Bug 455584 - SELinux prevents xdm working correctly
SELinux prevents xdm working correctly
Status: CLOSED DUPLICATE of bug 388431
Product: Fedora
Classification: Fedora
Component: xorg-x11-xdm (Show other bugs)
9
All Linux
low Severity low
: ---
: ---
Assigned To: X/OpenGL Maintenance List
Fedora Extras Quality Assurance
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2008-07-16 09:10 EDT by Adam Tkac
Modified: 2013-04-30 19:40 EDT (History)
3 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2008-07-17 08:03:43 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
AVC denials (2.96 KB, text/plain)
2008-07-16 09:22 EDT, Adam Tkac
no flags Details

  None (edit)
Description Adam Tkac 2008-07-16 09:10:24 EDT
Description of problem:
I decided to start using SELinux on my laptop but it prevents execution of my
favourite destop

Version-Release number of selected component (if applicable):
# rpm -qa |grep selinux-policy
selinux-policy-3.3.1-78.fc9.noarch
selinux-policy-targeted-3.3.1-78.fc9.noarch

How reproducible:
always

Steps to Reproduce:
# cat /etc/sysconfig/desktop 
DISPLAYMANAGER=XDM
PREFERRED=/usr/bin/startfluxbox

and then try log into your desktop
  
Actual results:
fails due missing TE rules

Expected results:
successful login

Additional info:
I will attach commented file with AVC denials
Comment 1 Adam Tkac 2008-07-16 09:22:53 EDT
Created attachment 311949 [details]
AVC denials
Comment 2 Daniel Walsh 2008-07-16 09:48:20 EDT
/etc/X11/xdm/authdir/authfiles directory should be writable (file "A:0-EQRIz0"
is created in this case)

I have no idea what these files are, none of these files/directrories exist when
I install fluxbox?  They are in a horrible location.  Variable files should be
in /var/run/fluxbox?  /var/lib/fluxbox?

If this is authorization data, you could choose:

/var/lib/abl(/.*)?	system_u:object_r:var_auth_t:s0
/var/run/xauth(/.*)?	system_u:object_r:xdm_var_run_t:s0
/var/lib/pam_ssh(/.*)?	system_u:object_r:var_auth_t:s0
/var/run/pam_ssh(/.*)?	system_u:object_r:var_auth_t:s0
/var/run/saslauthd(/.*)?	system_u:object_r:saslauthd_var_run_t:s0
/var/cache/coolkey(/.*)?	system_u:object_r:auth_cache_t:s0

Or create a new one.

/var/log/[kw]dm\.log.*	--	system_u:object_r:xserver_log_t:s0
/var/log/gdm(/.*)?	system_u:object_r:xserver_log_t:s0
/var/log/Xorg.*	--	system_u:object_r:xserver_log_t:s0
/var/log/XFree86.*	--	system_u:object_r:xserver_log_t:s0
/var/log/nvidia-installer\.log.*	--	system_u:object_r:xserver_log_t:s0

xserver log should match one of these I would think?  /var/log/Xorg.0.log seems
to be the way gdm does it.

What pam module does fluxbox use?  Does it include pam_selinux?
Comment 3 Adam Tkac 2008-07-17 07:52:55 EDT
Moving to proper component
Comment 4 Matěj Cepl 2008-07-17 08:03:43 EDT

*** This bug has been marked as a duplicate of 388431 ***

Note You need to log in before you can comment on or make changes to this bug.