Bug 1331668 - Selinux policy update 3.13.1-183.fc24 causes gdm to fail to load
Summary: Selinux policy update 3.13.1-183.fc24 causes gdm to fail to load
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy
Version: 24
Hardware: x86_64
OS: Linux
urgent
urgent
Target Milestone: ---
Assignee: Lukas Vrabec
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-04-29 07:57 UTC by Bill
Modified: 2016-05-07 11:43 UTC (History)
13 users (show)

Fixed In Version: selinux-policy-3.13.1-184.fc24
Clone Of:
Environment:
Last Closed: 2016-05-07 11:43:42 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)

Description Bill 2016-04-29 07:57:08 UTC
Description of problem:


Version-Release number of selected component (if applicable): 3.13.1-183.fc24


How reproducible: Apply this update from updates testing


Steps to Reproduce:
1.
2.
3.

Actual results: GDM fails to display login screen


Expected results: Login screen should display


Additional info: Can downgrade via other console to workaround.

Comment 1 Christian Stadelmann 2016-04-29 11:41:54 UTC
Workaround: downgrade to 3.13.1-182.fc24

I got quite angry about this update leaving me with a system that not only doesn't boot to gdm but also was barely able to even log in as root on any tty due to overloading the system with AVC denials.

Don't you have a build/test system that at least tries to install this policy and reboot the system into a desktop? It looks like you don't and I suggest you add one. This report might not be the right place, is there some place where to request this?

I know, this was on updates-testing and updates-testing is allowed (or even expected) to break sometimes. But still updates should not get submitted before being tested. This is especially important for updates from "Critical Path".

For reference, here is the bodhi page: https://bodhi.fedoraproject.org/updates/selinux-policy-3.13.1-183.fc24

Comment 2 Tommy He 2016-04-29 13:03:52 UTC
On a side note, you should be able login by passing "selinux=0" in grub2 kernel bootline.

Comment 3 Lukas Vrabec 2016-04-29 13:15:28 UTC
(In reply to Tommy He from comment #2)
> On a side note, you should be able login by passing "selinux=0" in grub2
> kernel bootline.

Yes, if you use enforcing=0 system will boot in permissive mode.

I'm preparing new builds for fedora-rawhide and fedora-24 with fixes.

Comment 4 Alan Ernhart 2016-04-29 13:52:39 UTC
Thx for this BZ report and confirmation of selinux. I hit this also, and got more experience with dnf history and journalctl in the process. Looking forward to trying new build.

Comment 5 Lukas Vrabec 2016-04-29 13:59:59 UTC
fedora@localhost ~]$ cat /etc/fedora-release 
Fedora release 24 (Twenty Four)

[fedora@localhost ~]$ getenforce 
Enforcing

[fedora@localhost ~]$ rpm -q selinux-policy 
selinux-policy-3.13.1-184.fc24.noarch

[fedora@localhost ~]$ sudo ausearch -m AVC -ts recent 
<no matches>


New selinux-policy builds:
http://koji.fedoraproject.org/koji/buildinfo?buildID=758634

Comment 6 Russel Winder 2016-04-29 14:05:28 UTC
I find that booting with enforcing=0 still leads to the problem (GDM does not show a login screen), but that booting with selinux=0 lets everything work.

Comment 7 Alan Ernhart 2016-04-29 14:19:23 UTC
The new builds resolved the issue for me. Thx! Will report karma on bodhi.

Comment 8 dertobi 2016-04-29 19:49:16 UTC
 I can confirm this issue. It's very annoying. You can't even properly use your keyboard in the console as Christian Stadelmann wrote. Please fix this ASAP.

Comment 9 Alexander Mayorov 2016-04-30 21:24:40 UTC
Another workaround I found is to set in /etc/gdm/custom.conf
WaylandEnable=false

Comment 10 Biji 2016-05-01 05:33:51 UTC
Setting Wayland to false, is not working for me. Only disabling selinux to make gdm run again

Comment 11 Russel Winder 2016-05-01 07:30:06 UTC
The Fedora Rawhide update of yesterday seems to have included the correct fix. No hacks needed now as far as I can see. An excellent May Day surprise :-)

Comment 12 Fedora Update System 2016-05-02 10:53:07 UTC
selinux-policy-3.13.1-184.fc24 has been pushed to the Fedora 24 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-e163032315

Comment 13 Bill 2016-05-03 00:12:11 UTC
I installed the 3.13.1-184.fc24 from updates testing and all appears to be well. So problem solved.

Comment 14 Fedora Update System 2016-05-07 11:43:33 UTC
selinux-policy-3.13.1-184.fc24 has been pushed to the Fedora 24 stable repository. If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.