Bug 1959173
| Summary: | Xorg login impossible when user is mapped to user_u | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Markus Iturriaga <miturria> |
| Component: | xorg-x11-server | Assignee: | Adam Jackson <ajax> |
| Status: | CLOSED WONTFIX | QA Contact: | Desktop QE <desktop-qa-list> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 8.3 | CC: | miturria, rmetrich, zpytela |
| Target Milestone: | rc | ||
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2022-11-10 07:27:59 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
PS: Mapping __default__ to staff_u works around this issue also but is not ideal. I wonder why Xorg runs as EUID 0. (If Xorg runs as EUID != 0, it writes its log file to ~/.local/share/xorg/ by default instead of /var/log/) Can you attach the Xorg log file from a successful login? It runs as root and then spawns a new Xorg process under the SELinux context of the user logging in. This behavior is different from RHEL7. If I set __default__ to staff_u, here is what the Xorg processes look like: system_u:system_r:xserver_t:s0-s0:c0.c1023 root 4567 4559 0 May10 tty1 00:00:01 /usr/libexec/Xorg vt1 -displayfd 3 -auth /run/user/42/gdm/Xauthority -background none -noreset -keeptty -novtswitch -verbose 3 staff_u:staff_r:xserver_t:s0 root 34882 34878 1 08:51 tty2 00:00:00 /usr/libexec/Xorg vt2 -displayfd 3 -auth /run/user/1000/gdm/Xauthority -background none -noreset -keeptty -novtswitch -verbose 3 Below is a successful Xorg log file when logging in as staff_u. The critical part that doesn't work is 'Log file renamed from "/var/log/Xorg.pid-34882.log" to "/var/log/Xorg.1.log"' - staff_u cannot manipulate files in /var/log. I've tried, by the way, to set "needs_root_rights = yes" in /etc/X11/Xwrapper.config but that makes no difference. The issue is definitely one of SELinux contexts. Any staff_u, sysadm_u (with xdm_sysadm_login on), or unconfined_u user can log in. Only user_u get rejected. Even after allowing access to files with var_log_t and xserver_log_t, there are still a bunch of SELinux denials in the audit log but they are not fatal to running Xorg. Again, this does not happen with XWayland, but that isn't an option on some hardware. [ 61628.597] _XSERVTransSocketUNIXCreateListener: ...SocketCreateListener() failed [ 61628.597] _XSERVTransMakeAllCOTSServerListeners: server already running [ 61628.598] (--) Log file renamed from "/var/log/Xorg.pid-34882.log" to "/var/log/Xorg.1.log" [ 61628.598] X.Org X Server 1.20.8 X Protocol Version 11, Revision 0 [ 61628.598] Build Operating System: 4.18.0-240.1.1.el8_3.x86_64 [ 61628.598] Current Operating System: Linux xxxx.domain.edu 4.18.0-240.22.1.el8_3.x86_64 #1 SMP Thu Mar 25 14:36:04 EDT 2021 x86_64 [ 61628.598] Kernel command line: BOOT_IMAGE=(hd0,gpt2)/vmlinuz-4.18.0-240.22.1.el8_3.x86_64 root=/dev/mapper/vg_xxxx-root ro crashkernel=auto resume=/dev/mapper/vg_xxxx-swap rd.lvm.lv=vg_xxxx/root rd.lvm.lv=vg_xxxx/swap biosdevname=0 rhgb quiet [ 61628.598] Build Date: 01 December 2020 12:57:54PM [ 61628.598] Build ID: xorg-x11-server 1.20.8-6.1.el8_3 [ 61628.598] Current version of pixman: 0.38.4 [ 61628.598] Before reporting problems, check http://wiki.x.org to make sure that you have the latest version. [ 61628.598] Markers: (--) probed, (**) from config file, (==) default setting, (++) from command line, (!!) notice, (II) informational, (WW) warning, (EE) error, (NI) not implemented, (??) unknown. [ 61628.598] (==) Log