Bug 2315513 - SELinux is preventing 99-nvme-nbft-co from using the 'siginh' accesses on a process.
Summary: SELinux is preventing 99-nvme-nbft-co from using the 'siginh' accesses on a p...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 41
Hardware: x86_64
OS: Unspecified
medium
low
Target Milestone: ---
Assignee: Zdenek Pytela
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: abrt_hash:a5ca84bc7865d5c66079b4c10e3...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2024-09-29 04:51 UTC by Renich Bon Ciric
Modified: 2025-07-10 16:29 UTC (History)
8 users (show)

Fixed In Version: selinux-policy-41.44-1.fc41
Clone Of:
Environment:
Last Closed: 2025-07-08 08:49:48 UTC
Type: ---
Embargoed:
zpytela: mirror+


Attachments (Terms of Use)
File: description (2.08 KB, text/plain)
2024-09-29 04:51 UTC, Renich Bon Ciric
no flags Details
File: os_info (756 bytes, text/plain)
2024-09-29 04:51 UTC, Renich Bon Ciric
no flags Details


Links
System ID Private Priority Status Summary Last Updated
Github fedora-selinux selinux-policy pull 2677 0 None Draft Label 99-nvme-nbft-connect.sh with NetworkManager_dispatcher_nvme_scr… 2025-05-06 15:44:45 UTC
Red Hat Issue Tracker FC-1647 0 None None None 2025-05-06 15:46:43 UTC

Description Renich Bon Ciric 2024-09-29 04:51:35 UTC
Description of problem:
Trying to create a guest in Fedora 40. Different kind of denial. 
SELinux is preventing 99-nvme-nbft-co from using the 'siginh' accesses on a process.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that 99-nvme-nbft-co should be allowed siginh access on processes labeled NetworkManager_dispatcher_custom_t by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c '99-nvme-nbft-co' --raw | audit2allow -M my-99nvmenbftco
# semodule -X 300 -i my-99nvmenbftco.pp

Additional Information:
Source Context                system_u:system_r:NetworkManager_dispatcher_t:s0
Target Context                system_u:system_r:NetworkManager_dispatcher_custom
                              _t:s0
Target Objects                Unknown [ process ]
Source                        99-nvme-nbft-co
Source Path                   99-nvme-nbft-co
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           
Target RPM Packages           
SELinux Policy RPM            selinux-policy-targeted-41.19-1.fc41.noarch
Local Policy RPM              selinux-policy-targeted-41.19-1.fc41.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 6.11.0-63.fc41.x86_64 #1 SMP
                              PREEMPT_DYNAMIC Sun Sep 15 17:48:54 UTC 2024
                              x86_64
Alert Count                   1
First Seen                    2024-09-28 22:48:55 CST
Last Seen                     2024-09-28 22:48:55 CST
Local ID                      dd79958e-7d30-4035-8a47-af90cd5397d9

Raw Audit Messages
type=AVC msg=audit(1727585335.368:1357): avc:  denied  { siginh } for  pid=24893 comm="99-nvme-nbft-co" scontext=system_u:system_r:NetworkManager_dispatcher_t:s0 tcontext=system_u:system_r:NetworkManager_dispatcher_custom_t:s0 tclass=process permissive=0


Hash: 99-nvme-nbft-co,NetworkManager_dispatcher_t,NetworkManager_dispatcher_custom_t,process,siginh

Version-Release number of selected component:
selinux-policy-targeted-41.19-1.fc41.noarch

Additional info:
reporter:       libreport-2.17.15
reason:         SELinux is preventing 99-nvme-nbft-co from using the 'siginh' accesses on a process.
package:        selinux-policy-targeted-41.19-1.fc41.noarch
component:      selinux-policy
hashmarkername: setroubleshoot
type:           libreport
kernel:         6.11.0-63.fc41.x86_64
comment:        Trying to create a guest in Fedora 40. Different kind of denial. 
component:      selinux-policy

Comment 1 Renich Bon Ciric 2024-09-29 04:51:37 UTC
Created attachment 2049351 [details]
File: description

Comment 2 Renich Bon Ciric 2024-09-29 04:51:39 UTC
Created attachment 2049352 [details]
File: os_info

Comment 3 Fedora Update System 2025-06-23 12:27:34 UTC
FEDORA-2025-d3953bee7c (selinux-policy-41.44-1.fc41) has been submitted as an update to Fedora 41.
https://bodhi.fedoraproject.org/updates/FEDORA-2025-d3953bee7c

Comment 4 Fedora Update System 2025-06-24 02:25:24 UTC
FEDORA-2025-d3953bee7c has been pushed to the Fedora 41 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2025-d3953bee7c`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2025-d3953bee7c

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 5 Fedora Update System 2025-07-10 16:29:09 UTC
FEDORA-2025-d3953bee7c (selinux-policy-41.44-1.fc41) has been pushed to the Fedora 41 stable repository.
If problem still persists, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.