Bug 2365140

Description of problem:
Installed the recent nvidia drivers for cuda on the machine following the instructions at:

https://docs.nvidia.com/datacenter/tesla/driver-installation-guide/index.html

Have the following nvidia drivers installed

nvidia-driver-assistant-0.20.133.20-1.noarch
nvidia-gpu-firmware-20250410-1.fc41.noarch
nvidia-modprobe-575.51.03-1.fc41.x86_64
nvidia-kmod-common-575.51.03-1.fc41.noarch
kmod-nvidia-open-dkms-575.51.03-1.fc41.noarch
libnvidia-ml-575.51.03-1.fc41.x86_64
libnvidia-gpucomp-575.51.03-1.fc41.x86_64
libnvidia-cfg-575.51.03-1.fc41.x86_64
nvidia-driver-cuda-libs-575.51.03-1.fc41.x86_64
nvidia-driver-libs-575.51.03-1.fc41.x86_64
nvidia-driver-575.51.03-1.fc41.x86_64
nvidia-libXNVCtrl-575.51.03-1.fc41.x86_64
nvidia-settings-575.51.03-1.fc41.x86_64
libnvidia-fbc-575.51.03-1.fc41.x86_64
nvidia-persistenced-575.51.03-1.fc41.x86_64
nvidia-driver-cuda-575.51.03-1.fc41.x86_64
nvidia-open-575.51.03-1.fc41.noarch
xorg-x11-nvidia-575.51.03-1.fc41.x86_64


I attempted to run the pcp-pmda-nvidia-gpu pmda with:

sudo dnf install pcp-pmda-nvidia-gpu -y
 cd /var/lib/pcp/pmdas/nvidia
sudo ./Install
(selected daemon)

Once the pcp nvidia pmda started running got a steady stream of SEL alert messages.
SELinux is preventing pmdanvidia from 'create' accesses on the directory nvidia-caps.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that pmdanvidia should be allowed create access on the nvidia-caps directory by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'pmdanvidia' --raw | audit2allow -M my-pmdanvidia
# semodule -X 300 -i my-pmdanvidia.pp

Additional Information:
Source Context                system_u:system_r:pcp_pmcd_t:s0
Target Context                system_u:object_r:device_t:s0
Target Objects                nvidia-caps [ dir ]
Source                        pmdanvidia
Source Path                   pmdanvidia
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           
Target RPM Packages           
SELinux Policy RPM            selinux-policy-targeted-41.38-1.fc41.noarch
Local Policy RPM              pcp-selinux-6.3.7-2.fc41.x86_64
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 6.13.9-200.fc41.x86_64 #1 SMP
                              PREEMPT_DYNAMIC Sat Mar 29 01:29:31 UTC 2025
                              x86_64
Alert Count                   674
First Seen                    2025-05-07 10:34:00 EDT
Last Seen                     2025-05-07 18:27:58 EDT
Local ID                      e0b6d12c-3882-4755-9f24-dbeb55209df3

Raw Audit Messages
type=AVC msg=audit(1746656878.649:3246): avc:  denied  { create } for  pid=29718 comm="pmdanvidia" name="nvidia-caps" scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:device_t:s0 tclass=dir permissive=0


Hash: pmdanvidia,pcp_pmcd_t,device_t,dir,create

Version-Release number of selected component:
selinux-policy-targeted-41.38-1.fc41.noarch

Additional info:
reporter:       libreport-2.17.15
package:        selinux-policy-targeted-41.38-1.fc41.noarch
reason:         SELinux is preventing pmdanvidia from 'create' accesses on the directory nvidia-caps.
kernel:         6.14.5-200.fc41.x86_64
type:           libreport
component:      pcp
hashmarkername: setroubleshoot
component:      pcp