-
Bug
-
Resolution: Obsolete
-
Major
-
rhel-9.6.z
-
No
-
Important
-
rhel-security-selinux
-
ssg_security
-
1
-
False
-
False
-
-
No
-
None
-
-
None
-
RegressionOnly
-
Release Note Not Required
-
Unspecified
-
Unspecified
-
Unspecified
-
-
All
-
None
What were you trying to do that didn't work?
Install the coreos-installer-bootinfra package
What is the impact of this issue to you?
It is causing a failure during the coreos-installer CI in the osci.installability, see log https://artifacts.osci.redhat.com/testing-farm/80e2e76d-975d-4a5f-83c6-c19145bce051/
type=PROCTITLE msg=audit(11/07/2025 01:42:41.841:675) : proctitle=/usr/bin/bash /usr/lib/systemd/system-generators/coreos-installer-generator /run/systemd/generator /run/systemd/generator.early type=SYSCALL msg=audit(11/07/2025 01:42:41.841:675) : arch=x86_64 syscall=openat success=no exit=ENOENT(No such file or directory) a0=AT_FDCWD a1=0x55896369bc70 a2=O_RDONLY|O_CLOEXEC a3=0x0 items=0 ppid=4655 pid=4657 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=coreos-installe exe=/usr/bin/bash subj=system_u:system_r:coreos_installer_t:s0 key=(null) type=AVC msg=audit(11/07/2025 01:42:41.841:675) : avc: denied { search } for pid=4657 comm=coreos-installe name=sss dev="xvda4" ino=16908422 scontext=system_u:system_r:coreos_installer_t:s0 tcontext=system_u:object_r:sssd_var_lib_t:s0 tclass=dir permissive=1
Please provide the package NVR for which the bug is seen:
selinux-policy-38.1.53-5.el9_6.noarch
How reproducible is this bug?:
Install coreos-installer-bootinfra package on a rhel which contains selinux-policy-targeted version 38.1.53-5.el9_6
Steps to reproduce
- execute:
dnf install coreos-installer-bootinfra
- execute:
ausearch -m avc --raw | audit2why
You should see:
type=AVC msg=audit(11/07/2025 01:42:41.841:675) : avc: denied { search } for pid=4657 comm=coreos-installe name=sss dev="xvda4" ino=16908422 scontext=system_u:system_r:coreos_installer_t:s0 tcontext=system_u:object_r:sssd_var_lib_t:s0 tclass=dir permissive=1
Expected results
Do not see an avc denied in the audit logs.
Actual results
type=AVC msg=audit(11/07/2025 01:42:41.841:675) : avc: denied { search } for pid=4657 comm=coreos-installe name=sss dev="xvda4" ino=16908422 scontext=system_u:system_r:coreos_installer_t:s0 tcontext=system_u:object_r:sssd_var_lib_t:s0 tclass=dir permissive=1
- clones
-
-
- Closed
-