btrfs swapfile - Not enough swap space for hibernation.

btrfs swapfile - Not enough swap space for hibernation.

[Sreyan Chakravarty]

Hi,

I have a swapfile in a swap subvolume, I have used the
btrfs_map_physical script to get the resume_offset, and the swap file
was created with the +C attribute.

But when I try to do a `systemctl hibernate`
                 Not enough swap space for hibernation.

This usually happens if the resume_offset parameter is not right. But
I don't know what I am doing wrong. I have followed all the correct
steps.

My swap file is 10GB and my RAM is 8GB.

'swapon' on gives the following output:

                       NAME                  TYPE      SIZE USED PRIO
                       /dev/zram0            partition 3.8G   0B  100
                      /var/swap/fedora.swap file       10G   0B   -2

$ lsattr /var/swap/fedora.swap
---------------C---- /var/swap/fedora.swap

My layout is as follows:

toplevel (level 5)
|
|--->root
|--->swap

$ btrfs subvolume list -p /
ID 425 gen 17482 parent 5 top level 5 path root
ID 426 gen 16880 parent 5 top level 5 path swap

My kernel command line is as follows:

root=UUID=7d9dbe1b-dea6-4141-807b-026325123ad8 ro
rootflags=subvol=root
rd.luks.uuid=luks-1136a62b-955b-4391-b9a4-b48ab11a862d
resume=/dev/disk/by-uuid/7d9dbe1b-dea6-4141-807b-026325123ad8
resume_offset=3599978


I got the resume_offset via the btrfs_map_physical.c which I got from
here : https://github.com/osandov/osandov-linux/blob/master/scripts/btrfs_map_physical.c

and then dividing the physical offset via my disk block size which is
4096, which equals the resume offset.

My fstab is as follows:

UUID=7d9dbe1b-dea6-4141-807b-026325123ad8 /
btrfs   subvol=root,x-systemd.device-timeout=0 0 0
UUID=7d9dbe1b-dea6-4141-807b-026325123ad8 /var/swap
   btrfs   subvol=swap,rw,nodatacow,noattime,nosuid,x-systemd.device-timeout=0
0 0
UUID=0e9cf655-eaef-44d6-8b5d-3f84e7449c0e /boot                   ext4
   defaults        1 2
UUID=CACC-9508          /boot/efi               vfat
umask=0077,shortname=winnt 0 2
/var/swap/fedora.swap none swap
defaults,x-systemd.requires-mounts-for=/var/swap 0 2

Other diagnostic information:

$ uname -a
Linux localhost.HPNotebook 5.8.15-301.fc33.x86_64 #1 SMP Thu Oct 15
16:58:06 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux

$ btrfs --version
btrfs-progs v5.7

$ btrfs fi show
Label: 'fedora'  uuid: 7d9dbe1b-dea6-4141-807b-026325123ad8
Total devices 1 FS bytes used 100.81GiB
devid    1 size 930.00GiB used 120.02GiB path
/dev/mapper/luks-1136a62b-955b-4391-b9a4-b48ab11a862d

$ btrfs fi df /
Data, single: total=116.01GiB, used=100.38GiB
System, DUP: total=8.00MiB, used=16.00KiB
Metadata, DUP: total=2.00GiB, used=443.69MiB
GlobalReserve, single: total=112.12MiB, used=0.00B

$dmesg > dmesg.log
https://pastebin.com/raw/3Dw1JkDP


Please let me know if any further information is required.

Where am I going wrong ?
--
Regards,
Sreyan Chakravarty

Re: btrfs swapfile - Not enough swap space for hibernation.

[Chris Murphy]

On Thu, Dec 10, 2020 at 4:30 AM Sreyan Chakravarty <sreyan32@gmail.com> wrote:
>
> Hi,
>
> I have a swapfile in a swap subvolume, I have used the
> btrfs_map_physical script to get the resume_offset, and the swap file
> was created with the +C attribute.
>
> But when I try to do a `systemctl hibernate`
>                  Not enough swap space for hibernation.

