Bug 2417995 - vsomeip3 SELinux policy prevents container access to /run/vsomeip/vsomeip-0 on AutoSD 10
Summary: vsomeip3 SELinux policy prevents container access to /run/vsomeip/vsomeip-0 o...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: vsomeip3
Version: rawhide
Hardware: Unspecified
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: Stephen John Smoogen
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-12-01 13:33 UTC by Dana Orr
Modified: 2025-12-20 01:53 UTC (History)
2 users (show)

Fixed In Version: vsomeip3-3.5.11-3.el9 vsomeip3-3.5.11-3.el10_1 vsomeip3-3.5.11-3.fc43 vsomeip3-3.5.11-3.el10_2 vsomeip3-3.5.11-3.fc42 vsomeip3-3.5.11-6.el10_2 vsomeip3-3.5.11-6.el10_1
Clone Of:
Environment:
Last Closed: 2025-12-12 01:14:12 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Dana Orr 2025-12-01 13:33:00 UTC
When running the quadlet_radio_engine demo under sig-docs/demos on AutoSD 10, both the radio and engine containers fail to connect to the VSOMEIP routing socket /run/vsomeip/vsomeip-0.
This functionality works correctly on AutoSD 9, but on AutoSD 10 the connection consistently fails.

Inside the containers, both applications repeatedly report:
[warning] local_client_endpoint::connect:
Couldn't connect to: /run/vsomeip/vsomeip-0 (Permission denied / 13)

On the host, SELinux AVC denials appear every time the radio and engine attempt to communicate:
avc: denied { connectto } for pid=541 comm="engine-service"
path="/run/vsomeip/vsomeip-0"
scontext=system_u:system_r:container_t:s0:...
tcontext=system_u:system_r:unconfined_service_t:s0
tclass=unix_stream_socket permissive=0

avc: denied { write } for comm="radio-service" name="vsomeip-0"
scontext=system_u:system_r:container_t:s0:...
tcontext=system_u:object_r:var_run_t:s0
tclass=sock_file


According to the vsomeip3-selinux policy, the socket should be labeled vsomeip_var_run_t, but on AutoSD 10 it is labeled var_run_t.
This mismatch prevents VSOMEIP-based applications running inside containers from communicating with the routing manager.

Reproducible: Always

Steps to Reproduce:
1. Build the quadlet_radio_engine image using Automotive Image Builder on AutoSD 10.
2. Run the test (test.sh) or boot the generated VM image.
3. Observe radio.service and engine.service logs as they attempt to connect to /run/vsomeip/vsomeip-0.
Actual Results:
Both containers (radio and engine) fail to connect to /run/vsomeip/vsomeip-0.
Inside both containers the logs repeatedly show:
[warning] local_client_endpoint::connect:
Couldn't connect to: /run/vsomeip/vsomeip-0 (Permission denied / 13)

SELinux AVC denials also appear in the host journal:

avc:  denied  { connectto } for  pid=546 comm="radio-service"
path="/run/vsomeip/vsomeip-0"
scontext=system_u:system_r:container_t:s0:cxxx
tcontext=system_u:system_r:unconfined_service_t:s0
tclass=unix_stream_socket

avc: denied { write } for comm="engine-service"
scontext=system_u:system_r:container_t
tcontext=system_u:object_r:var_run_t
tclass=sock_file

As a result the vsomeip connection never establishes, and the radio never outputs "Lowering volume".

Expected Results:
Containers should be able to communicate with routingmanagerd through /run/vsomeip/vsomeip-0, as they do on AutoSD 9.

Additional Information:
vsomeip3-selinux package is installed, but does not resolve the issue.

According to the policy, the socket should be labeled vsomeip_var_run_t, but on AutoSD 10 it is labeled var_run_t.

Changing labels manually inside the image is not possible due to SELinux restrictions in AutoSD 10.

Comment 1 Stephen John Smoogen 2025-12-01 14:45:54 UTC
Taking ticket. Will do the following:
1. Try to duplicate outside of AutoSD10
2. Update to the 3.5.11 to see if this fixes it.
3. If it doesn't and it is still there will try to debug and then open an upstream bug

Comment 2 Fedora Update System 2025-12-03 17:49:52 UTC
FEDORA-EPEL-2025-ec6e56bab0 (vsomeip3-3.5.11-3.el9) has been submitted as an update to Fedora EPEL 9.
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2025-ec6e56bab0

Comment 3 Fedora Update System 2025-12-03 18:27:41 UTC
FEDORA-EPEL-2025-c3aab4d6af (vsomeip3-3.5.11-3.el10_1) has been submitted as an update to Fedora EPEL 10.1.
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2025-c3aab4d6af

