Bug 1016638 - gnome desktop login of ipa user fails with error "unable to open session"
gnome desktop login of ipa user fails with error "unable to open session"
Status: CLOSED DUPLICATE of bug 887193
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: ipa (Show other bugs)
6.5
Unspecified Linux
unspecified Severity unspecified
: rc
: ---
Assigned To: Martin Kosek
Namita Soman
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2013-10-08 09:01 EDT by Kaleem
Modified: 2013-11-04 10:11 EST (History)
6 users (show)

See Also:
Fixed In Version:
Doc Type: Known Issue
Doc Text:
IdM server in Red Hat Enterprise Linux 6.3 introduced a technical preview of SELinux user mapping feature, which enabled a mapping of SELinux users to users managed by the IdM based on custom rules. However, the default configured SELinux user (guest_u:s0) used when no custom rule matches is too constraining. An IdM user authenticating to Red Hat Enterprise Linux 6.5 can be assigned the too constraining SELinux user in which case a login through graphical session would always fail. To work around this problem, change a too constraining default SELinux user in the IdM server from guest_u:s0 to a more relaxed value unconfined_u:s0-s0:c0.c1023: kinit admin ipa config-mod --ipaselinuxusermapdefault=unconfined_u:s0-s0:c0.c1023 An unconfined SELinux user will be now assigned to the IdM user by default, which will allow the user to successfully authenticate through graphical interface.
Story Points: ---
Clone Of:
Environment:
Last Closed: 2013-10-09 10:48:47 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
log file (4.15 KB, text/plain)
2013-10-08 09:01 EDT, Kaleem
no flags Details

  None (edit)
Description Kaleem 2013-10-08 09:01:13 EDT
Created attachment 809266 [details]
log file

Description of problem:
Gnome login of ipa user fails with error "unable to open session"

/var/log/secure log shows that authentication is successful.

Setup is as follows:

RHEL-65 IPA Client ---- RHEL-63 IPA Server

Version-Release number of selected component (if applicable):

[root@65client ~]# rpm -q ipa-client selinux-policy gnome-desktop
ipa-client-3.0.0-37.el6.i686
selinux-policy-3.7.19-218.el6.noarch
gnome-desktop-2.28.2-11.el6.i686
[root@65client ~]#

How reproducible:
Always

Steps to Reproduce:
1. Install a RHEL-65 ipa client with a RHEL-63 ipa server
2. Add a user on IPA server
3. Try gnome desktop login with user created in step 2 on IPA client machine

Actual results:
Gnome desktop login failed with error message "unable to open session"

Expected results:
Gnome desktop login should be successfull

Additional info:
1. Please find the attached log file which is having content from /var/log/secure and /var/log/audit/audit.log files.
Comment 2 Martin Kosek 2013-10-09 07:43:48 EDT
I think is just too strict SELinux user role assigned by SSSD. You can check the settings on 6.3 IPA server:

# ipa config-show 
...
  Default SELinux user: unconfined_u:s0-s0:c0.c1023
...

I bet there will be "guest_u:s0" value. This is too restrictive default. IIRC, we fixed the default in RHEL-6.4.

If you change it to "unconfined_u:s0-s0:c0.c1023", you should be able to log in again. There should be a Known Issue and KB article for that.
Comment 3 Martin Kosek 2013-10-09 08:02:24 EDT
This is the RHEL 6.4 bug with documentation: Bug 887193. I would just close it as duplicate of it.
Comment 4 Daniel Walsh 2013-10-09 10:48:47 EDT

*** This bug has been marked as a duplicate of bug 887193 ***

Note You need to log in before you can comment on or make changes to this bug.