Bug 2537253
| Summary: | SELinux is preventing chcon from using the mac_admin capability. | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Christian Stadelmann <fedora> |
| Component: | selinux-policy | Assignee: | Zdenek Pytela <zpytela> |
| Status: | CLOSED DUPLICATE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | medium | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 44 | CC: | dwalsh, lvrabec, mmalik, omosnacek, pkoncity, vmojzis, zpytela |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2026-09-22 07:20:31 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
*** This bug has been marked as a duplicate of bug 2533850 *** |
No noticeable problems, just a SELinux AVC denial. Reproducible: Always Steps to Reproduce: 1. Have Fedora atomic / Silverblue 2. Reboot 3. Log in to GNOME (I think this is necessary) 4. have a look at SELinux denials Actual Results: SELinux alert for AVC denial. Text: > You should report this as a bug. > You can generate a local policy module to allow this access. > Allow this access for now by executing: > # ausearch -c 'chcon' --raw | audit2allow -M my-chcon > # semodule -X 300 -i my-chcon.pp Expected Results: No SELinux denials. Additional Information: Output from SELinux Alert Browser's Detail window: ========== SELinux is preventing chcon from using the mac_admin capability. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that chcon should have the mac_admin capability by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'chcon' --raw | audit2allow -M my-chcon # semodule -X 300 -i my-chcon.pp Additional Information: Source Context system_u:system_r:tuned_t:s0 Target Context system_u:system_r:tuned_t:s0 Target Objects Unknown [ capability2 ] Source chcon Source Path chcon Port <Unknown> Host [redacted] Source RPM Packages Target RPM Packages SELinux Policy RPM selinux-policy-targeted-44.9-1.fc44.noarch Local Policy RPM Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name [redacted] Platform Linux [redacted] 7.2.5-200.fc44.x86_64 #1 SMP PREEMPT_DYNAMIC Fri Sep 11 15:11:05 UTC 2026 x86_64 Alert Count 32 First Seen 2026-09-15 23:00:02 CEST Last Seen 2026-09-20 12:25:36 CEST Local ID 8c0b9d84-9d20-4f2b-96ec-b881a06f70d1 Raw Audit Messages type=AVC msg=audit(1789899936.332:2477): avc: denied { mac_admin } for pid=119523 comm="chcon" capability=33 scontext=system_u:system_r:tuned_t:s0 tcontext=system_u:system_r:tuned_t:s0 tclass=capability2 permissive=0 Hash: chcon,tuned_t,tuned_t,capability2,mac_admin