Fedora Account System
Red Hat Associate
Red Hat Customer
Created attachment 592480 [details] raw avc denials Description of problem: /usr/bin/kdm is mislabeled in the policy, prevents user_u from logging into kde. Version-Release number of selected component (if applicable): How reproducible: Try to log into kde Steps to Reproduce: 1. Log into kde as a user_u 2. 3. Actual results: kde does not allow log in Expected results: Able to log in Additional info: Fix /usr/bin/kde is mislabeled as bin_t , /usr/bin/kdm should be type xdm_exec_t
*** Bug 832860 has been marked as a duplicate of this bug. ***
*** Bug 832806 has been marked as a duplicate of this bug. ***
Yes, # chcon -t xdm_exec_t /usr/bin/kdm will fix it for now.
sorry for the duplicates, I was having problems connecting to bugzilla.
No problem. I have finally found a bug. Fixed in selinux-policy-3.10.0-132.fc17
For me it actually allows you to login, but only after a delay of 20-30 seconds. Denial message is: type=USER_AVC msg=audit(1340046369.740:212): pid=0 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for msgtype=error error_name=net.reactivated.Fprint.Error.NoSuchDevice dest=:1.193 spid=6245 tpid=6222 scontext=system_u:system_r:fprintd_t:s0-s0:c0.c1023 tcontext=system_u:system_r:initrc_t:s0 tclass=dbus exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'
That looks like you still have a process running as initrc_t?
*** Bug 833184 has been marked as a duplicate of this bug. ***
Yeah, because kdm is labeled bin_t instead of kdm_exec_t. Changing that fixes it. But -130 wants it labeled bin_t.
Yes and a new build/update is on the way.
*** Bug 833219 has been marked as a duplicate of this bug. ***
selinux-policy-3.10.0-132.fc17 has been submitted as an update for Fedora 17. https://admin.fedoraproject.org/updates/selinux-policy-3.10.0-132.fc17
*** Bug 833383 has been marked as a duplicate of this bug. ***
selinux-policy-3.10.0-132.fc17 has been pushed to the Fedora 17 stable repository. If problems still persist, please make note of it in this bug report.
*** Bug 833627 has been marked as a duplicate of this bug. ***
I don't know if this is the same bug, but I have the same problems on f19. I write my user and password on kdm, and when I hit enter, it lasts like 10 seconds to start the splash screen, unless I wait the 10 seconds before hitting enter. Writing "chcon -t xdm_exec_t /usr/bin/kdm" just returns: chcon: can't apply partial context to unlabeled file ‘/usr/bin/kdm’ any ideas if this is the same? thanks!
It's clearly mislabled, but it is completely unlabelled. SELinx labels have several components, not just the "type" (what you are setting with -t). e.g.: # ls -lZ /usr/bin/kdm -rwxr-xr-x. root root system_u:object_r:xdm_exec_t:s0 /usr/bin/kdm Try "restorecon -v /usr/bin/kdm" to set the proper label.
Thanks for answering so quickly, I tried that but I still have the problem. I even have selinux disabled and I still have the problem, so I guess it is something else than selinux? thanks!
Don't disable SELinux - that's going to lead to a lot on unlabeled files causing problems if you re-enable. Set permissive mode (enforcing=0) instead. If you want to try to get back to a working selinux system do: touch /.autorelabel and reboot. This will take a while to relabel everything on system.
I tried that command, and yes it took a while to relabel everything, but I'm still having the delay after I hit enter =/
Try with the force command restorecon -F /usr/sbin/gdm
This bug is about SELinux, if you're having the issue even with SELinux disabled (as you said in comment #19), you're experiencing a DIFFERENT bug with the same symptoms.