# Various Selinux errors in journalctld on RHEL 10.1

**URL:** <https://discourse.openondemand.org/t/various-selinux-errors-in-journalctld-on-rhel-10-1/4874>\
**Category:** Get Help\
**Tags:** question\
**Created:** [May 1, 2026, 6:12pm UTC](https://discourse.openondemand.org/t/various-selinux-errors-in-journalctld-on-rhel-10-1/4874 "2026-05-01T18:12:58Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![timeu](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/timeu/32/3383_2.png) [@timeu](https://discourse.openondemand.org/u/timeu)\
**Post date:** [May 1, 2026, 6:12pm UTC](https://discourse.openondemand.org/t/various-selinux-errors-in-journalctld-on-rhel-10-1/4874/1 "2026-05-01T18:12:58Z")

</div>

I installed OpenOnDemand 4.1.4 on a RHEL 10.1 host with enforcing Selinux. I have set `setsebool ondemand_use_slurm on`  
When I try to submit a job I get following error:

```auto
An error occurred when submitting jobs for simulation 1: sbatch: error: s_p_parse_file: unable to read "/run/slurm/conf/slurm.conf": Permission denied
sbatch: error: ClusterName needs to be specified
sbatch: fatal: Unable to process configuration file

```

slurm error:

> SELinux is preventing /usr/bin/sinfo from open access on the file /var/spool/slurmd/conf-cache/slurm.conf.
> 
> \*\*\*\*\* Plugin catchall (100. confidence) suggests \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*
> 
> If you believe that sinfo should be allowed open access on the slurm.conf file by default.  
> Then you should report this as a bug.  
> You can generate a local policy module to allow this access.
> 
> Do  
> allow this access for now by executing:
> 
> # ausearch -c ‘sinfo’ --raw | audit2allow -M my-sinfo
> 
> # semodule -X 300 -i my-sinfo.pp
> 
> Additional Information:  
> Source Context system\_u:system\_r:ood\_pun\_t:s0  
> Target Context system\_u:object\_r:var\_spool\_t:s0  
> Target Objects /var/spool/slurmd/conf-cache/slurm.conf [file]  
> Source sinfo  
> Source Path /usr/bin/sinfo  
> Port  
> Host cbevm-ood-0.cbevm.inst.atlas.clip.vbc.ac.at  
> Source RPM Packages slurm-25.11.2-1.el10.x86\_64  
> Target RPM Packages  
> SELinux Policy RPM selinux-policy-targeted-42.1.7-1.el10\_1.1.noarch  
> Local Policy RPM  
> Selinux Enabled True  
> Policy Type targeted  
> Enforcing Mode Enforcing  
> Host Name cbevm-ood-0.cbevm.inst.atlas.clip.vbc.ac.at  
> Platform Linux cbevm-ood-0.cbevm.inst.atlas.clip.vbc.ac.at  
> 6.12.0-124.43.1.el10\_1.x86\_64 #1 SMP  
> PREEMPT\_DYNAMIC Tue Mar 3 19:10:08 EST 2026  
> x86\_64  
> Alert Count 35  
> First Seen 2026-04-30 00:44:31 CEST  
> Last Seen 2026-05-01 20:08:10 CEST  
> Local ID 03481587-4cb3-48f5-85c7-501455eb0592
> 
> Raw Audit Messages  
> type=AVC msg=audit(1777658890.926:1213): avc: denied { open } for pid=4988 comm=“squeue” path=“/var/spool/slurmd/conf-cache/slurm.conf” dev=“vda3” ino=33876739 scontext=system\_u:system\_r:ood\_pun\_t:s0 tcontext=system\_u:object\_r:var\_spool\_t:s0 tclass=file permissive=0
> 
> type=SYSCALL msg=audit(1777658890.926:1213): arch=x86\_64 syscall=openat success=no exit=EACCES a0=ffffff9c a1=1ed002b0 a2=0 a3=0 items=0 ppid=3823 pid=4988 auid=4294967295 uid=10303 gid=1999 euid=10303 suid=10303 fsuid=10303 egid=1999 sgid=1999 fsgid=1999 tty=(none) ses=4294967295 comm=squeue exe=/usr/bin/squeue subj=system\_u:system\_r:ood\_pun\_t:s0 key=(null)
> 
> Hash: sinfo,ood\_pun\_t,var\_spool\_t,file,open

I see also some non slurm related selinux errors in journalctl:

lnk\_file fd issue:

> SELinux is preventing /opt/ood/ondemand/root/usr/sbin/nginx from read access on the lnk\_file fd.
> 
> \*\*\*\*\* Plugin catchall (100. confidence) suggests \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*
> 
> If you believe that nginx should be allowed read access on the fd lnk\_file by default.  
> Then you should report this as a bug.  
> You can generate a local policy module to allow this access.  
> Do  
> allow this access for now by executing:
> 
> # ausearch -c ‘nginx’ --raw | audit2allow -M my-nginx
> 
> # semodule -X 300 -i my-nginx.pp
> 
> Additional Information:  
> Source Context system\_u:system\_r:ood\_pun\_t:s0  
> Target Context system\_u:object\_r:init\_var\_run\_t:s0  
> Target Objects fd [lnk\_file]  
> Source nginx  
> Source Path /opt/ood/ondemand/root/usr/sbin/nginx  
> Port  
> Host cbevm-ood-0.cbevm.inst.atlas.clip.vbc.ac.at  
> Source RPM Packages ondemand-passenger-6.1.0-2.ood4.1.0.el10.x86\_64  
> Target RPM Packages  
> SELinux Policy RPM selinux-policy-targeted-42.1.7-1.el10\_1.1.noarch  
> Local Policy RPM  
> Selinux Enabled True  
> Policy Type targeted
> 
> Enforcing Mode Enforcing  
> Host Name cbevm-ood-0.cbevm.inst.atlas.clip.vbc.ac.at  
> Platform Linux cbevm-ood-0.cbevm.inst.atlas.clip.vbc.ac.at  
> 6.12.0-124.43.1.el10\_1.x86\_64 #1 SMP  
> PREEMPT\_DYNAMIC Tue Mar 3 19:10:08 EST 2026  
> x86\_64  
> Alert Count 822  
> First Seen 2026-04-30 00:41:21 CEST  
> Last Seen 2026-05-01 20:06:16 CEST  
> Local ID 8a1e49c3-93f7-4838-9291-1d71fd05f833
> 
> Raw Audit Messages  
> type=AVC msg=audit(1777658776.858:1177): avc: denied { read } for pid=4868 comm=“PassengerAgent” name=“fd” dev=“tmpfs” ino=23 scontext=system\_u:system\_r:ood\_pun\_t:s0 tcontext=system\_u:object\_r:init\_var\_run\_t:s0 tclass=lnk\_file permissive=0
> 
> type=SYSCALL msg=audit(1777658776.858:1177): arch=x86\_64 syscall=newfstatat success=no exit=EACCES a0=ffffff9c a1=67e56a a2=7f1f4c61dd40 a3=0 items=0 ppid=4867 pid=4868 auid=4294967295 uid=10303 gid=1999 euid=10303 suid=10303 fsuid=10303 egid=1999 sgid=1999 fsgid=1999 tty=(none) ses=4294967295 comm=PassengerAgent exe=/opt/ood/ondemand/root/usr/lib64/passenger/support-binaries/PassengerAgent subj=system\_u:system\_r:ood\_pun\_t:s0 key=(null)
> 
> Hash: nginx,ood\_pun\_t,init\_var\_run\_t,lnk\_file,read

ps issue:

> SELinux is preventing /usr/bin/ps from read access on the directory node.
> 
> \*\*\*\*\* Plugin catchall (100. confidence) suggests \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*
> 
> If you believe that ps should be allowed read access on the node directory by default.  
> Then you should report this as a bug.  
> You can generate a local policy module to allow this access.  
> Do  
> allow this access for now by executing:
> 
> # ausearch -c ‘ps’ --raw | audit2allow -M my-ps
> 
> # semodule -X 300 -i my-ps.pp
> 
> Additional Information:  
> Source Context system\_u:system\_r:ood\_pun\_t:s0  
> Target Context system\_u:object\_r:sysfs\_t:s0  
> Target Objects node [dir]  
> Source ps  
> Source Path /usr/bin/ps  
> Port  
> Host cbevm-ood-0.cbevm.inst.atlas.clip.vbc.ac.at  
> Source RPM Packages procps-ng-4.0.4-8.el10.x86\_64  
> Target RPM Packages  
> SELinux Policy RPM selinux-policy-targeted-42.1.7-1.el10\_1.1.noarch  
> Local Policy RPM  
> Selinux Enabled True  
> Policy Type targeted  
> Enforcing Mode Enforcing  
> Host Name cbevm-ood-0.cbevm.inst.atlas.clip.vbc.ac.at  
> Platform Linux cbevm-ood-0.cbevm.inst.atlas.clip.vbc.ac.at  
> 6.12.0-124.43.1.el10\_1.x86\_64 #1 SMP  
> PREEMPT\_DYNAMIC Tue Mar 3 19:10:08 EST 2026  
> x86\_64  
> Alert Count 232  
> First Seen 2026-04-30 00:44:19 CEST  
> Last Seen 2026-05-01 20:07:16 CEST  
> Local ID df023fb1-c732-4750-8db3-ebfc21b9b007
> 
> Raw Audit Messages  
> type=AVC msg=audit(1777658836.929:1192): avc: denied { read } for pid=4911 comm=“ps” name=“node” dev=“sysfs” ino=588 scontext=system\_u:system\_r:ood\_pun\_t:s0 tcontext=system\_u:object\_r:sysfs\_t:s0 tclass=dir permissive=0
> 
> type=SYSCALL msg=audit(1777658836.929:1192): arch=x86\_64 syscall=openat success=no exit=EACCES a0=ffffff9c a1=7fc0f2fa979e a2=90800 a3=0 items=0 ppid=2642 pid=4911 auid=4294967295 uid=10303 gid=1999 euid=10303 suid=10303 fsuid=10303 egid=1999 sgid=1999 fsgid=1999 tty=(none) ses=4294967295 comm=ps exe=/usr/bin/ps subj=system\_u:system\_r:ood\_pun\_t:s0 key=(null)
> 
> Hash: ps,ood\_pun\_t,sysfs\_t,dir,read

favicon:

