Description of problem:
Opening Rhythmbox:

The user launches Rhythmbox, a music player application, on their Fedora system.
Initially, the application opens without any visible issues.
First Close Attempt:

The user attempts to close Rhythmbox for the first time.
During this process, Rhythmbox crashes unexpectedly, which may trigger the system to generate a core dump for debugging purposes.
Systemd-Coredump Activation:

As part of the core dump process, systemd-coredum is invoked to handle the core dump.
systemd-coredum tries to use the sys_admin capability, which is required for certain administrative actions like managing core dumps.
SELinux Denial:

SELinux, operating in enforcing mode, denies systemd-coredum the sys_admin capability because it is not explicitly allowed by the current SELinux policy.
An AVC (Access Vector Cache) denial is recorded, and a security alert is generated.
Subsequent Behavior:

After the initial crash and denial, the issue persists whenever Rhythmbox is closed, continuing to trigger the same SELinux alert.
The user observes this behavior consistently, with the alert only appearing after Rhythmbox is closed following the crash.
Audit Log Entry:

Each time the issue occurs, an entry is made in the audit log, capturing details such as the denied capability (sys_admin), the source (systemd-coredum), and the SELinux contexts involved.
User Impact:

The SELinux alert is intrusive, and the user must manually handle or ignore the alert each time it appears.
This impacts the usability of Rhythmbox and indicates a potential bug or misconfiguration in the system or SELinux policies.
SELinux is preventing systemd-coredum from using the 'sys_admin' capabilities.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that systemd-coredum should have the sys_admin capability by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'systemd-coredum' --raw | audit2allow -M my-systemdcoredum
# semodule -X 300 -i my-systemdcoredum.pp

Additional Information:
Source Context                system_u:system_r:systemd_coredump_t:s0
Target Context                system_u:system_r:systemd_coredump_t:s0
Target Objects                Unknown [ capability ]
Source                        systemd-coredum
Source Path                   systemd-coredum
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           
Target RPM Packages           
SELinux Policy RPM            selinux-policy-targeted-41.28-1.fc41.noarch
Local Policy RPM              selinux-policy-targeted-41.28-1.fc41.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 6.12.9-200.fc41.x86_64 #1 SMP
                              PREEMPT_DYNAMIC Thu Jan 9 16:05:40 UTC 2025 x86_64
Alert Count                   9
First Seen                    2025-01-16 01:40:46 +04
Last Seen                     2025-01-17 21:12:27 +04
Local ID                      ff5d4ad1-ec0d-4975-96d8-2bda0189f7e5

Raw Audit Messages
type=AVC msg=audit(1737133947.899:1431): avc:  denied  { sys_admin } for  pid=108252 comm="systemd-coredum" capability=21  scontext=system_u:system_r:systemd_coredump_t:s0 tcontext=system_u:system_r:systemd_coredump_t:s0 tclass=capability permissive=0


Hash: systemd-coredum,systemd_coredump_t,systemd_coredump_t,capability,sys_admin

Version-Release number of selected component:
selinux-policy-targeted-41.28-1.fc41.noarch

Additional info:
reporter:       libreport-2.17.15
reason:         SELinux is preventing systemd-coredum from using the 'sys_admin' capabilities.
package:        selinux-policy-targeted-41.28-1.fc41.noarch
component:      selinux-policy
hashmarkername: setroubleshoot
type:           libreport
kernel:         6.12.9-200.fc41.x86_64
component:      selinux-policy