Bug 1928561
| Summary: | SELinux is preventing gnome-session-b from 'watch' accesses on the directory /run/systemd/sessions. | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Pat Kelly <pmkellly72> |
| Component: | selinux-policy | Assignee: | Zdenek Pytela <zpytela> |
| Status: | CLOSED DUPLICATE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 34 | CC: | awilliam, dwalsh, grepl.miroslav, lvrabec, mmalik, omosnace, plautrba, sanjay.ankur, vmojzis, v, zpytela |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Unspecified | ||
| Whiteboard: | abrt_hash:f62581c4d4973bbc31c5a0033f623e79aa60c7b60706a01ce2673cf14f4a8ba0;VARIANT_ID=workstation; | ||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2021-03-19 07:36:47 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Similar problem has been detected: Second reboot after install. I had been installing additional software, hashmarkername: setroubleshoot kernel: 5.11.1-300.fc34.x86_64 package: selinux-policy-targeted-3.14.7-23.fc34.noarch reason: SELinux is preventing gnome-session-b from 'watch' accesses on the directory /run/systemd/sessions. type: libreport Similar problem has been detected: Started a session. Right after a system-upgrade to 34 hashmarkername: setroubleshoot kernel: 5.11.0-156.fc34.x86_64 package: selinux-policy-targeted-3.14.7-23.fc34.noarch reason: SELinux is preventing gnome-session-b from 'watch' accesses on the directory /run/systemd/sessions. type: libreport Similar problem has been detected: I have setroubleshoot loaded and this showed up after a reboot. It shows up after all restarts. hashmarkername: setroubleshoot kernel: 5.11.2-300.fc34.x86_64 package: selinux-policy-targeted-3.14.7-24.fc34.noarch reason: SELinux is preventing gnome-session-b from 'watch' accesses on the directory /run/systemd/sessions. type: libreport Similar problem has been detected: Happens during boot of current Fedora 34 Workstation. hashmarkername: setroubleshoot kernel: 5.11.6-300.fc34.x86_64 package: selinux-policy-targeted-3.14.7-25.fc34.noarch reason: SELinux is preventing gnome-session-b from 'watch' accesses on the directory /run/systemd/sessions. type: libreport *** This bug has been marked as a duplicate of bug 1928549 *** |
Description of problem: This alert started happeniing as soon as the system was rebooted after setroubleshoot was installed. Installing setrouble shoot was the only change made to the system after the WS Bets 0214 was installed. This is on a bare metal system. SELinux is preventing gnome-session-b from 'watch' accesses on the directory /run/systemd/sessions. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that gnome-session-b should be allowed watch access on the sessions directory by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'gnome-session-b' --raw | audit2allow -M my-gnomesessionb # semodule -X 300 -i my-gnomesessionb.pp Additional Information: Source Context system_u:system_r:xdm_t:s0-s0:c0.c1023 Target Context system_u:object_r:systemd_logind_sessions_t:s0 Target Objects /run/systemd/sessions [ dir ] Source gnome-session-b Source Path gnome-session-b Port <Unknown> Host (removed) Source RPM Packages Target RPM Packages SELinux Policy RPM selinux-policy-targeted-3.14.7-20.fc34.noarch Local Policy RPM selinux-policy-targeted-3.14.7-20.fc34.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 5.11.0-0.rc7.149.fc34.x86_64 #1 SMP Mon Feb 8 16:23:47 UTC 2021 x86_64 x86_64 Alert Count 2 First Seen 2021-02-14 16:10:19 EST Last Seen 2021-02-14 16:10:25 EST Local ID a778e236-ac41-4595-8bbf-ca8ba9870ad6 Raw Audit Messages type=AVC msg=audit(1613337025.486:606): avc: denied { watch } for pid=1037 comm="gnome-shell" path="/run/systemd/sessions" dev="tmpfs" ino=68 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:systemd_logind_sessions_t:s0 tclass=dir permissive=0 Hash: gnome-session-b,xdm_t,systemd_logind_sessions_t,dir,watch Version-Release number of selected component: selinux-policy-targeted-3.14.7-20.fc34.noarch Additional info: component: selinux-policy reporter: libreport-2.14.0 hashmarkername: setroubleshoot kernel: 5.11.0-0.rc7.149.fc34.x86_64 type: libreport Potential duplicate: bug 1928549