Bug 2541947
| Summary: | Lots of AVC denials for access to io.systemd.NamespaceResource tmpfs | ||||||
|---|---|---|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Rich <forums0> | ||||
| Component: | selinux-policy | Assignee: | Zdenek Pytela <zpytela> | ||||
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | ||||
| Severity: | medium | Docs Contact: | |||||
| Priority: | unspecified | ||||||
| Version: | 45 | CC: | clnetbox, dwalsh, lvrabec, mmalik, omosnacek, pkoncity, thetaeridanus, vedran, vmojzis, zpytela | ||||
| Target Milestone: | --- | Keywords: | SELinux | ||||
| Target Release: | --- | ||||||
| Hardware: | x86_64 | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | selinux-policy-45.23-1.fc45 | Doc Type: | --- | ||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2026-10-26 22:25:35 UTC | Type: | --- | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Attachments: |
|
||||||
Hi, Can you switch the system to permissive mode and gather all denials? setenforce 0 <reproduce> ausearch -i -m avc,user_avc,selinux_err,user_selinux_err -ts boot Does it all happen when the services start? Thanks for the reply. Some services trigger the message a lot (NetworkManager for example) - so its not just at service start. I'll have to attach the denials as a separate file - as there are lots. See "selinux.txt" Thanks Created attachment 2159093 [details]
SELinux Denials
I can confirm that an upgrade from 44 to 45 on Workstation is affected as well. On a fresh installation, the io.systemd.NamespaceResource denials don’t appear. FEDORA-2026-d1b11bf36b (selinux-policy-45.21-1.fc45) has been submitted as an update to Fedora 45. https://bodhi.fedoraproject.org/updates/FEDORA-2026-d1b11bf36b FEDORA-2026-d1b11bf36b has been pushed to the Fedora 45 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-d1b11bf36b` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-d1b11bf36b See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates. This update generally works fine and solves the problem, all SELinux AVC denials are gone, except for
SELinux is preventing pkla-check-auth from read access on the sock_file io.systemd.NamespaceResource.
Additional Information:
Source Context system_u:system_r:policykit_auth_t:s0
Target Context system_u:object_r:systemd_nsresourced_runtime_t:s0
Target Objects io.systemd.NamespaceResource [ sock_file ]
Source pkla-check-auth
Source Path pkla-check-auth
Port <Unknown>
Host xxxxxxxx
Source RPM Packages
Target RPM Packages
SELinux Policy RPM selinux-policy-targeted-45.21-1.fc45.noarch
Local Policy RPM selinux-policy-targeted-45.21-1.fc45.noarch
Selinux Enabled True
Policy Type targeted
Enforcing Mode Enforcing
Host Name xxxxxxxx
Platform Linux xxxxxxxx 7.2.9-300.fc45.x86_64 #1 SMP
PREEMPT_DYNAMIC Sat Oct 3 16:19:58 UTC 2026
x86_64
Alert Count 334
First Seen 2026-10-07 12:30:21 CEST
Last Seen 2026-10-07 12:30:38 CEST
Local ID b9282752-9168-478d-9eb6-703f24c7fae5
Raw Audit Messages
type=AVC msg=audit(1791369038.930:540): avc: denied { read } for pid=5474 comm="pkla-check-auth" name="io.systemd.NamespaceResource" dev="tmpfs" ino=1296 scontext=system_u:system_r:policykit_auth_t:s0 tcontext=system_u:object_r:systemd_nsresourced_runtime_t:s0 tclass=sock_file permissive=0
thanks, updating A new one appeared after accessing the system via ssh. Again, it occurs only on upgraded systems :
SELinux is preventing sshd-session from read access on the sock_file io.systemd.NamespaceResource.
Additional Information:
Source Context system_u:system_r:sshd_session_t:s0-s0:c0.c1023
Target Context system_u:object_r:systemd_nsresourced_runtime_t:s0
Target Objects io.systemd.NamespaceResource [ sock_file ]
Source sshd-session
Source Path sshd-session
Port <Unknown>
Host xxxxxxxx
Source RPM Packages
Target RPM Packages
SELinux Policy RPM selinux-policy-targeted-45.21-1.fc45.noarch
Local Policy RPM selinux-policy-targeted-45.21-1.fc45.noarch
Selinux Enabled True
Policy Type targeted
Enforcing Mode Enforcing
Host Name xxxxxxxx
Platform Linux xxxxxxxx 7.2.9-300.fc45.x86_64 #1 SMP
PREEMPT_DYNAMIC Sat Oct 3 16:19:58 UTC 2026
x86_64
Alert Count 2
First Seen 2026-10-08 09:52:04 CEST
Last Seen 2026-10-08 09:52:04 CEST
Local ID 4a85d8f6-d9f7-4f60-ac4a-5b2a8bf55e65
Raw Audit Messages
type=AVC msg=audit(1791445924.160:314): avc: denied { read } for pid=2793 comm="sshd-session" name="io.systemd.NamespaceResource" dev="tmpfs" ino=1296 scontext=system_u:system_r:sshd_session_t:s0-s0:c0.c1023 tcontext=system_u:object_r:systemd_nsresourced_runtime_t:s0 tclass=sock_file permissive=0
*** Bug 2548363 has been marked as a duplicate of this bug. *** Hi Zdenek ! Just want to let you know that the new version 45.22-1.fc45 seems to have solved the problem. No denials after a reboot of the system. Thank you ! Thanks for the feedback, Christian. FEDORA-2026-ad476c056c (selinux-policy-45.23-1.fc45) has been pushed to the Fedora 45 stable repository. If problem still persists, please make note of it in this bug report. |
Since upgrading to Fedora 45 Silverblue (I am not sure yet if this affects Workstation) there is a LOT of SELinux AVC denials. An example of a small subset (though all save the same target): audit[10360]: AVC avc: denied { read } for pid=10360 comm="systemd-userwor" name="io.systemd.NamespaceResource" dev="tmpfs" ino=1242 scontext=system_u:system_r:systemd_userdbd_t:s0 tcontext=system_u:object_r:systemd_nsresourced_runtime_t:s0 tclass=sock_file permissive=0 audit[1027]: AVC avc: denied { read } for pid=1027 comm="accounts-daemon" name="io.systemd.NamespaceResource" dev="tmpfs" ino=1242 scontext=system_u:system_r:accountsd_t:s0 tcontext=system_u:object_r:systemd_nsresourced_runtime_t:s0 tclass=sock_file permissive=0 audit[977]: AVC avc: denied { read } for pid=977 comm="polkitd" name="io.systemd.NamespaceResource" dev="tmpfs" ino=1242 scontext=system_u:system_r:policykit_t:s0 tcontext=system_u:object_r:systemd_nsresourced_runtime_t:s0 tclass=sock_file permissive=0 I believe they are trying to use a socket at: /run/systemd/io.systemd.NamespaceResource Currently it is unclear exactly what this breaks. Reproducible: Always Steps to Reproduce: 1.Install Fedora Silverblue 45 onto something 2.journalctl -b | grep -i avc Actual Results: Lots of AVC/SELinux errors Expected Results: Not lots of AVC/SELinux errors