[tests/selinux] pr775-checkpolicy-revdeps: test if systemd-tmpfiles-clean.service triggers an AVC denial

[tests/selinux] pr775-checkpolicy-revdeps: test if systemd-tmpfiles-clean.service triggers an AVC denial

[Veronika Syncakova]

A new commit has been pushed.

Repo   : tests/selinux
Branch : pr775-checkpolicy-revdeps
Commit : 18274abc2a426a37c2bff003bd4821a7fdf01dd8
Author : Veronika Syncakova <veva.syncakova@gmail.com>
Date   : 2026-04-13T10:11:28+00:00
Stats  : +23/-0 in 3 file(s)
URL    : https://src.fedoraproject.org/tests/selinux/c/18274abc2a426a37c2bff003bd4821a7fdf01dd8?branch=pr775-checkpolicy-revdeps

Log:
test if systemd-tmpfiles-clean.service triggers an AVC denial

---
diff --git a/selinux-policy/systemd-tmpfiles-and-similar/Makefile b/selinux-policy/systemd-tmpfiles-and-similar/Makefile
index fd16134..e30c908 100644
--- a/selinux-policy/systemd-tmpfiles-and-similar/Makefile
+++ b/selinux-policy/systemd-tmpfiles-and-similar/Makefile
@@ -64,6 +64,7 @@ $(METADATA): Makefile
 	@echo "Releases:        -RHEL4 -RHEL5 -RHEL6 -RHEL7" >> $(METADATA)
 	@echo "Bug:             RHEL-40374" >> $(METADATA) # RHEL-9
 	@echo "Bug:             RHEL-44191" >> $(METADATA) # RHEL-10
+	@echo "Bug:             RHEL-139855" >> $(METADATA) # RHEL-10
 
 	rhts-lint $(METADATA)
 

diff --git a/selinux-policy/systemd-tmpfiles-and-similar/main.fmf b/selinux-policy/systemd-tmpfiles-and-similar/main.fmf
index c72634c..6741bc4 100644
--- a/selinux-policy/systemd-tmpfiles-and-similar/main.fmf
+++ b/selinux-policy/systemd-tmpfiles-and-similar/main.fmf
@@ -36,6 +36,7 @@ tier: 2
 link:
   - verifies: https://issues.redhat.com/browse/RHEL-40374
   - verifies: https://issues.redhat.com/browse/RHEL-44191
+  - verifies: https://issues.redhat.com/browse/RHEL-139855
 adjust+:
   - enabled: false
     when: distro < rhel-9.5

diff --git a/selinux-policy/systemd-tmpfiles-and-similar/runtest.sh b/selinux-policy/systemd-tmpfiles-and-similar/runtest.sh
index 6c28056..a4fd928 100755
--- a/selinux-policy/systemd-tmpfiles-and-similar/runtest.sh
+++ b/selinux-policy/systemd-tmpfiles-and-similar/runtest.sh
@@ -76,6 +76,27 @@ rlJournalStart
         done
     rlPhaseEnd
 
+    rlPhaseStartTest "RHEL-139855"
+        SOFT_LIMIT=1000
+        HARD_LIMIT=1500
+        LIMIT_NOFILE="$(systemctl show --value --property DefaultLimitNOFILE)"
+        LIMIT_NOFILE_SOFT="$(systemctl show --value --property DefaultLimitNOFILESoft)"
+        rlAssertNotEquals "DefaultLimitNOFILE is set to: ${LIMIT_NOFILE}" $HARD_LIMIT $LIMIT_NOFILE
+        rlAssertNotEquals "DefaultLimitNOFILESoft is set to: ${LIMIT_NOFILE_SOFT}" $SOFT_LIMIT $LIMIT_NOFILE_SOFT
+        rlRun "mkdir /run/systemd/system.conf.d/"
+        rlRun "cat >/run/systemd/system.conf.d/99-NOFILE.conf <<EOF
+               [Manager]
+               DefaultLimitNOFILE=${SOFT_LIMIT}:${HARD_LIMIT}
+               EOF"
+        rlRun "systemctl daemon-reload"
+        LIMIT_NOFILE="$(systemctl show --value --property DefaultLimitNOFILE)"
+        LIMIT_NOFILE_SOFT="$(systemctl show --value --property DefaultLimitNOFILESoft)"
+        rlAssertEquals "DefaultLimitNOFILE has changed after daemon reload" $HARD_LIMIT $LIMIT_NOFILE
+        rlAssertEquals "DefaultLimitNOFILESoft has changed after daemon reload" $SOFT_LIMIT $LIMIT_NOFILE_SOFT
+        rlRun "systemctl restart systemd-tmpfiles-clean.service"
+        rlRun "rm /run/systemd/system.conf.d/99-NOFILE.conf"
+    rlPhaseEnd
+
     rlPhaseStartCleanup
         sleep 2
         rlSECheckAVC