Note: This is a beta release of Red Hat Bugzilla 5.0. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Also email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback here.
Bug 1509502 - SELinux is preventing bwrap from nnp_transition, nosuid_transition access on the process2 Unknown. [NEEDINFO]
Summary: SELinux is preventing bwrap from nnp_transition, nosuid_transition access on ...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 27
Hardware: x86_64
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Lukas Vrabec
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: abrt_hash:973be192d3709f930939c42607b...
: 1507911 (view as bug list)
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-11-04 03:43 UTC by Luya Tshimbalanga
Modified: 2018-11-22 07:41 UTC (History)
58 users (show)

Fixed In Version: selinux-policy-3.13.1-283.16.fc27
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2017-11-20 16:56:18 UTC
lvrabec: needinfo? (jeischma)


Attachments (Terms of Use)

Description Luya Tshimbalanga 2017-11-04 03:43:02 UTC
Description of problem:
Starting Gnome Boxes under Wayland session
SELinux is preventing bwrap from nnp_transition, nosuid_transition access on the process2 Unknown.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that bwrap should be allowed nnp_transition nosuid_transition access on the Unknown process2 by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'bwrap' --raw | audit2allow -M my-bwrap
# semodule -X 300 -i my-bwrap.pp

Additional Information:
Source Context                unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1
                              023
Target Context                unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023
Target Objects                Unknown [ process2 ]
Source                        bwrap
Source Path                   bwrap
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           
Target RPM Packages           
Policy RPM                    selinux-policy-3.13.1-283.14.fc27.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed)
                              4.14.0-0.rc3.git0.2.ecdt.fc27.x86_64 #1 SMP Tue
                              Oct 3 19:54:23 UTC 2017 x86_64 x86_64
Alert Count                   18
First Seen                    2017-10-31 21:13:26 PDT
Last Seen                     2017-10-31 21:13:57 PDT
Local ID                      b72a27d6-bd92-4048-b727-5b8935d6b681

Raw Audit Messages
type=AVC msg=audit(1509509637.924:1227): avc:  denied  { nnp_transition nosuid_transition } for  pid=11127 comm="bwrap" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tclass=process2 permissive=0


Hash: bwrap,unconfined_t,thumb_t,process2,nnp_transition,nosuid_transition

Version-Release number of selected component:
selinux-policy-3.13.1-283.14.fc27.noarch

Additional info:
component:      selinux-policy
reporter:       libreport-2.9.2
hashmarkername: setroubleshoot
kernel:         4.14.0-0.rc3.git0.2.ecdt.fc27.x86_64
type:           libreport

Potential duplicate: bug 1507911

Comment 1 Lukas Vrabec 2017-11-07 08:42:37 UTC
Hi, 

Do you know what's going here? When this AVC showed up?

Comment 2 Lukas Vrabec 2017-11-07 08:45:22 UTC
*** Bug 1507911 has been marked as a duplicate of this bug. ***

Comment 3 Nicholas Kudriavtsev 2017-11-07 09:24:48 UTC
Hi,

I can not say with certainty. Seems it happens when I start some applications on fresh boot, fresh login. For example when I start audacity-freeworld, but when I start audacity not in the first time the AVC does not show up sometimes.

Audacity is not the one application when I see the AVC.

I will try to pay more attention to this.

Comment 4 Luya Tshimbalanga 2017-11-07 09:38:33 UTC
Not sure how that happens. For example, I just start setroubleshoot when the AVC popped up.

Comment 5 Nicholas Kudriavtsev 2017-11-08 08:41:07 UTC
Well, I've got the AVC alert every time I start audacity-freeworld, easytag, keepassx. Sometimes when I open a folder on autofs nfs mount in nautilus I've got alert also.

