Description of problem: I think I get this when Caja is generating thumbnails. SELinux is preventing gdk-pixbuf-thum from 'append' accesses on the unix_stream_socket unix_stream_socket. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that gdk-pixbuf-thum should be allowed append access on the unix_stream_socket unix_stream_socket by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'gdk-pixbuf-thum' --raw | audit2allow -M my-gdkpixbufthum # semodule -X 300 -i my-gdkpixbufthum.pp Additional Information: Source Context unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 Target Context system_u:system_r:init_t:s0 Target Objects unix_stream_socket [ unix_stream_socket ] Source gdk-pixbuf-thum Source Path gdk-pixbuf-thum Port <Unknown> Host (removed) Source RPM Packages Target RPM Packages SELinux Policy RPM selinux-policy-targeted-38.30-1.fc38.noarch Local Policy RPM selinux-policy-targeted-38.30-1.fc38.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name (removed) Platform Linux (removed) 6.5.10-200.fc38.x86_64 #1 SMP PREEMPT_DYNAMIC Thu Nov 2 19:59:55 UTC 2023 x86_64 Alert Count 1205 First Seen 2023-09-03 20:25:04 BST Last Seen 2023-12-01 21:33:40 GMT Local ID 2526417f-5014-4194-8db3-fb3499a890f1 Raw Audit Messages type=AVC msg=audit(1701466420.881:575): avc: denied { append } for pid=22070 comm="gdk-pixbuf-thum" path="socket:[25140]" dev="sockfs" ino=25140 scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=system_u:system_r:init_t:s0 tclass=unix_stream_socket permissive=0 Hash: gdk-pixbuf-thum,thumb_t,init_t,unix_stream_socket,append Version-Release number of selected component: selinux-policy-targeted-38.30-1.fc38.noarch Additional info: reporter: libreport-2.17.11 package: selinux-policy-targeted-38.30-1.fc38.noarch component: selinux-policy type: libreport comment: I think I get this when Caja is generating thumbnails. kernel: 6.6.2-101.fc38.x86_64 reason: SELinux is preventing gdk-pixbuf-thum from 'append' accesses on the unix_stream_socket unix_stream_socket. hashmarkername: setroubleshoot component: selinux-policy
Created attachment 2002710 [details] File: description
Created attachment 2002711 [details] File: os_info
Sam, Can you check if the following module is sufficient ? # cat local_thumb_init_socket.cil (allow thumb_t init_t (unix_stream_socket (append))) # semodule -i local_thumb_init_socket.cil
Yes that resolves it. I can now rm ~/.cache/thumbnails/, restart caja and I get no alerts while it draws the thumbnails.
Thank you, PR has already been created.
FEDORA-2023-aeccf7b447 has been submitted as an update to Fedora 38. https://bodhi.fedoraproject.org/updates/FEDORA-2023-aeccf7b447
FEDORA-2023-aeccf7b447 has been pushed to the Fedora 38 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2023-aeccf7b447` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2023-aeccf7b447 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2023-aeccf7b447 has been pushed to the Fedora 38 stable repository. If problem still persists, please make note of it in this bug report.