Forums Technical Discussion SELinux is giving me a lot of notifications

SELinux is giving me a lot of notifications

   1502   3   1
User Avatar
dorfman1
Member
3 posts
Joined: Sept. 2019
Offline
 
Running on Fedora 43, Houdini Apprentice,latest prod. release - v21.

SELinux is throwing a lot of errors/notifications to me. I manage to get a lot of them under control, but I keep seeing the notifications & having some licensing issues:

1. Houdini keeps asking me to get an apprentice license after each system reboot.
2. Did what SELinux asked me to do: 
 sudo ausearch -c 'sesinetd' --raw | audit2allow -M my-sesinetd; sudo semodule -X 300 -i my-sesinetd.pp
. Followed advise given here https://www.sidefx.com/forum/topic/101793/ [www.sidefx.com] and looked up the issues posted in HelpDesk /FAQ.
Below is example of one of the notifications. 

SELinux is preventing sesinetd from ioctl access on the file /root/houdini21.0/houdini.env.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that sesinetd should be allowed ioctl access on the houdini.env file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'sesinetd' --raw | audit2allow -M my-sesinetd
# semodule -X 300 -i my-sesinetd.pp

Additional Information:
Source Context                system_u:system_r:init_t:s0
Target Context                unconfined_u:object_r:admin_home_t:s0
Target Objects                /root/houdini21.0/houdini.env [ file ]
Source                        sesinetd
Source Path                   sesinetd
Port                          <Unknown>
Host                          fedora
Source RPM Packages           
Target RPM Packages           
SELinux Policy RPM            selinux-policy-targeted-42.22-1.fc43.noarch
Local Policy RPM              selinux-policy-targeted-42.22-1.fc43.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     fedora
Platform                      Linux fedora 6.18.7-200.fc43.x86_64 #1 SMP
                              PREEMPT_DYNAMIC Fri Jan 23 16:42:34 UTC 2026
                              x86_64
Alert Count                   1
First Seen                    2026-02-01 11:21:34 EST
Last Seen                     2026-02-01 11:21:34 EST
Local ID                      a0b3ebe2-cd4c-43ce-9fe3-e1b201a6cf63

Raw Audit Messages
type=AVC msg=audit(1769962894.322:103): avc:  denied  { ioctl } for  pid=1011 comm="sesinetd" path="/root/houdini21.0/houdini.env" dev="nvme0n1p3" ino=523730 ioctlcmd=0x542a scontext=system_u:system_r:init_t:s0 tcontext=unconfined_u:object_r:admin_home_t:s0 tclass=file permissive=0


Hash: sesinetd,init_t,admin_home_t,file,ioctl

Thank you !
Edited by dorfman1 - Feb. 1, 2026 11:47:49
User Avatar
Stephen Davidson
Member
18 posts
Joined: May 2016
Offline
 
Hi, I'm a basic Linux user and this issue bothered me for years. I eventually solved this issue by entering'permissive' mode.


Rocky Linux(and RHEL-based distros) are notoriously strict with SELinux, which is usually why there are so many issue with Houdini License Administrator remembering login details and license keys.


You can use temporary permissive mode with 
sudo setenforce 0


Steps to Set Permanent Permissive Mode Using Nano (Be extremely careful)
sudo nano /etc/selinux/config

In the editor, look for the line that says SELINUX=enforcing and change it to SELINUX=permissive. (Use the arrow keys to navigate, and save with Ctrl+O, then Enter, and exit with Ctrl+X.)

Reboot your system for the change to take effect:
sudo reboot

After rebooting, verify the mode with sestatus or getenforce—it should show "Permissive".

If Houdini still throws errors post-change, check the audit logs (sudo ausearch -m avc -ts recent) for clues and consider generating a custom module to allow specific actions without broadly weakening SELinux.

