[tests/selinux] pr775-checkpolicy-revdeps: test if dhcpc hook can execute resolvectl

[tests/selinux] pr775-checkpolicy-revdeps: test if dhcpc hook can execute resolvectl

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 321b81e7174966b265c67834a3e066abd158e4f0
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2026-03-06T13:27:25+00:00
            Stats  : +19/-4 in 3 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/321b81e7174966b265c67834a3e066abd158e4f0?branch=pr775-checkpolicy-revdeps

            Log:
            test if dhcpc hook can execute resolvectl

Recent selinux-policy + dhcpcd + systemd-resolved testing revealed
SELinux denials caused by dhcpc hooks running the resolvectl program.
The TC reproduces the situation.

In order to support the dhcpcd service and its hooks fully, I believe
that SELinux policy allow the necessary actions. The TC looks for
appropriate policy rules and file context patterns.

The TC covers RHEL-147153 and RHEL-147155.

---
diff --git a/selinux-policy/dhcpcd-and-similar/Makefile b/selinux-policy/dhcpcd-and-similar/Makefile
index eb537ff..5ed2841 100644
--- a/selinux-policy/dhcpcd-and-similar/Makefile
+++ b/selinux-policy/dhcpcd-and-similar/Makefile
@@ -54,7 +54,7 @@ $(METADATA): Makefile
 	@echo "Type:            Regression" >> $(METADATA)
 	@echo "TestTime:        10m" >> $(METADATA)
 	@echo "RunFor:          selinux-policy" >> $(METADATA)
-	@echo "Requires:        audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console dhcpcd /usr/sbin/service iproute" >> $(METADATA)
+	@echo "Requires:        audit libselinux libselinux-utils policycoreutils selinux-policy selinux-policy-targeted setools-console dhcpcd /usr/sbin/service iproute systemd-resolved" >> $(METADATA)
 	@echo "RhtsRequires:    library(selinux-policy/common)" >> $(METADATA)
 	@echo "Environment:     AVC_ERROR=+no_avc_check" >> $(METADATA)
 	@echo "Priority:        Normal" >> $(METADATA)
@@ -71,6 +71,8 @@ $(METADATA): Makefile
 	@echo "Bug:             RHEL-43417" >> $(METADATA) # RHEL-10
 	@echo "Bug:             RHEL-113937" >> $(METADATA) # RHEL-10
 	@echo "Bug:             RHEL-113941" >> $(METADATA) # RHEL-9
+	@echo "Bug:             RHEL-147153" >> $(METADATA) # RHEL-10
+	@echo "Bug:             RHEL-147155" >> $(METADATA) # RHEL-9
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/dhcpcd-and-similar/main.fmf b/selinux-policy/dhcpcd-and-similar/main.fmf
index 939e1cd..d9f21eb 100644
--- a/selinux-policy/dhcpcd-and-similar/main.fmf
+++ b/selinux-policy/dhcpcd-and-similar/main.fmf
@@ -18,6 +18,7 @@ recommend:
   - dhcpcd
   - /usr/sbin/service
   - iproute
+  - systemd-resolved
 environment:
     AVC_ERROR: +no_avc_check
 duration: 10m
@@ -26,6 +27,7 @@ tag:
   - NoRHEL4
   - NoRHEL5
   - NoRHEL6
+  - NoRHEL7
   - targeted
   - NoRHIVOS
   - avoidImageMode
@@ -39,6 +41,8 @@ link:
   - verifies: https://issues.redhat.com/browse/RHEL-43417
   - verifies: https://issues.redhat.com/browse/RHEL-113937
   - verifies: https://issues.redhat.com/browse/RHEL-113941
+  - verifies: https://issues.redhat.com/browse/RHEL-147153
+  - verifies: https://issues.redhat.com/browse/RHEL-147155
 adjust+:
   - enabled: false
     when: distro == rhel-4, rhel-5, rhel-6, rhel-7, rhel-alt-7

diff --git a/selinux-policy/dhcpcd-and-similar/runtest.sh b/selinux-policy/dhcpcd-and-similar/runtest.sh
index 2b532ad..37583a1 100755
--- a/selinux-policy/dhcpcd-and-similar/runtest.sh
+++ b/selinux-policy/dhcpcd-and-similar/runtest.sh
@@ -51,6 +51,7 @@ rlJournalStart
         rlAssertRpm ${PACKAGE}
         rlAssertRpm ${PACKAGE}-targeted
         rlAssertRpm ${SERVICE_PACKAGE}
+        rlRun "rpm -qa | grep systemd | sort"
 
         rlServiceStop ${SERVICE_NAME}
         rlFileBackup /etc/shadow
@@ -111,10 +112,18 @@ rlJournalStart
 
     if rlIsRHEL '> 9.7' || rlIsRHEL '> 10.1' ; then
     rlPhaseStartTest "RHEL-113937 + RHEL-113941"
-        rlSEMatchPathCon "/usr/libexec/dhcpcd-run-hooks" "bin_t"
+        rlSEMatchPathCon "/usr/libexec/dhcpcd-run-hooks" "dhcpc_hook_exec_t"
         CONF_FILE_CONTEXT=`secon --type --file /etc/chrony.conf`
-        rlSESearchRule "allow dhcpc_t ${CONF_FILE_CONTEXT} : file { write } [ ]"
-    rlPhase
+        rlSESearchRule "allow dhcpc_hook_t ${CONF_FILE_CONTEXT} : file { write } [ ]"
+    rlPhaseEnd
+    fi
+
+    if rlIsRHEL '> 9.8' || rlIsRHEL '> 10.2' ; then
+    rlPhaseStartTest "RHEL-147153 + RHEL-147155"
+        rlSEMatchPathCon "/usr/bin/resolvectl" "bin_t"
+        rlSESearchRule "allow dhcpc_hook_t dhcpc_hook_t : unix_dgram_socket { create ioctl } [ ]"
+        rlSESearchRule "allow dhcpc_hook_t init_t : unix_stream_socket { getattr } [ ]"
+    rlPhaseEnd
     fi
 
     if [ -f /usr/lib/systemd/system/${SERVICE_NAME}.service ] ; then