Bug 2383472 - SELinux is preventing /usr/lib/systemd/systemd-oomd from 'watch' accesses on the sock_file /run/dbus/system_bus_socket.
Summary: SELinux is preventing /usr/lib/systemd/systemd-oomd from 'watch' accesses on ...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 42
Hardware: x86_64
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Zdenek Pytela
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: abrt_hash:aa6cf2c5d13f5f3597a22a1b9c5...
: 2383648 2383703 2383761 2383766 (view as bug list)
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-07-25 15:38 UTC by Colin J Thomson
Modified: 2025-08-25 09:00 UTC (History)
11 users (show)

Fixed In Version: selinux-policy-42.3-1.fc42
Clone Of:
Environment:
Last Closed: 2025-07-31 00:53:28 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)
File: os_info (739 bytes, text/plain)
2025-07-25 15:39 UTC, Colin J Thomson
no flags Details
File: description (2.47 KB, text/plain)
2025-07-25 15:39 UTC, Colin J Thomson
no flags Details

Description Colin J Thomson 2025-07-25 15:38:57 UTC
Description of problem:
This started after the latest upate and happens on every boot or reboot.
SELinux is preventing /usr/lib/systemd/systemd-oomd from 'watch' accesses on the sock_file /run/dbus/system_bus_socket.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that systemd-oomd should be allowed watch access on the system_bus_socket sock_file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'systemd-oomd' --raw | audit2allow -M my-systemdoomd
# semodule -X 300 -i my-systemdoomd.pp

Additional Information:
Source Context                system_u:system_r:systemd_oomd_t:s0
Target Context                system_u:object_r:system_dbusd_var_run_t:s0
Target Objects                /run/dbus/system_bus_socket [ sock_file ]
Source                        systemd-oomd
Source Path                   /usr/lib/systemd/systemd-oomd
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           systemd-udev-257.7-1.fc42.x86_64
Target RPM Packages           
SELinux Policy RPM            selinux-policy-targeted-42.2-1.fc42.noarch
Local Policy RPM              selinux-policy-targeted-42.2-1.fc42.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 6.15.8-200.fc42.x86_64 #1 SMP
                              PREEMPT_DYNAMIC Thu Jul 24 13:26:52 UTC 2025
                              x86_64
Alert Count                   2
First Seen                    2025-07-25 07:27:12 BST
Last Seen                     2025-07-25 16:27:35 BST
Local ID                      2f62335b-c787-4212-b66a-27a176b32992

Raw Audit Messages
type=AVC msg=audit(1753457255.13:63): avc:  denied  { watch } for  pid=1130 comm="systemd-oomd" path="/run/dbus/system_bus_socket" dev="tmpfs" ino=2887 scontext=system_u:system_r:systemd_oomd_t:s0 tcontext=system_u:object_r:system_dbusd_var_run_t:s0 tclass=sock_file permissive=1


type=SYSCALL msg=audit(1753457255.13:63): arch=x86_64 syscall=inotify_add_watch success=yes exit=EINTR a0=7 a1=55f27828f660 a2=2000d84 a3=1 items=0 ppid=1 pid=1130 auid=4294967295 uid=999 gid=999 euid=999 suid=999 fsuid=999 egid=999 sgid=999 fsgid=999 tty=(none) ses=4294967295 comm=systemd-oomd exe=/usr/lib/systemd/systemd-oomd subj=system_u:system_r:systemd_oomd_t:s0 key=(null)

Hash: systemd-oomd,systemd_oomd_t,system_dbusd_var_run_t,sock_file,watch

Version-Release number of selected component:
selinux-policy-targeted-42.2-1.fc42.noarch

Additional info:
reporter:       libreport-2.17.15
package:        selinux-policy-targeted-42.2-1.fc42.noarch
kernel:         6.15.8-200.fc42.x86_64
component:      selinux-policy
reason:         SELinux is preventing /usr/lib/systemd/systemd-oomd from 'watch' accesses on the sock_file /run/dbus/system_bus_socket.
hashmarkername: setroubleshoot
type:           libreport
comment:        This started after the latest upate and happens on every boot or reboot.
component:      selinux-policy

Comment 1 Colin J Thomson 2025-07-25 15:39:00 UTC
Created attachment 2098235 [details]
File: os_info

Comment 2 Colin J Thomson 2025-07-25 15:39:01 UTC
Created attachment 2098236 [details]
File: description

Comment 3 Mr. Beedell, Roke Julian Lockhart (RJLB) 2025-07-27 18:10:00 UTC
*** Bug 2383766 has been marked as a duplicate of this bug. ***

Comment 4 Zdenek Pytela 2025-07-28 11:28:25 UTC
*** Bug 2383648 has been marked as a duplicate of this bug. ***

Comment 5 Zdenek Pytela 2025-07-28 11:30:38 UTC
*** Bug 2383703 has been marked as a duplicate of this bug. ***

Comment 6 Zdenek Pytela 2025-07-28 11:30:49 UTC
*** Bug 2383761 has been marked as a duplicate of this bug. ***

Comment 7 Fedora Update System 2025-07-28 12:03:04 UTC
FEDORA-2025-9665662503 (selinux-policy-42.3-1.fc42) has been submitted as an update to Fedora 42.
https://bodhi.fedoraproject.org/updates/FEDORA-2025-9665662503

Comment 8 Fedora Update System 2025-07-29 04:12:31 UTC
FEDORA-2025-9665662503 has been pushed to the Fedora 42 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2025-9665662503`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2025-9665662503

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 9 Colin J Thomson 2025-07-30 16:32:14 UTC
Fixes it for me, tested over a few days, reboots and cold starts. Thank you.

Comment 10 Fedora Update System 2025-07-31 00:53:28 UTC
FEDORA-2025-9665662503 (selinux-policy-42.3-1.fc42) has been pushed to the Fedora 42 stable repository.
If problem still persists, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.