Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-109838

[image mode avc issue]unexpected avc error after reboot system

Linking RHIVOS CVEs to...Migration: Automation ...SWIFT: POC ConversionSync from "Extern...XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Major Major
    • None
    • rhel-10.0.z, rhel-10.1, rhel-9.7, rhel-10.1.z
    • ostree
    • None
    • No
    • None
    • rhel-image-mode
    • None
    • False
    • False
    • Hide

      None

      Show
      None
    • None
    • None
    • None
    • None
    • Unspecified
    • Unspecified
    • Unspecified
    • x86_64
    • None

      What were you trying to do that didn't work?

      deploy a system using ostreecontainer in kickstart file. Then reboot this system will raise avc error.

      Here is upstream discussion: https://github.com/bootc-dev/bootc/pull/1529

      What is the impact of this issue to you?

      all of system which deploy from remote repository will hit avc error.

      Please provide the package NVR for which the bug is seen:

      images.paas.redhat.com/mhou/rhel-9:rhel-9.6.0-updates-20250811.3-x86_64-stock-1754992233147

      images.paas.redhat.com/mhou/rhel-10:rhel-10.0-updates-20250811.2-amd64-rtk-1754991753791

      How reproducible is this bug?: 100%

      Steps to reproduce

      1. use ostreecontainer option in kickstart to deploy image mode
      2. reboot system

      Expected results

      no avc error after reboot

      Actual results

      https://beaker.engineering.redhat.com/jobs/11513918

      https://beaker-archive.prod.engineering.redhat.com/beaker-logs/2025/08/115139/11513918/19322557/console.log

      [50111.446723] systemd-shutdown[1]: Could not detach DM /dev/dm-0: Device or resource busy 
      [50111.446725] systemd-shutdown[1]: Not all DM devices detached, 1 left. 
      [50111.446727] systemd-shutdown[1]: Cannot finalize remaining file systems, DM devices, continuing. 
      [50111.472573] audit: type=1400 audit(1754646026.614:4): avc:  denied  { search } for  pid=8275 comm="mdadm" name="etc" dev="overlay" ino=529 scontext=system_u:system_r:mdadm_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=dir permissive=0 
      [50111.472576] audit: type=1400 audit(1754646026.614:5): avc:  denied  { search } for  pid=8275 comm="mdadm" name="etc" dev="overlay" ino=529 scontext=system_u:system_r:mdadm_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=dir permissive=0 
      [50111.482945] audit: type=1400 audit(1754646026.624:6): avc:  denied  { search } for  pid=8275 comm="mdadm" name="etc" dev="overlay" ino=529 scontext=system_u:system_r:mdadm_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=dir permissive=0 
      [50111.482947] audit: type=1400 audit(1754646026.624:7): avc:  denied  { search } for  pid=8275 comm="mdadm" name="etc" dev="overlay" ino=529 scontext=system_u:system_r:mdadm_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=dir permissive=0 
      [50111.482952] audit: type=1400 audit(1754646026.624:8): avc:  denied  { search } for  pid=8275 comm="mdadm" name="etc" dev="overlay" ino=529 scontext=system_u:system_r:mdadm_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=dir permissive=0 
       [!p ]104      

      Here is disk status on test machine.

      [root@dell-per750-66 ~]# smartctl --scan
      /dev/sda -d scsi # /dev/sda, SCSI device
      /dev/bus/0 -d megaraid,0 # /dev/bus/0 [megaraid_disk_00], SCSI device
      [root@dell-per750-66 ~]# smartctl -a /dev/sda -d megaraid,0
      smartctl 7.2 2020-12-30 r5155 [x86_64-linux-5.14.0-570.35.1.el9_6.x86_64+rt] (local build)
      Copyright (C) 2002-20, Bruce Allen, Christian Franke, www.smartmontools.org=== START OF INFORMATION SECTION ===
      Vendor:               SEAGATE
      Product:              ST600MM0069
      Revision:             ST38
      Compliance:           SPC-4
      User Capacity:        600,127,266,816 bytes [600 GB]
      Logical block size:   512 bytes
      Formatted with type 2 protection
      8 bytes of protection information per logical block
      LU is fully provisioned
      Rotation Rate:        10000 rpm
      Form Factor:          2.5 inches
      Logical Unit id:      0x5000c500efe082d3
      Serial number:        WFJ6HQ0V
      Device type:          disk
      Transport protocol:   SAS (SPL-3)
      Local Time is:        Mon Aug 25 09:05:01 2025 UTC
      SMART support is:     Available - device has SMART capability.
      SMART support is:     Enabled
      Temperature Warning:  Disabled or Not Supported=== START OF READ SMART DATA SECTION ===
      SMART Health Status: OKGrown defects during certification <not available>
      Total blocks reassigned during format <not available>
      Total new blocks reassigned = 0
      Power on minutes since format <not available>
      Current Drive Temperature:     31 C
      Drive Trip Temperature:        60 CAccumulated power on time, hours:minutes 19116:44
      Manufactured in week 41 of year 2022
      Specified cycle count over device lifetime:  10000
      Accumulated start-stop cycles:  1511
      Specified load-unload count over device lifetime:  300000
      Accumulated load-unload cycles:  8764
      Elements in grown defect list: 0Vendor (Seagate Cache) information
        Blocks sent to initiator = 2507561564
        Blocks received from initiator = 347352980
        Blocks read from cache and sent to initiator = 4076041104
        Number of read and write commands whose size <= segment size = 154872676
        Number of read and write commands whose size > segment size = 2Vendor (Seagate/Hitachi) factory information
        number of hours powered up = 19116.73
        number of minutes until next internal SMART test = 39Error counter log:
                 Errors Corrected by           Total   Correction     Gigabytes    Total
                     ECC          rereads/    errors   algorithm      processed    uncorrected
                 fast | delayed   rewrites  corrected  invocations   [10^9 bytes]  errors
      read:   2138380740        5         0  2138380745          5      27999.288           0
      write:         0        0        37        37         37      69484.145           0
      verify: 92511550        0         0  92511550          0      87207.180           0Non-medium error count:        0SMART Self-test log
      Num  Test              Status                 segment  LifeTime  LBA_first_err [SK ASC ASQ]
           Description                              number   (hours)
      # 1  Background long   Completed                  96       3                 - [-   -    -]
      # 2  Background short  Completed                  96       2                 - [-   -    -]Long (extended) Self-test duration: 3565 seconds [59.4 minutes]
       

       

              coreos-bot CoreOS Bot
              mhou@redhat.com HOU MINXI
              CoreOS Bot CoreOS Bot
              CoreOS QE Bot CoreOS QE Bot
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

                Created:
                Updated: