fedora-qa / os-autoinst-distri-fedora

#410 Create SELinux log in case of AVCs
Closed: Fixed by adamwill. Opened by kparal.

Closed: Fixed
Reopen Issue

This turned out to be an SELinux issue, but it took us a while to figure that out:
https://openqa.fedoraproject.org/tests/3643039

I wonder if we could have a post-failed-test step (that applies to all failed tests, not just boot issues), that would try to look for SELinux AVCs in the current boot, and if there were any, it would save them in a separate file and uploaded them. So if a person looked at "Logs & Assets" and saw an SELinux log, it would be a strong indication to inspect it. (If it wasn't there, no suspicious AVCs were found).

This could help us save time when determining the issue and also provide useful errors to package maintainers right away.

Thoughts?

Hmm. well, we already log AVCs specifically in tests/_console_avc_crash.pm, but it's not considered a debugging aid, it's a genuine test.

I'm not sure how I feel about it as a debugging step, tbh. My first port of call is usually journalctl --file var/log/journal/(tab)/\*.journal, which shows the journal from the failed test, where you'll normally see any AVCs right around the time the problem happened...so it's never really felt necessary to have them logged separately.

"Always check for AVCs" is good debugging advice in general, but...I'm not sure breaking them out into their own log file in openQA log upload code is really necessary. It feels like kinda the wrong place to do it?

Hmm, inspecting the log files manually is tedious (download, unpack, point journalctl to the right place, search). My "newcomer experience" was that I'm really missing at least the journal text output to be accessible right away to be immediately inspected in a browser tab (not hidden inside the var log tarball). It would make the first inspection faster. And the SELInux AVCs log, if present, would again save me more time. I saw that some tests upload files like nsswitch.conf, so I thought why not the SELinux log.

But hey, it's you and Lukas who spend most time with it, you know your needs. I was just trying to provide fresh ideas and perspective.

we could upload a text dump of the journal as well as /var/log I guess, yeah. I find being able to use journalctl is very useful because you can then filter by service and so on, but sure, in some cases you really just want to eyeball the text...

Metadata Update from @adamwill:
- Custom field story_points adjusted to 1

OK, I just went ahead and did both in https://pagure.io/fedora-qa/os-autoinst-distri-fedora/pull-request/422 . It was easy enough, what the heck.

Metadata Update from @adamwill:
- Issue close_status updated to: Fixed
- Issue status updated to: Closed (was: Open)

This issue has been migrated to Fedora Forge:
https://forge.fedoraproject.org/quality/os-autoinst-distri-fedora/issues/410

Please continue any further discussion there.
Metadata
None

improvetest

None
None
Low
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.