Fedora Account System
Red Hat Associate
Red Hat Customer
The gnome_remote_desktop_t is defined as permissive, which means that no actions are really blocked. Reproducible: Always Steps to Reproduce: 1. get a Fedora rawhide machine (targeted policy is active) 2. install both gdm and gnome-remote-desktop packages 3. start the gnome-remote-desktop service (possible failure can be ignored) 4. grdctl --system vnc enable 5. grdctl --system rdp enable 6. search for SELinux denials Actual Results: ---- type=PROCTITLE msg=audit(10/23/2024 02:51:35.701:987) : proctitle=/usr/libexec/gnome-remote-desktop-daemon --system type=PATH msg=audit(10/23/2024 02:51:35.701:987) : item=0 name=/etc/gnome-remote-desktop inode=276729 dev=fc:02 mode=dir,755 ouid=gnome-remote-desktop ogid=gnome-remote-desktop rdev=00:00 obj=system_u:object_r:etc_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=CWD msg=audit(10/23/2024 02:51:35.701:987) : cwd=/ type=SYSCALL msg=audit(10/23/2024 02:51:35.701:987) : arch=x86_64 syscall=inotify_add_watch success=yes exit=2 a0=0x3 a1=0x5620c104b9d0 a2=0x1002fce a3=0x5620c1003010 items=1 ppid=1 pid=3596 auid=unset uid=gnome-remote-desktop gid=gnome-remote-desktop euid=gnome-remote-desktop suid=gnome-remote-desktop fsuid=gnome-remote-desktop egid=gnome-remote-desktop sgid=gnome-remote-desktop fsgid=gnome-remote-desktop tty=(none) ses=unset comm=gnome-remote-de exe=/usr/libexec/gnome-remote-desktop-daemon subj=system_u:system_r:gnome_remote_desktop_t:s0 key=(null) type=AVC msg=audit(10/23/2024 02:51:35.701:987) : avc: denied { watch } for pid=3596 comm=gnome-remote-de path=/etc/gnome-remote-desktop dev="vda2" ino=276729 scontext=system_u:system_r:gnome_remote_desktop_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=dir permissive=1 ---- Expected Results: no SELinux denials Found by the following automated test: * https://src.fedoraproject.org/tests/selinux/pull-request/562