mirror of
https://github.com/rustdesk/rustdesk.git
synced 2026-03-02 19:26:56 -05:00
v1.2.2 failed to connect to linux （appimage， qilin-linux， aarch64） SELinux caused #2071
Labels
No labels
bug
documentation
duplicate
enhancement
enhancement
enhancement
good first issue
help wanted
invalid
question
unreproducible
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
starred/rustdesk-rustdesk#2071
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @Leo-Lionni on GitHub (Aug 21, 2023).
Bug Description
2.windows11 启动 rustdesk, 试图连接linux, 日志如下:
How to Reproduce
linux 为 银河麒麟 V10 aarch64 系统,CPU 为 飞腾 FT-D2000, windows11 为 家庭版 10.0.22621
暂时不知道如何复现, 日志是看不出来的--感觉都收不到"来自 windows 的连接请求.
Expected Behavior
应该在 linux(arm 或 aarch64)上正常使用; 即 windows 连接到linux , 正常.
Operating system(s) on local side and remote side
windows 11 -> linux (银河麒麟 V10, aarch64)
RustDesk Version(s) on local side and remote side
1.2.2 -> 1.2.2
Screenshots
Additional Context
No response
@rustdesk commented on GitHub (Aug 21, 2023):
tracked by https://github.com/rustdesk/rustdesk/issues/3565
@yossish8 commented on GitHub (Sep 18, 2023):
Hello, complete beginner here but I think I can help.
This issue is SELinux related. Fedora 38 popped up those errors:
Error 1: SELinux prevents opening of /tmp/RustDesk/ipc.pid
***** Plugin catchall (100. confidence) suggests **************************
If you believe that rustdesk should be allowed open access on the ipc.pid file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
ausearch -c 'rustdesk' --raw | audit2allow -M my-rustdesk
semodule -X 300 -i my-rustdesk.pp
Additional Information:
Source Context system_u:system_r:init_t:s0
Target Context unconfined_u:object_r:user_tmp_t:s0
Target Objects /tmp/RustDesk/ipc.pid [ file ]
Source rustdesk
Source Path rustdesk
Port
Host vmfedora
Source RPM Packages
Target RPM Packages
SELinux Policy RPM selinux-policy-targeted-38.24-1.fc38.noarch
Local Policy RPM selinux-policy-targeted-38.24-1.fc38.noarch
Selinux Enabled True
Policy Type targeted
Enforcing Mode Enforcing
Host Name vmfedora
Platform Linux vmfedora 6.4.11-200.fc38.x86_64 #1 SMP
PREEMPT_DYNAMIC Wed Aug 16 17:42:12 UTC 2023
x86_64
Alert Count 3
First Seen 2023-09-18 17:44:26 IDT
Last Seen 2023-09-18 19:44:03 IDT
Local ID dffffd1d-dc17-46b1-866a-22ff3e619094
Raw Audit Messages
type=AVC msg=audit(1695055443.494:551): avc: denied { open } for pid=76949 comm="rustdesk" path="/tmp/RustDesk/ipc.pid" dev="tmpfs" ino=195 scontext=system_u:system_r:init_t:s0 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=file permissive=0
Hash: rustdesk,init_t,user_tmp_t,file,open`
Error 2:SELinux prevents writing to /tmp/RustDesk/ipc.pid
***** Plugin catchall (100. confidence) suggests **************************
If you believe that rustdesk should be allowed write access on the ipc.pid file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
ausearch -c 'rustdesk' --raw | audit2allow -M my-rustdesk
semodule -X 300 -i my-rustdesk.pp
Additional Information:
Source Context system_u:system_r:init_t:s0
Target Context unconfined_u:object_r:user_tmp_t:s0
Target Objects ipc.pid [ file ]
Source rustdesk
Source Path rustdesk
Port
Host vmfedora
Source RPM Packages
Target RPM Packages
SELinux Policy RPM selinux-policy-targeted-38.24-1.fc38.noarch
Local Policy RPM selinux-policy-targeted-38.24-1.fc38.noarch
Selinux Enabled True
Policy Type targeted
Enforcing Mode Enforcing
Host Name vmfedora
Platform Linux vmfedora 6.4.11-200.fc38.x86_64 #1 SMP
PREEMPT_DYNAMIC Wed Aug 16 17:42:12 UTC 2023
x86_64
Alert Count 3
First Seen 2023-09-18 17:44:26 IDT
Last Seen 2023-09-18 19:44:03 IDT
Local ID 92b02e81-0d56-478d-ad15-4b2f577d4321
Raw Audit Messages
type=AVC msg=audit(1695055443.495:552): avc: denied { write } for pid=76949 comm="rustdesk" name="ipc.pid" dev="tmpfs" ino=195 scontext=system_u:system_r:init_t:s0 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=file permissive=0
Hash: rustdesk,init_t,user_tmp_t,file,write
Error 3:seems to be a block of network communication
***** Plugin catchall (100. confidence) suggests **************************
If you believe that rustdesk should be allowed connectto access on the X0 unix_stream_socket by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
ausearch -c 'rustdesk' --raw | audit2allow -M my-rustdesk
semodule -X 300 -i my-rustdesk.pp
Additional Information:
Source Context system_u:system_r:init_t:s0
Target Context system_u:system_r:xserver_t:s0-s0:c0.c1023
