SELINUX 정책이 적용되지 않습니다.

가상 머신으로 실행되는 Fedora Server v39(최소 설치)가 있습니다(호스트도 Fedora Server v39임).

VM을 사용하여 호스트 디렉터리를 VM과 공유 virtiofs하고 이를 /etc/wireguardVM에 매핑했습니다.

drwx------. 4 root root system_u:object_r:virtiofs_t:s0                   109 Dec 13 22:03 wireguard

SELINUX가 차단된 것을 제외하고 wireguard구성을 읽어서 설치했습니다./etc/wireguard

# ausearch -m AVC -i
----
type=AVC msg=audit(13/12/23 21:19:26.166:194) : avc:  denied  { search } for  pid=1151 comm=wg-quick name=/ dev="virtiofs" ino=981467275 scontext=system_u:system_r:wireguard_t:s0 tcontext=system_u:object_r:virtiofs_t:s0 tclass=dir permissive=0 
----
type=AVC msg=audit(13/12/23 22:00:40.880:204) : avc:  denied  { search } for  pid=1250 comm=wg-quick name=/ dev="virtiofs" ino=981467275 scontext=system_u:system_r:wireguard_t:s0 tcontext=system_u:object_r:virtiofs_t:s0 tclass=dir permissive=0 
----
type=AVC msg=audit(13/12/23 22:01:47.028:208) : avc:  denied  { search } for  pid=1265 comm=wg-quick name=/ dev="virtiofs" ino=981467275 scontext=system_u:system_r:wireguard_t:s0 tcontext=system_u:object_r:virtiofs_t:s0 tclass=dir permissive=1 
----
type=AVC msg=audit(13/12/23 22:01:47.028:209) : avc:  denied  { getattr } for  pid=1265 comm=wg-quick path=/etc/wireguard/wg0.conf dev="virtiofs" ino=981467299 scontext=system_u:system_r:wireguard_t:s0 tcontext=system_u:object_r:virtiofs_t:s0 tclass=file permissive=1 
----
type=AVC msg=audit(13/12/23 22:01:47.033:210) : avc:  denied  { getattr } for  pid=1269 comm=stat path=/etc/wireguard dev="virtiofs" ino=981467275 scontext=system_u:system_r:wireguard_t:s0 tcontext=system_u:object_r:virtiofs_t:s0 tclass=dir permissive=1 
----
type=AVC msg=audit(13/12/23 22:01:47.034:211) : avc:  denied  { read } for  pid=1265 comm=wg-quick name=wg0.conf dev="virtiofs" ino=981467299 scontext=system_u:system_r:wireguard_t:s0 tcontext=system_u:object_r:virtiofs_t:s0 tclass=file permissive=1 
----
type=AVC msg=audit(13/12/23 22:01:47.034:212) : avc:  denied  { open } for  pid=1265 comm=wg-quick path=/etc/wireguard/wg0.conf dev="virtiofs" ino=981467299 scontext=system_u:system_r:wireguard_t:s0 tcontext=system_u:object_r:virtiofs_t:s0 tclass=file permissive=1 
----
type=AVC msg=audit(13/12/23 22:01:47.035:213) : avc:  denied  { ioctl } for  pid=1265 comm=wg-quick path=/etc/wireguard/wg0.conf dev="virtiofs" ino=981467299 ioctlcmd=TCGETS scontext=system_u:system_r:wireguard_t:s0 tcontext=system_u:object_r:virtiofs_t:s0 tclass=file permissive=1 
----
type=AVC msg=audit(13/12/23 22:30:26.574:372) : avc:  denied  { search } for  pid=1692 comm=wg-quick name=/ dev="virtiofs" ino=981467275 scontext=system_u:system_r:wireguard_t:s0 tcontext=system_u:object_r:virtiofs_t:s0 tclass=dir permissive=1 
----
type=AVC msg=audit(13/12/23 22:30:26.574:373) : avc:  denied  { getattr } for  pid=1692 comm=wg-quick path=/etc/wireguard/wg0.conf dev="virtiofs" ino=981467299 scontext=system_u:system_r:wireguard_t:s0 tcontext=system_u:object_r:virtiofs_t:s0 tclass=file permissive=1 
----
type=AVC msg=audit(13/12/23 22:30:26.584:376) : avc:  denied  { search } for  pid=1702 comm=stat name=/ dev="virtiofs" ino=981467275 scontext=system_u:system_r:wireguard_t:s0 tcontext=system_u:object_r:virtiofs_t:s0 tclass=dir permissive=1 
----
type=AVC msg=audit(13/12/23 22:30:26.588:377) : avc:  denied  { getattr } for  pid=1704 comm=stat path=/etc/wireguard dev="virtiofs" ino=981467275 scontext=system_u:system_r:wireguard_t:s0 tcontext=system_u:object_r:virtiofs_t:s0 tclass=dir permissive=1 
----
type=AVC msg=audit(13/12/23 22:30:26.588:378) : avc:  denied  { read } for  pid=1692 comm=wg-quick name=wg0.conf dev="virtiofs" ino=981467299 scontext=system_u:system_r:wireguard_t:s0 tcontext=system_u:object_r:virtiofs_t:s0 tclass=file permissive=1 
----
type=AVC msg=audit(13/12/23 22:30:26.589:379) : avc:  denied  { open } for  pid=1692 comm=wg-quick path=/etc/wireguard/wg0.conf dev="virtiofs" ino=981467299 scontext=system_u:system_r:wireguard_t:s0 tcontext=system_u:object_r:virtiofs_t:s0 tclass=file permissive=1 
----
type=AVC msg=audit(13/12/23 22:30:26.593:380) : avc:  denied  { ioctl } for  pid=1692 comm=wg-quick path=/etc/wireguard/wg0.conf dev="virtiofs" ino=981467299 ioctlcmd=TCGETS scontext=system_u:system_r:wireguard_t:s0 tcontext=system_u:object_r:virtiofs_t:s0 tclass=file permissive=1

policycoreutils-python-utils그래서 SELINUX 도구를 설치 하고 실행하여 grep AVC /var/log/audit/audit.log | audit2allow -M wireguard다음 정책을 얻었습니다.

# cat wireguard.te

module wireguard 1.0;

require {
    type wireguard_t;
    type virtiofs_t;
    class dir { getattr search };
    class file { getattr ioctl open read };
}

#============= wireguard_t ==============
allow wireguard_t virtiofs_t:dir { getattr search };
allow wireguard_t virtiofs_t:file { getattr ioctl open read };

그런데 설치하려고 하면 오류가 발생합니다.

# semodule -i wireguard.pp
libsemanage.semanage_direct_install_info: Overriding wireguard module at lower priority 100 with module at priority 400.
Failed to resolve typepermissive statement at /var/lib/selinux/targeted/tmp/modules/400/permissive_wireguard_t/cil:1
Failed to resolve AST
semodule:  Failed!

내가 찾은 모든 도움말 페이지에 이 작업을 수행하라고 나와 있기 때문에 지금은 헤매고 있습니다. 도움을 주시면 감사하겠습니다.