Bugzilla (bugzilla.redhat.com) will be under maintenance for infrastructure upgrades and will not be available on July 31st between 12:30 AM - 05:30 AM UTC. We appreciate your understanding and patience. You can follow status.redhat.com for details.
Bug 1573640 - SELinux is preventing lightdm from 'write' accesses on the directory 20.
Summary: SELinux is preventing lightdm from 'write' accesses on the directory 20.
Alias: None
Product: Fedora
Classification: Fedora
Component: lightdm
Version: 28
Hardware: x86_64
OS: Unspecified
Target Milestone: ---
Assignee: Alternative GTK desktop environments
QA Contact: Fedora Extras Quality Assurance
Whiteboard: abrt_hash:1981da642bcae927f23b695ca39...
Depends On:
TreeView+ depends on / blocked
Reported: 2018-05-01 20:28 UTC by Grant Cohoe
Modified: 2018-05-02 15:45 UTC (History)
8 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Last Closed: 2018-05-02 15:45:57 UTC
Type: ---

Attachments (Terms of Use)

Description Grant Cohoe 2018-05-01 20:28:19 UTC
Description of problem:
Fresh install of FC28 Xfce spin. Got error on first and subsequent boots after install from ISO. Ran dnf update to get fresh package set. Rebooted, issue still occurs. Notification is only shown on first login.
SELinux is preventing lightdm from 'write' accesses on the directory 20.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that lightdm should be allowed write access on the 20 directory by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
allow this access for now by executing:
# ausearch -c 'lightdm' --raw | audit2allow -M my-lightdm
# semodule -X 300 -i my-lightdm.pp

Additional Information:
Source Context                system_u:system_r:xdm_t:s0-s0:c0.c1023
Target Context                system_u:object_r:etc_runtime_t:s0
Target Objects                20 [ dir ]
Source                        lightdm
Source Path                   lightdm
Port                          <Unknown>
Host                          (removed)
Source RPM Packages           
Target RPM Packages           
Policy RPM                    selinux-policy-3.14.1-21.fc28.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (removed)
Platform                      Linux (removed) 4.16.5-300.fc28.x86_64 #1 SMP Fri
                              Apr 27 17:38:36 UTC 2018 x86_64 x86_64
Alert Count                   3
First Seen                    2018-05-01 16:12:11 EDT
Last Seen                     2018-05-01 16:22:40 EDT
Local ID                      c0f5d4c4-291c-4cc3-80b1-31e4daf29f55

Raw Audit Messages
type=AVC msg=audit(1525206160.75:204): avc:  denied  { write } for  pid=1157 comm="lightdm" name=20 dev="dm-0" ino=153667 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:etc_runtime_t:s0 tclass=dir permissive=0

Hash: lightdm,xdm_t,etc_runtime_t,dir,write

Version-Release number of selected component:

Additional info:
component:      selinux-policy
reporter:       libreport-2.9.5
hashmarkername: setroubleshoot
kernel:         4.16.5-300.fc28.x86_64
type:           libreport

Comment 1 Lukas Vrabec 2018-05-02 11:19:13 UTC

Lightdm is trying to write to dir with name "20" somewhere in / . Do you know whats going on? 

After reply feel free to re-assign back to selinux-policy component. 


Comment 2 leigh scott 2018-05-02 11:42:17 UTC
(In reply to Lukas Vrabec from comment #1)
> Guys, 
> Lightdm is trying to write to dir with name "20" somewhere in / . Do you
> know whats going on? 


Comment 3 leigh scott 2018-05-02 12:07:45 UTC
I have no selinux issue on the F28 cinnamon spin using lightdm/slick-greeter.
The Mate maintainer doesn't see the issue on the spin either.

Comment 4 Grant Cohoe 2018-05-02 15:45:57 UTC
I believe I have located a cause of my issue. When installing to disk from the live image, I inadvertently set my homedir to ' ' (which amazingly Anaconda lets me do). Each login then gives me the SElinux alert. When I fix my homedir location to something sane (or re-install with the same) the error goes away.

If anyone would like to look in further I'm happy to assist, but I'd call this User Error on my part.

Note You need to log in before you can comment on or make changes to this bug.