Bug 2371004
| Summary: | SELinux is preventing ps from using the 'perfmon' capabilities. | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Colin J Thomson <colin.thomson> | ||||||
| Component: | pcp | Assignee: | William Cohen <wcohen> | ||||||
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | ||||||
| Severity: | unspecified | Docs Contact: | |||||||
| Priority: | unspecified | ||||||||
| Version: | 42 | CC: | agerstmayr, fberat, hhorak, jkurik, lchilton, mwolf, nathans, prd-fedora, redhat, sfeifer, steve.shockley, tony, wcohen, zawertun | ||||||
| Target Milestone: | --- | Flags: | hhorak:
mirror+
|
||||||
| Target Release: | --- | ||||||||
| Hardware: | x86_64 | ||||||||
| OS: | Unspecified | ||||||||
| Whiteboard: | abrt_hash:decbf91629a2cede8751b664773db001624d382065094c6e8978f5c3170a3bbd;VARIANT_ID=kde; | ||||||||
| Fixed In Version: | pcp-6.3.7-8.fc42 | Doc Type: | --- | ||||||
| Doc Text: | Story Points: | --- | |||||||
| Clone Of: | Environment: | ||||||||
| Last Closed: | 2025-07-17 01:26:36 UTC | Type: | --- | ||||||
| Regression: | --- | Mount Type: | --- | ||||||
| Documentation: | --- | CRM: | |||||||
| Verified Versions: | Category: | --- | |||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||
| Embargoed: | |||||||||
| Attachments: |
|
||||||||
Created attachment 2093425 [details]
File: os_info
Created attachment 2093426 [details]
File: description
+1 on my side. Was probably triggered by upgrading to Kernel 6.15.x Saw the errors in the log, but the computer was idle and not being used at the time. Don't know what caused it. reason: SELinux is preventing ps from using the 'perfmon' capabilities. package: selinux-policy-targeted-41.44-1.fc42.noarch hashmarkername: setroubleshoot type: libreport kernel: 6.15.3-200.fc42.x86_64 comment: Saw the errors in the log, but the computer was idle and not being used at the time. Don't know what caused it. till they fixed it, I created this selinux module:
module pcp_pmie_sysadmin 1.0;
require {
type pcp_pmlogger_t;
class capability2 perfmon;
}
allow pcp_pmlogger_t self:capability2 perfmon;
This gets rid of the error in a suitable way in my opinion.
My system is reporting 4701 occurrences of this in the last two days:
type=AVC msg=audit(1751228714.971:5236): avc: denied { perfmon } for pid=363764 comm="ps" capability=38 scontext=system_u:system_r:pcp_pmlogger_t:s0 tcontext=system_u:system_r:pcp_pmlogger_t:s0 tclass=capability2 permissive=0
Problem appears after updating my system reason: SELinux is preventing ps from using the 'perfmon' capabilities. package: selinux-policy-targeted-41.44-1.fc42.noarch hashmarkername: setroubleshoot type: libreport kernel: 6.15.4-200.fc42.x86_64 comment: Problem appears after updating my system I have seen the same issue on my fc41 machine runing 6.15.3 and 6.15.4 kernels. I have made an upstream pull request with a patch to address this issue: https://github.com/performancecopilot/pcp/pull/2231 FEDORA-2025-d396057e40 (pcp-6.3.7-8.fc42) has been submitted as an update to Fedora 42. https://bodhi.fedoraproject.org/updates/FEDORA-2025-d396057e40 FEDORA-2025-d396057e40 has been pushed to the Fedora 42 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2025-d396057e40` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2025-d396057e40 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates. I have applied the updates and the warnings have gone now, Thank you. FEDORA-2025-d396057e40 (pcp-6.3.7-8.fc42) has been pushed to the Fedora 42 stable repository. If problem still persists, please make note of it in this bug report. |
Description of problem: I am currently running the kernel-6.15.1-200.fc42 for the test week when these alerts started. Booting back to kernel-6.14.x the alerts are gone. SELinux is preventing ps from using the 'perfmon' capabilities. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that ps should have the perfmon capability by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'ps' --raw | audit2allow -M my-ps # semodule -X 300 -i my-ps.pp Additional Information: Source Context system_u:system_r:pcp_pmlogger_t:s0 Target Context system_u:system_r:pcp_pmlogger_t:s0 Target Objects Unknown [ capability2 ] Source ps Source Path ps Port <Unknown> Host (removed) Source RPM Packages Target RPM Packages SELinux Policy RPM selinux-policy-targeted-41.43-1.fc42.noarch Local Policy RPM pcp-selinux-6.3.7-5.fc42.x86_64 Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 6.15.1-200.fc42.x86_64 #1 SMP PREEMPT_DYNAMIC Fri Jun 6 09:32:26 UTC 2025 x86_64 Alert Count 65 First Seen 2025-06-08 13:55:10 BST Last Seen 2025-06-08 14:25:10 BST Local ID 8e7767b2-7ca3-4f55-97c6-7fb0c45a3d86 Raw Audit Messages type=AVC msg=audit(1749389110.267:1017): avc: denied { perfmon } for pid=32787 comm="ps" capability=38 scontext=system_u:system_r:pcp_pmlogger_t:s0 tcontext=system_u:system_r:pcp_pmlogger_t:s0 tclass=capability2 permissive=0 Hash: ps,pcp_pmlogger_t,pcp_pmlogger_t,capability2,perfmon Version-Release number of selected component: selinux-policy-targeted-41.43-1.fc42.noarch Additional info: reporter: libreport-2.17.15 package: selinux-policy-targeted-41.43-1.fc42.noarch kernel: 6.15.1-200.fc42.x86_64 component: pcp reason: SELinux is preventing ps from using the 'perfmon' capabilities. hashmarkername: setroubleshoot type: libreport event_log: 2025-06-08-14:51:12> Looking for similar problems in bugzilla component: pcp