From 1663f9c1b178ed2c7b29b11aefaa707a7c2227d2 Mon Sep 17 00:00:00 2001 From: Milos Malik Date: Fri, 21 Mar 2025 16:31:54 +0100 Subject: [PATCH] test if systemd generators can send data to /run/systemd/journal/socket Recent system roles testing revealed that SELinux prevents various systemd generators from sending any data into /run/systemd/journal/socket. The TC does not reproduce the situation. In order to enable the use case in which systemd-journald is replaced by rsyslog, I believe that SELinux policy should allow these actions. The TC looks for appropriate policy rules and file context patterns. The TC covers RHEL-75879. --- selinux-policy/systemd-generators/Makefile | 1 + selinux-policy/systemd-generators/main.fmf | 1 + selinux-policy/systemd-generators/runtest.sh | 5 +++++ 3 files changed, 7 insertions(+) diff --git a/selinux-policy/systemd-generators/Makefile b/selinux-policy/systemd-generators/Makefile index 041e2b8..9dbed8f 100644 --- a/selinux-policy/systemd-generators/Makefile +++ b/selinux-policy/systemd-generators/Makefile @@ -74,6 +74,7 @@ $(METADATA): Makefile @echo "Releases: -RHEL7" >> $(METADATA) @echo "Bug: 2230226" >> $(METADATA) # Fedora 39 @echo "Bug: RHEL-72549" >> $(METADATA) # RHEL-10 + @echo "Bug: RHEL-75879" >> $(METADATA) # RHEL-10 rhts-lint $(METADATA) diff --git a/selinux-policy/systemd-generators/main.fmf b/selinux-policy/systemd-generators/main.fmf index 4e67f10..93b9231 100644 --- a/selinux-policy/systemd-generators/main.fmf +++ b/selinux-policy/systemd-generators/main.fmf @@ -34,6 +34,7 @@ tag: link: - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2230226 - verifies: https://issues.redhat.com/browse/RHEL-72549 + - verifies: https://issues.redhat.com/browse/RHEL-75879 adjust: - enabled: false when: distro == rhel-4, rhel-5, rhel-6, rhel-7 diff --git a/selinux-policy/systemd-generators/runtest.sh b/selinux-policy/systemd-generators/runtest.sh index f92caea..bc8be92 100755 --- a/selinux-policy/systemd-generators/runtest.sh +++ b/selinux-policy/systemd-generators/runtest.sh @@ -205,6 +205,11 @@ EOF rlSESearchRule "allow systemd_ssh_generator_t vsock_device_t : chr_file { getattr ioctl open read } [ ]" rlSESearchRule "allow systemd_ssh_generator_t systemd_unit_file_t : file { create getattr write open } [ ]" rlPhaseEnd + + rlPhaseStartTest "RHEL-75879" + rlRun "seinfo -a systemd_generator -x" + rlSESearchRule "allow systemd_fstab_generator_t syslogd_t : unix_dgram_socket { sendto } [ ]" + rlPhaseEnd fi ### generators from other packages: install them all?