Description of problem: I upgraded from a Fedora 35 KDE Plasma installation to Fedora 36 using dnf system-upgrade. On the first boot in F36 as sddm was starting and logging in to Plasma 5.24.0 on Wayland, /usr/bin/maliit-keyboard segmentation faulted four times. coredumpctl was denied reading the maliit-keyboard core dumps repeatedly. These denials and crashes didn't happen in F35. SELinux is preventing coredumpctl from 'read' accesses on the file core.maliit-keyboard.989.17ab8a3e7cd446fb8b03145d79d85e92.1323.1645293192000000.zst. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that coredumpctl should be allowed read access on the core.maliit-keyboard.989.17ab8a3e7cd446fb8b03145d79d85e92.1323.1645293192000000.zst file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'coredumpctl' --raw | audit2allow -M my-coredumpctl # semodule -X 300 -i my-coredumpctl.pp Additional Information: Source Context system_u:system_r:abrt_t:s0-s0:c0.c1023 Target Context system_u:object_r:systemd_coredump_var_lib_t:s0 Target Objects core.maliit-keyboard.989.17ab8a3e7cd446fb8b03145d7 9d85e92.1323.1645293192000000.zst [ file ] Source coredumpctl Source Path coredumpctl Port <Unknown> Host (removed) Source RPM Packages Target RPM Packages SELinux Policy RPM selinux-policy-targeted-36.2-2.fc36.noarch Local Policy RPM selinux-policy-targeted-36.2-2.fc36.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 5.17.0-0.rc4.96.fc36.x86_64 #1 SMP PREEMPT Mon Feb 14 15:28:44 UTC 2022 x86_64 x86_64 Alert Count 6 First Seen 2022-02-19 12:53:16 EST Last Seen 2022-02-19 12:53:32 EST Local ID 30c9fd06-7cfb-4860-bf38-c0cf60166138 Raw Audit Messages type=AVC msg=audit(1645293212.952:416): avc: denied { read } for pid=2337 comm="coredumpctl" name="core.maliit-keyboard.989.17ab8a3e7cd446fb8b03145d79d85e92.1323.1645293192000000.zst" dev="dm-0" ino=3934283 scontext=system_u:system_r:abrt_t:s0-s0:c0.c1023 tcontext=system_u:object_r:systemd_coredump_var_lib_t:s0 tclass=file permissive=0 Hash: coredumpctl,abrt_t,systemd_coredump_var_lib_t,file,read Version-Release number of selected component: selinux-policy-targeted-36.2-2.fc36.noarch Additional info: component: selinux-policy reporter: libreport-2.16.0 hashmarkername: setroubleshoot kernel: 5.17.0-0.rc4.96.fc36.x86_64 type: libreport Potential duplicate: bug 2046295
This type of denial happened when abrt-server used coredumpctl to get the core dump from a crash of maliit-keyboard resulting in errors like abrt-server[1378]: Error: File './coredump' is not a coredump. Feb 19 12:53:32 abrt-server[1378]: Retrieving coredump with coredumpctl Feb 19 12:53:32 audit[2337]: AVC avc: denied { read } for pid=2337 comm="coredumpctl" name="core.maliit-keyboard.989.17ab8a3e7cd446fb8b03145d79d85e92.1323.1645293192000000.zst" dev="dm-0" ino=3934283 scontext=system_u:system_r:abrt_t:s0-s0:c0.c1023 tcontext=system_u:object_r:systemd_coredump_var_lib_t:s0 tclass=file permissive=0 Feb 19 12:53:32 audit[2337]: AVC avc: denied { read } for pid=2337 comm="coredumpctl" name="core.maliit-keyboard.989.17ab8a3e7cd446fb8b03145d79d85e92.1323.1645293192000000.zst" dev="dm-0" ino=3934283 scontext=system_u:system_r:abrt_t:s0-s0:c0.c1023 tcontext=system_u:object_r:systemd_coredump_var_lib_t:s0 tclass=file permissive=0 Feb 19 12:53:32 abrt-server[1378]: Error: File './coredump' is not a coredump Feb 19 12:53:32 abrt-server[1378]: eu-readelf: input file is empty Feb 19 12:53:32 plasmashell[1544]: qt.qpa.wayland: Wayland does not support QWindow::requestActivate() Feb 19 12:53:33 abrt-server[1378]: Error while running gdb: Feb 19 12:53:33 abrt-server[1378]: /usr/libexec/gdb: warning: Couldn't determine a path for the index cache directory. Feb 19 12:53:33 abrt-server[1378]: "/var/spool/abrt/ccpp-2022-02-19-12:53:13.701626-1323/./coredump" is not a core dump: file format not recognized Feb 19 12:53:33 abrt-server[1378]: Python Exception <class 'ValueError'>: invalid literal for int() with base 10: '' Feb 19 12:53:33 abrt-server[1378]: Error occurred in Python: invalid literal for int() with base 10: '' Feb 19 12:53:33 setroubleshoot[2312]: SELinux is preventing coredumpctl from read access on the file core.maliit-keyboard.989.17ab8a3e7cd446fb8b03145d79d85e92.1291.1645293189000000.zst. For complete SELinux messages run: sealert -l 30c9fd06-7cfb-4860-bf38-c0cf60166138 Feb 19 12:53:33 setroubleshoot[2312]: SELinux is preventing coredumpctl from read access on the file core.maliit-keyboard.989.17ab8a3e7cd446fb8b03145d79d85e92.1291.1645293189000000.zst. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that coredumpctl should be allowed read access on the core.maliit-keyboard.989.17ab8a3e7cd446fb8b03145d79d85e92.1291.1645293189000000.zst file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'coredumpctl' --raw | audit2allow -M my-coredumpctl # semodule -X 300 -i my-coredumpctl.pp Feb 19 12:53:33 setroubleshoot[2312]: AnalyzeThread.run(): Set alarm timeout to 10 Feb 19 12:53:33 setroubleshoot[2312]: AnalyzeThread.run(): Cancel pending alarm Feb 19 12:53:33 abrt-server[1378]: eu-unstrip: cannot read ELF core file: not a valid ELF file Feb 19 12:53:33 abrt-server[1378]: Can't open file 'core_backtrace' for reading: No such file or directory gnome-abrt doesn't have the core dump in the maliit-keyboard crash report as a result. When I tried to report the crash with gnome-abrt, the error Processing failed happened with the log --- Running report_uReport --- Error: File './coredump' is not a coredump ('report_uReport' exited with 1) These types of denials happened after crashes of sddm https://bugzilla.redhat.com/show_bug.cgi?id=2056308 , gutenprint53+usb https://bugzilla.redhat.com/show_bug.cgi?id=2055504 , plasmashell, xdg-desktop-portal-kde, and others with the same abrt errors and missing core dumps in gnome-abrt. The abrt server might not be able to accept reports for programs which produce core dumps because the core dumps are missing. Should the problem be assessed as a possible F36 beta blocker under the criterion "Bug hinders execution of required Beta test plans or dramatically reduces test coverage"? https://fedoraproject.org/wiki/Fedora_36_Beta_Release_Criteria
Our automatic OS regression tracker [1] has not seen this any more in the last three weeks. So it seems this got fixed? [1] https://github.com/cockpit-project/bots/issues/2988
(In reply to Martin Pitt from comment #2) > Our automatic OS regression tracker [1] has not seen this any more in the > last three weeks. So it seems this got fixed? > > [1] https://github.com/cockpit-project/bots/issues/2988 I don't see any related change in policy. It keeps being required to turn this boolean on to allow abrt execute various handlers: # setsebool -P abrt_handle_event on There is nothing to be done in selinux-policy.
I think this type of coredumpctl denial was fixed by abrt-2.15.1-1.fc36 as described in https://bugzilla.redhat.com/show_bug.cgi?id=2052872