From 371d710728d8eed82b7762d35e753f5cd86d5f23 Mon Sep 17 00:00:00 2001 From: William Cohen Date: Sun, 22 Feb 2026 22:30:02 -0500 Subject: [PATCH] Update SELinux policy for rocestat and nvidia PMDAs Resolves: RHEL-132402 Resolves: RHEL-134388 Resolves: RHEL-133519 --- pcp-RHEL-132402.patch | 60 +++++++++++++++++++++++++++++++++++++++++++ pcp.spec | 6 ++++- 2 files changed, 65 insertions(+), 1 deletion(-) create mode 100644 pcp-RHEL-132402.patch diff --git a/pcp-RHEL-132402.patch b/pcp-RHEL-132402.patch new file mode 100644 index 0000000..fa3936a --- /dev/null +++ b/pcp-RHEL-132402.patch @@ -0,0 +1,60 @@ +commit 082ff6beb14420c04af74f37d2ae8c1628182ae2 +Author: William Cohen +Date: Tue Feb 10 02:19:21 2026 +0000 + + selinux: AVC denial fix for rocestat pmda + + Resolves: RHEL-132402 + +diff --git a/src/selinux/pcp.te b/src/selinux/pcp.te +index 59cf1fb630..54f4e96877 100644 +--- a/src/selinux/pcp.te ++++ b/src/selinux/pcp.te +@@ -1036,6 +1036,16 @@ allow pcp_pmproxy_t pcp_log_t:lnk_file read; + allow pcp_pmcd_t fsadm_exec_t:file { execute execute_no_trans getattr open read }; + allow pcp_pmcd_t fixed_disk_device_t:blk_file { open read ioctl }; + ++#============= pmda-rocestat ============== ++optional_policy(` ++ require { ++ type ifconfig_exec_t; ++ } ++ # type=AVC msg=audit(N): avc: denied { execute_no_trans } for pid=PID comm="python3" path="/usr/sbin/ethtool" dev=DEV ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:ifconfig_exec_t:s0 tclass=file permissive=0 ++ # RHEL-132402 ++ allow pcp_pmcd_t ifconfig_exec_t:file { execute execute_no_trans }; ++') ++ + #============= pmda-nvidia ============== + # type=AVC msg=audit(N): avc: denied { execute } for pid=PID comm="pmdanvidia" path="/usr/lib64/libnvidia-ml.so" dev="dm-2" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=unconfined_u:object_r:default_t:s0 tclass=file permissive=0 + # type=AVC msg=audit(N): avc: denied { read } for pid=PID comm="pmdanvidia" name="nvidia-cap2" dev="devtmpfs" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=unconfined_u:object_r:device_t:s0 tclass=chr_file permissive=0 + +commit e84ee24823548ce92c1e222d034e5600f4d3a10a +Author: William Cohen +Date: Tue Feb 10 04:00:26 2026 +0000 + + selinux: Update nvidia pmda policy + + RHEL-133519 + +diff --git a/src/selinux/pcp.te b/src/selinux/pcp.te +index 54f4e96877..69ee2b2957 100644 +--- a/src/selinux/pcp.te ++++ b/src/selinux/pcp.te +@@ -1051,7 +1051,7 @@ optional_policy(` + # type=AVC msg=audit(N): avc: denied { read } for pid=PID comm="pmdanvidia" name="nvidia-cap2" dev="devtmpfs" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=unconfined_u:object_r:device_t:s0 tclass=chr_file permissive=0 + #RHEL-83594 + allow pcp_pmcd_t default_t:file { execute }; +-allow pcp_pmcd_t device_t:chr_file { create open read setattr write }; ++allow pcp_pmcd_t device_t:chr_file { create ioctl open read setattr write }; + allow pcp_pmcd_t device_t:dir { add_name remove_name write }; + allow pcp_pmcd_t device_t:lnk_file { create unlink }; + allow pcp_pmcd_t self:capability mknod; +@@ -1059,7 +1059,7 @@ allow pcp_pmcd_t dri_device_t:chr_file { ioctl open read write }; + allow pcp_pmcd_t device_t:dir write; + allow pcp_pmcd_t device_t:dir { create setattr }; + allow pcp_pmcd_t sysctl_vm_t:file read; +-allow pcp_pmcd_t xserver_misc_device_t:chr_file { ioctl open read write }; ++allow pcp_pmcd_t xserver_misc_device_t:chr_file { ioctl map open read write }; + + # type=AVC msg=audit(N): avc: denied { sys_rawio } for pid=PID comm="pmdaX" name="/" dev="tracefs" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:pcp_pmcd_t:s0 tclass=capability permissive=0 + allow pcp_pmcd_t self:capability sys_rawio; diff --git a/pcp.spec b/pcp.spec index b9718cc..3146ce7 100644 --- a/pcp.spec +++ b/pcp.spec @@ -1,12 +1,13 @@ Name: pcp Version: 7.0.3 -Release: 2%{?dist} +Release: 3%{?dist} Summary: System-level performance monitoring and performance management License: GPL-2.0-or-later AND LGPL-2.1-or-later AND CC-BY-3.0 URL: https://pcp.io Source0: https://github.com/performancecopilot/pcp/releases/pcp-%{version}.src.tar.gz Patch0: pcp2openmetrics-archive.patch +Patch1: pcp-RHEL-132402.patch %if 0%{?fedora} >= 40 || 0%{?rhel} >= 10 ExcludeArch: %{ix86} @@ -3424,6 +3425,9 @@ fi %files zeroconf -f pcp-zeroconf-files.rpm %changelog +* Thu Feb 19 2026 William Cohen - 7.0.3-3 +- Update selinux polices for rocestat and nvidia pmdas (RHEL-132402, RHEL-134388, RHEL-133519) + * Wed Feb 4 2026 Lauren Chilton - 7.0.3-2 - Fix pcp2openmetrics archive metric querying (RHEL-114006)