[tests/selinux] pr775-checkpolicy-revdeps: test if iio-sensor-proxy can read iio:devices

[tests/selinux] pr775-checkpolicy-revdeps: test if iio-sensor-proxy can read iio:devices

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : eb4ef74ed863c36fce382c5a75af525c6aec7aaa
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2026-03-23T15:23:06+00:00
            Stats  : +11/-0 in 3 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/eb4ef74ed863c36fce382c5a75af525c6aec7aaa?branch=pr775-checkpolicy-revdeps

            Log:
            test if iio-sensor-proxy can read iio:devices

A CentOS stream 10 user reported that SELinux denials are triggered
when their device with a running iio-sensor-proxy service is rotated.
Further analysis revealed that iio-sensor-proxy cannot perform the
following activities:
 * read various character devices - /dev/iio:device*
 * create a UDP socket
 * write into in_accel_x_en, in_accel_y_en, in_accel_z_en files
   stored under /sys
 * add a new directory for a HID sensor device connected via PCI

The TC does not reproduce the situation.

In order to support the cooperation of iio-sensor-proxy and various
devices, I believe that SELinux policy should allow these actions.
The TC looks for appropriate policy rules and file context patterns.

The TC covers RHEL-110090.

---
diff --git a/selinux-policy/iio-sensor-proxy-and-similar/Makefile b/selinux-policy/iio-sensor-proxy-and-similar/Makefile
index 1de229f..d79e134 100644
--- a/selinux-policy/iio-sensor-proxy-and-similar/Makefile
+++ b/selinux-policy/iio-sensor-proxy-and-similar/Makefile
@@ -66,6 +66,7 @@ $(METADATA): Makefile
 	@echo "Bug:             RHEL-17346" >> $(METADATA) # RHEL-9
 	@echo "Bug:             RHEL-62355" >> $(METADATA) # RHEL-10
 	@echo "Bug:             RHEL-70850" >> $(METADATA) # RHEL-10
+	@echo "Bug:             RHEL-110090" >> $(METADATA) # RHEL-10
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/iio-sensor-proxy-and-similar/main.fmf b/selinux-policy/iio-sensor-proxy-and-similar/main.fmf
index d17b90f..5d6fd94 100644
--- a/selinux-policy/iio-sensor-proxy-and-similar/main.fmf
+++ b/selinux-policy/iio-sensor-proxy-and-similar/main.fmf
@@ -36,6 +36,7 @@ link:
   - verifies: https://issues.redhat.com/browse/RHEL-17346
   - verifies: https://issues.redhat.com/browse/RHEL-62355
   - verifies: https://issues.redhat.com/browse/RHEL-70850
+  - verifies: https://issues.redhat.com/browse/RHEL-110090
 adjust+:
   - enabled: false
     when: distro == rhel-4, rhel-5, rhel-6, rhel-7

diff --git a/selinux-policy/iio-sensor-proxy-and-similar/runtest.sh b/selinux-policy/iio-sensor-proxy-and-similar/runtest.sh
index 804509f..c89bd18 100755
--- a/selinux-policy/iio-sensor-proxy-and-similar/runtest.sh
+++ b/selinux-policy/iio-sensor-proxy-and-similar/runtest.sh
@@ -72,6 +72,15 @@ rlJournalStart
         rlSESearchRule "allow iiosensorproxy_t xdm_t : dbus { send_msg } [ ]"
         rlSESearchRule "allow iiosensorproxy_t iiosensorproxy_t : capability2 { bpf } [ ]"
     rlPhaseEnd
+
+    rlPhaseStartTest "RHEL-110090"
+        rlRun "semanage fcontext -l | grep '/dev/iio:device.*character.*iio_device_t'"
+        rlSEMatchPathCon "/dev/iio:device3" "iio_device_t"
+        rlSESearchRule "allow iiosensorproxy_t sysfs_t : dir { write } [ ]"
+        rlSESearchRule "allow iiosensorproxy_t sysfs_t : file { write } [ ]"
+        rlSESearchRule "allow iiosensorproxy_t iiosensorproxy_t : unix_dgram_socket { create } [ ]"
+        rlSESearchRule "allow iiosensorproxy_t iio_device_t : chr_file { read } [ ]"
+    rlPhaseEnd
     fi
 
     if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then