[tests/selinux] pr775-checkpolicy-revdeps: test if boothd can connect to systemd-machined via socket

[Milos Malik <mmalik@redhat.com>]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : ed1316d819145d762db92df4c66aaf36d6b775bf
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2025-01-28T12:56:09+00:00
            Stats  : +12/-1 in 3 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/ed1316d819145d762db92df4c66aaf36d6b775bf?branch=pr775-checkpolicy-revdeps

            Log:
            test if boothd can connect to systemd-machined via socket

Recent selinux-policy + boothd + systemd-machined testing revealed
that SELinux prevents the boothd process from connecting to the
systemd-machined process via the /run/systemd/userdb/io.systemd.Machine
socket. The TC reproduces the situation.

In order to support the boothd and systemd-machined cooperation and
to avoid unnecessary SELinux denials, I believe that SELinux policy
should allow the access. The TC looks for appropriate policy rules
and file context patterns.

The TC covers RHEL-75471.

---
diff --git a/selinux-policy/boothd-and-similar/Makefile b/selinux-policy/boothd-and-similar/Makefile
index d78cc89..6e66c75 100644
--- a/selinux-policy/boothd-and-similar/Makefile
+++ b/selinux-policy/boothd-and-similar/Makefile
@@ -55,7 +55,7 @@ $(METADATA): Makefile
 	@echo "TestTime:        10m" >> $(METADATA)
 	@echo "RunFor:          selinux-policy" >> $(METADATA)
 	@echo "RunFor:          booth" >> $(METADATA)
-	@echo "Requires:        audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console booth-arbitrator booth-core /usr/sbin/service net-tools" >> $(METADATA)
+	@echo "Requires:        audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console booth-arbitrator booth-core /usr/sbin/service net-tools systemd-container" >> $(METADATA)
 	@echo "RhtsRequires:    library(selinux-policy/common)" >> $(METADATA)
 	@echo "Environment:     AVC_ERROR=+no_avc_check" >> $(METADATA)
 	@echo "Priority:        Normal" >> $(METADATA)
@@ -66,6 +66,7 @@ $(METADATA): Makefile
 	@echo "Bug:             RHEL-45907" >> $(METADATA) # RHEL-10
 	@echo "Bug:             RHEL-57104" >> $(METADATA) # RHEL-9
 	@echo "Bug:             RHEL-58060" >> $(METADATA) # RHEL-10
+	@echo "Bug:             RHEL-75471" >> $(METADATA) # RHEL-10
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/boothd-and-similar/main.fmf b/selinux-policy/boothd-and-similar/main.fmf
index 0881602..5539ab8 100644
--- a/selinux-policy/boothd-and-similar/main.fmf
+++ b/selinux-policy/boothd-and-similar/main.fmf
@@ -19,6 +19,7 @@ recommend:
   - booth-core
   - /usr/sbin/service
   - net-tools
+  - systemd-container
 environment:
     AVC_ERROR: +no_avc_check
 duration: 10m
@@ -34,6 +35,7 @@ link:
   - verifies: https://issues.redhat.com/browse/RHEL-45907
   - verifies: https://issues.redhat.com/browse/RHEL-57104
   - verifies: https://issues.redhat.com/browse/RHEL-58060
+  - verifies: https://issues.redhat.com/browse/RHEL-75471
 adjust:
   - enabled: false
     when: distro == rhel-4, rhel-5, rhel-6, rhel-7

diff --git a/selinux-policy/boothd-and-similar/runtest.sh b/selinux-policy/boothd-and-similar/runtest.sh
index 27231d6..6c355b3 100755
--- a/selinux-policy/boothd-and-similar/runtest.sh
+++ b/selinux-policy/boothd-and-similar/runtest.sh
@@ -52,6 +52,7 @@ rlJournalStart
 
         rlServiceStop ${SERVICE_NAME}
         rlFileBackup /etc/booth/booth.conf
+        rlRun "service systemd-machined start"
 
         rlSESetEnforce
         rlSEStatus
@@ -71,6 +72,10 @@ rlJournalStart
     rlPhaseStartTest "RHEL-57104 + RHEL-58060"
         rlSESearchRule "allow boothd_t kernel_t : unix_stream_socket { connectto } [ ]"
     rlPhaseEnd
+
+    rlPhaseStartTest "RHEL-75471"
+        rlSESearchRule "allow boothd_t systemd_machined_t : unix_stream_socket { connectto } [ ]"
+    rlPhaseEnd
     fi
 
     if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then
@@ -81,6 +86,9 @@ rlJournalStart
         rlRun "sed -i 's/^arbitrator=.*$/arbitrator=\"${IP_ADDRESS}\"/' /etc/booth/booth.conf"
         rlRun "grep ^arbitrator /etc/booth/booth.conf"
         rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "start status" 1
+        rlRun "booth list"
+        rlRun "booth status"
+        rlRun "booth peers"
         rlRun "restorecon -Rv /etc /var /run -e /var/ARTIFACTS" 0-255
         rlSEService - ${SERVICE_NAME} - ${PROCESS_CONTEXT} "restart status stop status" 1
     rlPhaseEnd