[tests/selinux] pr775-checkpolicy-revdeps: Test that the corecmd_bin_sys_resource permits sys_resource capability request when turned on.

[tests/selinux] pr775-checkpolicy-revdeps: Test that the corecmd_bin_sys_resource permits sys_resource capability request when turned on.

[Veronika Syncakova]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 5caabc667c5540fbcf3e6c5d9f3ef1e4834b4ae5
            Author : Veronika Syncakova <veva.syncakova@gmail.com>
            Date   : 2026-03-26T12:46:05+00:00
            Stats  : +90/-0 in 2 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/5caabc667c5540fbcf3e6c5d9f3ef1e4834b4ae5?branch=pr775-checkpolicy-revdeps

            Log:
            Test that the corecmd_bin_sys_resource permits sys_resource capability request when turned on.

TC covers RHEL-141858

The issue appears to be caused by the coreutils-single package, which introduces additional
prctl() system calls, that request sys_resource capability, leading to AVC denials.

---
diff --git a/selinux-policy/coreutils-single/main.fmf b/selinux-policy/coreutils-single/main.fmf
new file mode 100644
index 0000000..26e8e7e
--- /dev/null
+++ b/selinux-policy/coreutils-single/main.fmf
@@ -0,0 +1,38 @@
+summary: Test that the corecmd_bin_sys_resource permits sys_resource capability request when turned on.
+description: |+
+    Test that the corecmd_bin_sys_resource permits sys_resource capability request when turned on.
+ 
+contact: Veronika Syncakova <vsyncako@redhat.com>
+test: ./runtest.sh
+framework: beakerlib
+component:
+  - selinux-policy
+require:
+  - library(selinux-policy/common)
+recommend:
+  - audit
+  - libselinux
+  - policycoreutils
+  - selinux-policy
+  - selinux-policy-targeted
+environment:
+    AVC_ERROR: +no_avc_check
+check:
+  - how: avc
+    result: xfail
+duration: 10m
+enabled: true
+tag:
+  - NoRHEL4
+  - NoRHEL5
+  - NoRHEL6
+  - NoRHEL7
+  - NoRHEL8
+  - NoRHIVOS
+link:
+  - verifies: https://redhat.atlassian.net/browse/RHEL-141858
+adjust+:
+  - enabled: false
+    when: distro < rhel-10.3
+    continue: false
+    because: RHEL-141858 is fixed in RHEL-10.3

diff --git a/selinux-policy/coreutils-single/runtest.sh b/selinux-policy/coreutils-single/runtest.sh
new file mode 100755
index 0000000..5db41ac
--- /dev/null
+++ b/selinux-policy/coreutils-single/runtest.sh
@@ -0,0 +1,52 @@
+#!/bin/bash
+# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGE="coreutils-single"
+BOOLEAN="corecmd_bin_sys_resource"
+INSTALLED_VARIANT=""
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlRun "rlImport 'selinux-policy/common'" 0,1
+        if rpm -q coreutils-single > /dev/null 2>&1; then                                                                                             
+            INSTALLED_VARIANT="single"                                                             
+        else                                                                                                                                                                           
+            INSTALLED_VARIANT="regular"
+            rlRun "yum -y install ${PACKAGE} --allowerasing"                                                                        
+        fi
+        rlAssertRpm ${PACKAGE}
+        rlSESetEnforce
+        rlSEStatus
+        rlSESetTimestamp "General"
+    rlPhaseEnd
+
+    rlPhaseStartTest "RHEL-141858"
+        rlSESetTimestamp "No_AVC"
+        # Boolean and rule exists
+        rlRun "getsebool -a | grep ${BOOLEAN}"
+        rlSESearchRule "allow NetworkManager_dispatcher_chronyc_t self:capability {sys_resource} [ ${BOOLEAN} ]"
+        INTERFACE_NAME="$(ip link show |  head -n 1 | awk -F': ' '/^[0-9]+:/ {print $2}')"
+
+        # No AVC when the boolean is turned on
+        rlSEBooleanOn ${BOOLEAN}
+        rlRun "nmcli connection up ${INTERFACE_NAME}"
+        sleep 5
+        rlSECheckAVC "No_AVC"
+
+        # AVC present when boolean is off
+        rlSESetTimestamp "Trigger_AVC"
+        rlRun "setsebool ${BOOLEAN} off"
+        rlRun "nmcli connection up ${INTERFACE_NAME}"
+        sleep 5
+        rlRun 'rlSEAVCCheck "Trigger_AVC"' 1
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        rlSECheckAVC --ignore "type=AVC .* denied .* sys_resource .*:NetworkManager_dispatcher.* " "General"
+        rlSEBooleanRestore ${BOOLEAN}
+        if [ "$INSTALLED_VARIANT" = "regular" ]; then
+            rlRun "yum -y install coreutils --allowerasing"
+        fi
+    rlPhaseEnd
+rlJournalEnd
\ No newline at end of file