Bug 967635

Summary:	File /usr/bin/razor-lightdm-greeter label as spamc_t but should be xdm_exec_t.
Product:	[Fedora] Fedora	Reporter:	Andre Vehreschild <vehre>
Component:	selinux-policy-targeted	Assignee:	Miroslav Grepl <mgrepl>
Status:	CLOSED ERRATA	QA Contact:	Ben Levenson <benl>
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	17	CC:	dwalsh
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Linux
Whiteboard:
Fixed In Version:	selinux-policy-3.10.0-170.fc17	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2013-06-24 03:29:10 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Andre Vehreschild 2013-05-27 17:29:02 UTC

Description of problem:
Wrong label of razor-lightdm-greeter; Execution of that greeter is prevented by selinux. 

Version-Release number of selected component (if applicable):
selinux-policy-targeted-3.10.0-169.fc17
lightdm-razorqt-0.5.2-8.fc17

How reproducible:
Install both packages and requirements and use the razor-lightdm-greeter as greeter.

Steps to Reproduce:
1. yum install lightdm-razorqt
2. Edit /etc/sysconfig/desktop -> DISPLAYMANAGER=/usr/sbin/lightdm
3. reboot or systemctl restart prefdm

Actual results:
Blank screen and in /var/log/lightdm/x-?-greeter.log a very misleading error message about file not found or permission denied.

Expected results:
The razor-lightdm-greeter as login prompt.

Additional info:
This was solved by adding the line:

/usr/bin/razor-lightdm-greeter		system_u:object_r:xdm_exec_t

to /etc/selinux/targeted/contexts/files/file_contexts.local

Comment 1 Miroslav Grepl 2013-05-28 11:04:58 UTC

Thank you.

commit 56ba9b310d0f114d56ca00b8b007fe9a74cd110d
Author: Miroslav Grepl <mgrepl>
Date:   Tue May 28 13:04:22 2013 +0200

    Label /usr/bin/razor-lightdm-greeter as xdm_exec_t instead of spamc_exec_t

Comment 2 Fedora Update System 2013-06-07 07:01:12 UTC

selinux-policy-3.10.0-170.fc17 has been submitted as an update for Fedora 17.
https://admin.fedoraproject.org/updates/selinux-policy-3.10.0-170.fc17

Comment 3 Fedora Update System 2013-06-07 23:28:08 UTC

Package selinux-policy-3.10.0-170.fc17:
* should fix your issue,
* was pushed to the Fedora 17 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing selinux-policy-3.10.0-170.fc17'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2013-10302/selinux-policy-3.10.0-170.fc17
then log in and leave karma (feedback).

Comment 4 Fedora Update System 2013-06-24 03:29:10 UTC

selinux-policy-3.10.0-170.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.