Bug 2265927 - SELinux is preventing /usr/bin/abrt-dump-journal-core from 'write' accesses on the sock_file /run/systemd/userdb/io.systemd.DynamicUser.
Summary: SELinux is preventing /usr/bin/abrt-dump-journal-core from 'write' accesses o...
Keywords:
Status: CLOSED RAWHIDE
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: rawhide
Hardware: x86_64
OS: Unspecified
medium
unspecified
Target Milestone: ---
Assignee: Zdenek Pytela
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: abrt_hash:a7ebe5d62b0552fb1babfb9e9dd...
: 2266786 2270670 2271212 2272026 2272383 2272813 2273673 2273781 2274669 2274709 2274839 2275170 2276138 2276295 2276297 2276595 2276682 2276837 2276871 2276991 2277039 2277311 2277355 2277456 2277584 2277602 2277768 2277861 (view as bug list)
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2024-02-25 18:48 UTC by Mikhail
Modified: 2024-05-02 12:10 UTC (History)
37 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2024-04-26 10:40:28 UTC
Type: ---
Embargoed:

Attachments (Terms of Use)
File: description (2.94 KB, text/plain)
2024-02-25 18:48 UTC, Mikhail 		no flags Details
File: os_info (770 bytes, text/plain)
2024-02-25 18:48 UTC, Mikhail 		no flags Details
coredumpctl screen (401.48 KB, image/png)
2024-02-26 13:22 UTC, Mikhail 		no flags Details
View All


Links
System ID Private Priority Status Summary Last Updated
Github fedora-selinux selinux-policy pull 2091 0 None open Allow abrt-dump-journal-core connect to systemd-userdbd over a unix s… 2024-04-24 17:08:08 UTC

Description Mikhail 2024-02-25 18:48:31 UTC 
Description of problem:
SELinux is preventing /usr/bin/abrt-dump-journal-core from 'write' accesses on the sock_file /run/systemd/userdb/io.systemd.DynamicUser.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that abrt-dump-journal-core should be allowed write access on the io.systemd.DynamicUser sock_file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'abrt-dump-journ' --raw | audit2allow -M my-abrtdumpjourn
# semodule -X 300 -i my-abrtdumpjourn.pp

Additional Information:
Source Context                system_u:system_r:abrt_dump_oops_t:s0
Target Context                system_u:object_r:systemd_userdbd_runtime_t:s0
Target Objects                /run/systemd/userdb/io.systemd.DynamicUser [
                              sock_file ]
Source                        abrt-dump-journ
Source Path                   /usr/bin/abrt-dump-journal-core
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           abrt-addon-ccpp-2.17.5-1.fc41.x86_64
Target RPM Packages           
SELinux Policy RPM            selinux-policy-targeted-40.13-1.fc40.noarch
Local Policy RPM              selinux-policy-targeted-40.13-1.fc40.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Permissive
Host Name                     (removed)
Platform                      Linux (removed) 6.8.0-
                              0.rc5.20240222git39133352cbed.44.fc41.x86_64+debug
                              #1 SMP PREEMPT_DYNAMIC Fri Feb 23 01:27:39 +05
                              2024 x86_64
Alert Count                   31
First Seen                    2024-02-25 16:49:41 +05
Last Seen                     2024-02-25 23:47:32 +05
Local ID                      ce3471ed-bc3a-4e62-b41d-384aa003c5ca

Raw Audit Messages
type=AVC msg=audit(1708886852.210:1498): avc:  denied  { write } for  pid=1503 comm="abrt-dump-journ" name="io.systemd.DynamicUser" dev="tmpfs" ino=42 scontext=system_u:system_r:abrt_dump_oops_t:s0 tcontext=system_u:object_r:systemd_userdbd_runtime_t:s0 tclass=sock_file permissive=1


type=SYSCALL msg=audit(1708886852.210:1498): arch=x86_64 syscall=connect success=yes exit=0 a0=37 a1=7fffd87b9910 a2=2d a3=559c798cb190 items=1 ppid=1 pid=1503 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=abrt-dump-journ exe=/usr/bin/abrt-dump-journal-core subj=system_u:system_r:abrt_dump_oops_t:s0 key=(null)

type=CWD msg=audit(1708886852.210:1498): cwd=/

type=PATH msg=audit(1708886852.210:1498): item=0 name=/run/systemd/userdb/io.systemd.DynamicUser inode=42 dev=00:1a mode=0140666 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:systemd_userdbd_runtime_t:s0 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0

Hash: abrt-dump-journ,abrt_dump_oops_t,systemd_userdbd_runtime_t,sock_file,write

Version-Release number of selected component:
selinux-policy-targeted-40.13-1.fc40.noarch

