[tests/selinux] pr775-checkpolicy-revdeps: kernel/CVE-2025-71085: fix netlabel setup

[tests/selinux] pr775-checkpolicy-revdeps: kernel/CVE-2025-71085: fix netlabel setup

[Ondrej Mosnacek]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 35144ba78dac0dcaf411cd0dca2474925c0b2f35
            Author : Ondrej Mosnacek <omosnace@redhat.com>
            Date   : 2026-02-24T11:35:17+01:00
            Stats  : +6/-2 in 1 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/35144ba78dac0dcaf411cd0dca2474925c0b2f35?branch=pr775-checkpolicy-revdeps

            Log:
            kernel/CVE-2025-71085: fix netlabel setup

The original reproducer would break network traffic outside IPv6
localhost- make sure there are default rules for unlabeled traffic so
that the machine doesn't lose network connectivity during test.

Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>

---
diff --git a/kernel/CVE-2025-71085/runtest.sh b/kernel/CVE-2025-71085/runtest.sh
index 0515868..1835976 100755
--- a/kernel/CVE-2025-71085/runtest.sh
+++ b/kernel/CVE-2025-71085/runtest.sh
@@ -13,10 +13,14 @@ rlJournalStart
 
         rlRun "gcc -o reproducer reproducer.c" 0 "Compile the reproducer"
 
-        rlRun "netlabelctl map del default" 0 "Delete default netlabel map"
         rlRun "netlabelctl calipso add pass doi:7" 0 "Set up CALIPSO"
+        rlRun "netlabelctl map del default" 0 "Delete default netlabel map"
+        rlRun "netlabelctl map add default address:0.0.0.0/0 protocol:unlbl" 0 \
+            "Set unlabeled traffic by default"
+        rlRun "netlabelctl map add default address:::/0 protocol:unlbl" 0 \
+            "Set unlabeled traffic by default"
         rlRun "netlabelctl map add default address:0::1/128 protocol:calipso,7" 0 \
-            "Set up CALIPSO netlabel map"
+            "Set up CALIPSO for localhost only"
     rlPhaseEnd
 
     rlPhaseStartTest