Bug 976640 - Initial console login as root with ConsoleKit enabled is slow
Initial console login as root with ConsoleKit enabled is slow
Status: CLOSED ERRATA
Product: Fedora
Classification: Fedora
Component: selinux-policy-targeted (Show other bugs)
19
All All
unspecified Severity medium
: ---
: ---
Assigned To: Miroslav Grepl
Ben Levenson
: Reopened
Depends On: 975897
Blocks: F19-accepted/F19FinalFreezeException
  Show dependency treegraph
 
Reported: 2013-06-21 01:28 EDT by Adam Williamson
Modified: 2013-11-22 05:29 EST (History)
10 users (show)

See Also:
Fixed In Version: selinux-policy-3.12.1-57.fc19
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2013-07-03 20:56:18 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
journalctl -a output after reproducing this (login finally succeeds at 01:05:46 when org.freedesktop.ConsoleKit times out) (226.56 KB, text/plain)
2013-06-21 01:29 EDT, Adam Williamson
no flags Details

  None (edit)
Description Adam Williamson 2013-06-21 01:28:33 EDT
To reproduce: do an install of F19 Final TC6 LXDE live, create a root password. Boot to the installed system. Without logging in as a user at all, try to log in as root to a console (you can just boot runlevel 3). It will take ~30 seconds to complete. Looks like ConsoleKit attempts to start up and fails somehow. Attaching journalctl -a output from a reproduction (this is after the login finally succeeds).

Proposing as an FE as this is a bit annoying if you hit it and can't really be fixed post-install for some cases, but it's not really life-threatening.
Comment 1 Adam Williamson 2013-06-21 01:29:40 EDT
Created attachment 763651 [details]
journalctl -a output after reproducing this (login finally succeeds at 01:05:46 when org.freedesktop.ConsoleKit times out)
Comment 2 Dan Mashal 2013-06-24 01:52:40 EDT
ConsoleKit is deprecated. I would advise reassigning this to the proper component as there is not much I can do about it.
Comment 3 Adam Williamson 2013-06-24 02:36:06 EDT
ConsoleKit *is* the proper component. it's the component causing the problem.
Comment 4 Dan Mashal 2013-06-24 03:12:40 EDT
ConsoleKit code hasn't changed since F18 and probably older. NOTHING has changed in ConsoleKit.

Jun 21 01:05:21 localhost.localdomain console-kit-daemon[870]: console-kit-daemon[870]: WARNING: Failed to acquire org.freedesktop.ConsoleKit: An SELinux policy prevents this sender from sending this message to this recipient, 0 matched rules; type="method_call", sender=":1.11" (uid=0 pid=437 comm="/bin/login --      ") interface="org.freedesktop.ConsoleKit.Manager" member="OpenSessionWithParameters" error name="(unset)" requested_reply="0" destination="org.freedesktop.ConsoleKit" (uid=0 pid=870 comm="/usr/sbin/console-kit-daemon --no-daemon ")
Jun 21 01:05:21 localhost.localdomain console-kit-daemon[870]: WARNING: Failed to acquire org.freedesktop.ConsoleKit: An SELinux policy prevents this sender from sending this message to this recipient, 0 matched rules; type="method_call", sender=":1.11" (uid=0 pid=437 comm="/bin/login --      ") interface="org.freedesktop.ConsoleKit.Manager" member="OpenSessionWithParameters" error name="(unset)" requested_reply="0" 


Nothing is supposed to depend on ConsoleKit according to Lennart, we both know that was a stupid assumption, which is why I took ownership of the package. What do you want me to do?
Comment 6 Dan Mashal 2013-06-24 03:26:28 EDT
Also see: https://fedoraproject.org/wiki/Features/ckremoval
Comment 7 Adam Williamson 2013-06-24 12:40:00 EDT
That feature is not complete. Things *do* still depend on CK. They have not been migrated off of it. In the mean time, it is still a component of the distro and bugs in it need to be fixed. If you don't want to fix them, you need to orphan the component, not close the bugs.

In this specific case, lxsession is what depends on CK, so effectively, our LXDE desktop and spin are tied to it.
Comment 8 Dan Mashal 2013-06-24 15:42:53 EDT
Please try with selinux policy-55

https://bugzilla.redhat.com/show_bug.cgi?id=975897
Comment 9 Dan Mashal 2013-06-26 05:15:04 EDT
Fixed in selinux-policy-55/56+
Comment 10 Adam Williamson 2013-06-26 05:50:59 EDT
How the flying fuck does that make it 'upstream'?
Comment 11 Fedora Update System 2013-06-26 16:19:38 EDT
selinux-policy-3.12.1-57.fc19 has been submitted as an update for Fedora 19.
https://admin.fedoraproject.org/updates/selinux-policy-3.12.1-57.fc19
Comment 12 Fedora Update System 2013-06-27 11:50:10 EDT
Package selinux-policy-3.12.1-57.fc19:
* should fix your issue,
* was pushed to the Fedora 19 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing selinux-policy-3.12.1-57.fc19'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2013-11846/selinux-policy-3.12.1-57.fc19
then log in and leave karma (feedback).
Comment 13 Richard Marko 2013-07-03 19:02:53 EDT
This seem to fix the issue after the filesystem is relabeled.

(touch /.autorelabel)
Comment 14 Fedora Update System 2013-07-03 20:56:18 EDT
selinux-policy-3.12.1-57.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 15 Aidan Talerico 2013-07-28 22:17:51 EDT
Hello, I seem to be experiencing the same problem as Adam.

