[tests/selinux] pr775-checkpolicy-revdeps: Test that seunshare/sandbox doesn't execute shell commands when given

[tests/selinux] pr775-checkpolicy-revdeps: Test that seunshare/sandbox doesn't execute shell commands when given

[Veronika Syncakova]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : ed43635ec86fbdcef4b8350f6bb20593e222b8bc
            Author : Veronika Syncakova <veva.syncakova@gmail.com>
            Date   : 2026-04-08T08:09:56+00:00
            Stats  : +58/-0 in 2 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/ed43635ec86fbdcef4b8350f6bb20593e222b8bc?branch=pr775-checkpolicy-revdeps

            Log:
            Test that seunshare/sandbox doesn't execute shell commands when given
filenames with special characters.

The test was co-authored by Gemini and Claude.

TC coveres: RHEL-144055

---
diff --git a/policycoreutils/seunshare-drop-system-calls/main.fmf b/policycoreutils/seunshare-drop-system-calls/main.fmf
new file mode 100644
index 0000000..db2e2a7
--- /dev/null
+++ b/policycoreutils/seunshare-drop-system-calls/main.fmf
@@ -0,0 +1,24 @@
+summary: Test that seunshare/sandbox doesn't execute shell commands when given
+    filenames with special characters.
+contact: Veronika Syncakova <vsyncako@redhat.com>
+
+component:
+  - policycoreutils
+require:
+  - policycoreutils
+  - policycoreutils-sandbox
+duration: 10m
+enabled: true
+tag:
+  - NoRHEL4
+  - NoRHEL5
+  - NoRHEL6
+  - NoRHEL7
+  - NoRHEL8
+link:
+  - verifies: https://redhat.atlassian.net/browse/RHEL-144055
+  - verifies: https://redhat.atlassian.net/browse/RHEL-144041
+adjust+:
+  - enabled: false
+    when: distro < rhel-8
+    continue: false

diff --git a/policycoreutils/seunshare-drop-system-calls/runtest.sh b/policycoreutils/seunshare-drop-system-calls/runtest.sh
new file mode 100755
index 0000000..79cfb87
--- /dev/null
+++ b/policycoreutils/seunshare-drop-system-calls/runtest.sh
@@ -0,0 +1,34 @@
+#!/bin/bash
+
+# Include beakerlib environment
+. /usr/share/beakerlib/beakerlib.sh
+
+PACKAGE="policycoreutils-sandbox"
+TEST_DIR="/tmp/mytest"
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlAssertRpm ${PACKAGE}
+        rlRun "mkdir -p ${TEST_DIR}"
+    rlPhaseEnd
+
+    rlPhaseStartTest "RHEL-144055 + RHEL-144041"
+        # Create a file with malicious name 
+        rlRun -s "seunshare -Z unconfined_u:unconfined_r:sandbox_x_t:s0 \
+                -t ${TEST_DIR} \
+                -- /bin/bash -c \"touch \\\"/tmp/' ; id -Z ; '\\\"\""
+        rlRun "ls ${TEST_DIR} | grep '; id -Z ;' "
+        # Trigger rsync which processes filenames
+        rlRun -s "seunshare -Z unconfined_u:unconfined_r:sandbox_x_t:s0 \
+                -t ${TEST_DIR} \
+                -- /bin/bash -c \"touch \\\"/tmp/' ; id -Z ; '\\\"\" "
+        rlAssertNotGrep "command not found" $rlRun_LOG
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        rlRun "rm -rf ${TEST_DIR}"
+        rlRun "rm -f $rlRun_LOG"
+    rlPhaseEnd
+
+    rlJournalPrintText
+rlJournalEnd