fedora-ci.koji-build.installability.functional fails an AVC check for some packages. Examples:

dnf5-5.2.8.1-1.fc42 fails fedora-ci.koji-build.installability.functional https://artifacts.dev.testing-farm.io/1f78ed8d-7c4b-4bba-921f-d2eb658b35cc/ with:

install: dnf5-devel-0:5.2.8.1-1.fc42.x86_64 (SELinux AVCs)
type=AVC msg=audit(12/05/2024 22:38:19.094:1766) : avc:  denied  { getattr } for  pid=4757 comm=systemd-gpt-aut path=cgroup:[4026531835] dev="nsfs" ino=4026531835 scontext=system_u:system_r:systemd_gpt_generator_t:s0 tcontext=system_u:object_r:nsfs_t:s0 tclass=file permissive=0 

frr-10.2-2.fc42 fails with:

install: frr-0:10.2-2.fc42.x86_64 (SELinux AVCs)
type=AVC msg=audit(12/06/2024 09:23:39.606:1793) : avc:  denied  { getattr } for  pid=4966 comm=systemd-bless-b path=cgroup:[4026531835] dev="nsfs" ino=4026531835 scontext=system_u:system_r:systemd_bless_boot_generator_t:s0 tcontext=system_u:object_r:nsfs_t:s0 tclass=file permissive=0 

I'm not unable to reproduce it locally. I suspect the test machine has an container setup where programs from systemd-udev RPM package are executed, they attempt to access the nsfs file, the SELinux violation is logged, and the test fails.

Could you please find out what triggers it and what executes the system-udev programs? Please report the findings against systemd or selinux-policy component in Fedora Bugzilla.

I'd like to see it resolved so that the fedora-ci.koji-build.installability.functional test is meaningful for dnf5 updates.