If the journal doesn't have more information about why it says this,
and if the error is reported in the journal by systemd-logind, enable
debug logging for logind and reproduce and the try to figure out why
logind is complaining:

https://github.com/systemd/systemd/issues/15354#issuecomment-610385478

There is a possibility there isn't enough contiguous space in the
swapfile for the hibernation image. i.e. when you fallocate the
swapfile, it may be comprised of one or even dozens of separate
extents and if one of them isn't big enough for hibernation entry then
it'll always fail.

As far as I'm aware there isn't a way to ask fallocate for a minimum
extent size. I've sometimes had to fallocate multiple files in a row
to get a swapfile with few fragments and then delete the rest.

You can use filefrag -v to see the extent sizes. Those extents are
basically holes that swap code writes into. The swap code isn't
writing swap or hibernation images via Btrfs. It's just asking Btrfs
"what are the ranges and locations I can use" and Btrfs reports that
and then the swap and hibernation code use those areas directly.


> $ lsattr /var/swap/fedora.swap
> ---------------C---- /var/swap/fedora.swap

> UUID=7d9dbe1b-dea6-4141-807b-026325123ad8 /var/swap
>    btrfs   subvol=swap,rw,nodatacow,noattime,nosuid,x-systemd.device-timeout=0

OK you're confused. You do not need both chattr +C on the file and the
nodatacow option. You only need one of those. You should realize that
the nodatacow option applies file system wide. It's non-obvious but
really only the VFS mount options can apply separately to bind mounts.
And on Fedora, since subvolumes are mounted to specific mounts points
and are thus effectively bind mounts behind the scenes, it seems like
you can apply some mount options to specific subvolumes as if they are
separate file systems. But that's not what's going on, they're just
bind mounts. So you can do atime for one mount point, noatime for
another. And same for ro or rw. Those are VFS options. The Btrfs mount
options apply file system wide, that includes nodatacow, compress, and
so on.

Further problem now that you're using nodatacow is that you have a
bunch of nodatacow files that have been created in the meantime. And
those do *not* have chattr +C so you have no easy way to find them.
You'd have to parse 'btrfs inspect-internal dump-tree' for the
nodatacow flag.

nodatacow files are also no compression and no data checksums. So I'm
betting this is not what you want.




-- 
Chris Murphy

Re: btrfs swapfile - Not enough swap space for hibernation.

[Sreyan Chakravarty]

On Fri, Dec 11, 2020 at 12:32 AM Chris Murphy <lists@colorremedies.com> wrote:
>
> If the journal doesn't have more information about why it says this,
> and if the error is reported in the journal by systemd-logind, enable
> debug logging for logind and reproduce and the try to figure out why
> logind is complaining:
>
> https://github.com/systemd/systemd/issues/15354#issuecomment-610385478
>

Yes.

I have finally found out the reason why logind is complaining, thanks to you.

Dec 11 18:45:05 localhost.HPNotebook systemd-logind[1222]: Failed to
open swap file /var/swap/fedora.swap to determine on-disk offset:
Permission denied
Dec 11 18:45:05 localhost.HPNotebook systemd-logind[1222]: Sent
message type=method_return sender=n/a destination=:1.57 path=n/a
interface=n/a member=n/a cookie=130 reply_cookie=49 signature=s
error-name=n/a error-message=n/a
Dec 11 18:45:05 localhost.HPNotebook systemd-logind[1222]: Got message
type=method_call sender=:1.57 destination=org.freedesktop.login1
path=/org/freedesktop/login1 interface=org.freedesktop.login1.Manager
member=CanHybridSleep cookie=50 reply_cookie=0 signature=n/a
error-name=n/a error-message=n/a
Dec 11 18:45:05 localhost.HPNotebook systemd-logind[1222]: Sleep mode
"disk" is supported by the kernel.
Dec 11 18:45:05 localhost.HPNotebook systemd-logind[1222]: /dev/zram0:
ignoring zram swap