Additional info:
reporter:       libreport-2.17.15
reason:         SELinux is preventing /usr/bin/abrt-dump-journal-core from 'write' accesses on the sock_file /run/systemd/userdb/io.systemd.DynamicUser.
package:        selinux-policy-targeted-40.13-1.fc40.noarch
component:      selinux-policy
hashmarkername: setroubleshoot
type:           libreport
kernel:         6.8.0-0.rc5.20240222git39133352cbed.44.fc41.x86_64+debug
component:      selinux-policy
Comment 1 Mikhail 2024-02-25 18:48:33 UTC 
Created attachment 2018760 [details]
File: description
Comment 2 Mikhail 2024-02-25 18:48:34 UTC 
Created attachment 2018761 [details]
File: os_info
Comment 3 Mikhail 2024-02-25 18:49:56 UTC 
----
type=PROCTITLE msg=audit(02/25/2024 23:20:22.981:1366) : proctitle=/usr/bin/abrt-dump-journal-core -D -T -f -e 
type=PATH msg=audit(02/25/2024 23:20:22.981:1366) : item=0 name=/run/systemd/userdb/io.systemd.DynamicUser inode=42 dev=00:1a mode=socket,666 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:systemd_userdbd_runtime_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(02/25/2024 23:20:22.981:1366) : cwd=/ 
type=SOCKADDR msg=audit(02/25/2024 23:20:22.981:1366) : saddr={ saddr_fam=local path=/run/systemd/userdb/io.systemd.DynamicUser } 
type=SYSCALL msg=audit(02/25/2024 23:20:22.981:1366) : arch=x86_64 syscall=connect success=yes exit=0 a0=0x37 a1=0x7fffd87b9910 a2=0x2d a3=0x559c798cac50 items=1 ppid=1 pid=1503 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=abrt-dump-journ exe=/usr/bin/abrt-dump-journal-core subj=system_u:system_r:abrt_dump_oops_t:s0 key=(null) 
type=AVC msg=audit(02/25/2024 23:20:22.981:1366) : avc:  denied  { write } for  pid=1503 comm=abrt-dump-journ name=io.systemd.DynamicUser dev="tmpfs" ino=42 scontext=system_u:system_r:abrt_dump_oops_t:s0 tcontext=system_u:object_r:systemd_userdbd_runtime_t:s0 tclass=sock_file permissive=1 
----
type=PROCTITLE msg=audit(02/25/2024 23:20:22.981:1367) : proctitle=/usr/bin/abrt-dump-journal-core -D -T -f -e 
type=PATH msg=audit(02/25/2024 23:20:22.981:1367) : item=0 name=/run/systemd/userdb/io.systemd.DropIn inode=907 dev=00:1a mode=socket,666 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:systemd_userdbd_runtime_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(02/25/2024 23:20:22.981:1367) : cwd=/ 
type=SOCKADDR msg=audit(02/25/2024 23:20:22.981:1367) : saddr={ saddr_fam=local path=/run/systemd/userdb/io.systemd.DropIn } 
type=SYSCALL msg=audit(02/25/2024 23:20:22.981:1367) : arch=x86_64 syscall=connect success=yes exit=0 a0=0x3a a1=0x7fffd87b9910 a2=0x28 a3=0x559c798649e0 items=1 ppid=1 pid=1503 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=abrt-dump-journ exe=/usr/bin/abrt-dump-journal-core subj=system_u:system_r:abrt_dump_oops_t:s0 key=(null) 
type=AVC msg=audit(02/25/2024 23:20:22.981:1367) : avc:  denied  { connectto } for  pid=1503 comm=abrt-dump-journ path=/run/systemd/userdb/io.systemd.Multiplexer scontext=system_u:system_r:abrt_dump_oops_t:s0 tcontext=system_u:system_r:systemd_userdbd_t:s0 tclass=unix_stream_socket permissive=1 
----
type=PROCTITLE msg=audit(02/25/2024 23:20:22.981:1368) : proctitle=/usr/bin/abrt-dump-journal-core -D -T -f -e 
type=PATH msg=audit(02/25/2024 23:20:22.981:1368) : item=0 name=/run/systemd/userdb/io.systemd.Home inode=2190 dev=00:1a mode=socket,666 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:systemd_userdbd_runtime_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(02/25/2024 23:20:22.981:1368) : cwd=/ 
type=SOCKADDR msg=audit(02/25/2024 23:20:22.981:1368) : saddr={ saddr_fam=local path=/run/systemd/userdb/io.systemd.Home } 
type=SYSCALL msg=audit(02/25/2024 23:20:22.981:1368) : arch=x86_64 syscall=connect success=yes exit=0 a0=0x3b a1=0x7fffd87b9910 a2=0x26 a3=0x559c798bc0f0 items=1 ppid=1 pid=1503 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=abrt-dump-journ exe=/usr/bin/abrt-dump-journal-core subj=system_u:system_r:abrt_dump_oops_t:s0 key=(null) 
type=AVC msg=audit(02/25/2024 23:20:22.981:1368) : avc:  denied  { connectto } for  pid=1503 comm=abrt-dump-journ path=/run/systemd/userdb/io.systemd.Home scontext=system_u:system_r:abrt_dump_oops_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=unix_stream_socket permissive=1 
----
type=PROCTITLE msg=audit(02/25/2024 23:20:22.981:1369) : proctitle=/usr/bin/abrt-dump-journal-core -D -T -f -e 
type=PATH msg=audit(02/25/2024 23:20:22.981:1369) : item=0 name=/run/systemd/userdb/io.systemd.Machine inode=2196 dev=00:1a mode=socket,666 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:systemd_userdbd_runtime_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(02/25/2024 23:20:22.981:1369) : cwd=/ 
type=SOCKADDR msg=audit(02/25/2024 23:20:22.981:1369) : saddr={ saddr_fam=local path=/run/systemd/userdb/io.systemd.Machine } 
type=SYSCALL msg=audit(02/25/2024 23:20:22.981:1369) : arch=x86_64 syscall=connect success=yes exit=0 a0=0x3c a1=0x7fffd87b9910 a2=0x29 a3=0x559c798bc0f0 items=1 ppid=1 pid=1503 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=abrt-dump-journ exe=/usr/bin/abrt-dump-journal-core subj=system_u:system_r:abrt_dump_oops_t:s0 key=(null) 
type=AVC msg=audit(02/25/2024 23:20:22.981:1369) : avc:  denied  { connectto } for  pid=1503 comm=abrt-dump-journ path=/run/systemd/userdb/io.systemd.Machine scontext=system_u:system_r:abrt_dump_oops_t:s0 tcontext=system_u:system_r:systemd_machined_t:s0 tclass=unix_stream_socket permissive=1 
----
type=PROCTITLE msg=audit(02/25/2024 23:20:23.057:1370) : proctitle=/usr/libexec/abrt-handle-event -i --nice 10 -e post-create -- /var/spool/abrt/ccpp-2024-02-25-23:20:22.979628-149873 
type=PATH msg=audit(02/25/2024 23:20:23.057:1370) : item=1 name=/lib64/ld-linux-x86-64.so.2 inode=3676762 dev=00:20 mode=file,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:ld_so_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=PATH msg=audit(02/25/2024 23:20:23.057:1370) : item=0 name=/usr/libexec/abrt-handle-event inode=1792379 dev=00:20 mode=file,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:abrt_handle_event_exec_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(02/25/2024 23:20:23.057:1370) : cwd=/ 
type=EXECVE msg=audit(02/25/2024 23:20:23.057:1370) : argc=8 a0=/usr/libexec/abrt-handle-event a1=-i a2=--nice a3=10 a4=-e a5=post-create a6=-- a7=/var/spool/abrt/ccpp-2024-02-25-23:20:22.979628-149873 
type=BPRM_FCAPS msg=audit(02/25/2024 23:20:23.057:1370) : fver=0 fp=none fi=none fe=0 old_pp=chown,dac_override,dac_read_search,fowner,fsetid,kill,setgid,setuid,setpcap,linux_immutable,net_bind_service,net_broadcast,net_admin,net_raw,ipc_lock,ipc_owner,sys_chroot,sys_ptrace,sys_pacct,sys_admin,sys_boot,sys_nice,sys_resource,sys_tty_config,lease,audit_write,audit_control,setfcap,mac_override,mac_admin,block_suspend,audit_read,perfmon,bpf,checkpoint_restore old_pi=none old_pe=chown,dac_override,dac_read_search,fowner,fsetid,kill,setgid,setuid,setpcap,linux_immutable,net_bind_service,net_broadcast,net_admin,net_raw,ipc_lock,ipc_owner,sys_chroot,sys_ptrace,sys_pacct,sys_admin,sys_boot,sys_nice,sys_resource,sys_tty_config,lease,audit_write,audit_control,setfcap,mac_override,mac_admin,block_suspend,audit_read,perfmon,bpf,checkpoint_restore old_pa=none pp=chown,dac_override,dac_read_search,fowner,fsetid,kill,setgid,setuid,setpcap,linux_immutable,net_bind_service,net_broadcast,net_admin,net_raw,ipc_lock,ipc_owner,sys_chroot,sys_ptrace,sys_pacct,sys_admin,sys_boot,sys_nice,sys_resource,sys_tty_config,lease,audit_write,audit_control,setfcap,mac_override,mac_admin,block_suspend,audit_read,perfmon,bpf,checkpoint_restore pi=none pe=chown,dac_override,dac_read_search,fowner,fsetid,kill,setgid,setuid,setpcap,linux_immutable,net_bind_service,net_broadcast,net_admin,net_raw,ipc_lock,ipc_owner,sys_chroot,sys_ptrace,sys_pacct,sys_admin,sys_boot,sys_nice,sys_resource,sys_tty_config,lease,audit_write,audit_control,setfcap,mac_override,mac_admin,block_suspend,audit_read,perfmon,bpf,checkpoint_restore pa=none frootid=0 
type=SYSCALL msg=audit(02/25/2024 23:20:23.057:1370) : arch=x86_64 syscall=execve success=yes exit=0 a0=0x55e3d5af5080 a1=0x7ffcd4aaa280 a2=0x55e3d6537740 a3=0x0 items=2 ppid=150544 pid=150545 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=abrt-handle-eve exe=/usr/libexec/abrt-handle-event subj=system_u:system_r:abrt_handle_event_t:s0-s0:c0.c1023 key=(null) 
type=AVC msg=audit(02/25/2024 23:20:23.057:1370) : avc:  denied  { nnp_transition } for  pid=150545 comm=abrt-server scontext=system_u:system_r:abrt_t:s0-s0:c0.c1023 tcontext=system_u:system_r:abrt_handle_event_t:s0-s0:c0.c1023 tclass=process2 permissive=1 
----
type=PROCTITLE msg=audit(02/25/2024 23:46:52.229:1459) : proctitle=/usr/bin/abrt-dump-journal-core -D -T -f -e 
type=PATH msg=audit(02/25/2024 23:46:52.229:1459) : item=0 name=/run/systemd/userdb/io.systemd.DynamicUser inode=42 dev=00:1a mode=socket,666 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:systemd_userdbd_runtime_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(02/25/2024 23:46:52.229:1459) : cwd=/ 
type=SOCKADDR msg=audit(02/25/2024 23:46:52.229:1459) : saddr={ saddr_fam=local path=/run/systemd/userdb/io.systemd.DynamicUser } 
type=SYSCALL msg=audit(02/25/2024 23:46:52.229:1459) : arch=x86_64 syscall=connect success=yes exit=0 a0=0x37 a1=0x7fffd87b9910 a2=0x2d a3=0x559c798cb190 items=1 ppid=1 pid=1503 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=abrt-dump-journ exe=/usr/bin/abrt-dump-journal-core subj=system_u:system_r:abrt_dump_oops_t:s0 key=(null) 
type=AVC msg=audit(02/25/2024 23:46:52.229:1459) : avc:  denied  { write } for  pid=1503 comm=abrt-dump-journ name=io.systemd.DynamicUser dev="tmpfs" ino=42 scontext=system_u:system_r:abrt_dump_oops_t:s0 tcontext=system_u:object_r:systemd_userdbd_runtime_t:s0 tclass=sock_file permissive=1 
----
type=PROCTITLE msg=audit(02/25/2024 23:46:52.229:1460) : proctitle=/usr/bin/abrt-dump-journal-core -D -T -f -e 
type=PATH msg=audit(02/25/2024 23:46:52.229:1460) : item=0 name=/run/systemd/userdb/io.systemd.DropIn inode=907 dev=00:1a mode=socket,666 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:systemd_userdbd_runtime_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(02/25/2024 23:46:52.229:1460) : cwd=/ 
type=SOCKADDR msg=audit(02/25/2024 23:46:52.229:1460) : saddr={ saddr_fam=local path=/run/systemd/userdb/io.systemd.DropIn } 
type=SYSCALL msg=audit(02/25/2024 23:46:52.229:1460) : arch=x86_64 syscall=connect success=yes exit=0 a0=0x3a a1=0x7fffd87b9910 a2=0x28 a3=0x559c79844950 items=1 ppid=1 pid=1503 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=abrt-dump-journ exe=/usr/bin/abrt-dump-journal-core subj=system_u:system_r:abrt_dump_oops_t:s0 key=(null) 
type=AVC msg=audit(02/25/2024 23:46:52.229:1460) : avc:  denied  { connectto } for  pid=1503 comm=abrt-dump-journ path=/run/systemd/userdb/io.systemd.Multiplexer scontext=system_u:system_r:abrt_dump_oops_t:s0 tcontext=system_u:system_r:systemd_userdbd_t:s0 tclass=unix_stream_socket permissive=1 
----
type=PROCTITLE msg=audit(02/25/2024 23:46:52.230:1461) : proctitle=/usr/bin/abrt-dump-journal-core -D -T -f -e 
type=PATH msg=audit(02/25/2024 23:46:52.230:1461) : item=0 name=/run/systemd/userdb/io.systemd.Home inode=2190 dev=00:1a mode=socket,666 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:systemd_userdbd_runtime_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(02/25/2024 23:46:52.230:1461) : cwd=/ 
type=SOCKADDR msg=audit(02/25/2024 23:46:52.230:1461) : saddr={ saddr_fam=local path=/run/systemd/userdb/io.systemd.Home } 
type=SYSCALL msg=audit(02/25/2024 23:46:52.230:1461) : arch=x86_64 syscall=connect success=yes exit=0 a0=0x3b a1=0x7fffd87b9910 a2=0x26 a3=0x559c79844950 items=1 ppid=1 pid=1503 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=abrt-dump-journ exe=/usr/bin/abrt-dump-journal-core subj=system_u:system_r:abrt_dump_oops_t:s0 key=(null) 
type=AVC msg=audit(02/25/2024 23:46:52.230:1461) : avc:  denied  { connectto } for  pid=1503 comm=abrt-dump-journ path=/run/systemd/userdb/io.systemd.Home scontext=system_u:system_r:abrt_dump_oops_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=unix_stream_socket permissive=1 
----
type=PROCTITLE msg=audit(02/25/2024 23:46:52.230:1462) : proctitle=/usr/bin/abrt-dump-journal-core -D -T -f -e 
type=PATH msg=audit(02/25/2024 23:46:52.230:1462) : item=0 name=/run/systemd/userdb/io.systemd.Machine inode=2196 dev=00:1a mode=socket,666 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:systemd_userdbd_runtime_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(02/25/2024 23:46:52.230:1462) : cwd=/ 