> SELinux is preventing /usr/sbin/httpd from map access on the file /var/www/ood/public/favicon.ico.
> 
> \*\*\*\*\* Plugin catchall\_boolean (89.3 confidence) suggests \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*
> 
> If you want to allow domain to can mmap files  
> Then you must tell SELinux about this by enabling the ‘domain\_can\_mmap\_files’ boolean.
> 
> Do  
> setsebool -P domain\_can\_mmap\_files 1
> 
> \*\*\*\*\* Plugin catchall (11.6 confidence) suggests \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*
> 
> If you believe that httpd should be allowed map access on the favicon.ico file by default.  
> Then you should report this as a bug.  
> You can generate a local policy module to allow this access.  
> Do  
> allow this access for now by executing:
> 
> # ausearch -c ‘httpd’ --raw | audit2allow -M my-httpd
> 
> # semodule -X 300 -i my-httpd.pp
> 
> Additional Information:  
> Source Context system\_u:system\_r:httpd\_t:s0
> 
> Target Context system\_u:object\_r:ood\_apps\_public\_t:s0  
> Target Objects /var/www/ood/public/favicon.ico [file]  
> Source httpd  
> Source Path /usr/sbin/httpd  
> Port  
> Host cbevm-ood-0.cbevm.inst.atlas.clip.vbc.ac.at  
> Source RPM Packages httpd-core-2.4.63-4.el10\_1.3.x86\_64  
> Target RPM Packages ondemand-4.1.4-1.el10.x86\_64  
> SELinux Policy RPM selinux-policy-targeted-42.1.7-1.el10\_1.1.noarch  
> Local Policy RPM  
> Selinux Enabled True  
> Policy Type targeted  
> Enforcing Mode Enforcing  
> Host Name cbevm-ood-0.cbevm.inst.atlas.clip.vbc.ac.at  
> Platform Linux cbevm-ood-0.cbevm.inst.atlas.clip.vbc.ac.at  
> 6.12.0-124.43.1.el10\_1.x86\_64 #1 SMP  
> PREEMPT\_DYNAMIC Tue Mar 3 19:10:08 EST 2026  
> x86\_64  
> Alert Count 9  
> First Seen 2026-04-30 00:43:51 CEST  
> Last Seen 2026-05-01 20:08:10 CEST  
> Local ID 17d6df51-87ac-4414-b6f6-e24d26a66d57
> 
> Raw Audit Messages  
> type=AVC msg=audit(1777658890.964:1214): avc: denied { map } for pid=1993 comm=“httpd” path=“/var/www/ood/public/favicon.ico” dev=“vda3” ino=109516129 scontext=system\_u:system\_r:httpd\_t:s0 tcontext=system\_u:object\_r:ood\_apps\_public\_t:s0 tclass=file permissive=0
> 
> type=SYSCALL msg=audit(1777658890.964:1214): arch=x86\_64 syscall=mmap success=no exit=EACCES a0=0 a1=47e a2=1 a3=1 items=0 ppid=1988 pid=1993 auid=4294967295 uid=48 gid=48 euid=48 suid=48 fsuid=48 egid=48 sgid=48 fsgid=48 tty=(none) ses=4294967295 comm=httpd exe=/usr/sbin/httpd subj=system\_u:system\_r:httpd\_t:s0 key=(null)

This is the policy file that would allow the selinux violations:

> module ood 1.0;
> 
> require {  
> type ood\_pun\_t;  
> type ood\_apps\_public\_t;  
> type systemd\_userdbd\_runtime\_t;  
> type sysfs\_t;  
> type var\_spool\_t;  
> type init\_var\_run\_t;  
> type httpd\_t;  
> class dir read;  
> class lnk\_file read;  
> class file { map open read };  
> }
> 
> #============= httpd\_t ==============
> 
> #!!! This avc can be allowed using the boolean ‘domain\_can\_mmap\_files’  
> allow httpd\_t ood\_apps\_public\_t:file map;
> 
> #============= ood\_pun\_t ==============  
> allow ood\_pun\_t init\_var\_run\_t:lnk\_file read;  
> allow ood\_pun\_t sysfs\_t:dir read;  
> allow ood\_pun\_t sysfs\_t:file read;  
> allow ood\_pun\_t systemd\_userdbd\_runtime\_t:dir read;  
> allow ood\_pun\_t var\_spool\_t:file open;

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [May 1, 2026, 8:44pm UTC](https://discourse.openondemand.org/t/various-selinux-errors-in-journalctld-on-rhel-10-1/4874/2 "2026-05-01T20:44:35Z")

</div>

`selinux` is largely community driven component of OnDemand. We have it, but are not enforcing it. Pull requests welcome as it appears you have a solution for the issues.