Bug 2279215 - speech-dispatcherd.service startup failure (AVC denied)
Summary: speech-dispatcherd.service startup failure (AVC denied)
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 42
Hardware: All
OS: Linux
unspecified
high
Target Milestone: ---
Assignee: Zdenek Pytela
QA Contact: Fedora Extras Quality Assurance
URL: https://github.com/fedora-selinux/sel...
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2024-05-06 02:00 UTC by gordonwwang
Modified: 2025-12-02 01:33 UTC (History)
9 users (show)

Fixed In Version: selinux-policy-42.17-1.fc42
Clone Of:
Environment:
Last Closed: 2025-12-02 01:33:49 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description gordonwwang 2024-05-06 02:00:10 UTC
When systemctl start speech-dispatcherd.service, the following AVC denial occurs:

1. speech-dispatcher working directory changes, causing AVC rejection.
```
type=AVC msg=audit(1713942006.045:1230): avc:  denied  { create } for  pid=12672 comm="speech-dispatch" name="speech-dispatcher" scontext=system_u:system_r:speech_dispatcher_t:s0 tcontext=system_u:object_r:cache_home_t:s0 tclass=dir permissive=0
type=SERVICE_START msg=audit(1713942006.053:1232): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=speech-dispatcherd comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed'^]UID="root" AUID="unset"
```

After repairing the above denials, move on. A new permission issue occurs:

2. bash command, tcp port connection, and speech dispatcher-modules access are denied.
```
The audit.log is as follows:

239:type=AVC msg=audit(1714149641.307:1053): avc:  denied  { execute } for  pid=6920 comm="speech-dispatch" name="bash" dev="dm-0" ino=16782846 scontext=system_u:system_r:speech_dispatcher_t:s0 tcontext=system_u:object_r:shell_exec_t:s0 tclass=file permissive=0
240:type=AVC msg=audit(1714149641.308:1054): avc:  denied  { execute } for  pid=6921 comm="speech-dispatch" name="bash" dev="dm-0" ino=16782846 scontext=system_u:system_r:speech_dispatcher_t:s0 tcontext=system_u:object_r:shell_exec_t:s0 tclass=file permissive=0
241:type=AVC msg=audit(1714149641.308:1055): avc:  denied  { name_connect } for  pid=6909 comm="speech-dispatch" dest=59125 scontext=system_u:system_r:speech_dispatcher_t:s0 tcontext=system_u:object_r:ephemeral_port_t:s0 tclass=tcp_socket permissive=0
242:type=AVC msg=audit(1714149641.310:1056): avc:  denied  { execute } for  pid=6922 comm="speech-dispatch" name="bash" dev="dm-0" ino=16782846 scontext=system_u:system_r:speech_dispatcher_t:s0 tcontext=system_u:object_r:shell_exec_t:s0 tclass=file permissive=0
243:type=AVC msg=audit(1714149641.311:1057): avc:  denied  { execute } for  pid=6923 comm="speech-dispatch" name="bash" dev="dm-0" ino=16782846 scontext=system_u:system_r:speech_dispatcher_t:s0 tcontext=system_u:object_r:shell_exec_t:s0 tclass=file permissive=0
244:type=AVC msg=audit(1714149641.313:1058): avc:  denied  { execute_no_trans } for  pid=6924 comm="speech-dispatch" path="/usr/lib64/speech-dispatcher-modules/sd_cicero" dev="dm-0" ino=34460340 scontext=system_u:system_r:speech_dispatcher_t:s0 tcontext=system_u:object_r:lib_t:s0 tclass=file permissive=0
245:type=AVC msg=audit(1714149641.317:1059): avc:  denied  { execute_no_trans } for  pid=6925 comm="speech-dispatch" path="/usr/lib64/speech-dispatcher-modules/sd_espeak-ng" dev="dm-0" ino=34566660 scontext=system_u:system_r:speech_dispatcher_t:s0 tcontext=system_u:object_r:lib_t:s0 tclass=file permissive=0
246:type=AVC msg=audit(1714149641.321:1060): avc:  denied  { execute_no_trans } for  pid=6926 comm="speech-dispatch" path="/usr/lib64/speech-dispatcher-modules/sd_espeak-ng" dev="dm-0" ino=34566660 scontext=system_u:system_r:speech_dispatcher_t:s0 tcontext=system_u:object_r:lib_t:s0 tclass=file permissive=0
247:type=AVC msg=audit(1714149641.324:1061): avc:  denied  { execute_no_trans } for  pid=6927 comm="speech-dispatch" path=
```

Reproducible: Always

Steps to Reproduce:
1. dnf install speech-dispatcher
2. sudo vim /usr/lib/systemd/system/speech-dispatcherd.service
```
#Normal user status is fine. root not recommended
User=testuser
Group=testuser

```

3. sudo systemctl daemon-reload
4. sudo systemctl start speech-dispatcherd.service
Actual Results:  
speech-dispatcherd.service startup failure (AVC denied) 

Expected Results:  
speech-dispatcherd.service startup successfully

Comment 1 gordonwwang 2024-05-06 02:01:56 UTC
more details, see: https://github.com/fedora-selinux/selinux-policy/issues/2100

Comment 2 Aoife Moloney 2025-02-26 13:02:08 UTC
This bug appears to have been reported against 'rawhide' during the Fedora Linux 42 development cycle.
Changing version to 42.

Comment 3 Fedora Update System 2025-11-20 18:42:02 UTC
FEDORA-2025-0a825f4990 (selinux-policy-42.16-1.fc42) has been submitted as an update to Fedora 42.
https://bodhi.fedoraproject.org/updates/FEDORA-2025-0a825f4990

Comment 4 Fedora Update System 2025-11-22 01:59:03 UTC
FEDORA-2025-0a825f4990 has been pushed to the Fedora 42 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2025-0a825f4990`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2025-0a825f4990

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 5 Fedora Update System 2025-11-27 01:59:24 UTC
FEDORA-2025-5f224b92e4 has been pushed to the Fedora 42 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2025-5f224b92e4`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2025-5f224b92e4

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 6 Fedora Update System 2025-12-02 01:33:49 UTC
FEDORA-2025-5f224b92e4 (selinux-policy-42.17-1.fc42) has been pushed to the Fedora 42 stable repository.
If problem still persists, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.