[tests/selinux] main: Fix to accommodate the new attribute sys_resource_type

[tests/selinux] main: Fix to accommodate the new attribute sys_resource_type

[Veronika Syncakova]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : main
            Commit : 39d1965d56a2fca530f3cdc4bbd46c03e8d7320d
            Author : Veronika Syncakova <veva.syncakova@gmail.com>
            Date   : 2026-07-22T13:25:15+00:00
            Stats  : +2/-14 in 2 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/39d1965d56a2fca530f3cdc4bbd46c03e8d7320d?branch=main

            Log:
            Fix to accommodate the new attribute sys_resource_type

Allow the sys_resource capability to each domain which is allowed to
execute generic programs in system bin directories without domain
transition when the coreutils_bin_sys_resource tunable is on. If the
tunable is off, which is the default state, the capability is
dontaudited instead.

This test was nout counting with dontaudit rule beforehand. No avc will be present if the tunable
is off.

---
diff --git a/selinux-policy/coreutils-single/main.fmf b/selinux-policy/coreutils-single/main.fmf
index 76b94bd..4c4188f 100644
--- a/selinux-policy/coreutils-single/main.fmf
+++ b/selinux-policy/coreutils-single/main.fmf
@@ -19,9 +19,6 @@ recommend:
   - selinux-policy-targeted
 environment:
     AVC_ERROR: +no_avc_check
-check:
-  - how: avc
-    result: xfail
 duration: 10m
 enabled: true
 tag:

diff --git a/selinux-policy/coreutils-single/runtest.sh b/selinux-policy/coreutils-single/runtest.sh
index 5db41ac..743b295 100755
--- a/selinux-policy/coreutils-single/runtest.sh
+++ b/selinux-policy/coreutils-single/runtest.sh
@@ -18,11 +18,10 @@ rlJournalStart
         rlAssertRpm ${PACKAGE}
         rlSESetEnforce
         rlSEStatus
-        rlSESetTimestamp "General"
+        rlSESetTimestamp
     rlPhaseEnd
 
     rlPhaseStartTest "RHEL-141858"
-        rlSESetTimestamp "No_AVC"
         # Boolean and rule exists
         rlRun "getsebool -a | grep ${BOOLEAN}"
         rlSESearchRule "allow NetworkManager_dispatcher_chronyc_t self:capability {sys_resource} [ ${BOOLEAN} ]"
@@ -32,18 +31,10 @@ rlJournalStart
         rlSEBooleanOn ${BOOLEAN}
         rlRun "nmcli connection up ${INTERFACE_NAME}"
         sleep 5
-        rlSECheckAVC "No_AVC"
-
-        # AVC present when boolean is off
-        rlSESetTimestamp "Trigger_AVC"
-        rlRun "setsebool ${BOOLEAN} off"
-        rlRun "nmcli connection up ${INTERFACE_NAME}"
-        sleep 5
-        rlRun 'rlSEAVCCheck "Trigger_AVC"' 1
     rlPhaseEnd
 
     rlPhaseStartCleanup
-        rlSECheckAVC --ignore "type=AVC .* denied .* sys_resource .*:NetworkManager_dispatcher.* " "General"
+        rlSECheckAVC
         rlSEBooleanRestore ${BOOLEAN}
         if [ "$INSTALLED_VARIANT" = "regular" ]; then
             rlRun "yum -y install coreutils --allowerasing"