Description of problem: I updated to selinux-policy-34.10-1.fc34 from koji in a Fedora 34 KDE Plasma installation. I'm using the targeted policy in enforcing mode. I rebooted. The systemd denials of reading and searching /dev/dma_heap didn't happen while booting as reported in https://bugzilla.redhat.com/show_bug.cgi?id=1965743. systemd was denied associating with /dev/dma_heap while booting around when the journal was started on the next 3 boots. Jun 07 13:18:13 audit[1]: AVC avc: denied { associate } for pid=1 comm="systemd" name="dma_heap" dev="devtmpfs" ino=137 scontext=system_u:object_r:dma_device_dir_t:s0 tcontext=system_u:object_r:device_t:s0 tclass=filesystem permissive=0 This denial didn't appear with selinux-policy-34.9-1.fc34 or earlier. Version-Release number of selected component (if applicable): selinux-policy-34.10-1.fc34 How reproducible: systemd was denied associating with /dev/dma_heap while booting with selinux-policy-34.10-1.fc34 on 3/3 boots Steps to Reproduce: 1. Boot a Fedora 34 KDE Plasma installation updated to 2021-6-7 2. Log in to Plasma on Wayland 3. start konsole 4. sudo dnf upgrade https://kojipkgs.fedoraproject.org//packages/selinux-policy/34.10/1.fc34/noarch/selinux-policy-34.10-1.fc34.noarch.rpm https://kojipkgs.fedoraproject.org//packages/selinux-policy/34.10/1.fc34/noarch/selinux-policy-targeted-34.10-1.fc34.noarch.rpm 5. Reboot Actual results: systemd was denied associating with /dev/dma_heap while booting with selinux-policy-34.10-1.fc34 Expected results: No denials would happen. Additional info: The denial message has the source labelled as dma_device_dir_t. The selinux-policy-34.10-1.fc34 changelog at https://koji.fedoraproject.org/koji/buildinfo?buildID=1763228 noted the change - Label /dev/dma_heap with dma_device_dir_t
Matt, Thank you for the early report, should be fixed soon. https://github.com/fedora-selinux/selinux-policy/pull/774
FEDORA-2021-d8e34dbd6e has been submitted as an update to Fedora 34. https://bodhi.fedoraproject.org/updates/FEDORA-2021-d8e34dbd6e
FEDORA-2021-d8e34dbd6e has been pushed to the Fedora 34 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --advisory=FEDORA-2021-d8e34dbd6e` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2021-d8e34dbd6e See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2021-d8e34dbd6e has been pushed to the Fedora 34 stable repository. If problem still persists, please make note of it in this bug report.