[tests/selinux] pr775-checkpolicy-revdeps: test if sysadm_u or staff_u can talk to libvirt-dbus

[tests/selinux] pr775-checkpolicy-revdeps: test if sysadm_u or staff_u can talk to libvirt-dbus

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 559446d5439a01585647c57fe0d994dd1c8422f7
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2025-01-22T07:38:38+00:00
            Stats  : +48/-1 in 4 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/559446d5439a01585647c57fe0d994dd1c8422f7?branch=pr775-checkpolicy-revdeps

            Log:
            test if sysadm_u or staff_u can talk to libvirt-dbus

A recent cockpit-machines testing in SELinux enabled environments
revealed that SELinux prevents certain confined users from
communicating to the libvirt-dbus service. The TC reproduces the
situation for users derived from sysadm_u and staff_u.

In order to support the scenario, I believe that SELinux policy
should allow the D-bus communication in both directions. The TC
looks for appropriate policy rules and file context patterns.

The TC covers RHEL-73914.

---
diff --git a/selinux-policy/libvirt-dbus-and-similar/Makefile b/selinux-policy/libvirt-dbus-and-similar/Makefile
index 6ad5719..127fc47 100644
--- a/selinux-policy/libvirt-dbus-and-similar/Makefile
+++ b/selinux-policy/libvirt-dbus-and-similar/Makefile
@@ -29,7 +29,7 @@ export TESTVERSION=1.0
 
 BUILT_FILES=
 
-FILES=$(METADATA) runtest.sh Makefile PURPOSE
+FILES=$(METADATA) runtest.sh Makefile PURPOSE ssh.exp
 
 .PHONY: all install download clean
 
@@ -64,6 +64,7 @@ $(METADATA): Makefile
 	@echo "Environment:     AVC_ERROR=+no_avc_check" >> $(METADATA)
 	@echo "Releases:        -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA)
 	@echo "Bug:             RHEL-46893" >> $(METADATA) # RHEL-10
+	@echo "Bug:             RHEL-73914" >> $(METADATA) # RHEL-10
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/libvirt-dbus-and-similar/main.fmf b/selinux-policy/libvirt-dbus-and-similar/main.fmf
index a03ec19..9115a73 100644
--- a/selinux-policy/libvirt-dbus-and-similar/main.fmf
+++ b/selinux-policy/libvirt-dbus-and-similar/main.fmf
@@ -30,6 +30,7 @@ tag:
   - NoRHIVOS
 link:
   - verifies: https://issues.redhat.com/browse/RHEL-46893
+  - verifies: https://issues.redhat.com/browse/RHEL-73914
 adjust:
   - enabled: false
     when: distro == rhel-4, rhel-5, rhel-6, rhel-7

diff --git a/selinux-policy/libvirt-dbus-and-similar/runtest.sh b/selinux-policy/libvirt-dbus-and-similar/runtest.sh
index bf886b1..03aff21 100755
--- a/selinux-policy/libvirt-dbus-and-similar/runtest.sh
+++ b/selinux-policy/libvirt-dbus-and-similar/runtest.sh
@@ -67,13 +67,38 @@ rlJournalStart
         rlSESearchRule "allow virtqemud_t virt_dbus_t : dir { search } [ ]"
         rlSESearchRule "allow virtqemud_t virt_dbus_t : file { getattr open read } [ ]"
     rlPhaseEnd
+
+    rlPhaseStartTest "RHEL-73914"
+        rlSESearchRule "allow staff_t virt_dbus_t : dbus { send_msg } [ ]"
+        rlSESearchRule "allow virt_dbus_t staff_t : dbus { send_msg } [ ]"
+        rlSESearchRule "allow sysadm_t virt_dbus_t : dbus { send_msg } [ ]"
+        rlSESearchRule "allow virt_dbus_t sysadm_t : dbus { send_msg } [ ]"
+    rlPhaseEnd
     fi
 
+    rlPhaseStartTest "real scenario -- confined users"
+        rlRun "service virtqemud start"
+        rlSEConfigureSSH
+        rlRun "setsebool ssh_sysadm_login on"
+        for SELINUX_USER in staff_u sysadm_u ; do
+            USER_NAME="user${RANDOM}"
+            USER_SECRET="S3kr3t${RANDOM}"
+            rlRun "useradd -Z ${SELINUX_USER} -G libvirt ${USER_NAME}"
+            rlRun "echo ${USER_SECRET} | passwd --stdin ${USER_NAME}"
+            rlRun "./ssh.exp ${USER_NAME} ${USER_SECRET} localhost busctl call org.libvirt /org/libvirt/QEMU org.libvirt.Connect ListDomains u 0"
+            rlRun "userdel -rfZ ${USER_NAME}"
+        done
+        rlRun "setsebool ssh_sysadm_login off"
+        rlRun "service virtqemud stop"
+    rlPhaseEnd
+
+    if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then
     rlPhaseStartTest "real scenario -- standalone service"
         rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1
         rlRun "restorecon -Rv /var /run -e /var/ARTIFACTS" 0-255
         rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1
     rlPhaseEnd
+    fi
 
     rlPhaseStartTest "real scenario -- communication with other virt* services"
         for VIRT_SERVICE in virtinterfaced virtlxcd virtnetworkd virtnodedevd virtnwfilterd virtproxyd virtqemud virtsecretd virtstoraged virtvboxd ; do

diff --git a/selinux-policy/libvirt-dbus-and-similar/ssh.exp b/selinux-policy/libvirt-dbus-and-similar/ssh.exp
new file mode 100755
index 0000000..58c9647
--- /dev/null
+++ b/selinux-policy/libvirt-dbus-and-similar/ssh.exp
@@ -0,0 +1,20 @@
+#!/usr/bin/expect -f
+# Expect script for SSH logging as $username to $hostname using $password and executing $command.
+# Usage:
+#   ./ssh.exp username password hostname command
+set username [lrange $argv 0 0]
+set password [lrange $argv 1 1]
+set hostname [lrange $argv 2 2]
+set command  [lrange $argv 3 10]
+set timeout 15
+# connect to remote host and execute given command
+log_user 1
+spawn ssh -t $username@$hostname $command
+expect {
+  -nocase "yes/no" { send -- "yes\r" ; exp_continue }
+  -nocase "password" { send -- "$password\r" }
+}
+log_user 1
+# send -- "\r"
+expect eof
+