[tests/selinux] pr775-checkpolicy-revdeps: test if gdm can talk to tuned-ppd via D-bus

[tests/selinux] pr775-checkpolicy-revdeps: test if gdm can talk to tuned-ppd via D-bus

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 51aa683abb7cfd0b01b9527b2cd6cceaeb548dff
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2025-04-09T06:05:58+00:00
            Stats  : +16/-1 in 3 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/51aa683abb7cfd0b01b9527b2cd6cceaeb548dff?branch=pr775-checkpolicy-revdeps

            Log:
            test if gdm can talk to tuned-ppd via D-bus

Recent tuned-ppd + gdm + selinux-policy testing revealed that SELinux
prevents the D-bus communication between gdm and tuned-ppd. The TC
reproduces the situation which is accompanied by the following record
in the systemd journal:

  test-vm dbus-broker[...]: A security policy denied :1.54 to send method call
  /org/freedesktop/UPower/PowerProfiles:org.freedesktop.DBus.Properties.GetAll to :1.43.

In order to enable the bi-directional communication, I believe that
SELinux policy should allow sending D-bus messages between these
2 domains. The TC looks for appropriate policy rules and file context
patterns.

The TC covers RHEL-85849.

---
diff --git a/selinux-policy/tuned-ppd-and-similar/Makefile b/selinux-policy/tuned-ppd-and-similar/Makefile
index de75abf..4943a64 100644
--- a/selinux-policy/tuned-ppd-and-similar/Makefile
+++ b/selinux-policy/tuned-ppd-and-similar/Makefile
@@ -54,7 +54,7 @@ $(METADATA): Makefile
 	@echo "Type:            Regression" >> $(METADATA)
 	@echo "TestTime:        10m" >> $(METADATA)
 	@echo "RunFor:          selinux-policy" >> $(METADATA)
-	@echo "Requires:        audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console tuned-ppd /usr/sbin/service" >> $(METADATA)
+	@echo "Requires:        audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console tuned-ppd /usr/sbin/service gdm" >> $(METADATA)
 	@echo "RhtsRequires:    library(selinux-policy/common)" >> $(METADATA)
 	@echo "Environment:     AVC_ERROR=+no_avc_check" >> $(METADATA)
 	@echo "Priority:        Normal" >> $(METADATA)
@@ -64,6 +64,7 @@ $(METADATA): Makefile
 	@echo "Releases:        -RHEL4 -RHEL5 -RHEL6 -RHEL7 -RHEL8" >> $(METADATA)
 	@echo "Bug:             RHEL-69450" >> $(METADATA) # RHEL-10
 	@echo "Bug:             RHEL-69526" >> $(METADATA) # RHEL-9
+	@echo "Bug:             RHEL-85849" >> $(METADATA) # RHEL-10
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/tuned-ppd-and-similar/main.fmf b/selinux-policy/tuned-ppd-and-similar/main.fmf
index 9d92b40..9244966 100644
--- a/selinux-policy/tuned-ppd-and-similar/main.fmf
+++ b/selinux-policy/tuned-ppd-and-similar/main.fmf
@@ -16,6 +16,7 @@ recommend:
   - selinux-policy-targeted
   - setools-console
   - /usr/sbin/service
+  - gdm
 environment:
     AVC_ERROR: +no_avc_check
 duration: 10m
@@ -30,6 +31,7 @@ tag:
 link:
   - verifies: https://issues.redhat.com/browse/RHEL-69450
   - verifies: https://issues.redhat.com/browse/RHEL-69526
+  - verifies: https://issues.redhat.com/browse/RHEL-85849
 adjust:
   - enabled: false
     when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8

diff --git a/selinux-policy/tuned-ppd-and-similar/runtest.sh b/selinux-policy/tuned-ppd-and-similar/runtest.sh
index 7c16a30..d228c1d 100755
--- a/selinux-policy/tuned-ppd-and-similar/runtest.sh
+++ b/selinux-policy/tuned-ppd-and-similar/runtest.sh
@@ -74,13 +74,25 @@ rlJournalStart
         rlSESearchRule "allow init_t ${FILE_CONTEXT} : file { getattr open read execute } [ ]"
     rlPhaseEnd
 
+    if rlSEDefined "xdm_t tuned_ppd_t" ; then
+    rlPhaseStartTest "RHEL-85849"
+        rlSESearchRule "allow xdm_t tuned_ppd_t : dbus { send_msg } [ ]"
+        rlSESearchRule "allow tuned_ppd_t xdm_t : dbus { send_msg } [ ]"
+    rlPhaseEnd
+    fi
+
     if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then
     rlPhaseStartTest "real scenario -- standalone service"
+        rlRun "service gdm start"
+        rlRun "service gdm status"
+        sleep 2
         rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1
         rlRun "busctl introspect net.hadess.PowerProfiles /org/freedesktop/UPower/PowerProfiles"
         rlRun "busctl introspect net.hadess.PowerProfiles /net/hadess/PowerProfiles"
         rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255
         rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1
+        sleep 2
+        rlRun "service gdm stop"
     rlPhaseEnd
     fi