Description of problem: It happens when steam update games SELinux is preventing wine-preloader from using the 'execheap' accesses on a process. ***** Plugin allow_execheap (53.1 confidence) suggests ******************** If you do not think wine-preloader should need to map heap memory that is both writable and executable. Then you need to report a bug. This is a potentially dangerous access. Do contact your security administrator and report this issue. ***** Plugin catchall_boolean (42.6 confidence) suggests ****************** If you want to allow selinuxuser to execheap Then you must tell SELinux about this by enabling the 'selinuxuser_execheap' boolean. Do setsebool -P selinuxuser_execheap 1 ***** Plugin catchall (5.76 confidence) suggests ************************** If you believe that wine-preloader should be allowed execheap access on processes labeled unconfined_t by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'wine-preloader' --raw | audit2allow -M my-winepreloader # semodule -X 300 -i my-winepreloader.pp Additional Information: Source Context unconfined_u:unconfined_r:unconfined_t:s0- s0:c0.c1023 Target Context unconfined_u:unconfined_r:unconfined_t:s0- s0:c0.c1023 Target Objects Unknown [ process ] Source wine-preloader Source Path wine-preloader Port <Unknown> Host (removed) Source RPM Packages Target RPM Packages SELinux Policy RPM selinux-policy-targeted-38.26-1.fc40.noarch Local Policy RPM selinux-policy-targeted-38.26-1.fc40.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Permissive Host Name (removed) Platform Linux (removed) 6.6.0-0.rc0.20230831gitb97d64c72259.2.fc40.x86_64 #1 SMP PREEMPT_DYNAMIC Thu Aug 31 14:02:40 UTC 2023 x86_64 Alert Count 2 First Seen 2023-09-01 04:08:02 +05 Last Seen 2023-09-01 04:17:28 +05 Local ID d367d8e9-5514-4f87-b2b9-ce50816b05cb Raw Audit Messages type=AVC msg=audit(1693523848.277:333): avc: denied { execheap } for pid=195033 comm="wine-preloader" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=process permissive=1 Hash: wine-preloader,unconfined_t,unconfined_t,process,execheap Version-Release number of selected component: selinux-policy-targeted-38.26-1.fc40.noarch Additional info: reporter: libreport-2.17.11 reason: SELinux is preventing wine-preloader from using the 'execheap' accesses on a process. package: selinux-policy-targeted-38.26-1.fc40.noarch component: selinux-policy hashmarkername: setroubleshoot type: libreport kernel: 6.6.0-0.rc0.20230831gitb97d64c72259.2.fc40.x86_64 comment: It happens when steam update games component: selinux-policy
Created attachment 1986481 [details] File: description
Created attachment 1986482 [details] File: os_info
Mikhail, What it the path of the executable? Would the following command help? chcon -t wine_exec_t /path/wine-preloader
[root@primary-ws]~# chcon -t wine_exec_t "/home/mikhail/.local/share/Steam/steamapps/common/Proton - Experimental/files/bin/wine-preloader" [root@primary-ws]~#
# locate wine-preloader /home/mikhail/.local/share/Steam/steamapps/common/Proton - Experimental/files/bin/wine-preloader /home/mikhail/.local/share/Steam/steamapps/common/Proton - Experimental/files/bin/wine-preloader.debug /home/mikhail/.local/share/Steam/steamapps/common/Proton 7.0/dist/bin/wine-preloader /home/mikhail/.local/share/Steam/steamapps/common/Proton 8.0/dist/bin/wine-preloader /home/mikhail/.local/share/Steam/steamapps/common/Proton 8.0/dist/bin/wine-preloader.debug /home/mikhail/.local/share/Steam/steamapps/common/Proton Hotfix/files/bin/wine-preloader
Did changing the file's SELinux type help?
(In reply to Zdenek Pytela from comment #6) > Did changing the file's SELinux type help? Unfortunately I see this again: # ausearch -m avc -ts recent ---- time->Mon Sep 4 16:43:09 2023 type=AVC msg=audit(1693827789.313:1834): avc: denied { execheap } for pid=203105 comm="wine-preloader" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=process permissive=1 ---- time->Mon Sep 4 16:43:17 2023 type=AVC msg=audit(1693827797.969:1837): avc: denied { execheap } for pid=203368 comm="wine-preloader" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=process permissive=1 Maybe because we lost SELinux label after Proton Experimental update?
I rechecked and sure that set type "wine_exec_t" in the target security context didn't helps even when Proton didn't updated. ❯ sudo chcon -vt wine_exec_t "$HOME/.local/share/Steam/steamapps/common/Proton - Experimental/files/bin/wine-preloader" changing security context of '/home/mikhail/.local/share/Steam/steamapps/common/Proton - Experimental/files/bin/wine-preloader'
*** This bug has been marked as a duplicate of bug 2247299 ***