Fixes the issues I've seen.

This update doesn't seem to resolve #1824196 (and some others) -- all denial AVCs on an F32 system since boot.

AVC avc:  denied  { read } for  pid=619 comm="systemd-modules" name="SecureBoot-8be4df61-93ca-11d2-aa0d-00e098032b8c" dev="efivarfs" ino=15770 scontext=system_u:system_r:systemd_modules_load_t:s0 tcontext=system_u:object_r:efivarfs_t:s0 tclass=file permissive=1
AVC avc:  denied  { open } for  pid=619 comm="systemd-modules" path="/sys/firmware/efi/efivars/SecureBoot-8be4df61-93ca-11d2-aa0d-00e098032b8c" dev="efivarfs" ino=15770 scontext=system_u:system_r:systemd_modules_load_t:s0 tcontext=system_u:object_r:efivarfs_t:s0 tclass=file permissive=1
AVC avc:  denied  { getattr } for  pid=619 comm="systemd-modules" path="/sys/firmware/efi/efivars/SecureBoot-8be4df61-93ca-11d2-aa0d-00e098032b8c" dev="efivarfs" ino=15770 scontext=system_u:system_r:systemd_modules_load_t:s0 tcontext=system_u:object_r:efivarfs_t:s0 tclass=file permissive=1
AVC avc:  denied  { read } for  pid=812 comm="sssd" name="systemd" dev="tmpfs" ino=15787 scontext=system_u:system_r:sssd_t:s0 tcontext=system_u:object_r:init_var_run_t:s0 tclass=dir permissive=1
AVC avc:  denied  { read } for  pid=933 comm="systemd-resolve" name="SecureBoot-8be4df61-93ca-11d2-aa0d-00e098032b8c" dev="efivarfs" ino=15770 scontext=system_u:system_r:systemd_resolved_t:s0 tcontext=system_u:object_r:efivarfs_t:s0 tclass=file permissive=1
AVC avc:  denied  { open } for  pid=933 comm="systemd-resolve" path="/sys/firmware/efi/efivars/SecureBoot-8be4df61-93ca-11d2-aa0d-00e098032b8c" dev="efivarfs" ino=15770 scontext=system_u:system_r:systemd_resolved_t:s0 tcontext=system_u:object_r:efivarfs_t:s0 tclass=file permissive=1
AVC avc:  denied  { getattr } for  pid=933 comm="systemd-resolve" path="/sys/firmware/efi/efivars/SecureBoot-8be4df61-93ca-11d2-aa0d-00e098032b8c" dev="efivarfs" ino=15770 scontext=system_u:system_r:systemd_resolved_t:s0 tcontext=system_u:object_r:efivarfs_t:s0 tclass=file permissive=1

Solves the accounts-daemon sys_nice problem. Machine is not EFI so can't comment on BZ#1824196

@amessina, you're right, the patch got stuck halfway. Will be fixed in the next package build, sorry for that.

Works fine.

1823162 - Indeed no more AVC after upgrade to boinc-client-7.16.6-3.fc32.x86_64.rpm

Works

New denials related to flatpak helper and tpm abrmd. Relabeling also complaining about types related to both of those not existing. Not giving karma.

@bojan, flatpak has its own policy, please open a bugzilla on the flatpak component. Regarding tpm abrmd, open a bz on selinux-policy. In both cases share the reproducing steps and the results, I cannot see any issue on my vms.

I cannot reproduce neither of the issues reported, so it depends on package set installed or on customizations made to the system. More information is required to resolve these issues, please consider opening bugzillas.

Done -> https://bugzilla.redhat.com/show_bug.cgi?id=1811407

Works

This update has been unpushed.

Since multiple people have reported serious problems with this, I've unpushed it to ensure no-one else hits those problems till we know what's going on.

As neither of the problems appear on a default installation, more information is needed to help with resolving the issues. What changes on the system? What additional possibly clashing packages were installed? What exactly is on the screen or in audit logs?

These commands can give a hint:

rpm -qa "selinux" semanage export ausearch -i -m avc,user_avc,selinux_err,user_selinux_err -ts today

Additional steps to enable full auditing in audit daemon: 1) Open /etc/audit/rules.d/audit.rules file in an editor. 2) Remove following line if it exists: -a task,never 3) Add following line at the end of the file: -w /etc/shadow -p w 4) Restart the audit daemon: # service auditd restart 5) Re-run the scenario - install, update, start a service; since this point, full auditing is enabled 6) Collect AVC denials: # ausearch -i -m avc,user_avc,selinux_err,user_selinux_err -ts today The steps will persist reboot.

A new build is on the way: https://bodhi.fedoraproject.org/updates/FEDORA-2020-a6cd8de2ed

https://bodhi.fedoraproject.org/updates/FEDORA-2020-a6cd8de2ed solved the problems having been reported.
Although the scripts needed more than five minutes to complete, no error was reported.
After rebooting the system, no SELinux alerts appeared, so this version seems to be okay.