type=SOCKADDR msg=audit(02/25/2024 23:46:52.230:1462) : saddr={ saddr_fam=local path=/run/systemd/userdb/io.systemd.Machine } 
type=SYSCALL msg=audit(02/25/2024 23:46:52.230:1462) : arch=x86_64 syscall=connect success=yes exit=0 a0=0x3c a1=0x7fffd87b9910 a2=0x29 a3=0x559c7987cc60 items=1 ppid=1 pid=1503 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=abrt-dump-journ exe=/usr/bin/abrt-dump-journal-core subj=system_u:system_r:abrt_dump_oops_t:s0 key=(null) 
type=AVC msg=audit(02/25/2024 23:46:52.230:1462) : avc:  denied  { connectto } for  pid=1503 comm=abrt-dump-journ path=/run/systemd/userdb/io.systemd.Machine scontext=system_u:system_r:abrt_dump_oops_t:s0 tcontext=system_u:system_r:systemd_machined_t:s0 tclass=unix_stream_socket permissive=1 
----
type=PROCTITLE msg=audit(02/25/2024 23:46:52.376:1463) : proctitle=/usr/libexec/abrt-handle-event -i --nice 10 -e post-create -- /var/spool/abrt/ccpp-2024-02-25-23:46:52.229212-155897 
type=PATH msg=audit(02/25/2024 23:46:52.376:1463) : item=1 name=/lib64/ld-linux-x86-64.so.2 inode=3676762 dev=00:20 mode=file,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:ld_so_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=PATH msg=audit(02/25/2024 23:46:52.376:1463) : item=0 name=/usr/libexec/abrt-handle-event inode=1792379 dev=00:20 mode=file,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:abrt_handle_event_exec_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(02/25/2024 23:46:52.376:1463) : cwd=/ 
type=EXECVE msg=audit(02/25/2024 23:46:52.376:1463) : argc=8 a0=/usr/libexec/abrt-handle-event a1=-i a2=--nice a3=10 a4=-e a5=post-create a6=-- a7=/var/spool/abrt/ccpp-2024-02-25-23:46:52.229212-155897 
type=BPRM_FCAPS msg=audit(02/25/2024 23:46:52.376:1463) : fver=0 fp=none fi=none fe=0 old_pp=chown,dac_override,dac_read_search,fowner,fsetid,kill,setgid,setuid,setpcap,linux_immutable,net_bind_service,net_broadcast,net_admin,net_raw,ipc_lock,ipc_owner,sys_chroot,sys_ptrace,sys_pacct,sys_admin,sys_boot,sys_nice,sys_resource,sys_tty_config,lease,audit_write,audit_control,setfcap,mac_override,mac_admin,block_suspend,audit_read,perfmon,bpf,checkpoint_restore old_pi=none old_pe=chown,dac_override,dac_read_search,fowner,fsetid,kill,setgid,setuid,setpcap,linux_immutable,net_bind_service,net_broadcast,net_admin,net_raw,ipc_lock,ipc_owner,sys_chroot,sys_ptrace,sys_pacct,sys_admin,sys_boot,sys_nice,sys_resource,sys_tty_config,lease,audit_write,audit_control,setfcap,mac_override,mac_admin,block_suspend,audit_read,perfmon,bpf,checkpoint_restore old_pa=none pp=chown,dac_override,dac_read_search,fowner,fsetid,kill,setgid,setuid,setpcap,linux_immutable,net_bind_service,net_broadcast,net_admin,net_raw,ipc_lock,ipc_owner,sys_chroot,sys_ptrace,sys_pacct,sys_admin,sys_boot,sys_nice,sys_resource,sys_tty_config,lease,audit_write,audit_control,setfcap,mac_override,mac_admin,block_suspend,audit_read,perfmon,bpf,checkpoint_restore pi=none pe=chown,dac_override,dac_read_search,fowner,fsetid,kill,setgid,setuid,setpcap,linux_immutable,net_bind_service,net_broadcast,net_admin,net_raw,ipc_lock,ipc_owner,sys_chroot,sys_ptrace,sys_pacct,sys_admin,sys_boot,sys_nice,sys_resource,sys_tty_config,lease,audit_write,audit_control,setfcap,mac_override,mac_admin,block_suspend,audit_read,perfmon,bpf,checkpoint_restore pa=none frootid=0 
type=SYSCALL msg=audit(02/25/2024 23:46:52.376:1463) : arch=x86_64 syscall=execve success=yes exit=0 a0=0x562a2232d080 a1=0x7ffd52006480 a2=0x562a22f3df00 a3=0x0 items=2 ppid=155945 pid=155946 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=abrt-handle-eve exe=/usr/libexec/abrt-handle-event subj=system_u:system_r:abrt_handle_event_t:s0-s0:c0.c1023 key=(null) 
type=AVC msg=audit(02/25/2024 23:46:52.376:1463) : avc:  denied  { nnp_transition } for  pid=155946 comm=abrt-server scontext=system_u:system_r:abrt_t:s0-s0:c0.c1023 tcontext=system_u:system_r:abrt_handle_event_t:s0-s0:c0.c1023 tclass=process2 permissive=1 
----
type=PROCTITLE msg=audit(02/25/2024 23:47:16.230:1481) : proctitle=/usr/bin/abrt-dump-journal-core -D -T -f -e 
type=PATH msg=audit(02/25/2024 23:47:16.230:1481) : item=0 name=/run/systemd/userdb/io.systemd.DynamicUser inode=42 dev=00:1a mode=socket,666 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:systemd_userdbd_runtime_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(02/25/2024 23:47:16.230:1481) : cwd=/ 
type=SOCKADDR msg=audit(02/25/2024 23:47:16.230:1481) : saddr={ saddr_fam=local path=/run/systemd/userdb/io.systemd.DynamicUser } 
type=SYSCALL msg=audit(02/25/2024 23:47:16.230:1481) : arch=x86_64 syscall=connect success=yes exit=0 a0=0x37 a1=0x7fffd87b9910 a2=0x2d a3=0x559c798cb190 items=1 ppid=1 pid=1503 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=abrt-dump-journ exe=/usr/bin/abrt-dump-journal-core subj=system_u:system_r:abrt_dump_oops_t:s0 key=(null) 
type=AVC msg=audit(02/25/2024 23:47:16.230:1481) : avc:  denied  { write } for  pid=1503 comm=abrt-dump-journ name=io.systemd.DynamicUser dev="tmpfs" ino=42 scontext=system_u:system_r:abrt_dump_oops_t:s0 tcontext=system_u:object_r:systemd_userdbd_runtime_t:s0 tclass=sock_file permissive=1 
----
type=PROCTITLE msg=audit(02/25/2024 23:47:16.230:1482) : proctitle=/usr/bin/abrt-dump-journal-core -D -T -f -e 
type=PATH msg=audit(02/25/2024 23:47:16.230:1482) : item=0 name=/run/systemd/userdb/io.systemd.DropIn inode=907 dev=00:1a mode=socket,666 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:systemd_userdbd_runtime_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(02/25/2024 23:47:16.230:1482) : cwd=/ 
type=SOCKADDR msg=audit(02/25/2024 23:47:16.230:1482) : saddr={ saddr_fam=local path=/run/systemd/userdb/io.systemd.DropIn } 
type=SYSCALL msg=audit(02/25/2024 23:47:16.230:1482) : arch=x86_64 syscall=connect success=yes exit=0 a0=0x3a a1=0x7fffd87b9910 a2=0x28 a3=0x559c79844950 items=1 ppid=1 pid=1503 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=abrt-dump-journ exe=/usr/bin/abrt-dump-journal-core subj=system_u:system_r:abrt_dump_oops_t:s0 key=(null) 
type=AVC msg=audit(02/25/2024 23:47:16.230:1482) : avc:  denied  { connectto } for  pid=1503 comm=abrt-dump-journ path=/run/systemd/userdb/io.systemd.Multiplexer scontext=system_u:system_r:abrt_dump_oops_t:s0 tcontext=system_u:system_r:systemd_userdbd_t:s0 tclass=unix_stream_socket permissive=1 
----
type=PROCTITLE msg=audit(02/25/2024 23:47:16.230:1483) : proctitle=/usr/bin/abrt-dump-journal-core -D -T -f -e 
type=PATH msg=audit(02/25/2024 23:47:16.230:1483) : item=0 name=/run/systemd/userdb/io.systemd.Home inode=2190 dev=00:1a mode=socket,666 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:systemd_userdbd_runtime_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(02/25/2024 23:47:16.230:1483) : cwd=/ 
type=SOCKADDR msg=audit(02/25/2024 23:47:16.230:1483) : saddr={ saddr_fam=local path=/run/systemd/userdb/io.systemd.Home } 
type=SYSCALL msg=audit(02/25/2024 23:47:16.230:1483) : arch=x86_64 syscall=connect success=yes exit=0 a0=0x3b a1=0x7fffd87b9910 a2=0x26 a3=0x559c798cac50 items=1 ppid=1 pid=1503 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=abrt-dump-journ exe=/usr/bin/abrt-dump-journal-core subj=system_u:system_r:abrt_dump_oops_t:s0 key=(null) 
type=AVC msg=audit(02/25/2024 23:47:16.230:1483) : avc:  denied  { connectto } for  pid=1503 comm=abrt-dump-journ path=/run/systemd/userdb/io.systemd.Home scontext=system_u:system_r:abrt_dump_oops_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=unix_stream_socket permissive=1 
----
type=PROCTITLE msg=audit(02/25/2024 23:47:16.231:1484) : proctitle=/usr/bin/abrt-dump-journal-core -D -T -f -e 
type=PATH msg=audit(02/25/2024 23:47:16.231:1484) : item=0 name=/run/systemd/userdb/io.systemd.Machine inode=2196 dev=00:1a mode=socket,666 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:systemd_userdbd_runtime_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(02/25/2024 23:47:16.231:1484) : cwd=/ 
type=SOCKADDR msg=audit(02/25/2024 23:47:16.231:1484) : saddr={ saddr_fam=local path=/run/systemd/userdb/io.systemd.Machine } 
type=SYSCALL msg=audit(02/25/2024 23:47:16.231:1484) : arch=x86_64 syscall=connect success=yes exit=0 a0=0x3c a1=0x7fffd87b9910 a2=0x29 a3=0x559c798cac50 items=1 ppid=1 pid=1503 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=abrt-dump-journ exe=/usr/bin/abrt-dump-journal-core subj=system_u:system_r:abrt_dump_oops_t:s0 key=(null) 
type=AVC msg=audit(02/25/2024 23:47:16.231:1484) : avc:  denied  { connectto } for  pid=1503 comm=abrt-dump-journ path=/run/systemd/userdb/io.systemd.Machine scontext=system_u:system_r:abrt_dump_oops_t:s0 tcontext=system_u:system_r:systemd_machined_t:s0 tclass=unix_stream_socket permissive=1 
----
type=PROCTITLE msg=audit(02/25/2024 23:47:16.380:1485) : proctitle=/usr/libexec/abrt-handle-event -i --nice 10 -e post-create -- /var/spool/abrt/ccpp-2024-02-25-23:47:16.229004-155987 
type=PATH msg=audit(02/25/2024 23:47:16.380:1485) : item=1 name=/lib64/ld-linux-x86-64.so.2 inode=3676762 dev=00:20 mode=file,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:ld_so_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=PATH msg=audit(02/25/2024 23:47:16.380:1485) : item=0 name=/usr/libexec/abrt-handle-event inode=1792379 dev=00:20 mode=file,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:abrt_handle_event_exec_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(02/25/2024 23:47:16.380:1485) : cwd=/ 
type=EXECVE msg=audit(02/25/2024 23:47:16.380:1485) : argc=8 a0=/usr/libexec/abrt-handle-event a1=-i a2=--nice a3=10 a4=-e a5=post-create a6=-- a7=/var/spool/abrt/ccpp-2024-02-25-23:47:16.229004-155987 
type=BPRM_FCAPS msg=audit(02/25/2024 23:47:16.380:1485) : fver=0 fp=none fi=none fe=0 old_pp=chown,dac_override,dac_read_search,fowner,fsetid,kill,setgid,setuid,setpcap,linux_immutable,net_bind_service,net_broadcast,net_admin,net_raw,ipc_lock,ipc_owner,sys_chroot,sys_ptrace,sys_pacct,sys_admin,sys_boot,sys_nice,sys_resource,sys_tty_config,lease,audit_write,audit_control,setfcap,mac_override,mac_admin,block_suspend,audit_read,perfmon,bpf,checkpoint_restore old_pi=none old_pe=chown,dac_override,dac_read_search,fowner,fsetid,kill,setgid,setuid,setpcap,linux_immutable,net_bind_service,net_broadcast,net_admin,net_raw,ipc_lock,ipc_owner,sys_chroot,sys_ptrace,sys_pacct,sys_admin,sys_boot,sys_nice,sys_resource,sys_tty_config,lease,audit_write,audit_control,setfcap,mac_override,mac_admin,block_suspend,audit_read,perfmon,bpf,checkpoint_restore old_pa=none pp=chown,dac_override,dac_read_search,fowner,fsetid,kill,setgid,setuid,setpcap,linux_immutable,net_bind_service,net_broadcast,net_admin,net_raw,ipc_lock,ipc_owner,sys_chroot,sys_ptrace,sys_pacct,sys_admin,sys_boot,sys_nice,sys_resource,sys_tty_config,lease,audit_write,audit_control,setfcap,mac_override,mac_admin,block_suspend,audit_read,perfmon,bpf,checkpoint_restore pi=none pe=chown,dac_override,dac_read_search,fowner,fsetid,kill,setgid,setuid,setpcap,linux_immutable,net_bind_service,net_broadcast,net_admin,net_raw,ipc_lock,ipc_owner,sys_chroot,sys_ptrace,sys_pacct,sys_admin,sys_boot,sys_nice,sys_resource,sys_tty_config,lease,audit_write,audit_control,setfcap,mac_override,mac_admin,block_suspend,audit_read,perfmon,bpf,checkpoint_restore pa=none frootid=0 
type=SYSCALL msg=audit(02/25/2024 23:47:16.380:1485) : arch=x86_64 syscall=execve success=yes exit=0 a0=0x558e57c6e080 a1=0x7ffec0193c90 a2=0x558e58dc9970 a3=0x0 items=2 ppid=156030 pid=156031 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=abrt-handle-eve exe=/usr/libexec/abrt-handle-event subj=system_u:system_r:abrt_handle_event_t:s0-s0:c0.c1023 key=(null) 
type=AVC msg=audit(02/25/2024 23:47:16.380:1485) : avc:  denied  { nnp_transition } for  pid=156031 comm=abrt-server scontext=system_u:system_r:abrt_t:s0-s0:c0.c1023 tcontext=system_u:system_r:abrt_handle_event_t:s0-s0:c0.c1023 tclass=process2 permissive=1 
----
type=PROCTITLE msg=audit(02/25/2024 23:47:32.210:1498) : proctitle=/usr/bin/abrt-dump-journal-core -D -T -f -e 
type=PATH msg=audit(02/25/2024 23:47:32.210:1498) : item=0 name=/run/systemd/userdb/io.systemd.DynamicUser inode=42 dev=00:1a mode=socket,666 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:systemd_userdbd_runtime_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(02/25/2024 23:47:32.210:1498) : cwd=/ 
type=SOCKADDR msg=audit(02/25/2024 23:47:32.210:1498) : saddr={ saddr_fam=local path=/run/systemd/userdb/io.systemd.DynamicUser } 
