Fedora Account System
Red Hat Associate
Red Hat Customer
No noticeable problems, just a SELinux AVC denial. Reproducible: Always Steps to Reproduce: 1. Have Fedora atomic / Silverblue 2. Reboot 3. Log in to GNOME (I think this is necessary) 4. have a look at SELinux denials Actual Results: SELinux alert for AVC denial. Text: > You should report this as a bug. > You can generate a local policy module to allow this access. > Allow this access for now by executing: > # ausearch -c 'chcon' --raw | audit2allow -M my-chcon > # semodule -X 300 -i my-chcon.pp Expected Results: No SELinux denials. Additional Information: Output from SELinux Alert Browser's Detail window: ========== SELinux is preventing chcon from using the mac_admin capability. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that chcon should have the mac_admin capability by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'chcon' --raw | audit2allow -M my-chcon # semodule -X 300 -i my-chcon.pp Additional Information: Source Context system_u:system_r:tuned_t:s0 Target Context system_u:system_r:tuned_t:s0 Target Objects Unknown [ capability2 ] Source chcon Source Path chcon Port <Unknown> Host [redacted] Source RPM Packages Target RPM Packages SELinux Policy RPM selinux-policy-targeted-44.9-1.fc44.noarch Local Policy RPM Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name [redacted] Platform Linux [redacted] 7.2.5-200.fc44.x86_64 #1 SMP PREEMPT_DYNAMIC Fri Sep 11 15:11:05 UTC 2026 x86_64 Alert Count 32 First Seen 2026-09-15 23:00:02 CEST Last Seen 2026-09-20 12:25:36 CEST Local ID 8c0b9d84-9d20-4f2b-96ec-b881a06f70d1 Raw Audit Messages type=AVC msg=audit(1789899936.332:2477): avc: denied { mac_admin } for pid=119523 comm="chcon" capability=33 scontext=system_u:system_r:tuned_t:s0 tcontext=system_u:system_r:tuned_t:s0 tclass=capability2 permissive=0 Hash: chcon,tuned_t,tuned_t,capability2,mac_admin
*** This bug has been marked as a duplicate of bug 2533850 ***