[tests/selinux] pr775-checkpolicy-revdeps: test if nfs-server-generator can create/control its UDP sockets

[tests/selinux] pr775-checkpolicy-revdeps: test if nfs-server-generator can create/control its UDP sockets

[Milos Malik]

            A new commit has been pushed.

            Repo   : tests/selinux
            Branch : pr775-checkpolicy-revdeps
            Commit : 5e3d738a08460a00399211c537c9a0a68a1a9e67
            Author : Milos Malik <mmalik@redhat.com>
            Date   : 2026-04-13T07:47:16+00:00
            Stats  : +14/-0 in 3 file(s)
            URL    : https://src.fedoraproject.org/tests/selinux/c/5e3d738a08460a00399211c537c9a0a68a1a9e67?branch=pr775-checkpolicy-revdeps

            Log:
            test if nfs-server-generator can create/control its UDP sockets

After introducing the systemd_nfs_generator_t domain, a bug report was
filed which revealed that SELinux prevents the nfs-server-generator
from creating and controling its UDP sockets. The TC reproduces the
situation.

In order to support all functions of the nfs-server-generator program,
I believe that SELinux policy should allow these actions. The TC looks
for appropriate policy rules and file context patterns.

The TC covers RHEL-111556.

---
diff --git a/selinux-policy/systemd-generators/Makefile b/selinux-policy/systemd-generators/Makefile
index aab82d9..f2b644f 100644
--- a/selinux-policy/systemd-generators/Makefile
+++ b/selinux-policy/systemd-generators/Makefile
@@ -56,6 +56,7 @@ $(METADATA): Makefile
 	@echo "RunFor:          selinux-policy" >> $(METADATA)
 	@echo "Requires:        audit" >> $(METADATA)
 	@echo "Requires:        libselinux-utils" >> $(METADATA)
+	@echo "Requires:        nfs-utils" >> $(METADATA)
 	@echo "Requires:        policycoreutils" >> $(METADATA)
 	@echo "Requires:        selinux-policy" >> $(METADATA)
 	@echo "Requires:        selinux-policy-targeted" >> $(METADATA)
@@ -78,6 +79,7 @@ $(METADATA): Makefile
 	@echo "Bug:             RHEL-98656" >> $(METADATA) # RHEL-10
 	@echo "Bug:             RHEL-100415" >> $(METADATA) # RHEL-10
 	@echo "Bug:             RHEL-100721" >> $(METADATA) # RHEL-10
+	@echo "Bug:             RHEL-111556" >> $(METADATA) # RHEL-10
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/systemd-generators/main.fmf b/selinux-policy/systemd-generators/main.fmf
index 7b8c9f4..4062447 100644
--- a/selinux-policy/systemd-generators/main.fmf
+++ b/selinux-policy/systemd-generators/main.fmf
@@ -13,6 +13,7 @@ require:
 recommend:
   - audit
   - libselinux-utils
+  - nfs-utils
   - policycoreutils
   - selinux-policy
   - selinux-policy-targeted
@@ -39,6 +40,7 @@ link:
   - verifies: https://issues.redhat.com/browse/RHEL-98656
   - verifies: https://issues.redhat.com/browse/RHEL-100415
   - verifies: https://issues.redhat.com/browse/RHEL-100721
+  - verifies: https://issues.redhat.com/browse/RHEL-111556
 adjust+:
   - enabled: false
     when: distro == rhel-4, rhel-5, rhel-6, rhel-7

diff --git a/selinux-policy/systemd-generators/runtest.sh b/selinux-policy/systemd-generators/runtest.sh
index d52e632..0deeac8 100755
--- a/selinux-policy/systemd-generators/runtest.sh
+++ b/selinux-policy/systemd-generators/runtest.sh
@@ -225,6 +225,16 @@ EOF
     rlPhaseEnd
     fi
 
+    if seinfo -a | grep -q systemd_generator ; then
+    rlPhaseStartTest "RHEL-111556"
+        rlSEMatchPathCon "/usr/lib/systemd/system-generators/nfs-server-generator" "systemd_nfs_generator_exec_t"
+        rlSESearchRule "allow init_t systemd_nfs_generator_exec_t : file { getattr open read map execute } [ ]"
+        rlSESearchRule "type_transition init_t systemd_nfs_generator_exec_t : process systemd_nfs_generator_t"
+        rlSESearchRule "allow init_t systemd_nfs_generator_t : process { transition } [ ]"
+        rlSESearchRule "allow systemd_nfs_generator_t systemd_nfs_generator_t : udp_socket { getattr create setopt connect } [ ]"
+    rlPhaseEnd
+    fi
+
     ### generators from other packages: install them all?
     # dnf install "/usr/lib/systemd/system-generators/*"
     # cloud-init-generator nfs-server-generator rpc-pipefs-generator selinux-autorelabel-generator.sh zram-generator