Crashes on startup on Fedora 40 due to SELinux execheap denials

[nirbheek]

This is on Fedora 40. It was only happening on my laptop at first, so I thought it's just a configuration issue. However, now it's happening on my desktop too. The general error is:

mattermost-desktop killed by SIGTRAP
Fatal process out of memory: Failed to reserve virtual memory for CodeRange

This happens on every launch, but it goes away temporarily if I reboot my machine. abrt says that the backtrace has "low informational value", probably because I don't have any debug SDKs installed. Would you like me to attempt to get a backtrace?

[SemaiCZE]

I'm using it everyday on two Fedora 40 computers and both work fine. I'll try to look, but I don't give too much hope for it ...

[SemaiCZE]

@nirbheek Do you have any Selinux errors when the crash happens? https://issues.chromium.org/issues/335524387

[nirbheek]

Yep, you're right, my log is filed with:

Sep 18 20:59:39 murasakino audit[171547]: AVC avc: denied { execheap } for pid=171547 comm="mattermost-desk" scontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=process permissive=0

Hundreds of thousands of these, just in the last boot. I guess the app is mostly limping along, but sometimes it fails to start, because there are several of these being printed every second:

Sep 18 20:59:37
 tclass=process
Sep 18 20:59:37
 tclass=process
Sep 18 20:59:37
 tclass=process
Sep 18 20:59:37
 tclass=process
Sep 18 20:59:37
 tclass=process
Sep 18 20:59:38
 tclass=process
Sep 18 20:59:38
 tclass=process
Sep 18 20:59:38
 tclass=process
Sep 18 20:59:38
 tclass=process
Sep 18 20:59:39
 tclass=process
Sep 18 20:59:39
 tclass=process
Sep 18 20:59:39
 tclass=process
Sep 18 20:59:39
 tclass=process
Sep 18 20:59:39
 tclass=process
Sep 18 20:59:39
 tclass=process
Sep 18 20:59:40
 tclass=process
Sep 18 20:59:40
 tclass=process
Sep 18 20:59:40
 tclass=process
Sep 18 20:59:41
 tclass=process
Sep 18 20:59:42
 tclass=process
Sep 18 20:59:42
 tclass=process
Sep 18 20:59:42
 tclass=process
Sep 18 20:59:43
 tclass=process
Sep 18 20:59:43
 tclass=process

I've had journalctl -b -1 | grep -i execheap | wc -l running for 15 min now, and it still hasn't completed.

Edit: it completed, 443142 occurrences.

[SemaiCZE]

Well, there is nothing we can do from Mattermost or flatpak perspective. You can create a selinux exception from the logs or you can enable the execheap boolean:

setsebool -P selinuxuser_execheap 1

[nirbheek]

Ah well, thanks for getting to the root of the issue :) I guess we can keep the bug open so people can find it and the workaround?