-
Bug
-
Resolution: Unresolved
-
Normal
-
rhel-10.1
-
No
-
None
-
1
-
rhel-security-selinux
-
1
-
False
-
False
-
-
None
-
SELINUX 260128: 17
-
None
-
None
-
Unspecified
-
Unspecified
-
Unspecified
-
-
x86_64
-
None
What were you trying to do that didn't work?
When attempting to provision a system that Boots from SAN over NVMe-TCP, we are hitting the following in the AVC log:
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: targeted
Current mode: enforcing
Mode from config file: enforcing
Policy MLS status: enabled
Policy deny_unknown status: allowed
Memory protection checking: actual (secure)
Max kernel policy version: 33
selinux-policy-42.1.7-1.el10.noarch
----
time->Thu Aug 28 18:32:16 2025
type=USER_AVC msg=audit(1756420336.221:48): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc: denied { start } for auid=n/a uid=0 gid=0 path="/usr/lib/systemd/system/nvmf-connect-nbft.service" cmdline="" function="bus_unit_method_start_generic" scontext=system_u:system_r:NetworkManager_dispatcher_nvme_t:s0 tcontext=system_u:object_r:systemd_unit_file_t:s0 tclass=service permissive=0 exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=?'
----
time->Thu Aug 28 18:32:16 2025
type=USER_AVC msg=audit(1756420336.308:52): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='avc: denied { start } for auid=n/a uid=0 gid=0 path="/usr/lib/systemd/system/nvmf-connect-nbft.service" cmdline="" function="bus_unit_method_start_generic" scontext=system_u:system_r:NetworkManager_dispatcher_nvme_t:s0 tcontext=system_u:object_r:systemd_unit_file_t:s0 tclass=service permissive=0 exe="/usr/lib/systemd/systemd" sauid=0 hostname=? addr=? terminal=?'
Below are the jobs where the issue is observed:
https://beaker.engineering.redhat.com/jobs/11596932
https://beaker.engineering.redhat.com/jobs/11597271
What is the impact of this issue to you?
May break the multipath reconnect functionality
Please provide the package NVR for which the bug is seen:
RHEL-10.1-20250826.2
Often
Steps to reproduce
- See above
