Selinux label for keepalived notify fifo

[cwrx777]

What should be the selinux label and location for notify fifo?

I created a fifo pipe as follows

sudo mkfifo /var/run/keepalived.notify_fifo
sudo restorecon -v /var/run/keepalived.notify_fifo

selinux audit message:

time->Thu Jul 18 15:01:25 2024
type=PROCTITLE msg=audit(1721286085.215:16797050): proctitle=2F7573722F7362696E2F6B656570616C69766564002D44
type=PATH msg=audit(1721286085.215:16797050): item=0 name="/var/run/keepalived.notify_fifo" inode=419895579 dev=00:18 mode=010600 ouid=0 ogid=0 rdev=00:00 obj=unconfined_u:object_r:keepalived_var_run_t:s0 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0
type=CWD msg=audit(1721286085.215:16797050): cwd="/"
type=SYSCALL msg=audit(1721286085.215:16797050): arch=c000003e syscall=257 success=no exit=-13 a0=ffffff9c a1=55d108678d90 a2=a0802 a3=0 items=1 ppid=3014476 pid=3014477 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="keepalived" exe="/usr/sbin/keepalived" subj=system_u:system_r:keepalived_t:s0 key=(null)
type=AVC msg=audit(1721286085.215:16797050): avc:  denied  { read write } for  pid=3014477 comm="keepalived" name="keepalived.notify_fifo" dev="tmpfs" ino=419895579 scontext=system_u:system_r:keepalived_t:s0 tcontext=unconfined_u:object_r:keepalived_var_run_t:s0 tclass=fifo_file permissive=0

[pamunixadm2@SKHROMIVPAPP04 tmp]$ sudo ls -lartZ /var/run/keepalived.notify_fifo
prw-------. 1 root root unconfined_u:object_r:keepalived_var_run_t:s0 0 Jul 18 14:59 /var/run/keepalived.notify_fifo

[pqarmitage]

There is no should in respect of the fifo location. In large part it depends on your distro. For example the SELinux policy source files used by Fedora are at:
https://github.com/fedora-selinux/selinux-policy/blob/rawhide/policy/modules/contrib/keepalived.fc
https://github.com/fedora-selinux/selinux-policy/blob/rawhide/policy/modules/contrib/keepalived.if
https://github.com/fedora-selinux/selinux-policy/blob/rawhide/policy/modules/contrib/keepalived.te

Whenever I get an SELinux policy violation (this is on RedHat based distrubitions) the log always shows the commands to execute in order to add the required entries into the policy to grant the necessary permissions. It appears from the log entries above that this is not the case for you.

SELinux policies really are outside the scope of the project in question, and are a matter for the different distros using SELinux, and the maintainers of keepalived on those distros.