Fedora Account System
Red Hat Associate
Red Hat Customer
Description of problem: ❯ ps -AT o pid,tid,exe:1000,comm:1000,command:1000 |grep -i wine 39947 39947 /home/mikhail/.local/share/Steam/steamapps/common/Proton - Experimental/files/bin/wine64-preloader steam.exe c:\windows\system32\steam.exe /home/mikhail/.local/share/Steam/legacycompat/iscriptevaluator.exe legacycompat\evaluatorscript_1172470.vdf 39949 39949 /home/mikhail/.local/share/Steam/steamapps/common/Proton - Experimental/files/bin/wineserver wineserver /home/mikhail/.local/share/Steam/steamapps/common/Proton - Experimental/files/bin/wineserver 39953 39953 /home/mikhail/.local/share/Steam/steamapps/common/Proton - Experimental/files/bin/wine64-preloader services.exe C:\windows\system32\services.exe 39953 39954 /home/mikhail/.local/share/Steam/steamapps/common/Proton - Experimental/files/bin/wine64-preloader wine_rpcrt4_ser C:\windows\system32\services.exe 39953 39957 /home/mikhail/.local/share/Steam/steamapps/common/Proton - Experimental/files/bin/wine64-preloader wine_rpcrt4_io C:\windows\system32\services.exe 39953 39961 /home/mikhail/.local/share/Steam/steamapps/common/Proton - Experimental/files/bin/wine64-preloader wine_rpcrt4_io C:\windows\system32\services.exe 39953 39967 /home/mikhail/.local/share/Steam/steamapps/common/Proton - Experimental/files/bin/wine64-preloader wine_rpcrt4_io C:\windows\system32\services.exe 39953 39970 /home/mikhail/.local/share/Steam/steamapps/common/Proton - Experimental/files/bin/wine64-preloader wine_rpcrt4_io C:\windows\system32\services.exe 39953 39985 /home/mikhail/.local/share/Steam/steamapps/common/Proton - Experimental/files/bin/wine64-preloader wine_rpcrt4_io C:\windows\system32\services.exe 39953 39991 /home/mikhail/.local/share/Steam/steamapps/common/Proton - Experimental/files/bin/wine64-preloader wine_rpcrt4_io C:\windows\system32\services.exe 39953 39996 /home/mikhail/.local/share/Steam/steamapps/common/Proton - Experimental/files/bin/wine64-preloader services.exe C:\windows\system32\services.exe 39953 40009 /home/mikhail/.local/share/Steam/steamapps/common/Proton - Experimental/files/bin/wine64-preloader wine_rpcrt4_io C:\windows\system32\services.exe 39956 39956 /home/mikhail/.local/share/Steam/steamapps/common/Proton - Experimental/files/bin/wine64-preloader winedevice.exe C:\windows\system32\winedevice.exe 39956 39959 /home/mikhail/.local/share/Steam/steamapps/common/Proton - Experimental/files/bin/wine64-preloader winedevice.exe C:\windows\system32\winedevice.exe 39956 39960 /home/mikhail/.local/share/Steam/steamapps/common/Proton - Experimental/files/bin/wine64-preloader wine_sechost_se C:\windows\system32\winedevice.exe 39956 39962 /home/mikhail/.local/share/Steam/steamapps/common/Proton - Experimental/files/bin/wine64-preloader winedevice.exe C:\windows\system32\winedevice.exe 39956 39963 /home/mikhail/.local/share/Steam/steamapps/common/Proton - Experimental/files/bin/wine64-preloader winedevice.exe C:\windows\system32\winedevice.exe 39956 39964 /home/mikhail/.local/share/Steam/steamapps/common/Proton - Experimental/files/bin/wine64-preloader winedevice.exe C:\windows\system32\winedevice.exe 39956 39994 /home/mikhail/.local/share/Steam/steamapps/common/Proton - Experimental/files/bin/wine64-preloader winedevice.exe C:\windows\system32\winedevice.exe 39956 39995 /home/mikhail/.local/share/Steam/steamapps/common/Proton - Experimental/files/bin/wine64-preloader winedevice.exe C:\windows\system32\winedevice.exe 39966 39966 /home/mikhail/.local/share/Steam/steamapps/common/Proton - Experimental/files/bin/wine64-preloader winedevice.exe C:\windows\system32\winedevice.exe 39966 39968 /home/mikhail/.local/share/Steam/steamapps/common/Proton - Experimental/files/bin/wine64-preloader winedevice.exe C:\windows\system32\winedevice.exe 39966 39969 /home/mikhail/.local/share/Steam/steamapps/common/Proton - Experimental/files/bin/wine64-preloader wine_sechost_se C:\windows\system32\winedevice.exe 39966 39971 /home/mikhail/.local/share/Steam/steamapps/common/Proton - Experimental/files/bin/wine64-preloader winedevice.exe C:\windows\system32\winedevice.exe 39966 39972 /home/mikhail/.local/share/Steam/steamapps/common/Proton - Experimental/files/bin/wine64-preloader libusb_event C:\windows\system32\winedevice.exe 39966 39973 /home/mikhail/.local/share/Steam/steamapps/common/Proton - Experimental/files/bin/wine64-preloader winedevice.exe C:\windows\system32\winedevice.exe 39966 39974 /home/mikhail/.local/share/Steam/steamapps/common/Proton - Experimental/files/bin/wine64-preloader winedevice.exe C:\windows\system32\winedevice.exe 39966 39975 /home/mikhail/.local/share/Steam/steamapps/common/Proton - Experimental/files/bin/wine64-preloader winedevice.exe C:\windows\system32\winedevice.exe 39966 39977 /home/mikhail/.local/share/Steam/steamapps/common/Proton - Experimental/files/bin/wine64-preloader winedevice.exe C:\windows\system32\winedevice.exe 39966 39983 /home/mikhail/.local/share/Steam/steamapps/common/Proton - Experimental/files/bin/wine64-preloader winedevice.exe C:\windows\system32\winedevice.exe 39966 39984 /home/mikhail/.local/share/Steam/steamapps/common/Proton - Experimental/files/bin/wine64-preloader winedevice.exe C:\windows\system32\winedevice.exe 39982 39982 /home/mikhail/.local/share/Steam/steamapps/common/Proton - Experimental/files/bin/wine64-preloader plugplay.exe C:\windows\system32\plugplay.exe 39982 39986 /home/mikhail/.local/share/Steam/steamapps/common/Proton - Experimental/files/bin/wine64-preloader plugplay.exe C:\windows\system32\plugplay.exe 39982 39987 /home/mikhail/.local/share/Steam/steamapps/common/Proton - Experimental/files/bin/wine64-preloader wine_sechost_se C:\windows\system32\plugplay.exe 39982 39988 /home/mikhail/.local/share/Steam/steamapps/common/Proton - Experimental/files/bin/wine64-preloader wine_rpcrt4_ser C:\windows\system32\plugplay.exe 39990 39990 /home/mikhail/.local/share/Steam/steamapps/common/Proton - Experimental/files/bin/wine64-preloader svchost.exe C:\windows\system32\svchost.exe -k LocalServiceNetworkRestricted 39990 39992 /home/mikhail/.local/share/Steam/steamapps/common/Proton - Experimental/files/bin/wine64-preloader svchost.exe C:\windows\system32\svchost.exe -k LocalServiceNetworkRestricted 39990 39993 /home/mikhail/.local/share/Steam/steamapps/common/Proton - Experimental/files/bin/wine64-preloader wine_sechost_se C:\windows\system32\svchost.exe -k LocalServiceNetworkRestricted 39998 39998 /home/mikhail/.local/share/Steam/steamapps/common/Proton - Experimental/files/bin/wine64-preloader conhost.exe C:\windows\system32\conhost.exe --unix --width 238 --height 53 --server 0x10 40000 40000 /home/mikhail/.local/share/Steam/steamapps/common/Proton - Experimental/files/bin/wine64-preloader explorer.exe C:\windows\system32\explorer.exe /desktop 40000 40004 /home/mikhail/.local/share/Steam/steamapps/common/Proton - Experimental/files/bin/wine64-preloader explorer.exe C:\windows\system32\explorer.exe /desktop 40000 40005 /home/mikhail/.local/share/Steam/steamapps/common/Proton - Experimental/files/bin/wine64-preloader wine_rpcrt4_ser C:\windows\system32\explorer.exe /desktop 40008 40008 /home/mikhail/.local/share/Steam/steamapps/common/Proton - Experimental/files/bin/wine64-preloader rpcss.exe C:\windows\system32\rpcss.exe 40008 40011 /home/mikhail/.local/share/Steam/steamapps/common/Proton - Experimental/files/bin/wine64-preloader rpcss.exe C:\windows\system32\rpcss.exe 40008 40012 /home/mikhail/.local/share/Steam/steamapps/common/Proton - Experimental/files/bin/wine64-preloader wine_sechost_se C:\windows\system32\rpcss.exe 40008 40013 /home/mikhail/.local/share/Steam/steamapps/common/Proton - Experimental/files/bin/wine64-preloader wine_rpcrt4_ser C:\windows\system32\rpcss.exe 40008 40014 /home/mikhail/.local/share/Steam/steamapps/common/Proton - Experimental/files/bin/wine64-preloader wine_rpcrt4_ser C:\windows\system32\rpcss.exe 40008 40015 /home/mikhail/.local/share/Steam/steamapps/common/Proton - Experimental/files/bin/wine64-preloader wine_rpcrt4_io C:\windows\system32\rpcss.exe 40018 40018 /home/mikhail/.local/share/Steam/steamapps/common/Proton - Experimental/files/bin/wine64-preloader tabtip.exe C:\windows\system32\tabtip.exe 40018 40022 /home/mikhail/.local/share/Steam/steamapps/common/Proton - Experimental/files/bin/wine64-preloader wine_rpcrt4_ser C:\windows\system32\tabtip.exe 40018 40023 /home/mikhail/.local/share/Steam/steamapps/common/Proton - Experimental/files/bin/wine64-preloader tabtip.exe C:\windows\system32\tabtip.exe 40018 40027 /home/mikhail/.local/share/Steam/steamapps/common/Proton - Experimental/files/bin/wine64-preloader tabtip.exe C:\windows\system32\tabtip.exe 40025 40025 /home/mikhail/.local/share/Steam/steamapps/common/Proton - Experimental/files/bin/wine-preloader iscriptevaluato Z:\home\mikhail\.local\share\Steam\legacycompat\iscriptevaluator.exe legacycompat\evaluatorscript_1172470.vdf 40030 40030 /home/mikhail/.local/share/Steam/steamapps/common/Proton - Experimental/files/bin/wine-preloader SteamService.ex legacycompat\SteamService.exe /installscript Z:\home\mikhail\.local\share\Steam\steamapps\common\Apex Legends\runasadmin.vdf 1172470 40032 40032 /home/mikhail/.local/share/Steam/steamapps/common/Proton - Experimental/files/bin/wine64-preloader conhost.exe C:\windows\system32\conhost.exe --server 0x34 40409 40409 /home/mikhail/.local/share/Steam/steamapps/common/Proton - Experimental/files/bin/wine-preloader DXSETUP.exe Z:\home\mikhail\.local\share\Steam\steamapps\common\Steamworks Shared\_CommonRedist\DirectX\Jun2010\DXSETUP.exe /silent 40412 40412 /usr/bin/grep grep grep --color=auto --exclude-dir=.bzr --exclude-dir=CVS --exclude-dir=.git --exclude-dir=.hg --exclude-dir=.svn --exclude-dir=.idea --exclude-dir=.tox -i wine SELinux is preventing wine-preloader from using the 'execheap' accesses on a process. ***** Plugin allow_execheap (53.1 confidence) suggests ******************** If you do not think wine-preloader should need to map heap memory that is both writable and executable. Then you need to report a bug. This is a potentially dangerous access. Do contact your security administrator and report this issue. ***** Plugin catchall_boolean (42.6 confidence) suggests ****************** If you want to allow selinuxuser to execheap Then you must tell SELinux about this by enabling the 'selinuxuser_execheap' boolean. Do setsebool -P selinuxuser_execheap 1 ***** Plugin catchall (5.76 confidence) suggests ************************** If you believe that wine-preloader should be allowed execheap access on processes labeled unconfined_t by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'wine-preloader' --raw | audit2allow -M my-winepreloader # semodule -X 300 -i my-winepreloader.pp Additional Information: Source Context unconfined_u:unconfined_r:unconfined_t:s0- s0:c0.c1023 Target Context unconfined_u:unconfined_r:unconfined_t:s0- s0:c0.c1023 Target Objects Unknown [ process ] Source wine-preloader Source Path wine-preloader Port <Unknown> Host (removed) Source RPM Packages Target RPM Packages SELinux Policy RPM selinux-policy-targeted-40.4-1.fc40.noarch Local Policy RPM selinux-policy-targeted-40.4-1.fc40.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Permissive Host Name (removed) Platform Linux (removed) 6.6.0-61.fc40.x86_64+debug #1 SMP PREEMPT_DYNAMIC Mon Oct 30 11:40:06 UTC 2023 x86_64 Alert Count 110 First Seen 2023-10-16 03:08:29 +05 Last Seen 2023-10-31 23:43:51 +05 Local ID 12ea481c-80a4-4393-af0d-e9f7d9865461 Raw Audit Messages type=AVC msg=audit(1698777831.400:407): avc: denied { execheap } for pid=40331 comm="wine-preloader" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=process permissive=1 Hash: wine-preloader,unconfined_t,unconfined_t,process,execheap Version-Release number of selected component: selinux-policy-targeted-40.4-1.fc40.noarch Additional info: reporter: libreport-2.17.11 reason: SELinux is preventing wine-preloader from using the 'execheap' accesses on a process. package: selinux-policy-targeted-40.4-1.fc40.noarch component: selinux-policy hashmarkername: setroubleshoot type: libreport kernel: 6.6.0-61.fc40.x86_64+debug component: selinux-policy
