After logging in via GDM as a user mapped to staff_u I get a blue screen (which is a quirk of my monitor, basically it's what happens when there's no video output). The system is fully functional, I can SSH in, etc., but GDM and/or my login session are stuck in a way that prevents Ctrl-Alt-Fn keys from switching virtual consoles, giving the appearance of a crashed system. If I run 'semanage permissive -a staff_dbusd_t' then I can log in fine. After doing so, "ausearch -i -m avc -se staff_dbusd_t" shows two sets of events: type=AVC msg=audit(10/06/24 12:26:17.286:3657) : avc: denied { execute } for pid=302496 comm=dbus-daemon name=at-spi-bus-launcher dev="dm-1" ino=4077266 scontext=staff_u:staff_r:staff_dbusd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:gnome_atspi_exec_t:s0 tclass=file permissive=0 and: type=AVC msg=audit(10/06/24 12:45:54.010:687) : avc: denied { watch } for pid=12716 comm=dbus-broker-lau path=/var/lib/flatpak/exports/share/dbus-1/services dev="dm-0" ino=2174243 scontext=staff_u:staff_r:staff_dbusd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_lib_t:s0 tclass=dir permissive=0 I can't say if either of these are the direct cause of the problem, or whether they're just symptoms caused by other failures when when staff_dbusd_t is not in enforcing mode. I can try again with dontaudit rules disabled and report back if helpful. Paging through journalctl output I see the second message is associated with: Jun 10 12:51:48 dbus-broker-launch[14538]: ERROR dirwatch_add @ ../src/util/dirwatch.c +122: Permission denied Jun 10 12:51:48 dbus-broker-launch[14538]: launcher_load_service_dir @ ../src/launch/launcher.c +770 Jun 10 12:51:48 dbus-broker-launch[14538]: launcher_load_standard_session_services @ ../src/launch/launcher.c +916 Jun 10 12:51:48 dbus-broker-launch[14538]: launcher_load_services @ ../src/launch/launcher.c +972 Jun 10 12:51:48 dbus-broker-launch[14538]: launcher_run @ ../src/launch/launcher.c +1341 Jun 10 12:51:48 dbus-broker-launch[14538]: run @ ../src/launch/main.c +152 Jun 10 12:51:48 audit[14538]: AVC avc: denied { watch } for pid=14538 comm="dbus-broker-lau" path="/var/lib/flatpak/exports/share/dbus-1/services" dev="dm-0" ino=2174243 scontext=staff_u:staff_r:staff_dbusd_t:s0-s0:c0.c1023 tcontext=s> Jun 10 12:51:48 systemd[14458]: dbus-broker.service: Main process exited, code=exited, status=1/FAILURE ... which is repeated several times. Preventing dbus-broker from launching sounds like the sort of thing that would explain why a graphical login would fail. Reproducible: Always Steps to Reproduce: 1. Create a user mapped to staff_u 2. Log in via GDM Actual Results: Blue screen (login process is getting stuck somewhere while video output is disabled) Expected Results: Successful login
Tried this on a second system with totally different hardware and after authenticating the muse pointer freezes and I can't switch virtual consoles; however I can SSH in to run 'semanage permissive -a staff_dbusd_t', after which I can log in OK. So it's not a hardware problem but an SELinux policy problem.
Likely /var/lib/flatpak/exports/share/dbus-1/services needs to be given a suitable label and rules are needed to allow staff_dbusd_t/sysadm_dbusd_t/user_dbusd_t/xguest_dbusd_t to access it. I guess adding rules to allow those types to execute gnome_atspi_exec_t is also needed, do you want me to file separate bugzillas for that?
(In reply to Sam Morris from comment #2) > I guess adding rules to allow those types to execute gnome_atspi_exec_t is > also needed, do you want me to file separate bugzillas for that? No, this is sufficient, thank you. It will probably take me more than 1 build to have it addressed completely.
FEDORA-2024-aa24e6024f (selinux-policy-40.29-1.fc40) has been submitted as an update to Fedora 40. https://bodhi.fedoraproject.org/updates/FEDORA-2024-aa24e6024f
FEDORA-2024-a9588c99c1 has been pushed to the Fedora 40 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2024-a9588c99c1` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2024-a9588c99c1 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2024-a9588c99c1 (selinux-policy-40.29-2.fc40) has been pushed to the Fedora 40 stable repository. If problem still persists, please make note of it in this bug report.