[tests/selinux] pr775-checkpolicy-revdeps: test if tuned-ppd can create /etc/tuned/ppd_base_profile with correct label

[tests/selinux] pr775-checkpolicy-revdeps: test if tuned-ppd can create /etc/tuned/ppd_base_profile with correct label

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 1481683fec811ccb449a5af2883c9e9ea45bc050
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2025-06-10T12:39:42+00:00
            Stats  : +35/-1 in 3 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/1481683fec811ccb449a5af2883c9e9ea45bc050?branch=pr775-checkpolicy-revdeps

            Log:
            test if tuned-ppd can create /etc/tuned/ppd_base_profile with correct label

Several reported BZs revealed that the tuned-ppd process can
create an incorrectly labeled ppd_base_profile file under the
/etc/tuned directory if the file does not exist. The TC reproduces
the situation.

In order to fix this issue, SELinux policy should define a filename
transition rule which ensures that the correct SELinux label is applied
when the file is created. The TC looks for appropriate policy rules
and file context patterns.

The TC covers bz#2359851, bz#2361423 and their duplicates.

---
diff --git a/selinux-policy/tuned-ppd-and-similar/Makefile b/selinux-policy/tuned-ppd-and-similar/Makefile
index 695018b..5aa5106 100644
--- a/selinux-policy/tuned-ppd-and-similar/Makefile
+++ b/selinux-policy/tuned-ppd-and-similar/Makefile
@@ -65,7 +65,11 @@ $(METADATA): Makefile
 	@echo "Bug:             RHEL-69450" >> $(METADATA) # RHEL-10
 	@echo "Bug:             RHEL-69526" >> $(METADATA) # RHEL-9
 	@echo "Bug:             RHEL-85849" >> $(METADATA) # RHEL-10
+	@echo "Bug:             2359851" >> $(METADATA) # Fedora 42
+	@echo "Bug:             2360026" >> $(METADATA) # Fedora 42
+	@echo "Bug:             2361423" >> $(METADATA) # Fedora 42
 	@echo "Bug:             2367076" >> $(METADATA) # Fedora 41
+	@echo "Bug:             2367711" >> $(METADATA) # Fedora 42
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/tuned-ppd-and-similar/main.fmf b/selinux-policy/tuned-ppd-and-similar/main.fmf
index 559686f..e02c525 100644
--- a/selinux-policy/tuned-ppd-and-similar/main.fmf
+++ b/selinux-policy/tuned-ppd-and-similar/main.fmf
@@ -32,7 +32,11 @@ link:
   - verifies: https://issues.redhat.com/browse/RHEL-69450
   - verifies: https://issues.redhat.com/browse/RHEL-69526
   - verifies: https://issues.redhat.com/browse/RHEL-85849
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2359851
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2360026
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2361423
   - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2367076
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2367711
 adjust:
   - enabled: false
     when: distro < rhel-9.5

diff --git a/selinux-policy/tuned-ppd-and-similar/runtest.sh b/selinux-policy/tuned-ppd-and-similar/runtest.sh
index 95fd37a..85cdb7b 100755
--- a/selinux-policy/tuned-ppd-and-similar/runtest.sh
+++ b/selinux-policy/tuned-ppd-and-similar/runtest.sh
@@ -60,6 +60,7 @@ rlJournalStart
         rlAssertRpm ${SERVICE_PACKAGE}
 
         rlServiceStop ${SERVICE_NAME}
+        rlFileBackup /etc/tuned/ppd_base_profile
 
         rlSESetEnforce
         rlSEStatus
@@ -89,6 +90,16 @@ rlJournalStart
     rlPhaseEnd
     fi
 
+    if rlSEDefined "tuned_rw_etc_t tuned_ppd_t" ; then
+    rlPhaseStartTest "bz#2359851 + bz#2360026 + bz#2361423 + bz#2367711"
+        rlSEMatchPathCon "/etc/tuned" "tuned_etc_t"
+        rlSEMatchPathCon "/etc/tuned/ppd_base_profile" "tuned_rw_etc_t"
+        rlSESearchRule "type_transition tuned_ppd_t tuned_etc_t : file tuned_rw_etc_t ppd_base_profile"
+        rlSESearchRule "allow tuned_ppd_t tuned_etc_t : dir { write add_name } [ ]"
+        rlSESearchRule "allow tuned_ppd_t tuned_rw_etc_t : file { create write } [ ]"
+    rlPhaseEnd
+    fi
+
     if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then
     rlPhaseStartTest "real scenario -- standalone service"
         if [ -f /usr/lib/systemd/system/gdm.service ] ; then
@@ -100,7 +111,21 @@ rlJournalStart
         rlRun "busctl introspect net.hadess.PowerProfiles /org/freedesktop/UPower/PowerProfiles"
         rlRun "busctl introspect net.hadess.PowerProfiles /net/hadess/PowerProfiles"
         rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255
-        rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1
+        rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status" 1
+        rlRun "ls -Z /etc/tuned/ppd_base_profile"
+        rlRun "tuned-adm active"
+        rlRun "rm -f /etc/tuned/ppd_base_profile"
+        if tuned-adm active | grep -q powersave ; then
+            rlRun "tuned-adm profile balanced"
+        else
+            rlRun "tuned-adm profile powersave"
+        fi
+        sleep 2
+        rlRun "ls -Z /etc/tuned/ppd_base_profile"
+        rlRun "tuned-adm auto_profile"
+        rlRun "ls -Z /etc/tuned/ppd_base_profile | grep :tuned_rw_etc_t"
+        rlRun "tuned-adm verify"
+        rlSEService - ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "stop status" 1
         if [ -f /usr/lib/systemd/system/gdm.service ] ; then
             sleep 2
             rlRun "service gdm stop"
@@ -112,6 +137,7 @@ rlJournalStart
         sleep 2
         rlSECheckAVC
 
+        rlFileRestore
         rlServiceRestore ${SERVICE_NAME}
     rlPhaseEnd
 rlJournalPrintText