rpms/pcp
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Update SELinux policy for rocestat and nvidia PMDAs

Browse Source 
Resolves: RHEL-132402
Resolves: RHEL-134388
Resolves: RHEL-133519
This commit is contained in:
William Cohen 2026-02-22 22:30:02 -05:00
parent 116b890abd
commit 371d710728
2 changed files with 65 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

60
pcp-RHEL-132402.patch Normal file
View File

@ -0,0 +1,60 @@
commit 082ff6beb14420c04af74f37d2ae8c1628182ae2
Author: William Cohen <wcohen@redhat.com>
Date: Tue Feb 10 02:19:21 2026 +0000
selinux: AVC denial fix for rocestat pmda
Resolves: RHEL-132402
diff --git a/src/selinux/pcp.te b/src/selinux/pcp.te
index 59cf1fb630..54f4e96877 100644
--- a/src/selinux/pcp.te
+++ b/src/selinux/pcp.te
@@ -1036,6 +1036,16 @@ allow pcp_pmproxy_t pcp_log_t:lnk_file read;
allow pcp_pmcd_t fsadm_exec_t:file { execute execute_no_trans getattr open read };
allow pcp_pmcd_t fixed_disk_device_t:blk_file { open read ioctl };
+#============= pmda-rocestat ==============
+optional_policy(`
+ require {
+ type ifconfig_exec_t;
+ }
+ # type=AVC msg=audit(N): avc: denied { execute_no_trans } for pid=PID comm="python3" path="/usr/sbin/ethtool" dev=DEV ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:ifconfig_exec_t:s0 tclass=file permissive=0
+ # RHEL-132402
+ allow pcp_pmcd_t ifconfig_exec_t:file { execute execute_no_trans };
+')
+
#============= pmda-nvidia ==============
# type=AVC msg=audit(N): avc: denied { execute } for pid=PID comm="pmdanvidia" path="/usr/lib64/libnvidia-ml.so" dev="dm-2" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=unconfined_u:object_r:default_t:s0 tclass=file permissive=0
# type=AVC msg=audit(N): avc: denied { read } for pid=PID comm="pmdanvidia" name="nvidia-cap2" dev="devtmpfs" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=unconfined_u:object_r:device_t:s0 tclass=chr_file permissive=0
commit e84ee24823548ce92c1e222d034e5600f4d3a10a
Author: William Cohen <wcohen@redhat.com>
Date: Tue Feb 10 04:00:26 2026 +0000
selinux: Update nvidia pmda policy
RHEL-133519
diff --git a/src/selinux/pcp.te b/src/selinux/pcp.te
index 54f4e96877..69ee2b2957 100644
--- a/src/selinux/pcp.te
+++ b/src/selinux/pcp.te
@@ -1051,7 +1051,7 @@ optional_policy(`
# type=AVC msg=audit(N): avc: denied { read } for pid=PID comm="pmdanvidia" name="nvidia-cap2" dev="devtmpfs" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=unconfined_u:object_r:device_t:s0 tclass=chr_file permissive=0
#RHEL-83594
allow pcp_pmcd_t default_t:file { execute };
-allow pcp_pmcd_t device_t:chr_file { create open read setattr write };
+allow pcp_pmcd_t device_t:chr_file { create ioctl open read setattr write };
allow pcp_pmcd_t device_t:dir { add_name remove_name write };
allow pcp_pmcd_t device_t:lnk_file { create unlink };
allow pcp_pmcd_t self:capability mknod;
@@ -1059,7 +1059,7 @@ allow pcp_pmcd_t dri_device_t:chr_file { ioctl open read write };
allow pcp_pmcd_t device_t:dir write;
allow pcp_pmcd_t device_t:dir { create setattr };
allow pcp_pmcd_t sysctl_vm_t:file read;
-allow pcp_pmcd_t xserver_misc_device_t:chr_file { ioctl open read write };
+allow pcp_pmcd_t xserver_misc_device_t:chr_file { ioctl map open read write };
# type=AVC msg=audit(N): avc: denied { sys_rawio } for pid=PID comm="pmdaX" name="/" dev="tracefs" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:pcp_pmcd_t:s0 tclass=capability permissive=0
allow pcp_pmcd_t self:capability sys_rawio;

6
pcp.spec
View File

@ -1,12 +1,13 @@
Name: pcp
Version: 7.0.3
Release: 2%{?dist}
Release: 3%{?dist}
Summary: System-level performance monitoring and performance management
License: GPL-2.0-or-later AND LGPL-2.1-or-later AND CC-BY-3.0
URL: https://pcp.io
Source0: https://github.com/performancecopilot/pcp/releases/pcp-%{version}.src.tar.gz
Patch0: pcp2openmetrics-archive.patch
Patch1: pcp-RHEL-132402.patch
%if 0%{?fedora} >= 40 || 0%{?rhel} >= 10
ExcludeArch: %{ix86}
@ -3424,6 +3425,9 @@ fi
%files zeroconf -f pcp-zeroconf-files.rpm
%changelog
* Thu Feb 19 2026 William Cohen <wcohen@redhat.com> - 7.0.3-3
- Update selinux polices for rocestat and nvidia pmdas (RHEL-132402, RHEL-134388, RHEL-133519)
* Wed Feb 4 2026 Lauren Chilton <lchilton@redhat.com> - 7.0.3-2
- Fix pcp2openmetrics archive metric querying (RHEL-114006)