Description of problem: A relatively new Cockpit integration test [1] sets up a systemd-tty-askpass agent to reply to the LUKS password prompt at boot. This spuriously creates an SELinux violation: audit: type=1400 audit(1630396253.336:96): avc: denied { watch watch_reads } for pid=480 comm="systemd-tty-ask" path="/dev/tty1" dev="devtmpfs" ino=20 scontext=system_u:system_r:systemd_passwd_agent_t:s0 tcontext=system_u:object_r:tty_device_t:s0 tclass=chr_file permissive=0 audit: type=1300 audit(1630396253.336:96): arch=c000003e syscall=254 success=no exit=-13 a0=7 a1=7ffe9c946f23 a2=18 a3=564142057830 items=0 ppid=476 pid=480 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-tty-ask" exe="/usr/bin/systemd-tty-ask-password-agent" subj=system_u:system_r:systemd_passwd_agent_t:s0 key=(null) This doesn't appear to be something between systemd and SELinux, not influenced by our custom agent. That seems to have merely triggered this code. Version-Release number of selected component (if applicable): systemd-248.7-1.fc34.x86_64 selinux-policy-34.16-1.fc34.noarch How reproducible: Seldomly [1] https://github.com/cockpit-project/cockpit/blob/254b2b8f4e865d98a7/test/verify/check-storage-luks#L478 [2] https://github.com/cockpit-project/cockpit/blob/254b2b8f4e865d98a7338d131ebaf8d02add45b3/test/verify/storagelib.py#L439
Created attachment 1819294 [details] full journal Attaching full journal in case that is useful.
I've submitted a Fedora PR to address the issue: https://github.com/fedora-selinux/selinux-policy/pull/885
FEDORA-2021-a15b7e7314 has been submitted as an update to Fedora 34. https://bodhi.fedoraproject.org/updates/FEDORA-2021-a15b7e7314
FEDORA-2021-a15b7e7314 has been pushed to the Fedora 34 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --advisory=FEDORA-2021-a15b7e7314` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2021-a15b7e7314 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2021-a15b7e7314 has been pushed to the Fedora 34 stable repository. If problem still persists, please make note of it in this bug report.