[tests/selinux] pr775-checkpolicy-revdeps: test if virtqemud can detach devices or libvirt is macTableManager

[tests/selinux] pr775-checkpolicy-revdeps: test if virtqemud can detach devices or libvirt is macTableManager

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 8db47446be1befb107fb33b9b179a23e676dbc08
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2025-03-21T12:53:43+01:00
            Stats  : +55/-0 in 3 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/8db47446be1befb107fb33b9b179a23e676dbc08?branch=pr775-checkpolicy-revdeps

            Log:
            test if virtqemud can detach devices or libvirt is macTableManager

Testing of various virtualization scenarios revealed that SELinux
prevents the virtqemud processes from writing into following files:
 * /sys/bus/pci/devices/0000:00:05.0/driver_override
 * /sys/class/net/virbr0/brif/vnet5/learning

The TC reproduces these situations.

In order to support the use cases described in the following bugs,
I believe that SELinux policy should allow the write actions. The
TC looks for appropriate policy rules and file context patterns.

The TC covers RHEL-65266 and RHEL-65385.

---
diff --git a/selinux-policy/virt-install-additional/Makefile b/selinux-policy/virt-install-additional/Makefile
index c2e6bb8..0f7eedd 100644
--- a/selinux-policy/virt-install-additional/Makefile
+++ b/selinux-policy/virt-install-additional/Makefile
@@ -65,8 +65,10 @@ $(METADATA): Makefile
 	@echo "Architectures:   aarch64 s390x x86_64" >> $(METADATA)
 	@echo "Bug:             RHEL-56029" >> $(METADATA) # RHEL-9
 	@echo "Bug:             RHEL-65038" >> $(METADATA) # RHEL-10
+	@echo "Bug:             RHEL-65266" >> $(METADATA) # RHEL-10
 	@echo "Bug:             RHEL-65373" >> $(METADATA) # RHEL-10
 	@echo "Bug:             RHEL-65383" >> $(METADATA) # RHEL-10
+	@echo "Bug:             RHEL-65385" >> $(METADATA) # RHEL-10
 	@echo "Bug:             RHEL-65789" >> $(METADATA) # RHEL-10
 	@echo "Bug:             RHEL-69118" >> $(METADATA) # RHEL-10
 	@echo "Bug:             RHEL-69920" >> $(METADATA) # RHEL-10

diff --git a/selinux-policy/virt-install-additional/main.fmf b/selinux-policy/virt-install-additional/main.fmf
index 3480092..b7ba19a 100644
--- a/selinux-policy/virt-install-additional/main.fmf
+++ b/selinux-policy/virt-install-additional/main.fmf
@@ -39,8 +39,10 @@ tag:
 link:
   - verifies: https://issues.redhat.com/browse/RHEL-56029
   - verifies: https://issues.redhat.com/browse/RHEL-65038
+  - verifies: https://issues.redhat.com/browse/RHEL-65266
   - verifies: https://issues.redhat.com/browse/RHEL-65373
   - verifies: https://issues.redhat.com/browse/RHEL-65383
+  - verifies: https://issues.redhat.com/browse/RHEL-65385
   - verifies: https://issues.redhat.com/browse/RHEL-65789
   - verifies: https://issues.redhat.com/browse/RHEL-69118
   - verifies: https://issues.redhat.com/browse/RHEL-69920

diff --git a/selinux-policy/virt-install-additional/runtest.sh b/selinux-policy/virt-install-additional/runtest.sh
index ccb456f..b5de6be 100755
--- a/selinux-policy/virt-install-additional/runtest.sh
+++ b/selinux-policy/virt-install-additional/runtest.sh
@@ -277,6 +277,57 @@ rlJournalStart
         rlRun "modprobe -r scsi_debug"
     rlPhaseEnd
 
+    rlPhaseStartTest "RHEL-65266"
+        rlSESearchRule "allow virtqemud_t sysfs_t : file { write } [ ]"
+        rlRun "service virtqemud start"
+        rlRun "service virtnodedevd start"
+        rlRun "mkdir -p devices"
+        rlRun "pushd devices"
+        rlRun "virsh nodedev-list"
+        for I in `virsh nodedev-list` ; do
+            rlRun "virsh nodedev-dumpxml $I > $I"
+        done
+        if grep balloon * ; then
+            J=`grep -l balloon *`
+            rlRun "virsh nodedev-reattach $J"
+        else
+            rlLog "no balloon device was found - cannot reattach it"
+        fi
+        rlRun "popd"
+        rlRun "rm -rf devices"
+        sleep 2
+        rlRun "service virtnodedevd stop"
+        rlRun "service virtqemud stop"
+    rlPhaseEnd
+
+    rlPhaseStartTest "RHEL-65385"
+        rlSESearchRule "allow virtqemud_t sysfs_t : file { write } [ ]"
+        if rlIsRHEL 8 ; then
+            rlRun "service libvirtd start"
+        fi
+        rlRun "service virtqemud start"
+        rlRun "service virtnetworkd start"
+        rlRun "virsh net-list"
+        rlRun "virsh net-dumpxml default > default.xml"
+        rlRun "virsh net-destroy default"
+        rlRun "virsh net-undefine default"
+        rlRun "sed -i \"s/^\(.*bridge\) \(.*\)$/\1 macTableManager='libvirt' \2/\" default.xml"
+        rlRun "virsh net-create ./default.xml"
+        sleep 2
+        rlRun "virsh net-list"
+        rlRun "virt-install --memory 128 --pxe --virt-type qemu --os-variant alpinelinux3.8 --disk none --wait 0 --name test7" 0,1
+        sleep 10
+        rlRun "virsh list"
+        rlRun "virsh list | grep 'test7.*running'"
+        rlRun "virsh destroy test7"
+        rlRun "virsh undefine test7" 0,1
+        rlRun "service virtnetworkd stop"
+        rlRun "service virtqemud stop"
+        if rlIsRHEL 8 ; then
+            rlRun "service libvirtd stop"
+        fi
+    rlPhaseEnd
+
     rlPhaseStartCleanup
         sleep 2
         rlSECheckAVC