[tests/selinux] pr775-checkpolicy-revdeps: test if tuned-ppd can watch certain dirs under /sys

[tests/selinux] pr775-checkpolicy-revdeps: test if tuned-ppd can watch certain dirs under /sys

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : b663bc4abf8bfe2467a1a1c7cce29e96834d89c1
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2025-07-25T15:40:44+00:00
            Stats  : +22/-0 in 3 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/b663bc4abf8bfe2467a1a1c7cce29e96834d89c1?branch=pr775-checkpolicy-revdeps

            Log:
            test if tuned-ppd can watch certain dirs under /sys

Several recent bug reports revealed that SELinux prevents the tuned-ppd
processes from using the inotify_add_watch syscall on the following
directories:

 * /sys/devices/system/cpu/intel_pstate (permission: watch)
 * /sys/firmware/acpi (permission: watch_reads)

In order to support the expected tuned-ppd behavior, I believe that
SELinux policy should allow these actions. The TC looks for appropriate
policy rules and file context patterns.

The TC covers RHEL-101686, RHEL-101687, BZ#2358952 and their duplicates.

---
diff --git a/selinux-policy/tuned-ppd-and-similar/Makefile b/selinux-policy/tuned-ppd-and-similar/Makefile
index 5aa5106..3fabb16 100644
--- a/selinux-policy/tuned-ppd-and-similar/Makefile
+++ b/selinux-policy/tuned-ppd-and-similar/Makefile
@@ -65,11 +65,16 @@ $(METADATA): Makefile
 	@echo "Bug:             RHEL-69450" >> $(METADATA) # RHEL-10
 	@echo "Bug:             RHEL-69526" >> $(METADATA) # RHEL-9
 	@echo "Bug:             RHEL-85849" >> $(METADATA) # RHEL-10
+	@echo "Bug:             2358952" >> $(METADATA) # Fedora 42
+	@echo "Bug:             2359047" >> $(METADATA) # Fedora 42
 	@echo "Bug:             2359851" >> $(METADATA) # Fedora 42
 	@echo "Bug:             2360026" >> $(METADATA) # Fedora 42
+	@echo "Bug:             2360121" >> $(METADATA) # Fedora 41
 	@echo "Bug:             2361423" >> $(METADATA) # Fedora 42
 	@echo "Bug:             2367076" >> $(METADATA) # Fedora 41
 	@echo "Bug:             2367711" >> $(METADATA) # Fedora 42
+	@echo "Bug:             RHEL-101686" >> $(METADATA) # RHEL-10
+	@echo "Bug:             RHEL-101687" >> $(METADATA) # RHEL-9
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/tuned-ppd-and-similar/main.fmf b/selinux-policy/tuned-ppd-and-similar/main.fmf
index e02c525..48fc7ba 100644
--- a/selinux-policy/tuned-ppd-and-similar/main.fmf
+++ b/selinux-policy/tuned-ppd-and-similar/main.fmf
@@ -32,11 +32,16 @@ link:
   - verifies: https://issues.redhat.com/browse/RHEL-69450
   - verifies: https://issues.redhat.com/browse/RHEL-69526
   - verifies: https://issues.redhat.com/browse/RHEL-85849
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2358952
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2359047
   - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2359851
   - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2360026
+  - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2360121
   - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2361423
   - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2367076
   - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2367711
+  - verifies: https://issues.redhat.com/browse/RHEL-101686
+  - verifies: https://issues.redhat.com/browse/RHEL-101687
 adjust:
   - enabled: false
     when: distro < rhel-9.5

diff --git a/selinux-policy/tuned-ppd-and-similar/runtest.sh b/selinux-policy/tuned-ppd-and-similar/runtest.sh
index 0bc5804..cde5383 100755
--- a/selinux-policy/tuned-ppd-and-similar/runtest.sh
+++ b/selinux-policy/tuned-ppd-and-similar/runtest.sh
@@ -100,6 +100,18 @@ rlJournalStart
     rlPhaseEnd
     fi
 
+    if rlSEDefined "tuned_ppd_t" ; then
+    rlPhaseStartTest "RHEL-101686 + RHEL-101687"
+        rlSEMatchPathCon "/sys/devices/system/cpu/intel_pstate" "sysfs_t"
+        rlSESearchRule "allow tuned_ppd_t sysfs_t : dir { watch } [ ]"
+    rlPhaseEnd
+
+    rlPhaseStartTest "bz#2358952 + bz#2359047 + bz#2360121"
+        rlSEMatchPathCon "/sys/firmware/acpi" "sysfs_t"
+        rlSESearchRule "allow tuned_ppd_t sysfs_t : dir { watch_reads } [ ]"
+    rlPhaseEnd
+    fi
+
     if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then
     rlPhaseStartTest "real scenario -- standalone service"
         if [ -f /usr/lib/systemd/system/gdm.service ] ; then