#528 Installability failures due to "SELinux AVCs", but no AVCs apparent in any of the logs
Opened by adamwill. Modified

https://artifacts.dev.testing-farm.io/5d7a00d6-2b1c-4213-ad2a-6ee53bddd7a4/ claims to have failed because of "SELinux AVCs", but I can find no trace of any AVCs in any of the log files.


Trying to figure out what's going on here. One clue is

Complete!
Selinux policy:
Error opening /var/log/audit/audit.log (No such file or directory)

And afaict mini-tps is not checking the file directly: https://github.com/fedora-ci/mini-tps/blob/dc332d98cf8ede76d8d4c729fc7c15196299d35a/mtps-run-tests#L224-L233

    mv "$logfname" "$new_logfname"
    if [ -n "$SELINUX" ] && rpm --quiet -q audit; then
        selinux_status=0
        ausearch --format raw -m avc,user_avc,selinux_err,user_selinux_err -ts "$START_DATE" "$START_TIME" 2>&1 | sed -e '/received policyload notice/d' | grep -s -o '^' && selinux_status=1
        if [ "$selinux_status" -ne "0" ]; then
            ret=1
            # Selinux failed
            new_logfname="$(dirname "$logfname")/WARN-selinux-$(basename "$logfname")"
            echo "Selinux policy:" | tee -a "$logfname"
            ausearch -m avc,user_avc,selinux_err,user_selinux_err -i -ts "$START_DATE" "$START_TIME" | tee -a "$new_logfname"
        fi
    fi

This seems to be a regression in the selinux packages. Any clue about that @adamwill ?

Oh, hey. Are you using cloud base images, by any chance? If so this could possibly be caused by https://bugzilla.redhat.com/show_bug.cgi?id=2390898 .

@adamwill That could very well be it and explains why it only happens 'sometimes' :)

yep, another sad consequence of services not starting as expected. Eagerly waiting for the fixed cloud-init to get into the composes. Same issues on F43 FTR

Unfortunately the fix didn't work, according to today's Rawhide testing :/ I've let jcline know.

yep, there is already a new build in flight:

https://bodhi.fedoraproject.org/updates/FEDORA-2025-7acc66c0d1

Seems with this one I do not see anymore systemd ordeding errors

Fixed now isn't it?

Metadata