public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
From: Milos Malik <mmalik@redhat.com>
To: git-commits@fedoraproject.org
Subject: [tests/selinux] pr775-checkpolicy-revdeps: test if virtqemud can access CD/DVD device on host
Date: Fri, 11 Sep 2026 13:22:22 GMT [thread overview]
Message-ID: <178913294265.1.7592404275696563629.tests-selinux-5bcfcf4b08ad@fedoraproject.org> (raw)
A new commit has been pushed.
Repo : tests/selinux
Branch : pr775-checkpolicy-revdeps
Commit : 5bcfcf4b08adb049c9734778e93b3c838ccabd5e
Author : Milos Malik <mmalik@redhat.com>
Date : 2025-02-11T15:25:07+00:00
Stats : +62/-22 in 3 file(s)
URL : https://src.fedoraproject.org/tests/selinux/c/5bcfcf4b08adb049c9734778e93b3c838ccabd5e?branch=pr775-checkpolicy-revdeps
Log:
test if virtqemud can access CD/DVD device on host
Recent virtualization + CD/DVD + selinux-policy testing revealed
that SELinux prevents the rpc-virtqemud processes from accessing
SCSI devices on the host. The TC reproduces the situation.
In order to enable this use case, I believe that SELinux policy
should allow the access. The TC looks for appropriate policy rules
and file context patterns.
The TC covers RHEL-76104.
---
diff --git a/selinux-policy/virt-install-additional/Makefile b/selinux-policy/virt-install-additional/Makefile
index 6f8f1a6..c2e6bb8 100644
--- a/selinux-policy/virt-install-additional/Makefile
+++ b/selinux-policy/virt-install-additional/Makefile
@@ -52,9 +52,9 @@ $(METADATA): Makefile
@echo "Path: $(TEST_DIR)" >> $(METADATA)
@echo "Description: SELinux interferes with virt-install and related programs" >> $(METADATA)
@echo "Type: Regression" >> $(METADATA)
- @echo "TestTime: 20m" >> $(METADATA)
+ @echo "TestTime: 30m" >> $(METADATA)
@echo "RunFor: selinux-policy" >> $(METADATA)
- @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted /usr/sbin/service setools-console virt-install libvirt-client numad nbdkit usbutils" >> $(METADATA)
+ @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted /usr/sbin/service setools-console virt-install libvirt-client numad nbdkit usbutils lsscsi" >> $(METADATA)
@echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA)
@echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA)
@echo "Priority: Normal" >> $(METADATA)
@@ -71,6 +71,7 @@ $(METADATA): Makefile
@echo "Bug: RHEL-69118" >> $(METADATA) # RHEL-10
@echo "Bug: RHEL-69920" >> $(METADATA) # RHEL-10
@echo "Bug: RHEL-74230" >> $(METADATA) # RHEL-10
+ @echo "Bug: RHEL-76104" >> $(METADATA) # RHEL-10
rhts-lint $(METADATA)
diff --git a/selinux-policy/virt-install-additional/main.fmf b/selinux-policy/virt-install-additional/main.fmf
index faabe1f..3480092 100644
--- a/selinux-policy/virt-install-additional/main.fmf
+++ b/selinux-policy/virt-install-additional/main.fmf
@@ -23,9 +23,10 @@ recommend:
- numad
- nbdkit
- usbutils
+ - lsscsi
environment:
AVC_ERROR: +no_avc_check
-duration: 20m
+duration: 30m
enabled: true
tag:
- kernel-rt
@@ -44,13 +45,14 @@ link:
- verifies: https://issues.redhat.com/browse/RHEL-69118
- verifies: https://issues.redhat.com/browse/RHEL-69920
- verifies: https://issues.redhat.com/browse/RHEL-74230
+ - verifies: https://issues.redhat.com/browse/RHEL-76104
adjust:
- enabled: false
when: distro == rhel-4, rhel-5, rhel-6, rhel-7
- continue: false
+ because: the test is not relevant for these RHELs
- enabled: false
when: distro == ppc64le
- continue: false
+ because: the virt-install package is not available there
extra-summary: /CoreOS/selinux-policy/Regression/virt-install-additional
extra-task: /CoreOS/selinux-policy/Regression/virt-install-additional
extra-nitrate: TC#0617996
diff --git a/selinux-policy/virt-install-additional/runtest.sh b/selinux-policy/virt-install-additional/runtest.sh
index 775ee38..8773acf 100755
--- a/selinux-policy/virt-install-additional/runtest.sh
+++ b/selinux-policy/virt-install-additional/runtest.sh
@@ -59,14 +59,14 @@ rlJournalStart
rlRun "service virtqemud start"
