Update qatlib policy

[zpytela]

The commit addresses the following AVC denials: type=PROCTITLE msg=audit(12.12.2023 09:16:26.851:299) : proctitle=/usr/sbin/qatmgr --policy=0 type=SYSCALL msg=audit(12.12.2023 09:16:26.851:299) : arch=x86_64 syscall=ioctl success=yes exit=0 a0=0x5 a1=0x3b69 a2=0x3 a3=0x70000000004 items=0 ppid=1 pid=63688 auid=unset uid=root gid=qat euid=root suid=root fsuid=root egid=qat sgid=qat fsgid=qat tty=(none) ses=unset comm=qatmgr exe=/usr/sbin/qatmgr subj=system_u:system_r:qatlib_t:s0 key=(null) type=AVC msg=audit(12.12.2023 09:16:26.851:299) : avc: denied { ioctl } for pid=63688 comm=qatmgr path=/dev/vfio/465 dev="devtmpfs" ino=2030 ioctlcmd=0x3b69 scontext=system_u:system_r:qatlib_t:s0 tcontext=system_u:object_r:vfio_device_t:s0 tclass=chr_file permissive=1

type=PROCTITLE msg=audit(12.12.2023 09:16:31.459:301) : proctitle=/usr/sbin/qatmgr --policy=0 type=PATH msg=audit(12.12.2023 09:16:31.459:301) : item=1 name=(null) inode=3808 dev=00:18 mode=socket,660 ouid=root ogid=qat rdev=00:00 obj=system_u:object_r:var_run_t:s0 nametype=CREATE cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=PATH msg=audit(12.12.2023 09:16:31.459:301) : item=0 name=(null) inode=3633 dev=00:18 mode=dir,755 ouid=root ogid=qat rdev=00:00 obj=system_u:object_r:var_run_t:s0 nametype=PARENT cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=SYSCALL msg=audit(12.12.2023 09:16:31.459:301) : arch=x86_64 syscall=bind success=yes exit=0 a0=0x3 a1=0x7ffdd4804e30 a2=0x6e a3=0x9 items=2 ppid=1 pid=63688 auid=unset uid=root gid=qat euid=root suid=root fsuid=root egid=qat sgid=qat fsgid=qat tty=(none) ses=unset comm=qatmgr exe=/usr/sbin/qatmgr subj=system_u:system_r:qatlib_t:s0 key=(null) type=AVC msg=audit(12.12.2023 09:16:31.459:301) : avc: denied { create } for pid=63688 comm=qatmgr name=qatmgr.sock scontext=system_u:system_r:qatlib_t:s0 tcontext=system_u:object_r:var_run_t:s0 tclass=sock_file permissive=1

Resolves: RHEL-17947

[packit-as-a-service[bot]]

Cockpit tests failed for commit 63305d3c88c1a8899ea2930a751ba42a52c6702e. @martinpitt, @jelly, @mvollmer please check.

pitti: original log from testRaidRepair. Completely unrelated to SELinux, retrying to compare -- could be another regression in rawhide.

[packit-as-a-service[bot]]

Cockpit tests failed for commit 63305d3c88c1a8899ea2930a751ba42a52c6702e. @martinpitt, @jelly, @mvollmer please check.

[martinpitt]

OK, raid repair just broke in rawhide, I'll trawl through bodhi and report a bugzilla. Sorry for the noise, please ignore.

I tried to reproduce this locally with Cockpit CI's fedora-rawhide image. dnf update -y doesn't break it and updates to the current tag repository are empty.

[martinpitt]

@zpytela We did a quick hack on our side, and I restarted the test. The other PRs from yesterday already failed to build the rpms, so not restarting these. Sorry for the noise!