Fedora Account System
Red Hat Associate
Red Hat Customer
Description of problem: On my computer I'm getting a number of AVC denials related to bwrap that don't appear on a clean install. Versions of possibly related software: =========================== bubblewrap-0.11.0-2.fc43.x86_64 libselinux-3.9-5.fc43.x86_64 libselinux-devel-3.9-5.fc43.x86_64 libselinux-utils-3.9-5.fc43.x86_64 selinux-policy-42.16-1.fc43.noarch selinux-policy-minimum-42.16-1.fc43.noarch selinux-policy-targeted-42.16-1.fc43.noarch usbguard-selinux-1.1.3-6.fc43.noarch atril-thumbnailer-1.28.1-3.fc43.x86_64 ffmpegthumbnailer-2.2.3-3.fc43.x86_64 ffmpegthumbnailer-libs-2.2.3-3.fc43.x86_64 glycin-thumbnailer-2.0.4-1.fc43.x86_64 gnome-epub-thumbnailer-1.8-3.fc43.x86_64 (Full info of this one) =========================================================================== SELinux is preventing bwrap from using the 'setcap' accesses on a process. ***** Plugin catchall (100. confidence) suggests ************************** Se si ritiene che a bwrap debba essere consentito l'accesso setcap ai processi etichettati thumb_t per impostazione predefinita. Then si dovrebbe segnalare il problema come bug. È possibile generare un modulo di politica locale per consentire questo accesso. Do consentire questo accesso per ora eseguendo: # ausearch -c 'bwrap' --raw | audit2allow -M my-$MODULE_NOME # semodule -X 300 -i mio-bwrap.pp Additional Information: Source Context unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 Target Context unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 Target Objects Sconosciuto [ process ] Source bwrap Source Path bwrap Port <Sconosciuto> Host (removed) Source RPM Packages Target RPM Packages SELinux Policy RPM selinux-policy-targeted-42.16-1.fc43.noarch Local Policy RPM selinux-policy-targeted-42.16-1.fc43.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Permissive Host Name (removed) Platform Linux (removed) 6.17.8-300.fc43.x86_64 #1 SMP PREEMPT_DYNAMIC Fri Nov 14 01:47:12 UTC 2025 x86_64 Alert Count 2 First Seen 2025-11-28 02:10:54 CET Last Seen 2025-11-28 02:11:01 CET Local ID e887629f-4017-4768-8613-4eca74e50cd9 Raw Audit Messages type=AVC msg=audit(1764292261.371:876): avc: denied { setcap } for pid=264012 comm="bwrap" scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tclass=process permissive=1 Hash: bwrap,thumb_t,thumb_t,process,setcap ============================================================================ Brief info of all of them: ============================================================================ dave:~$ sudo ausearch -c 'bwrap' ---- time->Tue Nov 25 18:40:53 2025 type=AVC msg=audit(1764092453.127:363): avc: denied { sys_admin } for pid=27463 comm="bwrap" capability=21 scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 ---- time->Tue Nov 25 18:40:53 2025 type=AVC msg=audit(1764092453.128:364): avc: denied { sys_ptrace } for pid=27463 comm="bwrap" capability=19 scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 ---- time->Tue Nov 25 18:40:53 2025 type=AVC msg=audit(1764092453.128:365): avc: denied { setcap } for pid=27463 comm="bwrap" scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tclass=process permissive=1 ---- time->Tue Nov 25 18:40:53 2025 type=AVC msg=audit(1764092453.128:366): avc: denied { setpcap } for pid=27464 comm="bwrap" capability=8 scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 ---- time->Tue Nov 25 18:40:53 2025 type=AVC msg=audit(1764092453.128:367): avc: denied { nlmsg_write } for pid=27464 comm="bwrap" scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tclass=netlink_route_socket permissive=1 ---- time->Tue Nov 25 18:40:53 2025 type=AVC msg=audit(1764092453.128:368): avc: denied { net_admin } for pid=27464 comm="bwrap" capability=12 scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 ---- time->Tue Nov 25 18:40:53 2025 type=AVC msg=audit(1764092453.128:369): avc: denied { mounton } for pid=27464 comm="bwrap" path="/" dev="sdd4" ino=256 scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=system_u:object_r:root_t:s0 