Bug 976640 - Initial console login as root with ConsoleKit enabled is slow
Summary: Initial console login as root with ConsoleKit enabled is slow
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: selinux-policy-targeted
Version: 19
Hardware: All
OS: All
unspecified
medium
Target Milestone: ---
Assignee: Miroslav Grepl
QA Contact: Ben Levenson
URL:
Whiteboard:
Depends On: 975897
Blocks: F19-accepted, F19FinalFreezeException
TreeView+ depends on / blocked
 
Reported: 2013-06-21 05:28 UTC by Adam Williamson
Modified: 2013-11-22 10:29 UTC (History)
10 users (show)

Fixed In Version: selinux-policy-3.12.1-57.fc19
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2013-07-04 00:56:18 UTC


Attachments (Terms of Use)
journalctl -a output after reproducing this (login finally succeeds at 01:05:46 when org.freedesktop.ConsoleKit times out) (226.56 KB, text/plain)
2013-06-21 05:29 UTC, Adam Williamson
no flags Details


Links
System ID Priority Status Summary Last Updated
Red Hat Bugzilla 975897 None None None Never

Internal Links: 975897

Description Adam Williamson 2013-06-21 05:28:33 UTC
To reproduce: do an install of F19 Final TC6 LXDE live, create a root password. Boot to the installed system. Without logging in as a user at all, try to log in as root to a console (you can just boot runlevel 3). It will take ~30 seconds to complete. Looks like ConsoleKit attempts to start up and fails somehow. Attaching journalctl -a output from a reproduction (this is after the login finally succeeds).

Proposing as an FE as this is a bit annoying if you hit it and can't really be fixed post-install for some cases, but it's not really life-threatening.

Comment 1 Adam Williamson 2013-06-21 05:29:40 UTC
Created attachment 763651 [details]
journalctl -a output after reproducing this (login finally succeeds at 01:05:46 when org.freedesktop.ConsoleKit times out)

Comment 2 Dan Mashal 2013-06-24 05:52:40 UTC
ConsoleKit is deprecated. I would advise reassigning this to the proper component as there is not much I can do about it.

Comment 3 Adam Williamson 2013-06-24 06:36:06 UTC
ConsoleKit *is* the proper component. it's the component causing the problem.

Comment 4 Dan Mashal 2013-06-24 07:12:40 UTC
ConsoleKit code hasn't changed since F18 and probably older. NOTHING has changed in ConsoleKit.

Jun 21 01:05:21 localhost.localdomain console-kit-daemon[870]: console-kit-daemon[870]: WARNING: Failed to acquire org.freedesktop.ConsoleKit: An SELinux policy prevents this sender from sending this message to this recipient, 0 matched rules; type="method_call", sender=":1.11" (uid=0 pid=437 comm="/bin/login --      ") interface="org.freedesktop.ConsoleKit.Manager" member="OpenSessionWithParameters" error name="(unset)" requested_reply="0" destination="org.freedesktop.ConsoleKit" (uid=0 pid=870 comm="/usr/sbin/console-kit-daemon --no-daemon ")
Jun 21 01:05:21 localhost.localdomain console-kit-daemon[870]: WARNING: Failed to acquire org.freedesktop.ConsoleKit: An SELinux policy prevents this sender from sending this message to this recipient, 0 matched rules; type="method_call", sender=":1.11" (uid=0 pid=437 comm="/bin/login --      ") interface="org.freedesktop.ConsoleKit.Manager" member="OpenSessionWithParameters" error name="(unset)" requested_reply="0" 


Nothing is supposed to depend on ConsoleKit according to Lennart, we both know that was a stupid assumption, which is why I took ownership of the package. What do you want me to do?

Comment 6 Dan Mashal 2013-06-24 07:26:28 UTC
Also see: https://fedoraproject.org/wiki/Features/ckremoval

Comment 7 Adam Williamson 2013-06-24 16:40:00 UTC
That feature is not complete. Things *do* still depend on CK. They have not been migrated off of it. In the mean time, it is still a component of the distro and bugs in it need to be fixed. If you don't want to fix them, you need to orphan the component, not close the bugs.