rlRun "service virtnetworkd start"
rlRun "service virtstoraged start"
- rlRun "virt-install --memory 128 --pxe --virt-type qemu --os-variant alpinelinux3.8 --disk none --wait 0 --name test1 --cpu mode=maximum,check=none,migratable=on,numa.cell.id=0,numa.cell.cpus=0,numa.cell.memory=512000,numa.cell.unit="KiB" --memory maxMemory.slots=16,maxMemory=4096"
+ rlRun "virt-install --memory 128 --pxe --virt-type qemu --os-variant alpinelinux3.8 --disk none --wait 0 --name test1 --cpu mode=maximum,check=none,migratable=on,numa.cell.id=0,numa.cell.cpus=0,numa.cell.memory=512000,numa.cell.unit="KiB" --memory maxMemory.slots=16,maxMemory=4096" 0,1
sleep 30
rlRun "virsh list"
rlRun "virsh list | grep 'test1.*running'"
- rlRun "virsh attach-device test1 dimm.xml"
- sleep 30
+ rlWatchdog "virsh attach-device test1 dimm.xml" 30
+ sleep 10
rlRun "virsh destroy test1"
- rlRun "virsh undefine test1"
+ rlRun "virsh undefine test1" 0,1
rlRun "service virtstoraged stop"
rlRun "service virtnetworkd stop"
rlRun "service virtqemud stop"
@@ -85,12 +85,12 @@ rlJournalStart
rlRun "service virtqemud start"
rlRun "service virtnetworkd start"
rlRun "service virtstoraged start"
- rlRun "virt-install --memory 128 --pxe --virt-type qemu --os-variant alpinelinux3.8 --wait 0 --name test2 --network type=network,mac.address='52:54:00:ee:01:68',source=default,model.type=virtio,driver.queues=4"
+ rlRun "virt-install --memory 128 --pxe --virt-type qemu --os-variant alpinelinux3.8 --wait 0 --name test2 --network type=network,mac.address='52:54:00:ee:01:68',source=default,model.type=virtio,driver.queues=4" 0,1
sleep 30
rlRun "virsh list"
rlRun "virsh list | grep 'test2.*running'"
rlRun "virsh destroy test2"
- rlRun "virsh undefine test2"
+ rlRun "virsh undefine test2" 0,1
rlRun "service virtstoraged stop"
rlRun "service virtnetworkd stop"
rlRun "service virtqemud stop"
@@ -109,12 +109,12 @@ rlJournalStart
rlRun "service virtqemud start"
rlRun "service virtnetworkd start"
rlRun "service virtstoraged start"
- rlRun "virt-install --memory 128 --pxe --virt-type qemu --os-variant alpinelinux3.8 --wait 0 --name test3 --network type=network,mac.address='52:54:00:23:f2:12',source=default,model.type=virtio --xml xpath.set=./devices/interface/port/@isolated=yes"
+ rlRun "virt-install --memory 128 --pxe --virt-type qemu --os-variant alpinelinux3.8 --wait 0 --name test3 --network type=network,mac.address='52:54:00:23:f2:12',source=default,model.type=virtio --xml xpath.set=./devices/interface/port/@isolated=yes" 0,1
sleep 30
rlRun "virsh list"
rlRun "virsh list | grep 'test3.*running'"
rlRun "virsh destroy test3"
- rlRun "virsh undefine test3"
+ rlRun "virsh undefine test3" 0,1
rlRun "service virtstoraged stop"
rlRun "service virtnetworkd stop"
rlRun "service virtqemud stop"
@@ -135,12 +135,12 @@ rlJournalStart
rlRun "service virtqemud start"
rlRun "service virtnetworkd start"
rlRun "service virtstoraged start"
- rlRun "virt-install --memory 128 --pxe --virt-type qemu --os-variant alpinelinux3.8 --wait 0 --name test4 --numatune memory.mode='strict',memory.placement='auto'"
+ rlRun "virt-install --memory 128 --pxe --virt-type qemu --os-variant alpinelinux3.8 --wait 0 --name test4 --numatune memory.mode='strict',memory.placement='auto'" 0,1
sleep 30
rlRun "virsh list"
rlRun "virsh list | grep 'test4.*running'"
rlRun "virsh destroy test4"
- rlRun "virsh undefine test4"
+ rlRun "virsh undefine test4" 0,1
rlRun "service virtstoraged stop"
rlRun "service virtnetworkd stop"
rlRun "service virtqemud stop"
@@ -166,12 +166,12 @@ rlJournalStart
rlRun "service virtqemud start"
rlRun "service virtnetworkd start"
rlRun "service virtstoraged start"
- rlRun "virt-install --memory 128 --pxe --virt-type qemu --os-variant alpinelinux3.8 --disk source.protocol=ssh,source.name=/var/lib/libvirt/images/test.img,source.host0.name=localhost,source.host0.port=22 --wait 0 --name test5"
