Bug 1232042 - AVCs when trying to login as xguest user
Summary: AVCs when trying to login as xguest user
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 23
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2015-06-15 23:24 UTC by Simon Sekidde
Modified: 2016-09-03 00:17 UTC (History)
15 users (show)

Fixed In Version: selinux-policy-3.13.1-158.15.fc23
Clone Of:
Environment:
Last Closed: 2016-05-12 20:54:53 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)

Description Simon Sekidde 2015-06-15 23:24:16 UTC
Description of problem:

Unable to login as xguest user

Version-Release number of selected component (if applicable):

selinux-policy-3.13.1-129.fc23.noarch

How reproducible:
100% 

Steps to Reproduce:
1. enforcing mode
2. yum install xguest
3. reboot (not really needed) 

Actual results:

#============= xguest_t ==============
allow xguest_t event_device_t:chr_file write;

#!!!! This avc can be allowed using the boolean 'selinuxuser_use_ssh_chroot'
allow xguest_t self:capability { setuid setgid };
allow xguest_t self:capability { net_admin dac_read_search sys_admin dac_override };

Expected results:

No AVCs

Additional info:

Same problem observed on F22

Comment 1 Simon Sekidde 2015-06-15 23:24:29 UTC
----
type=USER_AVC msg=audit(06/15/2015 18:57:14.552:1416) : pid=1 uid=root auid=unset ses=unset subj=system_u:system_r:init_t:s0 msg='avc:  received policyload notice (seqno=2)  exe=/usr/lib/systemd/systemd sauid=root hostname=? addr=? terminal=?' 
----
type=USER_AVC msg=audit(06/15/2015 18:57:14.552:1417) : pid=1 uid=root auid=unset ses=unset subj=system_u:system_r:init_t:s0 msg='avc:  received policyload notice (seqno=3)  exe=/usr/lib/systemd/systemd sauid=root hostname=? addr=? terminal=?' 
----
type=USER_AVC msg=audit(06/15/2015 18:57:14.552:1418) : pid=1 uid=root auid=unset ses=unset subj=system_u:system_r:init_t:s0 msg='avc:  received policyload notice (seqno=4)  exe=/usr/lib/systemd/systemd sauid=root hostname=? addr=? terminal=?' 
----
type=USER_AVC msg=audit(06/15/2015 18:57:14.552:1419) : pid=1 uid=root auid=unset ses=unset subj=system_u:system_r:init_t:s0 msg='avc:  received policyload notice (seqno=5)  exe=/usr/lib/systemd/systemd sauid=root hostname=? addr=? terminal=?' 
----
type=AVC msg=audit(06/15/2015 18:57:25.276:1433) : avc:  denied  { sys_admin } for  pid=10272 comm=Xorg.wrap capability=sys_admin  scontext=xguest_u:xguest_r:xguest_t:s0 tcontext=xguest_u:xguest_r:xguest_t:s0 tclass=capability permissive=0 
----
type=AVC msg=audit(06/15/2015 18:57:25.276:1434) : avc:  denied  { setgid } for  pid=10272 comm=Xorg.wrap capability=setgid  scontext=xguest_u:xguest_r:xguest_t:s0 tcontext=xguest_u:xguest_r:xguest_t:s0 tclass=capability permissive=0 
----
type=AVC msg=audit(06/15/2015 18:57:25.276:1435) : avc:  denied  { setuid } for  pid=10272 comm=Xorg.wrap capability=setuid  scontext=xguest_u:xguest_r:xguest_t:s0 tcontext=xguest_u:xguest_r:xguest_t:s0 tclass=capability permissive=0 
----
type=AVC msg=audit(06/15/2015 18:57:25.306:1436) : avc:  denied  { dac_override } for  pid=10282 comm=pkexec capability=dac_override  scontext=xguest_u:xguest_r:xguest_t:s0 tcontext=xguest_u:xguest_r:xguest_t:s0 tclass=capability permissive=0 
----
type=AVC msg=audit(06/15/2015 18:57:25.306:1437) : avc:  denied  { dac_read_search } for  pid=10282 comm=pkexec capability=dac_read_search  scontext=xguest_u:xguest_r:xguest_t:s0 tcontext=xguest_u:xguest_r:xguest_t:s0 tclass=capability permissive=0 
----
type=AVC msg=audit(06/15/2015 18:57:25.310:1438) : avc:  denied  { dac_override } for  pid=10284 comm=pkexec capability=dac_override  scontext=xguest_u:xguest_r:xguest_t:s0 tcontext=xguest_u:xguest_r:xguest_t:s0 tclass=capability permissive=0 
----
type=AVC msg=audit(06/15/2015 18:57:25.310:1439) : avc:  denied  { dac_read_search } for  pid=10284 comm=pkexec capability=dac_read_search  scontext=xguest_u:xguest_r:xguest_t:s0 tcontext=xguest_u:xguest_r:xguest_t:s0 tclass=capability permissive=0 
----
type=AVC msg=audit(06/15/2015 18:57:25.383:1440) : avc:  denied  { write } for  pid=10272 comm=Xorg path=/dev/input/event2 dev="devtmpfs" ino=10914 scontext=xguest_u:xguest_r:xguest_t:s0 tcontext=system_u:object_r:event_device_t:s0 tclass=chr_file permissive=0 
----
type=AVC msg=audit(06/15/2015 18:57:25.534:1441) : avc:  denied  { setgid } for  pid=10287 comm=gdbus capability=setgid  scontext=xguest_u:xguest_r:xguest_t:s0 tcontext=xguest_u:xguest_r:xguest_t:s0 tclass=capability permissive=0 
----
type=AVC msg=audit(06/15/2015 18:57:25.534:1442) : avc:  denied  { setgid } for  pid=10286 comm=gmain capability=setgid  scontext=xguest_u:xguest_r:xguest_t:s0 tcontext=xguest_u:xguest_r:xguest_t:s0 tclass=capability permissive=0 
----
type=AVC msg=audit(06/15/2015 18:57:25.535:1443) : avc:  denied  { setgid } for  pid=10284 comm=pkexec capability=setgid  scontext=xguest_u:xguest_r:xguest_t:s0 tcontext=xguest_u:xguest_r:xguest_t:s0 tclass=capability permissive=0 
----
type=AVC msg=audit(06/15/2015 18:57:25.537:1444) : avc:  denied  { net_admin } for  pid=10284 comm=pkexec capability=net_admin  scontext=xguest_u:xguest_r:xguest_t:s0 tcontext=xguest_u:xguest_r:xguest_t:s0 tclass=capability permissive=0 
----
type=AVC msg=audit(06/15/2015 18:57:25.537:1445) : avc:  denied  { net_admin } for  pid=10284 comm=pkexec capability=net_admin  scontext=xguest_u:xguest_r:xguest_t:s0 tcontext=xguest_u:xguest_r:xguest_t:s0 tclass=capability permissive=0 
----
type=AVC msg=audit(06/15/2015 18:57:25.541:1447) : avc:  denied  { setgid } for  pid=10287 comm=gdbus capability=setgid  scontext=xguest_u:xguest_r:xguest_t:s0 tcontext=xguest_u:xguest_r:xguest_t:s0 tclass=capability permissive=0 
----
type=AVC msg=audit(06/15/2015 18:57:25.541:1448) : avc:  denied  { setgid } for  pid=10286 comm=gmain capability=setgid  scontext=xguest_u:xguest_r:xguest_t:s0 tcontext=xguest_u:xguest_r:xguest_t:s0 tclass=capability permissive=0 
----
type=AVC msg=audit(06/15/2015 18:57:25.541:1449) : avc:  denied  { setgid } for  pid=10284 comm=pkexec capability=setgid  scontext=xguest_u:xguest_r:xguest_t:s0 tcontext=xguest_u:xguest_r:xguest_t:s0 tclass=capability permissive=0