Target Objects /tmp/.X11-unix/X0 [ unix_stream_socket ]
Source rustdesk
Source Path rustdesk
Port
Host vmfedora
Source RPM Packages
Target RPM Packages
SELinux Policy RPM selinux-policy-targeted-38.24-1.fc38.noarch
Local Policy RPM selinux-policy-targeted-38.24-1.fc38.noarch
Selinux Enabled True
Policy Type targeted
Enforcing Mode Enforcing
Host Name vmfedora
Platform Linux vmfedora 6.4.11-200.fc38.x86_64 #1 SMP
PREEMPT_DYNAMIC Wed Aug 16 17:42:12 UTC 2023
x86_64
Alert Count 6
First Seen 2023-09-18 17:44:26 IDT
Last Seen 2023-09-18 19:44:03 IDT
Local ID a05c990c-b83e-498e-8be4-34545f52a987
Raw Audit Messages
type=AVC msg=audit(1695055443.511:554): avc: denied { connectto } for pid=76949 comm="rustdesk" path="/tmp/.X11-unix/X0" scontext=system_u:system_r:init_t:s0 tcontext=system_u:system_r:xserver_t:s0-s0:c0.c1023 tclass=unix_stream_socket permissive=0
Hash: rustdesk,init_t,xserver_t,unix_stream_socket,connectto
Error4:Blocking connection on port 6000
***** Plugin catchall (100. confidence) suggests **************************
If you believe that rustdesk should be allowed name_connect access on the port 6000 tcp_socket by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
ausearch -c 'rustdesk' --raw | audit2allow -M my-rustdesk
semodule -X 300 -i my-rustdesk.pp
Additional Information:
Source Context system_u:system_r:init_t:s0
Target Context system_u:object_r:xserver_port_t:s0
Target Objects port 6000 [ tcp_socket ]
Source rustdesk
Source Path rustdesk
Port 6000
Host vmfedora
Source RPM Packages
Target RPM Packages
SELinux Policy RPM selinux-policy-targeted-38.24-1.fc38.noarch
Local Policy RPM selinux-policy-targeted-38.24-1.fc38.noarch
Selinux Enabled True
Policy Type targeted
Enforcing Mode Enforcing
Host Name vmfedora
Platform Linux vmfedora 6.4.11-200.fc38.x86_64 #1 SMP
PREEMPT_DYNAMIC Wed Aug 16 17:42:12 UTC 2023
x86_64
Alert Count 6
First Seen 2023-09-18 17:44:26 IDT
Last Seen 2023-09-18 19:44:03 IDT
Local ID 53d1dd2f-0f49-4df8-9132-43c445acd452
Raw Audit Messages
type=AVC msg=audit(1695055443.512:556): avc: denied { name_connect } for pid=76949 comm="rustdesk" dest=6000 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:xserver_port_t:s0 tclass=tcp_socket permissive=0
Hash: rustdesk,init_t,xserver_port_t,tcp_socket,name_connect`
Error5:Blocking communication on other ports such as 21114
***** Plugin connect_ports (92.2 confidence) suggests *********************
If you want to allow rustdesk to connect to network port 21114
Then you need to modify the port type.
Do
semanage port -a -t PORT_TYPE -p tcp 21114
***** Plugin catchall_boolean (7.83 confidence) suggests ******************
If you want to allow nis to enabled
Then you must tell SELinux about this by enabling the 'nis_enabled' boolean.
Do
setsebool -P nis_enabled 1
***** Plugin catchall (1.41 confidence) suggests **************************
If you believe that rustdesk should be allowed name_connect access on the port 21114 tcp_socket by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
ausearch -c 'rustdesk' --raw | audit2allow -M my-rustdesk
semodule -X 300 -i my-rustdesk.pp
Additional Information:
Source Context system_u:system_r:init_t:s0
Target Context system_u:object_r:unreserved_port_t:s0
Target Objects port 21114 [ tcp_socket ]
Source rustdesk
Source Path rustdesk
Port 21114
Host vmfedora
Source RPM Packages
Target RPM Packages
SELinux Policy RPM selinux-policy-targeted-38.24-1.fc38.noarch
Local Policy RPM selinux-policy-targeted-38.24-1.fc38.noarch
Selinux Enabled True
Policy Type targeted
Enforcing Mode Enforcing
Host Name vmfedora
Platform Linux vmfedora 6.4.11-200.fc38.x86_64 #1 SMP
PREEMPT_DYNAMIC Wed Aug 16 17:42:12 UTC 2023
x86_64
Alert Count 98
First Seen 2023-09-18 17:44:26 IDT
Last Seen 2023-09-18 19:54:36 IDT
Local ID 587a4410-751d-47cd-8044-436dee6d7aab
Raw Audit Messages
type=AVC msg=audit(1695056076.687:777): avc: denied { name_connect } for pid=76949 comm="rustdesk" dest=21114 scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:unreserved_port_t:s0 tclass=tcp_socket permissive=0
Hash: rustdesk,init_t,unreserved_port_t,tcp_socket,name_connect
so seems like rustdesk needs a way to negotiate with SELinux in a way to make it a trusted app.
temporary fixes are suggested in the SELinux logs I provided.
I haven't tried these fixed myself, I just tested by temporarily disabling SELinux with command: "sudo setenforce 0" and it works.
hope I helped