selinux: restore missing ioctl/lock and gpg_exec_t in optional policy blocks

[bfjelds]

Problem

PR #636 replaced refpolicy interface macros with hand-expanded allow rules inside optional_policy blocks so the policy compiles on ACL images that lack those modules. However, the manual expansions had two permission gaps:

1. gpg_exec_t dropped entirely

The original gpg_entry_type(trident_t) macro expanded to domain_entry_file(trident_t, gpg_exec_t), granting trident access to the main gpg/gpg2 binary. The replacement only covered gpg_agent_exec_t — gpg_exec_t was neither required nor referenced.

On full Azure Linux where GPG is installed, trident loses all permissions on the gpg binary (needed by tdnf/rpm for package signature verification).

2. ioctl and lock systematically dropped from all exec replacements

Six exec macro replacements (chronyd_exec_t, logrotate_exec_t, rpm_exec_t, sudo_exec_t, kadmind_exec_t, gpg_agent_exec_t) all used { getattr open read execute execute_no_trans map } but the original can_exec / domain_entry_file macros also grant ioctl and lock.

This creates a permission gap on full AZL that could cause AVC denials.

3. entrypoint used instead of execute_no_trans on gpg binaries

The pre-#636 policy used gpg_entry_type(trident_t) which grants entrypoint — meaning 'this binary is a valid entry point for transitioning INTO trident_t.' However, trident (and osmodifier, which trident calls) do not directly exec gpg. GPG is invoked indirectly by tdnf/rpm for package signature verification, running in trident_t via execute_no_trans. There is no type_transition rule for gpg → trident_t anywhere in the policy, so entrypoint was always a latent bug in the original policy. The correct permission is execute_no_trans (execute without domain transition), matching can_exec macro semantics.

Verified that all tools invoked by osmodifier (useradd, usermod, systemctl, openssl, sed, grub2-mkconfig, blkid, setfiles, semanage, chmod) are already covered by existing policy rules.

Fix

• Add gpg_exec_t to the GPG optional block
• Use execute_no_trans (not entrypoint) on both gpg_exec_t and gpg_agent_exec_t to match actual runtime behavior
• Restore ioctl and lock on all six _exec_t allow rules to match upstream macro semantics

Review

Changes validated by 9-agent deep review (3 roles × 3 models: GPT-5.5, Opus, Sonnet). Finding #2 (entrypoint semantics) was flagged by all 3 skeptic models and 2 of 3 architect models.

Validation

• trideht pr-e2e: https://dev.azure.com/mariner-org/ECF/_build/results?buildId=1116164&view=results
• acl ab-update: https://dev.azure.com/mariner-org/ACL/_build/results?buildId=1116173

[Copilot]

Pull request overview

Fixes SELinux policy permission regressions introduced when refpolicy interface macros were manually expanded inside optional_policy blocks (to support ACL images that remove certain SELinux modules). This PR restores missing permissions so Trident can execute GPG and other helper binaries without AVC denials on full Azure Linux images.

Changes:

• Add gpg_exec_t back into the optional GPG policy block and grant Trident the expected executable access.
• Restore ioctl and lock permissions on several _exec_t allow rules (chronyd, logrotate, rpm, sudo, kadmind, and gpg-agent) to align with prior macro-derived permissions.

[bfjelds]

/azp run [GITHUB]-trident-pr-e2e

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).