[tests/selinux] main: set immutable bit on the restorecond PID file

[tests/selinux] main: set immutable bit on the restorecond PID file

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : main
            Commit : 712c3f71d38b5d25b2a7a76c820d4c113aa4bb28
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2026-08-11T15:04:43+00:00
            Stats  : +7/-2 in 2 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/712c3f71d38b5d25b2a7a76c820d4c113aa4bb28?branch=main

            Log:
            set immutable bit on the restorecond PID file

The restorecond service does not really need its PID file, which means
that neither the systemd process nor the restorecond process should
create it or remove it.

Removal attempts are detected, because the test sets the immutable
bit on the PID file and then it looks for timeout messages in journal.

---
diff --git a/policycoreutils/restorecond-service-timeouts/main.fmf b/policycoreutils/restorecond-service-timeouts/main.fmf
index bd454be..64b970e 100644
--- a/policycoreutils/restorecond-service-timeouts/main.fmf
+++ b/policycoreutils/restorecond-service-timeouts/main.fmf
@@ -4,6 +4,7 @@ contact: Milos Malik <mmalik@redhat.com>
 component:
   - policycoreutils
 recommend:
+  - e2fsprogs
   - policycoreutils
   - policycoreutils-restorecond
 duration: 5m
@@ -27,4 +28,5 @@ adjust:
   - enabled: false
     when: distro == rhel-8, centos-stream-8
     because: the bug is not yet fixed there
+id: 24e8b000-43ab-4db7-8066-502cfc6ec48a
 

diff --git a/policycoreutils/restorecond-service-timeouts/runtest.sh b/policycoreutils/restorecond-service-timeouts/runtest.sh
index 0857ea2..d0e2058 100755
--- a/policycoreutils/restorecond-service-timeouts/runtest.sh
+++ b/policycoreutils/restorecond-service-timeouts/runtest.sh
@@ -12,18 +12,21 @@ rlJournalStart
     rlPhaseStartTest "RHEL-142541 + RHEL-165247"
         rlRun "grep ^Type=simple /usr/lib/systemd/system/restorecond.service"
         rlRun "touch /run/restorecond.pid"
-        rlRun "ls -lZ /run/restorecond.pid"
-        rlRun "ls -lZ /run/restorecond.pid | grep :var_run_t"
+        rlRun "chattr +i /run/restorecond.pid"
         rlRun "systemctl start restorecond.service"
         sleep 2
         rlRun -s "systemctl status restorecond.service -l"
         rlRun "grep -i -e '/run/restorecond.pid' -e 'failed.*timeout' $rlRun_LOG" 1
         rm -f $rlRun_LOG
+
+        rlRun "chattr -i /run/restorecond.pid"
+        rlRun "rm -f /run/restorecond.pid"
         rlRun "systemctl restart restorecond.service"
         sleep 2
         rlRun -s "systemctl status restorecond.service -l"
         rlRun "grep -i -e '/run/restorecond.pid' -e 'failed.*timeout' $rlRun_LOG" 1
         rm -f $rlRun_LOG
+        rlAssertNotExists /run/restorecond.pid
     rlPhaseEnd
 
     rlPhaseStartCleanup