Bug 2166509

Description of problem:
I ran sudo dnf offline-upgrade download (with upgrades-testing enabled) then sudo dnf offline-upgrade reboot in a Fedora 37 KDE Plasma installation. The upgrade included systemd-251.11-1.fc37.x86_64 and subpackages. On the next 2 boots after the completed update, processes like sd-worker and systemd-userwork were denied using the sys_resource capability when systemd-userdbd.service was started as shown in the following journal output.

Feb 01 22:05:37 systemd[1]: Starting systemd-userdbd.service - User Database Manager...
Feb 01 22:05:37 auditd[832]: Email option is specified but /usr/lib/sendmail doesn't seem executable.
Feb 01 22:05:37 auditd[832]: q_depth should be larger than 512 for safety margin
Feb 01 22:05:37 auditd[837]: Error - plugin (/etc/audit/plugins.d//syslog.conf) is active but no path given
Feb 01 22:05:37 auditd[837]: Skipping syslog.conf plugin due to errors
Feb 01 22:05:37 auditd[837]: audit dispatcher initialized with q_depth=400 and 1 active plugins
Feb 01 22:05:37 audit: CONFIG_CHANGE op=set audit_enabled=1 old=1 auid=4294967295 ses=4294967295 subj=system_u:system_r:auditd_t:s0 res=1
Feb 01 22:05:37 audit[837]: SYSCALL arch=c000003e syscall=44 success=yes exit=60 a0=3 a1=7ffc7bb19b10 a2=3c a3=0 items=0 ppid=832 pid=837 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="auditd" exe="/usr/sbin/auditd" subj=system_u:system_r:auditd_t:s0 key=(null)
Feb 01 22:05:37 kernel: audit: type=1305 audit(1675307137.491:159): op=set audit_enabled=1 old=1 auid=4294967295 ses=4294967295 subj=system_u:system_r:auditd_t:s0 res=1
Feb 01 22:05:37 kernel: audit: type=1300 audit(1675307137.491:159): arch=c000003e syscall=44 success=yes exit=60 a0=3 a1=7ffc7bb19b10 a2=3c a3=0 items=0 ppid=832 pid=837 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="auditd" exe="/usr/sbin/auditd" subj=system_u:system_r:auditd_t:s0 key=(null)
Feb 01 22:05:37 audit: PROCTITLE proctitle="/sbin/auditd"
Feb 01 22:05:37 audit: CONFIG_CHANGE op=set audit_pid=837 old=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:auditd_t:s0 res=1
Feb 01 22:05:37 audit[837]: SYSCALL arch=c000003e syscall=44 success=yes exit=60 a0=3 a1=7ffc7bb177d0 a2=3c a3=0 items=0 ppid=832 pid=837 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="auditd" exe="/usr/sbin/auditd" subj=system_u:system_r:auditd_t:s0 key=(null)
Feb 01 22:05:37 audit: PROCTITLE proctitle="/sbin/auditd"
Feb 01 22:05:37 auditd[837]: Init complete, auditd 3.0.9 listening for events (startup state enable)
Feb 01 22:05:37 audit[843]: AVC avc:  denied  { sys_resource } for  pid=843 comm="(sd-worker)" capability=24  scontext=system_u:system_r:systemd_userdbd_t:s0 tcontext=system_u:system_r:systemd_userdbd_t:s0 tclass=capability permissive=0
Feb 01 22:05:37 audit[843]: SYSCALL arch=c000003e syscall=157 success=no exit=-1 a0=23 a1=8 a2=7f5ed8824000 a3=0 items=0 ppid=836 pid=843 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="(sd-worker)" exe="/usr/lib/systemd/systemd-userdbd" subj=system_u:system_r:systemd_userdbd_t:s0 key=(null)
Feb 01 22:05:37 audit: PROCTITLE proctitle="(sd-worker)"
Feb 01 22:05:37 audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=systemd-userdbd comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
Feb 01 22:05:37 systemd[1]: Started systemd-userdbd.service - User Database Manager.
Feb 01 22:05:37 sedispatch[839]: Connection Error (Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory): AVC Will be dropped
Feb 01 22:05:37 audit[844]: AVC avc:  denied  { sys_resource } for  pid=844 comm="(sd-worker)" capability=24  scontext=system_u:system_r:systemd_userdbd_t:s0 tcontext=system_u:system_r:systemd_userdbd_t:s0 tclass=capability permissive=0
Feb 01 22:05:37 audit[844]: SYSCALL arch=c000003e syscall=157 success=no exit=-1 a0=23 a1=8 a2=7f5ed8824000 a3=0 items=0 ppid=836 pid=844 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="(sd-worker)" exe="/usr/lib/systemd/systemd-userdbd" subj=system_u:system_r:systemd_userdbd_t:s0 key=(null)
Feb 01 22:05:37 audit: PROCTITLE proctitle="(sd-worker)"
Feb 01 22:05:37 audit[845]: AVC avc:  denied  { sys_resource } for  pid=845 comm="(sd-worker)" capability=24  scontext=system_u:system_r:systemd_userdbd_t:s0 tcontext=system_u:system_r:systemd_userdbd_t:s0 tclass=capability permissive=0
