Bug 2529296

AVC in permissive mode

type=PROCTITLE msg=audit(09/07/2026 09:30:53.648:2081) : proctitle=/usr/bin/NetworkManager --no-daemon 
type=PATH msg=audit(09/07/2026 09:30:53.648:2081) : item=0 name=/proc/self/fd/37 inode=4177 dev=00:1d mode=socket,666 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:xdm_var_run_t:s
0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(09/07/2026 09:30:53.648:2081) : cwd=/ 
type=SYSCALL msg=audit(09/07/2026 09:30:53.648:2081) : arch=x86_64 syscall=getxattr success=no exit=ENODATA(No data available) a0=0x7ffd530d5ac0 a1=0x7ff93047ddfe a2=0x5584b0851650 a3=0x
67 items=1 ppid=1 pid=8867 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=NetworkManager exe=/usr/bin/NetworkManager
 subj=system_u:system_r:NetworkManager_t:s0 key=(null) 
type=AVC msg=audit(09/07/2026 09:30:53.648:2081) : avc:  denied  { read } for  pid=8867 comm=NetworkManager name=org.gnome.DisplayManager dev="tmpfs" ino=4177 scontext=system_u:system_r:
NetworkManager_t:s0 tcontext=system_u:object_r:xdm_var_run_t:s0 tclass=sock_file permissive=1 
----
type=PROCTITLE msg=audit(09/07/2026 09:30:53.648:2082) : proctitle=/usr/bin/NetworkManager --no-daemon 
type=PATH msg=audit(09/07/2026 09:30:53.648:2082) : item=0 name=/proc/self/fd/40 inode=4033 dev=00:1d mode=socket,666 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:systemd_userdbd
_runtime_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(09/07/2026 09:30:53.648:2082) : cwd=/ 
type=SYSCALL msg=audit(09/07/2026 09:30:53.648:2082) : arch=x86_64 syscall=getxattr success=yes exit=10 a0=0x7ffd530d5ac0 a1=0x7ff93047ddfe a2=0x5584b0851650 a3=0x67 items=1 ppid=1 pid=8
867 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=NetworkManager exe=/usr/bin/NetworkManager subj=system_u:system_r
:NetworkManager_t:s0 key=(null) 
type=AVC msg=audit(09/07/2026 09:30:53.648:2082) : avc:  denied  { read } for  pid=8867 comm=NetworkManager name=io.systemd.Home dev="tmpfs" ino=4033 scontext=system_u:system_r:NetworkMa
nager_t:s0 tcontext=system_u:object_r:systemd_userdbd_runtime_t:s0 tclass=sock_file permissive=1

We have a bunch of sockets or symlinks to sockets under /run/systemd/userdb/:

[fedora@rawhide ~]$ ls -lZ /run/systemd/userdb/
total 0
lrwxrwxrwx. 1 root root system_u:object_r:systemd_userdbd_runtime_t:s0 42 Sep  5 15:51 io.systemd.DropIn -> /run/systemd/userdb/io.systemd.Multiplexer
srw-rw-rw-. 1 root root system_u:object_r:systemd_userdbd_runtime_t:s0  0 Sep  5 15:51 io.systemd.DynamicUser
srw-rw-rw-. 1 root root system_u:object_r:systemd_userdbd_runtime_t:s0  0 Sep  5 15:51 io.systemd.Multiplexer
lrwxrwxrwx. 1 root root system_u:object_r:systemd_userdbd_runtime_t:s0 42 Sep  5 15:51 io.systemd.NameServiceSwitch -> /run/systemd/userdb/io.systemd.Multiplexer
lrwxrwxrwx. 1 root root system_u:object_r:systemd_userdbd_runtime_t:s0 41 Sep  5 15:51 io.systemd.NamespaceResource -> /run/systemd/io.systemd.NamespaceResource
srw-rw-rw- 1 root root system_u:object_r:xdm_var_run_t:s0               0 Sep  3 10:05 /run/systemd/userdb/org.gnome.DisplayManager

They are used for namespace resolution. In /etc/nsswitch.conf we have
'passwd: files systemd', so anything that resolves users will use nss-systemd.
If systemd-userdbd.service is running, nss-systemd talks to it,
but if it's not, there's a series of fallbacks to talk to various
resolution sources directly.

