Bug 463377 - xguest fails due to incorrect selinux context
xguest fails due to incorrect selinux context
Status: CLOSED RAWHIDE
Product: Fedora
Classification: Fedora
Component: libX11 (Show other bugs)
9
All Linux
urgent Severity urgent
: ---
: ---
Assigned To: Søren Sandmann Pedersen
Fedora Extras Quality Assurance
:
Depends On:
Blocks: F10Blocker/F10FinalBlocker
  Show dependency treegraph
 
Reported: 2008-09-22 23:34 EDT by Matt Domsch
Modified: 2014-06-18 05:10 EDT (History)
11 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2008-10-23 16:49:52 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Matt Domsch 2008-09-22 23:34:02 EDT
Description of problem:
xguest and dbus in rawhide, fails.

type=AVC msg=audit(1222140311.434:13): avc:  denied  { read write } for  pid=3476 
comm="dbus-daemon" path="socket:[13340]" dev=sockfs ino=13340 scontext=xguest_u:xguest_r:xguest_dbusd_t:s0 tcontext=xguest_u:xguest_r:xguest_t:s0 tclass=unix_stream_socket


Version-Release number of selected component (if applicable):
xguest-1.0.6-7.fc9.noarch
dbus-1.2.3-1.fc10.x86_64
dbus-glib-0.76-2.fc10.i386
dbus-devel-1.2.3-1.fc10.x86_64
dbus-glib-devel-0.76-2.fc10.x86_64
dbus-python-0.83.0-2.fc9.x86_64
dbus-libs-1.2.3-1.fc10.x86_64
dbus-libs-1.2.3-1.fc10.i386
ndesk-dbus-glib-0.4.1-3.fc9.x86_64
dbus-glib-0.76-2.fc10.x86_64
ndesk-dbus-0.6.1a-2.fc9.x86_64
dbus-x11-1.2.3-1.fc10.x86_64


How reproducible:
always

Steps to Reproduce:
1. install xguest
2. try logging in with user guest

  
Actual results:
fail

Expected results:
login succeeds

Additional info:
Comment 1 John Poelstra 2008-09-23 13:51:22 EDT
changing component to selinux-policy-targeted and adding to F10 blocker
Comment 2 Daniel Walsh 2008-09-23 15:04:32 EDT
Actually looks like this is a more general problem with pam_namespace.  Looks like gdm/login is not handling the /tmp file system being replaced.
Comment 3 Matt Domsch 2008-10-04 01:23:47 EDT
This fails on Fedora 9 now as well.
Comment 4 Daniel Walsh 2008-10-06 15:58:07 EDT
Xlib is not handling the abstract namespace any longer.  This is a major regression in Fedora 9, Either the kernel or Xlib is now broken, and any users of pam_namespace for /tmp will now break.  xguest is broken.
Comment 5 Joachim Katzer 2008-10-06 18:31:01 EDT
For Fedora9, the bug is apparently caused by one of the following packages:

xorg-x11-server-Xephyr-1.5.0-2.fc9.i386
xorg-x11-server-common-1.5.0-2.fc9.i386
xorg-x11-server-Xorg-1.5.0-2.fc9.i386

I could install all other updates from the newkey repos, including gdm, kernel and selinux, without breaking xguest (at least for XFCE desktop which I have tested in a VM). 
xorg-x11-server version 1.4.99.905-2.20080702.fc9.i386 was compatible with xguest.
Comment 6 Daniel Walsh 2008-10-08 07:52:31 EDT
xguest is using the pam_namespace to mount a temporary file system over /tmp during the login process.  X apps are supposed to connect to @/tmp/.X11-unix/X0 first and then fail over to  /tmp/.X11-unix/X0. Either this is no longer true or the first connection is failing for some reason.

You can get this behaviour by just renaming the /tmp/.X11-unix/X0 socket

# netstat -an | grep -i LIS.*X11
unix  2      [ ACC ]     STREAM     LISTENING     131718 @/tmp/.X11-unix/X1
unix  2      [ ACC ]     STREAM     LISTENING     560065 @/tmp/.X11-unix/X0
unix  2      [ ACC ]     STREAM     LISTENING     131719 /tmp/.X11-unix/X1
unix  2      [ ACC ]     STREAM     LISTENING     560066 /tmp/.X11-unix/X0

# cd /tmp/.X11-unix
# mv X0 X0.back
# xterm
Warning: This program is an suid-root program or is being run by the root user.
The full text of the error or warning message cannot be safely formatted
in this environment. You may get a more descriptive message by running the
program as a non-root user or by removing the suid bit on the executable.
Comment 7 Adam Jackson 2008-10-23 16:49:52 EDT
This is fixed in libxcb-1.1.91-4.fc10

Note You need to log in before you can comment on or make changes to this bug.