[tests/selinux] pr775-checkpolicy-revdeps: test if virt-admin can connect to virt* daemons via admin sockets

[tests/selinux] pr775-checkpolicy-revdeps: test if virt-admin can connect to virt* daemons via admin sockets

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 783121a5a4106c698d6178413c94c3f6d33026c4
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2025-02-12T13:05:05+00:00
            Stats  : +43/-0 in 3 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/783121a5a4106c698d6178413c94c3f6d33026c4?branch=pr775-checkpolicy-revdeps

            Log:
            test if virt-admin can connect to virt* daemons via admin sockets

Recent virtualization CI test runs discovered SELinux denials when
the virt-admin tool tries to connect to the virtqemud process. The
TC reproduces the situation via systemd-run.

In order to support the following scenario, I believe that SELinux
policy should allow the necessary operations:

 * the virt-admin program is running as unconfined_service_t because
it was executed by a process running as unconfined_service_t and the
virt-admin process wants to talk to the virtqemud process

The TC looks for appropriate policy rules and file context patterns.

The TC covers RHEL-77620.

---
diff --git a/selinux-policy/virtualization-daemons/Makefile b/selinux-policy/virtualization-daemons/Makefile
index 5aaf556..3ae25e6 100644
--- a/selinux-policy/virtualization-daemons/Makefile
+++ b/selinux-policy/virtualization-daemons/Makefile
@@ -65,6 +65,7 @@ $(METADATA): Makefile
 	@echo "Releases:        -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA)
 	@echo "Bug:             2291273" >> $(METADATA) # Fedora 41
 	@echo "Bug:             RHEL-40834" >> $(METADATA) # RHEL-10
+	@echo "Bug:             RHEL-77620" >> $(METADATA) # RHEL-10
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/virtualization-daemons/main.fmf b/selinux-policy/virtualization-daemons/main.fmf
index eb1c349..2716b7e 100644
--- a/selinux-policy/virtualization-daemons/main.fmf
+++ b/selinux-policy/virtualization-daemons/main.fmf
@@ -38,6 +38,7 @@ enabled: true
 link:
   - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2291273
   - verifies: https://issues.redhat.com/browse/RHEL-40834
+  - verifies: https://issues.redhat.com/browse/RHEL-77620
 tag:
   - NoRHEL4
   - NoRHEL5

diff --git a/selinux-policy/virtualization-daemons/runtest.sh b/selinux-policy/virtualization-daemons/runtest.sh
index 32f85be..a142de9 100755
--- a/selinux-policy/virtualization-daemons/runtest.sh
+++ b/selinux-policy/virtualization-daemons/runtest.sh
@@ -154,6 +154,47 @@ rlJournalStart
     rlPhaseEnd
 
     if seinfo -a | grep -q virt_driver_domain ; then
+    rlPhaseStartTest "RHEL-77620"
+        rlSEMatchPathCon "/usr/bin/virt-admin" "bin_t"
+        rlSESearchRule "type_transition init_t bin_t : process unconfined_service_t"
+        rlSESearchRule "allow virtqemud_t unconfined_service_t : dir { search } [ ]"
+        rlSESearchRule "allow virtqemud_t unconfined_service_t : file { getattr open read } [ ]"
+    rlPhaseEnd
+    fi
+
+    rlPhaseStartTest "real scenario -- admin sockets"
+        # start all admin sockets
+        for TUPLE in ${ALL_TUPLES} ; do
+            SERVICE_NAME=`echo ${TUPLE} | cut -d : -f 1`
+            PROCESS_NAME=`echo ${TUPLE} | cut -d : -f 2`
+            PROCESS_CONTEXT=`echo ${TUPLE} | cut -d : -f 3`
+            if [ -f /usr/lib/systemd/system/${SERVICE_NAME}-admin.socket ] ; then
+                rlRun "systemctl start ${SERVICE_NAME}-admin.socket"
+            fi
+        done
+        # connect to the services via admin sockets
+        for TUPLE in ${ALL_TUPLES} ; do
+            SERVICE_NAME=`echo ${TUPLE} | cut -d : -f 1`
+            PROCESS_NAME=`echo ${TUPLE} | cut -d : -f 2`
+            PROCESS_CONTEXT=`echo ${TUPLE} | cut -d : -f 3`
+            if [ -f /usr/lib/systemd/system/${SERVICE_NAME}-admin.socket ] ; then
+                rlRun "virt-admin -c ${SERVICE_NAME}:///system client-list admin" 0,1
+                rlRun "systemd-run virt-admin -c ${SERVICE_NAME}:///system server-list" 0,1
+            fi
+        done
+        rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255
+        # stop all admin sockets
+        for TUPLE in ${ALL_TUPLES} ; do
+            SERVICE_NAME=`echo ${TUPLE} | cut -d : -f 1`
+            PROCESS_NAME=`echo ${TUPLE} | cut -d : -f 2`
+            PROCESS_CONTEXT=`echo ${TUPLE} | cut -d : -f 3`
+            if [ -f /usr/lib/systemd/system/${SERVICE_NAME}-admin.socket ] ; then
+                rlRun "systemctl stop ${SERVICE_NAME}-admin.socket"
+            fi
+        done
+    rlPhaseEnd
+
+    if seinfo -a | grep -q virt_driver_domain ; then
     rlPhaseStartTest "bz#2291273 + RHEL-40834"
         rlSESearchRule "allow virtnetworkd_t unconfined_t : dir { search } [ ]"
         rlSESearchRule "allow virtnetworkd_t unconfined_t : file { open read } [ ]"