I have selinux-policy-3.12.1-66.fc19 installed but I am getting the same message in journalctl and slow login as the original poster experienced.

Jul 28 18:42:33 aidan-fedora console-kit-daemon[851]: WARNING: Failed to acquire org.freedesktop.ConsoleKit: An SELinux policy prevents this sender from sending this message to this recipient, 0 matched rules; type="method_call", sender=":1.10" (uid=0 pid=401 comm="/bin/login --     ") interface="org.freedesktop.ConsoleKit.Manager" member="OpenSessionWithParameters" error name="(unset)" requested_reply="0" destination="org.freedesktop.ConsoleKit" (uid=0 pid=851 comm="/usr/sbin/console-kit-daemon --no-daemon ")
Jul 28 18:42:58 aidan-fedora login[401]: LOGIN ON tty1 BY orr
Comment 16 Miroslav Grepl 2013-07-29 00:46:17 EDT
Could you try to execute

# yum reinstall selinux-policy-targeted

# matchpathcon /usr/sbin/console-kit-daemon

# ls -Z  /usr/sbin/console-kit-daemon
Comment 17 Aidan Talerico 2013-07-29 00:53:38 EDT
yum reinstalled the package without error as expected

# matchpathcon /usr/sbin/console-kit-daemon
/usr/sbin/console-kit-daemon	system_u:object_r:consolekit_exec_t:s0

# ls -Z /usr/sbin/console-kit-daemon
-rwxr-xr-x. root root system_u:object_r:bin_t:s0       /usr/sbin/console-kit-daemon
Comment 18 Miroslav Grepl 2013-07-29 04:25:55 EDT
# restorecon -R -v /usr/sbin

will fix it. 

Did you install F19 as a fresh install?
Comment 19 Aidan Talerico 2013-07-29 07:07:36 EDT
Thank you, that worked. Logins are instant like they used to be.

>Did you install F19 as a fresh install?

No, I upgraded from 18 to 19 using fedup.
Comment 20 japa-fi 2013-10-18 01:21:50 EDT
Had the same issue, solved by followqing instructions above.

# yum reinstall selinux-policy-targeted
# restorecon -R -v /usr/sbin


====================0
System: Fresh install of Fedora 19 (Network install done on 17th Oct), using old /home
selinux-policy-targeted 3.12.1-74.9
matchpathcon and ls -Z provided same resulst as on comment 17.

Just FYI.
Comment 21 japa-fi 2013-10-23 09:07:32 EDT
Oh, forgot to mention: Installed with mate-desktop (if it matters)
Comment 22 Albert-Jan Yzelman 2013-11-22 05:29:03 EST
Found related issue: fresh install of F19 LXDE spin, *all* logins were slow. Not just root. After running out of patience today when login-to-desktop-screen took 20 seconds, found this bug. Solution on top works:

# yum reinstall selinux-policy-targeted
# restorecon -R -v /usr/sbin

Prior-fix log output is below. Would recommend you to find a way to push the above fix during regular yum updates, if LXDE is installed.

Nov 22 10:54:47 localhost.localdomain systemd-logind[354]: New session 1 of user <user>.
Nov 22 10:54:47 localhost.localdomain lxdm-binary[966]: pam_unix(lxdm:session): session opened for user albert by (uid=0)
Nov 22 10:54:47 localhost.localdomain dbus[362]: [system] Activating via systemd: service name='org.freedesktop.ConsoleKit' unit='console-kit-daemon.service'
Nov 22 10:54:47 localhost.localdomain dbus-daemon[362]: dbus[362]: [system] Activating via systemd: service name='org.freedesktop.ConsoleKit' unit='console-kit-daemon.service'
Nov 22 10:54:47 localhost.localdomain systemd[1]: Starting Console Manager...
Nov 22 10:54:47 localhost.localdomain dbus-daemon[362]: dbus[362]: [system] Successfully activated service 'org.freedesktop.ConsoleKit'
Nov 22 10:54:47 localhost.localdomain dbus[362]: [system] Successfully activated service 'org.freedesktop.ConsoleKit'
Nov 22 10:54:47 localhost.localdomain console-kit-daemon[983]: console-kit-daemon[983]: WARNING: Failed to acquire org.freedesktop.ConsoleKit: An SELinux policy prevents this sender from sending this message 
Nov 22 10:54:47 localhost.localdomain console-kit-daemon[983]: console-kit-daemon[983]: WARNING: Could not acquire name; bailing out
Nov 22 10:54:47 localhost.localdomain console-kit-daemon[983]: WARNING: Failed to acquire org.freedesktop.ConsoleKit: An SELinux policy prevents this sender from sending this message to this recipient, 0 matc
Nov 22 10:54:47 localhost.localdomain console-kit-daemon[983]: WARNING: Could not acquire name; bailing out
Nov 22 10:54:47 localhost.localdomain systemd[1]: Started Console Manager.
Nov 22 10:54:47 localhost.localdomain systemd[1]: console-kit-daemon.service: main process exited, code=exited, status=1/FAILURE
Nov 22 10:54:47 localhost.localdomain systemd[1]: Unit console-kit-daemon.service entered failed state.
...
Nov 22 10:55:12 localhost.localdomain dbus-daemon[362]: dbus[362]: [system] Failed to activate service 'org.freedesktop.ConsoleKit': timed out
Nov 22 10:55:12 localhost.localdomain dbus[362]: [system] Failed to activate service 'org.freedesktop.ConsoleKit': timed out
...

Note You need to log in before you can comment on or make changes to this bug.