Bug 2374728

Summary: SELinux is preventing login from execute access on the file gnome-keyring-daemon
Product: [Fedora] Fedora Reporter: Onyeibo Oku <onyeibo>
Component: selinux-policyAssignee: Zdenek Pytela <zpytela>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: unspecified    
Version: rawhideCC: dwalsh, lvrabec, mmalik, omosnacek, pkoncity, vmojzis, zpytela
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: selinux-policy-41.45-1.fc42 Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2025-07-12 01:45:24 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
ausearch output none

Description Onyeibo Oku 2025-06-25 09:55:20 UTC 
I am trying to start gnome-keyring through PAM (Console Login) on a Minimal Fedora version. I added the required lines into /etc/pam.d/login as per https://wiki.archlinux.org/title/GNOME/Keyring#Using_the_keyring

After successful login, the keyring is unavailable. Instead, I get AVC entries in the log stating that "SELinux is preventing login from execute access on the file gnome-keyring-daemon"

Reproducible: Always

Steps to Reproduce:
1. Install Fedora minimal with sway, gnome-keyring, gnome-keyring-pam
2. Update all to the recent packages as of today. Include the following in /etc/pam.d/login 

# after the last auth
auth       optional     pam_gnome_keyring.so

# after the last session
session    optional     pam_gnome_keyring.so auto_start

3. reboot and log in via console
Actual Results:
Selinux AVC entries (prevented)

Expected Results:
A running gnome-keyring-daemon with unlocked login keys
Comment 1 Zdenek Pytela 2025-06-25 10:50:51 UTC 
Hi,

Can you gather AVC denials, with full auditing if possible?
https://fedoraproject.org/wiki/SELinux/Debugging#Enable_full_auditing
Comment 2 Onyeibo Oku 2025-06-25 16:57:54 UTC 
Created attachment 2095147 [details]
ausearch output
Comment 3 Zdenek Pytela 2025-06-30 09:01:24 UTC 
Hi, 
Can you try copr build in

https://github.com/fedora-selinux/selinux-policy/pull/2745
Checks -> rpm-build?
Comment 4 Onyeibo Oku 2025-07-01 02:04:53 UTC 
(In reply to Zdenek Pytela from comment #3)
> Hi, 
> Can you try copr build in
> 
> https://github.com/fedora-selinux/selinux-policy/pull/2745
> Checks -> rpm-build?

Installed and running. No AVC on login. Thanks
Comment 5 Zdenek Pytela 2025-07-01 09:40:33 UTC 
Thanks for confirming.
Comment 6 Fedora Update System 2025-07-07 13:30:47 UTC 
FEDORA-2025-37b5c05ba4 (selinux-policy-41.45-1.fc42) has been submitted as an update to Fedora 42.
https://bodhi.fedoraproject.org/updates/FEDORA-2025-37b5c05ba4
Comment 7 Fedora Update System 2025-07-10 15:59:49 UTC 
FEDORA-2025-37b5c05ba4 has been pushed to the Fedora 42 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2025-37b5c05ba4`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2025-37b5c05ba4

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
Comment 8 Fedora Update System 2025-07-12 01:45:24 UTC 
FEDORA-2025-37b5c05ba4 (selinux-policy-41.45-1.fc42) has been pushed to the Fedora 42 stable repository.
If problem still persists, please make note of it in this bug report.