cockpit-session will start doing GSSAPI logins. The following selinux policy changes are required: # cockpit-session PAM stack wants to talk to systemd via a socket allow cockpit_session_t init_t:unix_stream_socket sendto; allow cockpit_session_t tmp_t:file { create write open unlink }; Symptoms: cockpit-session: gssapi auth failed: Unspecified GSS failure. Minor code may provide more information (Cannot create replay cache file /var/tmp/HTTP_0: File exists) audit: type=1400 audit(1411115120.035:21): avc: denied { sendto } for pid=1176 comm="cockpit-session" path="socket:[18680]" dev="sockfs" ino=18680 scontext=system_u:system_r:cockpit_session_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=unix_stream_socket permissive=0
commit b6b76edced6e8cce8914709c89eb211be3d7ec49 Author: Miroslav Grepl <mgrepl> Date: Mon Sep 22 16:18:52 2014 +0200 Allow cockpit-session to do GSSAPI logins.
Can this be fixed in f21 as well? Just tried SPNEGO/GSSAPI authentication but failed due to this issue. All I needed to do locally to add this SELinux policy: allow cockpit_session_t tmp_t:file { write create open unlink };
We would need a transition rule to cockpic_session_tmp_t
4e6bdce702835c74cf81053b911b747049a2775c fixes this in git.
This bug appears to have been reported against 'rawhide' during the Fedora 22 development cycle. Changing version to '22'. More information and reason for this action is here: https://fedoraproject.org/wiki/Fedora_Program_Management/HouseKeeping/Fedora22
Fedora 22 changed to end-of-life (EOL) status on 2016-07-19. Fedora 22 is no longer maintained, which means that it will not receive any further security or bug fix updates. As a result we are closing this bug. If you can reproduce this bug against a currently maintained version of Fedora please feel free to reopen this bug against that version. If you are unable to reopen this bug, please file a new report against the current release. If you experience problems, please add a comment to this bug. Thank you for reporting this bug and we are sorry it could not be fixed.