[tests/selinux] pr775-checkpolicy-revdeps: test if tlshd can access network and certificates

[tests/selinux] pr775-checkpolicy-revdeps: test if tlshd can access network and certificates

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 6026118dccd0be4909a87b93ea0072baf5ac4fb3
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2025-02-17T15:31:48+00:00
            Stats  : +21/-1 in 3 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/6026118dccd0be4909a87b93ea0072baf5ac4fb3?branch=pr775-checkpolicy-revdeps

            Log:
            test if tlshd can access network and certificates

Recent ktls-utils + NVME testing revealed that SELinux prevents
the tlshd processes from doing the following activities:
 * reading the /etc/resolv.conf file
 * creating and managing a UDP socket
 * searching the /etc/pki/tls/certs directory
 * reading the certificate files under /etc/pki/tls/certs/
 * reading the /proc/sys/net/ipv6/conf/all/disable_ipv6 file
 * searching the /proc/sys/net/ipv6 directory
 * creating and managing a netlink route socket

The TC does not reproduce the situation. There is a dedicated
automated test for this purpose.

In order to enable the expected tlshd functionality, I believe that
SELinux policy should allow these actions. The TC looks for appropriate
policy rules and file context patterns.

The TC covers RHEL-74424.

---
diff --git a/selinux-policy/tlshd-and-similar/Makefile b/selinux-policy/tlshd-and-similar/Makefile
index b6e2928..236ebdf 100644
--- a/selinux-policy/tlshd-and-similar/Makefile
+++ b/selinux-policy/tlshd-and-similar/Makefile
@@ -64,6 +64,7 @@ $(METADATA): Makefile
 	@echo "Releases:        -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA)
 	@echo "Bug:             RHEL-29439" >> $(METADATA) # RHEL-9
 	@echo "Bug:             RHEL-42672" >> $(METADATA) # RHEL-10
+	@echo "Bug:             RHEL-74424" >> $(METADATA) # RHEL-10
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/tlshd-and-similar/main.fmf b/selinux-policy/tlshd-and-similar/main.fmf
index f792516..34a61bc 100644
--- a/selinux-policy/tlshd-and-similar/main.fmf
+++ b/selinux-policy/tlshd-and-similar/main.fmf
@@ -31,9 +31,10 @@ tag:
 link:
   - verifies: https://issues.redhat.com/browse/RHEL-29439
   - verifies: https://issues.redhat.com/browse/RHEL-42672
+  - verifies: https://issues.redhat.com/browse/RHEL-74424
 adjust:
   - enabled: false
-    when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8
+    when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, centos-stream-8
     because: the ktls-utils package is not available there
 extra-summary: /CoreOS/selinux-policy/Regression/tlshd-and-similar
 extra-task: /CoreOS/selinux-policy/Regression/tlshd-and-similar

diff --git a/selinux-policy/tlshd-and-similar/runtest.sh b/selinux-policy/tlshd-and-similar/runtest.sh
index 4a2fc48..bf67f0e 100755
--- a/selinux-policy/tlshd-and-similar/runtest.sh
+++ b/selinux-policy/tlshd-and-similar/runtest.sh
@@ -70,6 +70,24 @@ rlJournalStart
         rlSESearchRule "type_transition init_t ${FILE_CONTEXT} : process ${PROCESS_CONTEXT}"
     rlPhaseEnd
 
+    if rlSEDefined "ktlshd_t" ; then
+    rlPhaseStartTest "RHEL-74424"
+        rlSEMatchPathCon "/etc/resolv.conf" "net_conf_t"
+        rlSEMatchPathCon "/etc/pki/tls/certs/ca-cert.pem" "cert_t"
+        rlRun "ls -Z /proc/net/if_inet6 | grep :proc_net_t"
+        rlRun "ls -Z /proc/sys/net/ipv6/conf/all/disable_ipv6 | grep :sysctl_net_t"
+        rlSESearchRule "allow ktlshd_t ktlshd_t : key { write } [ ]"
+        rlSESearchRule "allow ktlshd_t cert_t : dir { search } [ ]"
+        rlSESearchRule "allow ktlshd_t cert_t : file { getattr open read } [ ]"
+        rlSESearchRule "allow ktlshd_t net_conf_t : file { getattr open read } [ ]"
+        rlSESearchRule "allow ktlshd_t proc_net_t : lnk_file { read } [ ]"
+        rlSESearchRule "allow ktlshd_t ktlshd_t : netlink_route_socket { bind create getattr getopt nlmsg_read setopt } [ ]"
+        rlSESearchRule "allow ktlshd_t ktlshd_t : udp_socket { connect create getattr setopt } [ ]"
+        rlSESearchRule "allow ktlshd_t sysctl_net_t : dir { search } [ ]"
+        rlSESearchRule "allow ktlshd_t sysctl_net_t : file { getattr open read } [ ]"
+    rlPhaseEnd
+    fi
+
     if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then
     rlPhaseStartTest "real scenario -- standalone service"
         rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1