My permissions are as follows:

Permissions of /var/swap directory:
drwxr-xr-x. 1 root root   22 Dec 11 15:06 swap

Permissions of the actual swap file:
-rw-------. 1 root root 9663676416 Dec 11 15:09 fedora.swap

Permissions of the swap subvolume:
drwxr-xr-x. 1 root root   22 Dec 11 15:06 swap

Mount options:
UUID=7d9dbe1b-dea6-4141-807b-026325123ad8 /var/swap
   btrfs   subvol=swap,rw,noattime,nosuid,x-systemd.device-timeout=0 0
0
/var/swap/fedora.swap none swap
defaults,x-systemd.requires-mounts-for=/var/swap 0 2

Output of /proc/swaps:
Filename Type Size Used Priority
/dev/zram0                              partition 4020220 0 100
/var/swap/fedora.swap                   file 9437180 0 -2


The only reason I can fathom is that systemd-logind is unable to
access the directory /var/swap. IIRC, you were the one who suggested I
mount in that directory.

Not blaming you, but the question is what do I do now ?

The bug that you have linked to is about /home not /var.

So where should I keep the swap for logind to access it without any problems ?

> There is a possibility there isn't enough contiguous space in the
> swapfile for the hibernation image. i.e. when you fallocate the
> swapfile, it may be comprised of one or even dozens of separate
> extents and if one of them isn't big enough for hibernation entry then
> it'll always fail.
>
> As far as I'm aware there isn't a way to ask fallocate for a minimum
> extent size. I've sometimes had to fallocate multiple files in a row
> to get a swapfile with few fragments and then delete the rest.
>

I don't think that is possible since the file was created with dd, not
fallocate.
Also the +C attribute was used.

> OK you're confused. You do not need both chattr +C on the file and the
> nodatacow option. You only need one of those. You should realize that
> the nodatacow option applies file system wide. It's non-obvious but
> really only the VFS mount options can apply separately to bind mounts.
> And on Fedora, since subvolumes are mounted to specific mounts points
> and are thus effectively bind mounts behind the scenes, it seems like
> you can apply some mount options to specific subvolumes as if they are
> separate file systems. But that's not what's going on, they're just
> bind mounts. So you can do atime for one mount point, noatime for
> another. And same for ro or rw. Those are VFS options. The Btrfs mount
> options apply file system wide, that includes nodatacow, compress, and
> so on.
>
> Further problem now that you're using nodatacow is that you have a
> bunch of nodatacow files that have been created in the meantime. And
> those do *not* have chattr +C so you have no easy way to find them.
> You'd have to parse 'btrfs inspect-internal dump-tree' for the
> nodatacow flag.
>
> nodatacow files are also no compression and no data checksums. So I'm
> betting this is not what you want.

Yes, I have removed the nodatacow option from my mount in fstab as it
clearly had no effect.
I am now using the +C attribute.

--
Regards,
Sreyan Chakravarty

Re: btrfs swapfile - Not enough swap space for hibernation.

[Chris Murphy]

On Fri, Dec 11, 2020 at 7:02 AM Sreyan Chakravarty <sreyan32@gmail.com> wrote:
>
> The only reason I can fathom is that systemd-logind is unable to
> access the directory /var/swap. IIRC, you were the one who suggested I
> mount in that directory.
>
> Not blaming you, but the question is what do I do now ?

Well, what I recommended is a swap partition to avoid all of these
limitations and questions. If you're going to use swap on Btrfs then
you're kinda in the same boat as the rest of us who are trying to
address each limit. This is why it's not the default and why I haven't
written up anything yet.

My expectation is that swapfiles on btrfs need a helper service of
some sort, in order for it to be generally usable.

> The bug that you have linked to is about /home not /var.

It's a reference for a similar problem, not an identical problem, with
a how to enable debug for logind.

> So where should I keep the swap for logind to access it without any problems ?

You are in adventure land. So you're going on an adventure. If you
want it to just work, use a swap partition.


> I don't think that is possible since the file was created with dd, not
> fallocate.

