Bug 2497016
| Summary: | SELinux is preventing sort from 'search' accesses on the adresář /sys/fs/cgroup. | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Radek Valasek <reddy> | ||||||
| Component: | selinux-policy | Assignee: | Zdenek Pytela <zpytela> | ||||||
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | ||||||
| Severity: | unspecified | Docs Contact: | |||||||
| Priority: | unspecified | ||||||||
| Version: | 44 | CC: | dwalsh, lvrabec, mmalik, omosnacek, pkoncity, reddy, vmojzis, zpytela | ||||||
| Target Milestone: | --- | ||||||||
| Target Release: | --- | ||||||||
| Hardware: | x86_64 | ||||||||
| OS: | Unspecified | ||||||||
| Whiteboard: | abrt_hash:5b30587fb14c881fecce86e357384f26822738b39a75d5b0ef9d7c024e895681;VARIANT_ID=workstation; | ||||||||
| Fixed In Version: | selinux-policy-44.5-1.fc44 | Doc Type: | --- | ||||||
| Doc Text: | Story Points: | --- | |||||||
| Clone Of: | Environment: | ||||||||
| Last Closed: | 2026-07-30 01:17:34 UTC | Type: | --- | ||||||
| Regression: | --- | Mount Type: | --- | ||||||
| Documentation: | --- | CRM: | |||||||
| Verified Versions: | Category: | --- | |||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||
| Embargoed: | |||||||||
| Attachments: |
|
||||||||
Created attachment 2147654 [details]
File: description
Created attachment 2147655 [details]
File: os_info
FEDORA-2026-6433e648bb (selinux-policy-44.5-1.fc44) has been submitted as an update to Fedora 44. https://bodhi.fedoraproject.org/updates/FEDORA-2026-6433e648bb FEDORA-2026-6433e648bb has been pushed to the Fedora 44 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-6433e648bb` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-6433e648bb See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates. FEDORA-2026-6433e648bb (selinux-policy-44.5-1.fc44) has been pushed to the Fedora 44 stable repository. If problem still persists, please make note of it in this bug report. |
Description of problem: SELinux is preventing sort from 'search' accesses on the adresář /sys/fs/cgroup. ***** Plugin catchall (100. confidence) suggests ************************** Pokud jste přesvědčeni, že má sort mít ve výchozím stavu přístup search na cgroup directory. Then měli byste tento problém nahlásit jako chybu. Abyste přístup povolili, můžete vygenerovat lokální modul pravidel. Do prozatím tento přístup povolíte příkazy: # ausearch -c 'sort' --raw | audit2allow -M my-sort # semodule -X 300 -i my-sort.pp Additional Information: Source Context system_u:system_r:wireguard_t:s0 Target Context system_u:object_r:cgroup_t:s0 Target Objects /sys/fs/cgroup [ dir ] Source sort Source Path sort Port <Neznámé> Host (removed) Source RPM Packages Target RPM Packages SELinux Policy RPM selinux-policy-targeted-44.3-1.fc44.noarch Local Policy RPM selinux-policy-targeted-44.3-1.fc44.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 7.0.14-201.fc44.x86_64 #1 SMP PREEMPT_DYNAMIC Wed Jul 1 13:34:38 UTC 2026 x86_64 Alert Count 10 First Seen 2026-07-04 11:28:42 CEST Last Seen 2026-07-04 11:28:43 CEST Local ID bcba9d64-9368-42ee-8cf9-ee41ae7f063f Raw Audit Messages type=AVC msg=audit(1783157323.69:349): avc: denied { search } for pid=5350 comm="sort" name="/" dev="cgroup2" ino=1 scontext=system_u:system_r:wireguard_t:s0 tcontext=system_u:object_r:cgroup_t:s0 tclass=dir permissive=0 Hash: sort,wireguard_t,cgroup_t,dir,search Version-Release number of selected component: selinux-policy-targeted-44.3-1.fc44.noarch Additional info: reporter: libreport-2.17.15 kernel: 7.0.14-201.fc44.x86_64 package: selinux-policy-targeted-44.3-1.fc44.noarch component: selinux-policy hashmarkername: setroubleshoot reason: SELinux is preventing sort from 'search' accesses on the adresář /sys/fs/cgroup. type: libreport component: selinux-policy