type=SYSCALL msg=audit(02/25/2024 23:47:32.210:1498) : arch=x86_64 syscall=connect success=yes exit=0 a0=0x37 a1=0x7fffd87b9910 a2=0x2d a3=0x559c798cb190 items=1 ppid=1 pid=1503 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=abrt-dump-journ exe=/usr/bin/abrt-dump-journal-core subj=system_u:system_r:abrt_dump_oops_t:s0 key=(null) 
type=AVC msg=audit(02/25/2024 23:47:32.210:1498) : avc:  denied  { write } for  pid=1503 comm=abrt-dump-journ name=io.systemd.DynamicUser dev="tmpfs" ino=42 scontext=system_u:system_r:abrt_dump_oops_t:s0 tcontext=system_u:object_r:systemd_userdbd_runtime_t:s0 tclass=sock_file permissive=1 
----
type=PROCTITLE msg=audit(02/25/2024 23:47:32.210:1499) : proctitle=/usr/bin/abrt-dump-journal-core -D -T -f -e 
type=PATH msg=audit(02/25/2024 23:47:32.210:1499) : item=0 name=/run/systemd/userdb/io.systemd.DropIn inode=907 dev=00:1a mode=socket,666 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:systemd_userdbd_runtime_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(02/25/2024 23:47:32.210:1499) : cwd=/ 
type=SOCKADDR msg=audit(02/25/2024 23:47:32.210:1499) : saddr={ saddr_fam=local path=/run/systemd/userdb/io.systemd.DropIn } 
type=SYSCALL msg=audit(02/25/2024 23:47:32.210:1499) : arch=x86_64 syscall=connect success=yes exit=0 a0=0x3a a1=0x7fffd87b9910 a2=0x28 a3=0x559c798cb190 items=1 ppid=1 pid=1503 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=abrt-dump-journ exe=/usr/bin/abrt-dump-journal-core subj=system_u:system_r:abrt_dump_oops_t:s0 key=(null) 
type=AVC msg=audit(02/25/2024 23:47:32.210:1499) : avc:  denied  { connectto } for  pid=1503 comm=abrt-dump-journ path=/run/systemd/userdb/io.systemd.Multiplexer scontext=system_u:system_r:abrt_dump_oops_t:s0 tcontext=system_u:system_r:systemd_userdbd_t:s0 tclass=unix_stream_socket permissive=1 
----
type=PROCTITLE msg=audit(02/25/2024 23:47:32.210:1500) : proctitle=/usr/bin/abrt-dump-journal-core -D -T -f -e 
type=PATH msg=audit(02/25/2024 23:47:32.210:1500) : item=0 name=/run/systemd/userdb/io.systemd.Home inode=2190 dev=00:1a mode=socket,666 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:systemd_userdbd_runtime_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(02/25/2024 23:47:32.210:1500) : cwd=/ 
type=SOCKADDR msg=audit(02/25/2024 23:47:32.210:1500) : saddr={ saddr_fam=local path=/run/systemd/userdb/io.systemd.Home } 
type=SYSCALL msg=audit(02/25/2024 23:47:32.210:1500) : arch=x86_64 syscall=connect success=yes exit=0 a0=0x3b a1=0x7fffd87b9910 a2=0x26 a3=0x559c79839a70 items=1 ppid=1 pid=1503 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=abrt-dump-journ exe=/usr/bin/abrt-dump-journal-core subj=system_u:system_r:abrt_dump_oops_t:s0 key=(null) 
type=AVC msg=audit(02/25/2024 23:47:32.210:1500) : avc:  denied  { connectto } for  pid=1503 comm=abrt-dump-journ path=/run/systemd/userdb/io.systemd.Home scontext=system_u:system_r:abrt_dump_oops_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=unix_stream_socket permissive=1 
----
type=PROCTITLE msg=audit(02/25/2024 23:47:32.355:1501) : proctitle=/usr/libexec/abrt-handle-event -i --nice 10 -e post-create -- /var/spool/abrt/ccpp-2024-02-25-23:47:32.209214-156111 
type=PATH msg=audit(02/25/2024 23:47:32.355:1501) : item=1 name=/lib64/ld-linux-x86-64.so.2 inode=3676762 dev=00:20 mode=file,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:ld_so_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=PATH msg=audit(02/25/2024 23:47:32.355:1501) : item=0 name=/usr/libexec/abrt-handle-event inode=1792379 dev=00:20 mode=file,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:abrt_handle_event_exec_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(02/25/2024 23:47:32.355:1501) : cwd=/ 
type=EXECVE msg=audit(02/25/2024 23:47:32.355:1501) : argc=8 a0=/usr/libexec/abrt-handle-event a1=-i a2=--nice a3=10 a4=-e a5=post-create a6=-- a7=/var/spool/abrt/ccpp-2024-02-25-23:47:32.209214-156111 
type=BPRM_FCAPS msg=audit(02/25/2024 23:47:32.355:1501) : fver=0 fp=none fi=none fe=0 old_pp=chown,dac_override,dac_read_search,fowner,fsetid,kill,setgid,setuid,setpcap,linux_immutable,net_bind_service,net_broadcast,net_admin,net_raw,ipc_lock,ipc_owner,sys_chroot,sys_ptrace,sys_pacct,sys_admin,sys_boot,sys_nice,sys_resource,sys_tty_config,lease,audit_write,audit_control,setfcap,mac_override,mac_admin,block_suspend,audit_read,perfmon,bpf,checkpoint_restore old_pi=none old_pe=chown,dac_override,dac_read_search,fowner,fsetid,kill,setgid,setuid,setpcap,linux_immutable,net_bind_service,net_broadcast,net_admin,net_raw,ipc_lock,ipc_owner,sys_chroot,sys_ptrace,sys_pacct,sys_admin,sys_boot,sys_nice,sys_resource,sys_tty_config,lease,audit_write,audit_control,setfcap,mac_override,mac_admin,block_suspend,audit_read,perfmon,bpf,checkpoint_restore old_pa=none pp=chown,dac_override,dac_read_search,fowner,fsetid,kill,setgid,setuid,setpcap,linux_immutable,net_bind_service,net_broadcast,net_admin,net_raw,ipc_lock,ipc_owner,sys_chroot,sys_ptrace,sys_pacct,sys_admin,sys_boot,sys_nice,sys_resource,sys_tty_config,lease,audit_write,audit_control,setfcap,mac_override,mac_admin,block_suspend,audit_read,perfmon,bpf,checkpoint_restore pi=none pe=chown,dac_override,dac_read_search,fowner,fsetid,kill,setgid,setuid,setpcap,linux_immutable,net_bind_service,net_broadcast,net_admin,net_raw,ipc_lock,ipc_owner,sys_chroot,sys_ptrace,sys_pacct,sys_admin,sys_boot,sys_nice,sys_resource,sys_tty_config,lease,audit_write,audit_control,setfcap,mac_override,mac_admin,block_suspend,audit_read,perfmon,bpf,checkpoint_restore pa=none frootid=0 
type=SYSCALL msg=audit(02/25/2024 23:47:32.355:1501) : arch=x86_64 syscall=execve success=yes exit=0 a0=0x55a3010d1080 a1=0x7ffeed0e0f40 a2=0x55a302622140 a3=0x0 items=2 ppid=156191 pid=156192 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=abrt-handle-eve exe=/usr/libexec/abrt-handle-event subj=system_u:system_r:abrt_handle_event_t:s0-s0:c0.c1023 key=(null) 
type=AVC msg=audit(02/25/2024 23:47:32.355:1501) : avc:  denied  { nnp_transition } for  pid=156192 comm=abrt-server scontext=system_u:system_r:abrt_t:s0-s0:c0.c1023 tcontext=system_u:system_r:abrt_handle_event_t:s0-s0:c0.c1023 tclass=process2 permissive=1
Comment 4 Zdenek Pytela 2024-02-26 11:51:57 UTC 
*** Bug 2265926 has been marked as a duplicate of this bug. ***
Comment 5 Zdenek Pytela 2024-02-26 13:11:44 UTC 
Mikhail,

