test: skip OSCI gating AVC test

crates/xtask/src/tmt.rs

@@ -1070,6 +1070,18 @@ pub(crate) fn update_integration() -> Result<()> {
     tests_content.push_str("# THIS IS GENERATED CODE - DO NOT EDIT\n");
     tests_content.push_str("# Generated by: cargo xtask tmt\n");
     tests_content.push_str("\n");
+    // bootc probes for SELinux mac_admin capability by attempting chcon with
+    // an intentionally invalid label, which generates expected AVC denials.
+    // Report as informational only in OSCI gating test
+    tests_content
+        .push_str("# bootc probes for SELinux mac_admin capability by attempting chcon with\n");
+    tests_content
+        .push_str("# an intentionally invalid label, which generates expected AVC denials.\n");
+    tests_content.push_str("# Report as informational only in OSCI gating test\n");
+    tests_content.push_str("check:\n");
+    tests_content.push_str("  - how: avc\n");
+    tests_content.push_str("    result: info\n");
+    tests_content.push_str("\n");
     tests_content.push_str(&tests_yaml_formatted);
 
     // Only write if content changed

hack/packages.txt

@@ -3,6 +3,9 @@ rsync
 cloud-init
 /usr/bin/flock
 /usr/bin/awk
+# Needed by tmt avc check
+audit
+policycoreutils
 # Required by install-to-filesystem-var-mount test
 parted
 lvm2

tmt/plans/integration.fmf

@@ -2,12 +2,6 @@
 provision:
   how: virtual
   image: $@{test_disk_image}
-# bootc probes for SELinux mac_admin/install_t capability by attempting
-# chcon with an intentionally invalid label (see lsm.rs test_install_t).
-# This generates expected AVC denials that rhel-ci's injected AVC check
-# would otherwise flag as test failures.
-environment:
-    AVC_ERROR: +no_avc_check
 prepare:
   # Install image mode system on package mode system
   # Do not run on image mode VM running on Github CI and Locally

tmt/tests/tests.fmf

@@ -1,6 +1,13 @@
 # THIS IS GENERATED CODE - DO NOT EDIT
 # Generated by: cargo xtask tmt
 
+# bootc probes for SELinux mac_admin capability by attempting chcon with
+# an intentionally invalid label, which generates expected AVC denials.
+# Report as informational only in OSCI gating test
+check:
+  - how: avc
+    result: info
+
 /test-01-readonly:
   summary: Execute booted readonly/nondestructive tests
   duration: 30m