"SELinux has detected a problem." with "systemd-user-ru" at every boot

pogodemon · April 20, 2025, 9:38pm

I have freshly installed Fedora 42 KDE Plasma Desktop Edition on my laptop a few days ago. After a while, I started getting a notification from SELinux Troubleshooter at every boot. Though, it disappears so fast that I cannot quite catch it and it does not persist in history.

Opening the app itself, I get the same three alerts each time:

First:

SELinux is preventing systemd-user-ru from write access on the directory dconf.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that systemd-user-ru should be allowed write access on the dconf directory by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'systemd-user-ru' --raw | audit2allow -M my-systemduserru
# semodule -X 300 -i my-systemduserru.pp

Additional Information:
Source Context                system_u:system_r:systemd_user_runtimedir_t:s0
Target Context                system_u:object_r:config_home_t:s0
Target Objects                dconf [ dir ]
Source                        systemd-user-ru
Source Path                   systemd-user-ru
Port                          <Unknown>
Host                          Hostname
Source RPM Packages           
Target RPM Packages           
SELinux Policy RPM            selinux-policy-targeted-41.37-1.fc42.noarch
Local Policy RPM              selinux-policy-targeted-41.37-1.fc42.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     Hostname
Platform                      Linux Hostname 6.14.2-300.fc42.x86_64 #1 SMP
                              PREEMPT_DYNAMIC Thu Apr 10 21:50:55 UTC 2025
                              x86_64
Alert Count                   1
First Seen                    2025-04-21 01:19:14 +04
Last Seen                     2025-04-21 01:19:14 +04
Local ID                      c690a6d5-af46-48f8-a547-353296905416

Raw Audit Messages
type=AVC msg=audit(1745183954.210:189): avc:  denied  { write } for  pid=3368 comm="systemd-user-ru" name="dconf" dev="tmpfs" ino=70 scontext=system_u:system_r:systemd_user_runtimedir_t:s0 tcontext=system_u:object_r:config_home_t:s0 tclass=dir permissive=1


Hash: systemd-user-ru,systemd_user_runtimedir_t,config_home_t,dir,write

Second:

SELinux is preventing systemd-user-ru from remove_name access on the directory user.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that systemd-user-ru should be allowed remove_name access on the user directory by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'systemd-user-ru' --raw | audit2allow -M my-systemduserru
# semodule -X 300 -i my-systemduserru.pp

Additional Information:
Source Context                system_u:system_r:systemd_user_runtimedir_t:s0
Target Context                system_u:object_r:config_home_t:s0
Target Objects                user [ dir ]
Source                        systemd-user-ru
Source Path                   systemd-user-ru
Port                          <Unknown>
Host                          Hostname
Source RPM Packages           
Target RPM Packages           
SELinux Policy RPM            selinux-policy-targeted-41.37-1.fc42.noarch
Local Policy RPM              selinux-policy-targeted-41.37-1.fc42.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     Hostname
Platform                      Linux Hostname 6.14.2-300.fc42.x86_64 #1 SMP
                              PREEMPT_DYNAMIC Thu Apr 10 21:50:55 UTC 2025
                              x86_64
Alert Count                   1
First Seen                    2025-04-21 01:19:14 +04
Last Seen                     2025-04-21 01:19:14 +04
Local ID                      4bc4b566-cfb7-45d4-8f84-990b68d77afa

Raw Audit Messages
type=AVC msg=audit(1745183954.210:190): avc:  denied  { remove_name } for  pid=3368 comm="systemd-user-ru" name="user" dev="tmpfs" ino=71 scontext=system_u:system_r:systemd_user_runtimedir_t:s0 tcontext=system_u:object_r:config_home_t:s0 tclass=dir permissive=1


Hash: systemd-user-ru,systemd_user_runtimedir_t,config_home_t,dir,remove_name

Third:

SELinux is preventing systemd-user-ru from rmdir access on the directory dconf.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that systemd-user-ru should be allowed rmdir access on the dconf directory by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'systemd-user-ru' --raw | audit2allow -M my-systemduserru
# semodule -X 300 -i my-systemduserru.pp

Additional Information:
Source Context                system_u:system_r:systemd_user_runtimedir_t:s0
Target Context                system_u:object_r:config_home_t:s0
Target Objects                dconf [ dir ]
Source                        systemd-user-ru
Source Path                   systemd-user-ru
Port                          <Unknown>
Host                          Hostname
Source RPM Packages           
Target RPM Packages           
SELinux Policy RPM            selinux-policy-targeted-41.37-1.fc42.noarch
Local Policy RPM              selinux-policy-targeted-41.37-1.fc42.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     Hostname
Platform                      Linux Hostname 6.14.2-300.fc42.x86_64 #1 SMP
                              PREEMPT_DYNAMIC Thu Apr 10 21:50:55 UTC 2025
                              x86_64
Alert Count                   1
First Seen                    2025-04-21 01:19:14 +04
Last Seen                     2025-04-21 01:19:14 +04
Local ID                      383155d3-6432-44f1-ab34-433b720efc99

Raw Audit Messages
type=AVC msg=audit(1745183954.210:191): avc:  denied  { rmdir } for  pid=3368 comm="systemd-user-ru" name="dconf" dev="tmpfs" ino=70 scontext=system_u:system_r:systemd_user_runtimedir_t:s0 tcontext=system_u:object_r:config_home_t:s0 tclass=dir permissive=1


Hash: systemd-user-ru,systemd_user_runtimedir_t,config_home_t,dir,rmdir

I vaguely remember using rmdir on a folder in my home directory before these alerts started happening, but I am not sure if they are related.

