Bug 2525821 - SELinux is preventing systemd-tmpfile from getattr access on the directory /proc/pressure
Summary: SELinux is preventing systemd-tmpfile from getattr access on the directory /p...
Keywords:
Status: ASSIGNED
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 44
Hardware: x86_64
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: Zdenek Pytela
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-08-29 01:25 UTC by buubuu5456
Modified: 2026-08-31 09:25 UTC (History)
7 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Type: ---
Embargoed:


Attachments (Terms of Use)

Description buubuu5456 2026-08-29 01:25:27 UTC
Additional Information:
Source Context system_u:system_r:systemd_tmpfiles_t:s0
Target Context system_u:object_r:proc_psi_t:s0
Target Objects /proc/pressure [ dir ]
Source systemd-tmpfile
Source Path systemd-tmpfile
Port
Host localhost
Source RPM Packages
Target RPM Packages
SELinux Policy RPM selinux-policy-targeted-44.7-1.fc44.noarch
Local Policy RPM selinux-policy-targeted-44.7-1.fc44.noarch
Selinux Enabled True
Policy Type targeted
Enforcing Mode Enforcing
Host Name localhost
Platform Linux localhost 7.1.10-200.fc44.x86_64 #1 SMP
PREEMPT_DYNAMIC Sun Aug 23 16:15:11 UTC 2026
x86_64
Alert Count 8
First Seen 2026-08-26 22:46:48 EDT
Last Seen 2026-08-28 20:29:22 EDT
Local ID ed1118dc-12f5-45a5-bec5-c3bcebadbc0a

Raw Audit Messages
type=AVC msg=audit(1787963362.970:201): avc: denied { getattr } for pid=6078 comm=“systemd-tmpfile” path=“/proc/pressure” dev=“proc” ino=4026532069 scontext=system_u:system_r:systemd_tmpfiles_t:s0 tcontext=system_u:object_r:proc_psi_t:s0 tclass=dir permissive=0

Hash: systemd-tmpfile,systemd_tmpfiles_t,proc_psi_t,dir,getattr

Reproducible: Always

Steps to Reproduce:
1. Boot
2. Check sealert -l "*"
3.


Expected Results:
Not having an sealert every boot

Additional Information:
Doesn't seem to be breaking anything, systemd-tmpfile services are not failing or throwing errors.


Note You need to log in before you can comment on or make changes to this bug.