The Fedora Rawhide SELinux policy blocks the io_uring command passthrough operation on /dev/null for the unconfined_t domain. Reproducible: Always Steps to Reproduce: 1. Run the audit-testsuite in my 'working-iouring' development branch: https://github.com/pcmoore/misc-audit_testsuite/tree/working-iouring Actual Results: The following audit event is generated: type=PROCTITLE msg=audit(04/28/2023 16:24:03.598:214) : proctitle=./iouring t2 type=SYSCALL msg=audit(04/28/2023 16:24:03.598:214) : arch=x86_64 syscall=io_uring_enter success=yes exit=1 a0=0x4 a1=0x1 a2=0x0 a3=0x0 items=0 ppid=932 pid=1106 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts0 ses=1 comm=iouring exe=/root/sources/audit-testsuite/tests/io_uring/iouring subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) type=URINGOP msg=audit(04/28/2023 16:24:03.598:214) : uring_op=uring_cmd success=no exit=EACCES(Permission denied) items=0 ppid=932 pid=1106 uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(04/28/2023 16:24:03.598:214) : avc: denied { cmd } for pid=1106 comm=iouring path=/dev/null dev="devtmpfs" ino=4 scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=system_u:object_r:null_device_t:s0 tclass=io_uring permissive=0 Expected Results: The operation should succeed. % rpm -q selinux-policy selinux-policy-38.12-1.fc39.noarch % uname -r 6.4.0-0.rc0.20230428git33afd4b7.7.2.secnext.fc39.x86_64
Hi Paul, Thanks for reporting. I've submitted a Fedora PR to address the issue: https://github.com/fedora-selinux/selinux-policy/pull/1676 You can try the scratchbuild Checks -> Artifacts -> rpms.zip to see if the fix is complete.
Thanks Zdenek, that resolves the problem on my test system.