Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 1966834

Summary: [RHEL9] Hit avc denied issue for mdadm and lvm package
Product: Red Hat Enterprise Linux 9 Reporter: guazhang <guazhang>
Component: selinux-policyAssignee: Zdenek Pytela <zpytela>
Status: CLOSED CURRENTRELEASE QA Contact: Milos Malik <mmalik>
Severity: medium Docs Contact:
Priority: medium    
Version: 9.0CC: ffan, lvrabec, mmalik, plautrba, ssekidde, zveleba
Target Milestone: betaKeywords: Triaged
Target Release: 9.0 BetaFlags: pm-rhel: mirror+
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: No Doc Update
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2021-12-07 21:35:16 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description guazhang@redhat.com 2021-06-02 01:55:10 UTC 
Description of problem:

RHEL-9.0.0-20210528.3 BaseOS x86_64

https://beaker.engineering.redhat.com/jobs/5427612

https://beaker.engineering.redhat.com/recipes/10070014#task126609709,task126609720,task126609721

SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             targeted
Current mode:                   enforcing
Mode from config file:          enforcing
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Memory protection checking:     actual (secure)
Max kernel policy version:      33
selinux-policy-34.1.5-1.el9.noarch

https://beaker-archive.host.prod.eng.bos.redhat.com/beaker-logs/2021/05/54276/5427612/10070014/126609720/595469004/avc.log

----
type=AVC msg=audit(06/01/21 21:29:16.892:316) : avc:  denied  { search } for  pid=28986 comm=systemd-udevd name=dma_heap dev="devtmpfs" ino=169 scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:dma_device_t:s0 tclass=dir permissive=1 
----
type=AVC msg=audit(06/01/21 21:32:00.232:347) : avc:  denied  { search } for  pid=29708 comm=mdadm name=dma_heap dev="devtmpfs" ino=169 scontext=system_u:system_r:mdadm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:dma_device_t:s0 tclass=dir permissive=1 
----
type=AVC msg=audit(06/01/21 21:32:00.233:348) : avc:  denied  { read } for  pid=29708 comm=mdadm name=dma_heap dev="devtmpfs" ino=169 scontext=system_u:system_r:mdadm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:dma_device_t:s0 tclass=dir permissive=1 
----
type=AVC msg=audit(06/01/21 21:32:00.233:349) : avc:  denied  { open } for  pid=29708 comm=mdadm path=/dev/dma_heap dev="devtmpfs" ino=169 scontext=system_u:system_r:mdadm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:dma_device_t:s0 tclass=dir permissive=1


type=AVC msg=audit(1622432458.370:525): avc:  denied  { search } for  pid=132113 comm="lvm" name="dma_heap" dev="devtmpfs" ino=169 scontext=system_u:system_r:lvm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:dma_device_t:s0 tclass=dir permissive=0
----
time->Sun May 30 23:40:58 2021
type=AVC msg=audit(1622432458.372:526): avc:  denied  { read } for  pid=132113 comm="lvm" name="dma_heap" dev="devtmpfs" ino=169 scontext=system_u:system_r:lvm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:dma_device_t:s0 tclass=dir permissive=0
----
time->Sun May 30 23:40:58 2021
type=AVC msg=audit(1622432458.499:527): avc:  denied  { search } for  pid=132116 comm="lvm" name="dma_heap" dev="devtmpfs" ino=169 scontext=system_u:system_r:lvm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:dma_device_t:s0 tclass=dir permissive=0


mdadm --create --run /dev/md0 --level=0 --raid-devices=2                /dev/loop0 /dev/loop1


https://beaker-archive.host.prod.eng.bos.redhat.com/beaker-logs/2021/05/54276/5427612/10070014/126609726/595470421/avc.log

type=AVC msg=audit(1622446448.266:186): avc:  denied  { search } for  pid=4267 comm="lvm" name="dma_heap" dev="devtmpfs" ino=168 scontext=system_u:system_r:lvm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:dma_device_t:s0 tclass=dir permissive=0
----
time->Mon May 31 03:34:08 2021
type=AVC msg=audit(1622446448.269:187): avc:  denied  { read } for  pid=4267 comm="lvm" name="dma_heap" dev="devtmpfs" ino=168 scontext=system_u:system_r:lvm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:dma_device_t:s0 tclass=dir permissive=0
----


https://beaker-archive.host.prod.eng.bos.redhat.com/beaker-logs/2021/05/54276/5427612/10070014/126609709/595466543/avc.log

time->Mon May 31 02:58:05 2021
type=AVC msg=audit(1622444285.848:188): avc:  denied  { search } for  pid=8848 comm="systemd-udevd" name="dma_heap" dev="devtmpfs" ino=168 scontext=system_u:system_r:udev_t:s0-s0:c0.c1023 tcontext=system_u:object_r:dma_device_t:s0 tclass=dir permissive=0
Comment 3 Zdenek Pytela 2021-06-04 18:30:35 UTC 
Needs to be backported:
commit 77d425c74814b764671e026bacce82889d1b2953 (upstream-rw/rawhide)
Author: Zdenek Pytela <zpytela>
Date:   Mon May 31 16:33:21 2021 +0200

    Label /dev/dma_heap with dma_device_dir_t
Comment 5 Zdenek Pytela 2021-06-21 15:01:51 UTC 
*** Bug 1967818 has been marked as a duplicate of this bug. ***
Comment 15 Zdenek Pytela 2021-06-29 11:18:35 UTC 
*** Bug 1977261 has been marked as a duplicate of this bug. ***