[tests/selinux] pr775-checkpolicy-revdeps: test if chronyc can talk to the restricted chronyd via socket

[Milos Malik <mmalik@redhat.com>]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 59cff7b143a21d62def0ad5543a8770e676b59b8
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2025-03-20T09:44:13+00:00
            Stats  : +13/-1 in 3 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/59cff7b143a21d62def0ad5543a8770e676b59b8?branch=pr775-checkpolicy-revdeps

            Log:
            test if chronyc can talk to the restricted chronyd via socket

Recent selinux-policy + chrony testing revealed that SELinux prevents
communication between chronyc and the restricted chronyd service. The
TC reproduces the situation.

In order to enable this use case, I believe that SELinux policy
should allow the communcation in both directions. The TC looks
for appropriate policy rules.

The TC covers RHEL-82299 and RHEL-82308.

---
diff --git a/selinux-policy/chronyd-and-similar/Makefile b/selinux-policy/chronyd-and-similar/Makefile
index ab9a53b..a26d46f 100644
--- a/selinux-policy/chronyd-and-similar/Makefile
+++ b/selinux-policy/chronyd-and-similar/Makefile
@@ -105,6 +105,8 @@ $(METADATA): Makefile
 	@echo "Bug:             2173604" >> $(METADATA) # RHEL-9
 	@echo "Bug:             2169949" >> $(METADATA) # Fedora-38
 	@echo "Bug:             RHEL-18219" >> $(METADATA) # RHEL-9
+	@echo "Bug:             RHEL-82299" >> $(METADATA) # RHEL-10
+	@echo "Bug:             RHEL-82308" >> $(METADATA) # RHEL-9
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/chronyd-and-similar/main.fmf b/selinux-policy/chronyd-and-similar/main.fmf
index 6ada2ed..b80882f 100644
--- a/selinux-policy/chronyd-and-similar/main.fmf
+++ b/selinux-policy/chronyd-and-similar/main.fmf
@@ -86,6 +86,8 @@ link:
   - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2173604
   - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2169949
   - verifies: https://issues.redhat.com/browse/RHEL-18219
+  - verifies: https://issues.redhat.com/browse/RHEL-82299
+  - verifies: https://issues.redhat.com/browse/RHEL-82308
 adjust:
   - enabled: false
     when: distro == rhel-4

diff --git a/selinux-policy/chronyd-and-similar/runtest.sh b/selinux-policy/chronyd-and-similar/runtest.sh
index e7c7094..4e09f92 100755
--- a/selinux-policy/chronyd-and-similar/runtest.sh
+++ b/selinux-policy/chronyd-and-similar/runtest.sh
@@ -343,7 +343,7 @@ rlJournalStart
             rlRun "ipcs -m | grep 0x4e545030"
             rlRun "ls -Z /var/run/chronyd.sock | grep :chronyd_var_run_t"
         fi
-        rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255
+        rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255
         rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status" 1
         rlRun "chronyc tracking"
         for OUTPUT_FILE in /tmp/chronyc.output /var/lib/chrony/chronyc.output /var/log/chrony/chronyc.output ; do
@@ -419,6 +419,13 @@ rlJournalStart
     rlPhaseEnd
     fi
 
+    if rlSEDefined "chronyd_restricted_t" ; then
+    rlPhaseStartTest "RHEL-82299 + RHEL-82308"
+        rlSESearchRule "allow chronyc_t chronyd_restricted_t : unix_dgram_socket { sendto } [ ]"
+        rlSESearchRule "allow chronyd_restricted_t chronyc_t : unix_dgram_socket { sendto } [ ]"
+    rlPhaseEnd
+    fi
+
     if [ -f ${CHRONYD_RESTRICTED_UNIT_FILE} ]; then
       rlPhaseStartTest "chronyd-restricted -- bz#2169949 + RHEL-18219"
         rlRun "systemctl stop ${SERVICE_NAME}"
@@ -432,6 +439,7 @@ rlJournalStart
         sleep 3
         rlRun "ps -o pid,uid,command,context -C chronyd | grep -1 system_u:system_r:chronyd_restricted_t:"
         rlRun "systemctl status ${CHRONYD_RESTRICTED_SERVICE}"
+        rlRun "chronyc reload sources" 0,1
         rlRun "systemctl restart ${CHRONYD_RESTRICTED_SERVICE}"
         rlRun "systemctl status ${CHRONYD_RESTRICTED_SERVICE}"
         rlRun "systemctl stop ${CHRONYD_RESTRICTED_SERVICE}"