SELINUX and Zram-generator

[Javier Perez <pepebuho@xxxxxxxxx>]

Hi. I am getting SELINUX notifications about zram-generator.

Should I report the bug?

SELinux is preventing zram-generator from open access on the file /usr/lib/systemd/zram-generator.conf.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that zram-generator should be allowed open access on the zram-generator.conf file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'zram-generator' --raw | audit2allow -M my-zramgenerator
# semodule -X 300 -i my-zramgenerator.pp

Additional Information:
Source Context                system_u:system_r:init_t:s0
Target Context                system_u:object_r:systemd_zram_generator_conf_t:s0
Target Objects                /usr/lib/systemd/zram-generator.conf [ file ]
Source                        zram-generator
Source Path                   zram-generator
Port                          <Unknown>
Host                          (removed)
Source RPM Packages          
Target RPM Packages           zram-generator-defaults-1.1.2-11.fc40.noarch
SELinux Policy RPM            selinux-policy-targeted-40.24-1.fc40.noarch
Local Policy RPM              selinux-policy-targeted-40.24-1.fc40.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux pepewin 6.9.9-200.fc40.x86_64 #1 SMP
                              PREEMPT_DYNAMIC Thu Jul 11 19:29:01 UTC 2024
                              x86_64
Alert Count                   1
First Seen                    2024-07-23 00:32:34 EST
Last Seen                     2024-07-23 00:32:34 EST
Local ID                      8f6e8eb5-5de2-4ff6-9913-0e38051e5182

Raw Audit Messages
type=AVC msg=audit(1721712754.865:324): avc:  denied  { open } for  pid=106941 comm="zram-generator" path="/usr/lib/systemd/zram-generator.conf" dev="sda3" ino=356490 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:systemd_zram_generator_conf_t:s0 tclass=file permissive=0


Hash: zram-generator,init_t,systemd_zram_generator_conf_t,file,open

--

------------------------------
 /\_/\  
 |O O|  pepebuho@xxxxxxxxx
 ~~~~     Javier Perez
 ~~~~          While the night runs
 ~~~~          toward the day...
  m m       Pepebuho watches
                from his high perch.

-- 
_______________________________________________
users mailing list -- users@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to users-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/users@xxxxxxxxxxxxxxxxxxxxxxx
Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue