[tests/selinux] pr775-checkpolicy-revdeps: test if pcscd works OK with NoNewPrivileges=yes

[tests/selinux] pr775-checkpolicy-revdeps: test if pcscd works OK with NoNewPrivileges=yes

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 9b73e15e1ed92147da243918ba3067847916aaec
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2025-04-03T14:46:31+02:00
            Stats  : +13/-1 in 3 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/9b73e15e1ed92147da243918ba3067847916aaec?branch=pr775-checkpolicy-revdeps

            Log:
            test if pcscd works OK with NoNewPrivileges=yes

Recent pcscd + selinux-policy testing revealed SELinux denials which
are caused by the NoNewPrivileges=yes option present in the following
file:
 * /usr/lib/systemd/system/pcscd.service

The SELinux denials are also accompanied by the following errors in
the systemd journal:

  pcscd[...]: 00000000 ../src/pcscdaemon.c:704:main() cannot create /run/pcscd/pcscd.pid: Permission denied
  pcscd[...]: 61013391 ../src/pcscdaemon.c:843:clean_temp_files() Cannot remove /run/pcscd/pcscd.pid: No such file or directory

In order to support the intentional changes and avoid these SELinux
denials, I believe that SELinux policy should allow the nnp_transition
for the pcscd_t domain. The TC looks for appropriate policy rules.

The TC covers BZ#2355930, BZ#2356058 and BZ#2357154.

---
diff --git a/selinux-policy/bz624405-pcsc-and-similar/Makefile b/selinux-policy/bz624405-pcsc-and-similar/Makefile
index d0e27fd..18528c2 100644
--- a/selinux-policy/bz624405-pcsc-and-similar/Makefile
+++ b/selinux-policy/bz624405-pcsc-and-similar/Makefile
@@ -87,6 +87,9 @@ $(METADATA): Makefile
 	@echo "Bug:             1818759" >> $(METADATA) # Fedora 32
 	@echo "Bug:             1825182" >> $(METADATA) # Fedora 32
 	@echo "Bug:             1825188" >> $(METADATA) # Fedora 32
+	@echo "Bug:             2355930" >> $(METADATA) # Fedora 43
+	@echo "Bug:             2356058" >> $(METADATA) # Fedora 43
+	@echo "Bug:             2357154" >> $(METADATA) # Fedora 43
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/bz624405-pcsc-and-similar/main.fmf b/selinux-policy/bz624405-pcsc-and-similar/main.fmf
index 2d43271..7d7762f 100644
--- a/selinux-policy/bz624405-pcsc-and-similar/main.fmf
+++ b/selinux-policy/bz624405-pcsc-and-similar/main.fmf
@@ -49,6 +49,9 @@ link:
   - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1818759
   - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1825182
   - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1825188
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2355930
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2356058
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2357154
 adjust:
   - enabled: false
     when: arch == s390, s390x

diff --git a/selinux-policy/bz624405-pcsc-and-similar/runtest.sh b/selinux-policy/bz624405-pcsc-and-similar/runtest.sh
index 0093aa4..c202480 100755
--- a/selinux-policy/bz624405-pcsc-and-similar/runtest.sh
+++ b/selinux-policy/bz624405-pcsc-and-similar/runtest.sh
@@ -89,8 +89,13 @@ rlJournalStart
         rlSEMatchPathCon "/usr/sbin/pcscd" "pcscd_exec_t"
         rlSESearchRule "dontaudit pcscd_t pcscd_t : process { setsched } [ ]"
     rlPhaseEnd
+
+    rlPhaseStartTest "bz#2355930 + bz#2356058 + bz#2357154"
+        rlSESearchRule "allow init_t pcscd_t : process2 { nnp_transition } [ ]"
+    rlPhaseEnd
     fi
 
+    if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then
     rlPhaseStartTest "real scenario -- bz#624405"
         rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root"
         if ! rlSEDefined ${PROCESS_CONTEXT} ; then
@@ -101,9 +106,10 @@ rlJournalStart
             fi
         fi
         rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1
-        rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255
+        rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255
         rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1
     rlPhaseEnd
+    fi
 
     rlPhaseStartCleanup
         sleep 2