Comment 6 Gabriel Einsdorf 2017-11-08 09:05:14 UTC
Description of problem:
When starting the nextcloud-client flatpak from flathub

Version-Release number of selected component:
selinux-policy-3.13.1-283.14.fc27.noarch

Additional info:
reporter:       libreport-2.9.3
hashmarkername: setroubleshoot
kernel:         4.13.11-300.fc27.x86_64
type:           libreport

Comment 7 Lukas Vrabec 2017-11-08 12:47:24 UTC
Jiri, 
It looks like flatpack and also gnome-boxes using bubblewrap in Fedora, right?

Comment 8 Vít Ondruch 2017-11-08 14:33:54 UTC
(In reply to Lukas Vrabec from comment #7)
I don't have gnome-boxes installed, but I can imagine that this might pop up when gnome-software is checking for updates on background, since it depends on flatpak. That could explain the randomness.

Comment 9 Pavel Roskin 2017-11-08 20:46:53 UTC
Description of problem:
I got this issue when I launched tilix from the GNOME shell. I use Fedora 27 x86_64 up-to-date with updates-testing.

Version-Release number of selected component:
selinux-policy-3.13.1-283.14.fc27.noarch

Additional info:
reporter:       libreport-2.9.3
hashmarkername: setroubleshoot
kernel:         4.13.11-300.fc27.x86_64
type:           libreport

Comment 10 Anass Ahmed 2017-11-13 14:56:10 UTC
Description of problem:
Just logged in.


Additional info:
reporter:       libreport-2.9.3
hashmarkername: setroubleshoot
kernel:         4.13.11-300.fc27.x86_64
type:           libreport

Comment 11 David Hill 2017-11-13 22:04:52 UTC
I have the same behavior on rawhide (fc28)...  yesterday I tried mounting a samba share.

Comment 12 Anass Ahmed 2017-11-13 22:58:28 UTC
I think it happens when you search for anything on GNOME Shell overview. I can reproduce it reliably here.

Steps:
1. Open GNOME Shell overview.
2. Search for any application.
3. Wait for 5 seconds or so.
4. Get out of the overview (sometimes, you don't need to get out, the next step will happen inevitably).
5. SELinux Troubleshooter notification will kick in.

Looks like some sort of gnome-shell-search-provider for GNOME Software or GNOME Boxes (both use bubblewrap as stated earlier).

I've GNOME Boxes and I have machines inside and when I search for them, they appear in the results without issues, then the SELinux Troubleshooter notification kicks in.

I also have GNOME Software, and it used to show results in GNOME Shell overview for non-installed software that matches my search, but not anymore (I think it has been broken for me for some time now; and I use DNF anyway), and the SELinux Troubleshooter notification appears.

NOTE: If you've already a bwrap listed AVC, you should delete it from the SELinux Alert Browser to reproduce the issue again reliably.

Comment 13 Anass Ahmed 2017-11-13 23:16:20 UTC
OK, I've disabled all the search providers and enabled them one by one replicating the test I've stated above and I discovered the culprit which is a bit of a surprise to me; it's not Boxes nor Software, it's Documents.

The GNOME Documents search provider shows documents in the search results, but then the SELinux Troubleshooter notification appears.

Opening GNOME Documents itself results in the same SELinux notification which ensures that it's the culprit.

Comment 14 GOGI 2017-11-14 01:10:06 UTC
(In reply to Anass Ahmed from comment #13)
> OK, I've disabled all the search providers and enabled them one by one
> replicating the test I've stated above and I discovered the culprit which is
> a bit of a surprise to me; it's not Boxes nor Software, it's Documents.
> 
> The GNOME Documents search provider shows documents in the search results,
> but then the SELinux Troubleshooter notification appears.
> 
> Opening GNOME Documents itself results in the same SELinux notification
> which ensures that it's the culprit.

Don't be so sure, it started happening to me too since few days, and I have no clue what's the cause, I can't point exactly what causes this alert to appear because it is so random, but happens on boot, reboot, opening Gnome-Files (Nautilus), and some other apps as said previously by other persons...