file: "/var/log/Xorg.1.log", Time: Tue May 11 08:51:14 2021 [ 61628.599] (==) Using config directory: "/etc/X11/xorg.conf.d" [ 61628.599] (==) Using system config directory "/usr/share/X11/xorg.conf.d" [ 61628.599] (==) No Layout section. Using the first Screen section. [ 61628.599] (==) No screen section available. Using defaults. [ 61628.599] (**) |-->Screen "Default Screen Section" (0) [ 61628.599] (**) | |-->Monitor "<default monitor>" [ 61628.599] (==) No monitor specified for screen "Default Screen Section". Using a default monitor configuration. [ 61628.599] (==) Automatically adding devices [ 61628.599] (==) Automatically enabling devices [ 61628.599] (==) Automatically adding GPU devices [ 61628.599] (==) Automatically binding GPU devices [ 61628.599] (==) Max clients allowed: 256, resource mask: 0x1fffff [ 61628.599] (==) FontPath set to: catalogue:/etc/X11/fontpath.d, built-ins [ 61628.599] (==) ModulePath set to "/usr/lib64/xorg/modules" [ 61628.599] (II) The server relies on udev to provide the list of input devices. If no devices become available, reconfigure udev or disable AutoAddDevices. [ 61628.599] (II) Loader magic: 0x5597d3ca8020 [ 61628.599] (II) Module ABI versions: [ 61628.599] X.Org ANSI C Emulation: 0.4 [ 61628.599] X.Org Video Driver: 24.1 [ 61628.599] X.Org XInput driver : 24.1 [ 61628.599] X.Org Server Extension : 10.0 [ 61628.600] (++) using VT number 2 [ 61628.602] (II) systemd-logind: took control of session /org/freedesktop/login1/session/_313 [ 61628.603] (--) PCI:*(1@0:0:0) 10de:1382:10de:1065 rev 162, Mem @ 0xf6000000/16777216, 0xe0000000/268435456, 0xf0000000/33554432, I/O @ 0x0000e000/128, BIOS @ 0x????????/131072 [ 61628.603] (II) LoadModule: "glx" [ 61628.603] (II) Loading /usr/lib64/xorg/modules/extensions/libglx.so [ 61628.605] (II) Module glx: vendor="X.Org Foundation" [ 61628.605] compiled for 1.20.8, module version = 1.0.0 [ 61628.605] ABI class: X.Org Server Extension, version 10.0 [ 61628.720] (==) Matched nouveau as autoconfigured driver 0 [ 61628.720] (==) Matched modesetting as autoconfigured driver 1 [ 61628.720] (==) Matched fbdev as autoconfigured driver 2 [ 61628.720] (==) Matched vesa as autoconfigured driver 3 [ 61628.720] (==) Assigned the driver to the xf86ConfigLayout [ 61628.720] (II) LoadModule: "nouveau" [ 61628.720] (II) Loading /usr/lib64/xorg/modules/drivers/nouveau_drv.so [ 61628.721] (II) Module nouveau: vendor="X.Org Foundation" [ 61628.721] compiled for 1.20.1, module version = 1.0.15 [ 61628.721] Module class: X.Org Video Driver [ 61628.721] ABI class: X.Org Video Driver, version 24.0 [ 61628.721] (II) LoadModule: "modesetting" [ 61628.721] (II) Loading /usr/lib64/xorg/modules/drivers/modesetting_drv.so [ 61628.721] (II) Module modesetting: vendor="X.Org Foundation" [ 61628.721] compiled for 1.20.8, module version = 1.20.8 [ 61628.721] Module class: X.Org Video Driver [ 61628.721] ABI class: X.Org Video Driver, version 24.1 [ 61628.721] (II) LoadModule: "fbdev" [ 61628.721] (II) Loading /usr/lib64/xorg/modules/drivers/fbdev_drv.so [ 61628.721] (II) Module fbdev: vendor="X.Org Foundation" [ 61628.721] compiled for 1.20.1, module version = 0.5.0 [ 61628.721] Module class: X.Org Video Driver [ 61628.721] ABI class: X.Org Video Driver, version 24.0 [ 61628.721] (II) LoadModule: "vesa" [ 61628.721] (II) Loading /usr/lib64/xorg/modules/drivers/vesa_drv.so [ 61628.721] (II) Module vesa: vendor="X.Org Foundation" [ 61628.721] compiled for 