-
Bug
-
Resolution: Unresolved
-
Undefined
-
rhel-9.5
-
None
-
tigervnc-1.15.0-1.el9
-
No
-
Moderate
-
2
-
rhel-display-applications
-
ssg_display
-
1
-
3
-
3
-
False
-
False
-
-
None
-
Red Hat Enterprise Linux
-
DESKTOP Cycle #5 10.0 phase, DESKTOP Cycle #1 10.1 phase
-
None
This is some kind of continuation of RHEL-77973
What were you trying to do that didn't work?
When configuring the VNC service for root user on a vanilla system which never got the GUI started, the /root/.local directory doesn't exist.
This leads to getting an AVC when the VNC service tries to create the directory:
type=PROCTITLE msg=audit(02/05/2025 10:05:33.335:246) : proctitle=/usr/sbin/vncsession root :2 type=PATH msg=audit(02/05/2025 10:05:33.335:246) : item=1 name=/root/.local nametype=CREATE cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=PATH msg=audit(02/05/2025 10:05:33.335:246) : item=0 name=/root/ inode=16777346 dev=fd:00 mode=dir,550 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:admin_home_t:s0 nametype=PARENT cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=CWD msg=audit(02/05/2025 10:05:33.335:246) : cwd=/root type=SYSCALL msg=audit(02/05/2025 10:05:33.335:246) : arch=x86_64 syscall=mkdir success=no exit=EACCES(Permission denied) a0=0x5556b78f2300 a1=0755 a2=0x1c a3=0x0 items=2 ppid=6008 pid=6010 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=11 comm=vncsession exe=/usr/sbin/vncsession subj=system_u:system_r:vnc_session_t:s0 key=(null) type=AVC msg=audit(02/05/2025 10:05:33.335:246) : avc: denied { create } for pid=6010 comm=vncsession name=.local scontext=system_u:system_r:vnc_session_t:s0 tcontext=system_u:object_r:admin_home_t:s0 tclass=dir permissive=0
What is the impact of this issue to you?
Cannot setup VNC service for root user on vanilla system installed without a GUI ever started.
Please provide the package NVR for which the bug is seen:
tigervnc-selinux-1.14.1-1.el9_5.noarch
How reproducible is this bug?:
Always
Steps to reproduce
- Make sure user has no .local directory
# rm -fr /root/.local || true - Configure VNC for the user
# echo ":2=root" >> /etc/tigervnc/vncserver.users - Start a VNC session
# systemctl start vncserver@:2
Expected results
VNC service starting properly
Actual results
VNC service failing and AVC
- is related to
-
-
- Release Pending
-
- links to
-
RHSA-2025:147220
tigervnc bug fix and enhancement update