Comment 15 LiZhenbo 2017-11-14 01:45:43 UTC
I'm using F27, and I'll run into it every time if I open Chrome (under Gnome3)

Comment 16 Anass Ahmed 2017-11-14 01:46:33 UTC
(In reply to GOGI from comment #14)
> Don't be so sure, it started happening to me too since few days, and I have
> no clue what's the cause, I can't point exactly what causes this alert to
> appear because it is so random, but happens on boot, reboot, opening
> Gnome-Files (Nautilus), and some other apps as said previously by other
> persons...

It shows up on boot, and reboot because this is how SELinux Troubleshooter handles pending alerts.

It shows up upon launching different apps, because the way you launch them is through searching in the GNOME Shell overview which triggers the error regardless of the app you're trying to launch.

Comment 17 GOGI 2017-11-14 02:05:41 UTC
(In reply to Anass Ahmed from comment #16)
> (In reply to GOGI from comment #14)
> > Don't be so sure, it started happening to me too since few days, and I have
> > no clue what's the cause, I can't point exactly what causes this alert to
> > appear because it is so random, but happens on boot, reboot, opening
> > Gnome-Files (Nautilus), and some other apps as said previously by other
> > persons...
> 
> It shows up on boot, and reboot because this is how SELinux Troubleshooter
> handles pending alerts.

Oh really? You're serious? :D
Thanks I'm aware of how Troubleshooter works ;)

> 
> It shows up upon launching different apps, because the way you launch them
> is through searching in the GNOME Shell overview which triggers the error
> regardless of the app you're trying to launch.

Looks like you're acting as Big Brother inside my machine, aren't you? ;)
I'm sorry but I have to disappoint you and deny your self-assurance, because I didn't launch Nautilus from Gnome Shell Overview, and neither do I launch any of my favorites apps this way, I simply use the Dash, or "Places" shell extension when I intend to open something in Nautilus...

Comment 18 sheepdestroyer 2017-11-14 10:16:52 UTC
Description of problem:
  

Version-Release number of selected component:
selinux-policy-3.13.1-283.14.fc27.noarch

Additional info:
reporter:       libreport-2.9.3
hashmarkername: setroubleshoot
kernel:         4.13.11-300.fc27.x86_64
type:           libreport

Comment 19 Keefer Rourke 2017-11-14 15:01:45 UTC
*** Bug 1513000 has been marked as a duplicate of this bug. ***

Comment 20 Anass Ahmed 2017-11-14 16:40:59 UTC
(In reply to GOGI from comment #17)
> Looks like you're acting as Big Brother inside my machine, aren't you? ;)
> I'm sorry but I have to disappoint you and deny your self-assurance, because
> I didn't launch Nautilus from Gnome Shell Overview, and neither do I launch
> any of my favorites apps this way, I simply use the Dash, or "Places" shell
> extension when I intend to open something in Nautilus...

I'm trying to narrow the search for the culprit, not anything else.

On my machine, I'm able to re-produce the AVC reliably every time with the steps I've mentioned above.

Comment 21 Chris Sharp 2017-11-14 20:04:46 UTC
Description of problem:
I opened LibreOffice Calc.

Version-Release number of selected component:
selinux-policy-3.13.1-283.14.fc27.noarch

Additional info:
reporter:       libreport-2.9.3
hashmarkername: setroubleshoot
kernel:         4.13.12-300.fc27.x86_64
type:           libreport

Comment 22 Kamil Páral 2017-11-15 08:26:18 UTC
Description of problem:
I was extracting files from an encrypted zip archive using drag&drop from file-roller to nautilus.

