Bug 2291273

It doesn't work on libvirt-10.1.0-2.fc40.x86_64 selinux-policy-40.20-1.fc40.noarch either

The following SELinux denial appeared in enforcing mode:
----
type=PROCTITLE msg=audit(06/11/2024 03:35:58.951:1746) : proctitle=/usr/sbin/virtnetworkd --timeout 120 
type=PATH msg=audit(06/11/2024 03:35:58.951:1746) : item=0 name=/proc/5741/stat nametype=UNKNOWN cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(06/11/2024 03:35:58.951:1746) : cwd=/ 
type=SYSCALL msg=audit(06/11/2024 03:35:58.951:1746) : arch=x86_64 syscall=openat success=no exit=EACCES(Permission denied) a0=AT_FDCWD a1=0x55d5506deb30 a2=O_RDONLY a3=0x0 items=1 ppid=1 pid=5646 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=virtnetworkd exe=/usr/sbin/virtnetworkd subj=system_u:system_r:virtnetworkd_t:s0 key=(null) 
type=AVC msg=audit(06/11/2024 03:35:58.951:1746) : avc:  denied  { search } for  pid=5646 comm=virtnetworkd name=5741 dev="proc" ino=34144 scontext=system_u:system_r:virtnetworkd_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=dir permissive=0 
----

The following SELinux denials appeared in permissive mode:
----
type=PROCTITLE msg=audit(06/11/2024 03:37:56.377:1776) : proctitle=/usr/sbin/virtnetworkd --timeout 120 
type=PATH msg=audit(06/11/2024 03:37:56.377:1776) : item=0 name=/proc/5773/stat inode=35154 dev=00:16 mode=file,444 ouid=root ogid=root rdev=00:00 obj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(06/11/2024 03:37:56.377:1776) : cwd=/ 
type=SYSCALL msg=audit(06/11/2024 03:37:56.377:1776) : arch=x86_64 syscall=openat success=yes exit=18 a0=AT_FDCWD a1=0x55f3cb26cb90 a2=O_RDONLY a3=0x0 items=1 ppid=1 pid=5775 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=virtnetworkd exe=/usr/sbin/virtnetworkd subj=system_u:system_r:virtnetworkd_t:s0 key=(null) 
type=AVC msg=audit(06/11/2024 03:37:56.377:1776) : avc:  denied  { open } for  pid=5775 comm=virtnetworkd path=/proc/5773/stat dev="proc" ino=35154 scontext=system_u:system_r:virtnetworkd_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=file permissive=1 
type=AVC msg=audit(06/11/2024 03:37:56.377:1776) : avc:  denied  { read } for  pid=5775 comm=virtnetworkd name=stat dev="proc" ino=35154 scontext=system_u:system_r:virtnetworkd_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=file permissive=1 
type=AVC msg=audit(06/11/2024 03:37:56.377:1776) : avc:  denied  { search } for  pid=5775 comm=virtnetworkd name=5773 dev="proc" ino=35035 scontext=system_u:system_r:virtnetworkd_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=dir permissive=1 
----

Using the virt-admin command, similar issues can be reproduced for other virt* services.

# for I in `find /usr/lib/systemd/system -type f -name virt\*.service | cut -d / -f 6 | cut -d . -f 1` ; do service $I start ; virt-admin -c $I:///system exit ; done

When all SELinux denials that appeared in enforcing mode are analyzed by audit2allow, the output looks this way:

#============= virtnetworkd_t ==============
allow virtnetworkd_t unconfined_t:dir search;
allow virtnetworkd_t unconfined_t:file { open read };

#============= virtnodedevd_t ==============
allow virtnodedevd_t unconfined_t:dir search;

#============= virtnwfilterd_t ==============
allow virtnwfilterd_t unconfined_t:dir search;

#============= virtsecretd_t ==============
allow virtsecretd_t unconfined_t:dir search;
allow virtsecretd_t unconfined_t:file { open read };

#============= virtstoraged_t ==============
allow virtstoraged_t unconfined_t:dir search;
allow virtstoraged_t unconfined_t:file { open read };

#============= virtvboxd_t ==============
allow virtvboxd_t unconfined_t:dir search;
allow virtvboxd_t unconfined_t:file { open read };

When all SELinux denials that appeared in permissive mode are analyzed by audit2allow, the output looks this way:

#============= virtnetworkd_t ==============
allow virtnetworkd_t unconfined_t:dir search;
allow virtnetworkd_t unconfined_t:file { open read };

#============= virtnodedevd_t ==============
allow virtnodedevd_t unconfined_t:dir search;
allow virtnodedevd_t unconfined_t:file { open read };

#============= virtnwfilterd_t ==============
allow virtnwfilterd_t unconfined_t:dir search;
allow virtnwfilterd_t unconfined_t:file { open read };

#============= virtsecretd_t ==============
allow virtsecretd_t unconfined_t:dir search;
allow virtsecretd_t unconfined_t:file { open read };

#============= virtstoraged_t ==============
allow virtstoraged_t unconfined_t:dir search;
allow virtstoraged_t unconfined_t:file { open read };

#============= virtvboxd_t ==============
allow virtvboxd_t unconfined_t:dir search;
allow virtvboxd_t unconfined_t:file { open read };

Test coverage for this bug exists in a form of PR:
 * https://src.fedoraproject.org/tests/selinux/pull-request/510

The PR waits for a review.