Skip to content

SELinux + Rustdesk = Issues?

Rustdesk and SELinux playing along

Fedora 40

Like so many around me, I am celebrating the release of Fedora 40!
Yesterday I upgraded both my personal laptop as well as my workstation from work and the upgrades went swimmingly.

The only issues I've had to speak of are the two I'm going to mention here, but both of them are minimal and didn't really screw anything up other than I just had to spend a few minutes using a search engine to look for a solution.

Konsole Profiles

After upgrading my Fedora 39 to 40 I decided to put Plasma in lighter clothes, which didn't last long btw since I'm back to dark mode now a day later, and I wanted to play with changing the profile in Konsole as well to fit the rest of the look.
Well, one thing that changed between the two newest version of Fedora is that the default status of the main menu (File - Edit ...) is now hidden in Fedora 40 but it was visible. That means that the way to the Profiles in Konsole was wayyyy longer than usual, as you can see in this screenshot:

Konsole P rofiles

To fix it you only have to tick the "Show Menubar with All Actions" and the menu will now be shown at the top of you window from now on.

SELinux alerts regarding Rustdesk

Now this one took me a bit longer to figure out, at least by a few minutes, but when logging in to for the first time after a reboot I got bombarded with alerts and warnings from SELinux regarding Rustdesk and that it had been stopped from starting. At first when I saw the message I just did a "sudo killall rustdesk" since I wasn't using it at the moment but after a few I decided that I might want to fix this rather than having this as a repeat issue again and again (I know my AuDHD limits).

So I did a short quick search and found this in the Rustdesk documentation.
And for future referance I am going to note down here so I can return to it in case I need it later down the line.

First step is to install the following packages in case they're not installed:

sudo dnf install selinux-policy-devel make

Then I made a temporary file named rustdesk.te and placed the following into it:

module rustdesk 1.0;

require {
        type event_device_t;
        type xserver_t;
        type xserver_port_t;
        type sudo_exec_t;
        type init_t;
        type ephemeral_port_t;
        type user_tmp_t;
        type user_fonts_cache_t;
        type pulseaudio_home_t;
        type session_dbusd_tmp_t;
        type unconfined_dbusd_t;
        class process execmem;
        class file { open read create write execute execute_no_trans map setattr lock link unlink };
        class unix_stream_socket connectto;
        class tcp_socket name_connect;
        class dir { add_name remove_name };
        class sock_file write;
        class chr_file { open read write } ;
}

#============= init_t ==============
allow init_t xserver_t:unix_stream_socket connectto;
allow init_t sudo_exec_t:file { open read execute execute_no_trans };
allow init_t user_tmp_t:file { open write setattr };
allow init_t self:process execmem;
allow init_t user_fonts_cache_t:dir { add_name remove_name };
allow init_t user_fonts_cache_t:file { read write create open link lock unlink };
allow init_t xserver_port_t:tcp_socket name_connect;
allow init_t pulseaudio_home_t:file { read write open lock };
allow init_t session_dbusd_tmp_t:sock_file write;
allow init_t unconfined_dbusd_t:unix_stream_socket connectto;

#!!!! This AVC can be allowed using the boolean 'nis_enabled'
allow init_t ephemeral_port_t:tcp_socket name_connect;

#!!!! This AVC can be allowed using the boolean 'domain_can_mmap_files'
allow init_t sudo_exec_t:file map;


#============= init_t Wayland ==============
allow init_t event_device_t:chr_file { open read write };

#!!!! This AVC can be allowed using the boolean 'domain_can_mmap_files'
allow init_t user_tmp_t:file map;

Finally I had to run the following commands:

checkmodule -M -m -o rustdesk.mod rustdesk.te && semodule_package -o rustdesk.pp -m rustdesk.mod && sudo semodule -i rustdesk.pp
sudo semodule -l | grep rustdesk

This had to be done whilst Rustdesk was creating the errors ín SELinux, or at least I think so, and since it was running in the background (or trying to) I saw that this process stopped the errors from popping up and the problem was fixed.