public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
From: Milos Malik <mmalik@redhat.com>
To: git-commits@fedoraproject.org
Subject: [tests/selinux] pr775-checkpolicy-revdeps: test if tuned-ppd can watch certain dirs under /sys
Date: Fri, 11 Sep 2026 13:23:04 GMT [thread overview]
Message-ID: <178913298448.1.2059368179665560888.tests-selinux-b663bc4abf8b@fedoraproject.org> (raw)
A new commit has been pushed.
Repo : tests/selinux
Branch : pr775-checkpolicy-revdeps
Commit : b663bc4abf8bfe2467a1a1c7cce29e96834d89c1
Author : Milos Malik <mmalik@redhat.com>
Date : 2025-07-25T15:40:44+00:00
Stats : +22/-0 in 3 file(s)
URL : https://src.fedoraproject.org/tests/selinux/c/b663bc4abf8bfe2467a1a1c7cce29e96834d89c1?branch=pr775-checkpolicy-revdeps
Log:
test if tuned-ppd can watch certain dirs under /sys
Several recent bug reports revealed that SELinux prevents the tuned-ppd
processes from using the inotify_add_watch syscall on the following
directories:
* /sys/devices/system/cpu/intel_pstate (permission: watch)
* /sys/firmware/acpi (permission: watch_reads)
In order to support the expected tuned-ppd behavior, I believe that
SELinux policy should allow these actions. The TC looks for appropriate
policy rules and file context patterns.
The TC covers RHEL-101686, RHEL-101687, BZ#2358952 and their duplicates.
---
diff --git a/selinux-policy/tuned-ppd-and-similar/Makefile b/selinux-policy/tuned-ppd-and-similar/Makefile
index 5aa5106..3fabb16 100644
--- a/selinux-policy/tuned-ppd-and-similar/Makefile
+++ b/selinux-policy/tuned-ppd-and-similar/Makefile
@@ -65,11 +65,16 @@ $(METADATA): Makefile
@echo "Bug: RHEL-69450" >> $(METADATA) # RHEL-10
@echo "Bug: RHEL-69526" >> $(METADATA) # RHEL-9
@echo "Bug: RHEL-85849" >> $(METADATA) # RHEL-10
+ @echo "Bug: 2358952" >> $(METADATA) # Fedora 42
+ @echo "Bug: 2359047" >> $(METADATA) # Fedora 42
@echo "Bug: 2359851" >> $(METADATA) # Fedora 42
@echo "Bug: 2360026" >> $(METADATA) # Fedora 42
+ @echo "Bug: 2360121" >> $(METADATA) # Fedora 41
@echo "Bug: 2361423" >> $(METADATA) # Fedora 42
@echo "Bug: 2367076" >> $(METADATA) # Fedora 41
@echo "Bug: 2367711" >> $(METADATA) # Fedora 42
+ @echo "Bug: RHEL-101686" >> $(METADATA) # RHEL-10
+ @echo "Bug: RHEL-101687" >> $(METADATA) # RHEL-9
rhts-lint $(METADATA)
diff --git a/selinux-policy/tuned-ppd-and-similar/main.fmf b/selinux-policy/tuned-ppd-and-similar/main.fmf
index e02c525..48fc7ba 100644
--- a/selinux-policy/tuned-ppd-and-similar/main.fmf
+++ b/selinux-policy/tuned-ppd-and-similar/main.fmf
@@ -32,11 +32,16 @@ link:
- verifies: https://issues.redhat.com/browse/RHEL-69450
- verifies: https://issues.redhat.com/browse/RHEL-69526
- verifies: https://issues.redhat.com/browse/RHEL-85849
+ - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2358952
+ - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2359047
- verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2359851
- verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2360026
+ - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2360121
- verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2361423
- verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2367076
- verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2367711
+ - verifies: https://issues.redhat.com/browse/RHEL-101686
+ - verifies: https://issues.redhat.com/browse/RHEL-101687
adjust:
- enabled: false
when: distro < rhel-9.5
diff --git a/selinux-policy/tuned-ppd-and-similar/runtest.sh b/selinux-policy/tuned-ppd-and-similar/runtest.sh
index 0bc5804..cde5383 100755
--- a/selinux-policy/tuned-ppd-and-similar/runtest.sh
+++ b/selinux-policy/tuned-ppd-and-similar/runtest.sh
@@ -100,6 +100,18 @@ rlJournalStart
rlPhaseEnd
fi
+ if rlSEDefined "tuned_ppd_t" ; then
+ rlPhaseStartTest "RHEL-101686 + RHEL-101687"
+ rlSEMatchPathCon "/sys/devices/system/cpu/intel_pstate" "sysfs_t"
+ rlSESearchRule "allow tuned_ppd_t sysfs_t : dir { watch } [ ]"
+ rlPhaseEnd
+
+ rlPhaseStartTest "bz#2358952 + bz#2359047 + bz#2360121"
+ rlSEMatchPathCon "/sys/firmware/acpi" "sysfs_t"
+ rlSESearchRule "allow tuned_ppd_t sysfs_t : dir { watch_reads } [ ]"
+ rlPhaseEnd
+ fi
+
if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then
rlPhaseStartTest "real scenario -- standalone service"
if [ -f /usr/lib/systemd/system/gdm.service ] ; then
reply other threads:[~2026-09-11 13:23 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=178913298448.1.2059368179665560888.tests-selinux-b663bc4abf8b@fedoraproject.org \
--to=mmalik@redhat.com \
--cc=git-commits@fedoraproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox