Daily bogus SELinux alerts from snap

[David Handy]

At least once a day my Fedora 37 workstation pops up SELinux alerts like the ones below.
The SELinux alert text says that if I believe that snap should be allowed to do what it is is trying to do, I should report it at as a bug. Since it does not look like snap is doing anything nefarious, here is the bug report.

Below are the SELinux alerts I am getting daily:

SELinux is preventing snap from search access on the directory fs.

***** Plugin catchall (100. confidence) suggests **************************

If you believe that snap should be allowed search access on the fs directory by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'snap' --raw | audit2allow -M my-snap
# semodule -X 300 -i my-snap.pp

Additional Information:
Source Context system_u:system_r:snappy_cli_t:s0
Target Context system_u:object_r:sysctl_fs_t:s0
Target Objects fs [ dir ]
Source snap
Source Path snap
Port <Unknown>
Host hood.handysoftware.com
Source RPM Packages
Target RPM Packages
SELinux Policy RPM selinux-policy-targeted-37.18-1.fc37.noarch
Local Policy RPM snapd-selinux-2.57.6-2.fc37.noarch
Selinux Enabled True
Policy Type targeted
Enforcing Mode Permissive
Host Name hood.handysoftware.com
Platform Linux hood.handysoftware.com 6.1.7-200.fc37.x86_64
                              #1 SMP PREEMPT_DYNAMIC Wed Jan 18 17:11:49 UTC
                              2023 x86_64 x86_64
Alert Count 1
First Seen 2023-02-07 09:01:06 EST
Last Seen 2023-02-07 09:01:06 EST
Local ID 3de537df-3dcf-451b-9a7a-78a9f21b4623

Raw Audit Messages
type=AVC msg=audit(1675778466.174:7539): avc: denied { search } for pid=2537846 comm="snap" name="fs" dev="proc" ino=19550 scontext=system_u:system_r:snappy_cli_t:s0 tcontext=system_u:object_r:sysctl_fs_t:s0 tclass=dir permissive=1

Hash: snap,snappy_cli_t,sysctl_fs_t,dir,search

SELinux is preventing snap from search access on the directory /proc/sys/fs/binfmt_misc.

***** Plugin catchall (100. confidence) suggests **************************

If you believe that snap should be allowed search access on the binfmt_misc directory by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'snap' --raw | audit2allow -M my-snap
# semodule -X 300 -i my-snap.pp

Additional Information:
Source Context system_u:system_r:snappy_cli_t:s0
Target Context system_u:object_r:binfmt_misc_fs_t:s0
Target Objects /proc/sys/fs/binfmt_misc [ dir ]
Source snap
Source Path snap
Port <Unknown>
Host hood.handysoftware.com
Source RPM Packages
Target RPM Packages
SELinux Policy RPM selinux-policy-targeted-37.18-1.fc37.noarch
Local Policy RPM snapd-selinux-2.57.6-2.fc37.noarch
Selinux Enabled True
Policy Type targeted
Enforcing Mode Permissive
Host Name hood.handysoftware.com
Platform Linux hood.handysoftware.com 6.1.7-200.fc37.x86_64
                              #1 SMP PREEMPT_DYNAMIC Wed Jan 18 17:11:49 UTC
                              2023 x86_64 x86_64
Alert Count 1
First Seen 2023-02-07 09:01:06 EST
Last Seen 2023-02-07 09:01:06 EST
Local ID f99df951-41ef-4854-84af-ebc67158461e

Raw Audit Messages
type=AVC msg=audit(1675778466.174:7540): avc: denied { search } for pid=2537846 comm="snap" name="/" dev="binfmt_misc" ino=1 scontext=system_u:system_r:snappy_cli_t:s0 tcontext=system_u:object_r:binfmt_misc_fs_t:s0 tclass=dir permissive=1

Hash: snap,snappy_cli_t,binfmt_misc_fs_t,dir,search

[David Handy (dpvid)]

More details: I am running SELinux in permissive mode, so these alerts are not preventing snap from running.

I did look over the other SELinux-related snap tickets in launchpad and didn't find one quite like this. The other (older) SELinux tickets seem to be reporting different symptoms or different issues.