Bug 2270461

Summary:	SELinux denial for dhcpcd in /run/dhcpcd
Product:	[Fedora] Fedora	Reporter:	Major Hayden 🤠 <mhayden>
Component:	selinux-policy	Assignee:	Zdenek Pytela <zpytela>
Status:	CLOSED RAWHIDE	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	rawhide	CC:	dwalsh, knazekovan, lvrabec, mmalik, omosnacek, pkoncity, vmojzis, zpytela
Target Milestone:	---
Target Release:	---
Hardware:	x86_64
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2024-04-14 20:57:47 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2247055

Description Major Hayden 🤠 2024-03-20 13:28:11 UTC

I'm working on implementing dhcpcd support in cloud-init in BZ 2247055 and it's working well except for an SELinux AVC during the boot:

AVC avc:  denied  { connectto } for  pid=769 comm="dhcpcd" path="/run/dhcpcd/eth0-4.unpriv.sock" scontext=system_u:system_r:dhcpc_t:s0 tcontext=system_u:system_r:dhcpc_t:s0 tclass=unix_stream_socket permissive=0

I'm not sure if this is in Fedora's selinux-policy patches or if this comes from the mainline policy repository.

Reproducible: Always

Comment 1 Zdenek Pytela 2024-03-20 14:27:08 UTC

Thanks for the early report, you can try this PR scratchbuild to see if the fix is sufficient:

https://github.com/fedora-selinux/selinux-policy/pull/2069/checks
rpm-build:fedora-rawhide-x86_64

Comment 2 Major Hayden 🤠 2024-03-21 12:35:51 UTC

Fantastic! That works just fine. No more AVCs! 👏

cloud-init[766]: Cloud-init v. 24.1.1 running 'init-local' at Thu, 21 Mar 2024 12:34:28 +0000. Up 8.74 seconds.
dhcpcd[768]: dhcpcd-10.0.6 starting
dhcpcd[771]: DUID 00:01:00:01:2d:8e:e5:aa:02:45:29:a8:79:6f
kernel: 8021q: 802.1Q VLAN Support v1.8
dhcpcd[771]: eth0: IAID 29:a8:79:6f
avahi-daemon[751]: Server startup complete. Host name is ip-172-31-15-224.local. Local service cookie is 1350427016.
dhcpcd[771]: eth0: rebinding lease of 172.31.15.224
dhcpcd[771]: eth0: leased 172.31.15.224 for 3600 seconds
avahi-daemon[751]: Joining mDNS multicast group on interface eth0.IPv4 with address 172.31.15.224.
avahi-daemon[751]: New relevant interface eth0.IPv4 for mDNS.
avahi-daemon[751]: Registering new address record for 172.31.15.224 on eth0.IPv4.
dhcpcd[771]: eth0: adding route to 172.31.0.0/20
dhcpcd[771]: eth0: adding default route via 172.31.0.1
dhcpcd[771]: control command: /usr/sbin/dhcpcd --dumplease --ipv4only eth0
avahi-daemon[751]: Joining mDNS multicast group on interface eth0.IPv6 with address fe80::45:29ff:fea8:796f.
avahi-daemon[751]: New relevant interface eth0.IPv6 for mDNS.
avahi-daemon[751]: Registering new address record for fe80::45:29ff:fea8:796f on eth0.*.

Comment 3 Zdenek Pytela 2024-03-21 14:10:15 UTC

Thanks for testing, it'll be in the next rawhide and f40 builds.