Fedora Account System
Red Hat Associate
Red Hat Customer
kiwi's %post cli labels /usr/bin/kiwi and /usr/bin/kiwi-ng symlinks as install_exec_t. This causes AVC denials from lsmd (libStorageMgmt) which scans /usr/bin/ at boot and calls stat() on all entries. The lsmd_t policy allows getattr on exec_type:file but not lnk_file. Only the actual binary (/usr/bin/kiwi-ng-3) needs install_exec_t — SELinux resolves symlinks on exec, so the binary label is sufficient for domain transitions. Reproducible: Always Steps to Reproduce: sudo dnf install kiwi-cli sudo setenforce 1 sudo truncate -s 0 /var/log/audit/audit.log sudo systemctl restart libstoragemgmt sudo grep "denied.*lsmd" /var/log/audit/audit.log Actual Results: AVC denials are logged every time lsmd starts: type=AVC msg=audit(...): avc: denied { getattr } for comm="lsmd" path="/usr/bin/kiwi" scontext=system_u:system_r:lsmd_t:s0 tcontext=system_u:object_r:install_exec_t:s0 tclass=lnk_file type=AVC msg=audit(...): avc: denied { getattr } for comm="lsmd" path="/usr/bin/kiwi-ng" scontext=system_u:system_r:lsmd_t:s0 tcontext=system_u:object_r:install_exec_t:s0 tclass=lnk_file Expected Results: No AVC denials. The symlinks should have the default bin_t label since only the actual binary needs install_exec_t for domain transitions. Additional Information: - Introduced in commit c1ed67 ("Apply install_exec_t SELinux file context to kiwi executables") - The lsmd_t policy allows getattr on exec_type:file but not exec_type:lnk_file, so any process scanning /usr/bin/ will hit this - SELinux resolves symlinks on exec — labeling symlinks serves no security purpose - Tested fix on AL2023 and Fedora: only labeling kiwi-ng-3 eliminates denials while kiwi continues to work correctly in enforcing mode
This bug appears to have been reported against 'rawhide' during the Fedora Linux 45 development cycle. Changing version to 45.
FEDORA-EPEL-2026-75cc6afd67 (kiwi-11.0.2-1.el10_2) has been submitted as an update to Fedora EPEL 10.2. https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-75cc6afd67
FEDORA-2026-a325558d3a (kiwi-11.0.2-1.fc45) has been submitted as an update to Fedora 45. https://bodhi.fedoraproject.org/updates/FEDORA-2026-a325558d3a
FEDORA-2026-608c092987 (kiwi-11.0.2-1.fc44) has been submitted as an update to Fedora 44. https://bodhi.fedoraproject.org/updates/FEDORA-2026-608c092987
FEDORA-EPEL-2026-e12e5f4f1f (kiwi-11.0.2-1.el10_3) has been submitted as an update to Fedora EPEL 10.3. https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-e12e5f4f1f
FEDORA-EPEL-2026-8405851a97 (kiwi-11.0.2-1.el10_4) has been submitted as an update to Fedora EPEL 10.4. https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-8405851a97
FEDORA-2026-94ae6cb693 (kiwi-11.0.2-1.fc43) has been submitted as an update to Fedora 43. https://bodhi.fedoraproject.org/updates/FEDORA-2026-94ae6cb693
FEDORA-2026-a325558d3a (kiwi-11.0.2-1.fc45) has been pushed to the Fedora 45 stable repository. If problem still persists, please make note of it in this bug report.
FEDORA-EPEL-2026-e12e5f4f1f (kiwi-11.0.2-1.el10_3) has been pushed to the Fedora EPEL 10.3 stable repository. If problem still persists, please make note of it in this bug report.
FEDORA-EPEL-2026-8405851a97 (kiwi-11.0.2-1.el10_4) has been pushed to the Fedora EPEL 10.4 stable repository. If problem still persists, please make note of it in this bug report.
FEDORA-2026-94ae6cb693 (kiwi-11.0.2-1.fc43) has been pushed to the Fedora 43 stable repository. If problem still persists, please make note of it in this bug report.
FEDORA-EPEL-2026-75cc6afd67 (kiwi-11.0.2-1.el10_2) has been pushed to the Fedora EPEL 10.2 stable repository. If problem still persists, please make note of it in this bug report.
FEDORA-2026-608c092987 (kiwi-11.0.2-1.fc44) has been pushed to the Fedora 44 stable repository. If problem still persists, please make note of it in this bug report.