[tests/selinux] pr775-checkpolicy-revdeps: test if virtqemud can access USB devices attached to VMs

[tests/selinux] pr775-checkpolicy-revdeps: test if virtqemud can access USB devices attached to VMs

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 6292a9158b259e75e64a04fbc9374fcc70af78f8
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2025-01-28T12:45:22+00:00
            Stats  : +37/-1 in 3 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/6292a9158b259e75e64a04fbc9374fcc70af78f8?branch=pr775-checkpolicy-revdeps

            Log:
            test if virtqemud can access USB devices attached to VMs

Recent virtualization + SELinux policy testing revealed that SELinux
prevents the virtqemud process from accessing the USB devices which
are attached to VMs. The TC reproduces the situation.

In order to support this use case and to avoid unnecessary SELinux
denials, I believe that SELinux policy should allow the access. The
TC looks for appropriate policy rules and file context patterns.

The TC covers RHEL-74230.

---
diff --git a/selinux-policy/virt-install-additional/Makefile b/selinux-policy/virt-install-additional/Makefile
index bc05e84..6f8f1a6 100644
--- a/selinux-policy/virt-install-additional/Makefile
+++ b/selinux-policy/virt-install-additional/Makefile
@@ -54,7 +54,7 @@ $(METADATA): Makefile
 	@echo "Type:            Regression" >> $(METADATA)
 	@echo "TestTime:        20m" >> $(METADATA)
 	@echo "RunFor:          selinux-policy" >> $(METADATA)
-	@echo "Requires:        audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted /usr/sbin/service setools-console virt-install libvirt-client numad nbdkit" >> $(METADATA)
+	@echo "Requires:        audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted /usr/sbin/service setools-console virt-install libvirt-client numad nbdkit usbutils" >> $(METADATA)
 	@echo "RhtsRequires:    library(selinux-policy/common)" >> $(METADATA)
 	@echo "Environment:     AVC_ERROR=+no_avc_check" >> $(METADATA)
 	@echo "Priority:        Normal" >> $(METADATA)
@@ -70,6 +70,7 @@ $(METADATA): Makefile
 	@echo "Bug:             RHEL-65789" >> $(METADATA) # RHEL-10
 	@echo "Bug:             RHEL-69118" >> $(METADATA) # RHEL-10
 	@echo "Bug:             RHEL-69920" >> $(METADATA) # RHEL-10
+	@echo "Bug:             RHEL-74230" >> $(METADATA) # RHEL-10
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/virt-install-additional/main.fmf b/selinux-policy/virt-install-additional/main.fmf
index 07b77d2..faabe1f 100644
--- a/selinux-policy/virt-install-additional/main.fmf
+++ b/selinux-policy/virt-install-additional/main.fmf
@@ -22,6 +22,7 @@ recommend:
   - libvirt-client
   - numad
   - nbdkit
+  - usbutils
 environment:
     AVC_ERROR: +no_avc_check
 duration: 20m
@@ -42,6 +43,7 @@ link:
   - verifies: https://issues.redhat.com/browse/RHEL-65789
   - verifies: https://issues.redhat.com/browse/RHEL-69118
   - verifies: https://issues.redhat.com/browse/RHEL-69920
+  - verifies: https://issues.redhat.com/browse/RHEL-74230
 adjust:
   - enabled: false
     when: distro == rhel-4, rhel-5, rhel-6, rhel-7

diff --git a/selinux-policy/virt-install-additional/runtest.sh b/selinux-policy/virt-install-additional/runtest.sh
index f903568..3e087ce 100755
--- a/selinux-policy/virt-install-additional/runtest.sh
+++ b/selinux-policy/virt-install-additional/runtest.sh
@@ -207,6 +207,39 @@ rlJournalStart
         fi
     rlPhaseEnd
 
+    rlPhaseStartTest "RHEL-74230"
+        rlSEMatchPathCon "/dev/bus/usb/001/001" "usb_device_t"
+        if seinfo -a | grep -q virt_driver_domain ; then
+            rlSESearchRule "allow virtqemud_t usb_device_t : chr_file { getattr open read write lock setattr } [ ]"
+        fi
+        if rlIsRHEL 8 ; then
+            rlRun "service libvirtd start"
+        fi
+        rlRun "service virtqemud start"
+        rlRun "service virtnetworkd start"
+        rlRun "service virtstoraged start"
+        rlRun "service virtnodedevd start"
+        rlRun "lsusb -t"
+        # USB devices may not be available
+        rlRun "virsh nodedev-list | grep usb" 0,1
+        for USB_ID in `virsh nodedev-list | grep usb` ; do
+            rlRun "virt-install --memory 128 --pxe --virt-type qemu --os-variant alpinelinux3.8 --wait 0 --name test-${USB_ID} --host-device ${USB_ID}"
+        done
+        sleep 10
+        rlRun "virsh list"
+        for VM_NAME in `virsh list --name` ; do
+            rlRun "virsh destroy ${VM_NAME}"
+            rlRun "virsh undefine ${VM_NAME}"
+        done
+        rlRun "service virtnodedevd stop"
+        rlRun "service virtstoraged stop"
+        rlRun "service virtnetworkd stop"
+        rlRun "service virtqemud stop"
+        if rlIsRHEL 8 ; then
+            rlRun "service libvirtd stop"
+        fi
+    rlPhaseEnd
+
     rlPhaseStartCleanup
         sleep 2
         rlSECheckAVC