This does not pose any usability issues, but I also don’t believe this is an intended behavior.

System details:

Operating System: Fedora Linux 42
KDE Plasma Version: 6.3.4
KDE Frameworks Version: 6.13.0
Qt Version: 6.9.0
Kernel Version: 6.14.2-300.fc42.x86_64 (64-bit)
Graphics Platform: Wayland
Processors: 16 × AMD Ryzen AI 7 PRO 360 w/ Radeon 880M
Memory: 30.5 GiB of RAM
Graphics Processor: AMD Radeon Graphics
Manufacturer: LENOVO
Product Name: 21M1001WUS
System Version: ThinkPad T14s Gen 6

glb · April 21, 2025, 12:08am

It looks like a patch for this was submitted 4 days ago:

github.com/fedora-selinux/selinux-policy

Allow systemd-user-runtime-dir delete gnome homedir content

committed 02:14PM - 16 Apr 25 UTC

zpytela

+4 -0

The commit addresses the following AVC denial: type=PROCTITLE msg=audit(04/11/20…25 17:05:05.993:4774) : proctitle=/usr/lib/systemd/systemd-user-runtime-dir stop 1004 type=PATH msg=audit(04/11/2025 17:05:05.993:4774) : item=1 name=user inode=43 dev=00:41 mode=file,600 ouid=unknown(1004) ogid=unknown(1004) rdev=00:00 obj=unconfined_u:object_r:config_home_t:s0 nametype=DELETE cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=PATH msg=audit(04/11/2025 17:05:05.993:4774) : item=0 name=/ inode=42 dev=00:41 mode=dir,700 ouid=unknown(1004) ogid=unknown(1004) rdev=00:00 obj=unconfined_u:object_r:config_home_t:s0 nametype=PARENT cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=SYSCALL msg=audit(04/11/2025 17:05:05.993:4774) : arch=x86_64 syscall=unlinkat success=yes exit=0 a0=0x5 a1=0x557882d77153 a2=0x0 a3=0x4 items=2 ppid=1 pid=152473 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=systemd-user-ru exe=/usr/lib/systemd/systemd-user-runtime-dir subj=system_u:system_r:systemd_user_runtimedir_t:s0 key=(null) type=AVC msg=audit(04/11/2025 17:05:05.993:4774) : avc: denied { remove_name } for pid=152473 comm=systemd-user-ru name=user dev="tmpfs" ino=43 scontext=system_u:system_r:systemd_user_runtimedir_t:s0 tcontext=unconfined_u:object_r:config_home_t:s0 tclass=dir permissive=1 type=AVC msg=audit(04/11/2025 17:05:05.993:4774) : avc: denied { write } for pid=152473 comm=systemd-user-ru name=dconf dev="tmpfs" ino=42 scontext=system_u:system_r:systemd_user_runtimedir_t:s0 tcontext=unconfined_u:object_r:config_home_t:s0 tclass=dir permissive=1 Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=2359546

pogodemon · April 21, 2025, 4:52am

The patch was tagged as v41.38 four days ago, but this version is not yet packaged. I checked a few previous versions and they were packaged the same day as they were tagged. I wonder if there is a specific reason this one was held back?

glb · April 21, 2025, 2:22pm

It is in testing:

https://bodhi.fedoraproject.org/updates/FEDORA-2025-c6621cb65e

You should be able to install it now (and test it) with dnf --repo=updates-testing update selinux-policy. If it solves this problem, you might consider giving the update a positive vote in bodhi to help it get through to the stable repo a bit quicker.

Thanks.

pogodemon · April 21, 2025, 2:52pm

I tried the following, but dnf did not find any updates:

~$ sudo dnf --repo=updates-testing update selinux-policy
Updating and loading repositories:
Repositories loaded.
Nothing to do.

Fortunately, I was able download rpm packages manually. And I can confirm, with selinux-policy-41.38-1 these alerts don’t come up anymore.

Thanks a lot, @glb !

jbs4115 · April 22, 2025, 1:16pm

having the same problem. where did you find the rpm

thanks,
john

pogodemon · April 22, 2025, 1:46pm

Hi.

The package have been pushed to the testing repository. You can use the provided command to update them.

jbs4115 · April 22, 2025, 4:23pm

thank you

john

dreua · April 24, 2025, 10:46am

I’m seeing the same error message at every login on f41 - probably the same issue. Here is the update in testing for pre Adams (aka 41): FEDORA-2025-36084ab074 — bugfix update for selinux-policy — Fedora Updates System

Topic		Replies	Views
F42 - Akonadi and SELinux journalctl error messages Ask Fedora kde , f42	0	88	April 21, 2025
Are SELinux alarms frequent on Fedora? Ask Fedora f38 , selinux	2	752	May 1, 2023
Selinux help me deal with it Ask Fedora f35 , selinux	8	2117	January 20, 2022
Solved: Updated from f37 to f38: Problems with SELinux Ask Fedora f37 , f38 , selinux	18	2286	April 29, 2023
Enabling systemd-homed managed user&home dir during Fedora install Ask Fedora installation , systemd-homed	9	1888	January 6, 2023

"SELinux has detected a problem." with "systemd-user-ru" at every boot

Related topics