[tests/selinux] pr775-checkpolicy-revdeps: test if systemd generators can send data to /run/systemd/journal/socket

[tests/selinux] pr775-checkpolicy-revdeps: test if systemd generators can send data to /run/systemd/journal/socket

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 1663f9c1b178ed2c7b29b11aefaa707a7c2227d2
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2025-03-26T12:39:46+00:00
            Stats  : +7/-0 in 3 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/1663f9c1b178ed2c7b29b11aefaa707a7c2227d2?branch=pr775-checkpolicy-revdeps

            Log:
            test if systemd generators can send data to /run/systemd/journal/socket

Recent system roles testing revealed that SELinux prevents various
systemd generators from sending any data into /run/systemd/journal/socket.
The TC does not reproduce the situation.

In order to enable the use case in which systemd-journald is replaced
by rsyslog, I believe that SELinux policy should allow these actions.
The TC looks for appropriate policy rules and file context patterns.

The TC covers RHEL-75879.

---
diff --git a/selinux-policy/systemd-generators/Makefile b/selinux-policy/systemd-generators/Makefile
index 041e2b8..9dbed8f 100644
--- a/selinux-policy/systemd-generators/Makefile
+++ b/selinux-policy/systemd-generators/Makefile
@@ -74,6 +74,7 @@ $(METADATA): Makefile
 	@echo "Releases:        -RHEL7" >> $(METADATA)
 	@echo "Bug:             2230226" >> $(METADATA) # Fedora 39
 	@echo "Bug:             RHEL-72549" >> $(METADATA) # RHEL-10
+	@echo "Bug:             RHEL-75879" >> $(METADATA) # RHEL-10
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/systemd-generators/main.fmf b/selinux-policy/systemd-generators/main.fmf
index 4e67f10..93b9231 100644
--- a/selinux-policy/systemd-generators/main.fmf
+++ b/selinux-policy/systemd-generators/main.fmf
@@ -34,6 +34,7 @@ tag:
 link:
   - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2230226
   - verifies: https://issues.redhat.com/browse/RHEL-72549
+  - verifies: https://issues.redhat.com/browse/RHEL-75879
 adjust:
   - enabled: false
     when: distro == rhel-4, rhel-5, rhel-6, rhel-7

diff --git a/selinux-policy/systemd-generators/runtest.sh b/selinux-policy/systemd-generators/runtest.sh
index f92caea..bc8be92 100755
--- a/selinux-policy/systemd-generators/runtest.sh
+++ b/selinux-policy/systemd-generators/runtest.sh
@@ -205,6 +205,11 @@ EOF
         rlSESearchRule "allow systemd_ssh_generator_t vsock_device_t : chr_file { getattr ioctl open read } [ ]"
         rlSESearchRule "allow systemd_ssh_generator_t systemd_unit_file_t : file { create getattr write open } [ ]"
     rlPhaseEnd
+
+    rlPhaseStartTest "RHEL-75879"
+        rlRun "seinfo -a systemd_generator -x"
+        rlSESearchRule "allow systemd_fstab_generator_t syslogd_t : unix_dgram_socket { sendto } [ ]"
+    rlPhaseEnd
     fi
 
     ### generators from other packages: install them all?