Why? I've mentioned fallocate several times, and also man 5 btrfs
several times, and there it recommends fallocate. Nowhere is dd
suggested. It may not work with dd depending on the dd exact dd
command used.


-- 
Chris Murphy

Re: btrfs swapfile - Not enough swap space for hibernation.

[Sreyan Chakravarty]

On Sun, Dec 13, 2020 at 3:23 AM Chris Murphy <lists@colorremedies.com> wrote:
> You are in adventure land. So you're going on an adventure. If you
> want it to just work, use a swap partition.

To be clear my problem is not with swap files per se.

It's a SELinux error. I was asking for help on how to configure
SELinux so it does not stop systemd-logind from accessing the
/var/swap directory.

It has nothing to do with swaps.

FYI, I have used swaps in BTRFS with successful hibernation, but it
fell apart when I restored snapshots.

So I am not sure why you say a separate helper service will be required.

-- 
Regards,
Sreyan Chakravarty

Re: btrfs swapfile - Not enough swap space for hibernation.

[Sreyan Chakravarty]

On Mon, Dec 14, 2020 at 2:57 PM Sreyan Chakravarty <sreyan32@gmail.com> wrote:
>
> On Sun, Dec 13, 2020 at 3:23 AM Chris Murphy <lists@colorremedies.com> wrote:
> > You are in adventure land. So you're going on an adventure. If you
> > want it to just work, use a swap partition.
>
> To be clear my problem is not with swap files per se.
>
> It's a SELinux error. I was asking for help on how to configure
> SELinux so it does not stop systemd-logind from accessing the
> /var/swap directory.
>
> It has nothing to do with swaps.
>
> FYI, I have used swaps in BTRFS with successful hibernation, but it
> fell apart when I restored snapshots.
>
> So I am not sure why you say a separate helper service will be required.
>

Done.

Changing to the "etc_runtime_t" solved problems.

But I am not sure if the permissions are not too permissive or not.

I have opened a discussion for that in Github:
https://github.com/fedora-selinux/selinux-policy/issues/508

-- 
Regards,
Sreyan Chakravarty

Re: btrfs swapfile - Not enough swap space for hibernation.

[Sreyan Chakravarty]

On Fri, Dec 11, 2020 at 12:32 AM Chris Murphy <lists@colorremedies.com> wrote:
>
> If the journal doesn't have more information about why it says this,
> and if the error is reported in the journal by systemd-logind, enable
> debug logging for logind and reproduce and the try to figure out why
> logind is complaining:
>
> https://github.com/systemd/systemd/issues/15354#issuecomment-610385478
>
> There is a possibility there isn't enough contiguous space in the
> swapfile for the hibernation image. i.e. when you fallocate the
> swapfile, it may be comprised of one or even dozens of separate
> extents and if one of them isn't big enough for hibernation entry then
> it'll always fail.
>
> As far as I'm aware there isn't a way to ask fallocate for a minimum
> extent size. I've sometimes had to fallocate multiple files in a row
> to get a swapfile with few fragments and then delete the rest.
>
> You can use filefrag -v to see the extent sizes. Those extents are
> basically holes that swap code writes into. The swap code isn't
> writing swap or hibernation images via Btrfs. It's just asking Btrfs
> "what are the ranges and locations I can use" and Btrfs reports that
> and then the swap and hibernation code use those areas directly.
>
>
> > $ lsattr /var/swap/fedora.swap
> > ---------------C---- /var/swap/fedora.swap
>
> > UUID=7d9dbe1b-dea6-4141-807b-026325123ad8 /var/swap
> >    btrfs   subvol=swap,rw,nodatacow,noattime,nosuid,x-systemd.device-timeout=0
>
> OK you're confused. You do not need both chattr +C on the file and the
> nodatacow option. You only need one of those. You should realize that
> the nodatacow option applies file system wide. It's non-obvious but
> really only the VFS mount options can apply separately to bind mounts.
> And on Fedora, since subvolumes are mounted to specific mounts points
> and are thus effectively bind mounts behind the scenes, it seems like
> you can apply some mount options to specific subvolumes as if they are
> separate file systems. But that's not what's going on, they're just
> bind mounts. So you can do atime for one mount point, noatime for
> another. And same for ro or rw. Those are VFS options. The Btrfs mount
> options apply file system wide, that includes nodatacow, compress, and
> so on.
>
> Further problem now that you're using nodatacow is that you have a
> bunch of nodatacow files that have been created in the meantime. And
> those do *not* have chattr +C so you have no easy way to find them.
> You'd have to parse 'btrfs inspect-internal dump-tree' for the
> nodatacow flag.
>
> nodatacow files are also no compression and no data checksums. So I'm
> betting this is not what you want.
>


