Closed hakimifr closed 2 years ago
Do you have any AVCs logged for the failure?
I don't see any avc denial in dmesg and /var/log/audit/audit.log
(nor any avc message), but I've confirmed again by setting compression to the default lzo-rle and rebooting, same behaviour if I try to set lz4 as compression-algorithm again. Only works after permissive selinux.
So i followed this to temporarily disable dontaudit and the denial is now showing up in /var/log/audit/audit.log
type=AVC msg=audit(1646867409.273:465): avc: denied { module_request } for pid=5177 comm="zram-generator" kmod="crypto-lz4" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=system permissive=0
type=AVC msg=audit(1646867409.273:466): avc: denied { module_request } for pid=5177 comm="zram-generator" kmod="crypto-lz4-all" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=system permissive=0
type=AVC msg=audit(1646867409.273:467): avc: denied { module_request } for pid=5177 comm="zram-generator" kmod="cryptomgr" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=system permissive=0
type=SERVICE_START msg=audit(1646867409.294:468): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=systemd-zram-setup@zram0 comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed'UID="root" AUID="unset"
Please take this up with the provider of your selinux policy. We cannot do anything about this here.
os: Fedora 35 zram-generator version:
I created /etc/systemd/zram-generator.conf and added the following contents:
And when I run
systemctl restart systemd-zram-setup@zram0.service
, I get the following error:journal:
grepping /proc/modules reveals that the lz4 compression module isn't loaded.
However, if I temporarily make SELinux permissive with
setenforce 0
, the unit restarts fine and I now has zram with lz4 compression...And lz4 kernel module is now loaded.
related(?) #77