Comment 2 Miroslav Grepl 2015-06-16 10:13:47 UTC
Were you able to log in?

Comment 3 Simon Sekidde 2015-06-16 14:01:37 UTC
(In reply to Miroslav Grepl from comment #2)
> Were you able to log in?

No. Just get a blank screen with a blinking cursor on top left hand side

Comment 4 Rob Hicks 2015-07-01 16:28:08 UTC
Same results here under gdm and Fedora 22. Discussion in fedoraforums.org indicate xguest (in Fedora 22) works fine with kdm:

http://forums.fedoraforum.org/showthread.php?p=1736901&posted=1#post1736901

Comment 5 Jan Kurik 2015-07-15 13:59:45 UTC
This bug appears to have been reported against 'rawhide' during the Fedora 23 development cycle.
Changing version to '23'.

(As we did not run this process for some time, it could affect also pre-Fedora 23 development
cycle bugs. We are very sorry. It will help us with cleanup during Fedora 23 End Of Life. Thank you.)

More information and reason for this action is here:
https://fedoraproject.org/wiki/BugZappers/HouseKeeping/Fedora23

Comment 7 Lukas Vrabec 2016-03-24 13:53:28 UTC
It looks like that gdm doing something wrong because kdm and others display managers seem fine. Reading /dev/input/event2 by Xorg make sense to me, but I'm not sure about writing permissions.   

/dev/input/event2 is mouse event device.


Gdm folks, can you make it clear for us? 

Thank you.

Comment 8 Ray Strode [halfline] 2016-03-24 20:14:38 UTC
other display managers runs the X server as root, GDM instead runs the X server as the unprivileged user, within the user session.

Comment 9 Lukas Vrabec 2016-04-04 13:08:32 UTC
In this case we need to allow this rule in xguest policy.

Comment 10 Fedora Update System 2016-04-27 22:26:40 UTC
selinux-policy-3.13.1-158.15.fc23 has been submitted as an update to Fedora 23. https://bodhi.fedoraproject.org/updates/FEDORA-2016-df52942a2f

Comment 11 Fedora Update System 2016-04-28 22:55:12 UTC
selinux-policy-3.13.1-158.15.fc23 has been pushed to the Fedora 23 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-df52942a2f

Comment 12 Fedora Update System 2016-05-12 20:54:24 UTC
selinux-policy-3.13.1-158.15.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.

Comment 13 Rick 2016-09-03 00:17:43 UTC
This problem exists for Fedora 24 as well.

Guest account appears, but clicking on it momentarily blanks the screen and then the original login selections appear.

Same AVC denials appear in /var/log/messages.


Note You need to log in before you can comment on or make changes to this bug.