Version-Release number of selected component:
selinux-policy-3.13.1-283.14.fc27.noarch

Additional info:
reporter:       libreport-2.9.3
hashmarkername: setroubleshoot
kernel:         4.13.12-300.fc27.x86_64
type:           libreport

Comment 23 chris 2017-11-15 13:05:50 UTC
Description of problem:
Opened file browser and went to file system root /

Version-Release number of selected component:
selinux-policy-3.13.1-283.14.fc27.noarch

Additional info:
reporter:       libreport-2.9.3
hashmarkername: setroubleshoot
kernel:         4.13.12-300.fc27.x86_64
type:           libreport

Comment 24 a0c42f44 2017-11-15 15:51:41 UTC
*** Bug 1513575 has been marked as a duplicate of this bug. ***

Comment 25 Jeremy Young 2017-11-15 17:30:05 UTC
I can reproduce this by launching nautilus from the CLI

Comment 26 dave.keber 2017-11-16 14:48:53 UTC
Description of problem:
Just booting in a VM. Doesn't appear to happen on "real" hardware.

Version-Release number of selected component:
selinux-policy-3.13.1-283.14.fc27.noarch

Additional info:
reporter:       libreport-2.9.3
hashmarkername: setroubleshoot
kernel:         4.13.12-300.fc27.x86_64
type:           libreport

Comment 27 Fedora Update System 2017-11-16 15:11:46 UTC
selinux-policy-3.13.1-283.16.fc27 has been submitted as an update to Fedora 27. https://bodhi.fedoraproject.org/updates/FEDORA-2017-5178e6a393

Comment 28 Viktor 2017-11-16 16:02:16 UTC
Description of problem:
Started steam and this error appeared

Version-Release number of selected component:
selinux-policy-3.13.1-283.14.fc27.noarch

Additional info:
reporter:       libreport-2.9.3
hashmarkername: setroubleshoot
kernel:         4.13.12-300.fc27.x86_64
type:           libreport

Comment 29 gesserat 2017-11-17 13:20:11 UTC
Description of problem:
Took a few screenshots with printscreen key, then launched "GNOME Screenshot" and got this. Application launched succsessfuly. 

Version-Release number of selected component:
selinux-policy-3.13.1-283.14.fc27.noarch

Additional info:
reporter:       libreport-2.9.3
hashmarkername: setroubleshoot
kernel:         4.13.12-300.fc27.x86_64
type:           libreport

Comment 30 AsciiWolf 2017-11-17 14:10:29 UTC
Description of problem:
After logging in.

Version-Release number of selected component:
selinux-policy-3.13.1-283.14.fc27.noarch

Additional info:
reporter:       libreport-2.9.3
hashmarkername: setroubleshoot
kernel:         4.13.12-300.fc27.x86_64
type:           libreport

Comment 31 ALI-S0 2017-11-17 15:45:31 UTC
*** Bug 1514507 has been marked as a duplicate of this bug. ***

Comment 32 shahin mehraban 2017-11-17 16:13:46 UTC
*** Bug 1514513 has been marked as a duplicate of this bug. ***

Comment 33 Fedora Update System 2017-11-17 18:56:00 UTC
selinux-policy-3.13.1-283.16.fc27 has been pushed to the Fedora 27 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2017-5178e6a393

Comment 34 Matty 2017-11-18 20:24:54 UTC
Just got this issue restoring from suspend on a laptop. No other activity was being performed. Not sure if restoring slept processes is treated the same way as launching them new. If not, the issue may not be related to actually running a new process as some of the posts above seem to suggest.]

SELinux is preventing bwrap from 'nnp_transition, nosuid_transition' accesses on the process2 Unknown.

Comment 35 Matty 2017-11-18 20:27:11 UTC
Addition to prior comment - this behavior is repeatable. Restoring from suspend consistently seems to trigger this alert. Running FC27 on a dell XPS 13.

Comment 36 Anass Ahmed 2017-11-18 23:59:16 UTC
I think the update in the testing repo has fixed it for me.

