SElinux AVCs

[keysteal72]

Hi, every time I boot my Fedora, it appears a Selinux warning that has blocked 2 processes started bye tlp with destination dac_override and search (on /var/lib/snapd folder). Anyone has same issue?

[linrunner]

Hi, how do you expect to start a discussion if you are silent about most of the facts? The very least would be the output of:

 sudo ausearch -su 'tlp' -ts boot

Please don't just copy the long output here. Instead, use https://gist.github.com/. Thanks!

[keysteal72]

It's not long:

---
time->Sun Sep 29 15:40:01 2024
type=AVC msg=audit(1727617201.069:188): avc:  denied  { search } for  pid=2712 comm="tlp" name="snapd" dev="sda3" ino=718591 scontext=system_u:system_r:tlp_t:s0 tcontext=system_u:object_r:snappy_var_lib_t:s0 tclass=dir permissive=0
----
time->Sun Sep 29 15:40:01 2024
type=AVC msg=audit(1727617201.311:189): avc:  denied  { dac_override } for  pid=2712 comm="tlp" capability=1  scontext=system_u:system_r:tlp_t:s0 tcontext=system_u:system_r:tlp_t:s0 tclass=capability permissive=0
----
time->Sun Sep 29 15:40:01 2024
type=AVC msg=audit(1727617201.311:190): avc:  denied  { dac_override } for  pid=2712 comm="tlp" capability=1  scontext=system_u:system_r:tlp_t:s0 tcontext=system_u:system_r:tlp_t:s0 tclass=capability permissive=0

[linrunner]

I don't see parts of TLP being blocked here. TLP doesn't touch dac_override (whatever that might be) or /var/lib/snapd/.

You are welcome to wait and see if anyone gets in touch.

However, please note that I do not take care of SELinux issues upstream. If you want this fixed, you need to open a Fedora bug report against the selinux-policy package. If you do, please post the link here. Thank you.

[bonswouar]

Not sure if it's related (but the title seems general enough)

I personally have an AVC denial when plugging/unplugging the AC. As far as I know that didn't happen before, not sure if it's config related or due to a tlp update or something else
Here are the details:

type=AVC msg=audit(1739221020.273:671): avc:  denied  { getattr } for  pid=19928 comm="tlp" path="/proc/sys/kernel/nmi_watchdog" dev="proc" ino=12660 scontext=system_u:system_r:tlp_t:s0-s0:c0.c1023 tcontext=system_u:object_r:sysctl_nmi_watchdog_t:s0 tclass=file permissive=0

It seems related to nmi_watchdog, not sure what it is, but I didn't uncomment / change NMI_WATCHDOG in the conf so I guess it should be disabled?

I don't know much about SELinux, let me know if I should instead "open a Fedora bug report"

[linrunner]

@bonswouar TLP's default is to disable nmi_watchdog. Please file a Fedora bug as explained above.

[sigmavirus24]

For what it's worth, the existing bug is https://bugzilla.redhat.com/show_bug.cgi?id=2343780. I don't know that it makes sense to keep this open given this is a policy problem managed outside of this project.

Edit to add: Also, this was fixed in selinux-policy 41.33-1 which should be easy to upgrade as long as you're on Fedora 41. If you're on Fedora 40, it's not available as far as I can tell but also I didn't look very hard because I'm not using 40 anywhere.