Fedora 45 SELinux Problems

Ask Fedora
,
1

Seems to be loads of AVC denials in the logs for Fedora 45, at least on Silverblue anyway…

Nearly all of them relate to services not having access to /run/systemd/io.systemd.NamespaceResource and services triggering it include a load of systemd services, NetworkManager, etc.

just doing journalctl -b | grep -i avc will show loads.

I’ve reproduced that on standard vanilla Fedora Silverblue (45)

There is also denials for the systemd tpm2 services, being disallowed to open a log file and some other stuff. This seems to have been around since Fedora 44 though but with the latest systemd this could be contributing to those services failing to work properly. This is using bootc and a UKI though, might be a little off the standard Fedora track.

2

Please report as bugs in the Fedora bug tracker to get the attention of the selinux maintainers.

See Making sure you're not a bot!

3

Thanks, thats the plan since I can’t find anything else out about it. Be good to know if its not just me (unlikely) and if or not it happens on Fedora Workstation (ie not Silverblue) as well before raising it

4

It’s not worth waiting to see if others have the bug.

After all it’s a bug, the sooner you report it the sooner a maintainer has a chance to consider the issue.

5

When you report a bug you should check for duplicates. My experience has been that most bugs have already been reported by the time I determine a problem stems from a bug.

6

I have raised a bug: 2541947 – Lots of AVC denials for access to io.systemd.NamespaceResource tmpfs

There is also an existing bug for the TPM2 SELinux issues (or at least a part of them): 2541481 – AVC denials with systemd-pcrlogin@.service attempting to record logins into TPM NvPCR

Just FYI to anyone else who ends up on this thread

7

Just want to let you know that a standard Workstation upgrade is affected as well.

On a fresh installation, the io.systemd.NamespaceResource denials don’t happen.