1.20.2, module version = 2.4.0 [ 61628.721] Module class: X.Org Video Driver [ 61628.721] ABI class: X.Org Video Driver, version 24.0 [ 61628.721] (II) NOUVEAU driver [ 61628.721] (II) NOUVEAU driver for NVIDIA chipset families : [ 61628.721] RIVA TNT (NV04) [ 61628.721] RIVA TNT2 (NV05) [ 61628.721] GeForce 256 (NV10) [ 61628.721] GeForce 2 (NV11, NV15) [ 61628.721] GeForce 4MX (NV17, NV18) [ 61628.721] GeForce 3 (NV20) [ 61628.721] GeForce 4Ti (NV25, NV28) [ 61628.721] GeForce FX (NV3x) [ 61628.721] GeForce 6 (NV4x) [ 61628.721] GeForce 7 (G7x) [ 61628.721] GeForce 8 (G8x) [ 61628.721] GeForce GTX 200 (NVA0) [ 61628.721] GeForce GTX 400 (NVC0) [ 61628.721] (II) modesetting: Driver for Modesetting Kernel Drivers: kms [ 61628.721] (II) FBDEV: driver for framebuffer: fbdev [ 61628.721] (II) VESA: driver for VESA chipsets: vesa [ 61628.836] (EE) [drm] Failed to open DRM device for pci:0000:01:00.0: -19 [ 61628.836] (EE) open /dev/dri/card0: No such file or directory [ 61628.836] (WW) Falling back to old probe method for modesetting [ 61628.836] (EE) open /dev/dri/card0: No such file or directory [ 61628.836] (II) Loading sub module "fbdevhw" [ 61628.836] (II) LoadModule: "fbdevhw" [ 61628.836] (II) Loading /usr/lib64/xorg/modules/libfbdevhw.so [ 61628.836] (II) Module fbdevhw: vendor="X.Org Foundation" [ 61628.836] compiled for 1.20.8, module version = 0.0.2 [ 61628.836] ABI class: X.Org Video Driver, version 24.1 [ 61628.836] (EE) Unable to find a valid framebuffer device [ 61628.836] (WW) Falling back to old probe method for fbdev [ 61628.836] (II) Loading sub module "fbdevhw" [ 61628.836] (II) LoadModule: "fbdevhw" [ 61628.836] (II) Loading /usr/lib64/xorg/modules/libfbdevhw.so [ 61628.836] (II) Module fbdevhw: vendor="X.Org Foundation" [ 61628.836] compiled for 1.20.8, module version = 0.0.2 [ 61628.836] ABI class: X.Org Video Driver, version 24.1 [ 61628.836] (II) FBDEV(2): using default device [ 61628.836] vesa: Refusing to run on UEFI [ 61628.836] (EE) Screen 0 deleted because of no matching config section. [ 61628.836] (II) UnloadModule: "modesetting" [ 61628.836] (EE) Screen 0 deleted because of no matching config section. [ 61628.836] (II) UnloadModule: "fbdev" [ 61628.836] (II) UnloadSubModule: "fbdevhw" [ 61628.836] (II) FBDEV(0): Creating default Display subsection in Screen section "Default Screen Section" for depth/fbbpp 24/32 [ 61628.836] (==) FBDEV(0): Depth 24, (==) framebuffer bpp 32 [ 61628.836] (==) FBDEV(0): RGB weight 888 [ 61628.836] (==) FBDEV(0): Default visual is TrueColor [ 61628.836] (==) FBDEV(0): Using gamma correction (1.0, 1.0, 1.0) [ 61628.836] (II) FBDEV(0): hardware: EFI VGA (video memory: 8640kB) [ 61628.836] (DB) xf86MergeOutputClassOptions unsupported bus type 0 [ 61628.836] (II) FBDEV(0): checking modes against framebuffer device... [ 61628.836] (II) FBDEV(0): checking modes against monitor... [ 61628.836] (II) FBDEV(0): Virtual size is 1920x1080 (pitch 1920) [ 61628.836] (**) FBDEV(0): Built-in mode "current": 207.4 MHz, 85.3 kHz, 77.2 Hz [ 61628.836] (II) FBDEV(0): Modeline "current"x0.0 207.38 1920 1952 2192 2432 1080 1084 1088 1104 -hsync -vsync -csync (85.3 kHz b) [ 61628.836] (==) FBDEV(0): DPI set to (96, 96) [ 61628.836] (II) Loading sub module "fb" [ 61628.836] (II) LoadModule: "fb" [ 61628.836] (II) Loading /usr/lib64/xorg/modules/libfb.so [ 61628.836] (II) Module fb: vendor="X.Org Foundation" [ 61628.836] compiled for 1.20.8, module version = 1.0.0 [ 61628.836] ABI