Description of problem:

We isolated problem [1] in customer's RHOSP 16.1 (based on RHEL 8.2) deployment when we tried to analyze SELinux status. 

I was able to find Fedora bug https://bugzilla.redhat.com/show_bug.cgi?id=1713898, but it looks like fix wasn't backported to RHEL 8 yet, with RHEL 8.6 policy, the rule is not there either:

# sesearch -A -s snmpd_t -c cap_userns -p sys_ptrace

Commit that seem to address this problem:
commit adc572faae590e87ef91f8ba3ee8e99f92a531ea
Author: Lukas Vrabec <lvrabec>
Date:   Tue Nov 26 14:50:46 2019 +0100

    Allow snmpd_t domain to trace processes in user namespace
    
    Resolves: rhbz#1713898


I understand that it is hard to justify backport to RHEL 8.2, but would be great to have this fix in RHEL 8.4 (many RHOSP users will rely on RHEL 8.4 for a while).


[1]
SELinux is preventing snmpd from sys_ptrace access on the cap_userns labeled snmpd_t.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that snmpd should be allowed sys_ptrace access on cap_userns labeled snmpd_t by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'snmpd' --raw | audit2allow -M my-snmpd
# semodule -X 300 -i my-snmpd.pp


Additional Information:
Source Context                system_u:system_r:snmpd_t:s0
Target Context                system_u:system_r:snmpd_t:s0
Target Objects                Unknown [ cap_userns ]
Source                        snmpd
Source Path                   snmpd
Port                          <Unknown>
Host                          hostname
Source RPM Packages
Target RPM Packages
Policy RPM                    selinux-policy-3.14.3-41.el8_2.9.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Permissive
Host Name                     hostname
Platform                      Linux hostname
                              4.18.0-193.65.2.el8_2.x86_64 #1 SMP Mon Aug 30
                              04:52:32 EDT 2021 x86_64 x86_64
Alert Count                   32
First Seen                    2022-03-21 19:25:06 UTC
Last Seen                     2022-08-21 13:45:31 UTC
Local ID                      e12d319f-0335-4a96-8d64-33bd0e2d7a2d

Raw Audit Messages
type=AVC msg=audit(1661089531.866:11152269): avc:  denied  { sys_ptrace } for  pid=4356 comm="snmpd" capability=19  scontext=system_u:system_r:snmpd_t:s0 tcontext=system_u:system_r:snmpd_t:s0 tclass=cap_userns permissive=1


Hash: snmpd,snmpd_t,snmpd_t,cap_userns,sys_ptrace

Version-Release number of selected component (if applicable):
RHEL 8.2