tclass=dir permissive=1 ---- time->Tue Nov 25 18:40:53 2025 type=AVC msg=audit(1764092453.128:370): avc: denied { mounton } for pid=27464 comm="bwrap" path="/tmp" dev="tmpfs" ino=1 scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=system_u:object_r:tmp_t:s0 tclass=dir permissive=1 ---- time->Tue Nov 25 18:40:53 2025 type=AVC msg=audit(1764092453.128:371): avc: denied { mount } for pid=27464 comm="bwrap" name="/" dev="tmpfs" ino=1 scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=system_u:object_r:tmpfs_t:s0 tclass=filesystem permissive=1 ---- time->Tue Nov 25 18:40:53 2025 type=AVC msg=audit(1764092453.128:372): avc: denied { mounton } for pid=27464 comm="bwrap" path="/tmp/newroot" dev="tmpfs" ino=2 scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:thumb_tmpfs_t:s0 tclass=dir permissive=1 ---- time->Tue Nov 25 18:40:53 2025 type=AVC msg=audit(1764092453.129:373): avc: denied { remount } for pid=27464 comm="bwrap" scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=system_u:object_r:fs_t:s0 tclass=filesystem permissive=1 ---- time->Tue Nov 25 18:40:53 2025 type=AVC msg=audit(1764092453.131:374): avc: denied { create } for pid=27464 comm="bwrap" name="stdin" scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:thumb_tmpfs_t:s0 tclass=lnk_file permissive=1 ---- time->Tue Nov 25 18:40:53 2025 type=AVC msg=audit(1764092453.131:375): avc: denied { mount } for pid=27464 comm="bwrap" name="/" dev="devpts" ino=1 scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=system_u:object_r:devpts_t:s0 tclass=filesystem permissive=1 ---- time->Tue Nov 25 18:40:53 2025 type=AVC msg=audit(1764092453.132:376): avc: denied { unmount } for pid=27464 comm="bwrap" scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=system_u:object_r:fs_t:s0 tclass=filesystem permissive=1 ---- time->Tue Nov 25 18:40:53 2025 type=AVC msg=audit(1764092453.132:377): avc: denied { unmount } for pid=27464 comm="bwrap" scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=system_u:object_r:tmpfs_t:s0 tclass=filesystem permissive=1 ---- time->Tue Nov 25 18:40:55 2025 type=AVC msg=audit(1764092455.483:379): avc: denied { nlmsg_write } for pid=27749 comm="bwrap" scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tclass=netlink_route_socket permissive=1 ---- time->Tue Nov 25 18:40:55 2025 type=AVC msg=audit(1764092455.825:381): avc: denied { sys_admin } for pid=27786 comm="bwrap" capability=21 scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 ---- time->Tue Nov 25 18:40:55 2025 type=AVC msg=audit(1764092455.827:382): avc: denied { sys_ptrace } for pid=27786 comm="bwrap" capability=19 scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 ---- time->Tue Nov 25 18:40:55 2025 type=AVC msg=audit(1764092455.827:383): avc: denied { setpcap } for pid=27787 comm="bwrap" capability=8 scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 ---- time->Tue Nov 25 18:40:55 2025 type=AVC msg=audit(1764092455.827:384): avc: denied { net_admin } for pid=27787 comm="bwrap" capability=12 scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 ---- time->Tue Nov 25 18:40:56 2025 type=AVC msg=audit(1764092456.467:386): avc: denied { mount } for pid=27848 comm="bwrap" name="/" dev="tmpfs" ino=1 scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=system_u:object_r:tmpfs_t:s0 tclass=filesystem permissive=1 ---- time->Tue Nov 25 18:40:56 2025 type=AVC msg=audit(1764092456.469:387): avc: denied { unmount } for pid=27848 comm="bwrap" scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=system_u:object_r:tmpfs_t:s0 tclass=filesystem permissive=1 ---- time->Tue Nov 25 18:40:58 2025 type=AVC msg=audit(1764092458.258:388): avc: denied { setcap } for pid=28113 comm="bwrap" scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tclass=process permissive=1 ---- time->Tue Nov 25 18:40:58 2025 type=AVC msg=audit(1764092458.265:389): avc: denied { create } for pid=28114 comm="bwrap" name="stdin" scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:thumb_tmpfs_t:s0 