[tests/selinux] pr775-checkpolicy-revdeps: test if pcm-sensor-server can run on machines with many CPUs

[tests/selinux] pr775-checkpolicy-revdeps: test if pcm-sensor-server can run on machines with many CPUs

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 3702d34999e632423ccd12b632fa4c25f76e95ef
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2025-03-26T14:30:15+00:00
            Stats  : +12/-0 in 3 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/3702d34999e632423ccd12b632fa4c25f76e95ef?branch=pr775-checkpolicy-revdeps

            Log:
            test if pcm-sensor-server can run on machines with many CPUs

Recent selinux-policy + pcm testing on machines with multiple CPUs
revealed that SELinux prevents the pcm-sensor-server process from
doing various operation. The TC reproduces that situation on the
right HW.

In order to support the expected functions of pcm-sensor-server,
I believe that SELinux policy should allow these actions. The TC
looks for appropriate policy rules and file context patterns.

The TC covers RHEL-80452.

---
diff --git a/selinux-policy/pcm-sensor-server-and-similar/Makefile b/selinux-policy/pcm-sensor-server-and-similar/Makefile
index 09892d4..b37360f 100644
--- a/selinux-policy/pcm-sensor-server-and-similar/Makefile
+++ b/selinux-policy/pcm-sensor-server-and-similar/Makefile
@@ -64,6 +64,7 @@ $(METADATA): Makefile
 	@echo "Destructive:     no" >> $(METADATA)
 	@echo "Releases:        -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8 -RHEL9" >> $(METADATA)
 	@echo "Bug:             RHEL-52838" >> $(METADATA) # RHEL-10
+	@echo "Bug:             RHEL-80452" >> $(METADATA) # RHEL-10
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/pcm-sensor-server-and-similar/main.fmf b/selinux-policy/pcm-sensor-server-and-similar/main.fmf
index 3476274..146de4e 100644
--- a/selinux-policy/pcm-sensor-server-and-similar/main.fmf
+++ b/selinux-policy/pcm-sensor-server-and-similar/main.fmf
@@ -34,6 +34,7 @@ tag:
   - NoRHIVOS
 link:
   - verifies: https://issues.redhat.com/browse/RHEL-52838
+  - verifies: https://issues.redhat.com/browse/RHEL-80452
 adjust:
   - enabled: false
     when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, rhel-9

diff --git a/selinux-policy/pcm-sensor-server-and-similar/runtest.sh b/selinux-policy/pcm-sensor-server-and-similar/runtest.sh
index eab7a09..e54cd3b 100755
--- a/selinux-policy/pcm-sensor-server-and-similar/runtest.sh
+++ b/selinux-policy/pcm-sensor-server-and-similar/runtest.sh
@@ -63,6 +63,16 @@ rlJournalStart
         sleep 2
     rlPhaseEnd
 
+    if rlSEDefined "pcmsensor_t" ; then
+    rlPhaseStartTest "RHEL-80452"
+        rlSEMatchPathCon ${FILE_PATH} ${FILE_CONTEXT}
+        rlSESearchRule "allow pcmsensor_t pcmsensor_t : capability2 { perfmon } [ ]"
+        rlSESearchRule "allow pcmsensor_t pcmsensor_t : perf_event { cpu kernel open read } [ ]"
+        rlSESearchRule "allow pcmsensor_t pcmsensor_t : tcp_socket { accept bind create listen } [ ]"
+        rlSESearchRule "allow pcmsensor_t node_t : tcp_socket { node_bind } [ ]"
+    rlPhaseEnd
+    fi
+
     rm -f output.txt
     virt-what >& output.txt
     if [ -s output.txt ] ; then