-
Bug
-
Resolution: Unresolved
-
Undefined
-
rhel-10.2
-
None
-
insights-core-3.6.10.1-1.el10
-
None
-
Moderate
-
insights-adv-framework
-
None
-
False
-
False
-
-
No
-
None
-
Pass
-
Needed
-
None
-
Unspecified Release Note Type - Unknown
-
Unspecified
-
Unspecified
-
Unspecified
-
None
What were you trying to do that didn't work?
AVC for "allow insights_core_t rpm_var_cache_t:dir write;" shows up.
What is the impact of this issue to you?
Please provide the package NVR for which the bug is seen:
Use the insights-core/insights-core-selinux in https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=69434915
which for bug RHEL-126369. RHEL-126369 is verified, and the rpm fix unblocks this new AVC.
[root@kvm-08-guest39 ~]# rpm -qa | grep insights
insights-core-selinux-3.6.9.1-master.20.el10.noarch
insights-core-3.6.9.1-master.20.el10.noarch
insights-client-3.10.2-1.el10.noarch
insights-client-ros-3.10.2-1.el10.noarch
How reproducible is this bug?:
always
Steps to reproduce
1. Use systemd to collect data
[root@kvm-08-guest39 ~]# date +'%Y-%m-%d %H:%M' --date='3 minutes'
2025-11-13 22:08
[root@kvm-08-guest39 ~]# vi /usr/lib/systemd/system/insights-client.timer
[root@kvm-08-guest39 ~]# systemctl daemon-reload
[root@kvm-08-guest39 ~]# systemctl restart insights-client.timer
[root@kvm-08-guest39 ~]# sleep 3m
2. Check avc, and the following avc shows up:
---- type=PROCTITLE msg=audit(11/13/2025 21:32:32.665:2091) : proctitle=/usr/bin/python3 /usr/lib/python3.12/site-packages/insights_client/run.py type=PATH msg=audit(11/13/2025 21:32:32.665:2091) : item=0 name=/var/cache/dnf/ inode=214221 dev=fd:00 mode=dir,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:rpm_var_cache_t:s0 nametype=PARENT cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=CWD msg=audit(11/13/2025 21:32:32.665:2091) : cwd=/ type=SYSCALL msg=audit(11/13/2025 21:32:32.665:2091) : arch=x86_64 syscall=openat success=no exit=EACCES(Permission denied) a0=AT_FDCWD a1=0x7f7a1994d540 a2=O_RDWR|O_CREAT|O_CLOEXEC a3=0x1a4 items=1 ppid=211193 pid=211216 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=python3 exe=/usr/bin/python3.12 subj=system_u:system_r:insights_core_t:s0 key=(null) type=AVC msg=audit(11/13/2025 21:32:32.665:2091) : avc: denied { write } for pid=211216 comm=python3 name=dnf dev="dm-0" ino=214221 scontext=system_u:system_r:insights_core_t:s0 tcontext=system_u:object_r:rpm_var_cache_t:s0 tclass=dir permissive=0
Expected results
No avc for insights-core.
Actual results
AVC for "allow insights_core_t rpm_var_cache_t:dir write;" shows up
- links to
-
RHBA-2025:155891
insights-core update