From 5bc42151e15a3a0f0639d6e5038931deb66e35c4 Mon Sep 17 00:00:00 2001 From: William Cohen Date: Thu, 19 Feb 2026 22:40:09 -0500 Subject: [PATCH] Resolves: RHEL-133548 --- pcp-RHEL-133548.patch | 84 +++++++++++++++++++++++++++++++++++++++++++ pcp.spec | 6 +++- 2 files changed, 89 insertions(+), 1 deletion(-) create mode 100644 pcp-RHEL-133548.patch diff --git a/pcp-RHEL-133548.patch b/pcp-RHEL-133548.patch new file mode 100644 index 0000000..f42f054 --- /dev/null +++ b/pcp-RHEL-133548.patch @@ -0,0 +1,84 @@ +commit fca2000bcd098d1e1347d51f63a1aeb788a7a353 +Author: William Cohen +Date: Wed May 21 10:49:50 2025 -0400 + + selinux: update policy for AMD and NVIDIA gpu pmdas + + On Fedora 41 noticed that there were a number of AVC denials for both + the AMD and NVIDIA gpu pmdas. The SELinux policy has been updated + to address those denials. + + Resolves: Red Hat bugzilla 2365140 + Resolves: #2209 + +diff --git a/src/selinux/pcp.te b/src/selinux/pcp.te +index 56258796aa..b070c43c91 100644 +--- a/src/selinux/pcp.te ++++ b/src/selinux/pcp.te +@@ -379,6 +379,7 @@ require { + type debugfs_t; + type default_t; + type device_t; ++ type dri_device_t; + type etc_t; + type fixed_disk_device_t; + type fs_t; +@@ -419,6 +420,7 @@ require { + type sysctl_fs_t; #RHBZ1505888 + type sysctl_irq_t; #pmda.bcc + type sysctl_net_t; ++ type sysctl_vm_t; + type sysfs_t; #RHBZ1545245 + type syslogd_t; + type syslogd_var_run_t; +@@ -430,6 +432,7 @@ require { + type var_run_t; + type virt_image_t; + type websm_port_t; # pmda.openmetrics ++ type xserver_misc_device_t; + + class blk_file { ioctl open read }; + class capability { net_raw }; # pmda.netcheck +@@ -1013,6 +1016,11 @@ allow pcp_pmcd_t device_t:chr_file { create open read setattr write }; + allow pcp_pmcd_t device_t:dir { add_name remove_name write }; + allow pcp_pmcd_t device_t:lnk_file { create unlink }; + allow pcp_pmcd_t self:capability mknod; ++allow pcp_pmcd_t dri_device_t:chr_file { ioctl open read write }; ++allow pcp_pmcd_t device_t:dir write; ++allow pcp_pmcd_t device_t:dir { create setattr }; ++allow pcp_pmcd_t sysctl_vm_t:file read; ++allow pcp_pmcd_t xserver_misc_device_t:chr_file { ioctl open read write }; + + # type=AVC msg=audit(N): avc: denied { sys_rawio } for pid=PID comm="pmdaX" name="/" dev="tracefs" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:pcp_pmcd_t:s0 tclass=capability permissive=0 + allow pcp_pmcd_t self:capability sys_rawio; + +commit e84ee24823548ce92c1e222d034e5600f4d3a10a +Author: William Cohen +Date: Tue Feb 10 04:00:26 2026 +0000 + + selinux: Update nvidia pmda policy + + RHEL-133519 + +diff --git a/src/selinux/pcp.te b/src/selinux/pcp.te +index 54f4e96877..69ee2b2957 100644 +--- a/src/selinux/pcp.te ++++ b/src/selinux/pcp.te +@@ -1051,7 +1051,7 @@ optional_policy(` + # type=AVC msg=audit(N): avc: denied { read } for pid=PID comm="pmdanvidia" name="nvidia-cap2" dev="devtmpfs" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=unconfined_u:object_r:device_t:s0 tclass=chr_file permissive=0 + #RHEL-83594 + allow pcp_pmcd_t default_t:file { execute }; +-allow pcp_pmcd_t device_t:chr_file { create open read setattr write }; ++allow pcp_pmcd_t device_t:chr_file { create ioctl open read setattr write }; + allow pcp_pmcd_t device_t:dir { add_name remove_name write }; + allow pcp_pmcd_t device_t:lnk_file { create unlink }; + allow pcp_pmcd_t self:capability mknod; +@@ -1059,7 +1059,7 @@ allow pcp_pmcd_t dri_device_t:chr_file { ioctl open read write }; + allow pcp_pmcd_t device_t:dir write; + allow pcp_pmcd_t device_t:dir { create setattr }; + allow pcp_pmcd_t sysctl_vm_t:file read; +-allow pcp_pmcd_t xserver_misc_device_t:chr_file { ioctl open read write }; ++allow pcp_pmcd_t xserver_misc_device_t:chr_file { ioctl map open read write }; + + # type=AVC msg=audit(N): avc: denied { sys_rawio } for pid=PID comm="pmdaX" name="/" dev="tracefs" ino=INO scontext=system_u:system_r:pcp_pmcd_t:s0 tcontext=system_u:object_r:pcp_pmcd_t:s0 tclass=capability permissive=0 + allow pcp_pmcd_t self:capability sys_rawio; diff --git a/pcp.spec b/pcp.spec index 77a606c..be6e69c 100644 --- a/pcp.spec +++ b/pcp.spec @@ -1,6 +1,6 @@ Name: pcp Version: 6.3.7 -Release: 6%{?dist} +Release: 7%{?dist} Summary: System-level performance monitoring and performance management License: GPL-2.0-or-later AND LGPL-2.1-or-later AND CC-BY-3.0 URL: https://pcp.io @@ -23,6 +23,7 @@ Patch11: pmda-openmetrics_removal.patch Patch12: pcp2openmetrics_hang.patch Patch13: atop-cpu-utilization.patch Patch14: pmda-openmetrics-performance.patch +Patch15: pcp-RHEL-133548.patch %if 0%{?fedora} >= 40 || 0%{?rhel} >= 10 ExcludeArch: %{ix86} @@ -3633,6 +3634,9 @@ fi %files zeroconf -f pcp-zeroconf-files.rpm %changelog +* Thu Feb 19 2026 William Cohen - 6.3.7-7 +- Update selinux policy for pmda-nvidia (RHEL-133548) + * Wed Nov 19 2025 Lauren Chilton - 6.3.7-6 - Backport fix for pmdaopenmetrics metric removal (RHEL-101745) - Backport fix for pcp2openmetrics metric hanging (RHEL-106772)