Re: [PATCH testsuite] tmt: allow nlmsg also to the ssh_server attribute

On Mon, Jul 27, 2026 at 3:42 AM Ondrej Mosnacek <[email protected]> wrote:
>
> Without this SSH doesn't work under the latest Rawhide policy and the
> test run fails to complete successfully.
>
> Signed-off-by: Ondrej Mosnacek <[email protected]>

Acked-by: Stephen Smalley <[email protected]>

> ---
>  tmt/tests.fmf | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/tmt/tests.fmf b/tmt/tests.fmf
> index fe90c69..08bd129 100644
> --- a/tmt/tests.fmf
> +++ b/tmt/tests.fmf
> @@ -48,7 +48,7 @@
>          echo "(policycap netlink_xperm)" >>base.cil
>          echo "(policycap bpf_token_perms)" >>base.cil
>          # allow nlmsg to some system domains so that the system can boot
> -        for source in daemon initrc_domain systemprocess unconfined_domain_type sysadm_t; do
> +        for source in daemon initrc_domain systemprocess ssh_server unconfined_domain_type sysadm_t; do
>            echo "(allow $source self (netlink_route_socket (nlmsg)))" >>base.cil
>            echo "(allow $source self (netlink_tcpdiag_socket (nlmsg)))" >>base.cil
>            echo "(allow $source self (netlink_xfrm_socket (nlmsg)))" >>base.cil
> --
> 2.55.0
>
>