From: David Galloway <david.galloway@ibm.com>
Date: Wed, 4 Feb 2026 14:29:48 +0000 (-0500)
Subject: selinux: allowlist bpf podman denials
X-Git-Url: http://git-server-git.apps.pok.os.sepia.ceph.com/?a=commitdiff_plain;h=refs%2Fheads%2Fwip-74553;p=teuthology.git

selinux: allowlist bpf podman denials

Rocky Linux 10 logs SELinux AVCs for systemd BPF operations during container startup due to incomplete SELinux policy coverage. These AVCs occur in permissive mode, are reproducible without Ceph, and do not indicate functional failure. Tests should ignore this specific AVC class while continuing to fail on enforced denials.

Signed-off-by: David Galloway <david.galloway@ibm.com>
---

diff --git a/teuthology/task/selinux.py b/teuthology/task/selinux.py
index 7b33b11b3..8dc4fca9b 100644
--- a/teuthology/task/selinux.py
+++ b/teuthology/task/selinux.py
@@ -138,6 +138,7 @@ class SELinux(Task):
             'comm="sss_cache"',
             'context=system_u:system_r:NetworkManager_dispatcher_t:s0',
             'context=system_u:system_r:getty_t:s0',
+            'comm="systemd".*denied.*\{ prog_run \}.*tclass=bpf.*permissive=1',
         ]
         se_allowlist = self.config.get('allowlist', [])
         if se_allowlist: