# SELinux : denied getattr for tl-session

**URL:** <https://community.thinlinc.com/t/selinux-denied-getattr-for-tl-session/1862>\
**Category:** Community Support\
**Created:** [12 February 2026 13:05 UTC](https://community.thinlinc.com/t/selinux-denied-getattr-for-tl-session/1862 "2026-02-12T13:05:26Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![JBL](https://dub1.discourse-cdn.com/flex005/user_avatar/community.thinlinc.com/jbl/32/1341_2.png) [@JBL](https://community.thinlinc.com/u/JBL)\
**Post date:** [12 February 2026 13:05 UTC](https://community.thinlinc.com/t/selinux-denied-getattr-for-tl-session/1862/1 "2026-02-12T13:05:26Z")

</div>

I was getting a lot of these:  
`type=AVC msg=audit(1770892256.261:1384): avc: denied { getattr } for pid=35078 comm=“tl-session” name=“/” dev=“pidfs” ino=1 scontext=system_u:system_r:thinlinc_session_t:s0 tcontext=system_u:object_r:pidfs_t:s0 tclass=filesystem permissive=0`

Otherwise from a user perspective, the sessions were behaving as expected.

For now I simply added a policy to allow this, but I’m interested to know if this is a common issue and if there’s a better way to address this.

---

<div class="post-metadata">

**Author:** ![aaron](https://dub1.discourse-cdn.com/flex005/user_avatar/community.thinlinc.com/aaron/32/13_2.png) [@aaron](https://community.thinlinc.com/u/aaron)\
**Post date:** [13 February 2026 22:28 UTC](https://community.thinlinc.com/t/selinux-denied-getattr-for-tl-session/1862/2 "2026-02-13T22:28:03Z")

</div>

@CendioOssman any ideas here? Could it be related to this?

> [@WARNING vsmagent.sessions: Broken session for user abc, tl-session process 123 does not exist](https://community.thinlinc.com/t/warning-vsmagent-sessions-broken-session-for-user-abc-tl-session-process-123-does-not-exist/1861):
>
> I noticed a lot of entries of that type in /var/log/vsmagent.log. From what I can tell, process 123 indeed doesn’t exist anymore, for a good reason: it corresponds to the previous tl-session, which from a user perspective ended as expected. The log entry seems to be generated by an obfuscated /opt/thinlinc/modules/thinlinc/vsm/handler\_verifysessions.py. What could be reasons for ThinLinc believing that the previous session should be alive?

---

<div class="post-metadata">

**Author:** ![CendioOssman](https://dub1.discourse-cdn.com/flex005/user_avatar/community.thinlinc.com/cendioossman/32/385_2.png) [@CendioOssman](https://community.thinlinc.com/u/CendioOssman)\
**Post date:** [17 February 2026 13:04 UTC](https://community.thinlinc.com/t/selinux-denied-getattr-for-tl-session/1862/3 "2026-02-17T13:04:21Z")

</div>

No, that message is expected during normal operation of ThinLinc.

That AVC is not familiar to me. What distribution is this from, @JBL?

---

<div class="post-metadata">

**Author:** ![JBL](https://dub1.discourse-cdn.com/flex005/user_avatar/community.thinlinc.com/jbl/32/1341_2.png) [@JBL](https://community.thinlinc.com/u/JBL)\
**Post date:** [17 February 2026 15:13 UTC](https://community.thinlinc.com/t/selinux-denied-getattr-for-tl-session/1862/4 "2026-02-17T15:13:28Z")

</div>

@CendioOssman I’m on Fedora 43.

---

<div class="post-metadata">

**Author:** ![CendioOssman](https://dub1.discourse-cdn.com/flex005/user_avatar/community.thinlinc.com/cendioossman/32/385_2.png) [@CendioOssman](https://community.thinlinc.com/u/CendioOssman)\
**Post date:** [18 February 2026 14:29 UTC](https://community.thinlinc.com/t/selinux-denied-getattr-for-tl-session/1862/5 "2026-02-18T14:29:45Z")

</div>

Thanks. I can reproduce it here now as well. Like you, I could not see any practical issues. But we should investigate and see how we can resolve it.

I’ve added this bugzilla entry to track it:

> **[8794 – SELinux AVC for tl-session: getattr on pidfs](https://bugzilla.cendio.com/show_bug.cgi?id=8794)**