public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
From: Milos Malik <mmalik@redhat.com>
To: git-commits@fedoraproject.org
Subject: [tests/selinux] pr775-checkpolicy-revdeps: test if dhcpc hook can execute resolvectl
Date: Fri, 11 Sep 2026 13:23:36 GMT [thread overview]
Message-ID: <178913301620.1.9000541480821735499.tests-selinux-321b81e71749@fedoraproject.org> (raw)
A new commit has been pushed.
Repo : tests/selinux
Branch : pr775-checkpolicy-revdeps
Commit : 321b81e7174966b265c67834a3e066abd158e4f0
Author : Milos Malik <mmalik@redhat.com>
Date : 2026-03-06T13:27:25+00:00
Stats : +19/-4 in 3 file(s)
URL : https://src.fedoraproject.org/tests/selinux/c/321b81e7174966b265c67834a3e066abd158e4f0?branch=pr775-checkpolicy-revdeps
Log:
test if dhcpc hook can execute resolvectl
Recent selinux-policy + dhcpcd + systemd-resolved testing revealed
SELinux denials caused by dhcpc hooks running the resolvectl program.
The TC reproduces the situation.
In order to support the dhcpcd service and its hooks fully, I believe
that SELinux policy allow the necessary actions. The TC looks for
appropriate policy rules and file context patterns.
The TC covers RHEL-147153 and RHEL-147155.
---
diff --git a/selinux-policy/dhcpcd-and-similar/Makefile b/selinux-policy/dhcpcd-and-similar/Makefile
index eb537ff..5ed2841 100644
--- a/selinux-policy/dhcpcd-and-similar/Makefile
+++ b/selinux-policy/dhcpcd-and-similar/Makefile
@@ -54,7 +54,7 @@ $(METADATA): Makefile
@echo "Type: Regression" >> $(METADATA)
@echo "TestTime: 10m" >> $(METADATA)
@echo "RunFor: selinux-policy" >> $(METADATA)
- @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console dhcpcd /usr/sbin/service iproute" >> $(METADATA)
+ @echo "Requires: audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console dhcpcd /usr/sbin/service iproute systemd-resolved" >> $(METADATA)
@echo "RhtsRequires: library(selinux-policy/common)" >> $(METADATA)
@echo "Environment: AVC_ERROR=+no_avc_check" >> $(METADATA)
@echo "Priority: Normal" >> $(METADATA)
@@ -71,6 +71,8 @@ $(METADATA): Makefile
@echo "Bug: RHEL-43417" >> $(METADATA) # RHEL-10
@echo "Bug: RHEL-113937" >> $(METADATA) # RHEL-10
@echo "Bug: RHEL-113941" >> $(METADATA) # RHEL-9
+ @echo "Bug: RHEL-147153" >> $(METADATA) # RHEL-10
+ @echo "Bug: RHEL-147155" >> $(METADATA) # RHEL-9
rhts-lint $(METADATA)
diff --git a/selinux-policy/dhcpcd-and-similar/main.fmf b/selinux-policy/dhcpcd-and-similar/main.fmf
index 939e1cd..d9f21eb 100644
--- a/selinux-policy/dhcpcd-and-similar/main.fmf
+++ b/selinux-policy/dhcpcd-and-similar/main.fmf
@@ -18,6 +18,7 @@ recommend:
- dhcpcd
- /usr/sbin/service
- iproute
+ - systemd-resolved
environment:
AVC_ERROR: +no_avc_check
duration: 10m
@@ -26,6 +27,7 @@ tag:
- NoRHEL4
- NoRHEL5
- NoRHEL6
+ - NoRHEL7
- targeted
- NoRHIVOS
- avoidImageMode
@@ -39,6 +41,8 @@ link:
- verifies: https://issues.redhat.com/browse/RHEL-43417
- verifies: https://issues.redhat.com/browse/RHEL-113937
- verifies: https://issues.redhat.com/browse/RHEL-113941
+ - verifies: https://issues.redhat.com/browse/RHEL-147153
+ - verifies: https://issues.redhat.com/browse/RHEL-147155
adjust+:
- enabled: false
when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7
diff --git a/selinux-policy/dhcpcd-and-similar/runtest.sh b/selinux-policy/dhcpcd-and-similar/runtest.sh
index 2b532ad..37583a1 100755
--- a/selinux-policy/dhcpcd-and-similar/runtest.sh
+++ b/selinux-policy/dhcpcd-and-similar/runtest.sh
@@ -51,6 +51,7 @@ rlJournalStart
rlAssertRpm ${PACKAGE}
rlAssertRpm ${PACKAGE}-targeted
rlAssertRpm ${SERVICE_PACKAGE}
+ rlRun "rpm -qa | grep systemd | sort"
rlServiceStop ${SERVICE_NAME}
rlFileBackup /etc/shadow
@@ -111,10 +112,18 @@ rlJournalStart
if rlIsRHEL '> 9.7' || rlIsRHEL '> 10.1' ; then
rlPhaseStartTest "RHEL-113937 + RHEL-113941"
- rlSEMatchPathCon "/usr/libexec/dhcpcd-run-hooks" "bin_t"
+ rlSEMatchPathCon "/usr/libexec/dhcpcd-run-hooks" "dhcpc_hook_exec_t"
CONF_FILE_CONTEXT=`secon --type --file /etc/chrony.conf`
- rlSESearchRule "allow dhcpc_t ${CONF_FILE_CONTEXT} : file { write } [ ]"
- rlPhase
+ rlSESearchRule "allow dhcpc_hook_t ${CONF_FILE_CONTEXT} : file { write } [ ]"
+ rlPhaseEnd
+ fi
+
+ if rlIsRHEL '> 9.8' || rlIsRHEL '> 10.2' ; then
+ rlPhaseStartTest "RHEL-147153 + RHEL-147155"
+ rlSEMatchPathCon "/usr/bin/resolvectl" "bin_t"
+ rlSESearchRule "allow dhcpc_hook_t dhcpc_hook_t : unix_dgram_socket { create ioctl } [ ]"
+ rlSESearchRule "allow dhcpc_hook_t init_t : unix_stream_socket { getattr } [ ]"
+ rlPhaseEnd
fi
if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then
reply other threads:[~2026-09-11 13:23 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=178913301620.1.9000541480821735499.tests-selinux-321b81e71749@fedoraproject.org \
--to=mmalik@redhat.com \
--cc=git-commits@fedoraproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox