[tests/selinux] pr775-checkpolicy-revdeps: test if journalctl can connect to systemd-nspawn machine

[tests/selinux] pr775-checkpolicy-revdeps: test if journalctl can connect to systemd-nspawn machine

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : e05b9a7cbb694957db00dd3883cbb84768de0b3c
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2025-04-30T10:15:11+00:00
            Stats  : +13/-1 in 3 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/e05b9a7cbb694957db00dd3883cbb84768de0b3c?branch=pr775-checkpolicy-revdeps

            Log:
            test if journalctl can connect to systemd-nspawn machine

A customer case revealed that not all commands mentioned in the
RHEL-76352 bug were resolved in the selinux-policy component. The
TC executes the missed ones.

In order to support the journalctl ability to access virtual machines,
I believe that SELinux policy should allow the dbus-broker processes
to read the /var/lib/machine/<virtual-machine> directories. The TC
looks for appropriate policy rules and file context patterns.

The TC covers RHEL-85379 and RHEL-86528.

---
diff --git a/selinux-policy/systemd-machined-and-similar/Makefile b/selinux-policy/systemd-machined-and-similar/Makefile
index c9b3c59..c954661 100644
--- a/selinux-policy/systemd-machined-and-similar/Makefile
+++ b/selinux-policy/systemd-machined-and-similar/Makefile
@@ -71,6 +71,8 @@ $(METADATA): Makefile
 	@echo "Bug:             RHEL-76352" >> $(METADATA) # RHEL-9
 	@echo "Bug:             RHEL-77087" >> $(METADATA) # RHEL-10
 	@echo "Bug:             RHEL-78088" >> $(METADATA) # RHEL-10
+	@echo "Bug:             RHEL-85379" >> $(METADATA) # RHEL-9
+	@echo "Bug:             RHEL-86528" >> $(METADATA) # RHEL-10
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/systemd-machined-and-similar/main.fmf b/selinux-policy/systemd-machined-and-similar/main.fmf
index 18c8819..61d14a8 100644
--- a/selinux-policy/systemd-machined-and-similar/main.fmf
+++ b/selinux-policy/systemd-machined-and-similar/main.fmf
@@ -39,6 +39,8 @@ link:
   - verifies: https://issues.redhat.com/browse/RHEL-76352
   - verifies: https://issues.redhat.com/browse/RHEL-77087
   - verifies: https://issues.redhat.com/browse/RHEL-78088
+  - verifies: https://issues.redhat.com/browse/RHEL-85379
+  - verifies: https://issues.redhat.com/browse/RHEL-86528
 adjust:
   - enabled: false
     when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7

diff --git a/selinux-policy/systemd-machined-and-similar/runtest.sh b/selinux-policy/systemd-machined-and-similar/runtest.sh
index d4aa98e..87bd723 100755
--- a/selinux-policy/systemd-machined-and-similar/runtest.sh
+++ b/selinux-policy/systemd-machined-and-similar/runtest.sh
@@ -120,6 +120,10 @@ rlJournalStart
         rlSESearchRule "allow systemd_machined_t unconfined_service_t : file { getattr open read ioctl } [ ]"
         rlSESearchRule "allow systemd_machined_t systemd_machined_t : cap_userns { kill } [ ]"
     rlPhaseEnd
+
+    rlPhaseStartTest "RHEL-85379 + RHEL-86528"
+        rlSESearchRule "allow system_dbusd_t systemd_machined_var_lib_t : dir { read } [ ]"
+    rlPhaseEnd
     fi
 
     rlPhaseStartTest "real scenario -- standalone service"
@@ -134,7 +138,7 @@ rlJournalStart
     rlPhaseStartTest "real scenario -- bz#1900869 + bz#1900888"
         rlRun "mkdir -pZ /var/lib/machines/test"
         rlRun "dnf -y --installroot=/var/lib/machines/test/ install dhcp-client dnf filesystem glibc glibc-langpack-en glibc-langpack-de iproute iputils less passwd systemd vim-minimal ${INSTALL_OPTION}"
-        rlRun "du -sh /var/lib/machines/test"
+        rlRun "restorecon -Rv /var/lib/machines"
         if ${TEST_POLICY_NEEDED} ; then
             rlRun "semodule -i testpolicy.cil"
             rlRun "semodule -lfull | grep testpolicy"
@@ -144,7 +148,11 @@ rlJournalStart
         rlRun "ps -efZ | grep -e ${PROCESS_CONTEXT} -e unconfined_service_t"
         rlRun "machinectl list"
         rlRun "machinectl status test"
+        rlRun "journalctl -M test --system"
+        rlRun "journalctl -M test --user"
         rlWatchdog "machinectl login test" 20
+        rlRun "machinectl list-images"
+        rlRun "machinectl image-status test"
         if rlIsFedora ; then
             rlRun "rm -f /tmp/id"
             rlRun "machinectl copy-to test /usr/bin/id /tmp/id"