Allow unconfined_domain_type use IORING_OP_URING_CMD on self

[5umm3r15]

Addresses the following denial:

type=AVC msg=audit(1696506406.082:97818): avc: denied { cmd } for pid=541430 comm="io_uring_passth" path="/dev/ng2n1" dev="devtmpfs" ino=745 scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=system_u:object_r:fixed_disk_device_t:s0 tclass=io_uring permissive=0

Resolves: RHEL-11792

[WOnder93]

In the AVC the target type doesn't match the source type, so something is wrong here. Isn't the AVC already covered by the dev_io_uring_cmd_on_all_dev_nodes(unconfined_domain_type) line?

[5umm3r15]

@WOnder93 thank you, you are right, in the commit message was wrong denial.

The fix is for audit2allow output:
allow unconfined_t self:io_uring cmd;

[WOnder93]

Yeah, I asked in RHEL-11792 for the full denial, because it looks suspicious.

[5umm3r15]

Thanks @WOnder93, fixed
:)

[WOnder93]

I think you misunderstood - I was proposing the following as the final result:

allow unconfined_domain_type domain:io_uring { cmd override_creds };
allow unconfined_domain_type self:io_uring sqpoll;

[zpytela]

Thanks for your effort, closing in favor of #1937

[5umm3r15]

@zpytela thanks for update and sorry for not delivering fix on time

[zpytela]

No problem @5umm3r15, looking forward to your future contributions.