Bug 832840
| Summary: | /usr/bin/kdm is mislabeled | ||||||
|---|---|---|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | bodhi.zazen <bodhi.zazen> | ||||
| Component: | selinux-policy-targeted | Assignee: | Miroslav Grepl <mgrepl> | ||||
| Status: | CLOSED ERRATA | QA Contact: | Ben Levenson <benl> | ||||
| Severity: | unspecified | Docs Contact: | |||||
| Priority: | unspecified | ||||||
| Version: | 17 | CC: | darwinian.empire, dwalsh, germano.massullo, kevin, kylepablo, morgancoxuk, orion, rdieter, rguerra.marin, rtguille, stealthcipher, vincenzo.romano | ||||
| Target Milestone: | --- | ||||||
| Target Release: | --- | ||||||
| Hardware: | Unspecified | ||||||
| OS: | Unspecified | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | Doc Type: | Bug Fix | |||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2012-06-20 00:30:12 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Attachments: |
|
||||||
*** Bug 832860 has been marked as a duplicate of this bug. *** *** Bug 832806 has been marked as a duplicate of this bug. *** Yes, # chcon -t xdm_exec_t /usr/bin/kdm will fix it for now. sorry for the duplicates, I was having problems connecting to bugzilla. No problem. I have finally found a bug. Fixed in selinux-policy-3.10.0-132.fc17 For me it actually allows you to login, but only after a delay of 20-30 seconds. Denial message is:
type=USER_AVC msg=audit(1340046369.740:212): pid=0 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=error error_name=net.reactivated.Fprint.Error.NoSuchDevice dest=:1.193 spid=6245 tpid=6222 scontext=system_u:system_r:fprintd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:initrc_t:s0 tclass=dbus exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'
That looks like you still have a process running as initrc_t? *** Bug 833184 has been marked as a duplicate of this bug. *** Yeah, because kdm is labeled bin_t instead of kdm_exec_t. Changing that fixes it. But -130 wants it labeled bin_t. Yes and a new build/update is on the way. *** Bug 833219 has been marked as a duplicate of this bug. *** selinux-policy-3.10.0-132.fc17 has been submitted as an update for Fedora 17. https://admin.fedoraproject.org/updates/selinux-policy-3.10.0-132.fc17 *** Bug 833383 has been marked as a duplicate of this bug. *** selinux-policy-3.10.0-132.fc17 has been pushed to the Fedora 17 stable repository. If problems still persist, please make note of it in this bug report. *** Bug 833627 has been marked as a duplicate of this bug. *** selinux-policy-3.10.0-132.fc17 has been pushed to the Fedora 17 stable repository. If problems still persist, please make note of it in this bug report. I don't know if this is the same bug, but I have the same problems on f19. I write my user and password on kdm, and when I hit enter, it lasts like 10 seconds to start the splash screen, unless I wait the 10 seconds before hitting enter. Writing "chcon -t xdm_exec_t /usr/bin/kdm" just returns: chcon: can't apply partial context to unlabeled file ‘/usr/bin/kdm’ any ideas if this is the same? thanks! It's clearly mislabled, but it is completely unlabelled. SELinx labels have several components, not just the "type" (what you are setting with -t). e.g.: # ls -lZ /usr/bin/kdm -rwxr-xr-x. root root system_u:object_r:xdm_exec_t:s0 /usr/bin/kdm Try "restorecon -v /usr/bin/kdm" to set the proper label. Thanks for answering so quickly, I tried that but I still have the problem. I even have selinux disabled and I still have the problem, so I guess it is something else than selinux? thanks! Don't disable SELinux - that's going to lead to a lot on unlabeled files causing problems if you re-enable. Set permissive mode (enforcing=0) instead. If you want to try to get back to a working selinux system do: touch /.autorelabel and reboot. This will take a while to relabel everything on system. I tried that command, and yes it took a while to relabel everything, but I'm still having the delay after I hit enter =/ Try with the force command restorecon -F /usr/sbin/gdm This bug is about SELinux, if you're having the issue even with SELinux disabled (as you said in comment #19), you're experiencing a DIFFERENT bug with the same symptoms. |
Created attachment 592480 [details] raw avc denials Description of problem: /usr/bin/kdm is mislabeled in the policy, prevents user_u from logging into kde. Version-Release number of selected component (if applicable): How reproducible: Try to log into kde Steps to Reproduce: 1. Log into kde as a user_u 2. 3. Actual results: kde does not allow log in Expected results: Able to log in Additional info: Fix /usr/bin/kde is mislabeled as bin_t , /usr/bin/kdm should be type xdm_exec_t