[tests/selinux] pr775-checkpolicy-revdeps: test if samba-bgqd can send data into /var/lib/samba/private/msg.sock/

[tests/selinux] pr775-checkpolicy-revdeps: test if samba-bgqd can send data into /var/lib/samba/private/msg.sock/

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : f54862208135d884790d520d001545c6868f67bf
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2025-06-04T11:39:22+00:00
            Stats  : +8/-0 in 3 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/f54862208135d884790d520d001545c6868f67bf?branch=pr775-checkpolicy-revdeps

            Log:
            test if samba-bgqd can send data into /var/lib/samba/private/msg.sock/

Recent selinux-policy + samba testing revealed that SELinux prevents
the samba-bgqd process from sending data into UNIX datagram sockets
located in the /var/lib/samba/private/msg.sock/ directory. The TC
reproduces the situation on ppc64le machines.

In order to support the intentional samba-bgqd behavior, I believe
that SELinux policy should allow this action. The TC looks for
appropriate policy rules and file context patterns.

The TC covers RHEL-93731.

---
diff --git a/selinux-policy/samba-bgqd-and-similar/Makefile b/selinux-policy/samba-bgqd-and-similar/Makefile
index df25be8..e53e298 100644
--- a/selinux-policy/samba-bgqd-and-similar/Makefile
+++ b/selinux-policy/samba-bgqd-and-similar/Makefile
@@ -68,6 +68,7 @@ $(METADATA): Makefile
 	@echo "Bug:             RHEL-69517" >> $(METADATA) # RHEL-9
 	@echo "Bug:             RHEL-72860" >> $(METADATA) # RHEL-9
 	@echo "Bug:             RHEL-72861" >> $(METADATA) # RHEL-10
+	@echo "Bug:             RHEL-93731" >> $(METADATA) # RHEL-10
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/samba-bgqd-and-similar/main.fmf b/selinux-policy/samba-bgqd-and-similar/main.fmf
index ecf1d9c..9a8ed19 100644
--- a/selinux-policy/samba-bgqd-and-similar/main.fmf
+++ b/selinux-policy/samba-bgqd-and-similar/main.fmf
@@ -39,6 +39,7 @@ link:
   - verifies: https://issues.redhat.com/browse/RHEL-69517
   - verifies: https://issues.redhat.com/browse/RHEL-72860
   - verifies: https://issues.redhat.com/browse/RHEL-72861
+  - verifies: https://issues.redhat.com/browse/RHEL-93731
 adjust:
   - enabled: false
     when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8
@@ -46,3 +47,4 @@ adjust:
 extra-summary: /CoreOS/selinux-policy/Regression/samba-bgqd-and-similar
 extra-task: /CoreOS/selinux-policy/Regression/samba-bgqd-and-similar
 extra-nitrate: TC#0617974
+id: 1da15d16-92c5-405e-bc80-ed0ab0ea65a8

diff --git a/selinux-policy/samba-bgqd-and-similar/runtest.sh b/selinux-policy/samba-bgqd-and-similar/runtest.sh
index df5195b..e7d3fe7 100755
--- a/selinux-policy/samba-bgqd-and-similar/runtest.sh
+++ b/selinux-policy/samba-bgqd-and-similar/runtest.sh
@@ -87,6 +87,11 @@ rlJournalStart
         rlSESearchRule "allow samba_bgqd_t cupsd_var_run_t : sock_file { read write } [ ]"
         rlSESearchRule "allow samba_bgqd_t cupsd_t : unix_stream_socket { connectto } [ ]"
     rlPhaseEnd
+
+    rlPhaseStartTest "RHEL-93731"
+        rlSEMatchPathCon "/var/lib/samba/private/msg.sock/668534" "samba_var_t"
+        rlSESearchRule "allow samba_bgqd_t smbd_t : unix_dgram_socket { sendto } [ ]"
+    rlPhaseEnd
     fi
 
     if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then