Missing rules for bootupd

[travier]

On Fedora 41 Atomic Desktops, we have the following AVCs:

type=AVC msg=audit(1725290040.770:429): avc:  denied  { getattr } for  pid=4524 comm="bootupctl" path="/boot/efi/EFI/BOOT/BOOTIA32.EFI" dev="vda1" ino=142 scontext=system_u:system_r:bootupd_t:s0 tcontext=system_u:object_r:dosfs_t:s0 tclass=file permissive=1
type=AVC msg=audit(1725290040.770:430): avc:  denied  { read } for  pid=4524 comm="bootupctl" name="BOOTIA32.EFI" dev="vda1" ino=142 scontext=system_u:system_r:bootupd_t:s0 tcontext=system_u:object_r:dosfs_t:s0 tclass=file permissive=1
type=AVC msg=audit(1725290040.770:431): avc:  denied  { open } for  pid=4524 comm="bootupctl" path="/boot/efi/EFI/BOOT/BOOTIA32.EFI" dev="vda1" ino=142 scontext=system_u:system_r:bootupd_t:s0 tcontext=system_u:object_r:dosfs_t:s0 tclass=file permissive=1
type=AVC msg=audit(1725290040.862:432): avc:  denied  { read } for  pid=4524 comm="bootupctl" name="EFI" dev="vda1" ino=113 scontext=system_u:system_r:bootupd_t:s0 tcontext=system_u:object_r:dosfs_t:s0 tclass=dir permissive=1
type=AVC msg=audit(1725290040.863:433): avc:  denied  { write } for  pid=4524 comm="bootupctl" path=2F626F6F742F233234202864656C6574656429 dev="vda2" ino=24 scontext=system_u:system_r:bootupd_t:s0 tcontext=system_u:object_r:boot_t:s0 tclass=file permissive=1
type=AVC msg=audit(1725290040.869:434): avc:  denied  { link } for  pid=4524 comm="bootupctl" name="#24" dev="vda2" ino=24 scontext=system_u:system_r:bootupd_t:s0 tcontext=system_u:object_r:boot_t:s0 tclass=file permissive=1
type=AVC msg=audit(1725290040.869:435): avc:  denied  { rename } for  pid=4524 comm="bootupctl" name=".tmp.X84SiQFG.tmp" dev="vda2" ino=24 scontext=system_u:system_r:bootupd_t:s0 tcontext=system_u:object_r:boot_t:s0 tclass=file permissive=1

when running the commands from https://fedoraproject.org/wiki/Changes/FedoraSilverblueBootupd#How_To_Test.

How to reproduce

• Install a Fedora Silverblue 41 system
• Run:

  $ sudo semanage permissive -a bootupd_t
  $ sudo rm /boot/bootupd-state.json
  $ sudo bootupctl update
  

[travier]

More rules missing from a real update:

