fedora-ci.koji-build.installability.functional for libigloo-0.9.5-1.fc44 failed https://artifacts.dev.testing-farm.io/c2c6880b-8aa8-465d-b3cd-7ac8ceeec785/ with this AVC check:
type=PROCTITLE msg=audit(01/07/2026 19:13:22.597:973) : proctitle=/usr/lib/systemd/systemd-resolved type=PATH msg=audit(01/07/2026 19:13:22.597:973) : item=0 name=/etc/resolv.conf inode=44593 dev=00:22 mode=file,644 ouid=root ogid=root rdev=00:00 obj=unconfined_u:object_r:admin_home_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=CWD msg=audit(01/07/2026 19:13:22.597:973) : cwd=/ type=SYSCALL msg=audit(01/07/2026 19:13:22.597:973) : arch=x86_64 syscall=newfstatat success=no exit=EACCES(Permission denied) a0=AT_FDCWD a1=0x556becd1b3a2 a2=0x7ffdf768e820 a3=0x0 items=1 ppid=1 pid=766 auid=unset uid=systemd-resolve gid=systemd-resolve euid=systemd-resolve suid=systemd-resolve fsuid=systemd-resolve egid=systemd-resolve sgid=systemd-resolve fsgid=systemd-resolve tty=(none) ses=unset comm=systemd-resolve exe=/usr/lib/systemd/systemd-resolved subj=system_u:system_r:systemd_resolved_t:s0 key=(null) type=AVC msg=audit(01/07/2026 19:13:22.597:973) : avc: denied { getattr } for pid=766 comm=systemd-resolve path=/etc/resolv.conf dev="nvme0n1p3" ino=44593 scontext=system_u:system_r:systemd_resolved_t:s0 tcontext=unconfined_u:object_r:admin_home_t:s0 tclass=file permissive=0
I was unable to find which selinux-policy was installed there, but I believe this a bug in the test environment because default context for /etc/resolv.conf should be system_u:object_r:net_conf_t:s0 while the log shows unconfined_u:object_r:admin_home_t:s0. It seems that an inappropriate process creates /etc/resolv.conf on the testing system.
Could you debug which program creates that file on that system and either restorecon the label in provisioning phase, or report a bug to selinux-policy?
It happens on all Fedoras:
According to https://artifacts.dev.testing-farm.io/c2c6880b-8aa8-465d-b3cd-7ac8ceeec785/work-installabilitytojibo1a/log.txt the AVC appears after every DNF invocation.
thanks, yes, we are looking into this, see it also in other integration we have for Testing Farm
Opened the issue against selinux-policy https://bugzilla.redhat.com/show_bug.cgi?id=2427862
Coincidentally selinux-policy was updated yesterday, but that does not fit with the failure that we see in F42 since that update has not landed in F42 yet. Otherwise I am clueless on what created this issue.
Btw, selinux-policy is not tested for installability
Fix deploying now, retesting in a minute
Retesting here:
https://osci-jenkins-1.ci.fedoraproject.org/job/fedora-ci/job/installability-pipeline/job/master/340226/console
Closing as resolved by workarounding the issue in Testing Farm.
Metadata Update from @mvadkert: - Issue status updated to: Closed (was: Open)