Fedora Account System
Red Hat Associate
Red Hat Customer
Description of problem: SELinux is preventing gnome-shell from 'execute' accesses on the file 2F7661722F6C69622F67646D2F2332363231353830202864656C6574656429. ***** Plugin catchall (100. confidence) suggests ************************** If вы считаете, что gnome-shell следует разрешить доступ execute к 2F7661722F6C69622F67646D2F2332363231353830202864656C6574656429 file по умолчанию. Then рекомендуется создать отчет об ошибке. Чтобы разрешить доступ, можно создать локальный модуль политики. Do allow this access for now by executing: # ausearch -c 'gnome-shell' --raw | audit2allow -M my-gnomeshell # semodule -X 300 -i my-gnomeshell.pp Additional Information: Source Context system_u:system_r:xdm_t:s0-s0:c0.c1023 Target Context system_u:object_r:xdm_var_lib_t:s0 Target Objects 2F7661722F6C69622F67646D2F233236323135383020286465 6C6574656429 [ file ] Source gnome-shell Source Path gnome-shell Port <Unknown> Host (removed) Source RPM Packages Target RPM Packages Policy RPM selinux-policy-3.13.1-190.fc24.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 4.5.7-300.fc24.x86_64 #1 SMP Wed Jun 8 18:12:45 UTC 2016 x86_64 x86_64 Alert Count 7 First Seen 2016-06-08 15:11:38 YEKT Last Seen 2016-06-22 11:16:48 YEKT Local ID 61e2b93b-4827-4fae-8e63-2294d2196e8d Raw Audit Messages type=AVC msg=audit(1466576208.653:475): avc: denied { execute } for pid=2912 comm="gnome-shell" path=2F7661722F6C69622F67646D2F2332363231353830202864656C6574656429 dev="dm-0" ino=2621580 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:xdm_var_lib_t:s0 tclass=file permissive=0 Hash: gnome-shell,xdm_t,xdm_var_lib_t,file,execute Version-Release number of selected component: selinux-policy-3.13.1-190.fc24.noarch Additional info: reporter: libreport-2.7.1 hashmarkername: setroubleshoot kernel: 4.5.7-300.fc24.x86_64 reproducible: Not sure how to reproduce the problem type: libreport Potential duplicate: bug 1299403
I have the same problem. But in my case, when this SElinux alert occurs, I'm switched to another terminal and I must switch back to gnome by CTRL+ALT+F2.
Description of problem: It happens several minutes after loggin in, the system switches to TTY1 and I get this error on my desktop after switching back to TTY2. Version-Release number of selected component: selinux-policy-3.13.1-190.fc24.noarch Additional info: reporter: libreport-2.7.1 hashmarkername: setroubleshoot kernel: 4.5.7-300.fc24.x86_64 reproducible: Not sure how to reproduce the problem type: libreport
This also is happening to me. SELinux is preventing gnome-shell from execute access on the file 2F7661722F6C69622F67646D2F2E676C766E64515864545838202864656C6574656429. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that gnome-shell should be allowed execute access on the 2F7661722F6C69622F67646D2F2E676C766E64515864545838202864656C6574656429 file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'gnome-shell' --raw | audit2allow -M my-gnomeshell # semodule -X 300 -i my-gnomeshell.pp Additional Information: Source Context system_u:system_r:xdm_t:s0-s0:c0.c1023 Target Context system_u:object_r:xdm_var_lib_t:s0 Target Objects 2F7661722F6C69622F67646D2F2E676C766E64515864545838 202864656C6574656429 [ file ] Source gnome-shell Source Path gnome-shell Port <Unknown> Host localhost.localdomain Source RPM Packages Target RPM Packages Policy RPM selinux-policy-3.13.1-191.14.fc24.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name localhost.localdomain Platform Linux localhost.localdomain 4.7.2-201.fc24.x86_64 #1 SMP Fri Aug 26 15:58:40 UTC 2016 x86_64 x86_64 Alert Count 2 First Seen 2016-09-10 07:27:50 PDT Last Seen 2016-09-10 08:28:22 PDT Local ID 9c7895d3-7679-4da9-aed8-3ab1b3923b9d Raw Audit Messages type=AVC msg=audit(1473521302.798:208): avc: denied { execute } for pid=1285 comm="gnome-shell" path=2F7661722F6C69622F67646D2F2E676C766E64515864545838202864656C6574656429 dev="dm-0" ino=919120 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:xdm_var_lib_t:s0 tclass=file permissive=0 Hash: gnome-shell,xdm_t,xdm_var_lib_t,file,execute
*** Bug 1399363 has been marked as a duplicate of this bug. ***
Guys, gnome-shell is trying to execute file "2F7661722F6C69622F67646D2F2E676C766E64515864545838202864656C6574656429" stored somewhere here: /var/cache/[mg]dm(/.*)? all files system_u:object_r:xdm_var_lib_t:s0 /var/cache/lightdm(/.*)? all files system_u:object_r:xdm_var_lib_t:s0 /var/lib/[mxkwg]dm(/.*)? all files system_u:object_r:xdm_var_lib_t:s0 /var/lib/gdm(3)?(/.*)? all files system_u:object_r:xdm_var_lib_t:s0 /var/lib/lightdm(/.*)? all files system_u:object_r:xdm_var_lib_t:s0 /var/lib/lightdm-data(/.*)? all files system_u:object_r:xdm_var_lib_t:s0 /var/lib/lxdm(/.*)? all files system_u:object_r:xdm_var_lib_t:s0 /var/lib/sddm(/.*)? all files system_u:object_r:xdm_var_lib_t:s0 Do you know whats going on here? THanks.
(In reply to Lukas Vrabec from comment #5) Sorry but no.
Description of problem: Just boot up Version-Release number of selected component: selinux-policy-3.13.1-225.3.fc25.noarch Additional info: reporter: libreport-2.8.0 hashmarkername: setroubleshoot kernel: 4.8.15-300.fc25.x86_64 type: libreport
Description of problem: starting a minecraft server Version-Release number of selected component: selinux-policy-3.13.1-225.6.fc25.noarch Additional info: reporter: libreport-2.8.0 hashmarkername: setroubleshoot kernel: 4.8.16-300.fc25.x86_64 type: libreport
I too have suffered from the same alert. Very strange as I was running my system 'headless'. No gnome sessions should have been started, other than a gdm login screen. I was using ssh to log in to a system which runs a few docker containers I was playing around with. Along with ssh I also used cockpit to check on resource usage. NB I am in permissive mode because I am seeing a high number of SELinux errors on the docker containers at present and am busy correctring these. Just in case it helps the full details of my error are: If you believe that gnome-shell should be allowed execute access on the 2F7661722F6C69622F67646D2F2333303138353730202864656C6574656429 file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'gnome-shell' --raw | audit2allow -M my-gnomeshell # semodule -X 300 -i my-gnomeshell.pp Additional Information: Source Context system_u:system_r:xdm_t:s0-s0:c0.c1023 Target Context system_u:object_r:xdm_var_lib_t:s0 Target Objects 2F7661722F6C69622F67646D2F233330313835373020286465 6C6574656429 [ file ] Source gnome-shell Source Path gnome-shell Port <Unknown> Host young Source RPM Packages Target RPM Packages Policy RPM selinux-policy-3.13.1-225.6.fc25.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Permissive Host Name young Platform Linux ######## 4.8.f you believe that gnome-shell should be allowed execute access on the 2F7661722F6C69622F67646D2F2333303138353730202864656C6574656429 file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'gnome-shell' --raw | audit2allow -M my-gnomeshell # semodule -X 300 -i my-gnomeshell.pp Additional Information: Source Context system_u:system_r:xdm_t:s0-s0:c0.c1023 Target Context system_u:object_r:xdm_var_lib_t:s0 Target Objects 2F7661722F6C69622F67646D2F233330313835373020286465 6C6574656429 [ file ] Source gnome-shell Source Path gnome-shell Port <Unknown> Host young Source RPM Packages Target RPM Packages Policy RPM selinux-policy-3.13.1-225.6.fc25.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Permissive Host Name young Platform Linux ####### 4.8.16-300.fc25.x86_64 #1 SMP Fri Jan 6 18:11:49 UTC 2017 x86_64 x86_64 Alert Count 1 First Seen 2017-01-14 18:18:43 GMT Last Seen 2017-01-14 18:18:43 GMT16-300.fc25.x86_64 #1 SMP Fri Jan 6 18:11:49 UTC 2017 x86_64 x86_64 Alert Count 1 First Seen 2017-01-14 18:18:43 GMT Last Seen 2017-01-14 18:18:43 GMT
I am also getting this error, even with the latest selinux policy that was installed today and created a major headache. I use KDE so there is no gnome to worry about. Mine is linked to QSGRenderThread. It didn't affect things so I let it slide. ========================== SELinux is preventing QSGRenderThread from execute access on the file 2F7661722F6C69622F7364646D2F2331353736353531202864656C6574656429. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that QSGRenderThread should be allowed execute access on the 2F7661722F6C69622F7364646D2F2331353736353531202864656C6574656429 file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'QSGRenderThread' --raw | audit2allow -M my-QSGRenderThread # semodule -X 300 -i my-QSGRenderThread.pp Additional Information: Source Context system_u:system_r:xdm_t:s0-s0:c0.c1023 Target Context system_u:object_r:xdm_var_lib_t:s0 Target Objects 2F7661722F6C69622F7364646D2F2331353736353531202864 656C6574656429 [ file ] Source QSGRenderThread Source Path QSGRenderThread Port <Unknown> Host XXXX Source RPM Packages Target RPM Packages Policy RPM selinux-policy-3.13.1-225.10.fc25.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Permissive Host Name XXXX Platform Linux XXXX 4.9.11-200.fc25.x86_64 #1 SMP Mon Feb 20 18:11:59 UTC 2017 x86_64 x86_64 Alert Count 10 First Seen 2017-02-20 22:24:43 MST Last Seen 2017-02-26 15:38:18 MST Local ID b80a6ac7-97c9-4e5c-92c4-ed49927be15d Raw Audit Messages type=AVC msg=audit(1488148698.214:290): avc: denied { execute } for pid=2409 comm="QSGRenderThread" path=2F7661722F6C69622F7364646D2F2331353736353531202864656C6574656429 dev="dm-0" ino=1576551 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:xdm_var_lib_t:s0 tclass=file permissive=1 Hash: QSGRenderThread,xdm_t,xdm_var_lib_t,file,execute
Description of problem: When i tried to load the wl kernel module, it would not allow it Version-Release number of selected component: selinux-policy-3.13.1-225.10.fc25.noarch Additional info: reporter: libreport-2.8.0 hashmarkername: setroubleshoot kernel: 4.9.11-200.fc25.x86_64 type: libreport
On a second machine, I have had the same selinux notice about 2F7661722F6C69622F7364646D2F2331353736353531202864656C6574656429 again without using Gnome. On this machine it is against sddm-greeter Same selinux policy.
Description of problem: SELinux is preventing gnome-shell from 'execute' accesses on the file 2F7661722F6C69622F67646D2F2331313831353833202864656C6574656429. Version-Release number of selected component: selinux-policy-3.13.1-225.10.fc25.noarch Additional info: reporter: libreport-2.8.0 hashmarkername: setroubleshoot kernel: 4.9.11-200.fc25.x86_64 type: libreport
Description of problem: This message appears after login. Version-Release number of selected component: selinux-policy-3.13.1-225.10.fc25.noarch Additional info: reporter: libreport-2.8.0 hashmarkername: setroubleshoot kernel: 4.9.12-200.fc25.x86_64 type: libreport
Description of problem: gnome-shell on Wayland seems to be failing and falling back to gnome-shell on Xorg Version-Release number of selected component: selinux-policy-3.13.1-225.11.fc25.noarch Additional info: reporter: libreport-2.8.0 hashmarkername: setroubleshoot kernel: 4.9.12-200.fc25.x86_64 type: libreport
Right after starting my system, with just Keepass and a Firefox window open, my system freezes and I get this SELinux alert: SELinux is preventing gnome-shell from execute access on the file 2F7661722F6C69622F67646D2F2331373034313538202864656C6574656429. ***** Plugin catchall (100. confidence) suggests ************************** If cree que de manera predeterminada, gnome-shell debería permitir acceso execute sobre 2F7661722F6C69622F67646D2F2331373034313538202864656C6574656429 file. Then debería reportar esto como un error. Puede generar un módulo de política local para permitir este acceso. Do allow this access for now by executing: # ausearch -c 'gnome-shell' --raw | audit2allow -M my-gnomeshell # semodule -X 300 -i my-gnomeshell.pp Additional Information: Source Context system_u:system_r:xdm_t:s0-s0:c0.c1023 Target Context system_u:object_r:xdm_var_lib_t:s0 Target Objects 2F7661722F6C69622F67646D2F233137303431353820286465 6C6574656429 [ file ] Source gnome-shell Source Path gnome-shell Port <Unknown> Host (removed) Source RPM Packages Target RPM Packages Policy RPM selinux-policy-3.13.1-225.11.fc25.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux workstation 4.9.13-201.fc25.x86_64 #1 SMP Tue Mar 7 23:47:11 UTC 2017 x86_64 x86_64 Alert Count 30 First Seen 2017-02-28 17:05:45 CET Last Seen 2017-03-14 15:14:07 CET Local ID 408c1946-e073-4b1d-bd1e-7bdcacfd5114 Raw Audit Messages type=AVC msg=audit(1489500847.88:193): avc: denied { execute } for pid=1495 comm="gnome-shell" path=2F7661722F6C69622F67646D2F2331373034313538202864656C6574656429 dev="dm-1" ino=1704158 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:xdm_var_lib_t:s0 tclass=file permissive=0 Hash: gnome-shell,xdm_t,xdm_var_lib_t,file,execute
Description of problem: - Did a fresh install of Fedora 25. - Performed updates via CLI and did a reboot. - Message appeared after logging into GNOME. Version-Release number of selected component: selinux-policy-3.13.1-225.11.fc25.noarch Additional info: reporter: libreport-2.8.0 hashmarkername: setroubleshoot kernel: 4.10.6-200.fc25.x86_64 type: libreport
Description of problem: Trying to print a pdf Version-Release number of selected component: selinux-policy-3.13.1-225.11.fc25.noarch Additional info: reporter: libreport-2.8.0 hashmarkername: setroubleshoot kernel: 4.10.5-200.fc25.x86_64 type: libreport
Description of problem: Notification received just after bootiing up and login into GNOME. Version-Release number of selected component: selinux-policy-3.13.1-225.11.fc25.noarch Additional info: reporter: libreport-2.8.0 hashmarkername: setroubleshoot kernel: 4.10.8-200.fc25.x86_64 type: libreport
Description of problem: Boot the system Version-Release number of selected component: selinux-policy-3.13.1-225.11.fc25.noarch Additional info: reporter: libreport-2.8.0 hashmarkername: setroubleshoot kernel: 4.10.9-200.fc25.x86_64 type: libreport
Just in case it helps, 2F7661722F6C69622F67646D2F2331373034313538202864656C6574656429 is an hex encoding of the string: "/var/lib/gdm/#1704158" .
Given the similarity (execute AVC on a xdm_t temporary file in /var/lib/), I'd say this is a (near) duplicate of bug 1419302, where the exe involved is sddm-greeter. The AVC there is caused by a mmap (PROT_READ|PROT_EXECUTE) attempt on a temporary file, possibly some kind of a buffer for DRI/Mesa/nouveau. See bug 1419302 for more details.
This message is a reminder that Fedora 24 is nearing its end of life. Approximately 2 (two) weeks from now Fedora will stop maintaining and issuing updates for Fedora 24. It is Fedora's policy to close all bug reports from releases that are no longer maintained. At that time this bug will be closed as EOL if it remains open with a Fedora 'version' of '24'. Package Maintainer: If you wish for this bug to remain open because you plan to fix it in a currently maintained version, simply change the 'version' to a later Fedora version. Thank you for reporting this issue and we are sorry that we were not able to fix it before Fedora 24 is end of life. If you would still like to see this bug fixed and are able to reproduce it against a later version of Fedora, you are encouraged change the 'version' to a later Fedora version prior this bug is closed as described in the policy above. Although we aim to fix as many bugs as possible during every release's lifetime, sometimes those efforts are overtaken by events. Often a more recent Fedora release includes newer upstream software that fixes bugs or makes them obsolete.
Fedora 24 changed to end-of-life (EOL) status on 2017-08-08. Fedora 24 is no longer maintained, which means that it will not receive any further security or bug fix updates. As a result we are closing this bug. If you can reproduce this bug against a currently maintained version of Fedora please feel free to reopen this bug against that version. If you are unable to reopen this bug, please file a new report against the current release. If you experience problems, please add a comment to this bug. Thank you for reporting this bug and we are sorry it could not be fixed.