[tests/selinux] pr775-checkpolicy-revdeps: Add a test for unexpected denials from sysctl -a

[Ondrej Mosnacek <omosnace@redhat.com>]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : a011b35f3677adb559bc205cfc7829d28563d404
            Author : Ondrej Mosnacek <omosnace@redhat.com>
            Date   : 2026-03-12T13:22:29+01:00
            Stats  : +91/-0 in 3 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/a011b35f3677adb559bc205cfc7829d28563d404?branch=pr775-checkpolicy-revdeps

            Log:
            Add a test for unexpected denials from sysctl -a

Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>

---
diff --git a/kernel/sysctl-avcs/main.fmf b/kernel/sysctl-avcs/main.fmf
new file mode 100644
index 0000000..968e37e
--- /dev/null
+++ b/kernel/sysctl-avcs/main.fmf
@@ -0,0 +1,22 @@
+summary: Test for unexpected denials from sysctl -a
+description: |
+    Verifes that running sysctl -a doesn't trigger unexpected capability
+    checks that would result in AVC denials even when access is allowed.
+contact: Ondrej Mosnacek <omosnace@redhat.com>
+component:
+  - kernel
+framework: beakerlib
+require:
+  - selinux-policy-devel
+duration: 10m
+tier: 2
+check:
+  - avc
+enabled: true
+adjust+:
+  - enabled: false
+    when: distro < rhel-9
+    because: RHEL-8 and below are not worth supporting by this test
+link:
+  - verifies: https://issues.redhat.com/browse/RHEL-135610
+  - verifies: https://issues.redhat.com/browse/RHEL-145590

diff --git a/kernel/sysctl-avcs/runtest.sh b/kernel/sysctl-avcs/runtest.sh
new file mode 100755
index 0000000..b8129a9
--- /dev/null
+++ b/kernel/sysctl-avcs/runtest.sh
@@ -0,0 +1,32 @@
+#!/bin/bash
+# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# SPDX-License-Identifier: GPLv2
+# Copyright (c) 2026 Red Hat, Inc.
+# Author: Ondrej Mosnacek <omosnace@redhat.com>
+
+# Include Beakerlib environment
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlRun "uname -r"
+
+        SE_ROLE="$(secon -r --pid $$)"
+        SE_TYPE="$(secon -t --pid $$)"
+
+        rlRun "make -f /usr/share/selinux/devel/Makefile test_policy.pp M4PARAM='-D TEST_ROLE=$SE_ROLE -D TEST_TYPE=$SE_TYPE'" 0 \
+            "Build the test policy"
+        rlRun "semodule -i test_policy.pp" 0 "Load test policy"
+    rlPhaseEnd
+
+    rlPhaseStartTest
+        rlRun "runcon -t test_domain_t sysctl -a"
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        rlRun "semodule -r test_policy" 0 "Unload test policy"
+        rlRun "make -f /usr/share/selinux/devel/Makefile clean" 0 \
+            "Clean the test policy"
+    rlPhaseEnd
+rlJournalPrintText
+rlJournalEnd

diff --git a/kernel/sysctl-avcs/test_policy.te b/kernel/sysctl-avcs/test_policy.te
new file mode 100644
index 0000000..bf53caa
--- /dev/null
+++ b/kernel/sysctl-avcs/test_policy.te
@@ -0,0 +1,37 @@
+policy_module(test_policy,1.0.0)
+
+type test_domain_t;
+domain_type(test_domain_t)
+
+corecmd_bin_entry_type(test_domain_t)
+kernel_read_all_sysctls(test_domain_t)
+kernel_read_security_state(test_domain_t)
+fs_read_binfmt_misc(test_domain_t)
+fs_search_auto_mountpoints(test_domain_t)
+
+# No interface for this in policy:
+require {
+	type binfmt_misc_fs_t;
+}
+list_dirs_pattern(test_domain_t, binfmt_misc_fs_t, binfmt_misc_fs_t)
+
+# Some BPF sysctls can only be read with CAP_SYS_ADMIN, so we need to silence
+# it.
+dontaudit test_domain_t self:capability sys_admin;
+
+require {
+	type TEST_TYPE;
+	role TEST_ROLE;
+}
+allow TEST_TYPE test_domain_t:process transition;
+role TEST_ROLE types test_domain_t;
+
+allow test_domain_t TEST_TYPE:fd use;
+allow test_domain_t TEST_TYPE:fifo_file rw_inherited_fifo_file_perms;
+allow test_domain_t TEST_TYPE:process { sigchld };
+
+files_search_tmp(test_domain_t)
+
+term_use_all_terms(test_domain_t)
+
+userdom_search_user_tmp_dirs(test_domain_t)