Fedora Account System
Red Hat Associate
Red Hat Customer
Description of problem: $ cat /var/log/Xorg.0.log <skip> (WW) avc: denied null for request=GLX:MakeCurrent comm=compiz resid=3600006 restype=<unknown> scontext=unconfined_u:unconfined_r:unconfined_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0 tclass=x_resource (WW) avc: denied null for request=GLX:MakeCurrent comm=glxgears resid=5000003 restype=<unknown> scontext=unconfined_u:unconfined_r:unconfined_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0 tclass=x_resource $ ls -Z /usr/lib64/nvidia/libGL* lrwxrwxrwx root root system_u:object_r:lib_t:s0 /usr/lib64/nvidia/libGL.so -> libGL.so.180.29 lrwxrwxrwx root root system_u:object_r:lib_t:s0 /usr/lib64/nvidia/libGL.so.1 -> libGL.so.180.29 -rwxr-xr-x root root system_u:object_r:textrel_shlib_t:s0 /usr/lib64/nvidia/libGL.so.180.29 lrwxrwxrwx root root system_u:object_r:lib_t:s0 /usr/lib64/nvidia/libGLcore.so -> libGLcore.so.180.29 lrwxrwxrwx root root system_u:object_r:lib_t:s0 /usr/lib64/nvidia/libGLcore.so.1 -> libGLcore.so.180.29 -rwxr-xr-x root root system_u:object_r:textrel_shlib_t:s0 /usr/lib64/nvidia/libGLcore.so.180.29 Version-Release number of selected component (if applicable): 3.6.5-3.fc11 How reproducible: always Steps to Reproduce: 1. 2. 3. Actual results: Expected results: Additional info: # rpm -qa | grep selinux selinux-policy-3.6.5-3.fc11.noarch selinux-policy-targeted-3.6.5-3.fc11.noarch libselinux-utils-2.0.77-3.fc11.x86_64 libselinux-python-2.0.77-3.fc11.x86_64 libselinux-2.0.77-3.fc11.x86_64
This looks like a problem in the X11 SELinux patches.
Caused by "DixUnknownAccess" being passed to dixLookupResource or one of the other lookup functions. Need to find the callsite and change it to a nonzero access mode, e.g. "DixReadAccess" to reflect the purpose of the lookup.