class: X.Org ANSI C Emulation, version 0.4 [ 61628.836] (**) FBDEV(0): using shadow framebuffer [ 61628.836] (II) Loading sub module "shadow" [ 61628.836] (II) LoadModule: "shadow" [ 61628.837] (II) Loading /usr/lib64/xorg/modules/libshadow.so [ 61628.837] (II) Module shadow: vendor="X.Org Foundation" [ 61628.837] compiled for 1.20.8, module version = 1.1.0 [ 61628.837] ABI class: X.Org ANSI C Emulation, version 0.4 [ 61628.837] (II) FBDEV(0): FBIOBLANK: Invalid argument (Screen blanking not supported by kernel - disabling) [ 61628.837] (==) FBDEV(0): Backing store enabled [ 61628.837] (==) FBDEV(0): DPMS enabled [ 61628.837] (II) Initializing extension Generic Event Extension [ 61628.837] (II) Initializing extension SHAPE [ 61628.837] (II) Initializing extension MIT-SHM [ 61628.837] (II) Initializing extension XInputExtension [ 61628.837] (II) Initializing extension XTEST [ 61628.837] (II) Initializing extension BIG-REQUESTS [ 61628.837] (II) Initializing extension SYNC [ 61628.837] (II) Initializing extension XKEYBOARD [ 61628.837] (II) Initializing extension XC-MISC [ 61628.838] (II) Initializing extension XFIXES [ 61628.838] (II) Initializing extension RENDER [ 61628.838] (II) Initializing extension RANDR [ 61628.838] (II) Initializing extension COMPOSITE [ 61628.838] (II) Initializing extension DAMAGE [ 61628.838] (II) Initializing extension MIT-SCREEN-SAVER [ 61628.838] (II) Initializing extension DOUBLE-BUFFER [ 61628.838] (II) Initializing extension RECORD [ 61628.838] (II) Initializing extension DPMS [ 61628.838] (II) Initializing extension Present [ 61628.838] (II) Initializing extension DRI3 [ 61628.838] (II) Initializing extension X-Resource [ 61628.838] (II) Initializing extension XVideo [ 61628.838] (II) Initializing extension XVideo-MotionCompensation [ 61628.838] (II) Initializing extension SELinux [ 61628.838] (II) SELinux: Disabled by boolean [ 61628.838] (II) Initializing extension GLX [ 61628.839] (II) AIGLX: Screen 0 is not DRI2 capable [ 61628.877] (II) IGLX: Loaded and initialized swrast [ 61628.877] (II) GLX: Initialized DRISWRAST GL provider for screen 0 [ 61628.877] (II) Initializing extension XFree86-VidModeExtension [ 61628.877] (II) Initializing extension XFree86-DGA [ 61628.877] (II) Initializing extension XFree86-DRI [ 61628.877] (II) Initializing extension DRI2 [ 61628.896] (II) config/udev: Adding input device Power Button (/dev/input/event2) [ 61628.896] (**) Power Button: Applying InputClass "evdev keyboard catchall" [ 61628.896] (**) Power Button: Applying InputClass "libinput keyboard catchall" [ 61628.896] (**) Power Button: Applying InputClass "system-keyboard" [ 61628.896] (II) LoadModule: "libinput" [ 61628.896] (II) Loading /usr/lib64/xorg/modules/input/libinput_drv.so [ 61628.901] (II) Module libinput: vendor="X.Org Foundation" [ 61628.901] compiled for 1.20.3, module version = 0.29.0 [ 61628.901] Module class: X.Org XInput Driver [ 61628.901] ABI class: X.Org XInput driver, version 24.1 [ 61628.901] (II) Using input driver 'libinput' for 'Power Button' [ 61628.902] (II) systemd-logind: got fd for /dev/input/event2 13:66 fd 23 paused 0 [ 61628.902] (**) Power Button: always reports core events [ 61628.902] (**) Option "Device" "/dev/input/event2" [ 61628.902] (**) Option "_source" "server/udev" [ 61628.903] (II) event2 - Power Button: is tagged by udev as: Keyboard [ 61628.904] (II) event2 - Power Button: device is a keyboard [ 61628.904] (II) event2 - Power