Bug 2176487

The SELinux denials listed in comment#0 appear after removing the dontaudit rules.

Here are the SELinux denials caught in permissive mode:
----
type=PROCTITLE msg=audit(03/08/2023 09:20:36.049:343) : proctitle=ip link delete dev ppp0 
type=SYSCALL msg=audit(03/08/2023 09:20:36.049:343) : arch=x86_64 syscall=sendmsg success=yes exit=32 a0=0x3 a1=0x7ffe74892a30 a2=0x0 a3=0x9b items=0 ppid=4704 pid=4711 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=ip exe=/usr/sbin/ip subj=system_u:system_r:wireguard_t:s0 key=(null) 
type=AVC msg=audit(03/08/2023 09:20:36.049:343) : avc:  denied  { search } for  pid=4711 comm=ip name=slab dev="debugfs" ino=9932 scontext=system_u:system_r:wireguard_t:s0 tcontext=system_u:object_r:debugfs_t:s0 tclass=dir permissive=1 
----
type=PROCTITLE msg=audit(03/08/2023 09:20:40.752:352) : proctitle=ip link show dev ppp0 
type=SYSCALL msg=audit(03/08/2023 09:20:40.752:352) : arch=x86_64 syscall=ioctl success=no exit=ENODEV(No such device) a0=0x4 a1=SIOCGIFINDEX a2=0x7ffc3bd7aec0 a3=0x16 items=0 ppid=4739 pid=4740 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=ip exe=/usr/sbin/ip subj=system_u:system_r:wireguard_t:s0 key=(null) 
type=AVC msg=audit(03/08/2023 09:20:40.752:352) : avc:  denied  { sys_module } for  pid=4740 comm=ip capability=sys_module  scontext=system_u:system_r:wireguard_t:s0 tcontext=system_u:system_r:wireguard_t:s0 tclass=capability permissive=1 
----

further info of where I face this:

This works:
sudo wg-quick up <profile>

This does not work:
sudo systemctl start wg-quick@<profile>
sudo nmcli connection up <profile>

My wg conf is:

------
[Interface]
Address = 10.254.251.102
PrivateKey = <privkey>
DNS = 10.128.1.10
[Peer]
PublicKey = <pubkey>
AllowedIPs = 10.128.1.0/24, 10.128.2.0/24, 10.128.3.0/24, 10.128.4.0/24
Endpoint = <server-ip>:51820
PersistentKeepalive = 25
------

@ikke I would like you to test a special policy module in enforcing mode:

# setenforce 1
# cat testpolicy.cil 
( allow wireguard_t wireguard_t ( capability ( sys_module )))
( allow wireguard_t system_dbusd_t ( dbus ( send_msg )))
( allow wireguard_t debugfs_t ( dir ( search )))

# semodule -i testpolicy.cil 
#

Please re-run your scenario (systemctl start wg-quick@<profile>) and let us know if it works.

Please collect SELinux denials if they appear:

# ausearch -m avc -m user_avc -m selinux_err -i -ts today

The following command removes the policy module shown above:

# semodule -r testpolicy
#

Thank you.

Created attachment 1949149 [details]
Audit log as requested

Here are the commands:

------------
[coolboy@apu ~]$ cat testpolicy.cil
( allow wireguard_t wireguard_t ( capability ( sys_module )))
( allow wireguard_t system_dbusd_t ( dbus ( send_msg )))
( allow wireguard_t debugfs_t ( dir ( search )))
[coolboy@apu ~]$ getenforce
Enforcing
[coolboy@apu ~]$ sudo semodule -i testpolicy.cil
[coolboy@apu ~]$ date
Wed Mar  8 22:28:02 EET 2023
[coolboy@apu ~]$ sudo systemctl start wg-quick@cool-lab
[coolboy@apu ~]$ sudo wg
interface: cool-lab
  public key: xxx
  private key: (hidden)
  listening port: 37170

peer: xxx
  endpoint: xxx:51820
  allowed ips: 10.128.1.0/24, 10.128.2.0/24, 10.128.3.0/24, 10.128.4.0/24
  latest handshake: 3 seconds ago
  transfer: 92 B received, 180 B sent
  persistent keepalive: every 25 seconds
[coolboy@apu ~]$ sudo ausearch -m avc -m user_avc -m selinux_err -i -ts 03/08/23 22:28 > audit.txt
------------

see attached audit.txt.

It worked \o/ , not going to remove the policy :D

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (selinux-policy bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2023:2483