In general, this should all be allowed, in particular 
scontext=system_u:system_r:systemd_userdbd_t:s0 needs to talk to all those
sockets. They are systemd_userdbd_runtime_t and xdm_var_run_t, but maybe
there will be others provided by other services.

Thanks, this is a known technical debt in selinux-policy.

*** Bug 2531046 has been marked as a duplicate of this bug. ***

*** Bug 2530541 has been marked as a duplicate of this bug. ***

*** Bug 2531180 has been marked as a duplicate of this bug. ***

So the technical debt I was thinking of was actually addressed long ago, it rather seems to be a feature of some new systemd - clients now also need to read account providers' pid socket files.

I can see the PR si merged https://github.com/fedora-selinux/selinux-policy/pull/3405/changes

But I saw couple of more similar AVCs for systemd-logind

type=PROCTITLE msg=audit(09/11/2026 12:07:23.885:405) : proctitle=/usr/lib/systemd/systemd-logind
type=PATH msg=audit(09/11/2026 12:07:23.885:405) : item=0 name=/proc/self/fd/61 inode=3878 dev=00:1d mode=socket,666 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:xdm_var_run_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0
type=CWD msg=audit(09/11/2026 12:07:23.885:405) : cwd=/
type=SYSCALL msg=audit(09/11/2026 12:07:23.885:405) : arch=x86_64 syscall=getxattr success=no exit=EACCES(Permission denied) a0=0x7fffdd83b7b0 a1=0x7f74d3c51dfe a2=0x56092ab86f60 a3=0x67 items=1 ppid=1 pid=3616 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=systemd-logind exe=/usr/lib/systemd/systemd-logind subj=system_u:system_r:systemd_logind_t:s0 key=(null)
type=AVC msg=audit(09/11/2026 12:07:23.885:405) : avc:  denied  { read } for  pid=3616 comm=systemd-logind name=org.gnome.DisplayManager dev="tmpfs" ino=3878 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:object_r:xdm_var_run_t:s0 tclass=sock_file permissive=0
----
type=PROCTITLE msg=audit(09/11/2026 12:07:23.886:406) : proctitle=/usr/lib/systemd/systemd-logind
type=PATH msg=audit(09/11/2026 12:07:23.886:406) : item=0 name=/proc/self/fd/64 inode=3725 dev=00:1d mode=socket,666 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:systemd_userdbd_runtime_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0
type=CWD msg=audit(09/11/2026 12:07:23.886:406) : cwd=/
type=SYSCALL msg=audit(09/11/2026 12:07:23.886:406) : arch=x86_64 syscall=getxattr success=no exit=EACCES(Permission denied) a0=0x7fffdd83b7b0 a1=0x7f74d3c51dfe a2=0x56092ab86f60 a3=0x67 items=1 ppid=1 pid=3616 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=systemd-logind exe=/usr/lib/systemd/systemd-logind subj=system_u:system_r:systemd_logind_t:s0 key=(null)
type=AVC msg=audit(09/11/2026 12:07:23.886:406) : avc:  denied  { read } for  pid=3616 comm=systemd-logind name=io.systemd.Home dev="tmpfs" ino=3725 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:object_r:systemd_userdbd_runtime_t:s0 tclass=sock_file permissive=0
----
type=PROCTITLE msg=audit(09/11/2026 12:07:23.886:407) : proctitle=/usr/lib/systemd/systemd-logind
type=PATH msg=audit(09/11/2026 12:07:23.886:407) : item=0 name=/proc/self/fd/65 inode=3719 dev=00:1d mode=socket,666 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:systemd_userdbd_runtime_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0
type=CWD msg=audit(09/11/2026 12:07:23.886:407) : cwd=/
type=SYSCALL msg=audit(09/11/2026 12:07:23.886:407) : arch=x86_64 syscall=getxattr success=no exit=EACCES(Permission denied) a0=0x7fffdd83b7b0 a1=0x7f74d3c51dfe a2=0x56092ab86f60 a3=0x67 items=1 ppid=1 pid=3616 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=systemd-logind exe=/usr/lib/systemd/systemd-logind subj=system_u:system_r:systemd_logind_t:s0 key=(null)
type=AVC msg=audit(09/11/2026 12:07:23.886:407) : avc:  denied  { read } for  pid=3616 comm=systemd-logind name=io.systemd.Machine dev="tmpfs" ino=3719 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:object_r:systemd_userdbd_runtime_t:s0 tclass=sock_file permissive=0
----
type=PROCTITLE msg=audit(09/11/2026 12:07:23.887:408) : proctitle=/usr/lib/systemd/systemd-logind
type=PATH msg=audit(09/11/2026 12:07:23.887:408) : item=0 name=/proc/self/fd/66 inode=1735 dev=00:1d mode=socket,666 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:systemd_userdbd_runtime_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0
type=CWD msg=audit(09/11/2026 12:07:23.887:408) : cwd=/
type=SYSCALL msg=audit(09/11/2026 12:07:23.887:408) : arch=x86_64 syscall=getxattr success=no exit=EACCES(Permission denied) a0=0x7fffdd83b7b0 a1=0x7f74d3c51dfe a2=0x56092ab86f60 a3=0x67 items=1 ppid=1 pid=3616 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=systemd-logind exe=/usr/lib/systemd/systemd-logind subj=system_u:system_r:systemd_logind_t:s0 key=(null)
type=AVC msg=audit(09/11/2026 12:07:23.887:408) : avc:  denied  { read } for  pid=3616 comm=systemd-logind name=io.systemd.Multiplexer dev="tmpfs" ino=1735 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:object_r:systemd_userdbd_runtime_t:s0 tclass=sock_file permissive=0
----
type=PROCTITLE msg=audit(09/11/2026 12:07:23.887:409) : proctitle=/usr/lib/systemd/systemd-logind
type=PATH msg=audit(09/11/2026 12:07:23.887:409) : item=0 name=/proc/self/fd/67 inode=1695 dev=00:1d mode=socket,666 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:systemd_userdbd_runtime_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0
type=CWD msg=audit(09/11/2026 12:07:23.887:409) : cwd=/
type=SYSCALL msg=audit(09/11/2026 12:07:23.887:409) : arch=x86_64 syscall=getxattr success=no exit=EACCES(Permission denied) a0=0x7fffdd83b7b0 a1=0x7f74d3c51dfe a2=0x56092ab86f60 a3=0x67 items=1 ppid=1 pid=3616 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=systemd-logind exe=/usr/lib/systemd/systemd-logind subj=system_u:system_r:systemd_logind_t:s0 key=(null)
type=AVC msg=audit(09/11/2026 12:07:23.887:409) : avc:  denied  { read } for  pid=3616 comm=systemd-logind name=io.systemd.DynamicUser dev="tmpfs" ino=1695 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:object_r:systemd_userdbd_runtime_t:s0 tclass=sock_file permissive=0
root@lslebodn-thinkpadp1gen7:~# ausearch -m AVC,USER_AVC,SELINUX_ERR,USER_SELINUX_ERR -i -ts today | audit2allow