Button: device removed [ 61628.904] (**) Option "config_info" "udev:/sys/devices/LNXSYSTM:00/LNXPWRBN:00/input/input2/event2" [ 61628.904] (II) XINPUT: Adding extended input device "Power Button" (type: KEYBOARD, id 6) [ 61628.904] (**) Option "xkb_layout" "us" [ 61628.904] (II) event2 - Power Button: is tagged by udev as: Keyboard [ 61628.904] (II) event2 - Power Button: device is a keyboard [ 61628.905] (II) config/udev: Adding input device Power Button (/dev/input/event1) [ 61628.905] (**) Power Button: Applying InputClass "evdev keyboard catchall" [ 61628.905] (**) Power Button: Applying InputClass "libinput keyboard catchall" [ 61628.905] (**) Power Button: Applying InputClass "system-keyboard" [ 61628.905] (II) Using input driver 'libinput' for 'Power Button' [ 61628.905] (II) systemd-logind: got fd for /dev/input/event1 13:65 fd 26 paused 0 [ 61628.905] (**) Power Button: always reports core events [ 61628.906] (**) Option "Device" "/dev/input/event1" [ 61628.906] (**) Option "_source" "server/udev" [ 61628.906] (II) event1 - Power Button: is tagged by udev as: Keyboard [ 61628.906] (II) event1 - Power Button: device is a keyboard [ 61628.906] (II) event1 - Power Button: device removed [ 61628.906] (**) Option "config_info" "udev:/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0C0C:00/input/input1/event1" [ 61628.906] (II) XINPUT: Adding extended input device "Power Button" (type: KEYBOARD, id 7) [ 61628.906] (**) Option "xkb_layout" "us" [ 61628.907] (II) event1 - Power Button: is tagged by udev as: Keyboard [ 61628.907] (II) event1 - Power Button: device is a keyboard [ 61628.907] (II) config/udev: Adding input device Sleep Button (/dev/input/event0) [ 61628.907] (**) Sleep Button: Applying InputClass "evdev keyboard catchall" [ 61628.907] (**) Sleep Button: Applying InputClass "libinput keyboard catchall" [ 61628.907] (**) Sleep Button: Applying InputClass "system-keyboard" [ 61628.907] (II) Using input driver 'libinput' for 'Sleep Button' [ 61628.908] (II) systemd-logind: got fd for /dev/input/event0 13:64 fd 27 paused 0 [ 61628.908] (**) Sleep Button: always reports core events [ 61628.908] (**) Option "Device" "/dev/input/event0" [ 61628.908] (**) Option "_source" "server/udev" [ 61628.909] (II) event0 - Sleep Button: is tagged by udev as: Keyboard [ 61628.909] (II) event0 - Sleep Button: device is a keyboard [ 61628.909] (II) event0 - Sleep Button: device removed [ 61628.909] (**) Option "config_info" "udev:/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0C0E:00/input/input0/event0" [ 61628.909] (II) XINPUT: Adding extended input device "Sleep Button" (type: KEYBOARD, id 8) [ 61628.909] (**) Option "xkb_layout" "us" [ 61628.909] (II) event0 - Sleep Button: is tagged by udev as: Keyboard [ 61628.909] (II) event0 - Sleep Button: device is a keyboard [ 61628.910] (II) config/udev: Adding input device PixArt Dell MS116 USB Optical Mouse (/dev/input/event3) [ 61628.910] (**) PixArt Dell MS116 USB Optical Mouse: Applying InputClass "evdev pointer catchall" [ 61628.910] (**) PixArt Dell MS116 USB Optical Mouse: Applying InputClass "libinput pointer catchall" [ 61628.910] (II) Using input driver 'libinput' for 'PixArt Dell MS116 USB Optical Mouse' [ 61628.910] (II) systemd-logind: got fd for /dev/input/event3 13:67 fd 28 paused 0 [ 61628.910] (**) PixArt Dell MS116 USB Optical Mouse: always reports core events [ 61628.910] (**) Option "Device" "/dev/input/event3" [ 61628.910] (**) Option "_source" "server/udev" [ 61628.911] (II) event3 - PixArt Dell MS116 USB Optical Mouse: is tagged by udev as: Mouse [ 61628.911] (II) event3 - PixArt Dell MS116 USB Optical Mouse: device set to 1000 DPI [ 61628.911] (II) event3 - PixArt Dell MS116 USB Optical Mouse: device is a pointer [ 61628.911] (II) event3 - PixArt Dell MS116 USB Optical Mouse: device removed [ 61628.911] (**) Option "config_info" "udev:/sys/devices/pci0000:00/0000:00:14.0/usb1/1-4/1-4.1/1-4.1:1.0/0003:413C:301A.0001/input/input3/event3" [ 61628.911] (II) XINPUT: Adding extended input device "PixArt Dell MS116 USB Optical Mouse" (type: MOUSE, id 9) [ 61628.912] (**) Option "AccelerationScheme" "none" [ 61628.912] (**) PixArt Dell MS116 USB Optical Mouse: (accel) selected scheme none/0 [ 61628.912] (**) PixArt Dell MS116 USB Optical Mouse: (accel) acceleration factor: 2.000 [ 61628.912] (**) PixArt Dell MS116 USB Optical Mouse: (accel) acceleration threshold: 4 [ 61628.912] (II) event3 - PixArt Dell MS116 USB Optical Mouse: is tagged by udev as: Mouse [ 61628.912] (II) event3 - PixArt Dell MS116 USB Optical Mouse: device set to 1000 DPI [ 61628.913] (II) event3 - PixArt Dell MS116 USB Optical Mouse: device is a pointer [ 61628.913] (II) config/udev: Adding input device PixArt Dell MS116 USB Optical Mouse (/dev/input/mouse0) [ 61628.913] (II) No input driver specified, ignoring this device. [ 61628.913] (II) This device may have been added with another device file. [ 61628.914] (II) config/udev: Adding input device Dell KB216 Wired Keyboard (/dev/input/event4) [ 61628.914] (**) Dell KB216 Wired Keyboard: Applying InputClass "evdev keyboard catchall" [ 61628.914] (**) Dell KB216 Wired Keyboard: Applying InputClass "libinput keyboard catchall" [ 61628.914] (**) Dell KB216 Wired Keyboard: Applying InputClass "system-keyboard" [ 61628.914] (II) Using input driver 'libinput' for 'Dell KB216 Wired Keyboard' [ 61628.914] (II) systemd-logind: got fd for /dev/input/event4 13:68 fd 29 paused 0 [ 61628.914] (**) Dell KB216 Wired Keyboard: always reports core events [ 61628.914] (**) Option "Device" "/dev/input/event4" [ 61628.914] (**) Option "_source" "server/udev" [ 61628.915] (II) event4 - Dell KB216 Wired Keyboard: is tagged by udev as: Keyboard [ 61628.915] (II) event4 - Dell KB216 Wired Keyboard: device is a keyboard [ 61628.915] (II) event4 - Dell KB216 Wired Keyboard: device removed [ 61628.915] (**) Option "config_info" "udev:/sys/devices/pci0000:00/0000:00:14.0/usb1/1-4/1-4.2/1-4.2:1.0/0003:413C:2113.0002/input/input4/event4" [ 61628.915] (II) XINPUT: Adding extended input device "Dell KB216 Wired Keyboard" (type: KEYBOARD, id 10) [ 61628.915] (**) Option "xkb_layout" "us" [ 61628.916] (II) event4 - Dell KB216 Wired Keyboard: is tagged by udev as: Keyboard [ 61628.916] (II) event4 - Dell KB216 Wired Keyboard: device is a keyboard [ 61628.917] (II) config/udev: Adding input device Dell KB216 Wired Keyboard System Control (/dev/input/event5) [ 61628.917] (**) Dell KB216 Wired Keyboard System Control: Applying InputClass "evdev keyboard catchall" [ 61628.917] (**) Dell KB216 Wired Keyboard System Control: Applying InputClass "libinput keyboard catchall" [ 61628.917] (**) Dell KB216 Wired Keyboard System Control: Applying InputClass "system-keyboard" [ 61628.917] (II) Using input driver 'libinput' for 'Dell KB216 Wired Keyboard System Control' [ 61628.917] (II) systemd-logind: got fd for /dev/input/event5 13:69 fd 30 paused 0 [ 