[tests/selinux] pr775-checkpolicy-revdeps: test if fapolicyd can connect to systemd-machined via its socket

[tests/selinux] pr775-checkpolicy-revdeps: test if fapolicyd can connect to systemd-machined via its socket

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 22bdc812bb0c32d4f280e1f2f697032a2fe1579c
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2025-08-18T14:47:05+02:00
            Stats  : +16/-2 in 3 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/22bdc812bb0c32d4f280e1f2f697032a2fe1579c?branch=pr775-checkpolicy-revdeps

            Log:
            test if fapolicyd can connect to systemd-machined via its socket

A combined fapolicyd + systemd-machined + selinux-policy testing
revealed that SELinux prevents the fapolicyd processes from connecting
to the systemd-machined process via its UNIX socket located at:
/run/systemd/userdb/io.systemd.Machine. The TC reproduces the situation.

In order to support this behavior dictated by the nsswitch configuration,
I believe that SELinux policy should allow this action. The TC looks for
appropriate policy rules and file context patterns.

The TC covers RHEL-77071.

---
diff --git a/selinux-policy/fapolicyd-and-similar/Makefile b/selinux-policy/fapolicyd-and-similar/Makefile
index cdfcfed..17eef10 100644
--- a/selinux-policy/fapolicyd-and-similar/Makefile
+++ b/selinux-policy/fapolicyd-and-similar/Makefile
@@ -55,7 +55,7 @@ $(METADATA): Makefile
 	@echo "TestTime:        10m" >> $(METADATA)
 	@echo "RunFor:          fapolicyd" >> $(METADATA)
 	@echo "RunFor:          selinux-policy" >> $(METADATA)
-	@echo "Requires:        audit initscripts libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console fapolicyd fapolicyd-selinux" >> $(METADATA)
+	@echo "Requires:        audit /usr/sbin/service libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console fapolicyd fapolicyd-selinux systemd-container" >> $(METADATA)
 	@echo "RhtsRequires:    library(selinux-policy/common)" >> $(METADATA)
 	@echo "Environment:     AVC_ERROR=+no_avc_check" >> $(METADATA)
 	@echo "Priority:        Normal" >> $(METADATA)
@@ -67,6 +67,7 @@ $(METADATA): Makefile
 	@echo "Bug:             1874491" >> $(METADATA) # Fedora 33
 	@echo "Bug:             1876538" >> $(METADATA) # Fedora 33
 	@echo "Bug:             1932225" >> $(METADATA)
+	@echo "Bug:             RHEL-77071" >> $(METADATA) # RHEL-10
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/fapolicyd-and-similar/main.fmf b/selinux-policy/fapolicyd-and-similar/main.fmf
index b3fed85..30e15a7 100644
--- a/selinux-policy/fapolicyd-and-similar/main.fmf
+++ b/selinux-policy/fapolicyd-and-similar/main.fmf
@@ -19,6 +19,7 @@ recommend:
   - setools-console
   - fapolicyd
   - fapolicyd-selinux
+  - systemd-container
 environment:
     AVC_ERROR: +no_avc_check
 duration: 10m
@@ -37,6 +38,7 @@ link:
   - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1874491
   - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1876538
   - relates: https://bugzilla.redhat.com/show_bug.cgi?id=1932225
+  - verifies: https://issues.redhat.com/browse/RHEL-77071
 adjust:
   - enabled: false
     when: distro == rhel-4, rhel-5, rhel-6, rhel-7

diff --git a/selinux-policy/fapolicyd-and-similar/runtest.sh b/selinux-policy/fapolicyd-and-similar/runtest.sh
index 77549b1..90f3d2f 100755
--- a/selinux-policy/fapolicyd-and-similar/runtest.sh
+++ b/selinux-policy/fapolicyd-and-similar/runtest.sh
@@ -109,10 +109,21 @@ rlJournalStart
             PROCESS_CONTEXT="unconfined_service_t"
         fi
         rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1
-        rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255
+        rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255
         rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1
     rlPhaseEnd
 
+    rlPhaseStartTest "RHEL-77071"
+        rlSESearchRule "allow fapolicyd_t systemd_machined_t : unix_stream_socket { connectto } [ ]"
+        rlRun "service systemd-machined start"
+        rlRun "service systemd-machined status -l"
+        rlRun "service fapolicyd start"
+        rlRun "service fapolicyd status -l"
+        sleep 5
+        rlRun "service fapolicyd stop"
+        rlRun "service systemd-machined stop"
+    rlPhaseEnd
+
     rlPhaseStartCleanup
         sleep 2
         rlSECheckAVC