Bug 463377
| Summary: | xguest fails due to incorrect selinux context | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Matt Domsch <matt_domsch> |
| Component: | libX11 | Assignee: | Søren Sandmann Pedersen <sandmann> |
| Status: | CLOSED RAWHIDE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | urgent | Docs Contact: | |
| Priority: | urgent | ||
| Version: | 9 | CC: | dwalsh, james, jokatzer, kem, mgrepl, poelstra, sandmann, sgrubb, torsten, xgl-maint, yaneti |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2008-10-23 20:49:52 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 438943 | ||
changing component to selinux-policy-targeted and adding to F10 blocker Actually looks like this is a more general problem with pam_namespace. Looks like gdm/login is not handling the /tmp file system being replaced. This fails on Fedora 9 now as well. Xlib is not handling the abstract namespace any longer. This is a major regression in Fedora 9, Either the kernel or Xlib is now broken, and any users of pam_namespace for /tmp will now break. xguest is broken. For Fedora9, the bug is apparently caused by one of the following packages: xorg-x11-server-Xephyr-1.5.0-2.fc9.i386 xorg-x11-server-common-1.5.0-2.fc9.i386 xorg-x11-server-Xorg-1.5.0-2.fc9.i386 I could install all other updates from the newkey repos, including gdm, kernel and selinux, without breaking xguest (at least for XFCE desktop which I have tested in a VM). xorg-x11-server version 1.4.99.905-2.20080702.fc9.i386 was compatible with xguest. xguest is using the pam_namespace to mount a temporary file system over /tmp during the login process. X apps are supposed to connect to @/tmp/.X11-unix/X0 first and then fail over to /tmp/.X11-unix/X0. Either this is no longer true or the first connection is failing for some reason. You can get this behaviour by just renaming the /tmp/.X11-unix/X0 socket # netstat -an | grep -i LIS.*X11 unix 2 [ ACC ] STREAM LISTENING 131718 @/tmp/.X11-unix/X1 unix 2 [ ACC ] STREAM LISTENING 560065 @/tmp/.X11-unix/X0 unix 2 [ ACC ] STREAM LISTENING 131719 /tmp/.X11-unix/X1 unix 2 [ ACC ] STREAM LISTENING 560066 /tmp/.X11-unix/X0 # cd /tmp/.X11-unix # mv X0 X0.back # xterm Warning: This program is an suid-root program or is being run by the root user. The full text of the error or warning message cannot be safely formatted in this environment. You may get a more descriptive message by running the program as a non-root user or by removing the suid bit on the executable. This is fixed in libxcb-1.1.91-4.fc10 |
Description of problem: xguest and dbus in rawhide, fails. type=AVC msg=audit(1222140311.434:13): avc: denied { read write } for pid=3476 comm="dbus-daemon" path="socket:[13340]" dev=sockfs ino=13340 scontext=xguest_u:xguest_r:xguest_dbusd_t:s0 tcontext=xguest_u:xguest_r:xguest_t:s0 tclass=unix_stream_socket Version-Release number of selected component (if applicable): xguest-1.0.6-7.fc9.noarch dbus-1.2.3-1.fc10.x86_64 dbus-glib-0.76-2.fc10.i386 dbus-devel-1.2.3-1.fc10.x86_64 dbus-glib-devel-0.76-2.fc10.x86_64 dbus-python-0.83.0-2.fc9.x86_64 dbus-libs-1.2.3-1.fc10.x86_64 dbus-libs-1.2.3-1.fc10.i386 ndesk-dbus-glib-0.4.1-3.fc9.x86_64 dbus-glib-0.76-2.fc10.x86_64 ndesk-dbus-0.6.1a-2.fc9.x86_64 dbus-x11-1.2.3-1.fc10.x86_64 How reproducible: always Steps to Reproduce: 1. install xguest 2. try logging in with user guest Actual results: fail Expected results: login succeeds Additional info: