Description of problem: This is a fresh rawhide fedora upgraded with the dnf plugin from a fresh f25 (nothing was installed nor updated) I was told in IRC the event is due to some socket activated daemon that is not targeted or that might have an mislabeled executable file SELinux is preventing systemd from 'create' accesses on the unix_stream_socket Unknown. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that systemd should be allowed create access on the Unknown unix_stream_socket by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'systemd' --raw | audit2allow -M my-systemd # semodule -X 300 -i my-systemd.pp Additional Information: Source Context system_u:system_r:init_t:s0 Target Context system_u:system_r:unconfined_service_t:s0 Target Objects Unknown [ unix_stream_socket ] Source systemd Source Path systemd Port <Unknown> Host (removed) Source RPM Packages Target RPM Packages Policy RPM selinux-policy-3.13.1-224.fc25.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 4.8.6-300.fc25.x86_64 #1 SMP Tue Nov 1 12:36:38 UTC 2016 x86_64 x86_64 Alert Count 3 First Seen 2017-06-05 19:06:44 CEST Last Seen 2017-06-05 19:06:45 CEST Local ID 7fa84088-9ef1-4f5e-9c8f-dbd45dd84a53 Raw Audit Messages type=AVC msg=audit(1496682405.212:255): avc: denied { create } for pid=1 comm="systemd" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:unconfined_service_t:s0 tclass=unix_stream_socket permissive=0 Hash: systemd,init_t,unconfined_service_t,unix_stream_socket,create Version-Release number of selected component: selinux-policy-3.13.1-224.fc25.noarch Additional info: component: selinux-policy reporter: libreport-2.9.1 hashmarkername: setroubleshoot kernel: 4.12.0-0.rc3.git0.2.fc27.x86_64 type: libreport Potential duplicate: bug 1379278
*** This bug has been marked as a duplicate of bug 1379278 ***
I am not sure whether is is sssd-secrets because sssd-secrets.socket is not enabled by default. Bruno, could you try to reproduce AVC one more time in permissive mode and then run following command: ps auxZ | grep unconfined_service_t
(In reply to Lukas Slebodnik from comment #2) «ps auxZ | grep unconfined_service_t» only matches the grep process itself once, both in enforcing mode and after booting in permissive mode. If it is any help, the audit log is filled with this in enforcing mode: type=AVC msg=audit(1496844720.526:6192): avc: denied { dac_read_search } for pid=30802 comm="abrt-action-not" capability=2 scontext=system_u:system_r:abrt_t:s0-s0:c0.c1023 tcontext=system_u:system_r:abrt_t:s0-s0:c0.c1023 tclass=capability permissive=0 type=AVC msg=audit(1496844720.526:6193): avc: denied { dac_read_search } for pid=30802 comm="abrt-action-not" capability=2 scontext=system_u:system_r:abrt_t:s0-s0:c0.c1023 tcontext=system_u:system_r:abrt_t:s0-s0:c0.c1023 tclass=capability permissive=0 type=AVC msg=audit(1496844720.526:6194): avc: denied { dac_read_search } for pid=30802 comm="abrt-action-not" capability=2 scontext=system_u:system_r:abrt_t:s0-s0:c0.c1023 tcontext=system_u:system_r:abrt_t:s0-s0:c0.c1023 tclass=capability permissive=0