Bugzilla – Bug 1216237
SELinux: execstack denied for unconfined Discord flatpak
Last modified: 2023-10-24 07:47:09 UTC
Created attachment 870177 [details] Screenshot of the reported broken Discord application The Discord application (flatpak) on Tumbleweed reports a corrupt Discord installation (See Screenshot) due to some SELinux violations: > # ausearch -m avc | grep Discord > type=AVC msg=audit(1697269338.440:235): avc: denied { execstack } for pid=9690 comm="Discord" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=process permissive=0 > type=AVC msg=audit(1697269338.456:236): avc: denied { execstack } for pid=9690 comm="Discord" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=process permissive=0 > type=AVC msg=audit(1697269338.456:237): avc: denied { execstack } for pid=9690 comm="Discord" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=process permissive=0 > type=AVC msg=audit(1697269340.490:238): avc: denied { execstack } for pid=9690 comm="Discord" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=process permissive=0 > type=AVC msg=audit(1697269340.503:239): avc: denied { execstack } for pid=9690 comm="Discord" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=process permissive=0 Running the application in permissive SELinux mode makes those reports go away.
See also https://github.com/flathub/com.discordapp.Discord/issues/310
Is this solved by 'sudo setsebool selinuxuser_execstack 1`? See https://en.opensuse.org/Portal:Aeon#Android_Studio_emulator_not_working_from_flatpak
Yes that works.
Nice, closing as fixed.
Thank you Filippo!