[tests/selinux] pr775-checkpolicy-revdeps: test if recent systemd generators issues are fixed

[tests/selinux] pr775-checkpolicy-revdeps: test if recent systemd generators issues are fixed

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : bd01c13f8cf93774efea22c5aa58f069331c4fb8
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2025-07-28T09:06:36+02:00
            Stats  : +16/-0 in 3 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/bd01c13f8cf93774efea22c5aa58f069331c4fb8?branch=pr775-checkpolicy-revdeps

            Log:
            test if recent systemd generators issues are fixed

Recent selinux-policy testing revealed that policies for various systemd
generators are not complete. For example:
 * SELinux prevented the vsftpd-generator program from executing commands
like mkdir, ls, ln, gawk etc.
 * SELinux prevented systemd-cryptsetup-generator from creating files like
/run/systemd/generator/systemd-cryptsetup@luks*.service

In order to support the functionality of various systemd generators,
I believe that SELinux policy allow the actions mentioned above. The TC
looks for appropriate policy rules and file context patterns.

The TC covers RHEL-98656, RHEL-100415 and RHEL-100721.

---
diff --git a/selinux-policy/systemd-generators/Makefile b/selinux-policy/systemd-generators/Makefile
index 9dbed8f..aab82d9 100644
--- a/selinux-policy/systemd-generators/Makefile
+++ b/selinux-policy/systemd-generators/Makefile
@@ -75,6 +75,9 @@ $(METADATA): Makefile
 	@echo "Bug:             2230226" >> $(METADATA) # Fedora 39
 	@echo "Bug:             RHEL-72549" >> $(METADATA) # RHEL-10
 	@echo "Bug:             RHEL-75879" >> $(METADATA) # RHEL-10
+	@echo "Bug:             RHEL-98656" >> $(METADATA) # RHEL-10
+	@echo "Bug:             RHEL-100415" >> $(METADATA) # RHEL-10
+	@echo "Bug:             RHEL-100721" >> $(METADATA) # RHEL-10
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/systemd-generators/main.fmf b/selinux-policy/systemd-generators/main.fmf
index 93b9231..ee5326b 100644
--- a/selinux-policy/systemd-generators/main.fmf
+++ b/selinux-policy/systemd-generators/main.fmf
@@ -35,6 +35,9 @@ link:
   - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2230226
   - verifies: https://issues.redhat.com/browse/RHEL-72549
   - verifies: https://issues.redhat.com/browse/RHEL-75879
+  - verifies: https://issues.redhat.com/browse/RHEL-98656
+  - verifies: https://issues.redhat.com/browse/RHEL-100415
+  - verifies: https://issues.redhat.com/browse/RHEL-100721
 adjust:
   - enabled: false
     when: distro == rhel-4, rhel-5, rhel-6, rhel-7

diff --git a/selinux-policy/systemd-generators/runtest.sh b/selinux-policy/systemd-generators/runtest.sh
index 1cd2a13..1024c7b 100755
--- a/selinux-policy/systemd-generators/runtest.sh
+++ b/selinux-policy/systemd-generators/runtest.sh
@@ -213,6 +213,16 @@ EOF
         rlRun "seinfo -a systemd_generator -x"
         rlSESearchRule "allow systemd_fstab_generator_t syslogd_t : unix_dgram_socket { sendto } [ ]"
     rlPhaseEnd
+
+    rlPhaseStartTest "RHEL-98656"
+        rlSEMatchPathCon "/usr/lib/systemd/system-generators/systemd-cryptsetup-generator" "systemd_cryptsetup_generator_exec_t"
+        rlSESearchRule "allow systemd_cryptsetup_generator_t systemd_unit_file_t : file { getattr create open write } [ ]"
+    rlPhaseEnd
+
+    rlPhaseStartTest "RHEL-100415 + RHEL-100721"
+        rlSEMatchPathCon "/usr/lib/systemd/system-generators/vsftpd-generator" "systemd_vsftpd_generator_exec_t"
+        rlSESearchRule "allow systemd_vsftpd_generator_t bin_t : file { execute execute_no_trans map } [ ]"
+    rlPhaseEnd
     fi
 
     ### generators from other packages: install them all?