I have a feeling they might be fixed by 
```
diff --git a/policy/modules/system/authlogin.te b/policy/modules/system/authlogin.te
index d5994631fa..7c968167ae 100644
--- a/policy/modules/system/authlogin.te
+++ b/policy/modules/system/authlogin.te
@@ -576,6 +576,7 @@ optional_policy(`
 
 optional_policy(`
 	systemd_homed_stream_connect(nsswitch_domain)
+	systemd_read_userdbd_runtime_sock_files(nsswitch_domain)
 ')
 
 optional_policy(`
@@ -588,6 +589,7 @@ optional_policy(`
 ')
 
 optional_policy(`
+	xserver_read_xdm_pid_sock_files(nsswitch_domain)
 	xserver_stream_connect_xdm(nsswitch_domain)
 ')
```

But sharing them just in case

FEDORA-2026-2dbcddc9d9 (selinux-policy-45.17-1.fc45) has been submitted as an update to Fedora 45.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-2dbcddc9d9

FEDORA-2026-2dbcddc9d9 has been pushed to the Fedora 45 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-2dbcddc9d9`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-2dbcddc9d9

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

FEDORA-2026-2dbcddc9d9 (selinux-policy-45.17-1.fc45) has been pushed to the Fedora 45 stable repository.
If problem still persists, please make note of it in this bug report.