Red Hat - Defect ID: RHEL-82388
SELinux prevents dhcpcd from reading files stored in /run/dhcpcd-ci/ directory

Issue

Please provide the package NVR for which the bug is seen: audit-4.0.3-1.el10.x86_64 selinux-policy-40.13.25-1.el10.noarch How reproducible is this bug? always Steps to reproduce get a RHEL-10.0 machine (targeted policy is active) git clone https://src.fedoraproject.org/tests/dhcpcd run the test stored in Sanity/ipv4-tests directory search for SELinux denials Expected results no SELinux denials Actual results ---- type=PROCTITLE msg=audit(03/06/2025 04:15:47.410:703) : proctitle=dhcpcd -4 -M -d --logfile /var/run/dhcpcd-ci/dhcpcd-test.log.dhcpcd-domain-dns.conf -f /var/run/dhcpcd-ci/dhcpcd-domain-dns.conf type=PATH msg=audit(03/06/2025 04:15:47.410:703) : item=0 name=/var/run/dhcpcd-ci/dhcpcd-domain-dns.conf inode=2012 dev=00:1a mode=file,644 ouid=root ogid=root rdev=00:00 obj=unconfined_u:object_r:var_run_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=CWD msg=audit(03/06/2025 04:15:47.410:703) : cwd=/root/dhcpcd/Sanity/ipv4-tests type=SYSCALL msg=audit(03/06/2025 04:15:47.410:703) : arch=x86_64 syscall=openat success=yes exit=4 a0=AT_FDCWD a1=0x55c0ce7d4490 a2=O_RDONLY a3=0x0 items=1 ppid=8221 pid=8234 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts0 ses=4 comm=dhcpcd exe=/usr/sbin/dhcpcd subj=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(03/06/2025 04:15:47.410:703) : avc: denied { open } for pid=8234 comm=dhcpcd path=/run/dhcpcd-ci/dhcpcd-domain-dns.conf dev="tmpfs" ino=2012 scontext=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:var_run_t:s0 tclass=file permissive=1 type=AVC msg=audit(03/06/2025 04:15:47.410:703) : avc: denied { read } for pid=8234 comm=dhcpcd name=dhcpcd-domain-dns.conf dev="tmpfs" ino=2012 scontext=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:var_run_t:s0 tclass=file permissive=1 ---- type=PROCTITLE msg=audit(03/06/2025 04:15:47.411:704) : proctitle=dhcpcd -4 -M -d --logfile /var/run/dhcpcd-ci/dhcpcd-test.log.dhcpcd-domain-dns.conf -f /var/run/dhcpcd-ci/dhcpcd-domain-dns.conf type=PATH msg=audit(03/06/2025 04:15:47.411:704) : item=0 name=/var/run/dhcpcd-ci/dhcpcd-domain-dns.conf inode=2012 dev=00:1a mode=file,644 ouid=root ogid=root rdev=00:00 obj=unconfined_u:object_r:var_run_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=CWD msg=audit(03/06/2025 04:15:47.411:704) : cwd=/root/dhcpcd/Sanity/ipv4-tests type=SYSCALL msg=audit(03/06/2025 04:15:47.411:704) : arch=x86_64 syscall=newfstatat success=yes exit=0 a0=AT_FDCWD a1=0x55c0ce7d4490 a2=0x7ffee5d375c0 a3=0x0 items=1 ppid=8221 pid=8234 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts0 ses=4 comm=dhcpcd exe=/usr/sbin/dhcpcd subj=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(03/06/2025 04:15:47.411:704) : avc: denied { getattr } for pid=8234 comm=dhcpcd path=/run/dhcpcd-ci/dhcpcd-domain-dns.conf dev="tmpfs" ino=2012 scontext=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:var_run_t:s0 tclass=file permissive=1 ---- https://artifacts.osci.redhat.com/testing-farm/57af7453-27cd-4694-abd9-3561cf366989/ see part: /plans/cs_stacks/image-mode-critical-tier1/dhcpcd fail avc denial: https://artifacts.osci.redhat.com/testing-farm/57af7453-27cd-4694-abd9-3561cf366989/work-dhcpcd_2lhcg4v/plans/cs_stacks/image-mode-critical-tier1/dhcpcd/execute/data/guest/default-0/public/Sanity/ipv4-tests-3/checks/avc.txt

Release Notes

No. of Comments

Resolution

Done