Comment 37 rugk 2017-11-19 10:47:41 UTC
Description of problem:
downloaded file/gif and opened in gthumb

Version-Release number of selected component:
selinux-policy-3.13.1-283.14.fc27.noarch

Additional info:
reporter:       libreport-2.9.3
hashmarkername: setroubleshoot
kernel:         4.13.12-300.fc27.x86_64
type:           libreport

Comment 38 Baebs 2017-11-20 08:16:24 UTC
Description of problem:
SELinux is preventing bwrap from nnp_transition, nosuid_transition access on the process2 Unknown.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that bwrap should be allowed nnp_transition nosuid_transition access on the Unknown process2 by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'bwrap' --raw | audit2allow -M my-bwrap
# semodule -X 300 -i my-bwrap.pp

Additional Information:
Source Context                unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1
                              023
Target Context                unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023
Target Objects                Unknown [ process2 ]
Source                        bwrap
Source Path                   bwrap
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           
Target RPM Packages           
Policy RPM                    selinux-policy-3.13.1-283.14.fc27.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 4.13.12-300.fc27.x86_64 #1 SMP Wed
                              Nov 8 16:38:01 UTC 2017 x86_64 x86_64
Alert Count                   106
First Seen                    2017-11-20 10:28:54 +07
Last Seen                     2017-11-20 14:55:59 +07
Local ID                      de9c4efa-bfe9-499b-b8c9-fea74c7100ad

Raw Audit Messages
type=AVC msg=audit(1511164559.924:663): avc:  denied  { nnp_transition nosuid_transition } for  pid=16725 comm="bwrap" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:thumb_t:s0-s0:c0.c1023 tclass=process2 permissive=0


Hash: bwrap,unconfined_t,thumb_t,process2,nnp_transition,nosuid_transition

NAME=Fedora
VERSION="27 (Workstation Edition)"
ID=fedora
VERSION_ID=27
PRETTY_NAME="Fedora 27 (Workstation Edition)"
ANSI_COLOR="0;34"
CPE_NAME="cpe:/o:fedoraproject:fedora:27"
HOME_URL="https://fedoraproject.org/"
SUPPORT_URL="https://fedoraproject.org/wiki/Communicating_and_getting_help"
BUG_REPORT_URL="https://bugzilla.redhat.com/"
REDHAT_BUGZILLA_PRODUCT="Fedora"
REDHAT_BUGZILLA_PRODUCT_VERSION=27
REDHAT_SUPPORT_PRODUCT="Fedora"
REDHAT_SUPPORT_PRODUCT_VERSION=27
PRIVACY_POLICY_URL="https://fedoraproject.org/wiki/Legal:PrivacyPolicy"
VARIANT="Workstation Edition"
VARIANT_ID=workstation

Version-Release number of selected component:
selinux-policy-3.13.1-283.14.fc27.noarch

Additional info:
reporter:       libreport-2.9.3
hashmarkername: setroubleshoot
kernel:         4.13.12-300.fc27.x86_64
type:           libreport

Comment 39 Lukas Vrabec 2017-11-20 08:18:25 UTC
Please update selinux-policy to fix this issue.

Comment 40 Lukas Vrabec 2017-11-20 11:50:15 UTC
*** Bug 1514507 has been marked as a duplicate of this bug. ***

Comment 41 Fedora Update System 2017-11-20 16:56:18 UTC
selinux-policy-3.13.1-283.16.fc27 has been pushed to the Fedora 27 stable repository. If problems still persist, please make note of it in this bug report.

Comment 42 pretomisturado 2018-04-02 09:04:51 UTC
*** Bug 1562721 has been marked as a duplicate of this bug. ***

Comment 43 Jasper O'neal Hartline 2018-06-01 07:12:23 UTC
Description of problem:
Not sure downloading some videoes thats all


Additional info:
reporter:       libreport-2.9.2
hashmarkername: setroubleshoot
kernel:         4.16.9-200.fc27.x86_64
type:           libreport


Note You need to log in before you can comment on or make changes to this bug.