Bug 437211 - gdm /tmp files relabel failure
Summary: gdm /tmp files relabel failure
Status: CLOSED RAWHIDE
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy-targeted (Show other bugs)
(Show other bugs)
Version: rawhide
Hardware: All Linux
low
low
Target Milestone: ---
Assignee: Daniel Walsh
QA Contact: Ben Levenson
URL:
Whiteboard:
Keywords:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2008-03-12 21:56 UTC by Warren Togami
Modified: 2008-05-07 15:25 UTC (History)
0 users

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2008-05-07 15:25:15 UTC
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

Description Warren Togami 2008-03-12 21:56:20 UTC
selinux-policy-3.3.1-16.fc9.noarch
gdm-2.21.9-3.fc9.i386

1) Boot with selinux=0
2) Login with gdm to a desktop
3) Reboot
4) Boot with selinux=0 and enforcing
5) gdm fails!  You can't login!

Workaround
1) Erase everything in /tmp
2) Restart gdm

Could this possibly be fixed with selinux-policy?

Sorry I don't know exactly what caused this failure.

Comment 1 Dominick Grift 2008-03-13 09:41:28 UTC
Traditionally the file contexts have explicitely excluded relabelling anything
under /tmp. The reason for this is that if some highly classified data is in a
file in /tmp it would not be appropriate to relabel it to a default label (of
which incidentally there really isn't one for strict or MLS policies and even
for targeted there is no single label that works in all situations). So a
"fixfiles relabel" operation will offer to remove all files under /tmp



Comment 2 Colin Walters 2008-03-13 13:28:04 UTC
A default per-user /tmp would solve this.




Comment 3 Daniel Walsh 2008-03-13 22:07:06 UTC
Relabeling everything used to delete all the files in /tmp, which would fix the
problem and cause gdm to recreate the files on start.  But this was removed
since it was considered to destructive.

Comment 4 Daniel Walsh 2008-05-07 15:25:15 UTC
Added 
+    	rm -rf /tmp/gconfd-* /tmp/pulse-* /tmp/orbit-*
to fixfiles on autorelabel

policycoreutils-2.0.47-2


Note You need to log in before you can comment on or make changes to this bug.