Please re-run the automated tests in permissive mode (setenforce 0) and collect SELinux denials which will appear.

Thank you.

The permissive mode did not reveal additional SELinux denials:
----
type=PROCTITLE msg=audit(01/10/2022 04:06:11.137:944) : proctitle=perf record -e probe:* -o perf.data -aR -- inotifywait -e delete /tmp/perf_file 
type=SYSCALL msg=audit(01/10/2022 04:06:11.137:944) : arch=x86_64 syscall=bpf success=yes exit=792 a0=BPF_PROG_GET_FD_BY_ID a1=0x7ffdfc7c7150 a2=0x80 a3=0x7a items=0 ppid=2149 pid=22816 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=perf exe=/usr/bin/perf subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) 
type=AVC msg=audit(01/10/2022 04:06:11.137:944) : avc:  denied  { prog_run } for  pid=22816 comm=perf scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=system_u:system_r:virtd_t:s0-s0:c0.c1023 tclass=bpf permissive=1 
----

The attached audit.log files also contain the already known SELinux denials generated by the sss_cache program.

Can you explain what is the purpose and effect of this command which appears to be in the test?

perf record -e probe:* -o perf.data -aR -- inotifywait -e delete /tmp/perf_file

I use the tool [1] to do a performance test in which perf is used. To use perf tool it usually run "perf probe" to set some kernel functions probing, in my case it will run [2] first and then run perf record to save the calling of those kernel functions. It's hard to explain it clear in simple words. For details please see [3].

perf record -e probe:* -o perf.data -aR -- inotifywait -e delete /tmp/perf_file
-e probe: * means probe all the set functions
-o: the output file
-aR: options for perf record
inotifywait -e delete /tmp/perf_file: perf record will not be terminated until receiving inotify delete event for deleting file /tmp/perf_file.

[1] https://github.com/marceloleitner/perf-flower
[2] https://github.com/marceloleitner/perf-flower/blob/master/rate-monitor/perf-probes.sh
[3] https://man7.org/linux/man-pages/man1/perf.1.html

To backport:
commit 9a0c6ca3209e1562ccd337b50592be6b4a86157d (HEAD -> rawhide, upstream/rawhide)
Author: Nikola Knazekova <nknazeko>
Date:   Tue Feb 8 13:43:30 2022 +0100

    Allow unconfined to run virtd bpf

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (new packages: selinux-policy), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2022:3918