Description of problem:

I upgraded my RHEL Edge 9.0 box to 9.1 box, and it dropped of the network due wireguard not starting the tunnel.

RHEL 9.1:
------
Mar 03 09:50:14 apu.localnet wg-quick[9067]: [#] ip link add cool-lab type wireguard
Mar 03 09:50:14 apu.localnet wg-quick[9067]: [#] wg setconf cool-lab /dev/fd/63
Mar 03 09:50:14 apu.localnet wg-quick[9067]: [#] ip -4 address add 10.254.251.102 dev cool-lab
Mar 03 09:50:14 apu.localnet wg-quick[9067]: [#] ip link set mtu 1420 up dev cool-lab
Mar 03 09:50:14 apu.localnet wg-quick[9089]: [#] resolvconf -a cool-lab -m 0 -x
Mar 03 09:50:14 apu.localnet wg-quick[9091]: sd_bus_open_system: Permission denied
Mar 03 09:50:14 apu.localnet wg-quick[9067]: [#] ip link delete dev cool-lab
Mar 03 09:50:14 apu.localnet systemd[1]: wg-quick: Main process exited, code=exited, status=1/FAILURE
------

RHEL 9.0:
------
Mar 03 09:45:48 dell-edge wg-quick[1111]: [#] ip link add cool-lab type wireguard
Mar 03 09:45:48 dell-edge wg-quick[1111]: [#] wg setconf cool-lab /dev/fd/63
Mar 03 09:45:48 dell-edge wg-quick[1111]: [#] ip -4 address add 10.254.251.100 dev cool-lab
Mar 03 09:45:48 dell-edge wg-quick[1111]: [#] ip link set mtu 1420 up dev cool-lab
Mar 03 09:45:48 dell-edge wg-quick[1257]: [#] resolvconf -a cool-lab -m 0 -x
Mar 03 09:45:48 dell-edge wg-quick[1111]: [#] ip -4 route add 10.128.4.0/24 dev cool-lab
Mar 03 09:45:48 dell-edge wg-quick[1111]: [#] ip -4 route add 10.128.3.0/24 dev cool-lab
Mar 03 09:45:48 dell-edge wg-quick[1111]: [#] ip -4 route add 10.128.2.0/24 dev cool-lab
Mar 03 09:45:48 dell-edge wg-quick[1111]: [#] ip -4 route add 10.128.1.0/24 dev cool-lab
Mar 03 09:45:48 dell-edge systemd[1]: Finished WireGuard via wg-quick(8) for cool/lab.
------



Version-Release number of selected component (if applicable):

wireguard-tools-1.0.20210424-3.el9.x86_64



How reproducible:

I had it working fine (still do on another box) on 9.0. I did build new image in fleet management at c.rh.c and upgraded the box.

Steps to Reproduce:
1. install rhel9.0 edge
2. configure wireguard tunnel
3. upgrade to rhel 9.1

Might do the same directly on RHEL9.1, I have not tried.



Actual results:

While starting with systectl wireguard does not have permissions to use systemd-resolved. It fails with such error message. Looking at selinux troubles, there are several. I tried fixing them but it still fails to something:

I used this while trying to go around the problem:
--------------
set the boolean: domain_can_write_kmsg 1

[coolboy@apu ~]$ cat resolve.te

module resolve 1.0;

require {
        type syslogd_var_run_t;
        type wireguard_t;
        type system_dbusd_var_run_t;
        class dir search;
}

#============= wireguard_t ==============
allow wireguard_t syslogd_var_run_t:dir search;
allow wireguard_t system_dbusd_var_run_t:dir search;
--------------

Now selinux doesn't complain:

--------------
[coolboy@apu ~]$ sudo ausearch -c 'resolvconf' --raw| grep -v kmsg| audit2allow


#============= wireguard_t ==============

#!!!! This avc is allowed in the current policy
allow wireguard_t syslogd_var_run_t:dir search;
allow wireguard_t syslogd_var_run_t:sock_file write;

#!!!! This avc is allowed in the current policy
allow wireguard_t system_dbusd_var_run_t:dir search;
allow wireguard_t system_dbusd_var_run_t:sock_file write;
-----------


Expected results:

Tunnel to come up after upgrade and reboot.

Additional info:

The tunnel works if I just do
-----------
sudo wg-quick up cool-lab
-----------
It's just systemctl or nmcli that fails with it.