It's a SELinux error. Are there any SELinux experts here ?

I ran the command:

$ sudo ausearch -m AVC,USER_AVC,SELINUX_ERR -ts recent

and got the error:

time->Fri Dec 11 20:19:20 2020
type=AVC msg=audit(1607698160.378:357): avc:  denied  { search } for
pid=1362 comm="systemd-logind" name="swap" dev="dm-0" ino=256
scontext=system_u:system_r:systemd_logind_t:s0
tcontext=system_u:object_r:unlabeled_t:s0 tclass=dir permissive=0


If I run the command:

$ /sbin/restorecon /var/swap/fedora.swap

I get the following error:

time->Fri Dec 11 19:59:56 2020
type=AVC msg=audit(1607696996.854:323): avc:  denied  { read } for
pid=2523 comm="systemd-sleep" name="fedora.swap" dev="dm-0" ino=257
scontext=system_u:system_r:init_t:s0
tcontext=unconfined_u:object_r:var_t:s0 tclass=file permissive=0


My current SELinux label is :

unconfined_u:object_r:swapfile_t:s0 /var/swap/fedora.swap

When I run "/sbin/restorecon", the label changes to :

unconfined_u:object_r:var_t:s0 /var/swap/fedora.swap

IIRC, the correct label is etc_runtime or something like that.

Can any SELinux expert help me ?

-- 
Regards,
Sreyan Chakravarty

Re: btrfs swapfile - Not enough swap space for hibernation.

[Sreyan Chakravarty]

