Fedora Account System
Red Hat Associate
Red Hat Customer
***** Plugin catchall (100. confidence) suggests ************************** If you believe that systemd-userwork should be allowed read access on the 8 sock_file by default. Then You should report this as a bug. If you are certain this access is legitimate and not an intrusion attempt, you can generate a local policy module to allow it. Custom policy modules are not supported as they may weaken the system policy and expose the system to security vulnerabilities. # ausearch -c 'systemd-userwor' --raw | audit2allow -M my-systemduserwor # semodule -X 300 -i my-systemduserwor.pp Additional Information: Source Context system_u:system_r:systemd_userdbd_t:s0 Target Context system_u:object_r:xdm_var_run_t:s0 Target Objects /proc/self/fd/8 [ sock_file ] Source systemd-userwor Source Path /usr/lib/systemd/systemd-userwork Port <Unknown> Host <Unknown> Source RPM Packages systemd-262~rc1-4.fc45.x86_64 Target RPM Packages SELinux Policy RPM selinux-policy-targeted-45.15-2.fc45.noarch Local Policy RPM selinux-policy-targeted-45.15-2.fc45.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name lslebodn-thinkpadp1gen7.tpb.csb Platform Linux lslebodn-thinkpadp1gen7.tpb.csb 7.2.3-300.fc45.x86_64 #1 SMP PREEMPT_DYNAMIC Wed Sep 2 15:40:51 UTC 2026 x86_64 Alert Count 117 First Seen 2026-09-07 08:57:43 CEST Last Seen 2026-09-07 09:12:45 CEST Local ID 514146a7-3315-434c-9b1b-c3b6a2cd0744 Raw Audit Messages type=AVC msg=audit(1788765165.676:2011): avc: denied { read } for pid=7273 comm="systemd-userwor" name="org.gnome.DisplayManager" dev="tmpfs" ino=4177 scontext=system_u:system_r:systemd_userdbd_t:s0 tcontext=system_u:object_r:xdm_var_run_t:s0 tclass=sock_file permissive=0 type=SYSCALL msg=audit(1788765165.676:2011): arch=x86_64 syscall=getxattr success=no exit=EACCES a0=7ffd8ea05c50 a1=7f4af7e9e5ff a2=55e170623390 a3=67 items=1 ppid=3163 pid=7273 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=systemd-userwor exe=/usr/lib/systemd/systemd-userwork subj=system_u:system_r:systemd_userdbd_t:s0 key=(null) ARCH=x86_64 SYSCALL=getxattr AUID=unset UID=root GID=root EUID=root SUID=root FSUID=root EGID=root SGID=root FSGID=root type=CWD msg=audit(1788765165.676:2011): cwd=/ type=PATH msg=audit(1788765165.676:2011): item=0 name=/proc/self/fd/8 inode=4177 dev=00:1d mode=0140666 ouid=0 ogid=0 rdev=00:00 obj=system_u:object_r:xdm_var_run_t:s0 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0 OUID=root OGID=root Hash: systemd-userwor,systemd_userdbd_t,xdm_var_run_t,sock_file,read Reproducible: Always Additional Information: AVCs are introduced by new systemd-262~rc1-4.fc45.x86_64. And they are very similar for services root@lslebodn-thinkpadp1gen7:~# grep type=AVC /tmp/sealert.log type=AVC msg=audit(1788764269.465:1862): avc: denied { read } for pid=6077 comm="pkla-check-auth" name="org.gnome.DisplayManager" dev="tmpfs" ino=4177 scontext=system_u:system_r:policykit_auth_t:s0 tcontext=system_u:object_r:xdm_var_run_t:s0 tclass=sock_file permissive=0 type=AVC msg=audit(1788764270.87:1872): avc: denied { read } for pid=6077 comm="pkla-check-auth" name="io.systemd.DynamicUser" dev="tmpfs" ino=1915 scontext=system_u:system_r:policykit_auth_t:s0 tcontext=system_u:object_r:systemd_userdbd_runtime_t:s0 tclass=sock_file permissive=0 type=AVC