Bug 2523236
| Summary: | Connecting to VM vsock socket broken after updating selinux-policy-targeted | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Jason Montleon <jmontleo> |
| Component: | selinux-policy | Assignee: | Zdenek Pytela <zpytela> |
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | medium | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 44 | CC: | dwalsh, lvrabec, mmalik, omosnacek, pkoncity, vmojzis, zpytela |
| Target Milestone: | --- | Keywords: | Regression |
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | selinux-policy-44.8-1.fc44 | Doc Type: | --- |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2026-08-31 17:18:55 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
policy needs to be synced with rawhide you can try a copr build from here https://github.com/fedora-selinux/selinux-policy/pull/3387 The copr build for PR 3387 fixes the issue! FEDORA-2026-16b888c99f (selinux-policy-44.8-1.fc44) has been submitted as an update to Fedora 44. https://bodhi.fedoraproject.org/updates/FEDORA-2026-16b888c99f FEDORA-2026-16b888c99f has been pushed to the Fedora 44 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-16b888c99f` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-16b888c99f See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates. FEDORA-2026-16b888c99f (selinux-policy-44.8-1.fc44) has been pushed to the Fedora 44 stable repository. If problem still persists, please make note of it in this bug report. |
On a virtual machine Upgrading to: Upgrade selinux-policy-0:44.7-1.fc44.noarch Dependency updates Upgrade selinux-policy-targeted-0:44.7-1.fc44.noarch Group updates from: Replaced selinux-policy-0:44.6-1.fc44.noarch Dependency @System Replaced selinux-policy-targeted-0:44.6-1.fc44.noarch Group @System prevents connecting to the VM using vsock `ssh root@vsock%3` I had to run semodule -DB to see the denials. ``` # audit2allow -M vsock < vsock.log ******************** IMPORTANT *********************** To make this policy package active, execute: semodule -i vsock.pp audit2allow generated the following: # audit2allow -m vsock < vsock.log module vsock 1.0; require { type sshd_t; type sshd_session_t; type sshd_auth_t; class vsock_socket { read write }; class process { noatsecure rlimitinh siginh }; } #============= sshd_auth_t ============== allow sshd_auth_t sshd_t:vsock_socket { read write }; #============= sshd_session_t ============== allow sshd_session_t sshd_auth_t:process { noatsecure rlimitinh siginh }; allow sshd_session_t sshd_t:vsock_socket { read write }; #============= sshd_t ============== allow sshd_t sshd_session_t:process siginh; ``` From the collected logs: ``` type=USER_MAC_POLICY_LOAD msg=audit(1787634470.793:263): pid=928 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: op=load_policy lsm=selinux seqno=2 res=1 exe="/usr/bin/dbus-broker" hostname=? addr=? terminal=? res=success'UID="dbus" AUID="unset" type=SERVICE_START msg=audit(1787634470.813:264): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=sshd@7-8193-3:22-2:1280447774 comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'UID="root" AUID="unset" type=AVC msg=audit(1787634470.820:265): avc: denied { read write } for pid=1610 comm="sshd-session" path="socket:[26627]" dev="sockfs" ino=26627 scontext=system_u:system_r:sshd_session_t:s0-s0:c0.c1023 tcontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tclass=vsock_socket permissive=0 type=AVC msg=audit(1787634470.820:266): avc: denied { read write } for pid=1610 comm="sshd-session" path="socket:[26627]" dev="sockfs" ino=26627 scontext=system_u:system_r:sshd_session_t:s0-s0:c0.c1023 tcontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tclass=vsock_socket permissive=0 type=AVC msg=audit(1787634470.820:267): avc: denied { read write } for pid=1610 comm="sshd-session" path="socket:[26627]" dev="sockfs" ino=26627 scontext=system_u:system_r:sshd_session_t:s0-s0:c0.c1023 tcontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tclass=vsock_socket permissive=0 type=AVC msg=audit(1787634470.820:268): avc: denied { siginh } for pid=1610 comm="sshd-session" scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:sshd_session_t:s0-s0:c0.c1023 tclass=process permissive=0 type=SERVICE_STOP msg=audit(1787634470.828:269): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=sshd@7-8193-3:22-2:1280447774 comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'UID="root" AUID="unset" type=SERVICE_START msg=audit(1787634473.175:270): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=setroubleshootd comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'UID="root" AUID="unset" type=SERVICE_START msg=audit(1787634772.367:675): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=sshd@1-4097-3:22-2:1280447776 comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'UID="root" AUID="unset" type=AVC msg=audit(1787634772.380:676): avc: denied { noatsecure } for pid=1493 comm="sshd-session" scontext=system_u:system_r:sshd_session_t:s0-s0:c0.c1023 tcontext=system_u:system_r:sshd_auth_t:s0-s0:c0.c1023 tclass=process permissive=0 type=AVC msg=audit(1787634772.381:677): avc: denied { read write } for pid=1493 comm="sshd-auth" path="socket:[9191]" dev="sockfs" ino=9191 scontext=system_u:system_r:sshd_auth_t:s0-s0:c0.c1023 tcontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tclass=vsock_socket permissive=0 type=AVC msg=audit(1787634772.381:678): avc: denied { read write } for pid=1493 comm="sshd-auth" path="socket:[9191]" dev="sockfs" ino=9191 scontext=system_u:system_r:sshd_auth_t:s0-s0:c0.c1023 tcontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tclass=vsock_socket permissive=0 type=AVC msg=audit(1787634772.381:679): avc: denied { rlimitinh } for pid=1493 comm="sshd-auth" scontext=system_u:system_r:sshd_session_t:s0-s0:c0.c1023 tcontext=system_u:system_r:sshd_auth_t:s0-s0:c0.c1023 tclass=process permissive=0 type=AVC msg=audit(1787634772.381:680): avc: denied { siginh } for pid=1493 comm="sshd-auth" scontext=system_u:system_r:sshd_session_t:s0-s0:c0.c1023 tcontext=system_u:system_r:sshd_auth_t:s0-s0:c0.c1023 tclass=process permissive=0 type=USER_LOGIN msg=audit(1787634772.387:681): pid=1491 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_session_t:s0-s0:c0.c1023 msg='op=login acct="(unknown)" exe="/usr/libexec/openssh/sshd-session" hostname=? addr=UNKNOWN terminal=ssh res=failed'UID="root" AUID="unset" type=SERVICE_STOP msg=audit(1787634772.387:682): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=sshd@1-4097-3:22-2:1280447776 comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'UID="root" AUID="unset" type=SERVICE_START msg=audit(1787634774.677:683): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=setroubleshootd comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'UID="root" AUID="unset" type=SERVICE_START msg=audit(1787634775.421:684): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=dbus-:1.3-org.fedoraproject.SetroubleshootPrivileged@4 comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'UID="root" AUID="unset" ``` Reproducible: Always