Bug 2040545

Description of problem:
I updated a Fedora 35 KDE Plasma installation with updates-testing enabled using the following commands
sudo dnf offline-upgrade download
sudo dnf offline-upgrade reboot

The update included selinux-policy-35.9-1.fc35. QDBusConnection was denied writing to the sock_file bus during the next two boots. The denial happened when the systemd user manager was starting sddm for the uid 989. QDBusConnection might be a thread name of sddm given the source label was xdm_t.

Jan 13 21:12:59 systemd[1]: Started User Manager for UID 989.
Jan 13 21:12:59 audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=user@989 comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
Jan 13 21:12:59 systemd[1]: Started Session c1 of User sddm.
Jan 13 21:12:59 audit[1013]: USER_START pid=1013 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 msg='op=PAM:session_open grantors=pam_unix,pam_systemd acct="sddm" exe="/usr/libexec/sddm-helper" hostname=? addr=? terminal=:0 res=success'
Jan 13 21:12:59 audit[1070]: AVC avc:  denied  { write } for  pid=1070 comm="QDBusConnection" name="bus" dev="tmpfs" ino=52 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:session_dbusd_tmp_t:s0 tclass=sock_file permissive=0
Jan 13 21:12:59 sddm-greeter[1070]: QFont::fromString: Invalid description '(empty)'
Jan 13 21:12:59 kernel: Lockdown: systemd-logind: hibernation is restricted; see man kernel_lockdown.7
Jan 13 21:12:59 kernel: Lockdown: systemd-logind: hibernation is restricted; see man kernel_lockdown.7
Jan 13 21:12:59 kernel: Lockdown: systemd-logind: hibernation is restricted; see man kernel_lockdown.7
Jan 13 21:12:59 abrtd[881]: '/var/spool/abrt/ccpp-2021-04-06-16:56:01.73433-7477' is not a problem directory
Jan 13 21:13:00 sddm-greeter[1070]: Loading file:///usr/share/sddm/themes/breeze/Main.qml...
Jan 13 21:13:00 sddm-greeter[1070]: QObject: Cannot create children for a parent that is in a different thread.
                                    (Parent is QGuiApplication(0x7fff533faf70), parent's thread is QThread(0x55d50675bbe0), current thread is QThread(0x55d5068b4400)
Jan 13 21:13:00 sddm-greeter[1070]: QObject: Cannot create children for a parent that is in a different thread.
                                    (Parent is QGuiApplication(0x7fff533faf70), parent's thread is QThread(0x55d50675bbe0), current thread is QThread(0x55d5068b4400)
Jan 13 21:13:00 sddm-greeter[1070]: QObject: Cannot create children for a parent that is in a different thread.
                                    (Parent is QGuiApplication(0x7fff533faf70), parent's thread is QThread(0x55d50675bbe0), current thread is QThread(0x55d5068b4400)
Jan 13 21:13:00 sddm-greeter[1070]: QObject: Cannot create children for a parent that is in a different thread.
                                    (Parent is QGuiApplication(0x7fff533faf70), parent's thread is QThread(0x55d50675bbe0), current thread is QThread(0x55d5068b4400)
Jan 13 21:13:00 sddm-greeter[1070]: QObject: Cannot create children for a parent that is in a different thread.
                                    (Parent is QGuiApplication(0x7fff533faf70), parent's thread is QThread(0x55d50675bbe0), current thread is QThread(0x55d5068b4400)
Jan 13 21:13:00 sddm-greeter[1070]: QObject: Cannot create children for a parent that is in a different thread.
                                    (Parent is QGuiApplication(0x7fff533faf70), parent's thread is QThread(0x55d50675bbe0), current thread is QThread(0x55d5068b4400)
Jan 13 21:13:00 sddm-greeter[1070]: QObject: Cannot create children for a parent that is in a different thread.
                                    (Parent is QGuiApplication(0x7fff533faf70), parent's thread is QThread(0x55d50675bbe0), current thread is QThread(0x55d5068b4400)
Jan 13 21:13:00 sddm-greeter[1070]: QObject::installEventFilter(): Cannot filter events for objects in a different thread.

I didn't see this denial before selinux-policy-35.9-1.fc35. I'm using the targeted policy in enforcing mode. The other rpms involved were systemd-249.9-1.fc35 and sddm-0.19.0-18.fc35
The changelog for selinux-policy-35.9-1.fc35 had the following changes which might be related https://koji.fedoraproject.org/koji/buildinfo?buildID=1877518
- Ensure that `/run/systemd/*` are properly labeled
- Allow admin userdomains use socketpair()
- Change /run/user/[0-9]+ to /run/user/%{USERID} for proper labeling

There was another new denial of systemd-user-runtime-dir unlinking bus later which I'll make another report for.
SELinux is preventing QDBusConnection from 'write' accesses on the sock_file bus.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that QDBusConnection should be allowed write access on the bus sock_file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'QDBusConnection' --raw | audit2allow -M my-QDBusConnection
# semodule -X 300 -i my-QDBusConnection.pp

Additional Information:
Source Context                system_u:system_r:xdm_t:s0-s0:c0.c1023
Target Context                unconfined_u:object_r:session_dbusd_tmp_t:s0
Target Objects                bus [ sock_file ]
Source                        QDBusConnection
Source Path                   QDBusConnection
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           
Target RPM Packages           
SELinux Policy RPM            selinux-policy-targeted-35.9-1.fc35.noarch
Local Policy RPM              selinux-policy-targeted-35.9-1.fc35.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 5.15.14-200.fc35.x86_64 #1 SMP Tue
                              Jan 11 16:49:27 UTC 2022 x86_64 x86_64
Alert Count                   2
First Seen                    2022-01-13 21:07:12 EST
Last Seen                     2022-01-13 21:12:59 EST
Local ID                      a1dafeab-a03b-4929-959c-37762b7ec87c

Raw Audit Messages
type=AVC msg=audit(1642126379.679:279): avc:  denied  { write } for  pid=1070 comm="QDBusConnection" name="bus" dev="tmpfs" ino=52 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:session_dbusd_tmp_t:s0 tclass=sock_file permissive=0


Hash: QDBusConnection,xdm_t,session_dbusd_tmp_t,sock_file,write

Version-Release number of selected component:
selinux-policy-targeted-35.9-1.fc35.noarch

Additional info:
component:      selinux-policy
reporter:       libreport-2.15.2
hashmarkername: setroubleshoot
kernel:         5.15.14-200.fc35.x86_64
type:           libreport