Bug 2440594

Summary:	Incorrect context on /var/opt [regression]
Product:	[Fedora] Fedora	Reporter:	Pierre Ossman <ossman>
Component:	selinux-policy	Assignee:	Zdenek Pytela <zpytela>
Status:	ASSIGNED ---	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	unspecified	Docs Contact:
Priority:	medium
Version:	43	CC:	dan, lvrabec, mmalik, omosnacek, pkoncity, vmojzis, zpytela
Target Milestone:	---	Flags:	zpytela: mirror+
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Pierre Ossman 2026-02-18 13:50:23 UTC

Description of problem:
Files and directories under /var/opt have the wrong context, blocking access and breaking applications.

Version-Release number of selected component (if applicable):
selinux-policy-42.24-1.fc43.noarch

How reproducible:
100%

Steps to Reproduce:
1. ls -Zd /var/opt

Actual results:
> system_u:object_r:usr_t:s0 /var/opt

Expected results:
> system_u:object_r:var_t:s0 /var/opt

Additional info:
This is a regression caused here:

https://github.com/fedora-selinux/selinux-policy/pull/2917

Upstream bug report:

https://github.com/fedora-selinux/selinux-policy/issues/2960

This is breaking third-party software that uses the "opt" namespaces.

No known workaround except reverting the above PR.

Comment 1 Pierre Ossman 2026-03-16 10:13:36 UTC

Any idea on a timeline for a fix here? Do we need to start looking at more permanent workarounds for software that uses /var/opt?

The bug has unfortunately propagated to SLES 16, so this is hitting enterprise users now. I'm worried it will show up in RHEL as well soon.