Bug 1844198

Following SELinux denials appeared in permissive mode:
----
type=PROCTITLE msg=audit(06/04/2020 21:02:31.010:768) : proctitle=ovs-vswitchd unix:/var/run/openvswitch/db.sock -vconsole:emer -vsyslog:err -vfile:info --mlockall --user openvswitch:hugetlbfs - 
type=SYSCALL msg=audit(06/04/2020 21:02:31.010:768) : arch=x86_64 syscall=socket success=yes exit=32 a0=netlink a1=SOCK_RAW a2=pup a3=0x55f6da38ea20 items=0 ppid=51033 pid=51034 auid=unset uid=openvswitch gid=hugetlbfs euid=openvswitch suid=openvswitch fsuid=openvswitch egid=hugetlbfs sgid=hugetlbfs fsgid=hugetlbfs tty=(none) ses=unset comm=ovs-vswitchd exe=/usr/sbin/ovs-vswitchd subj=system_u:system_r:openvswitch_t:s0 key=(null) 
type=AVC msg=audit(06/04/2020 21:02:31.010:768) : avc:  denied  { create } for  pid=51034 comm=ovs-vswitchd scontext=system_u:system_r:openvswitch_t:s0 tcontext=system_u:system_r:openvswitch_t:s0 tclass=netlink_netfilter_socket permissive=1 
----
type=PROCTITLE msg=audit(06/04/2020 21:02:31.010:769) : proctitle=ovs-vswitchd unix:/var/run/openvswitch/db.sock -vconsole:emer -vsyslog:err -vfile:info --mlockall --user openvswitch:hugetlbfs - 
type=SYSCALL msg=audit(06/04/2020 21:02:31.010:769) : arch=x86_64 syscall=setsockopt success=yes exit=0 a0=0x20 a1=SOL_SOCKET a2=SO_RCVBUFFORCE a3=0x7ffe40f37a3c items=0 ppid=51033 pid=51034 auid=unset uid=openvswitch gid=hugetlbfs euid=openvswitch suid=openvswitch fsuid=openvswitch egid=hugetlbfs sgid=hugetlbfs fsgid=hugetlbfs tty=(none) ses=unset comm=ovs-vswitchd exe=/usr/sbin/ovs-vswitchd subj=system_u:system_r:openvswitch_t:s0 key=(null) 
type=AVC msg=audit(06/04/2020 21:02:31.010:769) : avc:  denied  { setopt } for  pid=51034 comm=ovs-vswitchd scontext=system_u:system_r:openvswitch_t:s0 tcontext=system_u:system_r:openvswitch_t:s0 tclass=netlink_netfilter_socket permissive=1 
----
type=PROCTITLE msg=audit(06/04/2020 21:02:31.010:770) : proctitle=ovs-vswitchd unix:/var/run/openvswitch/db.sock -vconsole:emer -vsyslog:err -vfile:info --mlockall --user openvswitch:hugetlbfs - 
type=SYSCALL msg=audit(06/04/2020 21:02:31.010:770) : arch=x86_64 syscall=getsockopt success=yes exit=0 a0=0x20 a1=SOL_SOCKET a2=SO_RCVBUF a3=0x7ffe40f379d4 items=0 ppid=51033 pid=51034 auid=unset uid=openvswitch gid=hugetlbfs euid=openvswitch suid=openvswitch fsuid=openvswitch egid=hugetlbfs sgid=hugetlbfs fsgid=hugetlbfs tty=(none) ses=unset comm=ovs-vswitchd exe=/usr/sbin/ovs-vswitchd subj=system_u:system_r:openvswitch_t:s0 key=(null) 
type=AVC msg=audit(06/04/2020 21:02:31.010:770) : avc:  denied  { getopt } for  pid=51034 comm=ovs-vswitchd scontext=system_u:system_r:openvswitch_t:s0 tcontext=system_u:system_r:openvswitch_t:s0 tclass=netlink_netfilter_socket permissive=1 
----
type=PROCTITLE msg=audit(06/04/2020 21:02:31.010:771) : proctitle=ovs-vswitchd unix:/var/run/openvswitch/db.sock -vconsole:emer -vsyslog:err -vfile:info --mlockall --user openvswitch:hugetlbfs - 
type=SOCKADDR msg=audit(06/04/2020 21:02:31.010:771) : saddr={ saddr_fam=netlink nlnk-fam=16 nlnk-pid=0 } 
type=SYSCALL msg=audit(06/04/2020 21:02:31.010:771) : arch=x86_64 syscall=connect success=yes exit=0 a0=0x20 a1=0x7ffe40f37a4c a2=0xc a3=0x7ffe40f379d4 items=0 ppid=51033 pid=51034 auid=unset uid=openvswitch gid=hugetlbfs euid=openvswitch suid=openvswitch fsuid=openvswitch egid=hugetlbfs sgid=hugetlbfs fsgid=hugetlbfs tty=(none) ses=unset comm=ovs-vswitchd exe=/usr/sbin/ovs-vswitchd subj=system_u:system_r:openvswitch_t:s0 key=(null) 
type=AVC msg=audit(06/04/2020 21:02:31.010:771) : avc:  denied  { connect } for  pid=51034 comm=ovs-vswitchd scontext=system_u:system_r:openvswitch_t:s0 tcontext=system_u:system_r:openvswitch_t:s0 tclass=netlink_netfilter_socket permissive=1 
----
type=PROCTITLE msg=audit(06/04/2020 21:02:31.010:772) : proctitle=ovs-vswitchd unix:/var/run/openvswitch/db.sock -vconsole:emer -vsyslog:err -vfile:info --mlockall --user openvswitch:hugetlbfs - 
type=SOCKADDR msg=audit(06/04/2020 21:02:31.010:772) : saddr={ saddr_fam=netlink nlnk-fam=16 nlnk-pid=51034 } 
type=SYSCALL msg=audit(06/04/2020 21:02:31.010:772) : arch=x86_64 syscall=getsockname success=yes exit=0 a0=0x20 a1=0x7ffe40f37a40 a2=0x7ffe40f37a38 a3=0x7ffe40f379d4 items=0 ppid=51033 pid=51034 auid=unset uid=openvswitch gid=hugetlbfs euid=openvswitch suid=openvswitch fsuid=openvswitch egid=hugetlbfs sgid=hugetlbfs fsgid=hugetlbfs tty=(none) ses=unset comm=ovs-vswitchd exe=/usr/sbin/ovs-vswitchd subj=system_u:system_r:openvswitch_t:s0 key=(null) 
type=AVC msg=audit(06/04/2020 21:02:31.010:772) : avc:  denied  { getattr } for  pid=51034 comm=ovs-vswitchd scontext=system_u:system_r:openvswitch_t:s0 tcontext=system_u:system_r:openvswitch_t:s0 tclass=netlink_netfilter_socket permissive=1
----

