Bug 2411970

Summary: New selinux failures
Product: [Fedora] Fedora Reporter: Cristian Le <fedora>
Component: selinux-policyAssignee: Zdenek Pytela <zpytela>
Status: CLOSED CURRENTRELEASE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: unspecified    
Version: 43CC: berrange, clalancette, crobinso, dwalsh, jforbes, jiyin, laine, libvirt-maint, lvrabec, mmalik, omosnacek, pkoncity, suraj.ghimire7, virt-maint, vmojzis, zpytela
Target Milestone: ---Keywords: Reopened
Target Release: ---   
Hardware: Unspecified   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2025-12-19 10:08:14 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
avc.txt
none
avc.txt none

Description Cristian Le 2025-11-03 12:40:48 UTC
Please redirect this bug to wherever relevant. Basically, since F43 we are encountering a new selinux failure [1]
```
type=AVC msg=audit(10/30/25 17:34:09.467:4630) : avc:  denied  { search } for  pid=8234 comm=systemd-machine name=59740 dev="proc" ino=130755 scontext=system_u:system_r:systemd_machined_t:s0 tcontext=system_u:system_r:virtd_t:s0-s0:c0.c1023 tclass=dir permissive=0 
```

(more details in the attached avc.txt file)

It seems to impact all tests, so it might be something very early on that is failing.

For more details, we are interacting with libvirt via testcloud [2] which is just a wrapper for the python interface. It does have a selinux handling [3], but I am not versed enough to understand if it is relevant.

[1]: https://github.com/teemtee/tmt/pull/4266 (not sure if you have access to the internal tests there, but we might be able to make the whole run public)
[2]: https://github.com/teemtee/testcloud/
[3]: https://github.com/teemtee/testcloud/blob/f7e6036f5173916723d9aa52a3bc7714950ed312/testcloud/image.py#L258-L272

Reproducible: Always

Comment 1 Cristian Le 2025-11-03 12:41:33 UTC
Created attachment 2112335 [details]
avc.txt

Comment 2 Cole Robinson 2025-11-04 16:06:31 UTC

*** This bug has been marked as a duplicate of bug 2407206 ***

Comment 3 Cristian Le 2025-12-12 10:00:42 UTC
Reopening because the issue is still present even with `selinux-policy-42.18-1.fc43.noarch` which was supposed to fix this. There is a slight difference with the bug marked as duplicate where that one has `tcontext=system_u:system_r:svirt_t` and this one has `tcontext=system_u:system_r:virtd_t`.

Comment 4 Cristian Le 2025-12-12 10:01:30 UTC
Created attachment 2118470 [details]
avc.txt