Bug 1801249

The automated TC revealed following problems when testing the selinux-policy 3.14.3-51.el8 packages on RHEL-8.3:

Compile test for container_filetrans_named_content failed.
Compile test for cron_admin_role failed.
Compile test for cron_role failed.
Compile test for cron_unconfined_role failed.
Compile test for rpm_named_filetrans failed.

Compilation of interfaces cron_role, cron_admin_role, cron_unconfined_role leads to the same error message:

compiletest.te:43:ERROR 'unknown type sepolicy_domain_t_t' at token ';' on line 4427:
#line 43
	typeattribute sepolicy_domain_t_t crontab_domain;
/usr/bin/checkmodule:  error(s) encountered while parsing configuration
make: *** [/usr/share/selinux/devel/include/Makefile:157: tmp/compiletest.mod] Error 1

But the remaining 2 interfaces produce different errors:

# sepolicy interface -c -i rpm_named_filetrans
Compiling rpm_named_filetrans interface
Compiling targeted compiletest module
compiletest.te:43:ERROR 'unknown type rpm_var_cache_t used in transition definition' at token ';' on line 4595:
	type_transition sepolicy_domain_t var_t:dir rpm_var_cache_t "dnf";
#line 43
/usr/bin/checkmodule:  error(s) encountered while parsing configuration
make: *** [/usr/share/selinux/devel/include/Makefile:157: tmp/compiletest.mod] Error 1
Compile test for rpm_named_filetrans failed.

# sepolicy interface -c -i container_filetrans_named_content
Compiling container_filetrans_named_content interface
Compiling targeted compiletest module
compiletest.te:43:ERROR 'unknown type container_kvm_var_run_t used in transition definition' at token ';' on line 4731:
	type_transition sepolicy_domain_t var_run_t:dir container_kvm_var_run_t "kata-containers";
#line 43
/usr/bin/checkmodule:  error(s) encountered while parsing configuration
make: *** [/usr/share/selinux/devel/include/Makefile:157: tmp/compiletest.mod] Error 1
Compile test for container_filetrans_named_content failed.

Fixed in rawhide:
commit b7b77904e0a165fc3ef54fe8c6f12405261c47b5 (HEAD -> rawhide, upstream/rawhide, upstream-rw/rawhide)
Author: Zdenek Pytela <zpytela>
Date:   Wed Feb 24 19:45:15 2021 +0100

    Add missing declaration in rpm_named_filetrans()

    In the rpm_named_filetrans() interface, the rpm_var_cache_t type was
    used, but not previously declared.

    As a result, the interface test compile failed using sepolicy-interface:

    $ sepolicy interface -c -i rpm_named_filetrans
    Compiling rpm_named_filetrans interface
    Compiling targeted compiletest module
    compiletest.te:43:ERROR 'unknown type rpm_var_cache_t used in transition definition' at token ';' on line 4641:
            type_transition sepolicy_domain_t var_t:dir rpm_var_cache_t "dnf";
    /usr/bin/checkmodule:  error(s) encountered while parsing configuration
    make: *** [/usr/share/selinux/devel/include/Makefile:157: tmp/compiletest.mod] Error 1
    Compile test for rpm_named_filetrans failed.

    Resolves: rhbz#1801249

commit 62db6d0b9fef710c6b186490861f6e816d2fa139
Author: Zdenek Pytela <zpytela>
Date:   Wed Feb 24 19:00:22 2021 +0100

    Change param description in cron interfaces to userdomain_prefix

    In the cron_role(), cron_unconfined_role(), and cron_admin_role()
    interfaces the second parameter name was incorrectly stated as "domain"
    while it should rather be "userdomain_prefix". As an example, "user" is
    the userdomain prefix for the "user_t" domain.

    As a result, test compile of these interfaces failed using sepolicy-interface:

    $ sepolicy interface -c -i cron_unconfined_role
    Compiling cron_unconfined_role interface
    Compiling targeted compiletest module
    compiletest.te:43:ERROR 'unknown type sepolicy_domain_t_t' at token ';' on line 4423:
            typeattribute sepolicy_domain_t_t crontab_domain;
    /usr/bin/checkmodule:  error(s) encountered while parsing configuration
    make: *** [/usr/share/selinux/devel/include/Makefile:157: tmp/compiletest.mod] Error 1
    Compile test for cron_unconfined_role failed.

    Resolves: rhbz#1801249

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (selinux-policy bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2021:4420