Bug 254164

Summary: gdm should use pam_selinux instead of doing its own selinux code
Product: [Fedora] Fedora Reporter: Ray Strode [halfline] <rstrode>
Component: gdmAssignee: Ray Strode [halfline] <rstrode>
Status: CLOSED RAWHIDE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: low Docs Contact:
Priority: low    
Version: rawhideCC: dwalsh
Target Milestone: ---Keywords: Reopened
Target Release: ---   
Hardware: All   
OS: Linux   
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2007-10-01 17:23:26 EDT Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
Bug Depends On:    
Bug Blocks: 235703    

Description Ray Strode [halfline] 2007-08-24 11:16:34 EDT
One problem that we're hitting with pam_gnomekeyring is that it runs in the
locked down xdm context since we don't do a domain transition until after pam
session modules are run.  This causes problems because it means
gnome-keyring-daemon runs under the wrong context.

Some session modules (like pam_console) need to run under the xdm domain and not
the user domain though.

If we switch to using pam_selinux then we can partition the session modules to
half run in the xdm context and half in the user context.
Comment 1 Ray Strode [halfline] 2007-08-24 11:34:31 EDT
should be fixed (or really broken) in tomorrow's rawhide
Comment 2 Ray Strode [halfline] 2007-09-07 12:08:46 EDT
it broke things for xguest users.  we need to save, reset and restore the
context around the call to the PreSession script
Comment 3 Ray Strode [halfline] 2007-10-01 17:23:26 EDT
we fixed this a while ago I believe.