Description of problem: This alert started happeniing as soon as the system was rebooted after setroubleshoot was installed. Installing setrouble shoot was the only change made to the system after the WS Bets 0214 was installed. This is on a bare metal system. SELinux is preventing gnome-shell from 'watch' accesses on the directory /var/lib/AccountsService/icons. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that gnome-shell should be allowed watch access on the icons directory by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'gnome-shell' --raw | audit2allow -M my-gnomeshell # semodule -X 300 -i my-gnomeshell.pp Additional Information: Source Context system_u:system_r:xdm_t:s0-s0:c0.c1023 Target Context system_u:object_r:accountsd_var_lib_t:s0 Target Objects /var/lib/AccountsService/icons [ dir ] Source gnome-shell Source Path gnome-shell Port <Unknown> Host (removed) Source RPM Packages Target RPM Packages accountsservice-0.6.55-6.fc34.x86_64 SELinux Policy RPM selinux-policy-targeted-3.14.7-20.fc34.noarch Local Policy RPM selinux-policy-targeted-3.14.7-20.fc34.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 5.11.0-0.rc7.149.fc34.x86_64 #1 SMP Mon Feb 8 16:23:47 UTC 2021 x86_64 x86_64 Alert Count 3 First Seen 2021-02-14 16:10:25 EST Last Seen 2021-02-14 16:10:33 EST Local ID 3bac62cb-d0f9-450d-9c51-5cf9cbaf8f1f Raw Audit Messages type=AVC msg=audit(1613337033.540:631): avc: denied { watch } for pid=1037 comm="gmain" path="/var/lib/AccountsService/icons" dev="sda2" ino=155654 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:accountsd_var_lib_t:s0 tclass=dir permissive=0 Hash: gnome-shell,xdm_t,accountsd_var_lib_t,dir,watch Version-Release number of selected component: selinux-policy-targeted-3.14.7-20.fc34.noarch Additional info: component: selinux-policy reporter: libreport-2.14.0 hashmarkername: setroubleshoot kernel: 5.11.0-0.rc7.149.fc34.x86_64 type: libreport Potential duplicate: bug 1928550
Similar problem has been detected: Starting session hashmarkername: setroubleshoot kernel: 5.11.0-156.fc34.x86_64 package: selinux-policy-targeted-3.14.7-23.fc34.noarch reason: SELinux is preventing gnome-shell from 'watch' accesses on the directory /var/lib/AccountsService/icons. type: libreport
Similar problem has been detected: Second reboot after install. I had been installing additional software, hashmarkername: setroubleshoot kernel: 5.11.1-300.fc34.x86_64 package: selinux-policy-targeted-3.14.7-23.fc34.noarch reason: SELinux is preventing gnome-shell from 'watch' accesses on the directory /var/lib/AccountsService/icons. type: libreport
Similar problem has been detected: I have setroubleshoot loaded and this shows up when the desktop first comes up on any restart. hashmarkername: setroubleshoot kernel: 5.11.2-300.fc34.x86_64 package: selinux-policy-targeted-3.14.7-24.fc34.noarch reason: SELinux is preventing gnome-shell from 'watch' accesses on the directory /var/lib/AccountsService/icons. type: libreport
*** Bug 1928550 has been marked as a duplicate of this bug. ***
Similar problem has been detected: Occurred straight after boot hashmarkername: setroubleshoot kernel: 5.11.3-300.fc34.x86_64 package: selinux-policy-targeted-3.14.7-22.fc34.noarch reason: SELinux is preventing gnome-shell from 'watch' accesses on the directory /var/lib/AccountsService/icons. type: libreport
Similar problem has been detected: Happened at boot hashmarkername: setroubleshoot kernel: 5.11.7-300.fc34.x86_64 package: selinux-policy-targeted-3.14.7-25.fc34.noarch reason: SELinux is preventing gnome-shell from 'watch' accesses on the directory /var/lib/AccountsService/icons. type: libreport
Similar problem has been detected: Happened after latest update, hashmarkername: setroubleshoot kernel: 5.11.8-300.fc34.x86_64 package: selinux-policy-targeted-3.14.7-26.fc34.noarch reason: SELinux is preventing gnome-shell from 'watch' accesses on the directory /var/lib/AccountsService/icons. type: libreport
I've submitted a Fedora PR to address the issue: https://github.com/fedora-selinux/selinux-policy/pull/658
Similar problem has been detected: SELinux notification after logging into GNOME. hashmarkername: setroubleshoot kernel: 5.11.7-300.fc34.x86_64 package: selinux-policy-targeted-3.14.7-25.fc34.noarch reason: SELinux is preventing gnome-shell from 'watch' accesses on the directório /var/lib/AccountsService/icons. type: libreport
FEDORA-2021-15b81d905c has been submitted as an update to Fedora 34. https://bodhi.fedoraproject.org/updates/FEDORA-2021-15b81d905c
Similar problem has been detected: After upgrading from F33 to F34 Beta. hashmarkername: setroubleshoot kernel: 5.11.9-300.fc34.x86_64 package: selinux-policy-targeted-3.14.7-27.fc34.noarch reason: SELinux is preventing gnome-shell from 'watch' accesses on the dossier /var/lib/AccountsService/icons. type: libreport
FEDORA-2021-15b81d905c has been pushed to the Fedora 34 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --advisory=FEDORA-2021-15b81d905c` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2021-15b81d905c See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
Similar problem has been detected: After upgrade from F33 to F34 Beta. Same problem with SELinux update https://bodhi.fedoraproject.org/updates/FEDORA-2021-15b81d905c . hashmarkername: setroubleshoot kernel: 5.11.9-300.fc34.x86_64 package: selinux-policy-targeted-3.14.7-27.fc34.noarch reason: SELinux is preventing gnome-shell from 'watch' accesses on the dossier /var/lib/AccountsService/icons. type: libreport
FEDORA-2021-15b81d905c has been pushed to the Fedora 34 stable repository. If problem still persists, please make note of it in this bug report.