Missing rules for bootupd on Fedora CoreOS Rawhide

[HuijingHei]

On Fedora CoreOS using Rawhide (using selinux-policy-41.18-1.fc42.noarch), get the following AVCs:

type=AVC msg=audit(1727251620.092:170): avc:  denied  { getattr } for  pid=1472 comm="bootupctl" path="/sysroot/.aleph-version.json" dev="vda4" ino=132 scontext=system_u:system_r:bootupd_t:s0 tcontext=system_u:object_r:root_t:s0 tclass=file permissive=1
type=AVC msg=audit(1727251620.092:171): avc:  denied  { read } for  pid=1472 comm="bootupctl" name=".aleph-version.json" dev="vda4" ino=132 scontext=system_u:system_r:bootupd_t:s0 tcontext=system_u:object_r:root_t:s0 tclass=file permissive=1
type=AVC msg=audit(1727251620.092:172): avc:  denied  { open } for  pid=1472 comm="bootupctl" path="/sysroot/.aleph-version.json" dev="vda4" ino=132 scontext=system_u:system_r:bootupd_t:s0 tcontext=system_u:object_r:root_t:s0 tclass=file permissive=1

And

type=AVC msg=audit(1727251620.089:166): avc:  denied  { search } for  pid=1475 comm="lsblk" name="udev" dev="tmpfs" ino=58 scontext=system_u:system_r:bootupd_t:s0 tcontext=system_u:object_r:udev_var_run_t:s0 tclass=dir permissive=1
type=AVC msg=audit(1727251620.089:167): avc:  denied  { read } for  pid=1475 comm="lsblk" name="b252:0" dev="tmpfs" ino=1331 scontext=system_u:system_r:bootupd_t:s0 tcontext=system_u:object_r:udev_var_run_t:s0 tclass=file permissive=1
type=AVC msg=audit(1727251620.089:168): avc:  denied  { open } for  pid=1475 comm="lsblk" path="/run/udev/data/b252:0" dev="tmpfs" ino=1331 scontext=system_u:system_r:bootupd_t:s0 tcontext=system_u:object_r:udev_var_run_t:s0 tclass=file permissive=1
type=AVC msg=audit(1727251620.089:169): avc:  denied  { getattr } for  pid=1475 comm="lsblk" path="/run/udev/data/b252:0" dev="tmpfs" ino=1331 scontext=system_u:system_r:bootupd_t:s0 tcontext=system_u:object_r:udev_var_run_t:s0 tclass=file permissive=1

We use lsblk in coreos/bootupd#729

[travier]

@zpytela Gentle ping here. We would appreciate if we could that in Fedora 41. Thanks

[HuijingHei]

Hi @zpytela , could you help to look at this when at your convenience? We need this for Fedora 41. Thanks!

[travier]

I've filed: https://bugzilla.redhat.com/show_bug.cgi?id=2320395

[zpytela]

All the denials are audited with permissive=1, i. e. all syscalls are allowed. Which service does not work properly?

[travier]

bootupd_t is not in permissive mode by default in Fedora 41+. We turned the permissive mode to get the full logs.

[zpytela]

I can't see my comment from yesterday where I asked which service created the /sysroot dir and files there as they are mislabeled.

Reading udev runtime files is allowed in the PR which refers to this issue.

[travier]

/sysroot is a "special" directory on ostree based systems and is the "real" root of the actual root partition on the disk, thus the root_t label.

[zpytela]

I am going to merge all open PRs now, although some may not be a complete solution, and create a build.