public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
From: Milos Malik <mmalik@redhat.com>
To: git-commits@fedoraproject.org
Subject: [tests/selinux] pr775-checkpolicy-revdeps: test if pcscd works OK with NoNewPrivileges=yes
Date: Fri, 11 Sep 2026 13:22:31 GMT	[thread overview]
Message-ID: <178913295129.1.12209166544706332263.tests-selinux-9b73e15e1ed9@fedoraproject.org> (raw)

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 9b73e15e1ed92147da243918ba3067847916aaec
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2025-04-03T14:46:31+02:00
            Stats  : +13/-1 in 3 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/9b73e15e1ed92147da243918ba3067847916aaec?branch=pr775-checkpolicy-revdeps

            Log:
            test if pcscd works OK with NoNewPrivileges=yes

Recent pcscd + selinux-policy testing revealed SELinux denials which
are caused by the NoNewPrivileges=yes option present in the following
file:
 * /usr/lib/systemd/system/pcscd.service

The SELinux denials are also accompanied by the following errors in
the systemd journal:

  pcscd[...]: 00000000 ../src/pcscdaemon.c:704:main() cannot create /run/pcscd/pcscd.pid: Permission denied
  pcscd[...]: 61013391 ../src/pcscdaemon.c:843:clean_temp_files() Cannot remove /run/pcscd/pcscd.pid: No such file or directory

In order to support the intentional changes and avoid these SELinux
denials, I believe that SELinux policy should allow the nnp_transition
for the pcscd_t domain. The TC looks for appropriate policy rules.

The TC covers BZ#2355930, BZ#2356058 and BZ#2357154.

---
diff --git a/selinux-policy/bz624405-pcsc-and-similar/Makefile b/selinux-policy/bz624405-pcsc-and-similar/Makefile
index d0e27fd..18528c2 100644
--- a/selinux-policy/bz624405-pcsc-and-similar/Makefile
+++ b/selinux-policy/bz624405-pcsc-and-similar/Makefile
@@ -87,6 +87,9 @@ $(METADATA): Makefile
 	@echo "Bug:             1818759" >> $(METADATA) # Fedora 32
 	@echo "Bug:             1825182" >> $(METADATA) # Fedora 32
 	@echo "Bug:             1825188" >> $(METADATA) # Fedora 32
+	@echo "Bug:             2355930" >> $(METADATA) # Fedora 43
+	@echo "Bug:             2356058" >> $(METADATA) # Fedora 43
+	@echo "Bug:             2357154" >> $(METADATA) # Fedora 43
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/bz624405-pcsc-and-similar/main.fmf b/selinux-policy/bz624405-pcsc-and-similar/main.fmf
index 2d43271..7d7762f 100644
--- a/selinux-policy/bz624405-pcsc-and-similar/main.fmf
+++ b/selinux-policy/bz624405-pcsc-and-similar/main.fmf
@@ -49,6 +49,9 @@ link:
   - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1818759
   - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1825182
   - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1825188
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2355930
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2356058
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2357154
 adjust:
   - enabled: false
     when: arch == s390, s390x

diff --git a/selinux-policy/bz624405-pcsc-and-similar/runtest.sh b/selinux-policy/bz624405-pcsc-and-similar/runtest.sh
index 0093aa4..c202480 100755
--- a/selinux-policy/bz624405-pcsc-and-similar/runtest.sh
+++ b/selinux-policy/bz624405-pcsc-and-similar/runtest.sh
@@ -89,8 +89,13 @@ rlJournalStart
         rlSEMatchPathCon "/usr/sbin/pcscd" "pcscd_exec_t"
         rlSESearchRule "dontaudit pcscd_t pcscd_t : process { setsched } [ ]"
     rlPhaseEnd
+
+    rlPhaseStartTest "bz#2355930 + bz#2356058 + bz#2357154"
+        rlSESearchRule "allow init_t pcscd_t : process2 { nnp_transition } [ ]"
+    rlPhaseEnd
     fi
 
+    if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then
     rlPhaseStartTest "real scenario -- bz#624405"
         rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root"
         if ! rlSEDefined ${PROCESS_CONTEXT} ; then
@@ -101,9 +106,10 @@ rlJournalStart
             fi
         fi
         rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1
-        rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255
+        rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255
         rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1
     rlPhaseEnd
+    fi
 
     rlPhaseStartCleanup
         sleep 2

                 reply	other threads:[~2026-09-11 13:22 UTC|newest]

Thread overview: [no followups] expand[flat|nested]  mbox.gz  Atom feed

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=178913295129.1.12209166544706332263.tests-selinux-9b73e15e1ed9@fedoraproject.org \
    --to=mmalik@redhat.com \
    --cc=git-commits@fedoraproject.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox