[tests/selinux] pr775-checkpolicy-revdeps: test if dhcpcd-run-hooks can write into /etc/chrony.conf file

[tests/selinux] pr775-checkpolicy-revdeps: test if dhcpcd-run-hooks can write into /etc/chrony.conf file

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 98bb59b1586d438257af93814806c9a231ba91e8
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2025-11-13T08:21:12+00:00
            Stats  : +13/-0 in 3 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/98bb59b1586d438257af93814806c9a231ba91e8?branch=pr775-checkpolicy-revdeps

            Log:
            test if dhcpcd-run-hooks can write into /etc/chrony.conf file

A recent dhcpcd + selinux-policy testing revealed that SELinux
prevents the running dhcpcd-run-hooks script from writing into
/etc/chrony.conf file on s390x machines. The TC reproduces the
situation, which is accompanied by the following error message:

  dhcpcd[...]: /usr/libexec/dhcpcd-run-hooks: line 132: /etc/chrony.conf: Permission denied

In order to support the intended dhcpcd-run-hooks function and
to avoid such errors in the journal, I believe that SELinux
policy should allow the access. The TC looks for appropriate
policy rules and file context patterns.

The TC covers RHEL-113937 and RHEL-113941.

---
diff --git a/selinux-policy/dhcpcd-and-similar/Makefile b/selinux-policy/dhcpcd-and-similar/Makefile
index 4b3f11f..eb537ff 100644
--- a/selinux-policy/dhcpcd-and-similar/Makefile
+++ b/selinux-policy/dhcpcd-and-similar/Makefile
@@ -69,6 +69,8 @@ $(METADATA): Makefile
 	@echo "Bug:             2270733" >> $(METADATA) # Fedora 41
 	@echo "Bug:             RHEL-33081" >> $(METADATA) # RHEL-10
 	@echo "Bug:             RHEL-43417" >> $(METADATA) # RHEL-10
+	@echo "Bug:             RHEL-113937" >> $(METADATA) # RHEL-10
+	@echo "Bug:             RHEL-113941" >> $(METADATA) # RHEL-9
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/dhcpcd-and-similar/main.fmf b/selinux-policy/dhcpcd-and-similar/main.fmf
index ed382df..939e1cd 100644
--- a/selinux-policy/dhcpcd-and-similar/main.fmf
+++ b/selinux-policy/dhcpcd-and-similar/main.fmf
@@ -37,6 +37,8 @@ link:
   - verifies: https://bugzilla.redhat.com/show_bug.cgi?id=2270733
   - verifies: https://issues.redhat.com/browse/RHEL-33081
   - verifies: https://issues.redhat.com/browse/RHEL-43417
+  - verifies: https://issues.redhat.com/browse/RHEL-113937
+  - verifies: https://issues.redhat.com/browse/RHEL-113941
 adjust+:
   - enabled: false
     when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7

diff --git a/selinux-policy/dhcpcd-and-similar/runtest.sh b/selinux-policy/dhcpcd-and-similar/runtest.sh
index c856c12..6fcebba 100755
--- a/selinux-policy/dhcpcd-and-similar/runtest.sh
+++ b/selinux-policy/dhcpcd-and-similar/runtest.sh
@@ -109,6 +109,15 @@ rlJournalStart
     rlPhaseEnd
     fi
 
+    if rlIsRHEL '> 9.7' || rlIsRHEL '> 10.1' ; then
+    rlPhaseStartTest "RHEL-113937 + RHEL-113941"
+        rlSEMatchPathCon "/usr/libexec/dhcpcd-run-hooks" "bin_t"
+        CONF_FILE_CONTEXT=`secon --type --file /etc/chrony.conf`
+        rlSESearchRule "allow dhcpc_t ${CONF_FILE_CONTEXT} : file { write } [ ]"
+    rlPhase
+    fi
+
+
     rlPhaseStartTest "real scenario -- standalone service"
         if ! rlIsRHEL "<9.5" ; then
             rlRun "ip netns add test-ns"