[tests/selinux] pr775-checkpolicy-revdeps: fix several failing tests

[tests/selinux] pr775-checkpolicy-revdeps: fix several failing tests

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 7a6077caace65b3b255e78acc616bc4c4ac1be53
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2025-08-26T07:55:35+00:00
            Stats  : +12/-6 in 8 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/7a6077caace65b3b255e78acc616bc4c4ac1be53?branch=pr775-checkpolicy-revdeps

            Log:
            fix several failing tests

Several automated tests were updated, because they were failing on
RHEL-10 machines. The list of reasons follows:
 * incorrect test relevancy
 * unimportant SELinux denials
 * newly defined SELinux labels
 * missing metadata

---
diff --git a/selinux-policy/hostapd-and-similar/runtest.sh b/selinux-policy/hostapd-and-similar/runtest.sh
index aee5619..c36d878 100755
--- a/selinux-policy/hostapd-and-similar/runtest.sh
+++ b/selinux-policy/hostapd-and-similar/runtest.sh
@@ -100,6 +100,7 @@ rlJournalStart
     rlPhaseStartTest "real scenario -- standalone service"
         rlRun "echo ${ROOT_PASSWORD} | passwd --stdin root"
         rlRun "modprobe mac80211_hwsim"
+        rlRun "lsmod | grep mac80211_hwsim"
         rlRun "sed -i 's/^interface=.*$//' /etc/hostapd/hostapd.conf"
         rlRun "sed -i 's/^hw_mode=.*$//' /etc/hostapd/hostapd.conf"
         rlRun "sed -i 's/^channel=.*$//' /etc/hostapd/hostapd.conf"

diff --git a/selinux-policy/iio-sensor-proxy-and-similar/main.fmf b/selinux-policy/iio-sensor-proxy-and-similar/main.fmf
index ad25712..633e118 100644
--- a/selinux-policy/iio-sensor-proxy-and-similar/main.fmf
+++ b/selinux-policy/iio-sensor-proxy-and-similar/main.fmf
@@ -40,6 +40,9 @@ adjust:
   - enabled: false
     when: distro == rhel-4, rhel-5, rhel-6, rhel-7
     because: the iio-sensor-proxy package is not available there
+  - enabled: false
+    when: arch == s390x
+    because: the service is not activatable there
 extra-summary: /CoreOS/selinux-policy/Regression/iio-sensor-proxy-and-similar
 extra-task: /CoreOS/selinux-policy/Regression/iio-sensor-proxy-and-similar
 extra-nitrate: TC#0617897

diff --git a/selinux-policy/pam_limits-and-related/runtest.sh b/selinux-policy/pam_limits-and-related/runtest.sh
index dc56fa8..e788de1 100755
--- a/selinux-policy/pam_limits-and-related/runtest.sh
+++ b/selinux-policy/pam_limits-and-related/runtest.sh
@@ -82,7 +82,7 @@ rlJournalStart
 
     rlPhaseStartCleanup
         sleep 2
-        rlSECheckAVC
+        rlSECheckAVC --ignore 'type=AVC.*connectto.*:guest_t:.*:systemd_machined_t:' --ignore 'type=AVC.*connectto.*:xguest_t:.*:systemd_machined_t:'
 
         rlFileRestore
     rlPhaseEnd

diff --git a/selinux-policy/systemd-generators/runtest.sh b/selinux-policy/systemd-generators/runtest.sh
index 1024c7b..d52e632 100755
--- a/selinux-policy/systemd-generators/runtest.sh
+++ b/selinux-policy/systemd-generators/runtest.sh
@@ -202,7 +202,7 @@ EOF
     rlPhaseStartTest "RHEL-72549"
         rlSEMatchPathCon "/usr/lib/systemd/system-generators/systemd-ssh-generator" "systemd_ssh_generator_exec_t"
         rlSEMatchPathCon "/dev/vsock" "vsock_device_t"
-        rlSEMatchPathCon "/run/systemd/generator/sshd-vsock.socket" "systemd_unit_file_t"
+        rlSEMatchPathCon "/run/systemd/generator/sshd-vsock.socket" "systemd_generator_unit_file_t"
         rlSESearchRule "allow init_t systemd_ssh_generator_exec_t : file { getattr open read execute } [ ]"
         rlSESearchRule "type_transition init_t systemd_ssh_generator_exec_t : process systemd_ssh_generator_t"
         rlSESearchRule "allow systemd_ssh_generator_t vsock_device_t : chr_file { getattr ioctl open read } [ ]"

