Fedora Account System
Red Hat Associate
Red Hat Customer
Since upgrading to Fedora 45 Silverblue (I am not sure yet if this affects Workstation) there is a LOT of SELinux AVC denials. An example of a small subset (though all save the same target): audit[10360]: AVC avc: denied { read } for pid=10360 comm="systemd-userwor" name="io.systemd.NamespaceResource" dev="tmpfs" ino=1242 scontext=system_u:system_r:systemd_userdbd_t:s0 tcontext=system_u:object_r:systemd_nsresourced_runtime_t:s0 tclass=sock_file permissive=0 audit[1027]: AVC avc: denied { read } for pid=1027 comm="accounts-daemon" name="io.systemd.NamespaceResource" dev="tmpfs" ino=1242 scontext=system_u:system_r:accountsd_t:s0 tcontext=system_u:object_r:systemd_nsresourced_runtime_t:s0 tclass=sock_file permissive=0 audit[977]: AVC avc: denied { read } for pid=977 comm="polkitd" name="io.systemd.NamespaceResource" dev="tmpfs" ino=1242 scontext=system_u:system_r:policykit_t:s0 tcontext=system_u:object_r:systemd_nsresourced_runtime_t:s0 tclass=sock_file permissive=0 I believe they are trying to use a socket at: /run/systemd/io.systemd.NamespaceResource Currently it is unclear exactly what this breaks. Reproducible: Always Steps to Reproduce: 1.Install Fedora Silverblue 45 onto something 2.journalctl -b | grep -i avc Actual Results: Lots of AVC/SELinux errors Expected Results: Not lots of AVC/SELinux errors
Hi, Can you switch the system to permissive mode and gather all denials? setenforce 0 <reproduce> ausearch -i -m avc,user_avc,selinux_err,user_selinux_err -ts boot Does it all happen when the services start?
Thanks for the reply. Some services trigger the message a lot (NetworkManager for example) - so its not just at service start. I'll have to attach the denials as a separate file - as there are lots. See "selinux.txt" Thanks
Created attachment 2159093 [details] SELinux Denials
I can confirm that an upgrade from 44 to 45 on Workstation is affected as well. On a fresh installation, the io.systemd.NamespaceResource denials don’t appear.
FEDORA-2026-d1b11bf36b (selinux-policy-45.21-1.fc45) has been submitted as an update to Fedora 45. https://bodhi.fedoraproject.org/updates/FEDORA-2026-d1b11bf36b
FEDORA-2026-d1b11bf36b has been pushed to the Fedora 45 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-d1b11bf36b` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-d1b11bf36b See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
This update generally works fine and solves the problem, all SELinux AVC denials are gone, except for SELinux is preventing pkla-check-auth from read access on the sock_file io.systemd.NamespaceResource. Additional Information: Source Context system_u:system_r:policykit_auth_t:s0 Target Context system_u:object_r:systemd_nsresourced_runtime_t:s0 Target Objects io.systemd.NamespaceResource [ sock_file ] Source pkla-check-auth Source Path pkla-check-auth Port <Unknown> Host xxxxxxxx Source RPM Packages Target RPM Packages SELinux Policy RPM selinux-policy-targeted-45.21-1.fc45.noarch Local Policy RPM selinux-policy-targeted-45.21-1.fc45.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name xxxxxxxx Platform Linux xxxxxxxx 7.2.9-300.fc45.x86_64 #1 SMP PREEMPT_DYNAMIC Sat Oct 3 16:19:58 UTC 2026 x86_64 Alert Count 334 First Seen 2026-10-07 12:30:21 CEST Last Seen 2026-10-07 12:30:38 CEST Local ID b9282752-9168-478d-9eb6-703f24c7fae5 Raw Audit Messages type=AVC msg=audit(1791369038.930:540): avc: denied { read } for pid=5474 comm="pkla-check-auth" name="io.systemd.NamespaceResource" dev="tmpfs" ino=1296 scontext=system_u:system_r:policykit_auth_t:s0 tcontext=system_u:object_r:systemd_nsresourced_runtime_t:s0 tclass=sock_file permissive=0
thanks, updating
A new one appeared after accessing the system via ssh. Again, it occurs only on upgraded systems : SELinux is preventing sshd-session from read access on the sock_file io.systemd.NamespaceResource. Additional Information: Source Context system_u:system_r:sshd_session_t:s0-s0:c0.c1023 Target Context system_u:object_r:systemd_nsresourced_runtime_t:s0 Target Objects io.systemd.NamespaceResource [ sock_file ] Source sshd-session Source Path sshd-session Port <Unknown> Host xxxxxxxx Source RPM Packages Target RPM Packages SELinux Policy RPM selinux-policy-targeted-45.21-1.fc45.noarch Local Policy RPM selinux-policy-targeted-45.21-1.fc45.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name xxxxxxxx Platform Linux xxxxxxxx 7.2.9-300.fc45.x86_64 #1 SMP PREEMPT_DYNAMIC Sat Oct 3 16:19:58 UTC 2026 x86_64 Alert Count 2 First Seen 2026-10-08 09:52:04 CEST Last Seen 2026-10-08 09:52:04 CEST Local ID 4a85d8f6-d9f7-4f60-ac4a-5b2a8bf55e65 Raw Audit Messages type=AVC msg=audit(1791445924.160:314): avc: denied { read } for pid=2793 comm="sshd-session" name="io.systemd.NamespaceResource" dev="tmpfs" ino=1296 scontext=system_u:system_r:sshd_session_t:s0-s0:c0.c1023 tcontext=system_u:object_r:systemd_nsresourced_runtime_t:s0 tclass=sock_file permissive=0
*** Bug 2548363 has been marked as a duplicate of this bug. ***
Hi Zdenek ! Just want to let you know that the new version 45.22-1.fc45 seems to have solved the problem. No denials after a reboot of the system. Thank you !
Thanks for the feedback, Christian.