Thank you for the detailed report. Still, can you disclose which application failed and if you have some customized abrt configuration?

This is to be added to the policy:
init_stream_connectto(abrt_dump_oops_t)
systemd_machined_stream_connect(abrt_dump_oops_t)
systemd_userdbd_stream_connect(abrt_dump_oops_t)
Comment 6 Mikhail 2024-02-26 13:22:50 UTC 
Created attachment 2018925 [details]
coredumpctl screen

> Thank you for the detailed report. Still, can you disclose which application failed and if you have some customized abrt configuration?

At sun 2024-02-25 23:20:22 crashed xdg-desktop-portal-gnome application and I don't have custom abrt configuration
Comment 7 Mikhail 2024-03-02 10:44:00 UTC 
# sudo ausearch -i -m avc,user_avc,selinux_err,user_selinux_err -ts today
----
type=PROCTITLE msg=audit(03/02/2024 15:40:17.043:220) : proctitle=/usr/bin/abrt-dump-journal-core -D -T -f -e 
type=PATH msg=audit(03/02/2024 15:40:17.043:220) : item=0 name=/run/systemd/userdb/io.systemd.DynamicUser inode=42 dev=00:1a mode=socket,666 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:systemd_userdbd_runtime_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(03/02/2024 15:40:17.043:220) : cwd=/ 
type=SOCKADDR msg=audit(03/02/2024 15:40:17.043:220) : saddr={ saddr_fam=local path=/run/systemd/userdb/io.systemd.DynamicUser } 
type=SYSCALL msg=audit(03/02/2024 15:40:17.043:220) : arch=x86_64 syscall=connect success=yes exit=0 a0=0x4f a1=0x7ffc23f033d0 a2=0x2d a3=0x55be4a4f8d20 items=1 ppid=1 pid=1517 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=abrt-dump-journ exe=/usr/bin/abrt-dump-journal-core subj=system_u:system_r:abrt_dump_oops_t:s0 key=(null) 
type=AVC msg=audit(03/02/2024 15:40:17.043:220) : avc:  denied  { write } for  pid=1517 comm=abrt-dump-journ name=io.systemd.DynamicUser dev="tmpfs" ino=42 scontext=system_u:system_r:abrt_dump_oops_t:s0 tcontext=system_u:object_r:systemd_userdbd_runtime_t:s0 tclass=sock_file permissive=1 
----
type=PROCTITLE msg=audit(03/02/2024 15:40:17.043:221) : proctitle=/usr/bin/abrt-dump-journal-core -D -T -f -e 
type=PATH msg=audit(03/02/2024 15:40:17.043:221) : item=0 name=/run/systemd/userdb/io.systemd.DropIn inode=913 dev=00:1a mode=socket,666 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:systemd_userdbd_runtime_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(03/02/2024 15:40:17.043:221) : cwd=/ 
type=SOCKADDR msg=audit(03/02/2024 15:40:17.043:221) : saddr={ saddr_fam=local path=/run/systemd/userdb/io.systemd.DropIn } 
type=SYSCALL msg=audit(03/02/2024 15:40:17.043:221) : arch=x86_64 syscall=connect success=yes exit=0 a0=0x52 a1=0x7ffc23f033d0 a2=0x28 a3=0x55be4a4f8e80 items=1 ppid=1 pid=1517 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=abrt-dump-journ exe=/usr/bin/abrt-dump-journal-core subj=system_u:system_r:abrt_dump_oops_t:s0 key=(null) 
type=AVC msg=audit(03/02/2024 15:40:17.043:221) : avc:  denied  { connectto } for  pid=1517 comm=abrt-dump-journ path=/run/systemd/userdb/io.systemd.Multiplexer scontext=system_u:system_r:abrt_dump_oops_t:s0 tcontext=system_u:system_r:systemd_userdbd_t:s0 tclass=unix_stream_socket permissive=1 
----
type=PROCTITLE msg=audit(03/02/2024 15:40:17.044:222) : proctitle=/usr/bin/abrt-dump-journal-core -D -T -f -e 
type=PATH msg=audit(03/02/2024 15:40:17.044:222) : item=0 name=/run/systemd/userdb/io.systemd.Machine inode=2197 dev=00:1a mode=socket,666 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:systemd_userdbd_runtime_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(03/02/2024 15:40:17.044:222) : cwd=/ 
type=SOCKADDR msg=audit(03/02/2024 15:40:17.044:222) : saddr={ saddr_fam=local path=/run/systemd/userdb/io.systemd.Machine } 
type=SYSCALL msg=audit(03/02/2024 15:40:17.044:222) : arch=x86_64 syscall=connect success=yes exit=0 a0=0x53 a1=0x7ffc23f033d0 a2=0x29 a3=0x55be4a4b7830 items=1 ppid=1 pid=1517 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=abrt-dump-journ exe=/usr/bin/abrt-dump-journal-core subj=system_u:system_r:abrt_dump_oops_t:s0 key=(null) 
type=AVC msg=audit(03/02/2024 15:40:17.044:222) : avc:  denied  { connectto } for  pid=1517 comm=abrt-dump-journ path=/run/systemd/userdb/io.systemd.Machine scontext=system_u:system_r:abrt_dump_oops_t:s0 tcontext=system_u:system_r:systemd_machined_t:s0 tclass=unix_stream_socket permissive=1 
----
type=PROCTITLE msg=audit(03/02/2024 15:40:17.044:223) : proctitle=/usr/bin/abrt-dump-journal-core -D -T -f -e 
type=PATH msg=audit(03/02/2024 15:40:17.044:223) : item=0 name=/run/systemd/userdb/io.systemd.Home inode=2203 dev=00:1a mode=socket,666 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:systemd_userdbd_runtime_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(03/02/2024 15:40:17.044:223) : cwd=/ 
type=SOCKADDR msg=audit(03/02/2024 15:40:17.044:223) : saddr={ saddr_fam=local path=/run/systemd/userdb/io.systemd.Home } 
type=SYSCALL msg=audit(03/02/2024 15:40:17.044:223) : arch=x86_64 syscall=connect success=yes exit=0 a0=0x54 a1=0x7ffc23f033d0 a2=0x26 a3=0x55be4a489780 items=1 ppid=1 pid=1517 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=abrt-dump-journ exe=/usr/bin/abrt-dump-journal-core subj=system_u:system_r:abrt_dump_oops_t:s0 key=(null) 
type=AVC msg=audit(03/02/2024 15:40:17.044:223) : avc:  denied  { connectto } for  pid=1517 comm=abrt-dump-journ path=/run/systemd/userdb/io.systemd.Home scontext=system_u:system_r:abrt_dump_oops_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=unix_stream_socket permissive=1 
----
type=PROCTITLE msg=audit(03/02/2024 15:40:17.188:228) : proctitle=/usr/libexec/abrt-handle-event -i --nice 10 -e post-create -- /var/spool/abrt/ccpp-2024-03-02-15:40:17.42634-5681 
type=PATH msg=audit(03/02/2024 15:40:17.188:228) : item=1 name=/lib64/ld-linux-x86-64.so.2 inode=6820658 dev=00:20 mode=file,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:ld_so_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=PATH msg=audit(03/02/2024 15:40:17.188:228) : item=0 name=/usr/libexec/abrt-handle-event inode=1792379 dev=00:20 mode=file,755 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:abrt_handle_event_exec_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 
type=CWD msg=audit(03/02/2024 15:40:17.188:228) : cwd=/ 
type=EXECVE msg=audit(03/02/2024 15:40:17.188:228) : argc=8 a0=/usr/libexec/abrt-handle-event a1=-i a2=--nice a3=10 a4=-e a5=post-create a6=-- a7=/var/spool/abrt/ccpp-2024-03-02-15:40:17.42634-5681 
type=BPRM_FCAPS msg=audit(03/02/2024 15:40:17.188:228) : fver=0 fp=none fi=none fe=0 old_pp=chown,dac_override,dac_read_search,fowner,fsetid,kill,setgid,setuid,setpcap,linux_immutable,net_bind_service,net_broadcast,net_admin,net_raw,ipc_lock,ipc_owner,sys_chroot,sys_ptrace,sys_pacct,sys_admin,sys_boot,sys_nice,sys_resource,sys_tty_config,lease,audit_write,audit_control,setfcap,mac_override,mac_admin,block_suspend,audit_read,perfmon,bpf,checkpoint_restore old_pi=none old_pe=chown,dac_override,dac_read_search,fowner,fsetid,kill,setgid,setuid,setpcap,linux_immutable,net_bind_service,net_broadcast,net_admin,net_raw,ipc_lock,ipc_owner,sys_chroot,sys_ptrace,sys_pacct,sys_admin,sys_boot,sys_nice,sys_resource,sys_tty_config,lease,audit_write,audit_control,setfcap,mac_override,mac_admin,block_suspend,audit_read,perfmon,bpf,checkpoint_restore old_pa=none pp=chown,dac_override,dac_read_search,fowner,fsetid,kill,setgid,setuid,setpcap,linux_immutable,net_bind_service,net_broadcast,net_admin,net_raw,ipc_lock,ipc_owner,sys_chroot,sys_ptrace,sys_pacct,sys_admin,sys_boot,sys_nice,sys_resource,sys_tty_config,lease,audit_write,audit_control,setfcap,mac_override,mac_admin,block_suspend,audit_read,perfmon,bpf,checkpoint_restore pi=none pe=chown,dac_override,dac_read_search,fowner,fsetid,kill,setgid,setuid,setpcap,linux_immutable,net_bind_service,net_broadcast,net_admin,net_raw,ipc_lock,ipc_owner,sys_chroot,sys_ptrace,sys_pacct,sys_admin,sys_boot,sys_nice,sys_resource,sys_tty_config,lease,audit_write,audit_control,setfcap,mac_override,mac_admin,block_suspend,audit_read,perfmon,bpf,checkpoint_restore pa=none frootid=0 
type=SYSCALL msg=audit(03/02/2024 15:40:17.188:228) : arch=x86_64 syscall=execve success=yes exit=0 a0=0x559382af1080 a1=0x7ffcbf4b1ca0 a2=0x55938320d0a0 a3=0x0 items=2 ppid=5762 pid=5774 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=abrt-handle-eve exe=/usr/libexec/abrt-handle-event subj=system_u:system_r:abrt_handle_event_t:s0-s0:c0.c1023 key=(null) 
type=AVC msg=audit(03/02/2024 15:40:17.188:228) : avc:  denied  { nnp_transition } for  pid=5774 comm=abrt-server scontext=system_u:system_r:abrt_t:s0-s0:c0.c1023 tcontext=system_u:system_r:abrt_handle_event_t:s0-s0:c0.c1023 tclass=process2 permissive=1 
root@primary-ws ~# 