+ rlRun "virt-install --memory 128 --pxe --virt-type qemu --os-variant alpinelinux3.8 --disk source.protocol=ssh,source.name=/var/lib/libvirt/images/test.img,source.host0.name=localhost,source.host0.port=22 --wait 0 --name test5" 0,1
sleep 30
rlRun "virsh list"
rlRun "virsh list | grep 'test5.*running'"
rlRun "virsh destroy test5"
- rlRun "virsh undefine test5"
+ rlRun "virsh undefine test5" 0,1
rlRun "service virtstoraged stop"
rlRun "service virtnetworkd stop"
rlRun "service virtqemud stop"
@@ -192,13 +192,13 @@ rlJournalStart
rlRun "service virtqemud start"
rlRun "service virtnetworkd start"
rlRun "service virtstoraged start"
- rlRun "virt-install --memory 128 --pxe --virt-type qemu --os-variant alpinelinux3.8 --wait 0 --name test6"
+ rlRun "virt-install --memory 128 --pxe --virt-type qemu --os-variant alpinelinux3.8 --wait 0 --name test6" 0,1
sleep 30
rlRun "virsh vcpuinfo test6"
rlRun "virsh list"
rlRun "virsh list | grep 'test6.*running'"
rlRun "virsh destroy test6"
- rlRun "virsh undefine test6"
+ rlRun "virsh undefine test6" 0,1
rlRun "service virtstoraged stop"
rlRun "service virtnetworkd stop"
rlRun "service virtqemud stop"
@@ -210,7 +210,8 @@ rlJournalStart
rlPhaseStartTest "RHEL-74230"
rlSEMatchPathCon "/dev/bus/usb/001/001" "usb_device_t"
if seinfo -a | grep -q virt_driver_domain ; then
- rlSESearchRule "allow virtqemud_t usb_device_t : chr_file { getattr open read write lock setattr } [ ]"
+ rlSESearchRule "allow virtqemud_t usb_device_t : chr_file { getattr } [ ]"
+ rlSESearchRule "allow virtqemud_t usb_device_t : chr_file { open read write lock setattr } [ virt_use_usb ]"
fi
if rlIsRHEL 8 ; then
rlRun "service libvirtd start"
@@ -223,13 +224,48 @@ rlJournalStart
# USB devices may not be available
rlRun "virsh nodedev-list | grep usb" 0,1
for USB_ID in `virsh nodedev-list | grep usb` ; do
- rlRun "virt-install --memory 128 --pxe --virt-type qemu --os-variant alpinelinux3.8 --wait 0 --name test-${USB_ID} --host-device ${USB_ID}"
+ rlRun "virt-install --memory 128 --pxe --virt-type qemu --os-variant alpinelinux3.8 --wait 0 --name test-${USB_ID} --host-device ${USB_ID}" 0,1
+ done
+ sleep 10
+ rlRun "virsh list"
+ for VM_NAME in `virsh list --name` ; do
+ rlRun "virsh destroy ${VM_NAME}"
+ rlRun "virsh undefine ${VM_NAME}" 0,1
+ done
+ rlRun "service virtnodedevd stop"
+ rlRun "service virtstoraged stop"
+ rlRun "service virtnetworkd stop"
+ rlRun "service virtqemud stop"
+ if rlIsRHEL 8 ; then
+ rlRun "service libvirtd stop"
+ fi
+ rlPhaseEnd
+
+ rlPhaseStartTest "RHEL-76104"
+ rlSEMatchPathCon "/dev/sg0" "scsi_generic_device_t"
+ if seinfo -a | grep -q virt_driver_domain ; then
+ rlSESearchRule "allow virtqemud_t scsi_generic_device_t : chr_file { getattr open read write lock setattr } [ ]"
+ fi
+ rlRun "modprobe scsi_debug ptype=5"
+ sleep 2
+ rlRun "lsscsi -gs"
+ if rlIsRHEL 8 ; then
+ rlRun "service libvirtd start"
+ fi
+ rlRun "service virtqemud start"
+ rlRun "service virtnetworkd start"
+ rlRun "service virtstoraged start"
+ rlRun "service virtnodedevd start"
+ # SCSI devices may not be available
+ rlRun "virsh nodedev-list | grep scsi" 0,1
+ for SCSI_ID in `virsh nodedev-list | grep scsi` ; do
+ rlRun "virt-install --memory 128 --pxe --virt-type qemu --os-variant alpinelinux3.8 --wait 0 --name test-${SCSI_ID} --host-device ${SCSI_ID}" 0,1
done
sleep 10
rlRun "virsh list"
for VM_NAME in `virsh list --name` ; do
rlRun "virsh destroy ${VM_NAME}"
- rlRun "virsh undefine ${VM_NAME}"
+ rlRun "virsh undefine ${VM_NAME}" 0,1
done
rlRun "service virtnodedevd stop"
rlRun "service virtstoraged stop"
@@ -238,6 +274,7 @@ rlJournalStart
if rlIsRHEL 8 ; then
rlRun "service libvirtd stop"
fi
+ rlRun "modprobe -r scsi_debug"
rlPhaseEnd
rlPhaseStartCleanup
reply other threads:[~2026-09-11 13:22 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=178913294265.1.7592404275696563629.tests-selinux-5bcfcf4b08ad@fedoraproject.org \
--to=mmalik@redhat.com \
--cc=git-commits@fedoraproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox