[tests/selinux] pr775-checkpolicy-revdeps: test if gdm can talk to switcheroo via D-bus

[tests/selinux] pr775-checkpolicy-revdeps: test if gdm can talk to switcheroo via D-bus

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : a6904ef9bcf836cca8d182e67b1b1e7bd09ee586
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2025-06-06T11:01:24+00:00
            Stats  : +16/-2 in 4 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/a6904ef9bcf836cca8d182e67b1b1e7bd09ee586?branch=pr775-checkpolicy-revdeps

            Log:
            test if gdm can talk to switcheroo via D-bus

A recently filed customer case revealed that SELinux prevents
dbus-broker processes (executed by GDM or gnome-shell) from
communicating to switcheroo-control processes. The TC reproduces
the situation.

In order to support various GNOME features, I believe that SELinux
policy should allow this action. The TC looks for appropriate
policy rules and file context patterns.

The TC covers RHEL-93335 and RHEL-93535.

---
diff --git a/selinux-policy/switcheroo-control-and-similar/Makefile b/selinux-policy/switcheroo-control-and-similar/Makefile
index 2337eb8..1174fbd 100644
--- a/selinux-policy/switcheroo-control-and-similar/Makefile
+++ b/selinux-policy/switcheroo-control-and-similar/Makefile
@@ -55,7 +55,7 @@ $(METADATA): Makefile
 	@echo "TestTime:        15m" >> $(METADATA)
 	@echo "RunFor:          selinux-policy" >> $(METADATA)
 	@echo "RunFor:          switcheroo-control" >> $(METADATA)
-	@echo "Requires:        audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console switcheroo-control python3-gobject-base /usr/sbin/service" >> $(METADATA)
+	@echo "Requires:        audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console switcheroo-control python3-gobject-base /usr/sbin/service gdm" >> $(METADATA)
 	@echo "RhtsRequires:    library(selinux-policy/common)" >> $(METADATA)
 	@echo "Priority:        Normal" >> $(METADATA)
 	@echo "License:         GPLv2" >> $(METADATA)
@@ -64,6 +64,8 @@ $(METADATA): Makefile
 	@echo "Environment:     AVC_ERROR=+no_avc_check" >> $(METADATA)
 	@echo "Releases:        -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA)
 	@echo "Bug:             RHEL-24268" >> $(METADATA) # RHEL-9
+	@echo "Bug:             RHEL-93335" >> $(METADATA) # RHEL-9
+	@echo "Bug:             RHEL-93535" >> $(METADATA) # RHEL-10
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/switcheroo-control-and-similar/main.fmf b/selinux-policy/switcheroo-control-and-similar/main.fmf
index eb2d6bb..4c8ed75 100644
--- a/selinux-policy/switcheroo-control-and-similar/main.fmf
+++ b/selinux-policy/switcheroo-control-and-similar/main.fmf
@@ -21,6 +21,7 @@ recommend:
   - switcheroo-control
   - python3-gobject-base
   - /usr/sbin/service
+  - gdm
 environment:
     AVC_ERROR: +no_avc_check
 duration: 10m
@@ -34,6 +35,8 @@ tag:
   - NoRHIVOS
 link:
   - verifies: https://issues.redhat.com/browse/RHEL-24268
+  - verifies: https://issues.redhat.com/browse/RHEL-93335
+  - verifies: https://issues.redhat.com/browse/RHEL-93535
 adjust:
   - enabled: false
     when: distro == rhel-4, rhel-5, rhel-6, rhel-7

diff --git a/selinux-policy/switcheroo-control-and-similar/runtest.sh b/selinux-policy/switcheroo-control-and-similar/runtest.sh
index 243d0ee..f95007b 100755
--- a/selinux-policy/switcheroo-control-and-similar/runtest.sh
+++ b/selinux-policy/switcheroo-control-and-similar/runtest.sh
@@ -51,6 +51,7 @@ rlJournalStart
         rlAssertRpm ${SERVICE_PACKAGE}
 
         rlServiceStop ${SERVICE_NAME}
+        rlServiceStart gdm
 
         rlSESetEnforce
         rlSEStatus
@@ -78,6 +79,11 @@ rlJournalStart
         rlSESearchRule "allow unconfined_t switcheroo_control_t : dbus { send_msg } [ ]"
         rlSESearchRule "allow switcheroo_control_t unconfined_t : dbus { send_msg } [ ]"
     rlPhaseEnd
+
+    rlPhaseStartTest "RHEL-93335 + RHEL-93535"
+        rlSESearchRule "allow xdm_t switcheroo_control_t : dbus { send_msg } [ ]"
+        rlSESearchRule "allow switcheroo_control_t xdm_t : dbus { send_msg } [ ]"
+    rlPhaseEnd
     fi
 
     if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then

diff --git a/setroubleshoot/independent-on-initscripts/main.fmf b/setroubleshoot/independent-on-initscripts/main.fmf
index ffd5eb7..a5735d9 100644
--- a/setroubleshoot/independent-on-initscripts/main.fmf
+++ b/setroubleshoot/independent-on-initscripts/main.fmf
@@ -13,5 +13,8 @@ link:
   - verifies: https://issues.redhat.com/browse/RHEL-90842
 adjust:
   - enabled: false
-    when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, rhel-9, centos-stream-8, centos-stream-9
+    when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, rhel-9, centos-stream-8,
+        centos-stream-9
     continue: false
+extra-nitrate: TC#0619234
+id: 945c84e9-8e15-4ab6-a2be-65841c8e0a8a