Bug 2481246

Summary: SELinux blocks strongswan VPN initiated via NetworkManager
Product: [Fedora] Fedora Reporter: Christian Krause <chkr>
Component: selinux-policyAssignee: Zdenek Pytela <zpytela>
Status: NEW --- QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: unspecified    
Version: 44CC: dwalsh, lvrabec, mmalik, omosnacek, pkoncity, vmojzis, zpytela
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Christian Krause 2026-05-25 18:39:23 UTC 
NetworkManager added a new security features which leads to additional filesystem access in /var/run/NetworkManager/cert:

https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/2324

That is currently not allowed by selinux-policy-targeted.




Reproducible: Always

Steps to Reproduce:
1. configure a strongswan-based VPN (do NOT select: "Make available to other users")
2. enable VPN
3. due to BZ #2461399 there is another permission problem with standard UNIX permissions - after the first connection attempt it is necessary to fix the permissions temporarily: 'chmod 700 /var/run/NetworkManager/cert'
4. enable VPN again
Actual Results:
The creation of the temporary files is denied by SELinux.

From /var/log/audit/audit.log:

type=AVC msg=audit(1779732798.917:693): avc:  denied  { add_name } for  pid=11190 comm="charon-nm" name="bWsojW" scontext=system_u:system_r:ipsec_t:s0 tcontext=system_u:object_r:NetworkManager_var_run_t:s0 tclass=dir permissive=1
type=AVC msg=audit(1779732798.917:694): avc:  denied  { create } for  pid=11190 comm="charon-nm" name="bWsojW" scontext=system_u:system_r:ipsec_t:s0 tcontext=system_u:object_r:NetworkManager_var_run_t:s0 tclass=file permissive=1
type=AVC msg=audit(1779732798.917:695): avc:  denied  { read open } for  pid=11190 comm="charon-nm" path="/run/NetworkManager/cert/bWsojW" dev="tmpfs" ino=5309 scontext=system_u:system_r:ipsec_t:s0 tcontext=system_u:object_r:NetworkManager_var_run_t:s0 tclass=file permissive=1
type=AVC msg=audit(1779732798.917:696): avc:  denied  { getattr } for  pid=11190 comm="charon-nm" path="/run/NetworkManager/cert/bWsojW" dev="tmpfs" ino=5309 scontext=system_u:system_r:ipsec_t:s0 tcontext=system_u:object_r:NetworkManager_var_run_t:s0 tclass=file permissive=1
type=AVC msg=audit(1779732798.918:697): avc:  denied  { remove_name } for  pid=11190 comm="charon-nm" name="bWsojW.FNK4P3" dev="tmpfs" ino=5310 scontext=system_u:system_r:ipsec_t:s0 tcontext=system_u:object_r:NetworkManager_var_run_t:s0 tclass=dir permissive=1
type=AVC msg=audit(1779732798.918:698): avc:  denied  { rename } for  pid=11190 comm="charon-nm" name="bWsojW.FNK4P3" dev="tmpfs" ino=5310 scontext=system_u:system_r:ipsec_t:s0 tcontext=system_u:object_r:NetworkManager_var_run_t:s0 tclass=file permissive=1
type=AVC msg=audit(1779732798.918:699): avc:  denied  { unlink } for  pid=11190 comm="charon-nm" name="bWsojW" dev="tmpfs" ino=5309 scontext=system_u:system_r:ipsec_t:s0 tcontext=system_u:object_r:NetworkManager_var_run_t:s0 tclass=file permissive=1

Note: the file names in /var/run/NetworkManager/cert are random (generated via mkstemp()).

Expected Results:
SELinux should allow the creation of these files.

Additional Information:
When using audit2allow, it suggests:

require {
	type NetworkManager_var_run_t;
	type ipsec_t;
	class dir { add_name create remove_name };
	class file { create getattr open read rename unlink };
}

#============= ipsec_t ==============
allow ipsec_t NetworkManager_var_run_t:dir { add_name create remove_name };
allow ipsec_t NetworkManager_var_run_t:file { create getattr open read rename unlink };