> coredumpctl
Sat 2024-03-02 12:42:23 +05  318124 1000 1000 SIGTRAP present  /opt/brave.com/brave-nightly/brave                                   588.8M
Sat 2024-03-02 15:40:16 +05    5681 1000 1000 SIGSEGV present  /home/mikhail/.local/share/Steam/ubuntu12_64/gldriverquery             2.1M
lines 164-215/215 (END)
Comment 8 Zdenek Pytela 2024-03-21 11:35:45 UTC 
*** Bug 2270670 has been marked as a duplicate of this bug. ***
Comment 9 Zdenek Pytela 2024-04-05 19:23:40 UTC 
*** Bug 2272383 has been marked as a duplicate of this bug. ***
Comment 10 Zdenek Pytela 2024-04-05 19:23:53 UTC 
*** Bug 2272026 has been marked as a duplicate of this bug. ***
Comment 11 Zdenek Pytela 2024-04-05 19:24:19 UTC 
*** Bug 2271212 has been marked as a duplicate of this bug. ***
Comment 12 Zdenek Pytela 2024-04-05 19:24:37 UTC 
*** Bug 2272813 has been marked as a duplicate of this bug. ***
Comment 13 Zdenek Pytela 2024-04-05 19:24:52 UTC 
*** Bug 2266786 has been marked as a duplicate of this bug. ***
Comment 14 Zdenek Pytela 2024-04-05 19:28:02 UTC 
*** Bug 2273673 has been marked as a duplicate of this bug. ***
Comment 15 Zdenek Pytela 2024-04-08 10:26:57 UTC 
*** Bug 2273781 has been marked as a duplicate of this bug. ***
Comment 16 Zdenek Pytela 2024-04-12 10:19:54 UTC 
*** Bug 2274669 has been marked as a duplicate of this bug. ***
Comment 17 Zdenek Pytela 2024-04-15 06:01:10 UTC 
*** Bug 2274709 has been marked as a duplicate of this bug. ***
Comment 18 Zdenek Pytela 2024-04-15 06:03:09 UTC 
*** Bug 2274839 has been marked as a duplicate of this bug. ***
Comment 19 Milos Malik 2024-04-16 10:45:24 UTC 
*** Bug 2275170 has been marked as a duplicate of this bug. ***
Comment 20 Zdenek Pytela 2024-04-24 19:23:21 UTC 
*** Bug 2276871 has been marked as a duplicate of this bug. ***
Comment 21 Zdenek Pytela 2024-04-24 19:25:59 UTC 
*** Bug 2276595 has been marked as a duplicate of this bug. ***
Comment 22 Zdenek Pytela 2024-04-24 19:26:18 UTC 
*** Bug 2276682 has been marked as a duplicate of this bug. ***
Comment 23 Zdenek Pytela 2024-04-24 19:26:41 UTC 
*** Bug 2276297 has been marked as a duplicate of this bug. ***
Comment 24 Zdenek Pytela 2024-04-24 19:26:54 UTC 
*** Bug 2276295 has been marked as a duplicate of this bug. ***
Comment 25 Zdenek Pytela 2024-04-24 19:32:00 UTC 
*** Bug 2276138 has been marked as a duplicate of this bug. ***
Comment 26 Zdenek Pytela 2024-04-24 19:42:59 UTC 
*** Bug 2276837 has been marked as a duplicate of this bug. ***
Comment 27 Zdenek Pytela 2024-04-24 20:22:03 UTC 
*** Bug 2276991 has been marked as a duplicate of this bug. ***
Comment 28 Zdenek Pytela 2024-04-25 12:14:12 UTC 
*** Bug 2277039 has been marked as a duplicate of this bug. ***
Comment 29 Kamil Páral (Red Hat) 2024-04-26 10:48:47 UTC 
Can we please also get an F40 update? Thanks.
Comment 30 Zdenek Pytela 2024-04-26 15:16:46 UTC 
*** Bug 2277355 has been marked as a duplicate of this bug. ***
Comment 31 Zdenek Pytela 2024-04-26 15:19:54 UTC 
(In reply to Kamil Páral from comment #29)
> Can we please also get an F40 update? Thanks.

There already is.
https://bodhi.fedoraproject.org/updates/FEDORA-2024-57cdb8429c
Comment 32 Zdenek Pytela 2024-04-26 15:21:36 UTC 
*** Bug 2277311 has been marked as a duplicate of this bug. ***
Comment 33 Zdenek Pytela 2024-04-29 08:55:41 UTC 
*** Bug 2277602 has been marked as a duplicate of this bug. ***
Comment 34 Zdenek Pytela 2024-04-29 09:07:46 UTC 
*** Bug 2277584 has been marked as a duplicate of this bug. ***
Comment 35 Zdenek Pytela 2024-04-29 09:11:49 UTC 
*** Bug 2277456 has been marked as a duplicate of this bug. ***
Comment 36 Zdenek Pytela 2024-04-30 07:36:48 UTC 
*** Bug 2277861 has been marked as a duplicate of this bug. ***
Comment 37 Zdenek Pytela 2024-05-02 12:10:05 UTC 
*** Bug 2277768 has been marked as a duplicate of this bug. ***
Note You need to log in before you can comment on or make changes to this bug.