[BUG] Ctrl+Shift+P crashes Trivalent #1892
Description
Description
Pressing Ctrl+Shift+P in Trivalent causes Trivalent to immediately crash. This is the keyboard shortcut to open the system print dialog. (I'm reporting this here rather than in the Trivalent repo because it's an SELinux issue, and Trivalent's SELinux policy is in this repo.)
Reproduce
- Enable printing capabilities in Trivalent (Settings -> System -> Printing capabilities).
- Open any website in Trivalent.
- Press Ctrl+Shift+P.
Expected
Either the system print dialog should open or it should gracefully fail.
Actual
Trivalent immediately crashes. SELinux AVCs coinciding with the crash correspond to the following audit2allow entries:
#============= unconfined_trivalent_t ==============
allow unconfined_trivalent_t nsfs_t:file getattr;
allow unconfined_trivalent_t systemd_userdbd_runtime_t:dir read;
allow unconfined_trivalent_t tmpfs_t:filesystem remount;
Here are the corresponding audit log entries (with duplicates removed):
type=AVC msg=audit(02/01/2026 20:00:23.333:851) : avc: denied { read } for pid=3121 comm=blocking-6 name=userdb dev="tmpfs" ino=48 scontext=unconfined_u:unconfined_r:unconfined_trivalent_t:s0-s0:c0.c1023 tcontext=system_u:object_r:systemd_userdbd_runtime_t:s0 tclass=dir permissive=0
----
type=AVC msg=audit(02/01/2026 20:00:23.334:852) : avc: denied { getattr } for pid=35969 comm=bwrap path=user:[4026533140] dev="nsfs" ino=4026533140 scontext=unconfined_u:unconfined_r:unconfined_trivalent_t:s0-s0:c0.c1023 tcontext=system_u:object_r:nsfs_t:s0 tclass=file permissive=0
----
type=AVC msg=audit(02/01/2026 20:00:23.340:859) : avc: denied { remount } for pid=35970 comm=bwrap scontext=unconfined_u:unconfined_r:unconfined_trivalent_t:s0-s0:c0.c1023 tcontext=system_u:object_r:tmpfs_t:s0 tclass=filesystem permissive=0
Image
kinoite-main-hardened:latest, 2026-02-01 image
Upstream
N/A
Declaration
- I agree to follow this project's Code of Conduct.
- I declare that this is not a request for alternate community messaging or social platforms.
- I declare that I have read the secureblue website and my feature request is in-scope.