61628.917] (**) Dell KB216 Wired Keyboard System Control: always reports core events [ 61628.917] (**) Option "Device" "/dev/input/event5" [ 61628.917] (**) Option "_source" "server/udev" [ 61628.919] (II) event5 - Dell KB216 Wired Keyboard System Control: is tagged by udev as: Keyboard [ 61628.919] (II) event5 - Dell KB216 Wired Keyboard System Control: device is a keyboard [ 61628.919] (II) event5 - Dell KB216 Wired Keyboard System Control: device removed [ 61628.919] (**) Option "config_info" "udev:/sys/devices/pci0000:00/0000:00:14.0/usb1/1-4/1-4.2/1-4.2:1.1/0003:413C:2113.0003/input/input5/event5" [ 61628.919] (II) XINPUT: Adding extended input device "Dell KB216 Wired Keyboard System Control" (type: KEYBOARD, id 11) [ 61628.919] (**) Option "xkb_layout" "us" [ 61628.920] (II) event5 - Dell KB216 Wired Keyboard System Control: is tagged by udev as: Keyboard [ 61628.920] (II) event5 - Dell KB216 Wired Keyboard System Control: device is a keyboard [ 61628.921] (II) config/udev: Adding input device Dell KB216 Wired Keyboard Consumer Control (/dev/input/event6) [ 61628.921] (**) Dell KB216 Wired Keyboard Consumer Control: Applying InputClass "evdev keyboard catchall" [ 61628.921] (**) Dell KB216 Wired Keyboard Consumer Control: Applying InputClass "libinput keyboard catchall" [ 61628.921] (**) Dell KB216 Wired Keyboard Consumer Control: Applying InputClass "system-keyboard" [ 61628.921] (II) Using input driver 'libinput' for 'Dell KB216 Wired Keyboard Consumer Control' [ 61628.922] (II) systemd-logind: got fd for /dev/input/event6 13:70 fd 31 paused 0 [ 61628.922] (**) Dell KB216 Wired Keyboard Consumer Control: always reports core events [ 61628.922] (**) Option "Device" "/dev/input/event6" [ 61628.922] (**) Option "_source" "server/udev" [ 61628.923] (II) event6 - Dell KB216 Wired Keyboard Consumer Control: is tagged by udev as: Keyboard [ 61628.923] (II) event6 - Dell KB216 Wired Keyboard Consumer Control: device is a keyboard [ 61628.923] (II) event6 - Dell KB216 Wired Keyboard Consumer Control: device removed [ 61628.923] (II) libinput: Dell KB216 Wired Keyboard Consumer Control: needs a virtual subdevice [ 61628.923] (**) Option "config_info" "udev:/sys/devices/pci0000:00/0000:00:14.0/usb1/1-4/1-4.2/1-4.2:1.1/0003:413C:2113.0003/input/input6/event6" [ 61628.923] (II) XINPUT: Adding extended input device "Dell KB216 Wired Keyboard Consumer Control" (type: MOUSE, id 12) [ 61628.923] (**) Option "AccelerationScheme" "none" [ 61628.923] (**) Dell KB216 Wired Keyboard Consumer Control: (accel) selected scheme none/0 [ 61628.923] (**) Dell KB216 Wired Keyboard Consumer Control: (accel) acceleration factor: 2.000 [ 61628.923] (**) Dell KB216 Wired Keyboard Consumer Control: (accel) acceleration threshold: 4 [ 61628.924] (II) event6 - Dell KB216 Wired Keyboard Consumer Control: is tagged by udev as: Keyboard [ 61628.924] (II) event6 - Dell KB216 Wired Keyboard Consumer Control: device is a keyboard [ 61628.924] (II) config/udev: Adding input device PC Speaker (/dev/input/event7) [ 61628.924] (II) No input driver specified, ignoring this device. [ 61628.924] (II) This device may have been added with another device file. [ 61628.927] (**) Dell KB216 Wired Keyboard Consumer Control: Applying InputClass "evdev keyboard catchall" [ 61628.927] (**) Dell KB216 Wired Keyboard Consumer Control: Applying InputClass "libinput keyboard catchall" [ 61628.927] (**) Dell KB216 Wired Keyboard Consumer Control: Applying InputClass "system-keyboard" [ 61628.927] (II) Using input driver 'libinput' for 'Dell KB216 Wired Keyboard Consumer Control' [ 61628.927] (II) systemd-logind: returning pre-existing fd for /dev/input/event6 13:70 [ 61628.927] (**) Dell KB216 Wired Keyboard Consumer Control: always reports core events [ 61628.927] (**) Option "Device" "/dev/input/event6" [ 61628.927] (**) Option "_source" "_driver/libinput" [ 61628.927] (II) libinput: Dell KB216 Wired Keyboard Consumer Control: is a virtual subdevice [ 61628.927] (**) Option "config_info" "udev:/sys/devices/pci0000:00/0000:00:14.0/usb1/1-4/1-4.2/1-4.2:1.1/0003:413C:2113.0003/input/input6/event6" [ 61628.927] (II) XINPUT: Adding extended input device "Dell KB216 Wired Keyboard Consumer Control" (type: KEYBOARD, id 13) [ 61628.927] (**) Option "xkb_layout" "us" After evaluating this issue, there are no plans to address it further or fix it in an upcoming release. Therefore, it is being closed. If plans change such that this issue will be fixed in an upcoming release, then the bug can be reopened. |
Description of problem: Users mapped to user_u cannot log in on graphical console use Xorg (works in XWayland) Version-Release number of selected component (if applicable): xorg-x11-server-Xorg-1.20.8-6.1.el8_3 How reproducible: See steps below. It fails on an otherwise unmodified RHEL 8 system. Steps to Reproduce: 1. Install RHEL8.3 with "Server with GUI" 2. If the system has a video card that causes it to default to Xorg, this step is unnecessary. You can either set the default to Xorg in /etc/gdm/custom.conf: [daemon] # Uncoment the line below to force the login screen to use Xorg WaylandEnable=false Or alternatively, you can select an X11 session at login. 3. Make user_u the default: semanage login -m -s user_u -r s0 __default__ Actual results: Any user with user_u cannot log in at the GUI console. The user_t context cannot manipulate files in /var/log type=AVC msg=audit(1620676186.094:159): avc: denied { write } for pid=7104 comm="Xorg" name="log" dev="dm-4" ino=8388741 scontext=user_u:user_r:user_t:s0 tcontext=system_u:object_r:var_log_t:s0 tclass=dir permissive=0 type=SYSCALL msg=audit(1620676186.094:159): arch=c000003e syscall=257 success=no exit=-13 a0=ffffff9c a1=55d8b50fb4b0 a2=241 a3=1b6 items=0 ppid=7098 pid=7104 auid=1000 uid=1000 gid=1000 euid=0 suid=0 fsuid=0 egid=1000 sgid=1000 fsgid=1000 tty=tty2 ses=5 comm="Xorg" exe="/usr/libexec/Xorg" subj=user_u:user_r:user_t:s0 key=(null)ARCH=x86_64 SYSCALL=openat AUID="testuser" UID="testuser" GID="testuser" EUID="root" SUID="root" FSUID="root" EGID="testuser" SGID="testuser" FSGID="testuser" I was able to compile an SELinux module but this should not be necessary. This module allowed users mapped user_u to log in: require { type pulseaudio_t; type var_log_t; type user_t; type xserver_log_t; class process2 nnp_transition; class dir write; class dir { remove_name add_name }; class file { create open write rename unlink }; } #============= user_t ============== allow user_t pulseaudio_t:process2 nnp_transition; allow user_t var_log_t:dir write; allow user_t var_log_t:dir { remove_name add_name}; allow user_t var_log_t:file { create open write unlink rename }; allow user_t xserver_log_t:file { create open write unlink rename }; Expected results: Users should be able to log in. Additional info: This problem does not occur when using XWayland, only Xorg. Note, the npp_transition was added to ameliorate bug #1854471.