Hide Forgot
Description of problem: With bcc-0.7.0 and pcp-4.1.3 on Fedora 29 Beta after enabling BCC PMDA and the modules it provides: type=AVC msg=audit(1537965513.240:236): avc: denied { map_create } for pid=15717 comm="python3" scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:pcp_pmcd_t:s0 tclass=bpf permissive=1 type=AVC msg=audit(1537965513.240:237): avc: denied { map_read map_write } for pid=15717 comm="python3" scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:pcp_pmcd_t:s0 tclass=bpf permissive=1 type=AVC msg=audit(1537965513.323:238): avc: denied { prog_load } for pid=15717 comm="python3" scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:pcp_pmcd_t:s0 tclass=bpf permissive=1 type=AVC msg=audit(1537965513.324:239): avc: denied { prog_run } for pid=15717 comm="python3" scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:pcp_pmcd_t:s0 tclass=bpf permissive=1 type=AVC msg=audit(1537965560.008:240): avc: denied { getattr } for pid=9973 comm="pmdaproc" path="/dev/gpmctl" dev="devtmpfs" ino=22065 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:gpmctl_t:s0 tclass=sock_file permissive=1 type=AVC msg=audit(1537965563.766:241): avc: denied { signull } for pid=15717 comm="python3" scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1 (Pasting everything seen there, at least the gpmctl_t related was known earlier already.) Thanks.
On Fedora 29 Workstation Beta also: type=AVC msg=audit(1538054722.670:267): avc: denied { getattr associate } for pid=1205 comm="pmdalinux" key=0 scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tclass=shm permissive=1
Just pushed this commits upstream. commit e7ca60ae8e4a22a69bea682ebaf992a3924a9633 (HEAD -> master, origin/master, origin/HEAD) Author: Lukas Berk <lberk> Date: Thu Sep 27 14:44:52 2018 -0400 selinux: rhbza1633211 continued Further avc denials as reported by marko commit 82b0d271a96f3dcb53beaf2639ef8ea1f73b2cf8 Author: Lukas Berk <lberk> Date: Thu Sep 27 11:49:18 2018 -0400 selinux: rhbz1633211 bpf class & inheritence issues Not only add bpf class checks/rules, but add --common flags (where applicable) to catch the permissions where the class access type is inherited. This should (hopefully) solve the issue on newer selinux versions where the user space tooling can report inheritence, and opts to omit large potions of the class access types.
pcp-4.2.0-1.fc29 has been submitted as an update to Fedora 29. https://bodhi.fedoraproject.org/updates/FEDORA-2018-3b0d7f7858
pcp-4.2.0-1.fc28 has been submitted as an update to Fedora 28. https://bodhi.fedoraproject.org/updates/FEDORA-2018-ae612244a9
pcp-4.2.0-1.fc27 has been submitted as an update to Fedora 27. https://bodhi.fedoraproject.org/updates/FEDORA-2018-8da69c3c21
pcp-4.2.0-1.fc29 has been pushed to the Fedora 29 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-3b0d7f7858
pcp-4.2.0-1.fc27 has been pushed to the Fedora 27 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-8da69c3c21
pcp-4.2.0-1.fc28 has been pushed to the Fedora 28 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-ae612244a9
pcp-4.2.0-1.fc27 has been pushed to the Fedora 27 stable repository. If problems still persist, please make note of it in this bug report.
pcp-4.2.0-1.fc29 has been pushed to the Fedora 29 stable repository. If problems still persist, please make note of it in this bug report.
pcp-4.2.0-1.fc28 has been pushed to the Fedora 28 stable repository. If problems still persist, please make note of it in this bug report.