I recently asked SideFX support for their feedback on this issue. Once I hear back from them I will update this post.
User Avatar
hMonkey
Member
118 posts
Joined: Oct. 2018
Offline
 
or pick what you need from this post - applicable to fedora:
https://www.sidefx.com/forum/topic/90453/?page=3#post-448353 [www.sidefx.com]
also why are you running houdini as root?
Target Objects                /root/houdini21.0/houdini.env [ file ]
Edited by hMonkey - Feb. 13, 2026 07:16:56
User Avatar
MatsWatlab
Member
3 posts
Joined: June 2016
Online
 
Hi,

I had also alot of troubles getting my licenses to work and i used ChatGPT to help me. Here you can read what i and chatGPT found out and tried to make it work:



Houdini 22 hserver fails to start on Fedora due to SELinux (`203/EXEC`) — a solution

I ran into a licensing problem on Fedora 44 after installing/updating Houdini through the SideFX Launcher. I'm posting the solution here since this appears to be an SELinux issue and may affect other Fedora/RHEL-based distributions as well.

### Symptoms

Houdini reported that no valid licenses could be found, despite the License Administrator showing valid available licenses.

Checking the hserver service:

systemctl status hserver.service

showed:

hserver.service: Failed at step EXEC spawning /usr/lib/sesi/hserver/hserver: Permission denied
Main process exited, status=203/EXEC

The executable itself existed and had normal Unix execute permissions:

-r-xr-xr-x. 1 root root ... /usr/lib/sesi/hserver/hserver

Trying the Houdini hserver client also showed that no hserver daemon was running:

/opt/hfs22.0.368/bin/hserver -l


### SELinux was blocking hserver

Checking the SELinux audit log:

sudo ausearch -m AVC -ts recent | grep -i hserver

showed denials such as:

avc: denied { execute } ...
scontext=system_u:system_r:init_t:s0
tcontext=system_u:object_r:hserver_rw_content_t:s0


After allowing that, further denials appeared for:

{ read open }

and eventually:

{ execute_no_trans }


The important part turned out to be the SELinux context assigned to the executable:

ls -lZ /usr/lib/sesi/hserver/hserver


returned:

system_u:object_r:hserver_rw_content_t:s0

`restorecon` did not fix this because SELinux actually considered that to be the configured context:


matchpathcon /usr/lib/sesi/hserver/hserver

also returned:

system_u:object_r:hserver_rw_content_t:s0


### Solution

Instead of adding increasingly broad SELinux exceptions, I changed the persistent SELinux context of the hserver executable to the normal `bin_t` executable type:


sudo semanage fcontext -a -t bin_t '/usr/lib/sesi/hserver/hserver'
sudo restorecon -v /usr/lib/sesi/hserver/hserver


Afterwards:

ls -lZ /usr/lib/sesi/hserver/hserver

showed the binary as `bin_t`.

Then I reset and restarted the service:

sudo systemctl reset-failed hserver.service
sudo systemctl restart hserver.service


And:

systemctl status hserver.service


finally showed:

Active: active (running)

Running:

/opt/hfs22.0.368/bin/hserver -l

then showed that hserver was running and connected to:

https://www.sidefx.com/license/sesinetd [www.sidefx.com]

Houdini could acquire its license normally again.


### Note about `audit2allow`

During troubleshooting I temporarily created a local SELinux policy using `audit2allow`. This was **not necessary after fixing the file context**.

I removed the temporary policy and restarted hserver again. It continued to work correctly, confirming that changing the context of `/usr/lib/sesi/hserver/hserver` to `bin_t` was the actual fix.

So if you're seeing:


hserver.service: Failed at step EXEC
status=203/EXEC
Permission denied


on Fedora or another SELinux-enabled distribution, check this first:


ls -lZ /usr/lib/sesi/hserver/hserver
sudo ausearch -m AVC -ts recent | grep -i hserver

If the hserver executable is labeled `hserver_rw_content_t` and SELinux is blocking systemd from executing it, changing the persistent context of that executable to `bin_t` solved the problem for me.

**System in my case:**

* Fedora 44
* Houdini / hserver 22.0.368
* Installed through SideFX Launcher
* SELinux enforcing
Edited by MatsWatlab - Aug. 20, 2026 18:46:58
  • Quick Links