msg=audit(1788765165.676:2011): avc: denied { read } for pid=7273 comm="systemd-userwor" name="org.gnome.DisplayManager" dev="tmpfs" ino=4177 scontext=system_u:system_r:systemd_userdbd_t:s0 tcontext=system_u:object_r:xdm_var_run_t:s0 tclass=sock_file permissive=0 type=AVC msg=audit(1788764269.446:1846): avc: denied { read } for pid=3542 comm="polkitd" name="org.gnome.DisplayManager" dev="tmpfs" ino=4177 scontext=system_u:system_r:policykit_t:s0 tcontext=system_u:object_r:xdm_var_run_t:s0 tclass=sock_file permissive=0 type=AVC msg=audit(1788764269.446:1851): avc: denied { read } for pid=3542 comm="polkitd" name="io.systemd.DynamicUser" dev="tmpfs" ino=1915 scontext=system_u:system_r:policykit_t:s0 tcontext=system_u:object_r:systemd_userdbd_runtime_t:s0 tclass=sock_file permissive=0 type=AVC msg=audit(1788764785.275:1974): avc: denied { read } for pid=3754 comm="accounts-daemon" name="org.gnome.DisplayManager" dev="tmpfs" ino=4177 scontext=system_u:system_r:accountsd_t:s0 tcontext=system_u:object_r:xdm_var_run_t:s0 tclass=sock_file permissive=0 type=AVC msg=audit(1788764785.275:1978): avc: denied { read } for pid=3754 comm="accounts-daemon" name="io.systemd.DynamicUser" dev="tmpfs" ino=1915 scontext=system_u:system_r:accountsd_t:s0 tcontext=system_u:object_r:systemd_userdbd_runtime_t:s0 tclass=sock_file permissive=0 type=AVC msg=audit(1788764267.328:1191): avc: denied { read } for pid=3826 comm="colord" name="org.gnome.DisplayManager" dev="tmpfs" ino=4177 scontext=system_u:system_r:colord_t:s0 tcontext=system_u:object_r:xdm_var_run_t:s0 tclass=sock_file permissive=0 type=AVC msg=audit(1788764267.329:1195): avc: denied { read } for pid=3826 comm="colord" name="io.systemd.DynamicUser" dev="tmpfs" ino=1915 scontext=system_u:system_r:colord_t:s0 tcontext=system_u:object_r:systemd_userdbd_runtime_t:s0 tclass=sock_file permissive=0 type=AVC msg=audit(1788764267.337:1207): avc: denied { read } for pid=3540 comm="NetworkManager" name="org.gnome.DisplayManager" dev="tmpfs" ino=4177 scontext=system_u:system_r:NetworkManager_t:s0 tcontext=system_u:object_r:xdm_var_run_t:s0 tclass=sock_file permissive=0 type=AVC msg=audit(1788764267.337:1211): avc: denied { read } for pid=3540 comm="NetworkManager" name="io.systemd.DynamicUser" dev="tmpfs" ino=1915 scontext=system_u:system_r:NetworkManager_t:s0 tcontext=system_u:object_r:systemd_userdbd_runtime_t:s0 tclass=sock_file permissive=0 type=AVC msg=audit(1788764774.110:1933): avc: denied { read } for pid=7107 comm="sshd-session" name="org.gnome.DisplayManager" dev="tmpfs" ino=4177 scontext=system_u:system_r:sshd_session_t:s0-s0:c0.c1023 tcontext=system_u:object_r:xdm_var_run_t:s0 tclass=sock_file permissive=0 type=AVC msg=audit(1788764774.110:1937): avc: denied { read } for pid=7107 comm="sshd-session" name="io.systemd.DynamicUser" dev="tmpfs" ino=1915 scontext=system_u:system_r:sshd_session_t:s0-s0:c0.c1023 tcontext=system_u:object_r:systemd_userdbd_runtime_t:s0 tclass=sock_file permissive=0 All of them sems to be the same root case based on syscall `arch=x86_64 syscall=getxattr success=no exit=EACCES`
AVC in permissive mode type=PROCTITLE msg=audit(09/07/2026 09:30:53.648:2081) : proctitle=/usr/bin/NetworkManager --no-daemon type=PATH msg=audit(09/07/2026 09:30:53.648:2081) : item=0 name=/proc/self/fd/37 inode=4177 dev=00:1d mode=socket,666 