tclass=lnk_file permissive=1 ---- time->Tue Nov 25 18:40:58 2025 type=AVC msg=audit(1764092458.265:390): avc: denied { mount } for pid=28114 comm="bwrap" name="/" dev="devpts" ino=1 scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=system_u:object_r:devpts_t:s0 tclass=filesystem permissive=1 ---- time->Tue Nov 25 18:40:59 2025 type=AVC msg=audit(1764092459.559:391): avc: denied { mounton } for pid=28243 comm="bwrap" path="/tmp/newroot" dev="tmpfs" ino=2 scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:thumb_tmpfs_t:s0 tclass=dir permissive=1 ---- time->Tue Nov 25 18:40:59 2025 type=AVC msg=audit(1764092459.560:392): avc: denied { remount } for pid=28243 comm="bwrap" scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=system_u:object_r:fs_t:s0 tclass=filesystem permissive=1 ---- time->Tue Nov 25 18:40:59 2025 type=AVC msg=audit(1764092459.561:393): avc: denied { unmount } for pid=28243 comm="bwrap" scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=system_u:object_r:fs_t:s0 tclass=filesystem permissive=1 ---- time->Wed Nov 26 16:53:54 2025 type=AVC msg=audit(1764172434.452:2985): avc: denied { sys_admin } for pid=146745 comm="bwrap" capability=21 scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 ---- time->Wed Nov 26 16:53:54 2025 type=AVC msg=audit(1764172434.454:2986): avc: denied { sys_ptrace } for pid=146745 comm="bwrap" capability=19 scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 ---- time->Wed Nov 26 16:53:54 2025 type=AVC msg=audit(1764172434.454:2987): avc: denied { setcap } for pid=146745 comm="bwrap" scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tclass=process permissive=1 ---- time->Wed Nov 26 16:53:54 2025 type=AVC msg=audit(1764172434.454:2988): avc: denied { setpcap } for pid=146746 comm="bwrap" capability=8 scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 ---- time->Wed Nov 26 16:53:54 2025 type=AVC msg=audit(1764172434.454:2989): avc: denied { nlmsg_write } for pid=146746 comm="bwrap" scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tclass=netlink_route_socket permissive=1 ---- time->Wed Nov 26 16:53:54 2025 type=AVC msg=audit(1764172434.454:2990): avc: denied { net_admin } for pid=146746 comm="bwrap" capability=12 scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 ---- time->Wed Nov 26 16:53:54 2025 type=AVC msg=audit(1764172434.455:2991): avc: denied { mounton } for pid=146746 comm="bwrap" path="/" dev="sdd4" ino=256 scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=system_u:object_r:root_t:s0 tclass=dir permissive=1 ---- time->Wed Nov 26 16:53:54 2025 type=AVC msg=audit(1764172434.455:2992): avc: denied { mounton } for pid=146746 comm="bwrap" path="/tmp" dev="tmpfs" ino=1 scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=system_u:object_r:tmp_t:s0 tclass=dir permissive=1 ---- time->Wed Nov 26 16:53:54 2025 type=AVC msg=audit(1764172434.455:2993): avc: denied { mount } for pid=146746 comm="bwrap" name="/" dev="tmpfs" ino=1 scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=system_u:object_r:tmpfs_t:s0 tclass=filesystem permissive=1 ---- time->Wed Nov 26 16:53:54 2025 type=AVC msg=audit(1764172434.455:2994): avc: denied { mounton } for pid=146746 comm="bwrap" path="/tmp/newroot" dev="tmpfs" ino=2 scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:thumb_tmpfs_t:s0 tclass=dir permissive=1 ---- time->Wed Nov 26 16:53:54 2025 type=AVC msg=audit(1764172434.456:2995): avc: denied { remount } for pid=146746 comm="bwrap" scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=system_u:object_r:fs_t:s0 tclass=filesystem permissive=1 ---- time->Wed Nov 26 16:53:54 2025 type=AVC msg=audit(1764172434.458:2996): avc: denied { create } for pid=146746 comm="bwrap" name="stdin" scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:thumb_tmpfs_t:s0 tclass=lnk_file permissive=1 ---- time->Wed Nov 26 16:53:54 2025 type=AVC msg=audit(1764172434.460:2997): avc: denied { mount } for pid=146746 comm="bwrap" name="/" dev="devpts" ino=1 scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=system_u:object_r:devpts_t:s0 tclass=filesystem permissive=1 ---- time->Wed Nov 26 16:53:54 2025 type=AVC msg=audit(1764172434.462:2998): avc: denied { unmount } for pid=146746 comm="bwrap" scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=system_u:object_r:fs_t:s0 tclass=filesystem permissive=1 ---- time->Wed Nov 26 16:53:54 2025 type=AVC msg=audit(1764172434.463:2999): avc: denied { unmount } for pid=146746 comm="bwrap" scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=system_u:object_r:tmpfs_t:s0 tclass=filesystem permissive=1 ---- time->Wed Nov 26 16:53:54 2025 type=AVC msg=audit(1764172434.485:3000): avc: denied { mount } for pid=146750 comm="bwrap" name="/" dev="devpts" ino=1 scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=system_u:object_r:devpts_t:s0 tclass=filesystem permissive=1 ---- time->Wed Nov 26 18:11:05 2025 type=AVC msg=audit(1764177065.782:3142): avc: denied { sys_admin } for pid=164049 comm="bwrap" capability=21 scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 ---- time->Wed Nov 26 18:11:05 2025 type=AVC msg=audit(1764177065.783:3143): avc: denied { sys_ptrace } for pid=164049 comm="bwrap" capability=19 scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 ---- time->Wed Nov 26 18:11:05 2025 type=AVC msg=audit(1764177065.783:3144): avc: denied { setcap } for pid=164049 comm="bwrap" scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tclass=process permissive=1 ---- time->Wed Nov 26 18:11:05 2025 type=AVC msg=audit(1764177065.783:3145): avc: denied { setpcap } for pid=164050 comm="bwrap" capability=8 scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 ---- time->Wed Nov 26 18:11:05 2025 type=AVC msg=audit(1764177065.784:3146): avc: denied { nlmsg_write } for pid=164050 comm="bwrap" scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tclass=netlink_route_socket permissive=1 ---- time->Wed Nov 26 18:11:05 2025 type=AVC msg=audit(1764177065.784:3147): avc: denied { net_admin } for pid=164050 comm="bwrap" capability=12 scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 ---- time->Wed Nov 26 18:11:05 2025 type=AVC msg=audit(1764177065.784:3148): avc: denied { mounton } for pid=164050 comm="bwrap" path="/" dev="sdd4" ino=256 scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=system_u:object_r:root_t:s0 tclass=dir permissive=1 ---- time->Wed Nov 26 18:11:05 2025 type=AVC msg=audit(1764177065.784:3149): avc: denied { mounton } for pid=164050 comm="bwrap" path="/tmp" dev="tmpfs" ino=1 scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=system_u:object_r:tmp_t:s0 tclass=dir permissive=1 ---- time->Wed Nov 26 18:11:05 2025 type=AVC msg=audit(1764177065.784:3150): avc: denied { mount } for pid=164050 comm="bwrap" name="/" dev="tmpfs" ino=1 scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=system_u:object_r:tmpfs_t:s0 tclass=filesystem permissive=1 ---- time->Wed Nov 26 18:11:05 2025 type=AVC msg=audit(1764177065.784:3151): avc: denied { mounton } for pid=164050 comm="bwrap" path="/tmp/newroot" dev="tmpfs" ino=2 scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:thumb_tmpfs_t:s0 tclass=dir permissive=1 ---- time->Wed Nov 26 18:11:05 2025 type=AVC msg=audit(1764177065.785:3152): avc: denied { remount } for pid=164050 comm="bwrap" scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=system_u:object_r:fs_t:s0 tclass=filesystem permissive=1 ---- time->Wed Nov 26 18:11:05 2025 type=AVC msg=audit(1764177065.786:3153): avc: denied { create } for pid=164050 comm="bwrap" name="stdin" scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:thumb_tmpfs_t:s0 tclass=lnk_file permissive=1 ---- time->Wed Nov 26 18:11:05 2025 type=AVC msg=audit(1764177065.786:3154): avc: denied { mount } for pid=164050 comm="bwrap" name="/" dev="devpts" ino=1 scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=system_u:object_r:devpts_t:s0 tclass=filesystem permissive=1 ---- time->Wed Nov 26 18:11:05 2025 type=AVC msg=audit(1764177065.786:3155): avc: denied { unmount } for pid=164050 comm="bwrap" scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=system_u:object_r:fs_t:s0 tclass=filesystem permissive=1 ---- time->Wed Nov 26 18:11:05 2025 type=AVC msg=audit(1764177065.787:3156): avc: denied { unmount } for pid=164050 comm="bwrap" scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=system_u:object_r:tmpfs_t:s0 tclass=filesystem permissive=1 ---- time->Fri Nov 28 02:10:54 2025 type=AVC msg=audit(1764292254.452:844): avc: denied { sys_admin } for pid=263447 comm="bwrap" capability=21 scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 ---- time->Fri Nov 28 02:10:54 2025 type=AVC msg=audit(1764292254.454:845): avc: denied { sys_ptrace } for pid=263447 comm="bwrap" capability=19 scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 ---- time->Fri Nov 28 02:10:54 2025 type=AVC msg=audit(1764292254.454:846): avc: denied { setcap } for pid=263447 comm="bwrap" scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tclass=process permissive=1 ---- time->Fri Nov 28 02:10:54 2025 type=AVC msg=audit(1764292254.454:847): avc: denied { setpcap } for pid=263448 comm="bwrap" capability=8 scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 ---- time->Fri Nov 28 02:10:54 2025 type=AVC msg=audit(1764292254.454:848): avc: denied { nlmsg_write } for pid=263448 comm="bwrap" scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tclass=netlink_route_socket permissive=1 ---- time->Fri Nov 28 02:10:54 2025 type=AVC msg=audit(1764292254.454:849): avc: denied { net_admin } for pid=263448 comm="bwrap" capability=12 scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 ---- time->Fri Nov 28 02:10:54 2025 type=AVC msg=audit(1764292254.455:850): avc: denied { mounton } for pid=263448 comm="bwrap" path="/" dev="sdd4" ino=256 scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=system_u:object_r:root_t:s0 tclass=dir permissive=1 ---- time->Fri Nov 28 02:10:54 2025 type=AVC msg=audit(1764292254.455:851): avc: denied { mounton } for pid=263448 comm="bwrap" path="/tmp" dev="tmpfs" ino=1 scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=system_u:object_r:tmp_t:s0 tclass=dir permissive=1 ---- time->Fri Nov 28 02:10:54 2025 type=AVC msg=audit(1764292254.455:852): avc: denied { mount } for pid=263448 comm="bwrap" name="/" dev="tmpfs" ino=1 scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=system_u:object_r:tmpfs_t:s0 tclass=filesystem permissive=1 ---- time->Fri Nov 28 02:10:54 2025 type=AVC msg=audit(1764292254.455:853): avc: denied { mounton } for pid=263448 comm="bwrap" path="/tmp/newroot" dev="tmpfs" ino=2 scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:thumb_tmpfs_t:s0 tclass=dir permissive=1 ---- time->Fri Nov 28 02:10:54 2025 type=AVC msg=audit(1764292254.456:854): avc: denied { remount } for pid=263448 comm="bwrap" scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=system_u:object_r:fs_t:s0 tclass=filesystem permissive=1 ---- time->Fri Nov 28 02:10:54 2025 type=AVC msg=audit(1764292254.457:855): avc: denied { create } for pid=263448 comm="bwrap" name="stdin" scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:thumb_tmpfs_t:s0 tclass=lnk_file permissive=1 ---- time->Fri Nov 28 02:10:54 2025 type=AVC msg=audit(1764292254.457:856): avc: denied { mount } for pid=263448 comm="bwrap" name="/" dev="devpts" ino=1 scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=system_u:object_r:devpts_t:s0 tclass=filesystem permissive=1 ---- time->Fri Nov 28 02:10:54 2025 type=AVC msg=audit(1764292254.458:857): avc: denied { unmount } for pid=263448 comm="bwrap" scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=system_u:object_r:fs_t:s0 tclass=filesystem permissive=1 ---- time->Fri Nov 28 02:10:54 2025 type=AVC msg=audit(1764292254.458:858): avc: denied { unmount } for pid=263448 comm="bwrap" scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=system_u:object_r:tmpfs_t:s0 tclass=filesystem permissive=1 ---- time->Fri Nov 28 02:10:54 2025 type=AVC msg=audit(1764292254.796:859): avc: denied { sys_admin } for pid=263493 comm="bwrap" capability=21 scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 ---- time->Fri Nov 28 02:10:54 2025 type=AVC msg=audit(1764292254.797:860): avc: denied { sys_ptrace } for pid=263493 comm="bwrap" capability=19 scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 ---- time->Fri Nov 28 02:10:54 2025 type=AVC msg=audit(1764292254.797:861): avc: denied { setpcap } for pid=263494 comm="bwrap" capability=8 scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 ---- time->Fri Nov 28 02:10:54 2025 type=AVC msg=audit(1764292254.797:862): avc: denied { net_admin } for pid=263494 comm="bwrap" capability=12 scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 ---- time->Fri Nov 28 02:10:56 2025 type=AVC msg=audit(1764292256.104:863): avc: denied { nlmsg_write } for pid=263648 comm="bwrap" scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tclass=netlink_route_socket permissive=1 ---- time->Fri Nov 28 02:10:56 2025 type=AVC msg=audit(1764292256.105:864): avc: denied { mounton } for pid=263648 comm="bwrap" path="/" dev="sdd4" ino=256 scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=system_u:object_r:root_t:s0 tclass=dir permissive=1 ---- time->Fri Nov 28 02:10:56 2025 type=AVC msg=audit(1764292256.105:865): avc: denied { mount } for pid=263648 comm="bwrap" name="/" dev="tmpfs" ino=1 scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=system_u:object_r:tmpfs_t:s0 tclass=filesystem permissive=1 ---- time->Fri Nov 28 02:10:56 2025 type=AVC msg=audit(1764292256.107:866): avc: denied { unmount } for pid=263648 comm="bwrap" scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=system_u:object_r:tmpfs_t:s0 tclass=filesystem permissive=1 ---- time->Fri Nov 28 02:10:56 2025 type=AVC msg=audit(1764292256.119:867): avc: denied { remount } for pid=263652 comm="bwrap" scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=system_u:object_r:fs_t:s0 tclass=filesystem permissive=1 ---- time->Fri Nov 28 02:10:56 2025 type=AVC msg=audit(1764292256.120:868): avc: denied { unmount } for pid=263652 comm="bwrap" scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=system_u:object_r:fs_t:s0 tclass=filesystem permissive=1 ---- time->Fri Nov 28 02:10:58 2025 type=AVC msg=audit(1764292258.135:871): avc: denied { mounton } for pid=263730 comm="bwrap" path="/tmp" dev="tmpfs" ino=1 scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=system_u:object_r:tmp_t:s0 tclass=dir permissive=1 ---- time->Fri Nov 28 02:10:58 2025 type=AVC msg=audit(1764292258.135:872): avc: denied { mounton } for pid=263730 comm="bwrap" path="/tmp/newroot" dev="tmpfs" ino=2 scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:thumb_tmpfs_t:s0 tclass=dir permissive=1 ---- time->Fri Nov 28 02:10:58 2025 type=AVC msg=audit(1764292258.137:873): avc: denied { create } for pid=263730 comm="bwrap" name="stdin" scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:thumb_tmpfs_t:s0 tclass=lnk_file permissive=1 ---- time->Fri Nov 28 02:10:58 2025 type=AVC msg=audit(1764292258.137:874): avc: denied { mount } for pid=263730 comm="bwrap" name="/" dev="devpts" ino=1 scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=system_u:object_r:devpts_t:s0 tclass=filesystem permissive=1 ---- time->Fri Nov 28 02:11:01 2025 type=AVC msg=audit(1764292261.371:876): avc: denied { setcap } for pid=264012 comm="bwrap" scontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tclass=process permissive=1 Version-Release number of selected component: selinux-policy-targeted-42.16-1.fc43.noarch Additional info: reporter: libreport-2.17.15 reason: SELinux is preventing bwrap from using the 'setcap' accesses on a process. package: selinux-policy-targeted-42.16-1.fc43.noarch component: selinux-policy hashmarkername: setroubleshoot type: libreport kernel: 6.17.8-300.fc43.x86_64 component: selinux-policy
Created attachment 2116511 [details] File: description
Created attachment 2116512 [details] File: os_info
*** This bug has been marked as a duplicate of bug 2415016 ***