Bug 2468436 - SELinux is preventing /usr/bin/pcscd from 'search' accesses on the directory /sys/fs/cgroup/user.slice/user-1000.slice/user/app.slice/app-org.chromium.Chromium-388102.scope.
Summary: SELinux is preventing /usr/bin/pcscd from 'search' accesses on the directory ...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 44
Hardware: x86_64
OS: Linux
unspecified
unspecified
Target Milestone: ---
Assignee: Zdenek Pytela
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: abrt_hash:785db81df86ad7b18c83dc00ed9...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-05-09 03:39 UTC by Mr Beedell, Roke Julian Lockhart
Modified: 2026-07-30 01:17 UTC (History)
8 users (show)

Fixed In Version: selinux-policy-44.5-1.fc44
Clone Of:
Environment:
Last Closed: 2026-07-30 01:17:29 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)
File: description (3.83 KB, text/plain)
2026-05-09 03:39 UTC, Mr Beedell, Roke Julian Lockhart
no flags Details
File: os_info (712 bytes, text/plain)
2026-05-09 03:39 UTC, Mr Beedell, Roke Julian Lockhart
no flags Details

Description Mr Beedell, Roke Julian Lockhart 2026-05-09 03:39:00 UTC
Description of problem:
I don't know what caused it.
SELinux is preventing /usr/bin/pcscd from 'search' accesses on the directory /sys/fs/cgroup/user.slice/user-1000.slice/user/app.slice/app-org.chromium.Chromium-388102.scope.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that pcscd should be allowed search access on the app-org.chromium.Chromium-388102.scope directory by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'pcscd' --raw | audit2allow -M my-pcscd
# semodule -X 300 -i my-pcscd.pp

Additional Information:
Source Context                system_u:system_r:pcscd_t:s0
Target Context                system_u:object_r:cgroup_t:s0
Target Objects                /sys/fs/cgroup/user.slice/user-
                              1000.slice/user/app.slice/app-
                              org.chromium.Chromium-388102.scope [ dir ]
Source                        pcscd
Source Path                   /usr/bin/pcscd
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           pcsc-lite-2.4.1-2.fc44.x86_64
Target RPM Packages           
SELinux Policy RPM            selinux-policy-targeted-44.1-1.fc44.noarch
Local Policy RPM              selinux-policy-targeted-44.1-1.fc44.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Permissive
Host Name                     (removed)
Platform                      Linux (removed) 6.19.14-300.fc44.x86_64 #1 SMP
                              PREEMPT_DYNAMIC Thu Apr 23 15:17:50 UTC 2026
                              x86_64
Alert Count                   360
First Seen                    2026-05-01 15:49:55 BST
Last Seen                     2026-05-09 03:40:21 BST
Local ID                      3e4a5baf-fc5c-4a69-ab1a-310dce39ced7

Raw Audit Messages
type=AVC msg=audit(1778294421.382:11001): avc:  denied  { search } for  pid=3195 comm="pcscd" name="/" dev="cgroup2" ino=1 scontext=system_u:system_r:pcscd_t:s0 tcontext=system_u:object_r:cgroup_t:s0 tclass=dir permissive=1


type=AVC msg=audit(1778294421.382:11001): avc:  denied  { search } for  pid=3195 comm="pcscd" name="user.slice" dev="cgroup2" ino=1627 scontext=system_u:system_r:pcscd_t:s0 tcontext=system_u:object_r:cgroup_t:s0 tclass=dir permissive=1


type=AVC msg=audit(1778294421.382:11001): avc:  denied  { search } for  pid=3195 comm="pcscd" name="user-1000.slice" dev="cgroup2" ino=6528 scontext=system_u:system_r:pcscd_t:s0 tcontext=system_u:object_r:cgroup_t:s0 tclass=dir permissive=1


type=AVC msg=audit(1778294421.382:11001): avc:  denied  { search } for  pid=3195 comm="pcscd" name="user" dev="cgroup2" ino=6689 scontext=system_u:system_r:pcscd_t:s0 tcontext=system_u:object_r:cgroup_t:s0 tclass=dir permissive=1


type=AVC msg=audit(1778294421.382:11001): avc:  denied  { search } for  pid=3195 comm="pcscd" name="app.slice" dev="cgroup2" ino=6805 scontext=system_u:system_r:pcscd_t:s0 tcontext=unconfined_u:object_r:cgroup_t:s0 tclass=dir permissive=1


type=SYSCALL msg=audit(1778294421.382:11001): arch=x86_64 syscall=name_to_handle_at success=yes exit=0 a0=ffffff9c a1=7fb5d4007520 a2=7fb5d4009630 a3=7fb5ee1342dc items=1 ppid=1 pid=3195 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=pcscd exe=/usr/bin/pcscd subj=system_u:system_r:pcscd_t:s0 key=(null)

type=CWD msg=audit(1778294421.382:11001): cwd=/

type=PATH msg=audit(1778294421.382:11001): item=0 name=/sys/fs/cgroup/user.slice/user-1000.slice/user/app.slice/app-org.chromium.Chromium-388102.scope inode=140305 dev=00:1d mode=040755 ouid=1000 ogid=1000 rdev=00:00 obj=unconfined_u:object_r:cgroup_t:s0 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0

Hash: pcscd,pcscd_t,cgroup_t,dir,search

Version-Release number of selected component:
selinux-policy-targeted-44.1-1.fc44.noarch

Additional info:
reporter:       libreport-2.17.15
reason:         SELinux is preventing /usr/bin/pcscd from 'search' accesses on the directory /sys/fs/cgroup/user.slice/user-1000.slice/user/app.slice/app-org.chromium.Chromium-388102.scope.
package:        selinux-policy-targeted-44.1-1.fc44.noarch
component:      selinux-policy
hashmarkername: setroubleshoot
type:           libreport
kernel:         6.19.14-300.fc44.x86_64
event_log:      2026-05-09-04:35:47> Looking for similar problems in bugzilla
comment:        I don't know what caused it.
component:      selinux-policy

Comment 1 Mr Beedell, Roke Julian Lockhart 2026-05-09 03:39:02 UTC
Created attachment 2140436 [details]
File: description

Comment 2 Mr Beedell, Roke Julian Lockhart 2026-05-09 03:39:04 UTC
Created attachment 2140437 [details]
File: os_info

Comment 3 Mr Beedell, Roke Julian Lockhart 2026-05-09 03:39:30 UTC
Blame https://github.com/abrt/gnome-abrt/issues/381#issue-3138313547 for the OS change.

Comment 4 Fedora Update System 2026-07-28 09:43:59 UTC
FEDORA-2026-6433e648bb (selinux-policy-44.5-1.fc44) has been submitted as an update to Fedora 44.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-6433e648bb

Comment 5 Fedora Update System 2026-07-29 01:49:06 UTC
FEDORA-2026-6433e648bb has been pushed to the Fedora 44 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-6433e648bb`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-6433e648bb

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 6 Fedora Update System 2026-07-30 01:17:29 UTC
FEDORA-2026-6433e648bb (selinux-policy-44.5-1.fc44) has been pushed to the Fedora 44 stable repository.
If problem still persists, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.