Bug 2543273

Description of problem:
This BZ is about tracking SELinux policy so the systemd-imds-early-network.service can run under Enforcing.
Selinux has no policy for the systemd IMDS subsystem introduced in systemd (systemd-imdsd, systemd-imds-early-network.service).
Under SELinux Enforcing the service is denied writing its network config files and fails at boot on cloud images (AWS EC2, Azure, ...).

This is the SELinux-policy follow-up requested in bug 2541402 (comment #13, comment #14). The immediate F45 blocker was handled on the systemd side bug 2541402

Version-Release number of selected component:
selinux-policy-targeted-45.19-1.fc45.noarch
systemd-262-1.fc45.x86_64
kernel 7.2.7-300.fc45.x86_64

How reproducible:
Always (100%) on a cloud instance with SELinux Enforcing

cloud run by https://fedoraproject.org/wiki/Test_Results:Fedora_45_Branched_20260927.n.0_Cloud#Amazon_EC2_(via_Testing_Farm)


Reproducible: Always

Steps to Reproduce:
Steps to Reproduce:
1. Boot a Fedora cloud image (e.g. Fedora-Cloud-Base-AmazonEC2 45) on EC2
2. Enforcing is as default
3. systemctl start systemd-imds-early-network.service
4. journalctl -b | grep -iE 'avc.*imds'


Actual Results:
Service fails; SELinux denies file create/write:

avc: denied { write }  pid=586 comm="systemd-imdsd"
     path="/run/systemd/network/#1687 (deleted)"
     scontext=system_u:system_r:init_t:s0
     tcontext=system_u:object_r:net_conf_t:s0 tclass=file permissive=0

avc: denied { create } pid=586 comm="systemd-imdsd"
     name=".#85-imds-early.network99ed0c802ba21ff1"
     scontext=system_u:system_r:init_t:s0
     tcontext=system_u:object_r:net_conf_t:s0 tclass=file permissive=0

avc: denied { create } pid=586 comm="systemd-imdsd"
     name=".#imds-endpoint.rr4cf31dc6e1f9f0dc"
     scontext=system_u:system_r:init_t:s0
     tcontext=system_u:object_r:systemd_resolved_var_run_t:s0 tclass=file permissive=0

Expected Results:
systemd-imds-early-network.service starts with no AVC denials

Additional Information:
denials happen in early boot (sysinit.target) before auditd is up, so ausearch misses them - collect via journalctl -b in permissive mode.

systemd bug 2541402