Comment 4 Fedora Update System 2025-12-03 18:27:58 UTC
FEDORA-EPEL-2025-63fce08d0f (vsomeip3-3.5.11-3.el10_2) has been submitted as an update to Fedora EPEL 10.2.
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2025-63fce08d0f

Comment 5 Fedora Update System 2025-12-03 18:50:59 UTC
FEDORA-2025-e957d5442e (vsomeip3-3.5.11-3.fc42) has been submitted as an update to Fedora 42.
https://bodhi.fedoraproject.org/updates/FEDORA-2025-e957d5442e

Comment 6 Fedora Update System 2025-12-03 19:23:59 UTC
FEDORA-2025-b2bb6e6d39 (vsomeip3-3.5.11-3.fc43) has been submitted as an update to Fedora 43.
https://bodhi.fedoraproject.org/updates/FEDORA-2025-b2bb6e6d39

Comment 7 Fedora Update System 2025-12-04 01:12:30 UTC
FEDORA-EPEL-2025-63fce08d0f has been pushed to the Fedora EPEL 10.2 testing repository.

You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2025-63fce08d0f

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 8 Fedora Update System 2025-12-04 01:21:15 UTC
FEDORA-EPEL-2025-ec6e56bab0 has been pushed to the Fedora EPEL 9 testing repository.

You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2025-ec6e56bab0

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 9 Fedora Update System 2025-12-04 01:21:45 UTC
FEDORA-2025-b2bb6e6d39 has been pushed to the Fedora 43 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2025-b2bb6e6d39`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2025-b2bb6e6d39

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 10 Fedora Update System 2025-12-04 01:26:34 UTC
FEDORA-EPEL-2025-c3aab4d6af has been pushed to the Fedora EPEL 10.1 testing repository.

You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2025-c3aab4d6af

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 11 Fedora Update System 2025-12-04 01:48:52 UTC
FEDORA-2025-e957d5442e has been pushed to the Fedora 42 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2025-e957d5442e`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2025-e957d5442e

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 12 Fedora Update System 2025-12-11 11:42:06 UTC
FEDORA-EPEL-2025-7f77ef3ba6 (vsomeip3-3.5.11-6.el10_2) has been submitted as an update to Fedora EPEL 10.2.
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2025-7f77ef3ba6

Comment 13 Fedora Update System 2025-12-11 13:11:02 UTC
FEDORA-EPEL-2025-29b8e257ce (vsomeip3-3.5.11-6.el10_1) has been submitted as an update to Fedora EPEL 10.1.
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2025-29b8e257ce

Comment 14 Fedora Update System 2025-12-12 01:14:12 UTC
FEDORA-EPEL-2025-ec6e56bab0 (vsomeip3-3.5.11-3.el9) has been pushed to the Fedora EPEL 9 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 15 Fedora Update System 2025-12-12 01:25:16 UTC
FEDORA-EPEL-2025-c3aab4d6af (vsomeip3-3.5.11-3.el10_1) has been pushed to the Fedora EPEL 10.1 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 16 Fedora Update System 2025-12-12 01:33:16 UTC
FEDORA-2025-b2bb6e6d39 (vsomeip3-3.5.11-3.fc43) has been pushed to the Fedora 43 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 17 Fedora Update System 2025-12-12 01:34:51 UTC
FEDORA-EPEL-2025-63fce08d0f (vsomeip3-3.5.11-3.el10_2) has been pushed to the Fedora EPEL 10.2 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 18 Fedora Update System 2025-12-12 01:44:27 UTC
FEDORA-EPEL-2025-7f77ef3ba6 has been pushed to the Fedora EPEL 10.2 testing repository.

You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2025-7f77ef3ba6

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 19 Fedora Update System 2025-12-12 01:46:15 UTC
FEDORA-2025-e957d5442e (vsomeip3-3.5.11-3.fc42) has been pushed to the Fedora 42 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 20 Fedora Update System 2025-12-12 02:34:29 UTC
FEDORA-EPEL-2025-29b8e257ce has been pushed to the Fedora EPEL 10.1 testing repository.

You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2025-29b8e257ce

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 21 Fedora Update System 2025-12-20 00:36:06 UTC
FEDORA-EPEL-2025-7f77ef3ba6 (vsomeip3-3.5.11-6.el10_2) has been pushed to the Fedora EPEL 10.2 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 22 Fedora Update System 2025-12-20 01:53:09 UTC
FEDORA-EPEL-2025-29b8e257ce (vsomeip3-3.5.11-6.el10_1) has been pushed to the Fedora EPEL 10.1 stable repository.
If problem still persists, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.