Description of problem: When working on some SELinux enhancements to snapd, I got this: ---- time->Thu Mar 28 15:09:46 2019 type=AVC msg=audit(1553785786.977:906): avc: denied { map_create } for pid=31513 comm="systemd" scontext=system_u:system_r:unconfined_service_t:s0 tcontext=system_u:system_r:unconfined_service_t:s0 tclass=bpf permissive=0 ---- Since we already allow map_create for unconfined_t, we should perhaps allow it for unconfined_service_t too. Version-Release number of selected component (if applicable): selinux-policy-3.14.2-49.fc29.noarch selinux-policy-devel-3.14.2-49.fc29.noarch selinux-policy-targeted-3.14.2-49.fc29.noarch How reproducible: always
commit 3fdfab205c1fe9cfe2f29fe128934d91d553e010 Author: Lukas Vrabec <lvrabec> Date: Mon Apr 1 13:25:30 2019 +0200 Allow unconfined_domain_type to use bpf tools BZ(1694115)
selinux-policy-3.14.2-53.fc29 has been submitted as an update to Fedora 29. https://bodhi.fedoraproject.org/updates/FEDORA-2019-bf377d92c7
selinux-policy-3.14.2-53.fc29 has been pushed to the Fedora 29 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2019-bf377d92c7
selinux-policy-3.14.2-53.fc29 has been pushed to the Fedora 29 stable repository. If problems still persist, please make note of it in this bug report.
Thank you for the fix!