From what I can gather, the title says it all. I would be grateful if there was a bug reporting CLI tool (for the Fedora Server Edition) that would generate reports for a given log entry or something. I never know exactly what you guys might need. Something similar to the Problem Reporting Red Hat tool. Reproducible: Didn't try Steps to Reproduce: 1. Install Fedora 41 Server Edition 2. Install cockpit 3. Update system using cockpit 4. Restarted system (due to: Failed to initialize NVML: Driver/library version mismatch error) 5. Noticed error occurred. Actual Results: I don't know what happened. I am just reporting. Additional Information: uname -a Linux fedora-server 6.14.4-200.fc41.x86_64 #1 SMP PREEMPT_DYNAMIC Fri Apr 25 15:45:16 UTC 2025 x86_64 GNU/Linux sealert -l f730c8d6-a730-4076-acaa-a96df3526d9b SELinux is preventing ps from using the sys_admin capability. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that ps should have the sys_admin capability by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'ps' --raw | audit2allow -M my-ps # semodule -X 300 -i my-ps.pp Additional Information: Source Context system_u:system_r:pcp_pmie_t:s0 Target Context system_u:system_r:pcp_pmie_t:s0 Target Objects Unknown [ capability ] Source ps Source Path ps Port <Unknown> Host fedora-server Source RPM Packages Target RPM Packages SELinux Policy RPM selinux-policy-targeted-41.38-1.fc41.noarch Local Policy RPM pcp-selinux-6.3.7-2.fc41.x86_64 Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name fedora-server Platform Linux fedora-server 6.14.4-200.fc41.x86_64 #1 SMP PREEMPT_DYNAMIC Fri Apr 25 15:45:16 UTC 2025 x86_64 Alert Count 52 First Seen 2025-05-03 08:24:01 CEST Last Seen 2025-05-03 20:28:27 CEST Local ID f730c8d6-a730-4076-acaa-a96df3526d9b Raw Audit Messages type=AVC msg=audit(1746296907.485:800): avc: denied { sys_admin } for pid=58471 comm="ps" capability=21 scontext=system_u:system_r:pcp_pmie_t:s0 tcontext=system_u:system_r:pcp_pmie_t:s0 tclass=capability permissive=0 Hash: ps,pcp_pmie_t,pcp_pmie_t,capability,sys_admin ps --version ps from procps-ng 4.0.4
Created attachment 2088270 [details] dnf history list ; cockpit log entry ; sestatus ; cockpit log entries for setroubleshootd.service
Resolved by upstream PR: https://github.com/performancecopilot/pcp/pull/2201
*** Bug 2354167 has been marked as a duplicate of this bug. ***
*** Bug 2360117 has been marked as a duplicate of this bug. ***
Builds of pcp-6.3.7-5 for fc41, fc42, and rawhide with the upstream patch to address this issue have been successfully built on koji.fedoraproject.org.
Happens at any time... reason: SELinux is preventing ps from using the 'sys_admin' capabilities. package: selinux-policy-targeted-41.39-1.fc42.noarch hashmarkername: setroubleshoot type: libreport kernel: 6.14.5-300.fc42.x86_64 comment: Happens at any time...
FEDORA-2025-8c82dffb1b (pcp-6.3.7-4.fc42) has been submitted as an update to Fedora 42. https://bodhi.fedoraproject.org/updates/FEDORA-2025-8c82dffb1b
FEDORA-2025-8c82dffb1b has been pushed to the Fedora 42 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2025-8c82dffb1b` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2025-8c82dffb1b See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
*** Bug 2367075 has been marked as a duplicate of this bug. ***
I installed the update, but I still get these messages, to be 100% sure I ran fixfiles -B onboot SELinux is preventing ps from using the sys_admin capability. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that ps should have the sys_admin capability by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'ps' --raw | audit2allow -M my-ps # semodule -X 300 -i my-ps.pp Additional Information: Source Context system_u:system_r:pcp_pmie_t:s0 Target Context system_u:system_r:pcp_pmie_t:s0 Target Objects Unknown [ capability ] Source ps Source Path ps Port <Unknown> Host <Unknown> Source RPM Packages Target RPM Packages SELinux Policy RPM selinux-policy-targeted-41.40-1.fc42.noarch Local Policy RPM pcp-selinux-6.3.7-4.fc42.x86_64 Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name example.com Platform Linux example.com 6.14.6-300.fc42.x86_64 #1 SMP PREEMPT_DYNAMIC Fri May 9 20:11:19 UTC 2025 x86_64 Alert Count 2580 First Seen 2025-04-24 21:58:11 CEST Last Seen 2025-05-21 14:58:12 CEST Local ID 9a5385f2-9492-48a0-963e-44b9f1284b6b Raw Audit Messages type=AVC msg=audit(1747832292.86:203): avc: denied { sys_admin } for pid=3328 comm="ps" capability=21 scontext=system_u:system_r:pcp_pmie_t:s0 tcontext=system_u:system_r:pcp_pmie_t:s0 tclass=capability permissive=0 Hash: ps,pcp_pmie_t,pcp_pmie_t,capability,sys_admin
FEDORA-2025-8c82dffb1b (pcp-6.3.7-4.fc42) has been pushed to the Fedora 42 stable repository. If problem still persists, please make note of it in this bug report.
Last Seen 2025-05-22 04:58:12 CEST Please reopen
| Local Policy RPM pcp-selinux-6.3.7-4.fc42.x86_64 Martin, you'll need the -5 build not -4. cheers.
thank you!
This has appeared again. A regression may have occurred. @nathans
Occurs repeatedly with unknown catalyst with latest updates. reason: SELinux is preventing /usr/bin/ps from using the 'sys_admin' capabilities. package: selinux-policy-targeted-41.41-1.fc42.noarch hashmarkername: setroubleshoot type: libreport kernel: 6.14.9-300.fc42.x86_64 comment: Occurs repeatedly with unknown catalyst with latest updates.
It's still happening with `pcp-selinux-6.3.7-7.fc42.x86_64`. I just did a second `/.autorelable` boot after months of frustration with this issue. :P Glad I found this bugzilla.
@nathans let me know if I can help with any information.
Just installed the updates-testing version `pcp-6.3.7-8` with the command : ``` # dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2025-d396057e40 ``` To test if this fixes the issue.