Starting the service ras-mc-ctl.service from the rasdaemon package fails when SELinux is set to enforcing mode. Reproducible: Always Steps to Reproduce: 1. Install rasdaemon package with `dnf install rasdaemon` 2. Start rasdaemon.service with `systemctl start rasdemon`. Note that this works. 3. Try to start ras-mc-ctl.service with `systemctl start ras-mc-ctl.service`. Note that this fails with an error from systemctl. 4. Set SELinux to permissive mode with `setenforcing 0`. 5. Try to start ras-mc-ctl.service again. Note that now it works. Actual Results: # systemctl start ras-mc-ctl.service Job for ras-mc-ctl.service failed because the control process exited with error code. See "systemctl status ras-mc-ctl.service" and "journalctl -xeu ras-mc-ctl.service" for details. Expected Results: # systemctl start ras-mc-ctl.service # systemctl status ras-mc-ctl.service ● ras-mc-ctl.service - Initialize EDAC v3.0.0 Drivers For Machine Hardware Loaded: loaded (/usr/lib/systemd/system/ras-mc-ctl.service; disabled; preset: disabled) Drop-In: /usr/lib/systemd/system/service.d └─10-timeout-abort.conf, 50-keep-warm.conf Active: active (exited) since XYAZ XXXX-XX-XX XX:XX:XX YYY; 1min 00s ago --- I've included the output of "sealert -l" when running SELinux in permissive mode as a log file to this bug report. Below is the Raw Audit Messages from this output: type=AVC msg=audit(1735686000.621:305): avc: denied { write } for pid=4494 comm="ras-mc-ctl" name="dimm_label" dev="sysfs" ino=60664 scontext=system_u:system_r:rasdaemon_t:s0 tcontext=system_u:object_r:sysfs_t:s0 tclass=file permissive=1 type=SYSCALL msg=audit(1735686000.621:305): arch=x86_64 syscall=openat success=yes exit=ESRCH a0=ffffff9c a1=556391175920 a2=80241 a3=1b6 items=0 ppid=1 pid=4494 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=ras-mc-ctl exe=/usr/bin/perl subj=system_u:system_r:rasdaemon_t:s0 key=(null) Package versions Linux 6.12.6-200.fc41.x86_64 #1 SMP selinux-policy-targeted-41.27-1.fc41.noarch rasdaemon-0.8.0-5.fc41.x86_64
Created attachment 2064421 [details] ras-mc-ctl.service sealert output
For reference the sysfs file "dimm_label" can be found here: /sys/devices/system/edac/mc/mc*/(dimm|rank)*/dimm_label In my system it looks like this: # ls -lahZ /sys/devices/system/edac/mc/mc0/rank0/dimm_label -rw-r--r--. 1 root root system_u:object_r:sysfs_t:s0 4,0K X xxx XX.XX /sys/devices/system/edac/mc/mc0/rank0/dimm_label
FEDORA-2025-acfddac85e (selinux-policy-41.47-1.fc41) has been submitted as an update to Fedora 41. https://bodhi.fedoraproject.org/updates/FEDORA-2025-acfddac85e
FEDORA-2025-acfddac85e has been pushed to the Fedora 41 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2025-acfddac85e` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2025-acfddac85e See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2025-acfddac85e (selinux-policy-41.47-1.fc41) has been pushed to the Fedora 41 stable repository. If problem still persists, please make note of it in this bug report.