Bug 2282396 - Installing a package triggers systemd and selinux generators which causes AVC errors
Summary: Installing a package triggers systemd and selinux generators which causes AVC...
Keywords:
Status: CLOSED DUPLICATE of bug 2280935
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: rawhide
Hardware: Unspecified
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: Zdenek Pytela
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2024-05-22 10:57 UTC by Tomáš Hozza
Modified: 2024-05-22 13:59 UTC (History)
7 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2024-05-22 13:59:18 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Tomáš Hozza 2024-05-22 10:57:34 UTC
I'm observing AVCs when installing osbuild-ostree package as part of the Fedora installability test:

----
type=AVC msg=audit(05/22/2024 08:40:57.441:687) : avc:  denied  { map_read map_write } for  pid=4024 comm=selinux-autorel scontext=system_u:system_r:selinux_autorelabel_generator_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=bpf permissive=0 
----
type=AVC msg=audit(05/22/2024 08:40:57.447:688) : avc:  denied  { map_read map_write } for  pid=4028 comm=systemd-fstab-g scontext=system_u:system_r:systemd_fstab_generator_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=bpf permissive=0 
----
type=AVC msg=audit(05/22/2024 08:40:57.457:689) : avc:  denied  { map_read map_write } for  pid=4030 comm=systemd-gpt-aut scontext=system_u:system_r:systemd_gpt_generator_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=bpf permissive=0 
----
type=AVC msg=audit(05/22/2024 08:40:57.459:690) : avc:  denied  { map_read map_write } for  pid=4033 comm=systemd-rc-loca scontext=system_u:system_r:systemd_rc_local_generator_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=bpf permissive=0 
----
type=AVC msg=audit(05/22/2024 08:40:57.475:691) : avc:  denied  { map_read map_write } for  pid=4038 comm=systemd-sysv-ge scontext=system_u:system_r:systemd_sysv_generator_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=bpf permissive=0 
----
type=AVC msg=audit(05/22/2024 08:40:57.511:692) : avc:  denied  { read } for  pid=4035 comm=systemd-ssh-gen name=vsock dev="devtmpfs" ino=386 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:vsock_device_t:s0 tclass=chr_file permissive=0

No AVCs are observed with the same package on older Fedora releases.

https://src.fedoraproject.org/rpms/osbuild/pull-request/281
https://artifacts.dev.testing-farm.io/dbe11dc8-4386-4c99-8d28-7bde961fc22a/

Reproducible: Always

Comment 1 Zdenek Pytela 2024-05-22 13:59:18 UTC

*** This bug has been marked as a duplicate of bug 2280935 ***


Note You need to log in before you can comment on or make changes to this bug.