SELinux breaks block backend on Fedora 38-based qube

[marmarek]

How to file a helpful issue

Qubes OS release

R4.2

Brief summary

SELinux in enforcing mode prevents block backend from working (attaching a block device exposed by such qube)

Steps to reproduce

In a qube:

1. truncate -s 50M test.img
2. losetup -f test.img

And then attach created loop device. I assume the same happens for USB sticks in sys-usb etc.

Expected behavior

Works.

Actual behavior

avc:  denied  { read write } for  pid=1470 comm="qubes-block" name="loop0" dev="devtmpfs" ino=805 scontext=system_u:system_r:xend_t:s0-s0:c0.c1023 tcontext=system_u:object_r:fixed_disk_device_t:s0 tclass=blk_file permissive=1
avc:  denied  { open } for  pid=1470 comm="qubes-block" path="/dev/loop0" dev="devtmpfs" ino=805 scontext=system_u:system_r:xend_t:s0-s0:c0.c1023 tcontext=system_u:object_r:fixed_disk_device_t:s0 tclass=blk_file permissive=1
avc:  denied  { ioctl } for  pid=1470 comm="qubes-block" path="/dev/loop0" dev="devtmpfs" ino=805 ioctlcmd=0x1280 scontext=system_u:system_r:xend_t:s0-s0:c0.c1023 tcontext=system_u:object_r:fixed_disk_device_t:s0 tclass=blk_file permissive=1

(enabled permissive mode to collect more logs, but normally the first failure breaks the thing).

[marmarek]

I assume the same breaks on Fedora 37 too.