[tests/selinux] pr775-checkpolicy-revdeps: test if GDM can talk to iio-sensor-proxy via D-bus

[tests/selinux] pr775-checkpolicy-revdeps: test if GDM can talk to iio-sensor-proxy via D-bus

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 02fe4ae17a3e98693f322117ba033320693bb108
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2024-12-11T08:35:52+01:00
            Stats  : +14/-1 in 4 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/02fe4ae17a3e98693f322117ba033320693bb108?branch=pr775-checkpolicy-revdeps

            Log:
            test if GDM can talk to iio-sensor-proxy via D-bus

Recent gdm + iio-sensor-proxy + selinux-policy testing revealed that
SELinux prevents the D-bus communication between the gdm service
and the iio-sensor-proxy service. The TC reproduces the situation.

In order to support their intentional collaboration (for example:
net.hadess.SensorProxy.ClaimAccelerometer), I believe that SELinux
policy should allow the D-bus communication in both directions. The
TC looks for appropriate policy rules.

The TC covers RHEL-70850.

---
diff --git a/selinux-policy/iio-sensor-proxy-and-similar/Makefile b/selinux-policy/iio-sensor-proxy-and-similar/Makefile
index 8d57ba2..1de229f 100644
--- a/selinux-policy/iio-sensor-proxy-and-similar/Makefile
+++ b/selinux-policy/iio-sensor-proxy-and-similar/Makefile
@@ -55,7 +55,7 @@ $(METADATA): Makefile
 	@echo "TestTime:        10m" >> $(METADATA)
 	@echo "RunFor:          iio-sensor-proxy" >> $(METADATA)
 	@echo "RunFor:          selinux-policy" >> $(METADATA)
-	@echo "Requires:        audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console iio-sensor-proxy /usr/sbin/service" >> $(METADATA)
+	@echo "Requires:        audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console iio-sensor-proxy /usr/sbin/service gdm" >> $(METADATA)
 	@echo "RhtsRequires:    library(selinux-policy/common)" >> $(METADATA)
 	@echo "Environment:     AVC_ERROR=+no_avc_check" >> $(METADATA)
 	@echo "Priority:        Normal" >> $(METADATA)
@@ -64,6 +64,8 @@ $(METADATA): Makefile
 	@echo "Destructive:     no" >> $(METADATA)
 	@echo "Releases:        -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA)
 	@echo "Bug:             RHEL-17346" >> $(METADATA) # RHEL-9
+	@echo "Bug:             RHEL-62355" >> $(METADATA) # RHEL-10
+	@echo "Bug:             RHEL-70850" >> $(METADATA) # RHEL-10
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/iio-sensor-proxy-and-similar/PURPOSE b/selinux-policy/iio-sensor-proxy-and-similar/PURPOSE
index 2577aa3..b41c372 100644
--- a/selinux-policy/iio-sensor-proxy-and-similar/PURPOSE
+++ b/selinux-policy/iio-sensor-proxy-and-similar/PURPOSE
@@ -3,3 +3,4 @@ Author: Milos Malik <mmalik@redhat.com>
 
 SELinux interferes with the iio-sensor-proxy service and related programs.
 
+Known interactions: iio-sensor-proxy + gdm.

diff --git a/selinux-policy/iio-sensor-proxy-and-similar/main.fmf b/selinux-policy/iio-sensor-proxy-and-similar/main.fmf
index b414ed3..7a59d93 100644
--- a/selinux-policy/iio-sensor-proxy-and-similar/main.fmf
+++ b/selinux-policy/iio-sensor-proxy-and-similar/main.fmf
@@ -18,6 +18,7 @@ recommend:
   - setools-console
   - iio-sensor-proxy
   - /usr/sbin/service
+  - gdm
 environment:
     AVC_ERROR: +no_avc_check
 duration: 10m
@@ -32,6 +33,8 @@ tag:
   - NoRHIVOS
 link:
   - verifies: https://issues.redhat.com/browse/RHEL-17346
+  - verifies: https://issues.redhat.com/browse/RHEL-62355
+  - verifies: https://issues.redhat.com/browse/RHEL-70850
 adjust:
   - enabled: false
     when: distro == rhel-4, rhel-5, rhel-6, rhel-7

diff --git a/selinux-policy/iio-sensor-proxy-and-similar/runtest.sh b/selinux-policy/iio-sensor-proxy-and-similar/runtest.sh
index 5e26ab7..bf177c6 100755
--- a/selinux-policy/iio-sensor-proxy-and-similar/runtest.sh
+++ b/selinux-policy/iio-sensor-proxy-and-similar/runtest.sh
@@ -57,6 +57,7 @@ rlJournalStart
 
         rlServiceStop ${SERVICE_NAME}
         rlFileBackup /usr/lib/systemd/system/iio-sensor-proxy.service
+        rlServiceStart gdm
 
         rlSESetEnforce
         rlSEStatus
@@ -64,6 +65,11 @@ rlJournalStart
         sleep 2
     rlPhaseEnd
 
+    rlPhaseStartTest "RHEL-70850"
+        rlSESearchRule "allow xdm_t iiosensorproxy_t : dbus { send_msg } [ ]"
+        rlSESearchRule "allow iiosensorproxy_t xdm_t : dbus { send_msg } [ ]"
+    rlPhaseEnd
+
     rlPhaseStartTest "real scenario -- standalone service"
         rlRun "sed -i 's/^.*Environment=.*$/Environment=FAKE_COMPASS=1/' /usr/lib/systemd/system/iio-sensor-proxy.service"
         rlRun "systemctl daemon-reload"
@@ -84,6 +90,7 @@ rlJournalStart
         rlFileRestore
         rlRun "systemctl daemon-reload"
         rlServiceRestore ${SERVICE_NAME}
+        rlServiceRestore gdm
     rlPhaseEnd
 rlJournalPrintText
 rlJournalEnd