Bug 2327878

Description of problem:
This is 7 of 10 reports I am going to make. 

I've installed CentOS Stream 10 on UEFI using virt-install:

virt-install --connect=qemu:///system --name=cs10 --vcpus=2 --memory=4096 --boot=uefi --osinfo=centos-stream9 --location=https://mirror.stream.centos.org/10-stream/BaseOS/x86_64/os/

It installed correctly but I saw some SELInux issues as soon as it started. Yet, it installed correctly. 

Now, I am trying to boot it and 10 SELinux warnings come up. I will make a report for each one of them. 

I've also, taken a screenshot and recorded a short video of a strange issue. Every time I turn off the machine and back on, the SELInux label changes. I restore them, repeat and the same happens. It's clearer in t
he video which I will attach to the first bug report only. 

Thank you. 

Relates to bug: 2327872

https://bugzilla.redhat.com/show_bug.cgi?id=2327872
SELinux is preventing /usr/sbin/virtqemud from 'getattr' accesses on the directory /dev/binderfs.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that virtqemud should be allowed getattr access on the binderfs directory by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'rpc-virtqemud' --raw | audit2allow -M my-rpcvirtqemud
# semodule -X 300 -i my-rpcvirtqemud.pp

Additional Information:
Source Context                system_u:system_r:virtqemud_t:s0
Target Context                system_u:object_r:binderfs_t:s0
Target Objects                /dev/binderfs [ dir ]
Source                        rpc-virtqemud
Source Path                   /usr/sbin/virtqemud
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           libvirt-daemon-driver-qemu-10.6.0-5.fc41.x86_64
Target RPM Packages           
SELinux Policy RPM            selinux-policy-targeted-41.25-1.fc41.noarch
Local Policy RPM              selinux-policy-targeted-41.25-1.fc41.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Permissive
Host Name                     (removed)
Platform                      Linux (removed) 6.11.8-300.fc41.x86_64 #1 SMP
                              PREEMPT_DYNAMIC Thu Nov 14 20:37:39 UTC 2024
                              x86_64
Alert Count                   8
First Seen                    2024-11-21 11:59:59 CST
Last Seen                     2024-11-21 12:22:47 CST
Local ID                      826ae7f0-5dfe-43ae-a5cf-8ce66b6c4f91

Raw Audit Messages
type=AVC msg=audit(1732213367.621:2436): avc:  denied  { getattr } for  pid=88716 comm="rpc-virtqemud" path="/dev/binderfs" dev="binder" ino=1 scontext=system_u:system_r:virtqemud_t:s0 tcontext=system_u:object_r:binderfs_t:s0 tclass=dir permissive=1


type=SYSCALL msg=audit(1732213367.621:2436): arch=x86_64 syscall=newfstatat success=yes exit=0 a0=ffffff9c a1=7f8e1c094ed0 a2=7f8e2abfded0 a3=0 items=0 ppid=88715 pid=88716 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=rpc-virtqemud exe=/usr/sbin/virtqemud subj=system_u:system_r:virtqemud_t:s0 key=(null)

Hash: rpc-virtqemud,virtqemud_t,binderfs_t,dir,getattr

Version-Release number of selected component:
selinux-policy-targeted-41.25-1.fc41.noarch

Additional info:
reporter:       libreport-2.17.15
reason:         SELinux is preventing /usr/sbin/virtqemud from 'getattr' accesses on the directory /dev/binderfs.
package:        selinux-policy-targeted-41.25-1.fc41.noarch
component:      selinux-policy
hashmarkername: setroubleshoot
type:           libreport
kernel:         6.11.8-300.fc41.x86_64
component:      selinux-policy