On Fri, Dec 11, 2020 at 8:26 PM Sreyan Chakravarty <sreyan32@gmail.com> wrote:
>
> On Fri, Dec 11, 2020 at 12:32 AM Chris Murphy <lists@colorremedies.com> wrote:
> >
> > If the journal doesn't have more information about why it says this,
> > and if the error is reported in the journal by systemd-logind, enable
> > debug logging for logind and reproduce and the try to figure out why
> > logind is complaining:
> >
> > https://github.com/systemd/systemd/issues/15354#issuecomment-610385478
> >
> > There is a possibility there isn't enough contiguous space in the
> > swapfile for the hibernation image. i.e. when you fallocate the
> > swapfile, it may be comprised of one or even dozens of separate
> > extents and if one of them isn't big enough for hibernation entry then
> > it'll always fail.
> >
> > As far as I'm aware there isn't a way to ask fallocate for a minimum
> > extent size. I've sometimes had to fallocate multiple files in a row
> > to get a swapfile with few fragments and then delete the rest.
> >
> > You can use filefrag -v to see the extent sizes. Those extents are
> > basically holes that swap code writes into. The swap code isn't
> > writing swap or hibernation images via Btrfs. It's just asking Btrfs
> > "what are the ranges and locations I can use" and Btrfs reports that
> > and then the swap and hibernation code use those areas directly.
> >
> >
> > > $ lsattr /var/swap/fedora.swap
> > > ---------------C---- /var/swap/fedora.swap
> >
> > > UUID=7d9dbe1b-dea6-4141-807b-026325123ad8 /var/swap
> > >    btrfs   subvol=swap,rw,nodatacow,noattime,nosuid,x-systemd.device-timeout=0
> >
> > OK you're confused. You do not need both chattr +C on the file and the
> > nodatacow option. You only need one of those. You should realize that
> > the nodatacow option applies file system wide. It's non-obvious but
> > really only the VFS mount options can apply separately to bind mounts.
> > And on Fedora, since subvolumes are mounted to specific mounts points
> > and are thus effectively bind mounts behind the scenes, it seems like
> > you can apply some mount options to specific subvolumes as if they are
> > separate file systems. But that's not what's going on, they're just
> > bind mounts. So you can do atime for one mount point, noatime for
> > another. And same for ro or rw. Those are VFS options. The Btrfs mount
> > options apply file system wide, that includes nodatacow, compress, and
> > so on.
> >
> > Further problem now that you're using nodatacow is that you have a
> > bunch of nodatacow files that have been created in the meantime. And
> > those do *not* have chattr +C so you have no easy way to find them.
> > You'd have to parse 'btrfs inspect-internal dump-tree' for the
> > nodatacow flag.
> >
> > nodatacow files are also no compression and no data checksums. So I'm
> > betting this is not what you want.
> >
>
>
> It's a SELinux error. Are there any SELinux experts here ?
>
> I ran the command:
>
> $ sudo ausearch -m AVC,USER_AVC,SELINUX_ERR -ts recent
>
> and got the error:
>
> time->Fri Dec 11 20:19:20 2020
> type=AVC msg=audit(1607698160.378:357): avc:  denied  { search } for
> pid=1362 comm="systemd-logind" name="swap" dev="dm-0" ino=256
> scontext=system_u:system_r:systemd_logind_t:s0
> tcontext=system_u:object_r:unlabeled_t:s0 tclass=dir permissive=0
>
>
> If I run the command:
>
> $ /sbin/restorecon /var/swap/fedora.swap
>
> I get the following error:
>
> time->Fri Dec 11 19:59:56 2020
> type=AVC msg=audit(1607696996.854:323): avc:  denied  { read } for
> pid=2523 comm="systemd-sleep" name="fedora.swap" dev="dm-0" ino=257
> scontext=system_u:system_r:init_t:s0
> tcontext=unconfined_u:object_r:var_t:s0 tclass=file permissive=0
>
>
> My current SELinux label is :
>
> unconfined_u:object_r:swapfile_t:s0 /var/swap/fedora.swap
>
> When I run "/sbin/restorecon", the label changes to :
>
> unconfined_u:object_r:var_t:s0 /var/swap/fedora.swap
>
> IIRC, the correct label is etc_runtime or something like that.
>
> Can any SELinux expert help me ?
>
> --
> Regards,
> Sreyan Chakravarty


I also got the following allow rules from "sesearch --allow | grep swap"

