[tests/selinux] pr775-checkpolicy-revdeps: test if mdevctl (virtnodedevd_t) can create dirs under /etc/mdevctl.d/

[tests/selinux] pr775-checkpolicy-revdeps: test if mdevctl (virtnodedevd_t) can create dirs under /etc/mdevctl.d/

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : c857e84cc919645408e9092fd398759561e08d50
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2025-07-24T08:14:25+00:00
            Stats  : +46/-0 in 4 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/c857e84cc919645408e9092fd398759561e08d50?branch=pr775-checkpolicy-revdeps

            Log:
            test if mdevctl (virtnodedevd_t) can create dirs under /etc/mdevctl.d/

A recent libvirt testing of mediated devices revealed that SELinux
prevents the mdevctl process (executed by the virtnodedevd service)
from creating directories under /etc/mdevctl.d/. The TC reproduces
the situation.

In order to enable the expected mdevctl behavior, I believe that
SELinux policy should allow this action. The TC looks for appropriate
policy rules and file context patterns.

The TC covers RHEL-98559.

test if virtqemud can reset PCI devices

Recently, an experimental libvirt + selinux-policy testing that
SELinux prevents the rpc-virtqemud process from writing (syscall =
openat) into /sys/bus/pci/devices/0000:00:00.0/config file. The TC
reproduces the situation.

In order to support the nodedev-reset function and to avoid unnecessary
SELinux denials, I believe that SELinux policy should allow this
action. The TC looks for appropriate policy rules and file context
patterns.

The TC covers RHEL-101417.

---
diff --git a/selinux-policy/virt-install-additional/Makefile b/selinux-policy/virt-install-additional/Makefile
index 0f7eedd..20b3ae0 100644
--- a/selinux-policy/virt-install-additional/Makefile
+++ b/selinux-policy/virt-install-additional/Makefile
@@ -74,6 +74,8 @@ $(METADATA): Makefile
 	@echo "Bug:             RHEL-69920" >> $(METADATA) # RHEL-10
 	@echo "Bug:             RHEL-74230" >> $(METADATA) # RHEL-10
 	@echo "Bug:             RHEL-76104" >> $(METADATA) # RHEL-10
+	@echo "Bug:             RHEL-98559" >> $(METADATA) # RHEL-10
+	@echo "Bug:             RHEL-101417" >> $(METADATA) # RHEL-10
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/virt-install-additional/main.fmf b/selinux-policy/virt-install-additional/main.fmf
index 06da58a..7cf0d61 100644
--- a/selinux-policy/virt-install-additional/main.fmf
+++ b/selinux-policy/virt-install-additional/main.fmf
@@ -49,6 +49,8 @@ link:
   - verifies: https://issues.redhat.com/browse/RHEL-69920
   - verifies: https://issues.redhat.com/browse/RHEL-74230
   - verifies: https://issues.redhat.com/browse/RHEL-76104
+  - verifies: https://issues.redhat.com/browse/RHEL-98559
+  - verifies: https://issues.redhat.com/browse/RHEL-101417
 adjust:
   - enabled: false
     when: distro == rhel-4, rhel-5, rhel-6, rhel-7

diff --git a/selinux-policy/virt-install-additional/nodedev.xml b/selinux-policy/virt-install-additional/nodedev.xml
new file mode 100644
index 0000000..7dcb0df
--- /dev/null
+++ b/selinux-policy/virt-install-additional/nodedev.xml
@@ -0,0 +1,7 @@
+<device>
+<parent>PLACEHOLDER</parent>
+<capability type="mdev">
+<type id="vfio_ccw-io" />
+<uuid>8d312cf6-f92a-485c-8db8-ba9299848f46</uuid>
+</capability>
+</device>

diff --git a/selinux-policy/virt-install-additional/runtest.sh b/selinux-policy/virt-install-additional/runtest.sh
index b05be78..313e7a4 100755
--- a/selinux-policy/virt-install-additional/runtest.sh
+++ b/selinux-policy/virt-install-additional/runtest.sh
@@ -332,6 +332,41 @@ rlJournalStart
         fi
     rlPhaseEnd
 
+    rlPhaseStartTest "RHEL-98559"
+        if rlSEDefined "virtnodedevd_t mdevctl_conf_t" ; then
+            rlSEMatchPathCon "/etc/mdevctl.d" "mdevctl_conf_t"
+            rlSESearchRule "allow virtnodedevd_t mdevctl_conf_t : dir { create } [ ]"
+        fi
+        rlRun "service virtqemud start"
+        rlRun "service virtnodedevd start"
+        rlRun "virsh nodedev-list | grep pci"
+        LAST_PCI_DEVICE=`virsh nodedev-list | grep pci | tail -n 1`
+        rlRun "sed -i \"s/PLACEHOLDER/${LAST_PCI_DEVICE}/\" nodedev.xml"
+        rlRun "cat nodedev.xml"
+        rlRun "virsh nodedev-define ./nodedev.xml"
+        sleep 1
+        rlRun "service virtnodedevd stop"
+        rlRun "service virtqemud stop"
+    rlPhaseEnd
+
+    rlPhaseStartTest "RHEL-101417"
+        if [ -d /sys/bus/pci/devices ] ; then
+            rlRun "find /sys/bus/pci/devices -type f -name config -ls"
+        fi
+        if seinfo -a | grep -q virt_driver_domain ; then
+            rlSESearchRule "allow virtqemud_t sysfs_t : file { write } [ ]"
+        fi
+        rlRun "service virtqemud start"
+        rlRun "service virtnodedevd start"
+        rlRun "virsh nodedev-list | grep pci"
+        for I in `virsh nodedev-list | grep pci` ; do
+            rlRun "virsh nodedev-reset $I" 0,1
+            sleep 1
+        done
+        rlRun "service virtnodedevd stop"
+        rlRun "service virtqemud stop"
+    rlPhaseEnd
+
     rlPhaseStartCleanup
         sleep 2
         rlSECheckAVC