Created attachment 1996410 [details] File: description
Created attachment 1996411 [details] File: os_info
❯ ls -laZ "/home/mikhail/.local/share/Steam/steamapps/common/Proton - Experimental/files/bin/wine64-preloader" -rwxr-xr-x. 1 mikhail mikhail unconfined_u:object_r:data_home_t:s0 18592 Aug 11 02:48 '/home/mikhail/.local/share/Steam/steamapps/common/Proton - Experimental/files/bin/wine64-preloader'
*** This bug has been marked as a duplicate of bug 2247299 ***
Same issue here. ``` SELinux is preventing wine-preloader from using the execheap access on a process. ***** Plugin allow_execheap (53.1 confidence) suggests ******************** SELinux is preventing wine-preloader from using the execheap access on a process. ***** Plugin allow_execheap (53.1 confidence) suggests ******************** If you do not think wine-preloader should need to map heap memory that is both writable and executable. Then you need to report a bug. This is a potentially dangerous access. Do contact your security administrator and report this issue. ***** Plugin catchall_boolean (42.6 confidence) suggests ****************** If you want to allow unconfined executables to make their heap memory executable. Doing this is a really bad idea. Probably indicates a badly coded executable, but could indicate an attack. This executable should be reported in bugzilla Then you must tell SELinux about this by enabling the 'selinuxuser_execheap' boolean. Do setsebool -P selinuxuser_execheap 1 ***** Plugin catchall (5.76 confidence) suggests ************************** If you believe that wine-preloader should be allowed execheap access on processes labeled unconfined_t by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'wine-preloader' --raw | audit2allow -M my-winepreloader # semodule -X 300 -i my-winepreloader.pp Additional Information: Source Context unconfined_u:unconfined_r:unconfined_t:s0- s0:c0.c1023 Target Context unconfined_u:unconfined_r:unconfined_t:s0- s0:c0.c1023 Target Objects Unknown [ process ] Source wine-preloader Source Path wine-preloader Port <Unknown> Host localhost Source RPM PSELinux is preventing wine-preloader from using the execheap access on a process. ***** Plugin allow_execheap (53.1 confidence) suggests ******************** If you do not think wine-preloader should need to map heap memory that is both writable and executable. Then you need to report a bug. This is a potentially dangerous access. Do contact your security administrator and report this issue. ***** Plugin catchall_boolean (42.6 confidence) suggests ****************** If you want to allow unconfined executables to make their heap memory executable. Doing this is a really bad idea. Probably indicates a badly coded executable, but could indicate an attack. This executable should be reported in bugzilla Then you must tell SELinux about this by enabling the 'selinuxuser_execheap' boolean. Do setsebool -P selinuxuser_execheap 1 ***** Plugin catchall (5.76 confidence) suggests ************************** If you believe that wine-preloader should be allowed execheap access on processes labeled unconfined_t by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'wine-preloader' --raw | audit2allow -M my-winepreloader # semodule -X 300 -i my-winepreloader.pp Additional Information: Source Context unconfined_u:unconfined_r:unconfined_t:s0- s0:c0.c1023 Target Context unconfined_u:unconfined_r:unconfined_t:s0- s0:c0.c1023 Target Objects Unknown [ process ] Source wine-preloader Source Path wine-preloader Port <Unknown> Host localhost Source RPM Packages Target RPM Packages SELinux Policy RPM selinux-policy-targeted-40.24-1.fc40.noarch Local Policy RPM selinux-policy-targeted-40.24-1.fc40.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name localhost Platform Linux localhost 6.9.10-200.fc40.x86_64 #1 SMP PREEMPT_DYNAMIC Thu Jul 18 21:39:30 UTC 2024 x86_64 Alert Count 1712 First Seen 2024-06-28 00:07:55 CEST Last Seen 2024-07-26 19:04:03 CEST Local ID d3e577ff-f396-466e-a576-8f1ff4500aa7 Raw Audit Messages type=AVC msg=audit(1722013443.587:1297): avc: denied { execheap } for pid=9183 comm="electron-mail" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=process permissive=0 Hash: wine-preloader,unconfined_t,unconfined_t,process,execheapackages Target RPM Packages SELinux Policy RPM selinux-policy-targeted-40.24-1.fc40.noarch Local Policy RPM selinux-policy-targeted-40.24-1.fc40.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name localhost Platform Linux localhost 6.9.10-200.fc40.x86_64 #1 SMP PREEMPT_DYNAMIC Thu Jul 18 21:39:30 UTC 2024 x86_64 Alert Count 1712 First Seen 2024-06-28 00:07:55 CEST Last Seen 2024-07-26 19:04:03 CEST Local ID d3e577ff-f396-466e-a576-8f1ff4500aa7 Raw Audit Messages type=AVC msg=audit(1722013443.587:1297): avc: denied { execheap } for pid=9183 comm="electron-mail" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=process permissive=0 Hash: wine-preloader,unconfined_t,unconfined_t,process,execheap If you do not think wine-preloader should need to map heap memory that is both writable and executable. Then you need to report a bug. This is a potentially dangerous access. Do contact your security administrator and report this issue. ***** Plugin catchall_boolean (42.6 confidence) suggests ****************** If you want to allow unconfined executables to make their heap memory executable. Doing this is a really bad idea. Probably indicates a badly coded executable, but could indicate an attack. This executable should be reported in bugzilla Then you must tell SELinux about this by enabling the 'selinuxuser_execheap' boolean. Do setsebool -P selinuxuser_execheap 1 ***** Plugin catchall (5.76 confidence) suggests ************************** If you believe that wine-preloader should be allowed execheap access on processes labeled unconfined_t by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'wine-preloader' --raw | audit2allow -M my-winepreloader # semodule -X 300 -i my-winepreloader.pp Additional Information: Source Context unconfined_u:unconfined_r:unconfined_t:s0- s0:c0.c1023 Target Context unconfined_u:unconfined_r:unconfined_t:s0- s0:c0.c1023 Target Objects Unknown [ process ] Source wine-preloader Source Path wine-preloader Port <Unknown> Host localhost Source RPM Packages Target RPM Packages SELinux Policy RPM selinux-policy-targeted-40.24-1.fc40.noarch Local Policy RPM selinux-policy-targeted-40.24-1.fc40.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name localhost Platform Linux localhost 6.9.10-200.fc40.x86_64 #1 SMP PREEMPT_DYNAMIC Thu Jul 18 21:39:30 UTC 2024 x86_64 Alert Count 1712 First Seen 2024-06-28 00:07:55 CEST Last Seen 2024-07-26 19:04:03 CEST Local ID d3e577ff-f396-466e-a576-8f1ff4500aa7 Raw Audit Messages type=AVC msg=audit(1722013443.587:1297): avc: denied { execheap } for pid=9183 comm="electron-mail" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=process permissive=0 Hash: wine-preloader,unconfined_t,unconfined_t,process,execheap ``` ``` user@localhost:~$ ls -laZ "/home/user/.local/share/Steam/steamapps/common/Proton - Experimental/files/bin/wine64-preloader" -rwxr-xr-x. 1 user user unconfined_u:object_r:data_home_t:s0 19152 jun 27 23:29 '/home/user/.local/share/Steam/steamapps/common/Proton - Experimental/files/bin/wine64-preloader' ```