Bug 2425217
| Summary: | SELinux is preventing bwrap from 'mounton' accesses on the directory /newroot/usr/lib/fontconfig/cache. | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Daniel D. <ddmpost> | ||||||||
| Component: | selinux-policy | Assignee: | Zdenek Pytela <zpytela> | ||||||||
| Status: | CLOSED DUPLICATE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | ||||||||
| Severity: | unspecified | Docs Contact: | |||||||||
| Priority: | unspecified | ||||||||||
| Version: | 43 | CC: | ddmpost, dwalsh, lvrabec, mmalik, omosnacek, pkoncity, vmojzis, zpytela | ||||||||
| Target Milestone: | --- | ||||||||||
| Target Release: | --- | ||||||||||
| Hardware: | x86_64 | ||||||||||
| OS: | Unspecified | ||||||||||
| Whiteboard: | abrt_hash:5995164b3457349ce8aa941c20758175f28c96d1b5727c9db5b09639c15bd072;VARIANT_ID=xfce; | ||||||||||
| Fixed In Version: | Doc Type: | --- | |||||||||
| Doc Text: | Story Points: | --- | |||||||||
| Clone Of: | Environment: | ||||||||||
| Last Closed: | 2026-02-02 17:08:27 UTC | Type: | --- | ||||||||
| Regression: | --- | Mount Type: | --- | ||||||||
| Documentation: | --- | CRM: | |||||||||
| Verified Versions: | Category: | --- | |||||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||||
| Embargoed: | |||||||||||
| Attachments: |
|
||||||||||
Created attachment 2119925 [details]
File: os_info
Created attachment 2119926 [details]
File: description
Created attachment 2119927 [details]
SELinux contexts on my filesystem
Instead of /newroot/usr/lib/fontconfig/cache I'm attaching a listing of SELinux contexts of the directory and files in my /usr/lib/fontconfig/cache
*** This bug has been marked as a duplicate of bug 2415016 *** |
Description of problem: Problem occurred while accesing an image file on Thunar. The description on SELinux Troubleshooter mentions an apparently nonexistent path beginning with /newroot/, so I cannot check its stated context. SELinux is preventing bwrap from 'mounton' accesses on the directory /newroot/usr/lib/fontconfig/cache. ***** Plugin restorecon (99.5 confidence) suggests ************************ If you want to fix the label. /newroot/usr/lib/fontconfig/cache default label should be default_t. Then you can run restorecon. The access attempt may have been stopped due to insufficient permissions to access a parent directory in which case try to change the following command accordingly. Do # /sbin/restorecon -v /newroot/usr/lib/fontconfig/cache ***** Plugin catchall (1.49 confidence) suggests ************************** If you believe that bwrap should be allowed mounton access on the cache directory by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'bwrap' --raw | audit2allow -M my-bwrap # semodule -X 300 -i my-bwrap.pp Additional Information: Source Context unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 Target Context system_u:object_r:fonts_cache_t:s0 Target Objects /newroot/usr/lib/fontconfig/cache [ dir ] Source bwrap Source Path bwrap Port <Unknown> Host (removed) Source RPM Packages Target RPM Packages SELinux Policy RPM selinux-policy-targeted-42.19-1.fc43.noarch Local Policy RPM selinux-policy-targeted-42.19-1.fc43.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 6.17.12-300.fc43.x86_64 #1 SMP PREEMPT_DYNAMIC Sat Dec 13 05:06:24 UTC 2025 x86_64 Alert Count 14 First Seen 2025-12-22 23:50:29 CET Last Seen 2025-12-24 16:43:20 CET Local ID 7c78aebf-6e6f-4f3a-a99b-e5485db529f7 Raw Audit Messages type=AVC msg=audit(1766591000.452:612): avc: denied { mounton } for pid=2706730 comm="bwrap" path="/newroot/usr/lib/fontconfig/cache" dev="nvme0n1p3" ino=1713929 scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=system_u:object_r:fonts_cache_t:s0 tclass=dir permissive=0 Hash: bwrap,thumb_t,fonts_cache_t,dir,mounton Version-Release number of selected component: selinux-policy-targeted-42.19-1.fc43.noarch Additional info: reporter: libreport-2.17.15 hashmarkername: setroubleshoot package: selinux-policy-targeted-42.19-1.fc43.noarch type: libreport reason: SELinux is preventing bwrap from 'mounton' accesses on the directory /newroot/usr/lib/fontconfig/cache. component: selinux-policy comment: Problem occurred while accesing an image file on Thunar. The description on SELinux Troubleshooter mentions an apparently nonexistent path beginning with /newroot/, so I cannot check its stated context. kernel: 6.17.12-300.fc43.x86_64 component: selinux-policy