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:xdm_var_run_t:s 0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=CWD msg=audit(09/07/2026 09:30:53.648:2081) : cwd=/ type=SYSCALL msg=audit(09/07/2026 09:30:53.648:2081) : arch=x86_64 syscall=getxattr success=no exit=ENODATA(No data available) a0=0x7ffd530d5ac0 a1=0x7ff93047ddfe a2=0x5584b0851650 a3=0x 67 items=1 ppid=1 pid=8867 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=NetworkManager exe=/usr/bin/NetworkManager subj=system_u:system_r:NetworkManager_t:s0 key=(null) type=AVC msg=audit(09/07/2026 09:30:53.648:2081) : avc: denied { read } for pid=8867 comm=NetworkManager name=org.gnome.DisplayManager dev="tmpfs" ino=4177 scontext=system_u:system_r: NetworkManager_t:s0 tcontext=system_u:object_r:xdm_var_run_t:s0 tclass=sock_file permissive=1 ---- type=PROCTITLE msg=audit(09/07/2026 09:30:53.648:2082) : proctitle=/usr/bin/NetworkManager --no-daemon type=PATH msg=audit(09/07/2026 09:30:53.648:2082) : item=0 name=/proc/self/fd/40 inode=4033 dev=00:1d mode=socket,666 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:systemd_userdbd _runtime_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=CWD msg=audit(09/07/2026 09:30:53.648:2082) : cwd=/ type=SYSCALL msg=audit(09/07/2026 09:30:53.648:2082) : arch=x86_64 syscall=getxattr success=yes exit=10 a0=0x7ffd530d5ac0 a1=0x7ff93047ddfe a2=0x5584b0851650 a3=0x67 items=1 ppid=1 pid=8 867 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=NetworkManager exe=/usr/bin/NetworkManager subj=system_u:system_r :NetworkManager_t:s0 key=(null) type=AVC msg=audit(09/07/2026 09:30:53.648:2082) : avc: denied { read } for pid=8867 comm=NetworkManager name=io.systemd.Home dev="tmpfs" ino=4033 scontext=system_u:system_r:NetworkMa nager_t:s0 tcontext=system_u:object_r:systemd_userdbd_runtime_t:s0 tclass=sock_file permissive=1
We have a bunch of sockets or symlinks to sockets under /run/systemd/userdb/: [fedora@rawhide ~]$ ls -lZ /run/systemd/userdb/ total 0 lrwxrwxrwx. 1 root root system_u:object_r:systemd_userdbd_runtime_t:s0 42 Sep 5 15:51 io.systemd.DropIn -> /run/systemd/userdb/io.systemd.Multiplexer srw-rw-rw-. 1 root root system_u:object_r:systemd_userdbd_runtime_t:s0 0 Sep 5 15:51 io.systemd.DynamicUser srw-rw-rw-. 1 root root system_u:object_r:systemd_userdbd_runtime_t:s0 0 Sep 5 15:51 io.systemd.Multiplexer lrwxrwxrwx. 1 root root system_u:object_r:systemd_userdbd_runtime_t:s0 42 Sep 5 15:51 io.systemd.NameServiceSwitch -> /run/systemd/userdb/io.systemd.Multiplexer lrwxrwxrwx. 1 root root system_u:object_r:systemd_userdbd_runtime_t:s0 41 Sep 5 15:51 io.systemd.NamespaceResource -> /run/systemd/io.systemd.NamespaceResource srw-rw-rw- 1 root root system_u:object_r:xdm_var_run_t:s0 0 Sep 3 10:05 /run/systemd/userdb/org.gnome.DisplayManager They are used for namespace resolution. In /etc/nsswitch.conf we have 'passwd: files systemd', so anything that resolves users will use nss-systemd. If systemd-userdbd.service is running, nss-systemd talks to it, but if it's not, there's a series of fallbacks to talk to various resolution sources directly. In general, this should all be allowed, in particular scontext=system_u:system_r:systemd_userdbd_t:s0 needs to talk to all those sockets. They are systemd_userdbd_runtime_t and xdm_var_run_t, but maybe there will be others provided by other services.
