Bug 2507582
| Summary: | SELinux is preventing sshd-session from name_connect access on the tcp_socket port 3389 (gnome-remote-desktop-daemon) | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Bryan <bryanroessler> |
| Component: | selinux-policy | Assignee: | Zdenek Pytela <zpytela> |
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | medium | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 44 | CC: | dwalsh, edgar.hoch, kentrhb, lvrabec, mironov.ivan, mmalik, omosnacek, pkoncity, vmojzis, zpytela |
| Target Milestone: | --- | Flags: | zpytela:
needinfo?
(bryanroessler) |
| Target Release: | --- | ||
| Hardware: | aarch64 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | selinux-policy-44.9-1.fc44 | Doc Type: | --- |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2026-09-16 00:54:22 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Please provide unfiltered avc denials and, if possible, enable full auditing first: https://fedoraproject.org/wiki/SELinux/Debugging#Enable_full_auditing The problem still exists with selinux-policy-44.8-1.fc44.noarch.
This is the message caused by a user who uses vs code.
type=AVC msg=audit(28.08.2026 11:58:43.276:30506) : avc: denied { name_connect } for pid=1879765 comm=sshd-session dest=46369 scontext=system_u:system_r:sshd_session_t:s0-s0:c0.c1023 tcontext=system_u:object_r:ephemeral_port_t:s0 tclass=tcp_socket permissive=0
I have tried "ssh -D 39104 myuser", then configured firefox using SOCKS-Host with this port for testing. I have used https://www.redhat.com/en/blog/ssh-dynamic-port-forwarding to get an impression how I can test this.
type=PROCTITLE msg=audit(28.08.2026 13:54:06.506:30838) : proctitle=sshd-session: myuser@pts/2
type=SOCKADDR msg=audit(28.08.2026 13:54:06.506:30838) : saddr={ saddr_fam=inet6 laddr=2001:7c0:2041:8::19 lport=443 }
type=SYSCALL msg=audit(28.08.2026 13:54:06.506:30838) : arch=x86_64 syscall=connect success=no exit=EACCES(Keine Berechtigung) a0=0x6 a1=0x557e14384be0 a2=0x1c a3=0x0 items=0 ppid=1884002 pid=1884005 auid=myuser uid=myuser gid=myuser euid=myuser suid=myuser fsuid=myuser egid=myuser sgid=myuser fsgid=myuser tty=(none) ses=99 comm=sshd-session exe=/usr/libexec/openssh/sshd-session subj=system_u:system_r:sshd_session_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(28.08.2026 13:54:06.506:30838) : avc: denied { name_connect } for pid=1884005 comm=sshd-session dest=443 scontext=system_u:system_r:sshd_session_t:s0-s0:c0.c1023 tcontext=system_u:object_r:http_port_t:s0 tclass=tcp_socket permissive=0
A temporary workaround is to enable sebool nis_enabled.
setsebool nis_enabled on
FEDORA-2026-1413268892 (selinux-policy-44.9-1.fc44) has been submitted as an update to Fedora 44. https://bodhi.fedoraproject.org/updates/FEDORA-2026-1413268892 FEDORA-2026-1413268892 has been pushed to the Fedora 44 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-1413268892` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-1413268892 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates. FEDORA-2026-1413268892 (selinux-policy-44.9-1.fc44) has been pushed to the Fedora 44 stable repository. If problem still persists, please make note of it in this bug report. |
When trying to connect to a GNOME remote desktop headless session, the server reports the following error and the connection fails: Jul 27 12:53:09 pi4 setroubleshoot[554411]: SELinux is preventing sshd-session from name_connect access on the tcp_socket port 3389. For complete SELinux messages run: sealert -l a714c98d-d8e3-4b8a-8d8a-3fc746ea2779 Jul 27 12:53:10 pi4 audit[1]: SERVICE_STOP pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=dbus-:1.2-org.fedoraproject.SetroubleshootPrivileged@6 comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' Jul 27 12:53:09 pi4 setroubleshoot[554411]: SELinux is preventing sshd-session from name_connect access on the tcp_socket port 3389. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that sshd-session should be allowed name_connect access on the port 3389 tcp_socket by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'sshd-session' --raw | audit2allow -M my-sshdsession # semodule -X 300 -i my-sshdsession.pp Jul 27 12:53:11 pi4 gnome-remote-desktop-daemon[551917]: [12:53:11:180] [551917:00086bed] [ERROR][com.freerdp.core.peer] - [rdp_set_error_info]: ERRINFO_CB_CONNECTION_CANCELLED [0x00010409] Reproducible: Always Steps to Reproduce: 1. Enable gnome-remote-desktop (not desktop sharing) over RDP 2. Connect from client using Gnome Connections or Remmina RDP 3. Actual Results: Connection dies after a few seconds. Expected Results: New remote desktop session is created and accessible via RDP (port 3389).