Bug 2411970 - New selinux failures
Summary: New selinux failures
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 43
Hardware: Unspecified
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: Zdenek Pytela
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-11-03 12:40 UTC by Cristian Le
Modified: 2025-12-19 10:08 UTC (History)
16 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2025-12-19 10:08:14 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)
avc.txt (7.28 KB, text/plain)
2025-11-03 12:41 UTC, Cristian Le
no flags Details
avc.txt (9.37 KB, text/plain)
2025-12-12 10:01 UTC, Cristian Le
no flags Details


Links
System ID Private Priority Status Summary Last Updated
Github fedora-selinux selinux-policy pull 3002 0 None open Allow systemd-machined read virtd process state 2025-12-16 09:39:24 UTC

Description Cristian Le 2025-11-03 12:40:48 UTC
Please redirect this bug to wherever relevant. Basically, since F43 we are encountering a new selinux failure [1]
```
type=AVC msg=audit(10/30/25 17:34:09.467:4630) : avc:  denied  { search } for  pid=8234 comm=systemd-machine name=59740 dev="proc" ino=130755 scontext=system_u:system_r:systemd_machined_t:s0 tcontext=system_u:system_r:virtd_t:s0-s0:c0.c1023 tclass=dir permissive=0 
```

(more details in the attached avc.txt file)

It seems to impact all tests, so it might be something very early on that is failing.

For more details, we are interacting with libvirt via testcloud [2] which is just a wrapper for the python interface. It does have a selinux handling [3], but I am not versed enough to understand if it is relevant.

[1]: https://github.com/teemtee/tmt/pull/4266 (not sure if you have access to the internal tests there, but we might be able to make the whole run public)
[2]: https://github.com/teemtee/testcloud/
[3]: https://github.com/teemtee/testcloud/blob/f7e6036f5173916723d9aa52a3bc7714950ed312/testcloud/image.py#L258-L272

Reproducible: Always

Comment 1 Cristian Le 2025-11-03 12:41:33 UTC
Created attachment 2112335 [details]
avc.txt

Comment 2 Cole Robinson 2025-11-04 16:06:31 UTC

*** This bug has been marked as a duplicate of bug 2407206 ***

Comment 3 Cristian Le 2025-12-12 10:00:42 UTC
Reopening because the issue is still present even with `selinux-policy-42.18-1.fc43.noarch` which was supposed to fix this. There is a slight difference with the bug marked as duplicate where that one has `tcontext=system_u:system_r:svirt_t` and this one has `tcontext=system_u:system_r:virtd_t`.

Comment 4 Cristian Le 2025-12-12 10:01:30 UTC
Created attachment 2118470 [details]
avc.txt


Note You need to log in before you can comment on or make changes to this bug.