[tests/selinux] pr775-checkpolicy-revdeps: test if systemd-ssh-generator can read /dev/vsock

[Milos Malik <mmalik@redhat.com>]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 5a5d3a227c573de823261841d901e777d11aa54d
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2025-01-29T07:50:40+00:00
            Stats  : +23/-3 in 3 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/5a5d3a227c573de823261841d901e777d11aa54d?branch=pr775-checkpolicy-revdeps

            Log:
            test if systemd-ssh-generator can read /dev/vsock

SELinux denials recently found on Beaker machines revealed that
SELinux prevents the systemd-ssh-generator processes from reading
the /dev/vsock device. The TC reproduces the situation.

In order to enable the ssh-generator which belongs to new systemd
builds, I believe that SELinux policy should allow the access. The
TC looks for appropriate policy rules and file context patterns.

The TC covers RHEL-72549.

---
diff --git a/selinux-policy/systemd-generators/Makefile b/selinux-policy/systemd-generators/Makefile
index dcaae62..041e2b8 100644
--- a/selinux-policy/systemd-generators/Makefile
+++ b/selinux-policy/systemd-generators/Makefile
@@ -54,21 +54,26 @@ $(METADATA): Makefile
 	@echo "Type:            Sanity" >> $(METADATA)
 	@echo "TestTime:        15m" >> $(METADATA)
 	@echo "RunFor:          selinux-policy" >> $(METADATA)
+	@echo "Requires:        audit" >> $(METADATA)
+	@echo "Requires:        libselinux-utils" >> $(METADATA)
 	@echo "Requires:        policycoreutils" >> $(METADATA)
 	@echo "Requires:        selinux-policy" >> $(METADATA)
 	@echo "Requires:        selinux-policy-targeted" >> $(METADATA)
 	@echo "Requires:        zram-generator" >> $(METADATA)
+	@echo "Requires:        setools-console" >> $(METADATA)
 	@echo "RhtsRequires:    library(selinux-policy/common)" >> $(METADATA)
 	@echo "Priority:        Normal" >> $(METADATA)
 	@echo "License:         GPLv2" >> $(METADATA)
 	@echo "Confidential:    no" >> $(METADATA)
 	@echo "Destructive:     no" >> $(METADATA)
-	#@echo "Environment:     AVC_ERROR=+no_avc_check" >> $(METADATA)
+	@echo "Environment:     AVC_ERROR=+no_avc_check" >> $(METADATA)
 	@echo "Environment:     SYSTEMD_PAGER=\"\"" >> $(METADATA)
 	@echo "Releases:        -RHEL4" >> $(METADATA)
 	@echo "Releases:        -RHEL5" >> $(METADATA)
 	@echo "Releases:        -RHEL6" >> $(METADATA)
-	@echo "Bug:             2230226" >> $(METADATA)
+	@echo "Releases:        -RHEL7" >> $(METADATA)
+	@echo "Bug:             2230226" >> $(METADATA) # Fedora 39
+	@echo "Bug:             RHEL-72549" >> $(METADATA) # RHEL-10
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/systemd-generators/main.fmf b/selinux-policy/systemd-generators/main.fmf
index 949427e..4e67f10 100644
--- a/selinux-policy/systemd-generators/main.fmf
+++ b/selinux-policy/systemd-generators/main.fmf
@@ -16,6 +16,8 @@ recommend:
   - policycoreutils
   - selinux-policy
   - selinux-policy-targeted
+  - setools-console
+  - zram-generator
 environment:
     AVC_ERROR: +no_avc_check
 duration: 15m
@@ -24,15 +26,17 @@ tag:
   - NoRHEL4
   - NoRHEL5
   - NoRHEL6
+  - NoRHEL7
   - TierCandidatesPASS
   - f32friendly
   - targeted
   - NoRHIVOS
 link:
   - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2230226
+  - verifies: https://issues.redhat.com/browse/RHEL-72549
 adjust:
   - enabled: false
-    when: distro == rhel-7
+    when: distro == rhel-4, rhel-5, rhel-6, rhel-7
     continue: false
 extra-nitrate: TC#0617500
 id: f92a6183-91e3-407a-9ac7-9b7df460109a

diff --git a/selinux-policy/systemd-generators/runtest.sh b/selinux-policy/systemd-generators/runtest.sh
index f6f6c25..f92caea 100755
--- a/selinux-policy/systemd-generators/runtest.sh
+++ b/selinux-policy/systemd-generators/runtest.sh
@@ -195,6 +195,17 @@ EOF
 	rlRun "systemctl stop sysv-generator-test.service"
     rlPhaseEnd
 
+    if rlIsCentOS 10 || rlIsRHEL 10 ; then
+    rlPhaseStartTest "RHEL-72549"
+        rlSEMatchPathCon "/usr/lib/systemd/system-generators/systemd-ssh-generator" "systemd_ssh_generator_exec_t"
+        rlSEMatchPathCon "/dev/vsock" "vsock_device_t"
+        rlSEMatchPathCon "/run/systemd/generator/sshd-vsock.socket" "systemd_unit_file_t"
+        rlSESearchRule "allow init_t systemd_ssh_generator_exec_t : file { getattr open read execute } [ ]"
+        rlSESearchRule "type_transition init_t systemd_ssh_generator_exec_t : process systemd_ssh_generator_t"
+        rlSESearchRule "allow systemd_ssh_generator_t vsock_device_t : chr_file { getattr ioctl open read } [ ]"
+        rlSESearchRule "allow systemd_ssh_generator_t systemd_unit_file_t : file { create getattr write open } [ ]"
+    rlPhaseEnd
+    fi
 
     ### generators from other packages: install them all?
     # dnf install "/usr/lib/systemd/system-generators/*"