Description of problem: xguest and dbus in rawhide, fails. type=AVC msg=audit(1222140311.434:13): avc: denied { read write } for pid=3476 comm="dbus-daemon" path="socket:[13340]" dev=sockfs ino=13340 scontext=xguest_u:xguest_r:xguest_dbusd_t:s0 tcontext=xguest_u:xguest_r:xguest_t:s0 tclass=unix_stream_socket Version-Release number of selected component (if applicable): xguest-1.0.6-7.fc9.noarch dbus-1.2.3-1.fc10.x86_64 dbus-glib-0.76-2.fc10.i386 dbus-devel-1.2.3-1.fc10.x86_64 dbus-glib-devel-0.76-2.fc10.x86_64 dbus-python-0.83.0-2.fc9.x86_64 dbus-libs-1.2.3-1.fc10.x86_64 dbus-libs-1.2.3-1.fc10.i386 ndesk-dbus-glib-0.4.1-3.fc9.x86_64 dbus-glib-0.76-2.fc10.x86_64 ndesk-dbus-0.6.1a-2.fc9.x86_64 dbus-x11-1.2.3-1.fc10.x86_64 How reproducible: always Steps to Reproduce: 1. install xguest 2. try logging in with user guest Actual results: fail Expected results: login succeeds Additional info:
changing component to selinux-policy-targeted and adding to F10 blocker
Actually looks like this is a more general problem with pam_namespace. Looks like gdm/login is not handling the /tmp file system being replaced.
This fails on Fedora 9 now as well.
Xlib is not handling the abstract namespace any longer. This is a major regression in Fedora 9, Either the kernel or Xlib is now broken, and any users of pam_namespace for /tmp will now break. xguest is broken.
For Fedora9, the bug is apparently caused by one of the following packages: xorg-x11-server-Xephyr-1.5.0-2.fc9.i386 xorg-x11-server-common-1.5.0-2.fc9.i386 xorg-x11-server-Xorg-1.5.0-2.fc9.i386 I could install all other updates from the newkey repos, including gdm, kernel and selinux, without breaking xguest (at least for XFCE desktop which I have tested in a VM). xorg-x11-server version 1.4.99.905-2.20080702.fc9.i386 was compatible with xguest.
xguest is using the pam_namespace to mount a temporary file system over /tmp during the login process. X apps are supposed to connect to @/tmp/.X11-unix/X0 first and then fail over to /tmp/.X11-unix/X0. Either this is no longer true or the first connection is failing for some reason. You can get this behaviour by just renaming the /tmp/.X11-unix/X0 socket # netstat -an | grep -i LIS.*X11 unix 2 [ ACC ] STREAM LISTENING 131718 @/tmp/.X11-unix/X1 unix 2 [ ACC ] STREAM LISTENING 560065 @/tmp/.X11-unix/X0 unix 2 [ ACC ] STREAM LISTENING 131719 /tmp/.X11-unix/X1 unix 2 [ ACC ] STREAM LISTENING 560066 /tmp/.X11-unix/X0 # cd /tmp/.X11-unix # mv X0 X0.back # xterm Warning: This program is an suid-root program or is being run by the root user. The full text of the error or warning message cannot be safely formatted in this environment. You may get a more descriptive message by running the program as a non-root user or by removing the suid bit on the executable.
This is fixed in libxcb-1.1.91-4.fc10