Bug 2361423 - SELinux is preventing tuned-ppd from 'create' accesses on the file ppd_base_profile.
Summary: SELinux is preventing tuned-ppd from 'create' accesses on the file ppd_base_p...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 42
Hardware: x86_64
OS: Unspecified
medium
medium
Target Milestone: ---
Assignee: Zdenek Pytela
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: abrt_hash:a576711846ef39ad9955d1f0f32...
: 2367711 (view as bug list)
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-04-21 08:36 UTC by j.bl
Modified: 2025-05-21 09:24 UTC (History)
9 users (show)

Fixed In Version: selinux-policy-41.40-1.fc42
Clone Of:
Environment:
Last Closed: 2025-05-15 01:55:52 UTC
Type: ---
Embargoed:
zpytela: mirror+


Attachments (Terms of Use)
File: description (1.89 KB, text/plain)
2025-04-21 08:36 UTC, j.bl
no flags Details
File: os_info (767 bytes, text/plain)
2025-04-21 08:36 UTC, j.bl
no flags Details


Links
System ID Private Priority Status Summary Last Updated
Github fedora-selinux selinux-policy pull 2679 0 None open Allow tuned-ppd create ppd_base_profile with a file transition 2025-05-12 09:25:46 UTC
Red Hat Issue Tracker FC-1622 0 None None None 2025-04-23 11:35:07 UTC

Description j.bl 2025-04-21 08:36:29 UTC
Description of problem:
SELinux troubleshooter notified me of this. From the names involved, it sounds like something that shouldn't happen.
SELinux is preventing tuned-ppd from 'create' accesses on the file ppd_base_profile.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that tuned-ppd should be allowed create access on the ppd_base_profile file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'tuned-ppd' --raw | audit2allow -M my-tunedppd
# semodule -X 300 -i my-tunedppd.pp

Additional Information:
Source Context                system_u:system_r:tuned_ppd_t:s0
Target Context                system_u:object_r:tuned_etc_t:s0
Target Objects                ppd_base_profile [ file ]
Source                        tuned-ppd
Source Path                   tuned-ppd
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           
Target RPM Packages           
SELinux Policy RPM            selinux-policy-targeted-41.37-1.fc42.noarch
Local Policy RPM              selinux-policy-targeted-41.37-1.fc42.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 6.14.2-300.fc42.x86_64 #1 SMP
                              PREEMPT_DYNAMIC Thu Apr 10 21:50:55 UTC 2025
                              x86_64
Alert Count                   6
First Seen                    2025-04-17 13:27:39 CEST
Last Seen                     2025-04-21 10:25:22 CEST
Local ID                      7bd48478-fee1-41b6-9807-f1627ae5457d

Raw Audit Messages
type=AVC msg=audit(1745223922.767:1726): avc:  denied  { create } for  pid=1250 comm="tuned-ppd" name="ppd_base_profile" scontext=system_u:system_r:tuned_ppd_t:s0 tcontext=system_u:object_r:tuned_etc_t:s0 tclass=file permissive=1


Hash: tuned-ppd,tuned_ppd_t,tuned_etc_t,file,create

Version-Release number of selected component:
selinux-policy-targeted-41.37-1.fc42.noarch

Additional info:
reporter:       libreport-2.17.15
reason:         SELinux is preventing tuned-ppd from 'create' accesses on the file ppd_base_profile.
package:        selinux-policy-targeted-41.37-1.fc42.noarch
component:      selinux-policy
hashmarkername: setroubleshoot
type:           libreport
kernel:         6.14.2-300.fc42.x86_64
comment:        SELinux troubleshooter notified me of this. From the names involved, it sounds like something that shouldn't happen.
component:      selinux-policy

Comment 1 j.bl 2025-04-21 08:36:33 UTC
Created attachment 2086135 [details]
File: description

Comment 2 j.bl 2025-04-21 08:36:34 UTC
Created attachment 2086136 [details]
File: os_info

Comment 3 Zdenek Pytela 2025-05-06 18:03:56 UTC
Hi,

Will you be able to test the coprbuild from
https://github.com/fedora-selinux/selinux-policy/pull/2679
-> checks?

Comment 4 j.bl 2025-05-12 06:22:03 UTC
Thanks, Zdenek. I've installed the copr repo and will see if this fixes the issue. I plan to let you know later this week if it's working.

Comment 5 Fedora Update System 2025-05-13 19:17:45 UTC
FEDORA-2025-5e64167ac4 (selinux-policy-41.40-1.fc42) has been submitted as an update to Fedora 42.
https://bodhi.fedoraproject.org/updates/FEDORA-2025-5e64167ac4

Comment 6 Fedora Update System 2025-05-14 02:07:46 UTC
FEDORA-2025-5e64167ac4 has been pushed to the Fedora 42 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2025-5e64167ac4`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2025-5e64167ac4

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 7 Fedora Update System 2025-05-15 01:55:52 UTC
FEDORA-2025-5e64167ac4 (selinux-policy-41.40-1.fc42) has been pushed to the Fedora 42 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 8 Zdenek Pytela 2025-05-21 09:24:46 UTC
*** Bug 2367711 has been marked as a duplicate of this bug. ***


Note You need to log in before you can comment on or make changes to this bug.