[tests/selinux] pr775-checkpolicy-revdeps: test if tuned-ppd can talk to SSSD via socket

[Milos Malik <mmalik@redhat.com>]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 34a1e679ecb38ec1bedbbd52b8907ecf00cbec39
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2025-06-02T09:34:21+00:00
            Stats  : +10/-0 in 3 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/34a1e679ecb38ec1bedbbd52b8907ecf00cbec39?branch=pr775-checkpolicy-revdeps

            Log:
            test if tuned-ppd can talk to SSSD via socket

Recently, a SSSD enabled machine which also runs the tuned-ppd service
revealed that SELinux prevents the tuned-ppd process from writing to
the /var/lib/sss/pipes/nss socket and then connecting to the sssd
process. The TC does not reproduce the situation.

In order to support the communication between tuned-ppd and SSSD
(tuned-ppd <-> nsswitch <-> SSSD), I believe that SELinux policy
should allow the actions. The TC looks for appropriate policy rules
and file context patterns.

The TC covers BZ#2367076.

---
diff --git a/selinux-policy/tuned-ppd-and-similar/Makefile b/selinux-policy/tuned-ppd-and-similar/Makefile
index 4943a64..695018b 100644
--- a/selinux-policy/tuned-ppd-and-similar/Makefile
+++ b/selinux-policy/tuned-ppd-and-similar/Makefile
@@ -65,6 +65,7 @@ $(METADATA): Makefile
 	@echo "Bug:             RHEL-69450" >> $(METADATA) # RHEL-10
 	@echo "Bug:             RHEL-69526" >> $(METADATA) # RHEL-9
 	@echo "Bug:             RHEL-85849" >> $(METADATA) # RHEL-10
+	@echo "Bug:             2367076" >> $(METADATA) # Fedora 41
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/tuned-ppd-and-similar/main.fmf b/selinux-policy/tuned-ppd-and-similar/main.fmf
index 909655b..559686f 100644
--- a/selinux-policy/tuned-ppd-and-similar/main.fmf
+++ b/selinux-policy/tuned-ppd-and-similar/main.fmf
@@ -32,6 +32,7 @@ link:
   - verifies: https://issues.redhat.com/browse/RHEL-69450
   - verifies: https://issues.redhat.com/browse/RHEL-69526
   - verifies: https://issues.redhat.com/browse/RHEL-85849
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2367076
 adjust:
   - enabled: false
     when: distro < rhel-9.5

diff --git a/selinux-policy/tuned-ppd-and-similar/runtest.sh b/selinux-policy/tuned-ppd-and-similar/runtest.sh
index e337ae3..95fd37a 100755
--- a/selinux-policy/tuned-ppd-and-similar/runtest.sh
+++ b/selinux-policy/tuned-ppd-and-similar/runtest.sh
@@ -81,6 +81,14 @@ rlJournalStart
     rlPhaseEnd
     fi
 
+    if rlSEDefined "tuned_ppd_t sssd_t" ; then
+    rlPhaseStartTest "bz#2367076"
+        rlSEMatchPathCon "/var/lib/sss/pipes/nss" "sssd_var_lib_t"
+        rlSESearchRule "allow tuned_ppd_t sssd_var_lib_t : sock_file { write } [ ]"
+        rlSESearchRule "allow tuned_ppd_t sssd_t : unix_stream_socket { connectto } [ ]"
+    rlPhaseEnd
+    fi
+
     if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then
     rlPhaseStartTest "real scenario -- standalone service"
         if [ -f /usr/lib/systemd/system/gdm.service ] ; then