Bug 2360779

I started to debug the issue - here are my initial results:

- gnome-control-center is trying to load /usr/lib64/NetworkManager/libnm-gtk4-vpn-plugin-vpnc-editor.so
- dlopen works, but dlsym fails when trying to get the address of the function "nm_vpn_editor_factory_vpnc"
- when checking the exported symbols of the *.so file, there are nearly none:

nm -D /usr/lib64/NetworkManager/libnm-vpn-plugin-vpnc-editor.so
                 w __cxa_finalize
                 w __gmon_start__
                 U g_static_resource_fini
                 U g_static_resource_init
                 w _ITM_deregisterTMCloneTable
                 w _ITM_registerTMCloneTable

- in NetworkManager-vpnc-gnome-1.2.8, there are many more symbols and there is also the missing "nm_vpn_editor_factory_vpnc" method in the text section of that shared object:

nm -D /usr/lib64/NetworkManager/libnm-gtk4-vpn-plugin-vpnc-editor.so |grep nm_vpn_editor_factory_vpnc
0000000000004080 T nm_vpn_editor_factory_vpnc

- why there are so many symbols missing in NetworkManager-vpnc-gnome-1.4.0's libnm-vpn-plugin-vpnc-editor.so I'm not sure...

I found the issue and provided a patch upstream: https://gitlab.gnome.org/GNOME/NetworkManager-vpnc/-/merge_requests/19.

@lkundrak if the patch is OK for you, I can "provenpackage" the update in Fedora for rawhide and F42.

FEDORA-2025-e303622939 (NetworkManager-vpnc-1.4.0-3.fc42) has been submitted as an update to Fedora 42.
https://bodhi.fedoraproject.org/updates/FEDORA-2025-e303622939

FEDORA-2025-e303622939 has been pushed to the Fedora 42 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2025-e303622939`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2025-e303622939

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

FEDORA-2025-e303622939 (NetworkManager-vpnc-1.4.0-3.fc42) has been pushed to the Fedora 42 stable repository.
If problem still persists, please make note of it in this bug report.

The UI Panel is now working. 

But activating the connection does not work due to SELinux denial. 

#nmcli con up id HOME                                        4 
Error: Connection activation failed: The VPN service failed to start
Hint: use 'journalctl -xe NM_CONNECTION=787e342d-671f-4837-b5d4-d9ebb0cd82aa + NM_DEVICE=wlp2s0' to get more details.

#journalctl -xe NM_CONNECTION=787e342d-671f-4837-b5d4-d9ebb0cd82aa
NetworkManager[1893]: <warn>  [1747307040.8455] vpn[0x5626d9735e90,787e342d-671    f-4837-b5d4-d9ebb0cd82aa,"HOME"]: failed to connect: 'Failed to execute child process “/usr/sbin/vpnc”     (Permission denied)'
#journalctl -f 
May 15 13:08:39 fedora NetworkManager[1893]: <info>  [1747307319.9930] agent-manager: agent[bdf7ab0f8a645e73,:1.248/nmcli-connect/1000]: agent registered
May 15 13:08:40 fedora NetworkManager[1893]: <info>  [1747307320.0088] vpn[0x5626d9735e90,787e342d-671f-4837-b5d4-d9ebb0cd82aa,"HOME"]: starting vpnc
May 15 13:08:40 fedora NetworkManager[1893]: <info>  [1747307320.0090] audit: op="connection-activate" uuid="787e342d-671f-4837-b5d4-d9ebb0cd82aa" name="HOME" pid=9356 uid=1000 result="success"
May 15 13:08:40 fedora audit[9372]: AVC avc:  denied  { execute } for  pid=9372 comm="nm-vpnc-service" name="consolehelper" dev="dm-0" ino=637909 scontext=system_u:system_r:NetworkManager_t:s0 tcontext=system_u:object_r:consolehelper_exec_t:s0 tclass=file permissive=0
May 15 13:08:40 fedora audit[9385]: AVC avc:  denied  { execute } for  pid=9385 comm="nm-vpnc-service" name="consolehelper" dev="dm-0" ino=637909 scontext=system_u:system_r:NetworkManager_t:s0 tcontext=system_u:object_r:consolehelper_exec_t:s0 tclass=file permissive=0
May 15 13:08:40 fedora NetworkManager[1893]: <warn>  [1747307320.1245] vpn[0x5626d9735e90,787e342d-671f-4837-b5d4-d9ebb0cd82aa,"HOME"]: failed to connect: 'Failed to execute child process “/usr/sbin/vpnc” (Permission denied)'

#setenforce 0
#nmcli con up id HOME 
Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/36)

-> all works as expected

I can confirm the above report.

Now the panel is working but you get an SELinux error.

If I disable SELinux (getenforce -> disabled) the vpn works correctly.

Don't know if I should open another bug report.

(In reply to Riccardo R. from comment #7)

> Now the panel is working but you get an SELinux error.
> 
> If I disable SELinux (getenforce -> disabled) the vpn works correctly.
> 
> Don't know if I should open another bug report.

There are already two bug report for the selinux-policy component for the SELinux issue:

https://bugzilla.redhat.com/show_bug.cgi?id=2366041
https://bugzilla.redhat.com/show_bug.cgi?id=2366205

Please subscribe to them for updates.