# ldd /usr/sbin/ovs-vswitchd | grep pcap
	librte_pmd_pcap.so.20.0 => /lib64/librte_pmd_pcap.so.20.0 (0x00007fdc857e7000)
	libpcap.so.1 => /lib64/libpcap.so.1 (0x00007fdc84ddb000)
# rpm -qf /lib64/libpcap.so.1
libpcap-1.9.1-3.fc32.x86_64
#

There is additional SELinux denial visible on Fedora 33:
----
type=PROCTITLE msg=audit(06/04/2020 15:33:48.940:392) : proctitle=install -d -m 755 -o openvswitch -g hugetlbfs /var/run/openvswitch 
type=PATH msg=audit(06/04/2020 15:33:48.940:392) : item=0 name=(null) inode=46535 dev=00:19 mode=dir,700 ouid=openvswitch ogid=hugetlbfs rdev=00:00 obj=system_u:object_r:openvswitch_var_run_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=SYSCALL msg=audit(06/04/2020 15:33:48.940:392) : arch=x86_64 syscall=fchmod success=no exit=EPERM(Operation not permitted) a0=0x5 a1=0755 a2=0x0 a3=0x0 items=1 ppid=26821 pid=26870 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=install exe=/usr/bin/install subj=system_u:system_r:openvswitch_t:s0 key=(null) 
type=AVC msg=audit(06/04/2020 15:33:48.940:392) : avc:  denied  { fowner } for  pid=26870 comm=install capability=fowner  scontext=system_u:system_r:openvswitch_t:s0 tcontext=system_u:system_r:openvswitch_t:s0 tclass=capability permissive=0 
----

The rest of SELinux denials is the same as on Fedora 32.

This affects OKD-on-FCOS 32, which requires OVS to work in enforcing mode. Bumping priority

For the fowner permission: The PATH entry of the audit record is empty, but the object type is openvswitch_var_run_t, i. e. managed by openvswitch:

type=PROCTITLE msg=audit(09/15/20 07:24:02.347:458) : proctitle=install -d -m 755 -o openvswitch -g hugetlbfs /var/run/openvswitch 
type=PATH msg=audit(09/15/20 07:24:02.347:458) : item=0 name=(null) inode=51760 dev=00:1a mode=dir,700 ouid=openvswitch ogid=hugetlbfs rdev=00:00 obj=system_u:object_r:openvswitch_var_run_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=SYSCALL msg=audit(09/15/20 07:24:02.347:458) : arch=x86_64 syscall=fchmod success=no exit=EPERM(Operation not permitted) a0=0x5 a1=0755 a2=0x0 a3=0x0 items=1 ppid=29628 pid=29677 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=install exe=/usr/bin/install subj=system_u:system_r:openvswitch_t:s0 key=(null) 
type=AVC msg=audit(09/15/20 07:24:02.347:458) : avc:  denied  { fowner } for  pid=29677 comm=install capability=fowner  scontext=system_u:system_r:openvswitch_t:s0 tcontext=system_u:system_r:openvswitch_t:s0 tclass=capability permissive=0 


I've submitted a Fedora PR to address the issue:
https://github.com/fedora-selinux/selinux-policy-contrib/pull/333

Fixed in F32 and F33