NetworkManager added a new security features which leads to additional filesystem access in /var/run/NetworkManager/cert:

https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/2324

That is currently not allowed by selinux-policy-targeted.




Reproducible: Always

Steps to Reproduce:
1. configure a strongswan-based VPN (do NOT select: "Make available to other users")
2. enable VPN
3. due to BZ #2461399 there is another permission problem with standard UNIX permissions - after the first connection attempt it is necessary to fix the permissions temporarily: 'chmod 700 /var/run/NetworkManager/cert'
4. enable VPN again
Actual Results:
The creation of the temporary files is denied by SELinux.

From /var/log/audit/audit.log:

type=AVC msg=audit(1779732798.917:693): avc:  denied  { add_name } for  pid=11190 comm="charon-nm" name="bWsojW" scontext=system_u:system_r:ipsec_t:s0 tcontext=system_u:object_r:NetworkManager_var_run_t:s0 tclass=dir permissive=1
type=AVC msg=audit(1779732798.917:694): avc:  denied  { create } for  pid=11190 comm="charon-nm" name="bWsojW" scontext=system_u:system_r:ipsec_t:s0 tcontext=system_u:object_r:NetworkManager_var_run_t:s0 tclass=file permissive=1
type=AVC msg=audit(1779732798.917:695): avc:  denied  { read open } for  pid=11190 comm="charon-nm" path="/run/NetworkManager/cert/bWsojW" dev="tmpfs" ino=5309 scontext=system_u:system_r:ipsec_t:s0 tcontext=system_u:object_r:NetworkManager_var_run_t:s0 tclass=file permissive=1
type=AVC msg=audit(1779732798.917:696): avc:  denied  { getattr } for  pid=11190 comm="charon-nm" path="/run/NetworkManager/cert/bWsojW" dev="tmpfs" ino=5309 scontext=system_u:system_r:ipsec_t:s0 tcontext=system_u:object_r:NetworkManager_var_run_t:s0 tclass=file permissive=1
type=AVC msg=audit(1779732798.918:697): avc:  denied  { remove_name } for  pid=11190 comm="charon-nm" name="bWsojW.FNK4P3" dev="tmpfs" ino=5310 scontext=system_u:system_r:ipsec_t:s0 tcontext=system_u:object_r:NetworkManager_var_run_t:s0 tclass=dir permissive=1
type=AVC msg=audit(1779732798.918:698): avc:  denied  { rename } for  pid=11190 comm="charon-nm" name="bWsojW.FNK4P3" dev="tmpfs" ino=5310 scontext=system_u:system_r:ipsec_t:s0 tcontext=system_u:object_r:NetworkManager_var_run_t:s0 tclass=file permissive=1
type=AVC msg=audit(1779732798.918:699): avc:  denied  { unlink } for  pid=11190 comm="charon-nm" name="bWsojW" dev="tmpfs" ino=5309 scontext=system_u:system_r:ipsec_t:s0 tcontext=system_u:object_r:NetworkManager_var_run_t:s0 tclass=file permissive=1

Note: the file names in /var/run/NetworkManager/cert are random (generated via mkstemp()).

Expected Results:
SELinux should allow the creation of these files.

Additional Information:
When using audit2allow, it suggests:

require {
	type NetworkManager_var_run_t;
	type ipsec_t;
	class dir { add_name create remove_name };
	class file { create getattr open read rename unlink };
}

#============= ipsec_t ==============
allow ipsec_t NetworkManager_var_run_t:dir { add_name create remove_name };
allow ipsec_t NetworkManager_var_run_t:file { create getattr open read rename unlink };