User-Agent:       Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:57.0) Gecko/20100101 Firefox/57.0
Build Identifier: 

After updating my Fedora 27 install to latest patch level from mirrors, I found that I couldn't log in to the desktop via GDM any longer.

The only AVC I could see indicated that it could be related to a gnome keyring problem. After patching the policy to allow for the logged action, it was found to be still failing.

GDM login worked fine when "setenforce 0" so was obviously an SELINUX issue.

Some further investigation (including disabling all dontaudit's in my policy) indicated some issues around init_t, init_exec_t and staff_t. "semanage permissive -a init_t" allowed everything to work fine.

Addressing and patching the init_t AVC's did not fix the problem, but addressing the init_exec_t AVC did. Here is an example AVC (usually squashed by a dontaudit):

----
time->Thu Nov 16 16:45:52 2017
type=AVC msg=audit(1510803952.496:325): avc:  denied  { map } for  pid=5491 comm="systemd" path="/usr/lib/systemd/systemd" dev="dm-1" ino=2240297 scontext=staff_u:staff_r:staff_t:s0-s0:c0.c1023 tcontext=system_u:object_r:init_exec_t:s0 tclass=file permissive=0
----

Running this through audit2allow generated the following policy module:

----
module my-systemd-fix 1.0;

require {
	type staff_t;
	type init_exec_t;
	class file map;
}

#============= staff_t ==============

#!!!! This avc has a dontaudit rule in the current policy
allow staff_t init_exec_t:file map;
----

Loading this module appears to have fixed the issue and login now works again.

Please forgive my bumbling as I am relatively new to selinux and am still learning how to drive it.

Reproducible: Always

Steps to Reproduce:
1. Install a fresh F27, apply all updates
2. Create a user
3. Attempt to login via GDM - observe login success
4. usermod -Z staff_u username
5. Attempt to login via GDM 
Actual Results:  
Login fails, black screen shown and returned to login screen.

Additionally, the systemd user service fails to start.

Expected Results:  
Login success, and systemd user service starts