On Thu, Dec 8, 2022 at 5:49 AM Jeffrey Walton <noloader@gmail.com> wrote:

On Wed, Dec 7, 2022 at 11:43 PM Robert McBroom via users
<users@lists.fedoraproject.org> wrote:
>
> ...
> There is nothing in audit.log referring to any of the files or processes in the alerts.
>
> I've run the relabel command several times and the alerts are still there.
> ...
> Raw Audit Messages
> type=AVC msg=audit(1643524262.137:696): avc: denied { open } for pid=74330 comm="gdb" path="/dev/snd/pcmC0D0p" dev="devt
> mpfs" ino=532 scontext=system_u:system_r:abrt_t:s0-s0:c0.c1023 tcontext=system_u:object_r:sound_device_t:s0 tclass=chr_file

selinux alerts for gdb and devtmpfs looks like a known issue:
https://bugzilla.redhat.com/show_bug.cgi?id=1896648

Yes, a known issue - it is required to turn this boolean on to allow abrt execute its gdb handler and be able to troubleshoot further:

# setsebool -P abrt_handle_event on

and subsequently report another bug for the affected component.

Refer to abrt_handle_event_selinux(8) for more information.

We are going to change the boolean default in Rawhide. There does not seem to be any risk, but still this state has been valid since 2010.

Jeff
_______________________________________________
users mailing list -- users@lists.fedoraproject.org
To unsubscribe send an email to users-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/users@lists.fedoraproject.org
Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue

Zdenek Pytela

Security SELinux team