Appeared immediately after comment#0

Summary:

SELinux is preventing /usr/libexec/gdm-session-worker "entrypoint" access on
/usr/bin/gnome-keyring-daemon.

Detailed Description:

SELinux denied access requested by gdm-session-wor. It is not expected that this
access is required by gdm-session-wor and this access may signal an intrusion
attempt. It is also possible that the specific version or configuration of the
application is causing it to require additional access.

Allowing Access:

You can generate a local policy module to allow this access - see FAQ
(http://docs.fedoraproject.org/selinux-faq-fc5/#id2961385) Please file a bug
report.

Additional Information:

Source Context                guest_u:guest_r:oddjob_mkhomedir_t:s0
Target Context                system_u:object_r:bin_t:s0
Target Objects                /usr/bin/gnome-keyring-daemon [ file ]
Source                        gdm-session-wor
Source Path                   /usr/libexec/gdm-session-worker
Port                          <Unknown>
Host                          localhost.localdomain
Source RPM Packages           gdm-2.30.4-21.el6
Target RPM Packages           gnome-keyring-2.28.2-6.el6
Policy RPM                    selinux-policy-3.7.19-55.el6
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Plugin Name                   catchall
Host Name                     localhost.localdomain
Platform                      Linux localhost.localdomain 2.6.32-71.el6.i686 #1
                              SMP Wed Sep 1 01:26:34 EDT 2010 i686 i686
Alert Count                   3
First Seen                    Fri Oct  1 10:43:52 2010
Last Seen                     Fri Oct  1 10:47:03 2010
Local ID                      46d0d879-29b7-43a3-84e9-85c5107610a6
Line Numbers                  

Raw Audit Messages            

node=localhost.localdomain type=AVC msg=audit(1285922823.270:335): avc:  denied  { entrypoint } for  pid=5660 comm="gdm-session-wor" path="/usr/bin/gnome-keyring-daemon" dev=dm-0 ino=64714 scontext=guest_u:guest_r:oddjob_mkhomedir_t:s0 tcontext=system_u:object_r:bin_t:s0 tclass=file

node=localhost.localdomain type=SYSCALL msg=audit(1285922823.270:335): arch=40000003 syscall=11 success=no exit=-13 a0=7ba449 a1=bf9bd1a0 a2=a014618 a3=7ba48c items=0 ppid=5622 pid=5660 auid=505 uid=505 gid=505 euid=505 suid=505 fsuid=505 egid=505 sgid=505 fsgid=505 tty=(none) ses=24 comm="gdm-session-wor" exe="/usr/libexec/gdm-session-worker" subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)

I'm sorry I forgot that guest_u user is not allowed to work in an X session.

So this is what happened when you tried to login via X as a guest user.  You were not allowed to login correct?

Yes, I tried to log into X via GDM. After I entered login and password GDM displayed a message something like "Unable to open session" and I was not allowed to log in.

Sadly the tool looked for a transition from xdm_t to guest_t and then attempted to fail over to other domains.  Maybe it is time to change the library to not bring back alternative matches.

We would have to make this change in Rawhide before we tried it in RHEL6.  Delayed until at least 6.2

Fixed in libselinux-2.1.13-10.el7

This request was resolved in Red Hat Enterprise Linux 7.0.

Contact your manager or support representative in case you have further questions about the request.

The needinfo request[s] on this closed bug have been removed as they have been unresolved for 1000 days