Bug 2236394

Summary: avc: denied { create } for pid=993 comm="systemd-network" name=".#networkd734718013635965" scontext=system_u:system_r:systemd_network_generator_t:s0
Product: [Fedora] Fedora Reporter: Martin Pitt <mpitt>
Component: selinux-policyAssignee: Zdenek Pytela <zpytela>
Status: CLOSED DUPLICATE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: medium    
Version: 39CC: dwalsh, lvrabec, mmalik, nknazeko, omosnacek, pkoncity, vmojzis, zpytela
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Linux   
URL: https://cockpit-logs.us-east-1.linodeobjects.com/pull-18843-20230830-111332-f8fd0064-fedora-39-storage/log.html#17
Whiteboard: CockpitTest
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2023-09-08 22:19:25 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Martin Pitt 2023-08-31 06:56:53 UTC 
This is a variant of bug 2223571. This time it's about "create", instead of "sendto" or "write":

audit: type=1400 audit(1693394653.739:4): avc:  denied  { create } for  pid=993 comm="systemd-network" name=".#networkd734718013635965" scontext=system_u:system_r:systemd_network_generator_t:s0 tcontext=system_u:object_r:init_var_run_t:s0 tclass=file permissive=0



Reproducible: Sometimes

Steps to Reproduce:
We only saw this once, in a test case that's completely unrelated to network configuration. I. e. this is "magic background activity". But as it's very similar to #2223571, it's hopefully simple to adjust the policy?
Comment 1 Zdenek Pytela 2023-08-31 07:22:26 UTC 
This rather seems to be a follow-up to bz#2230226, but I believe it was resolved. What was your selinux-policy version?
Comment 2 Martin Pitt 2023-08-31 07:41:50 UTC 
Our image has selinux-policy-38.25-1.fc39.noarch . That's the latest available one from https://bodhi.fedoraproject.org/updates/?packages=selinux-policy. If the bz#2230226 fix didn't land in F39 yet, of course feel free to make this a duplicate. Thanks!
Comment 3 Zdenek Pytela 2023-09-08 22:19:25 UTC 
The fix was in selinux-policy-38.25-1.fc39.noarch, but not complex enough. Closing anyway as a dup now that the root cause is (hopefully) disclosed.

*** This bug has been marked as a duplicate of bug 2230226 ***