Description of problem: SELinux is preventing nm-dispatcher from using the 'sys_admin' capabilities. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that nm-dispatcher should have the sys_admin capability by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'nm-dispatcher' --raw | audit2allow -M my-nmdispatcher # semodule -X 300 -i my-nmdispatcher.pp Additional Information: Source Context system_u:system_r:NetworkManager_dispatcher_t:s0 Target Context system_u:system_r:NetworkManager_dispatcher_t:s0 Target Objects Unknown [ capability ] Source nm-dispatcher Source Path nm-dispatcher Port <Unknown> Host (removed) Source RPM Packages Target RPM Packages SELinux Policy RPM selinux-policy-targeted-38.17-1.fc38.noarch Local Policy RPM selinux-policy-targeted-38.17-1.fc38.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 6.3.8-200.fc38.x86_64 #1 SMP PREEMPT_DYNAMIC Thu Jun 15 02:15:40 UTC 2023 x86_64 Alert Count 20 First Seen 2023-06-27 20:31:38 CEST Last Seen 2023-06-28 11:18:14 CEST Local ID 65f11ef2-e975-4769-bb8a-00f42e148795 Raw Audit Messages type=AVC msg=audit(1687943894.608:2698977): avc: denied { sys_admin } for pid=2583223 comm="nm-dispatcher" capability=21 scontext=system_u:system_r:NetworkManager_dispatcher_t:s0 tcontext=system_u:system_r:NetworkManager_dispatcher_t:s0 tclass=capability permissive=0 Hash: nm-dispatcher,NetworkManager_dispatcher_t,NetworkManager_dispatcher_t,capability,sys_admin Version-Release number of selected component: selinux-policy-targeted-38.17-1.fc38.noarch Additional info: reporter: libreport-2.17.10 reason: SELinux is preventing nm-dispatcher from using the 'sys_admin' capabilities. package: selinux-policy-targeted-38.17-1.fc38.noarch component: selinux-policy hashmarkername: setroubleshoot type: libreport kernel: 6.3.8-200.fc38.x86_64 event_log: 2023-06-28-11:19:44> Looking for similar problems in bugzilla component: selinux-policy
Created attachment 1972985 [details] File: description
Created attachment 1972986 [details] File: os_info
Hi, Do you know at which moment this denial appears? As the capability is quite powerful, more information is needed. If you can reproduce it, please enable full auditing: 1) Open the /etc/audit/rules.d/audit.rules file in an editor. 2) Remove the following line if it exists: -a task,never 3) Add the following line to the end of the file: -w /etc/shadow -p w 4) Restart the audit daemon: # service auditd restart or reboot the system. 5) Re-run your scenario. 6) Collect AVC denials: # ausearch -i -m avc,user_avc,selinux_err,user_selinux_err -ts today
As no new information appeared during the past weeks, we are going to close this bug. If you need to pursue this matter further, feel free to reopen this bug and attach the needed information