# rpm -qa kdm\* kdm-settings-4.11.22-41.fc40.noarch kdm-4.11.22-41.fc40.x86_64 # The kdm service starts and runs successfully. However, the SELinux denial appears each time the service is (re)started. Reproducible: Always Steps to Reproduce: 1. get a Fedora rawhide machine (targeted policy is active) 2. install the kdm and xorg-x11-server-Xorg packages 3. start the kdm service 4. search for SELinux denials Actual Results: ---- type=PROCTITLE msg=audit(04/18/2024 02:14:23.432:1256) : proctitle=/usr/libexec/kde4/lnusertemp cache type=PATH msg=audit(04/18/2024 02:14:23.432:1256) : item=1 name=/root/.kde nametype=CREATE cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=PATH msg=audit(04/18/2024 02:14:23.432:1256) : item=0 name=/root/ inode=8193 dev=fc:02 mode=dir,550 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:admin_home_t:s0 nametype=PARENT cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=CWD msg=audit(04/18/2024 02:14:23.432:1256) : cwd=/ type=SYSCALL msg=audit(04/18/2024 02:14:23.432:1256) : arch=x86_64 syscall=mkdir success=no exit=EACCES(Permission denied) a0=0x7ffefe45bd80 a1=0700 a2=0xffffffffffffff88 a3=0x0 items=2 ppid=12502 pid=12510 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=lnusertemp exe=/usr/libexec/kde4/lnusertemp subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(04/18/2024 02:14:23.432:1256) : avc: denied { create } for pid=12510 comm=lnusertemp name=.kde scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:admin_home_t:s0 tclass=dir permissive=0 ---- Expected Results: no SELinux denials
I know that there is a SELinux boolean which can improve the situation: # sesearch -s xdm_t -t admin_home_t -c dir -p create -A allow polydomain polymember:dir { create relabelto setattr }; [ polyinstantiation_enabled ]:True # But another SELinux denial appears when I enable it and restart the kdm service: ---- type=PROCTITLE msg=audit(04/18/2024 02:18:24.648:1262) : proctitle=/usr/libexec/kde4/lnusertemp cache type=PATH msg=audit(04/18/2024 02:18:24.648:1262) : item=2 name=/root/.kde/machine-FDQN nametype=CREATE cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=PATH msg=audit(04/18/2024 02:18:24.648:1262) : item=1 name=/var/tmp/kdecache-rootxt2lvD nametype=UNKNOWN cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=PATH msg=audit(04/18/2024 02:18:24.648:1262) : item=0 name=/root/.kde/ inode=409658 dev=fc:02 mode=dir,700 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:admin_home_t:s0 nametype=PARENT cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=CWD msg=audit(04/18/2024 02:18:24.648:1262) : cwd=/ type=SYSCALL msg=audit(04/18/2024 02:18:24.648:1262) : arch=x86_64 syscall=symlink success=no exit=EACCES(Permission denied) a0=0x7ffe2a0ff840 a1=0x7ffe2a100850 a2=0x0 a3=0x100 items=3 ppid=12551 pid=12559 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=lnusertemp exe=/usr/libexec/kde4/lnusertemp subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(04/18/2024 02:18:24.648:1262) : avc: denied { create } for pid=12559 comm=lnusertemp name=machine-FQDN scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:admin_home_t:s0 tclass=lnk_file permissive=0 ----
The same SELinux denial appears in permissive mode: ---- type=PROCTITLE msg=audit(04/18/2024 02:36:02.642:1269) : proctitle=/usr/libexec/kde4/lnusertemp cache type=PATH msg=audit(04/18/2024 02:36:02.642:1269) : item=2 name=/root/.kde/cache-machine-FQDN inode=409705 dev=fc:02 mode=link,777 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:admin_home_t:s0 nametype=CREATE cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=PATH msg=audit(04/18/2024 02:36:02.642:1269) : item=1 name=/var/tmp/kdecache-root nametype=UNKNOWN cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=PATH msg=audit(04/18/2024 02:36:02.642:1269) : item=0 name=/root/.kde/ inode=409658 dev=fc:02 mode=dir,700 ouid=root ogid=root rdev=00:00 obj=system_u:object_r:admin_home_t:s0 nametype=PARENT cap_fp=none cap_fi=none cap_fe=0 cap_fver=0 cap_frootid=0 type=CWD msg=audit(04/18/2024 02:36:02.642:1269) : cwd=/ type=SYSCALL msg=audit(04/18/2024 02:36:02.642:1269) : arch=x86_64 syscall=symlink success=yes exit=0 a0=0x7ffcc9babab0 a1=0x7ffcc9bacac0 a2=0x0 a3=0x100 items=3 ppid=12621 pid=12629 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=lnusertemp exe=/usr/libexec/kde4/lnusertemp subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(04/18/2024 02:36:02.642:1269) : avc: denied { create } for pid=12629 comm=lnusertemp name=cache-machine-FQDN scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:admin_home_t:s0 tclass=lnk_file permissive=1 ---- # ls -alZ /root/.kde/ total 8 drwx------. 2 root root system_u:object_r:admin_home_t:s0 4096 Apr 18 02:36 . dr-xr-x---. 8 root root system_u:object_r:admin_home_t:s0 4096 Apr 18 02:36 .. lrwxrwxrwx. 1 root root system_u:object_r:admin_home_t:s0 22 Apr 18 02:36 cache-machine-FQDN -> /var/tmp/kdecache-root # As you can see, the root cause of the problem is the mislabeled /root/.kde directory, which did not exist before the kde service was started. If the /root/.kde directory was labeled correctly, I believe that none of the SELinux denials would have appeared.
# rpm -qa selinux\* selinux-policy-40.16-1.fc41.noarch selinux-policy-targeted-40.16-1.fc41.noarch # sesearch -s xdm_t -t admin_home_t -c dir -T type_transition xdm_t admin_home_t:dir auth_home_t .yubico; type_transition xdm_t admin_home_t:dir spamc_home_t .pyzor; type_transition xdm_t admin_home_t:dir spamc_home_t .razor; type_transition xdm_t admin_home_t:dir spamc_home_t .spamassassin; type_transition xdm_t admin_home_t:dir spamc_home_t .spamd; type_transition xdm_t admin_home_t:dir ssh_home_t .shosts; type_transition xdm_t admin_home_t:dir ssh_home_t .ssh; type_transition xdm_t admin_home_t:dir user_fonts_cache_t .fontconfig; type_transition xdm_t admin_home_t:dir user_fonts_config_t .fonts.d; type_transition xdm_t admin_home_t:dir user_fonts_t .fonts; # To fix the root cause, I believe that we need the following type_transition rule: type_transition xdm_t admin_home_t:dir config_home_t .kde;
Test coverage for this bug exists in a form of PR: * https://src.fedoraproject.org/tests/selinux/pull-request/493 The PR waits for a review.
FEDORA-2025-e7a319968a (selinux-policy-41.29-1.fc41) has been submitted as an update to Fedora 41. https://bodhi.fedoraproject.org/updates/FEDORA-2025-e7a319968a
FEDORA-2025-e7a319968a has been pushed to the Fedora 41 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2025-e7a319968a` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2025-e7a319968a See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2025-9da160c869 has been pushed to the Fedora 41 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2025-9da160c869` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2025-9da160c869 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2025-62c612355c has been pushed to the Fedora 41 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2025-62c612355c` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2025-62c612355c See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2025-62c612355c (selinux-policy-41.31-1.fc41) has been pushed to the Fedora 41 stable repository. If problem still persists, please make note of it in this bug report.