selinux: allow pmdalibvirt access to virtqemud split daemon sockets

[natoscott]

On newer Fedora/RHEL systems, libvirt uses split daemons (virtqemud) instead of the monolithic libvirtd. The virtqemud socket has a different SELinux type (virtqemud_var_run_t) than the old libvirtd socket (virt_var_run_t), so pmdalibvirt was denied access.

Additionally, virtqemud needs to read /proc//stat of connecting clients (pcp_pmcd_t) for identification, which also requires policy.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Repository UI (inherited), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 3726e47b-2826-4a2d-9edb-2a747af110b4

📥 Commits

Reviewing files that changed from the base of the PR and between 415c691 and c841c63.

📒 Files selected for processing (1)

• src/selinux/pcp.te

---

📝 Walkthrough

Summary by CodeRabbit

• Bug Fixes
  • Improved compatibility with split-daemon virtualization services.
  • Resolved permission issues that could prevent monitoring components from accessing required virtualization service files, directories, and sockets.

Walkthrough

The SELinux policy adds an optional virtqemud policy block, requiring its daemon and runtime socket types and allowing pcp_pmcd_t to access the socket, directories, and files needed by pmda.libvirt.

Changes

virtqemud SELinux integration

Layer / File(s)	Summary
virtqemud access policy src/selinux/pcp.te	Adds required virtqemud types and grants pcp_pmcd_t socket write, directory search, and file open/read permissions.

Suggested reviewers: kmcdonell

Poem

I’m a rabbit hopping through policy lines,
Where virtqemud’s socket now aligns.
PCP may search, read, and write,
SELinux rules tucked in tight.
Nibble, compile, all rights shine!

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main SELinux policy change for pmdalibvirt and virtqemud split-daemon sockets.
Description check	✅ Passed	The description directly matches the policy update and explains both the socket access and client /proc read requirements.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}