Please note updating from the previous package version selinux-policy-3.14.5-38.fc32 will have all filesystems relabeling as a result which cannot be prevented. If relabeling takes a lot of time, consider unmounting some filesystems, updating manually, postponing the update to later.

Updating from older versions of the package should not trigger the relabeling.

Works.

Installed selinux-policy-targeted-3.14.5-39.fc32.noarch, relabeled entire system, rebooted...

time->Thu May 21 19:37:49 2020
type=AVC msg=audit(1590107869.700:161): avc:  denied  { read } for  pid=937 comm="systemd-resolve" name="SecureBoot-8be4df61-93ca-11d2-aa0d-00e098032b8c" dev="efivarfs" ino=15758 scontext=system_u:system_r:systemd_resolved_t:s0 tcontext=system_u:object_r:efivarfs_t:s0 tclass=file permissive=1
----
time->Thu May 21 19:37:49 2020
type=AVC msg=audit(1590107869.700:162): avc:  denied  { open } for  pid=937 comm="systemd-resolve" path="/sys/firmware/efi/efivars/SecureBoot-8be4df61-93ca-11d2-aa0d-00e098032b8c" dev="efivarfs" ino=15758 scontext=system_u:system_r:systemd_resolved_t:s0 tcontext=system_u:object_r:efivarfs_t:s0 tclass=file permissive=1
----
time->Thu May 21 19:37:49 2020
type=AVC msg=audit(1590107869.700:163): avc:  denied  { getattr } for  pid=937 comm="systemd-resolve" path="/sys/firmware/efi/efivars/SecureBoot-8be4df61-93ca-11d2-aa0d-00e098032b8c" dev="efivarfs" ino=15758 scontext=system_u:system_r:systemd_resolved_t:s0 tcontext=system_u:object_r:efivarfs_t:s0 tclass=file permissive=1

After a full reboot...

~]# ll -Z /sys/firmware/
total 0
drwxr-xr-x.  6 root root system_u:object_r:sysfs_t:s0 0 May 21 19:57 acpi
drwxr-xr-x.  4 root root system_u:object_r:sysfs_t:s0 0 May 21 19:57 dmi
drwxr-xr-x.  5 root root system_u:object_r:sysfs_t:s0 0 May 21 19:57 efi
drwxr-xr-x. 23 root root system_u:object_r:sysfs_t:s0 0 May 21 19:58 memmap

~]# restorecon -RFv /sys/firmware/
Relabeled /sys/firmware/efi from system_u:object_r:sysfs_t:s0 to system_u:object_r:efivarfs_t:s0

grepping the selinux-policy.git source, I don't see that systemd_resolved_t has the fs_read_efivars_files applied.

selinux-policy.git]$ grep fs_read_efivarfs_files policy/modules/system/systemd.te 
fs_read_efivarfs_files(systemd_logind_t)
fs_read_efivarfs_files(systemd_machined_t)
fs_read_efivarfs_files(systemd_networkd_t)
fs_read_efivarfs_files(systemd_localed_t)
fs_read_efivarfs_files(systemd_hostnamed_t)
fs_read_efivarfs_files(systemd_rfkill_t)
fs_read_efivarfs_files(systemd_timedated_t)
fs_read_efivarfs_files(systemd_sysctl_t)
fs_read_efivarfs_files(systemd_hwdb_t)
fs_read_efivarfs_files(systemd_gpt_generator_t)
fs_read_efivarfs_files(systemd_userdbd_t)

Note, on another system the same issue occurs with systemd_modules_load_t

AVC avc:  denied  { read } for  pid=585 comm="systemd-modules" name="SecureBoot-8be4df61-93ca-11d2-aa0d-00e098032b8c" dev="efivarfs" ino=2253 scontext=system_u:system_r:systemd_modules_load_t:s0 tcontext=system_u:object_r:efivarfs_t:s0 tclass=file permissive=1
AVC avc:  denied  { open } for  pid=585 comm="systemd-modules" path="/sys/firmware/efi/efivars/SecureBoot-8be4df61-93ca-11d2-aa0d-00e098032b8c" dev="efivarfs" ino=2253 scontext=system_u:system_r:systemd_modules_load_t:s0 tcontext=system_u:object_r:efivarfs_t:s0 tclass=file permissive=1
AVC avc:  denied  { getattr } for  pid=585 comm="systemd-modules" path="/sys/firmware/efi/efivars/SecureBoot-8be4df61-93ca-11d2-aa0d-00e098032b8c" dev="efivarfs" ino=2253 scontext=system_u:system_r:systemd_modules_load_t:s0 tcontext=system_u:object_r:efivarfs_t:s0 tclass=file permissive=1

update hangs

no issues yet

@jpbn what do you mean by "hangs"? Note the update can take a long time, see c#1.

@amessina, you are right the update addresses most of the issues reported, but not the one in the bz description, sorry for that.

@zpytela the script did not end. had to close terminal.

No regressions found

Works

Works for me.

Two time this AVC is logged, but nothing breaks (note: I disable secure-boot in the UEFI).

AVC avc:  denied  { read } for  pid=1563 comm="systemd-modules" name="SecureBoot-***" dev="efivarfs" ino=397 scontext=system_u:system_r:systemd_modules_load_t:s0 tcontext=system_u:object_r:efivarfs_t:s0 tclass=file permissive=0

Works

works for me

Pushing to stable given the prevailing positive feedback. The remaining bugs (systemd-resolved, systemd-modules) will be resolved in the next build.