allow devices_unconfined_type device_node:blk_file { append
audit_access create execmod execute getattr ioctl link lock map
mounton open quotaon read relabelfrom relabelto rename setattr swapon
unlink write };
allow devices_unconfined_type device_node:chr_file { append
audit_access create execute execute_no_trans getattr ioctl link lock
map mounton open quotaon read relabelfrom relabelto rename setattr
swapon unlink write };
allow devices_unconfined_type device_node:file { append audit_access
create execute execute_no_trans getattr ioctl link lock map mounton
open quotaon read relabelfrom relabelto rename setattr swapon unlink
write };
allow devices_unconfined_type device_node:lnk_file { append
audit_access create execmod execute getattr ioctl link lock map
mounton open quotaon read relabelfrom relabelto rename setattr swapon
unlink write };
allow files_unconfined_type file_type:blk_file { append audit_access
create execmod execute getattr ioctl link lock map mounton open
quotaon read relabelfrom relabelto rename setattr swapon unlink write
};
allow files_unconfined_type file_type:chr_file { append audit_access
create execute execute_no_trans getattr ioctl link lock map mounton
open quotaon read relabelfrom relabelto rename setattr swapon unlink
write };
allow files_unconfined_type file_type:dir { add_name append
audit_access create execmod execute getattr ioctl link lock map
mounton open quotaon read relabelfrom relabelto remove_name rename
reparent rmdir search setattr swapon unlink write };
allow files_unconfined_type file_type:fifo_file { append audit_access
create execmod execute getattr ioctl link lock map mounton open
quotaon read relabelfrom relabelto rename setattr swapon unlink write
};
allow files_unconfined_type file_type:file { append audit_access
create execute execute_no_trans getattr ioctl link lock map mounton
open quotaon read relabelfrom relabelto rename setattr swapon unlink
write };
allow files_unconfined_type file_type:lnk_file { append audit_access
create execmod execute getattr ioctl link lock map mounton open
quotaon read relabelfrom relabelto rename setattr swapon unlink write
};
allow files_unconfined_type file_type:sock_file { append audit_access
create execmod execute getattr ioctl link lock map mounton open
quotaon read relabelfrom relabelto rename setattr swapon unlink write
};
allow filesystem_unconfined_type filesystem_type:blk_file { append
audit_access create execmod execute getattr ioctl link lock map
mounton open quotaon read relabelfrom relabelto rename setattr swapon
unlink write };
allow filesystem_unconfined_type filesystem_type:chr_file { append
audit_access create entrypoint execmod execute execute_no_trans
getattr ioctl link lock map mounton open quotaon read relabelfrom
relabelto rename setattr swapon unlink write };
allow filesystem_unconfined_type filesystem_type:dir { add_name append
audit_access create execmod execute getattr ioctl link lock map
mounton open quotaon read relabelfrom relabelto remove_name rename
reparent rmdir search setattr swapon unlink write };
allow filesystem_unconfined_type filesystem_type:fifo_file { append
audit_access create execmod execute getattr ioctl link lock map
mounton open quotaon read relabelfrom relabelto rename setattr swapon
unlink write };
allow filesystem_unconfined_type filesystem_type:file { append
audit_access create execmod execute execute_no_trans getattr ioctl
link lock map mounton open quotaon read relabelfrom relabelto rename
setattr swapon unlink write };
allow filesystem_unconfined_type filesystem_type:lnk_file { append
audit_access create execmod execute getattr ioctl link lock map
mounton open quotaon read relabelfrom relabelto rename setattr swapon
unlink write };
allow filesystem_unconfined_type filesystem_type:sock_file { append
audit_access create execmod execute getattr ioctl link lock map
mounton open quotaon read relabelfrom relabelto rename setattr swapon
unlink write };
allow kern_unconfined proc_type:dir { add_name append audit_access
create execmod execute getattr ioctl link lock map mounton open
quotaon read relabelfrom relabelto remove_name rename reparent rmdir
search setattr swapon unlink write };
allow kern_unconfined proc_type:file { append audit_access create
execmod execute execute_no_trans getattr ioctl link lock map mounton
open quotaon read relabelfrom relabelto rename setattr swapon unlink
write };
allow kern_unconfined proc_type:lnk_file { append audit_access create
execmod execute getattr ioctl link lock map mounton open quotaon read
relabelfrom relabelto rename setattr swapon unlink write };
allow kern_unconfined sysctl_type:dir { add_name append audit_access
create execmod execute getattr ioctl link lock map mounton open
quotaon read relabelfrom relabelto remove_name rename reparent rmdir
search setattr swapon unlink write };
allow kern_unconfined sysctl_type:file { append audit_access create
execmod execute execute_no_trans getattr ioctl link lock map mounton
open quotaon read relabelfrom relabelto rename setattr swapon unlink
write };
allow kern_unconfined sysctl_type:lnk_file { append audit_access
create execmod execute getattr ioctl link lock map mounton open
quotaon read relabelfrom relabelto rename setattr swapon unlink write
};
allow swapfile_t swapfile_t:filesystem associate;
allow updfstab_t swapfile_t:file getattr;


I have no idea what it means.

I have no clue about SELinux.

-- 
Regards,
Sreyan Chakravarty