Feb 01 22:05:37 sedispatch[839]: Connection Error (Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory): AVC Will be dropped
Feb 01 22:05:37 audit[845]: SYSCALL arch=c000003e syscall=157 success=no exit=-1 a0=23 a1=8 a2=7f5ed8824000 a3=0 items=0 ppid=836 pid=845 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="(sd-worker)" exe="/usr/lib/systemd/systemd-userdbd" subj=system_u:system_r:systemd_userdbd_t:s0 key=(null)
Feb 01 22:05:37 audit: PROCTITLE proctitle="(sd-worker)"
Feb 01 22:05:37 sedispatch[839]: Connection Error (Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory): AVC Will be dropped
Feb 01 22:05:37 audit[844]: AVC avc:  denied  { sys_resource } for  pid=844 comm="systemd-userwor" capability=24  scontext=system_u:system_r:systemd_userdbd_t:s0 tcontext=system_u:system_r:systemd_userdbd_t:s0 tclass=capability permissive=0
Feb 01 22:05:37 audit[844]: SYSCALL arch=c000003e syscall=157 success=no exit=-1 a0=23 a1=8 a2=7ff4893bc000 a3=0 items=0 ppid=836 pid=844 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-userwor" exe="/usr/lib/systemd/systemd-userwork" subj=system_u:system_r:systemd_userdbd_t:s0 key=(null)
Feb 01 22:05:37 audit: PROCTITLE proctitle="(sd-worker)"
Feb 01 22:05:37 audit[843]: AVC avc:  denied  { sys_resource } for  pid=843 comm="systemd-userwor" capability=24  scontext=system_u:system_r:systemd_userdbd_t:s0 tcontext=system_u:system_r:systemd_userdbd_t:s0 tclass=capability permissive=0
Feb 01 22:05:37 audit[846]: AVC avc:  denied  { sys_resource } for  pid=846 comm="(sd-worker)" capability=24  scontext=system_u:system_r:systemd_userdbd_t:s0 tcontext=system_u:system_r:systemd_userdbd_t:s0 tclass=capability permissive=0
Feb 01 22:05:37 audit[843]: SYSCALL arch=c000003e syscall=157 success=no exit=-1 a0=23 a1=8 a2=7f1574a9c000 a3=0 items=0 ppid=836 pid=843 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-userwor" exe="/usr/lib/systemd/systemd-userwork" subj=system_u:system_r:systemd_userdbd_t:s0 key=(null)
Feb 01 22:05:37 audit: PROCTITLE proctitle="(sd-worker)"
Feb 01 22:05:37 audit[846]: SYSCALL arch=c000003e syscall=157 success=no exit=-1 a0=23 a1=8 a2=7f5ed8824000 a3=0 items=0 ppid=836 pid=846 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="(sd-worker)" exe="/usr/lib/systemd/systemd-userdbd" subj=system_u:system_r:systemd_userdbd_t:s0 key=(null)
Feb 01 22:05:37 audit: PROCTITLE proctitle="(sd-worker)"
Feb 01 22:05:37 sedispatch[839]: Connection Error (Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory): AVC Will be dropped
Feb 01 22:05:37 audit[845]: AVC avc:  denied  { sys_resource } for  pid=845 comm="systemd-userwor" capability=24  scontext=system_u:system_r:systemd_userdbd_t:s0 tcontext=system_u:system_r:systemd_userdbd_t:s0 tclass=capability permissive=0
Feb 01 22:05:37 audit[845]: SYSCALL arch=c000003e syscall=157 success=no exit=-1 a0=23 a1=8 a2=7f33e089c000 a3=0 items=0 ppid=836 pid=845 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-userwor" exe="/usr/lib/systemd/systemd-userwork" subj=system_u:system_r:systemd_userdbd_t:s0 key=(null)
Feb 01 22:05:37 audit: PROCTITLE proctitle="(sd-worker)"
Feb 01 22:05:37 sedispatch[839]: Connection Error (Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory): AVC Will be dropped
Feb 01 22:05:37 sedispatch[839]: Connection Error (Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory): AVC Will be dropped
Feb 01 22:05:37 audit[846]: AVC avc:  denied  { sys_resource } for  pid=846 comm="systemd-userwor" capability=24  scontext=system_u:system_r:systemd_userdbd_t:s0 tcontext=system_u:system_r:systemd_userdbd_t:s0 tclass=capability permissive=0
Feb 01 22:05:37 audit[846]: SYSCALL arch=c000003e syscall=157 success=no exit=-1 a0=23 a1=8 a2=7fdec0159000 a3=0 items=0 ppid=836 pid=846 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="systemd-userwor" exe="/usr/lib/systemd/systemd-userwork" subj=system_u:system_r:systemd_userdbd_t:s0 key=(null)
Feb 01 22:05:37 audit: PROCTITLE proctitle="(sd-worker)"
Feb 01 22:05:37 sedispatch[839]: Connection Error (Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory): AVC Will be dropped
Feb 01 22:05:37 sedispatch[839]: Connection Error (Failed to connect to socket /run/dbus/system_bus_socket: No such file or directory): AVC Will be dropped

