Bug 2441643
| Summary: | SELinux is preventing gpsd from using the 'setcap' accesses on a process. | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Aleksandar Kostadinov <akostadi> | ||||||||
| Component: | selinux-policy | Assignee: | Zdenek Pytela <zpytela> | ||||||||
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | ||||||||
| Severity: | unspecified | Docs Contact: | |||||||||
| Priority: | medium | ||||||||||
| Version: | 43 | CC: | akostadi, dan, davek, lvrabec, mmalik, omosnacek, pkoncity, vmojzis, zpytela | ||||||||
| Target Milestone: | --- | Flags: | zpytela:
mirror+
|
||||||||
| Target Release: | --- | ||||||||||
| Hardware: | x86_64 | ||||||||||
| OS: | Unspecified | ||||||||||
| Whiteboard: | abrt_hash:a3dd0c08a51d749e922c0a7b18ec57139f00b59a60bb1acb5c78c1f73a43317c;VARIANT_ID=; | ||||||||||
| Fixed In Version: | selinux-policy-43.7-1.fc43 | Doc Type: | --- | ||||||||
| Doc Text: | Story Points: | --- | |||||||||
| Clone Of: | Environment: | ||||||||||
| Last Closed: | 2026-04-30 01:21:03 UTC | Type: | --- | ||||||||
| Regression: | --- | Mount Type: | --- | ||||||||
| Documentation: | --- | CRM: | |||||||||
| Verified Versions: | Category: | --- | |||||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||||
| Embargoed: | |||||||||||
| Attachments: |
|
||||||||||
Created attachment 2130453 [details]
File: description
Created attachment 2130454 [details]
File: os_info
Hi, Can you include some details like journal entries? Can you reproduce it with full audigin enabled? https://fedoraproject.org/wiki/SELinux/Debugging#Enable_full_auditing Created attachment 2131564 [details] logs from gpsd startup I followed the wiki for a more thorough reproducer (I wonder why is it not the default, otherwise reporting bugs would be very hard for an average user): > 🐚 sudo ausearch -i -m avc,user_avc,selinux_err,user_selinux_err -ts today > ---- > type=PROCTITLE msg=audit( 1.03.2026 22:59:40.600:1655) : proctitle=/usr/bin/gpsd -n /dev/em05.at > type=SYSCALL msg=audit( 1.03.2026 22:59:40.600:1655) : arch=x86_64 syscall=capset success=no exit=EACCES(Permission denied) a0=0x564277d56c9c a1=0x564277d56ca4 a2=0x564277d56ca4 a3=0x564277d08010 items=0 ppid=1 pid=592931 auid=unset uid=nobody gid=dialout euid=nobody suid=nobody fsuid=nobody egid=dialout sgid=dialout fsgid=dialout > tty=(none) ses=unset comm=gpsd exe=/usr/bin/gpsd subj=system_u:system_r:gpsd_t:s0 key=(null) > type=AVC msg=audit( 1.03.2026 22:59:40.600:1655) : avc: denied { setcap } for pid=592931 comm=gpsd scontext=system_u:system_r:gpsd_t:s0 tcontext=system_u:system_r:gpsd_t:s0 tclass=process permissive=0 Also attached what I thought was relevant from `journalctl` Is this any better because I can't spot with my untrained eye any additional information :) yes, it was helpful. *** Bug 2418373 has been marked as a duplicate of this bug. *** FEDORA-2026-80879d3dfe (selinux-policy-43.7-1.fc43) has been submitted as an update to Fedora 43. https://bodhi.fedoraproject.org/updates/FEDORA-2026-80879d3dfe FEDORA-2026-80879d3dfe has been pushed to the Fedora 43 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-80879d3dfe` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-80879d3dfe See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates. FEDORA-2026-80879d3dfe (selinux-policy-43.7-1.fc43) has been pushed to the Fedora 43 stable repository. If problem still persists, please make note of it in this bug report. |
Description of problem: Trying to run gpsd with config file: > # Options for gpsd, including serial devices (default empty) > OPTIONS="-n" > # Set to 'true' to add USB devices automatically via udev (default true) > USBAUTO="false" > # default not set at all. this link is created by UDEV when device is detected > DEVICES="/dev/em05.at" The device itself is: Quectel EM05-G Revision: EM05GFAR07A07M1G vendor/prod id: 2c7c:0314 SELinux is preventing gpsd from using the 'setcap' accesses on a process. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that gpsd should be allowed setcap access on processes labeled gpsd_t by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'gpsd' --raw | audit2allow -M my-gpsd # semodule -X 300 -i my-gpsd.pp Additional Information: Source Context system_u:system_r:gpsd_t:s0 Target Context system_u:system_r:gpsd_t:s0 Target Objects Unknown [ process ] Source gpsd Source Path gpsd Port <Unknown> Host (removed) Source RPM Packages Target RPM Packages SELinux Policy RPM selinux-policy-targeted-42.23-1.fc43.noarch Local Policy RPM selinux-policy-targeted-42.23-1.fc43.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 6.18.8-200.fc43.x86_64 #1 SMP PREEMPT_DYNAMIC Fri Jan 30 20:23:28 UTC 2026 x86_64 Alert Count 1 First Seen 2026-02-21 17:13:50 EET Last Seen 2026-02-21 17:13:50 EET Local ID 91bded3a-4c7c-4df4-91bc-e98997000880 Raw Audit Messages type=AVC msg=audit(1771686830.13:5630): avc: denied { setcap } for pid=134303 comm="gpsd" scontext=system_u:system_r:gpsd_t:s0 tcontext=system_u:system_r:gpsd_t:s0 tclass=process permissive=0 Hash: gpsd,gpsd_t,gpsd_t,process,setcap Version-Release number of selected component: selinux-policy-targeted-42.23-1.fc43.noarch Additional info: reporter: libreport-2.17.15 reason: SELinux is preventing gpsd from using the 'setcap' accesses on a process. package: selinux-policy-targeted-42.23-1.fc43.noarch component: selinux-policy hashmarkername: setroubleshoot type: libreport kernel: 6.18.8-200.fc43.x86_64 component: selinux-policy