Description of problem:

While writing a CI test for Kea I came to notice about SELinux denial for dhcpcd when run under non default network namespace. Dhcpcd tries to detect whether it runs under network namespace and if so it reads the name of it and just prints it for logging/informative purposes. This prevents CI tests to pass cleanly.

Version-Release number of selected component (if applicable):

selinux-policy-40.15-1.fc41.noarch

How reproducible:

Always.

Steps to Reproduce:
1. run dhcpcd under non-default network namespace
# ip netns exec netns-client dhcpcd -4 --inactive -B --nohook 20-resolv.conf veth1

Actual results:

~~~
[ ERROR ] AVC check: FAIL
----
type=AVC msg=audit(03/21/2024 10:44:52.504:650) : avc:  denied  { read } for  pid=3762 comm=dhcpcd name=netns dev="tmpfs" ino=1407 scontext=unconfined_u:system_r:dhcpc_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:ifconfig_var_run_t:s0 tclass=dir permissive=0
~~~

Expected results:

No denials.

Additional info:

strace:

6569  10:47:50.521190 openat(AT_FDCWD</>, "/var/run/netns", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = -1 EACCES (Permission denied) <0.000204>

dhcpd code:

https://github.com/NetworkConfiguration/dhcpcd/blob/master/src/if-linux.c#L406