[PATCH 0/1] selinux-testsuite: Add watch_sb and watch_mount checks

[Richard Haines <richard_c_haines@btinternet.com>]

To test fanotify fs watch perms on 5.4+ (will also include tests/notify):

1) Extract the base module (base.cil):
      semodule -c -E base

2) Edit the following definitions in base.cil to add watch permissions:

   (common file (ioctl read write ....))
Add:
   watch watch_mount watch_sb watch_with_perm watch_reads

   (class filesystem (mount remount ....))
Add:
   watch

3) Insert modified base module (inserts with default priority 400):
       semodule -i base.cil

4) Backup, then edit the following definitions in:
       /usr/share/selinux/devel/include/support/all_perms.spt

   define(`all_file_perms',`{ ioctl read write ....
Add:
   watch watch_mount watch_sb watch_with_perm watch_reads

   define(`all_dir_perms',`{ ioctl read write ....
Add:
   watch watch_mount watch_sb watch_with_perm watch_reads

   define(`all_filesystem_perms',`{ mount remount ....
Add:
   watch

5) 'make test' can now be run. tests/filesystem should run 81 tests, and
   tests/fs_filesystem should run 79 tests. However one test will fail on
   current kernels (fix in 5.7) with fs_filesystem because:
'Failed as kernel 5.x without "selinux: fix regression introduced by
move_mount(2) syscall" patch'

NOTE: Do NOT leave the new base.cil active after tests, as the system may
not reboot if in enforcing mode, as various watch permissions will be denied.
Revert to the original (priority 100) as follows:

semodule -r base
make clean
make -C policy unload

Finally restore the original:
/usr/share/selinux/devel/include/support/all_perms.spt

Richard Haines (1):
  selinux-testsuite: Add watch_sb and watch_mount checks

 policy/Makefile                  |  3 ++
 policy/test_filesystem.te        | 15 -------
 policy/test_filesystem_notify.te | 60 ++++++++++++++++++++++++++
 tests/filesystem/Filesystem.pm   |  6 +--
 tests/filesystem/fanotify_fs.c   | 18 ++++++--
 tests/filesystem/test            | 74 ++++++++++++++++++++++++++++++--
 tests/fs_filesystem/test         | 74 ++++++++++++++++++++++++++++++--
 7 files changed, 221 insertions(+), 29 deletions(-)
 create mode 100644 policy/test_filesystem_notify.te

-- 
2.24.1