FWhen playing TF2 on Fedora, you will notice that various sounds don't emit, like music, character voices etc.
The issue is that the sound engine of TF2 is using execheap for MP3 sound decoding, which is something that SELinux permits.
More details on this:
https://github.com/ValveSoftware/Source-1-Games/issues/2734#issuecomment-1363552623
The not so good & secure solution is just disabling SELinux completely.
Proper solution:
Incorporate simple SELinux rule in rpm by @KyleGospo which is only targeting the TF2 executable.
Package:
https://copr.fedorainfracloud.org/coprs/kylegospo/hl2linux-selinux/
Issue:
https://github.com/ublue-os/main/issues/209
The issue is that the sound engine of TF2 is using execheap for MP3 sound decoding, which is something that SELinux permits.
More details on this:
https://github.com/ValveSoftware/Source-1-Games/issues/2734#issuecomment-1363552623
The not so good & secure solution is just disabling SELinux completely.
Proper solution:
Incorporate simple SELinux rule in rpm by @KyleGospo which is only targeting the TF2 executable.
Package:
https://copr.fedorainfracloud.org/coprs/kylegospo/hl2linux-selinux/
Issue:
https://github.com/ublue-os/main/issues/209
GitHub
Describe the package When playing TF2 on Fedora, you will notice that various sounds don't emit, like music, character voices etc. The issue is that the sound engine of TF2 is using execheap fo...
GitHub
Steam client version: 1468023329 Distribution: Fedora 24 Opted into Steam client beta?: No Have you checked for system updates?: Yes Here's a copy from what is being displayed in the console. [...
AFrom that policy:
This avc can be allowed using the boolean 'selinuxuser_execheap'
ABut that'd be bad 
AThis change makes sense
ADoes this work with either flatpak steam and rpm steam?
FI currently have disabled SeLinux for some script to work, but I will test when I get home
FMy desktop crashes with SeLinux enabled, can't test it
fffffffffffff
fffffffffffff
AIf you actually disabled selinux
Athen it's not surprising that's a one-way operation for the most part, you'll have unlabeled files
AIf it was just permissive then it is weird that it crashes
Fyeah, disabled
FAnyway, I planned reinstall with Ublue some day xD
KWe should leave this optional, the reason audio in Team Fortress is blocked is because the version of the audio libraries they have are subject to remote execution vulns
KAllowing it regardless is something we would never want to ship OOTB
AI couldn't find any references to this, do you have a link?
AThe RCEs are well documented: https://secret.club/2021/04/20/source-engine-rce-invite.html but I couldn't find anything specifically about the audio libraries being compromised
KSorry, by subject to I mean it's insecure by nature because it requires execheap
KThe only correct fix is for valve to update miles to a version that has the underlying issue resolved
KAnything else is trading security for functionality
KI believe they've done exactly that in Portal, so it's just a matter of Team Fortress 2 getting an update
Aoh 100% agree, I think if anything we should tell people to toggle the boolean if they want this functionality
