Bug 2360326 - SELinux is preventing /usr/lib/systemd/systemd-rfkill from read, open access on the file file.
Summary: SELinux is preventing /usr/lib/systemd/systemd-rfkill from read, open access ...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: rawhide
Hardware: x86_64
OS: Unspecified
medium
unspecified
Target Milestone: ---
Assignee: Zdenek Pytela
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: abrt_hash:489db76d34408115c0f4e64dfa6...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-04-16 16:17 UTC by Andrew Kreimer
Modified: 2025-04-23 01:48 UTC (History)
8 users (show)

Fixed In Version: selinux-policy-41.38-1.fc42
Clone Of:
Environment:
Last Closed: 2025-04-23 01:48:25 UTC
Type: ---
Embargoed:
zpytela: mirror+


Attachments (Terms of Use)
File: description (2.42 KB, text/plain)
2025-04-16 16:17 UTC, Andrew Kreimer
no flags Details
File: os_info (718 bytes, text/plain)
2025-04-16 16:17 UTC, Andrew Kreimer
no flags Details


Links
System ID Private Priority Status Summary Last Updated
Github fedora-selinux selinux-policy pull 2648 0 None open Allow systemd-rfkill read nsfs files 2025-04-16 17:09:33 UTC
Red Hat Issue Tracker FC-1598 0 None None None 2025-04-16 17:09:47 UTC

Description Andrew Kreimer 2025-04-16 16:17:26 UTC
Description of problem:
SELinux is preventing /usr/lib/systemd/systemd-rfkill from read, open access on the file file.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that systemd-rfkill should be allowed read open access on the file file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'systemd-rfkill' --raw | audit2allow -M my-systemdrfkill
# semodule -X 300 -i my-systemdrfkill.pp

Additional Information:
Source Context                system_u:system_r:systemd_rfkill_t:s0
Target Context                system_u:object_r:nsfs_t:s0
Target Objects                file [ file ]
Source                        systemd-rfkill
Source Path                   /usr/lib/systemd/systemd-rfkill
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           systemd-udev-257.5-2.fc43.x86_64
Target RPM Packages           
SELinux Policy RPM            selinux-policy-targeted-41.37-1.fc43.noarch
Local Policy RPM              selinux-policy-targeted-41.37-1.fc43.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 6.15.0-
                              0.rc1.20250411git900241a5cc15.19.fc43.x86_64 #1
                              SMP PREEMPT_DYNAMIC Fri Apr 11 19:18:58 UTC 2025
                              x86_64
Alert Count                   6
First Seen                    2025-04-08 19:02:43 IDT
Last Seen                     2025-04-15 19:56:19 IDT
Local ID                      8745de0e-e224-40a7-ae1b-6cd01c5d8d80

Raw Audit Messages
type=AVC msg=audit(1744736179.846:80): avc:  denied  { read open } for  pid=670 comm="systemd-rfkill" path="net:[4026531840]" dev="nsfs" ino=4026531840 scontext=system_u:system_r:systemd_rfkill_t:s0 tcontext=system_u:object_r:nsfs_t:s0 tclass=file permissive=0


type=SYSCALL msg=audit(1744736179.846:80): arch=x86_64 syscall=ioctl success=no exit=EACCES a0=6 a1=894c a2=7ffd977d144c a3=7ffd977d144c items=0 ppid=1 pid=670 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=systemd-rfkill exe=/usr/lib/systemd/systemd-rfkill subj=system_u:system_r:systemd_rfkill_t:s0 key=(null)

Hash: systemd-rfkill,systemd_rfkill_t,nsfs_t,file,read,open

Version-Release number of selected component:
selinux-policy-targeted-41.37-1.fc43.noarch

Additional info:
reporter:       libreport-2.17.15
reason:         SELinux is preventing /usr/lib/systemd/systemd-rfkill from read, open access on the file file.
package:        selinux-policy-targeted-41.37-1.fc43.noarch
component:      selinux-policy
hashmarkername: setroubleshoot
type:           libreport
kernel:         6.15.0-0.rc1.20250411git900241a5cc15.19.fc43.x86_64
component:      selinux-policy

Comment 1 Andrew Kreimer 2025-04-16 16:17:29 UTC
Created attachment 2085224 [details]
File: description

Comment 2 Andrew Kreimer 2025-04-16 16:17:30 UTC
Created attachment 2085225 [details]
File: os_info

Comment 3 Zdenek Pytela 2025-04-16 17:09:34 UTC
Andrew,

Do you happen to know what is required to trigger this denial?

Comment 4 Andrew Kreimer 2025-04-16 20:40:48 UTC
Zdenek,

No clue, I get those notifications on every startup.

Ask me anything, will try to do my best.

Comment 5 Fedora Update System 2025-04-21 08:44:17 UTC
FEDORA-2025-c6621cb65e (selinux-policy-41.38-1.fc42) has been submitted as an update to Fedora 42.
https://bodhi.fedoraproject.org/updates/FEDORA-2025-c6621cb65e

Comment 6 Fedora Update System 2025-04-22 01:45:31 UTC
FEDORA-2025-c6621cb65e has been pushed to the Fedora 42 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2025-c6621cb65e`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2025-c6621cb65e

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 7 Andrew Kreimer 2025-04-22 07:39:38 UTC
Thanks, there are no errors/notifications since the update.

Comment 8 Fedora Update System 2025-04-23 01:48:25 UTC
FEDORA-2025-c6621cb65e (selinux-policy-41.38-1.fc42) has been pushed to the Fedora 42 stable repository.
If problem still persists, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.