Description of problem: Installed binary nvidia driver from RPMFusion SELinux is preventing gnome-shell from 'map' accesses on the chr_file /dev/nvidia0. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that gnome-shell should be allowed map access on the nvidia0 chr_file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'gnome-shell' --raw | audit2allow -M my-gnomeshell # semodule -X 300 -i my-gnomeshell.pp Additional Information: Source Context system_u:system_r:xdm_t:s0-s0:c0.c1023 Target Context system_u:object_r:xserver_misc_device_t:s0 Target Objects /dev/nvidia0 [ chr_file ] Source gnome-shell Source Path gnome-shell Port <Unknown> Host (removed) Source RPM Packages Target RPM Packages Policy RPM selinux-policy-3.13.1-283.5.fc27.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Permissive Host Name (removed) Platform Linux (removed) 4.13.5-300.fc27.x86_64 #1 SMP Thu Oct 5 16:57:11 UTC 2017 x86_64 x86_64 Alert Count 12 First Seen 2017-10-11 13:58:00 +0330 Last Seen 2017-10-11 14:01:00 +0330 Local ID af86913d-14e9-429a-8418-a0d31ded80eb Raw Audit Messages type=AVC msg=audit(1507717860.4:579): avc: denied { map } for pid=4880 comm="gnome-shell" path="/dev/nvidia0" dev="devtmpfs" ino=27667 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:xserver_misc_device_t:s0 tclass=chr_file permissive=1 Hash: gnome-shell,xdm_t,xserver_misc_device_t,chr_file,map Version-Release number of selected component: selinux-policy-3.13.1-283.5.fc27.noarch Additional info: component: selinux-policy reporter: libreport-2.9.2 hashmarkername: setroubleshoot kernel: 4.13.5-300.fc27.x86_64 type: libreport
# sesearch -A -s xdm_t -t xserver_misc_device_t -c chr_file -p map allow xdm_t xserver_misc_device_t:chr_file { append getattr ioctl lock map open read setattr write }; Fixed in the latest selinux-policy update.
Description of problem: Since updating to selinux-policy-3.13.1-283.35, gdm is unable to start under the proprietary NVidia driver. Version-Release number of selected component: selinux-policy-3.13.1-283.35.fc27.noarch Additional info: reporter: libreport-2.9.3 hashmarkername: setroubleshoot kernel: 4.17.3-100.fc27.x86_64 type: libreport
Description of problem: 1. Ran DNF of the following packages: selinux-policy noarch 3.13.1-283.35.fc27 selinux-policy-targeted noarch 3.13.1-283.35.fc27 2. Rebooted Version-Release number of selected component: selinux-policy-3.13.1-283.35.fc27.noarch Additional info: reporter: libreport-2.9.3 hashmarkername: setroubleshoot kernel: 4.17.3-100.fc27.x86_64 type: libreport