,9 +48,11 @@ rlJournalStart
     rlPhaseEnd
 
     rlPhaseStartTest "RHEL-65038"
-        rlSESearchRule "allow virtqemud_t svirt_tcg_t : lnk_file { read } [ ]"
-        rlSESearchRule "allow virtqemud_t svirt_tcg_t : process { getrlimit } [ ]"
-        rlSESearchRule "allow virtqemud_t svirt_t : process { getrlimit } [ ]"
+        if seinfo -a | grep -q virt_driver_domain ; then
+            rlSESearchRule "allow virtqemud_t svirt_tcg_t : lnk_file { read } [ ]"
+            rlSESearchRule "allow virtqemud_t svirt_tcg_t : process { getrlimit } [ ]"
+            rlSESearchRule "allow virtqemud_t svirt_t : process { getrlimit } [ ]"
+        fi
         if rlIsRHEL 8 ; then
             rlRun "service libvirtd start"
         fi
@@ -74,7 +76,9 @@ rlJournalStart
     rlPhaseEnd
 
     rlPhaseStartTest "RHEL-65373"
-        rlSESearchRule "allow virtqemud_t virtqemud_t : tun_socket { relabelto relabelfrom } [ ]"
+        if seinfo -a | grep -q virt_driver_domain ; then
+            rlSESearchRule "allow virtqemud_t virtqemud_t : tun_socket { relabelto relabelfrom } [ ]"
+        fi
         if rlIsRHEL 8 ; then
             rlRun "service libvirtd start"
         fi
@@ -96,7 +100,9 @@ rlJournalStart
     rlPhaseEnd
 
     rlPhaseStartTest "RHEL-65383"
-        rlSESearchRule "allow virtqemud_t sysfs_t : file { write } [ ]"
+        if seinfo -a | grep -q virt_driver_domain ; then
+            rlSESearchRule "allow virtqemud_t sysfs_t : file { write } [ ]"
+        fi
         if rlIsRHEL 8 ; then
             rlRun "service libvirtd start"
         fi
@@ -118,9 +124,11 @@ rlJournalStart
     rlPhaseEnd
 
     rlPhaseStartTest "RHEL-65789"
-        rlSESearchRule "allow virtqemud_t numad_exec_t : file { getattr open read map execute } [ ]"
-        rlSESearchRule "allow virtqemud_t numad_t : process { transition } [ ]"
-        rlSESearchRule "type_transition virtqemud_t numad_exec_t : process numad_t"
+        if seinfo -a | grep -q virt_driver_domain ; then
+            rlSESearchRule "allow virtqemud_t numad_exec_t : file { getattr open read map execute } [ ]"
+            rlSESearchRule "allow virtqemud_t numad_t : process { transition } [ ]"
+            rlSESearchRule "type_transition virtqemud_t numad_exec_t : process numad_t"
+        fi
         if rlIsRHEL 8 ; then
             rlRun "service libvirtd start"
         fi
@@ -173,6 +181,32 @@ rlJournalStart
         rlFileRestore
     rlPhaseEnd
 
+    rlPhaseStartTest "RHEL-69920"
+        if seinfo -a | grep -q virt_driver_domain ; then
+            rlSESearchRule "allow virtqemud_t svirt_t : process { getsched } [ ]"
+            rlSESearchRule "allow virtqemud_t svirt_tcg_t : process { getsched } [ ]"
+        fi
+        if rlIsRHEL 8 ; then
+            rlRun "service libvirtd start"
+        fi
+        rlRun "service virtqemud start"
+        rlRun "service virtnetworkd start"
+        rlRun "service virtstoraged start"
+        rlRun "virt-install --memory 128 --pxe --virt-type qemu --os-variant alpinelinux3.8 --wait 0 --name test6"
+        sleep 30
+        rlRun "virsh vcpuinfo test6"
+        rlRun "virsh list"
+        rlRun "virsh list | grep 'test6.*running'"
+        rlRun "virsh destroy test6"
+        rlRun "virsh undefine test6"
+        rlRun "service virtstoraged stop"
+        rlRun "service virtnetworkd stop"
+        rlRun "service virtqemud stop"
+        if rlIsRHEL 8 ; then
+            rlRun "service libvirtd stop"
+        fi
+    rlPhaseEnd
+
     rlPhaseStartCleanup
         sleep 2
         rlSECheckAVC