Bug 119769

Summary: cannot run as user
Product: [Fedora] Fedora Reporter: Scott Sloan <devscott>
Component: usermodeAssignee: Jindrich Novy <jnovy>
Status: CLOSED CURRENTRELEASE QA Contact: David Lawrence <dkl>
Severity: high Docs Contact:
Priority: high    
Version: rawhideCC: de_lupus, dwalsh, lsof, pknirsch, tammy.c.fox, twaugh
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2004-11-30 19:11:33 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
strace output none

Description Scott Sloan 2004-04-02 01:27:11 UTC 
Description of problem:

[scott@localhost scott]$ system-logviewer
Could not set exec context to user_u:sysadm_r:sysadm_t.
[scott@localhost scott]$ su
Password:
[root@localhost scott]# sysetm-logviewer
bash: sysetm-logviewer: command not found
[root@localhost scott]# system-logviewer
/usr/share/system-logviewer/LogFileFrame.py:121: DeprecationWarning:
but we use it for a constructor for convenience
  self.searchEntry = gtk.Entry()
[root@localhost scott]#

This happens with all system-*

How reproducible:

every time

Steps to Reproduce:
1. from user, try and launch and of the system- programs
2. type in root password
3. they die
  
Actual results:

program is killed

Expected results:

program should launch

Additional info:

if this is not a bug then all system programs should be removed from
the user menu. what is the point of the user seeing them if they can't
not run them even if they know the root password
Comment 1 Scott Sloan 2004-04-02 08:55:08 UTC 
Created attachment 99071 [details]
strace output
Comment 2 Tammy Fox 2004-04-02 16:03:05 UTC 
This looks like it might be a symptom of SELinux. Please disable
SELinux with the setenforce 0 command as described at
http://people.redhat.com/kwade/fedora-docs/selinux-faq-en/, try to run
system-logviewer as a user again, and let me know what happens.
Comment 3 Scott Sloan 2004-04-02 16:35:18 UTC 
With Setting: 

/etc/sysconfig/selinux

selinux=disabled

I can start system-* succssfully, so you're right Tammy in that this
is a direct symptom of selinux.
Comment 4 Tammy Fox 2004-04-02 16:51:49 UTC 
After further investigation, it looks like userhelper is dumping out
the  Could not set exec context to user_u:sysadm_r:sysadm_t error message.

I am changing the component to usermode.
Comment 5 Tim Waugh 2004-04-04 14:19:07 UTC 
FWIW, this works for users created with 'useradd' (i.e. with
sysadm_r), but not with seuser add -R user_r (i.e. with user_r).

[tim@tornado tim]$ id -Z
tim:user_r:user_t
[tim@tornado tim]$ gdmsetup
Could not set exec context to tim:sysadm_r:sysadm_t.

[foo@tornado foo]$ id -Z
user_u:sysadm_r:sysadm_t
[foo@tornado foo]$ gdmsetup
[asks for password, then works]
Comment 6 Bill Nottingham 2004-04-05 21:42:39 UTC 
*** Bug 119602 has been marked as a duplicate of this bug. ***
Comment 7 Bill Nottingham 2004-04-05 21:42:46 UTC 
*** Bug 119858 has been marked as a duplicate of this bug. ***
Comment 8 Daniel Walsh 2004-11-30 19:11:33 UTC 
Current policy fixes this problem