type=AVC msg=audit(1725290584.206:609): avc:  denied  { getattr } for  pid=3484 comm="bootupctl" path="/boot/efi/EFI/BOOT/BOOTIA32.EFI" dev="vda1" ino=115 scontext=system_u:system_r:bootupd_t:s0 tcontext=system_u:object_r:dosfs_t:s0 tclass=file permissive=1
type=AVC msg=audit(1725290584.206:610): avc:  denied  { read } for  pid=3484 comm="bootupctl" name="BOOTIA32.EFI" dev="vda1" ino=115 scontext=system_u:system_r:bootupd_t:s0 tcontext=system_u:object_r:dosfs_t:s0 tclass=file permissive=1
type=AVC msg=audit(1725290584.206:611): avc:  denied  { open } for  pid=3484 comm="bootupctl" path="/boot/efi/EFI/BOOT/BOOTIA32.EFI" dev="vda1" ino=115 scontext=system_u:system_r:bootupd_t:s0 tcontext=system_u:object_r:dosfs_t:s0 tclass=file permissive=1
type=AVC msg=audit(1725290584.270:612): avc:  denied  { read } for  pid=3484 comm="bootupctl" name="EFI" dev="vda1" ino=113 scontext=system_u:system_r:bootupd_t:s0 tcontext=system_u:object_r:dosfs_t:s0 tclass=dir permissive=1
type=AVC msg=audit(1725290584.270:613): avc:  denied  { write } for  pid=3484 comm="bootupctl" name="EFI" dev="vda1" ino=113 scontext=system_u:system_r:bootupd_t:s0 tcontext=system_u:object_r:dosfs_t:s0 tclass=dir permissive=1
type=AVC msg=audit(1725290584.270:614): avc:  denied  { add_name } for  pid=3484 comm="bootupctl" name=".tmpGbLl0E79.tmp" scontext=system_u:system_r:bootupd_t:s0 tcontext=system_u:object_r:dosfs_t:s0 tclass=dir permissive=1
type=AVC msg=audit(1725290584.270:615): avc:  denied  { create } for  pid=3484 comm="bootupctl" name=".tmpGbLl0E79.tmp" scontext=system_u:system_r:bootupd_t:s0 tcontext=system_u:object_r:dosfs_t:s0 tclass=file permissive=1
type=AVC msg=audit(1725290584.270:616): avc:  denied  { write } for  pid=3484 comm="bootupctl" path="/boot/efi/EFI/.tmpGbLl0E79.tmp" dev="vda1" ino=130 scontext=system_u:system_r:bootupd_t:s0 tcontext=system_u:object_r:dosfs_t:s0 tclass=file permissive=1
type=AVC msg=audit(1725290584.278:617): avc:  denied  { setattr } for  pid=3484 comm="bootupctl" name=".tmpGbLl0E79.tmp" dev="vda1" ino=130 scontext=system_u:system_r:bootupd_t:s0 tcontext=system_u:object_r:dosfs_t:s0 tclass=file permissive=1
type=AVC msg=audit(1725290584.278:618): avc:  denied  { remove_name } for  pid=3484 comm="bootupctl" name=".tmpGbLl0E79.tmp" dev="vda1" ino=130 scontext=system_u:system_r:bootupd_t:s0 tcontext=system_u:object_r:dosfs_t:s0 tclass=dir permissive=1
type=AVC msg=audit(1725290584.278:619): avc:  denied  { rename } for  pid=3484 comm="bootupctl" name=".tmpGbLl0E79.tmp" dev="vda1" ino=130 scontext=system_u:system_r:bootupd_t:s0 tcontext=system_u:object_r:dosfs_t:s0 tclass=file permissive=1
type=AVC msg=audit(1725290584.295:620): avc:  denied  { unlink } for  pid=3484 comm="bootupctl" name="grubx64.efi" dev="vda1" ino=123 scontext=system_u:system_r:bootupd_t:s0 tcontext=system_u:object_r:dosfs_t:s0 tclass=file permissive=1
type=AVC msg=audit(1725290584.297:621): avc:  denied  { write } for  pid=3484 comm="bootupctl" path=2F626F6F742F233136202864656C6574656429 dev="vda2" ino=16 scontext=system_u:system_r:bootupd_t:s0 tcontext=system_u:object_r:boot_t:s0 tclass=file permissive=1
type=AVC msg=audit(1725290584.333:622): avc:  denied  { link } for  pid=3484 comm="bootupctl" name="#16" dev="vda2" ino=16 scontext=system_u:system_r:bootupd_t:s0 tcontext=system_u:object_r:boot_t:s0 tclass=file permissive=1
type=AVC msg=audit(1725290584.333:623): avc:  denied  { rename } for  pid=3484 comm="bootupctl" name=".tmp.Z4pRaNq2.tmp" dev="vda2" ino=16 scontext=system_u:system_r:bootupd_t:s0 tcontext=system_u:object_r:boot_t:s0 tclass=file permissive=1

[travier]

Essentially, bootupd needs to do be able to do all common file/dir create/rename/write/remove operations in the EFI partition.

[travier]

This is running selinux-policy-targeted-41.14-1.fc41.noarch

[travier]

Next part in #2341