Bug 469091 - SELinux denying gdm the ability to write to var_spool_t?
SELinux denying gdm the ability to write to var_spool_t?
Product: Fedora
Classification: Fedora
Component: selinux-policy-targeted (Show other bugs)
All Linux
medium Severity medium
: ---
: ---
Assigned To: Daniel Walsh
Ben Levenson
Depends On:
  Show dependency treegraph
Reported: 2008-10-29 16:32 EDT by Luke Macken
Modified: 2016-09-19 22:39 EDT (History)
4 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2009-01-08 14:12:38 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Luke Macken 2008-10-29 16:32:49 EDT
Description of problem:

type=1400 audit(1225324588.070:4): avc:  denied  { write } for  pid=1990 comm="gdm-binary" name="gdm" dev=dm-0 ino=69980 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_spool_t:s0 tclass=dir

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1. Spin a fresh rawhide livecd.  boot.
Comment 1 Luke Macken 2008-10-29 16:34:09 EDT
I'm assuming that this occurred  when gdm tried to write /var/spool/gdm/force-display-on-active-vt
Comment 2 Ray Strode [halfline] 2008-10-29 16:44:34 EDT
does restorecon on /var/spool/gdm fix it?
Comment 3 Luke Macken 2008-10-29 17:30:02 EDT
Yes, running restorecon changes the context from var_spool_t to xdm_spool_t and seems to resolve the issue.
Comment 4 Luke Macken 2008-10-29 17:32:10 EDT
I just noticed this message when running the livecd-creator...

/sbin/restorecon reset /var/spool/gdm context system_u:object_r:var_spool_t:s0->system_u:object_r:xdm_spool_t:s0
/sbin/restorecon set context /var/spool/gdm->system_u:object_r:xdm_spool_t:s0 failed:'Invalid argument'
Read error on pipe.
Comment 5 Ray Strode [halfline] 2008-10-29 18:07:30 EDT
There was already about this that got closed, but let's just use this one rather than reopening that one.

what system did you run livecd-creator on?
Comment 6 Luke Macken 2008-10-29 18:28:58 EDT
I ran the livecd-creator on a F9 machine with livecd-tools-019-1.fc9.x86_64 (with SELinux in permissive mode, fwiw)
Comment 7 Daniel Walsh 2008-10-30 14:27:30 EDT
Some how this directory is getting destroyed and recreated with the wrong context.

selinux-policy-3.5.13-11.fc10.noarch  has the correct code, so that if gdm tries to create /var/spool/gdm it will create it with the right context.

But I do not know how or why this is being created with the wrong context.

Suspicion would be rpm post install script or init script.
Comment 8 Ray Strode [halfline] 2008-10-30 14:51:55 EDT
is that the type of thing that might get logged by auditd?
Comment 9 Daniel Walsh 2008-10-30 15:09:14 EDT
Not likely.
Comment 10 Bug Zapper 2008-11-25 23:27:50 EST
This bug appears to have been reported against 'rawhide' during the Fedora 10 development cycle.
Changing version to '10'.

More information and reason for this action is here:

Note You need to log in before you can comment on or make changes to this bug.