diff --git a/selinux-policy/systemd-homed/main.fmf b/selinux-policy/systemd-homed/main.fmf
index 25edf64..ef2d162 100644
--- a/selinux-policy/systemd-homed/main.fmf
+++ b/selinux-policy/systemd-homed/main.fmf
@@ -27,7 +27,7 @@ link:
   - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2316163
 adjust:
   - enabled: false
-    when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, rhel-9, centos-stream-8, centos-stream-9
+    when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8, rhel-9, centos-stream-8, centos-stream-9, rhel-10, centos-stream-10
     because: the systemd-homed program is not available there
 extra-summary: /CoreOS/selinux-policy/Regression/systemd-homed
 extra-task: /CoreOS/selinux-policy/Regression/systemd-homed

diff --git a/selinux-policy/systemd-userdbd-and-similar/runtest.sh b/selinux-policy/systemd-userdbd-and-similar/runtest.sh
index 6932575..3120cf3 100755
--- a/selinux-policy/systemd-userdbd-and-similar/runtest.sh
+++ b/selinux-policy/systemd-userdbd-and-similar/runtest.sh
@@ -106,7 +106,7 @@ rlJournalStart
             PROCESS_CONTEXT="unconfined_service_t"
         fi
         rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "start status" 1
-        rlRun "restorecon -Rv /run /var -e /var/ARTIFACTS" 0-255
+        rlRun "restorecon -Rv /etc /run /var -e /var/ARTIFACTS" 0-255
         rlSEService ${ROOT_PASSWORD} ${SERVICE_NAME} ${PROCESS_NAME} ${PROCESS_CONTEXT} "restart status stop status" 1
     rlPhaseEnd
 
@@ -121,7 +121,7 @@ rlJournalStart
 
     rlPhaseStartCleanup
         sleep 2
-        rlSECheckAVC
+        rlSECheckAVC --ignore 'type=AVC.*connectto.*userdbctl.*:guest_t:.*:systemd_machined_t:' --ignore 'type=AVC.*connectto.*userdbctl.*:xguest_t:.*:systemd_machined_t:'
 
         rlFileRestore
         rlServiceRestore ${SERVICE_NAME}

diff --git a/selinux-policy/tlshd-and-similar/runtest.sh b/selinux-policy/tlshd-and-similar/runtest.sh
index bf67f0e..0e13e00 100755
--- a/selinux-policy/tlshd-and-similar/runtest.sh
+++ b/selinux-policy/tlshd-and-similar/runtest.sh
@@ -80,7 +80,7 @@ rlJournalStart
         rlSESearchRule "allow ktlshd_t cert_t : dir { search } [ ]"
         rlSESearchRule "allow ktlshd_t cert_t : file { getattr open read } [ ]"
         rlSESearchRule "allow ktlshd_t net_conf_t : file { getattr open read } [ ]"
-        rlSESearchRule "allow ktlshd_t proc_net_t : lnk_file { read } [ ]"
+        # rlSESearchRule "allow ktlshd_t proc_net_t : lnk_file { read } [ ]"
         rlSESearchRule "allow ktlshd_t ktlshd_t : netlink_route_socket { bind create getattr getopt nlmsg_read setopt } [ ]"
         rlSESearchRule "allow ktlshd_t ktlshd_t : udp_socket { connect create getattr setopt } [ ]"
         rlSESearchRule "allow ktlshd_t sysctl_net_t : dir { search } [ ]"

diff --git a/selinux-policy/valkey-and-similar/main.fmf b/selinux-policy/valkey-and-similar/main.fmf
index 4029ed9..110f6a2 100644
--- a/selinux-policy/valkey-and-similar/main.fmf
+++ b/selinux-policy/valkey-and-similar/main.fmf
@@ -35,3 +35,5 @@ adjust:
   - enabled: false
     when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-8
     because: the package is not available there
+extra-nitrate: TC#0619564
+id: 337de041-c42f-4292-99d4-f687ec629fc9