Fedora Account System
Red Hat Associate
Red Hat Customer
When trying to connect to a GNOME remote desktop headless session, the server reports the following error and the connection fails: Jul 27 12:53:09 pi4 setroubleshoot[554411]: SELinux is preventing sshd-session from name_connect access on the tcp_socket port 3389. For complete SELinux messages run: sealert -l a714c98d-d8e3-4b8a-8d8a-3fc746ea2779 Jul 27 12:53:10 pi4 audit[1]: SERVICE_STOP pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=dbus-:1.2-org.fedoraproject.SetroubleshootPrivileged@6 comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success' Jul 27 12:53:09 pi4 setroubleshoot[554411]: SELinux is preventing sshd-session from name_connect access on the tcp_socket port 3389. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that sshd-session should be allowed name_connect access on the port 3389 tcp_socket by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'sshd-session' --raw | audit2allow -M my-sshdsession # semodule -X 300 -i my-sshdsession.pp Jul 27 12:53:11 pi4 gnome-remote-desktop-daemon[551917]: [12:53:11:180] [551917:00086bed] [ERROR][com.freerdp.core.peer] - [rdp_set_error_info]: ERRINFO_CB_CONNECTION_CANCELLED [0x00010409] Reproducible: Always Steps to Reproduce: 1. Enable gnome-remote-desktop (not desktop sharing) over RDP 2. Connect from client using Gnome Connections or Remmina RDP 3. Actual Results: Connection dies after a few seconds. Expected Results: New remote desktop session is created and accessible via RDP (port 3389).
Please provide unfiltered avc denials and, if possible, enable full auditing first: https://fedoraproject.org/wiki/SELinux/Debugging#Enable_full_auditing
The problem still exists with selinux-policy-44.8-1.fc44.noarch. This is the message caused by a user who uses vs code. type=AVC msg=audit(28.08.2026 11:58:43.276:30506) : avc: denied { name_connect } for pid=1879765 comm=sshd-session dest=46369 scontext=system_u:system_r:sshd_session_t:s0-s0:c0.c1023 tcontext=system_u:object_r:ephemeral_port_t:s0 tclass=tcp_socket permissive=0 I have tried "ssh -D 39104 myuser", then configured firefox using SOCKS-Host with this port for testing. I have used https://www.redhat.com/en/blog/ssh-dynamic-port-forwarding to get an impression how I can test this. type=PROCTITLE msg=audit(28.08.2026 13:54:06.506:30838) : proctitle=sshd-session: myuser@pts/2 type=SOCKADDR msg=audit(28.08.2026 13:54:06.506:30838) : saddr={ saddr_fam=inet6 laddr=2001:7c0:2041:8::19 lport=443 } type=SYSCALL msg=audit(28.08.2026 13:54:06.506:30838) : arch=x86_64 syscall=connect success=no exit=EACCES(Keine Berechtigung) a0=0x6 a1=0x557e14384be0 a2=0x1c a3=0x0 items=0 ppid=1884002 pid=1884005 auid=myuser uid=myuser gid=myuser euid=myuser suid=myuser fsuid=myuser egid=myuser sgid=myuser fsgid=myuser tty=(none) ses=99 comm=sshd-session exe=/usr/libexec/openssh/sshd-session subj=system_u:system_r:sshd_session_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(28.08.2026 13:54:06.506:30838) : avc: denied { name_connect } for pid=1884005 comm=sshd-session dest=443 scontext=system_u:system_r:sshd_session_t:s0-s0:c0.c1023 tcontext=system_u:object_r:http_port_t:s0 tclass=tcp_socket permissive=0 A temporary workaround is to enable sebool nis_enabled. setsebool nis_enabled on
FEDORA-2026-1413268892 (selinux-policy-44.9-1.fc44) has been submitted as an update to Fedora 44. https://bodhi.fedoraproject.org/updates/FEDORA-2026-1413268892
FEDORA-2026-1413268892 has been pushed to the Fedora 44 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-1413268892` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-1413268892 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2026-1413268892 (selinux-policy-44.9-1.fc44) has been pushed to the Fedora 44 stable repository. If problem still persists, please make note of it in this bug report.