[tests/selinux] main: Add selinux-policy/nfs-kernel-execute-special-files test

[tests/selinux] main: Add selinux-policy/nfs-kernel-execute-special-files test

[Ondrej Mosnacek]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : main
            Commit : 73d6b01313e4b7899445344324e5f25ae4780601
            Author : Ondrej Mosnacek <omosnace@redhat.com>
            Date   : 2026-09-22T11:42:28+00:00
            Stats  : +100/-0 in 2 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/73d6b01313e4b7899445344324e5f25ae4780601?branch=main

            Log:
            Add selinux-policy/nfs-kernel-execute-special-files test

Verifies that calling access(2) on special files (symlink, blk file,
chr file, fifo) doesn't fail on SELinux denials on the server side.

---
diff --git a/selinux-policy/nfs-kernel-execute-special-files/main.fmf b/selinux-policy/nfs-kernel-execute-special-files/main.fmf
new file mode 100644
index 0000000..a9773f9
--- /dev/null
+++ b/selinux-policy/nfs-kernel-execute-special-files/main.fmf
@@ -0,0 +1,29 @@
+summary: Test access(2) on special files shared through NFS
+description: |
+    Verifies that calling access(2) on special files (symlink, blk file,
+    chr file, fifo) doesn't fail on SELinux denials on the server side.
+contact: Ondrej Mosnacek <omosnace@redhat.com>
+component:
+  - selinux-policy
+framework: beakerlib
+require:
+  - library(selinux-policy/common)
+  - python3
+  - nfs-utils
+environment:
+    AVC_ERROR: +no_avc_check
+duration: 5m
+tier: 2
+enabled: true
+adjust+:
+  - enabled: false
+    when: distro < fedora-45
+    because: Not yet fixed in Fedora
+  - enabled: false
+    when: distro < centos-stream-11
+    because: Not yet fixed in CentOS
+  - enabled: false
+    when: distro < rhel-11
+    because: Not yet fixed in RHEL
+link:
+  - verifies: https://redhat.atlassian.net/browse/RHEL-72728

diff --git a/selinux-policy/nfs-kernel-execute-special-files/runtest.sh b/selinux-policy/nfs-kernel-execute-special-files/runtest.sh
new file mode 100755
index 0000000..1a8093c
--- /dev/null
+++ b/selinux-policy/nfs-kernel-execute-special-files/runtest.sh
@@ -0,0 +1,71 @@
+#!/bin/bash
+# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+# SPDX-License-Identifier: GPL-2.0
+# Copyright (c) 2026 Red Hat, Inc.
+# Author: Ondrej Mosnacek <omosnace@redhat.com>
+
+# Include Beakerlib environment
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlImport 'selinux-policy/common' 0,1
+
+        rlAssertRpm selinux-policy
+        rlAssertRpm selinux-policy-targeted
+
+        rlRun "uname -r" 0 "Print running kernel version"
+
+        rlSESetEnforce
+        rlSEStatus
+
+        rlLog "Set up the test files"
+        rlRun "tmpdir=\"\$(mktemp -d)\""
+        rlRun "ln -s test \"\$tmpdir/link\""
+        rlRun "mkfifo \"\$tmpdir/fifo\""
+        rlRun "mknod \"\$tmpdir/chrdev\" c 1 3"
+        rlRun "mknod \"\$tmpdir/blkdev\" b 0 7"
+        rlRun "chmod ugo+rwx \"\$tmpdir/\"{fifo,chrdev,blkdev}"
+        rlRun "ls -lZ \"\$tmpdir\""
+
+        rlLog "Set up the NFS stuff"
+        rlRun "systemctl start nfs-server"
+        rlRun "exportfs -o rw,no_root_squash,fsid=0 \"localhost:\$tmpdir\""
+        rlRun "mntpoint=\"\$(mktemp -d -p /mnt)\""
+        rlRun "mount -t nfs -o nfsvers=4.1 localhost:/ \"\$mntpoint\""
+    rlPhaseEnd
+
+    rlPhaseStartTest "Policy rules"
+        rlLog "kernel_t should be allowed the execute permission on special files"
+
+        rlSESearchRule "allow kernel_t file_type:lnk_file  { execute } []"
+        rlSESearchRule "allow kernel_t file_type:chr_file  { execute } []"
+        rlSESearchRule "allow kernel_t file_type:blk_file  { execute } []"
+        rlSESearchRule "allow kernel_t file_type:fifo_file { execute } []"
+    rlPhaseEnd
+
+    rlPhaseStartTest "Real scenario"
+        rlLog "Should work with no AVCs"
+
+        rlSESetTimestamp
+        sleep 1
+        for f in link fifo chrdev blkdev; do
+            # We would like to test that access(2) actually succeeds, but
+            # it currently fails anyway due to a kernel bug (fix pending).
+            # Thus, ignore the exit code here for now.
+            rlRun "python3 -c \"import os; assert os.access('\$mntpoint/$f', os.R_OK|os.X_OK, follow_symlinks=False)\"" 0-1
+        done
+        sleep 1
+        rlSECheckAVC
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        rlRun "umount \"\$mntpoint\""
+        rlRun "rmdir \"\$mntpoint\""
+        rlRun "exportfs -u \"localhost:\$tmpdir\""
+        rlRun "systemctl stop nfs-server"
+        rlRun "rm -rf \"\$tmpdir\""
+    rlPhaseEnd
+
+rlJournalPrintText
+rlJournalEnd