SELinux issues
Opened this issue · 1 comments
LecrisUT commented
After a recent update of Element, I started having SELinux issues related to execheap.
SELinux is preventing element-desktop from using the execheap access on a process.
***** Plugin allow_execheap (53.1 confidence) suggests ********************
If you do not think element-desktop should need to map heap memory that is both writable and executable.
Then you need to report a bug. This is a potentially dangerous access.
Do
contact your security administrator and report this issue.
***** Plugin catchall_boolean (42.6 confidence) suggests ******************
If you want to allow selinuxuser to execheap
Then you must tell SELinux about this by enabling the 'selinuxuser_execheap' boolean.
Do
setsebool -P selinuxuser_execheap 1
***** Plugin catchall (5.76 confidence) suggests **************************
If you believe that element-desktop should be allowed execheap access on processes labeled unconfined_t by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'element-desktop' --raw | audit2allow -M my-elementdesktop
# semodule -X 300 -i my-elementdesktop.pp
Additional Information:
Source Context unconfined_u:unconfined_r:unconfined_t:s0-
s0:c0.c1023
Target Context unconfined_u:unconfined_r:unconfined_t:s0-
s0:c0.c1023
Target Objects Unknown [ process ]
Source element-desktop
Source Path element-desktop
Port <Unknown>
Host fedora
Source RPM Packages
Target RPM Packages
SELinux Policy RPM selinux-policy-targeted-40.23-1.fc40.noarch
Local Policy RPM selinux-policy-targeted-40.23-1.fc40.noarch
Selinux Enabled True
Policy Type targeted
Enforcing Mode Enforcing
Host Name fedora
Platform Linux fedora 6.9.8-200.fc40.x86_64 #1 SMP
PREEMPT_DYNAMIC Fri Jul 5 16:20:11 UTC 2024
x86_64
Alert Count 80
First Seen 2024-07-13 10:12:03 CEST
Last Seen 2024-07-16 09:19:17 CEST
Local ID c95e2487-a0cc-487e-a55a-dff8f3632b88
Raw Audit Messages
type=AVC msg=audit(1721114357.832:250): avc: denied { execheap } for pid=3418 comm="element-desktop" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=process permissive=0
Hash: element-desktop,unconfined_t,unconfined_t,process,execheap
This is similar to the issue flathub/org.zulip.Zulip#74, and similarly I don't know if it's on flatpak packaging or upstream?
SISheogorath commented
This seems to be a general Fedora issue: https://discussion.fedoraproject.org/t/selinux-execheap-denials/120638 (there are some more threads around). There is also a bugzilla ticket for it: https://bugzilla.redhat.com/show_bug.cgi?id=2254434