From: David Galloway Date: Mon, 26 Jan 2026 17:05:01 +0000 (-0500) Subject: qa: allowlist bpf podman denials on Rocky 10 X-Git-Tag: testing/wip-pdonnell-testing-20260205.015545~1^2 X-Git-Url: http://git-server-git.apps.pok.os.sepia.ceph.com/?a=commitdiff_plain;h=44d775f2c3bb6078ae51d36df9e6ba11f63499cb;p=ceph-ci.git qa: allowlist bpf podman denials on Rocky 10 Rocky Linux 10 logs SELinux AVCs for systemd BPF operations during container startup due to incomplete SELinux policy coverage. These AVCs occur in permissive mode, are reproducible without Ceph, and do not indicate functional failure. Tests should ignore this specific AVC class while continuing to fail on enforced denials. Signed-off-by: David Galloway --- diff --git a/qa/distros/all/rocky_10.yaml b/qa/distros/all/rocky_10.yaml index 3fd574be2c8..f68cce1a29d 100644 --- a/qa/distros/all/rocky_10.yaml +++ b/qa/distros/all/rocky_10.yaml @@ -1,2 +1,6 @@ os_type: rocky os_version: "10.1" +overrides: + selinux: + allowlist: + - 'comm="systemd".*denied.*\{ prog_run \}.*tclass=bpf.*permissive=1'