SELinux : denied getattr for tl-session

ThinLinc
1

I was getting a lot of these:
type=AVC msg=audit(1770892256.261:1384): avc: denied { getattr } for pid=35078 comm=“tl-session” name=“/” dev=“pidfs” ino=1 scontext=system_u:system_r:thinlinc_session_t:s0 tcontext=system_u:object_r:pidfs_t:s0 tclass=filesystem permissive=0

Otherwise from a user perspective, the sessions were behaving as expected.

For now I simply added a policy to allow this, but I’m interested to know if this is a common issue and if there’s a better way to address this.

2

@CendioOssman any ideas here? Could it be related to this?

3

No, that message is expected during normal operation of ThinLinc.

That AVC is not familiar to me. What distribution is this from, @JBL?

4

@CendioOssman I’m on Fedora 43.

5

Thanks. I can reproduce it here now as well. Like you, I could not see any practical issues. But we should investigate and see how we can resolve it.

I’ve added this bugzilla entry to track it:

1 Like