Bug 2369545 - SELinux execmem access denial on startup
Summary: SELinux execmem access denial on startup
Keywords:
Status: ASSIGNED
Alias: None
Product: Fedora EPEL
Classification: Fedora
Component: fail2ban
Version: epel9
Hardware: All
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: Orion Poplawski
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-05-31 10:31 UTC by overact_ninetieth160
Modified: 2025-10-05 08:52 UTC (History)
3 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Type: Bug
Embargoed:


Attachments (Terms of Use)

Description overact_ninetieth160 2025-05-31 10:31:25 UTC
Description of problem:

The following SELinux denial is logged several times upon startup of fail2ban:

type=AVC msg=audit(1748686317.733:34516): avc:  denied  { execmem } for  pid=785523 comm="grep" scontext=system_u:system_r:fail2ban_t:s0 tcontext=system_u:system_r:fail2ban_t:s0 tclass=process permissive=0


How reproducible:


Steps to Reproduce:
1. systemctl start fail2ban
2. Check audit log


Additional info:

I am not sure what fail2ban does that it wants execmem, so this might be an upstream issue.

Comment 1 overact_ninetieth160 2025-09-04 22:50:07 UTC
Is this not an easy fix? Or is fail2ban not supposed to do this and I should report this upstream?

Comment 2 Orion Poplawski 2025-10-03 21:40:38 UTC
Couple things:

* I cannot reproduce this on my AlmaLinux 9.6 system
* execmem is really not something that should ever be enabled or needed

So you're going to need to figure out what exactly fail2ban is trying to do here.  I also can't really imagine grep ever needing execmem.  Do you have a modified grep?

rpm -V grep
which grep

start fail2ban with loglevel = DEBUG and post your fail2ban.log

Comment 3 overact_ninetieth160 2025-10-05 08:52:07 UTC
Unmodified grep, rpm verify comes back clean and the f2b log does not show any errors.

It turns out that the denial happens when stopping (or restarting) fail2ban. I have traced this to the nftables banaction. Steps to reproduce:

/etc/fail2ban/jail.d/nginx-limit-req.local:
```
[nginx-limit-req]
banaction = nftables
enabled = true
```

```
sudo fail2ban-client set nginx-limit-req banip 1.2.3.4
sudo systemctl start fail2ban
sudo systemctl stop fail2ban
```

audit.log shows:

type=AVC msg=audit(1759651205.377:859): avc:  denied  { execmem } for  pid=18382 comm="grep" scontext=system_u:system_r:fail2ban_t:s0 tcontext=system_u:system_r:fail2ban_t:s0 tclass=process permissive=0


The uses of grep in action.d/nftables.conf to remove nftables rules look ok to me, but I'm ready to make an upstream report if you think something should be changed there.


Note You need to log in before you can comment on or make changes to this bug.