Thanks, this is a known technical debt in selinux-policy.
*** Bug 2531046 has been marked as a duplicate of this bug. ***
*** Bug 2530541 has been marked as a duplicate of this bug. ***
*** Bug 2531180 has been marked as a duplicate of this bug. ***
So the technical debt I was thinking of was actually addressed long ago, it rather seems to be a feature of some new systemd - clients now also need to read account providers' pid socket files.
I can see the PR si merged https://github.com/fedora-selinux/selinux-policy/pull/3405/changes But I saw couple of more similar AVCs for systemd-logind type=PROCTITLE msg=audit(09/11/2026 12:07:23.885:405) : proctitle=/usr/lib/systemd/systemd-logind type=PATH msg=audit(09/11/2026 12:07:23.885:405) : item=0 name=/proc/self/fd/61 inode=3878 dev=00:1d mode=socket,666 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:xdm_var_run_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=CWD msg=audit(09/11/2026 12:07:23.885:405) : cwd=/ type=SYSCALL msg=audit(09/11/2026 12:07:23.885:405) : arch=x86_64 syscall=getxattr success=no exit=EACCES(Permission denied) a0=0x7fffdd83b7b0 a1=0x7f74d3c51dfe a2=0x56092ab86f60 a3=0x67 items=1 ppid=1 pid=3616 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=systemd-logind exe=/usr/lib/systemd/systemd-logind subj=system_u:system_r:systemd_logind_t:s0 key=(null) type=AVC msg=audit(09/11/2026 12:07:23.885:405) : avc: denied { read } for pid=3616 comm=systemd-logind name=org.gnome.DisplayManager dev="tmpfs" ino=3878 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:object_r:xdm_var_run_t:s0 tclass=sock_file permissive=0 ---- type=PROCTITLE msg=audit(09/11/2026 12:07:23.886:406) : proctitle=/usr/lib/systemd/systemd-logind type=PATH msg=audit(09/11/2026 12:07:23.886:406) : item=0 name=/proc/self/fd/64 inode=3725 dev=00:1d mode=socket,666 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:systemd_userdbd_runtime_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=CWD msg=audit(09/11/2026 12:07:23.886:406) : cwd=/ type=SYSCALL msg=audit(09/11/2026 12:07:23.886:406) : arch=x86_64 syscall=getxattr success=no exit=EACCES(Permission denied) a0=0x7fffdd83b7b0 a1=0x7f74d3c51dfe a2=0x56092ab86f60 a3=0x67 items=1 ppid=1 pid=3616 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=systemd-logind exe=/usr/lib/systemd/systemd-logind subj=system_u:system_r:systemd_logind_t:s0 key=(null) type=AVC msg=audit(09/11/2026 12:07:23.886:406) : avc: denied { read } for pid=3616 comm=systemd-logind name=io.systemd.Home dev="tmpfs" ino=3725 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:object_r:systemd_userdbd_runtime_t:s0 tclass=sock_file permissive=0 ---- type=PROCTITLE msg=audit(09/11/2026 12:07:23.886:407) : proctitle=/usr/lib/systemd/systemd-logind type=PATH msg=audit(09/11/2026 12:07:23.886:407) : item=0 name=/proc/self/fd/65 inode=3719 dev=00:1d mode=socket,666 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:systemd_userdbd_runtime_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=CWD msg=audit(09/11/2026 12:07:23.886:407) : cwd=/ type=SYSCALL msg=audit(09/11/2026 12:07:23.886:407) : arch=x86_64 syscall=getxattr success=no exit=EACCES(Permission denied) a0=0x7fffdd83b7b0 a1=0x7f74d3c51dfe a2=0x56092ab86f60 a3=0x67 items=1 ppid=1 pid=3616 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=systemd-logind exe=/usr/lib/systemd/systemd-logind subj=system_u:system_r:systemd_logind_t:s0 key=(null) type=AVC msg=audit(09/11/2026 12:07:23.886:407) : avc: denied { read } for pid=3616 comm=systemd-logind name=io.systemd.Machine