I also saw SELinux denial notifications at various times while using Plasma. The same sorts of sys_resource denials were shown in the journal at those times. The denials didn't happen before the update including systemd-251.11-1.fc37 so likely some change in that is related to them. I'm using the targeted policy in enforcing mode from selinux-policy-37.18-1.fc37.
SELinux is preventing (sd-worker) from using the 'sys_resource' capabilities.

*****  Plugin sys_resource (91.4 confidence) suggests   **********************

If you do not want processes to require capabilities to use up all the system resources on your system;
Then you need to diagnose why your system is running out of system resources and fix the problem.

According to /usr/include/linux/capability.h, sys_resource is required to:

/* Override resource limits. Set resource limits. */
/* Override quota limits. */
/* Override reserved space on ext2 filesystem */
/* Modify data journaling mode on ext3 filesystem (uses journaling
   resources) */
/* NOTE: ext2 honors fsuid when checking for resource overrides, so
   you can override using fsuid too */
/* Override size restrictions on IPC message queues */
/* Allow more than 64hz interrupts from the real-time clock */
/* Override max number of consoles on console allocation */
/* Override max number of keymaps */

Do
fix the cause of the SYS_RESOURCE on your system.

*****  Plugin catchall (9.59 confidence) suggests   **************************

If you believe that (sd-worker) should have the sys_resource capability by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c '(sd-worker)' --raw | audit2allow -M my-sdworker
# semodule -X 300 -i my-sdworker.pp

Additional Information:
Source Context                system_u:system_r:systemd_userdbd_t:s0
Target Context                system_u:system_r:systemd_userdbd_t:s0
Target Objects                Unknown [ capability ]
Source                        (sd-worker)
Source Path                   (sd-worker)
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           
Target RPM Packages           
SELinux Policy RPM            selinux-policy-targeted-37.18-1.fc37.noarch
Local Policy RPM              selinux-policy-targeted-37.18-1.fc37.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 6.1.8-200.fc37.x86_64 #1 SMP
                              PREEMPT_DYNAMIC Tue Jan 24 20:32:16 UTC 2023
                              x86_64 x86_64
Alert Count                   12
First Seen                    2023-02-01 22:10:46 EST
Last Seen                     2023-02-01 22:16:10 EST
Local ID                      be2b891b-ec94-4342-94bf-21c34a711eaa

Raw Audit Messages
type=AVC msg=audit(1675307770.565:398): avc:  denied  { sys_resource } for  pid=3450 comm="systemd-userwor" capability=24  scontext=system_u:system_r:systemd_userdbd_t:s0 tcontext=system_u:system_r:systemd_userdbd_t:s0 tclass=capability permissive=0


Hash: (sd-worker),systemd_userdbd_t,systemd_userdbd_t,capability,sys_resource

Version-Release number of selected component:
selinux-policy-targeted-37.18-1.fc37.noarch

Additional info:
component:      selinux-policy
reporter:       libreport-2.17.4
hashmarkername: setroubleshoot
kernel:         6.1.8-200.fc37.x86_64
type:           libreport