rpms/pcp
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Resolves: RHEL-133548

Browse Source
This commit is contained in:
William Cohen 2026-02-19 22:40:09 -05:00
parent f5f1fcd82a
commit 5bc42151e1
2 changed files with 89 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

84
pcp-RHEL-133548.patch Normal file
View File

@ -0,0 +1,84 @@
commit fca2000bcd098d1e1347d51f63a1aeb788a7a353
Author: William Cohen <wcohen@redhat.com>
Date: Wed May 21 10:49:50 2025 -0400
selinux: update policy for AMD and NVIDIA gpu pmdas
On Fedora 41 noticed that there were a number of AVC denials for both
the AMD and NVIDIA gpu pmdas. The SELinux policy has been updated
to address those denials.
Resolves: Red Hat bugzilla 2365140
Resolves: #2209
diff --git a/src/selinux/pcp.te b/src/selinux/pcp.te
index 56258796aa..b070c43c91 100644
--- a/src/selinux/pcp.te
+++ b/src/selinux/pcp.te
@@ -379,6 +379,7 @@ require {
type debugfs_t;
type default_t;
type device_t;
+ type dri_device_t;
type etc_t;
type fixed_disk_device_t;
type fs_t;
@@ -419,6 +420,7 @@ require {
type sysctl_fs_t; #RHBZ1505888
type sysctl_irq_t; #pmda.bcc
type sysctl_net_t;
+ type sysctl_vm_t;
type sysfs_t; #RHBZ1545245
type syslogd_t;
type syslogd_var_run_t;
@@ -430,6 +432,7 @@ require {
type var_run_t;
type virt_image_t;
type websm_port_t; # pmda.openmetrics
+ type xserver_misc_device_t;
class blk_file { ioctl open read };
class capability { net_raw }; # pmda.netcheck
@@ -1013,6 +1016,11 @@ allow pcp_pmcd_t device_t:chr_file { create open read setattr write };
allow pcp_pmcd_t device_t:dir { add_name remove_name write };
allow pcp_pmcd_t device_t:lnk_file { create unlink };
allow pcp_pmcd_t self:capability mknod;
+allow pcp_pmcd_t dri_device_t:chr_file { ioctl open read write };
+allow pcp_pmcd_t device_t:dir write;
+allow pcp_pmcd_t device_t:dir { create setattr };
+allow pcp_pmcd_t sysctl_vm_t:file read;
+allow pcp_pmcd_t xserver_misc_device_t:chr_file { ioctl open read write };
# type=AVC msg=audit(N): avc: denied { sys_rawio } for pid=PID comm="pmdaX" name="/" dev="tracefs" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:pcp_pmcd_t:s0 tclass=capability permissive=0
allow pcp_pmcd_t self:capability sys_rawio;
commit e84ee24823548ce92c1e222d034e5600f4d3a10a
Author: William Cohen <wcohen@redhat.com>
Date: Tue Feb 10 04:00:26 2026 +0000
selinux: Update nvidia pmda policy
RHEL-133519
diff --git a/src/selinux/pcp.te b/src/selinux/pcp.te
index 54f4e96877..69ee2b2957 100644
--- a/src/selinux/pcp.te
+++ b/src/selinux/pcp.te
@@ -1051,7 +1051,7 @@ optional_policy(`
# type=AVC msg=audit(N): avc: denied { read } for pid=PID comm="pmdanvidia" name="nvidia-cap2" dev="devtmpfs" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=unconfined_u:object_r:device_t:s0 tclass=chr_file permissive=0
#RHEL-83594
allow pcp_pmcd_t default_t:file { execute };
-allow pcp_pmcd_t device_t:chr_file { create open read setattr write };
+allow pcp_pmcd_t device_t:chr_file { create ioctl open read setattr write };
allow pcp_pmcd_t device_t:dir { add_name remove_name write };
allow pcp_pmcd_t device_t:lnk_file { create unlink };
allow pcp_pmcd_t self:capability mknod;
@@ -1059,7 +1059,7 @@ allow pcp_pmcd_t dri_device_t:chr_file { ioctl open read write };
allow pcp_pmcd_t device_t:dir write;
allow pcp_pmcd_t device_t:dir { create setattr };
allow pcp_pmcd_t sysctl_vm_t:file read;
-allow pcp_pmcd_t xserver_misc_device_t:chr_file { ioctl open read write };
+allow pcp_pmcd_t xserver_misc_device_t:chr_file { ioctl map open read write };
# type=AVC msg=audit(N): avc: denied { sys_rawio } for pid=PID comm="pmdaX" name="/" dev="tracefs" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:pcp_pmcd_t:s0 tclass=capability permissive=0
allow pcp_pmcd_t self:capability sys_rawio;

6
pcp.spec
View File

@ -1,6 +1,6 @@
Name: pcp
Version: 6.3.7
Release: 6%{?dist}
Release: 7%{?dist}
Summary: System-level performance monitoring and performance management
License: GPL-2.0-or-later AND LGPL-2.1-or-later AND CC-BY-3.0
URL: https://pcp.io
@ -23,6 +23,7 @@ Patch11: pmda-openmetrics_removal.patch
Patch12: pcp2openmetrics_hang.patch
Patch13: atop-cpu-utilization.patch
Patch14: pmda-openmetrics-performance.patch
Patch15: pcp-RHEL-133548.patch
%if 0%{?fedora} >= 40 || 0%{?rhel} >= 10
ExcludeArch: %{ix86}
@ -3633,6 +3634,9 @@ fi
%files zeroconf -f pcp-zeroconf-files.rpm
%changelog
* Thu Feb 19 2026 William Cohen <wcohen@redhat.com> - 6.3.7-7
- Update selinux policy for pmda-nvidia (RHEL-133548)
* Wed Nov 19 2025 Lauren Chilton <lchilton@redhat.com> - 6.3.7-6
- Backport fix for pmdaopenmetrics metric removal (RHEL-101745)
- Backport fix for pcp2openmetrics metric hanging (RHEL-106772)