dev="tmpfs" ino=3719 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:object_r:systemd_userdbd_runtime_t:s0 tclass=sock_file permissive=0 ---- type=PROCTITLE msg=audit(09/11/2026 12:07:23.887:408) : proctitle=/usr/lib/systemd/systemd-logind type=PATH msg=audit(09/11/2026 12:07:23.887:408) : item=0 name=/proc/self/fd/66 inode=1735 dev=00:1d mode=socket,666 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:systemd_userdbd_runtime_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=CWD msg=audit(09/11/2026 12:07:23.887:408) : cwd=/ type=SYSCALL msg=audit(09/11/2026 12:07:23.887:408) : arch=x86_64 syscall=getxattr success=no exit=EACCES(Permission denied) a0=0x7fffdd83b7b0 a1=0x7f74d3c51dfe a2=0x56092ab86f60 a3=0x67 items=1 ppid=1 pid=3616 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=systemd-logind exe=/usr/lib/systemd/systemd-logind subj=system_u:system_r:systemd_logind_t:s0 key=(null) type=AVC msg=audit(09/11/2026 12:07:23.887:408) : avc: denied { read } for pid=3616 comm=systemd-logind name=io.systemd.Multiplexer dev="tmpfs" ino=1735 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:object_r:systemd_userdbd_runtime_t:s0 tclass=sock_file permissive=0 ---- type=PROCTITLE msg=audit(09/11/2026 12:07:23.887:409) : proctitle=/usr/lib/systemd/systemd-logind type=PATH msg=audit(09/11/2026 12:07:23.887:409) : item=0 name=/proc/self/fd/67 inode=1695 dev=00:1d mode=socket,666 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:systemd_userdbd_runtime_t:s0 nametype=NORMAL cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=CWD msg=audit(09/11/2026 12:07:23.887:409) : cwd=/ type=SYSCALL msg=audit(09/11/2026 12:07:23.887:409) : arch=x86_64 syscall=getxattr success=no exit=EACCES(Permission denied) a0=0x7fffdd83b7b0 a1=0x7f74d3c51dfe a2=0x56092ab86f60 a3=0x67 items=1 ppid=1 pid=3616 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=systemd-logind exe=/usr/lib/systemd/systemd-logind subj=system_u:system_r:systemd_logind_t:s0 key=(null) type=AVC msg=audit(09/11/2026 12:07:23.887:409) : avc: denied { read } for pid=3616 comm=systemd-logind name=io.systemd.DynamicUser dev="tmpfs" ino=1695 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=system_u:object_r:systemd_userdbd_runtime_t:s0 tclass=sock_file permissive=0 root@lslebodn-thinkpadp1gen7:~# ausearch -m AVC,USER_AVC,SELINUX_ERR,USER_SELINUX_ERR -i -ts today | audit2allow I have a feeling they might be fixed by ``` diff --git a/policy/modules/system/authlogin.te b/policy/modules/system/authlogin.te index d5994631fa..7c968167ae 100644 --- a/policy/modules/system/authlogin.te +++ b/policy/modules/system/authlogin.te @@ -576,6 +576,7 @@ optional_policy(` optional_policy(` systemd_homed_stream_connect(nsswitch_domain) + systemd_read_userdbd_runtime_sock_files(nsswitch_domain) ') optional_policy(` @@ -588,6 +589,7 @@ optional_policy(` ') optional_policy(` + xserver_read_xdm_pid_sock_files(nsswitch_domain) xserver_stream_connect_xdm(nsswitch_domain) ') ``` But sharing them just in case
FEDORA-2026-2dbcddc9d9 (selinux-policy-45.17-1.fc45) has been submitted as an update to Fedora 45. https://bodhi.fedoraproject.org/updates/FEDORA-2026-2dbcddc9d9
FEDORA-2026-2dbcddc9d9 has been pushed to the Fedora 45 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-2dbcddc9d9` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-2dbcddc9d9 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2026-2dbcddc9d9 (selinux-policy-45.17-1.fc45) has been pushed to the Fedora 45 stable repository. If problem still persists, please make note of it in this bug report.