Description of problem:

I have RHEL9 beta installed on a Dell Latitude 7420.

SELinux is preventing the laptop from suspending when the lid is closed:

May 05 19:55:40 laptop.example.org [7232]: Failed to execute /usr/lib/systemd/system-sleep/sysstat.sleep: Permission denied
May 05 19:55:40 laptop.example.org [7231]: /usr/lib/systemd/system-sleep/sysstat.sleep failed with exit status 1.
May 05 19:55:41 laptop.example.org setroubleshoot[7233]: SELinux is preventing /usr/lib/systemd/systemd-sleep from execute access on the file /usr/lib/systemd/system-sleep/sysstat.sleep.
May 05 19:55:42 laptop.example.org setroubleshoot[7233]: SELinux is preventing /usr/lib/systemd/systemd-sleep from execute access on the file /usr/lib/systemd/system-sleep/sysstat.sleep.

If I place systemd_sleep_t in permissive mode, then suspending works, but a bevvy of SELinux (permissive) denies are logged:

May 05 23:13:21 laptop.example.org setroubleshoot[10630]: SELinux is preventing /usr/bin/bash from execute access on the file /lib64/ld-linux-x86-64.so.2.
May 05 23:13:21 laptop.example.org setroubleshoot[10630]: SELinux is preventing /usr/bin/bash from execute access on the file /lib64/ld-linux-x86-64.so.2.
May 05 23:13:21 laptop.example.org setroubleshoot[10630]: SELinux is preventing /usr/bin/bash from getattr access on the file /usr/lib64/sa/sa1.
May 05 23:13:21 laptop.example.org setroubleshoot[10630]: SELinux is preventing /usr/bin/bash from ioctl access on the file /usr/lib64/sa/sa1.
May 05 23:13:21 laptop.example.org setroubleshoot[10630]: SELinux is preventing /usr/bin/bash from getattr access on the directory /var/log/sa.
May 05 23:13:21 laptop.example.org setroubleshoot[10630]: SELinux is preventing /usr/lib64/sa/sadc from map access on the file /usr/lib64/sa/sadc.
May 05 23:13:21 laptop.example.org setroubleshoot[10630]: SELinux is preventing /usr/lib64/sa/sadc from read access on the file dev.
May 05 23:13:21 laptop.example.org setroubleshoot[10630]: SELinux is preventing /usr/lib64/sa/sadc from getattr access on the file /proc/<pid>/net/dev.
May 05 23:13:22 laptop.example.org setroubleshoot[10630]: SELinux is preventing /usr/lib64/sa/sadc from search access on the directory /var/log/sa/sa05.
May 05 23:13:22 laptop.example.org setroubleshoot[10630]: SELinux is preventing /usr/bin/bash from execute access on the file /lib64/ld-linux-x86-64.so.2.
May 05 23:13:22 laptop.example.org setroubleshoot[10630]: SELinux is preventing /usr/bin/bash from getattr access on the file /usr/lib64/sa/sa1.
May 05 23:13:22 laptop.example.org setroubleshoot[10630]: SELinux is preventing /usr/bin/bash from ioctl access on the file /usr/lib64/sa/sa1.
May 05 23:13:22 laptop.example.org setroubleshoot[10630]: SELinux is preventing /usr/lib64/sa/sadc from map access on the file /usr/lib64/sa/sadc.
May 05 23:13:22 laptop.example.org setroubleshoot[10630]: SELinux is preventing /usr/lib64/sa/sadc from read access on the file /var/log/sa/sa05.

And:

$ ausearch -m avc -ts today | audit2allow

#============= systemd_sleep_t ==============
allow systemd_sleep_t bin_t:file { execute execute_no_trans };
allow systemd_sleep_t proc_net_t:file { getattr open read };

#!!!! This avc can be allowed using the boolean 'domain_can_mmap_files'
allow systemd_sleep_t shell_exec_t:file map;
allow systemd_sleep_t shell_exec_t:file execute;
allow systemd_sleep_t sysstat_exec_t:file { execute execute_no_trans getattr ioctl open read };

#!!!! This avc can be allowed using the boolean 'domain_can_mmap_files'
allow systemd_sleep_t sysstat_exec_t:file map;
allow systemd_sleep_t sysstat_log_t:dir { getattr search };
allow systemd_sleep_t sysstat_log_t:file { open read };

This doesn’t look like a rule or two is missing; it looks like either there is a transition rule that is missing (meaning, systemd_sleep_t is being denied all over the place because all of this should be executing in a different SELinux context), or systemd_sleep_t is the correct context, but most of the policy it should have is simply missing.

Version-Release number of selected component (if applicable):

selinux-policy-targeted-34.1.28-1.el9_0.noarch

How reproducible:

Install RHEL9 beta on a laptop and close the lid.

Alternatively, using a tool like pm-suspend to manually force a suspend will likely demonstrate the issue on any modern hardware that supports the ACPI S3 suspend state.