Description of problem: At least, I can't log in in enforcing mode. If I'm not in enforcing mode, my login shell ends up being unconfined_u:system_r:abrt_helper_t, which is very wrong. Version-Release number of selected component (if applicable): systemd-3-3 selinux-policy-targeted-3.8.6-3.fc14 How reproducible: 100%
Same problem here for me, same versions of systemd and selinux policy. I can log in if I disable selinux and switch to permissive mode. I tried doing a full relabel of the FS but it didn't help.
Hmm, I thought we had fixed the policy already. Reassigning to the policy package.
Labeling is fixed in selinux-policy-3_8_7-1_fc14 But I will leave this bug open for a while since lots of other changes need to be made to systemd to get it to work properly with SELinux. Lennart we are going to have to either make systemd impersonate services or setup proper labeling on things like sockets, when doing autostart.
My current messages: type=AVC msg=audit(1279341708.897:8): avc: denied { accept } for pid=713 comm="dbus-daemon" path="/var/run/dbus/system_bus_socket" scontext=system_u:system_r:system_dbusd_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=unix_stream_socket type=AVC msg=audit(1279341708.897:9): avc: denied { getattr } for pid=713 comm="dbus-daemon" path="/var/run/dbus/system_bus_socket" scontext=system_u:system_r:system_dbusd_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=unix_stream_socket type=AVC msg=audit(1279341708.897:10): avc: denied { getopt } for pid=713 comm="dbus-daemon" path="/var/run/dbus/system_bus_socket" scontext=system_u:system_r:system_dbusd_t:s0 tcontext=system_u:system_r:init_t:s0 tclass=unix_stream_socket Does not boot in enforcing.
Please open a new bug report, this bug report is for tracking bug & change required for SELinux to work with Systemd. Thanks. --- Fedora Bugzappers volunteer triage team https://fedoraproject.org/wiki/BugZappers
*** Bug 614710 has been marked as a duplicate of this bug. ***
selinux-policy-3.8.8-1.fc14 policy should allow you to boot systemd in enforcing mode. I had to hack policy to allow messagebus and avahi to work. We need to change systemd to properly impersonate those services. Currently the first app that tries to communicate with avahi or dbus ends up with an avc requiring. allow telepathy_msn_t init_t:unix_stream_socket connectto; Since init_t creates the socket. systemd should have setsockcreatecon("system_u:system_r:dbusd_t:s0") Then the avc would have been solved with the allow rule. allow telepathy_msn_t dbusd_t:unix_stream_socket connectto;
Err, reverting. sorry.