In this specific case, lxsession is what depends on CK, so effectively, our LXDE desktop and spin are tied to it.

Comment 8 Dan Mashal 2013-06-24 19:42:53 UTC
Please try with selinux policy-55

https://bugzilla.redhat.com/show_bug.cgi?id=975897

Comment 9 Dan Mashal 2013-06-26 09:15:04 UTC
Fixed in selinux-policy-55/56+

Comment 10 Adam Williamson 2013-06-26 09:50:59 UTC
How the flying fuck does that make it 'upstream'?

Comment 11 Fedora Update System 2013-06-26 20:19:38 UTC
selinux-policy-3.12.1-57.fc19 has been submitted as an update for Fedora 19.
https://admin.fedoraproject.org/updates/selinux-policy-3.12.1-57.fc19

Comment 12 Fedora Update System 2013-06-27 15:50:10 UTC
Package selinux-policy-3.12.1-57.fc19:
* should fix your issue,
* was pushed to the Fedora 19 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing selinux-policy-3.12.1-57.fc19'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2013-11846/selinux-policy-3.12.1-57.fc19
then log in and leave karma (feedback).

Comment 13 Richard Marko 2013-07-03 23:02:53 UTC
This seem to fix the issue after the filesystem is relabeled.

(touch /.autorelabel)

Comment 14 Fedora Update System 2013-07-04 00:56:18 UTC
selinux-policy-3.12.1-57.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 15 Aidan Talerico 2013-07-29 02:17:51 UTC
Hello, I seem to be experiencing the same problem as Adam.

I have selinux-policy-3.12.1-66.fc19 installed but I am getting the same message in journalctl and slow login as the original poster experienced.

Jul 28 18:42:33 aidan-fedora console-kit-daemon[851]: WARNING: Failed to acquire org.freedesktop.ConsoleKit: An SELinux policy prevents this sender from sending this message to this recipient, 0 matched rules; type="method_call", sender=":1.10" (uid=0 pid=401 comm="/bin/login --     ") interface="org.freedesktop.ConsoleKit.Manager" member="OpenSessionWithParameters" error name="(unset)" requested_reply="0" destination="org.freedesktop.ConsoleKit" (uid=0 pid=851 comm="/usr/sbin/console-kit-daemon --no-daemon ")
Jul 28 18:42:58 aidan-fedora login[401]: LOGIN ON tty1 BY orr

Comment 16 Miroslav Grepl 2013-07-29 04:46:17 UTC
Could you try to execute

# yum reinstall selinux-policy-targeted

# matchpathcon /usr/sbin/console-kit-daemon

# ls -Z  /usr/sbin/console-kit-daemon

Comment 17 Aidan Talerico 2013-07-29 04:53:38 UTC
yum reinstalled the package without error as expected

# matchpathcon /usr/sbin/console-kit-daemon
/usr/sbin/console-kit-daemon	system_u:object_r:consolekit_exec_t:s0

# ls -Z /usr/sbin/console-kit-daemon
-rwxr-xr-x. root root system_u:object_r:bin_t:s0       /usr/sbin/console-kit-daemon

Comment 18 Miroslav Grepl 2013-07-29 08:25:55 UTC
# restorecon -R -v /usr/sbin

will fix it. 

Did you install F19 as a fresh install?

Comment 19 Aidan Talerico 2013-07-29 11:07:36 UTC
Thank you, that worked. Logins are instant like they used to be.

>Did you install F19 as a fresh install?

No, I upgraded from 18 to 19 using fedup.

Comment 20 japa-fi 2013-10-18 05:21:50 UTC
Had the same issue, solved by followqing instructions above.

# yum reinstall selinux-policy-targeted
# restorecon -R -v /usr/sbin


====================0
System: Fresh install of Fedora 19 (Network install done on 17th Oct), using old /home
selinux-policy-targeted 3.12.1-74.9
matchpathcon and ls -Z provided same resulst as on comment 17.

Just FYI.

Comment 21 japa-fi 2013-10-23 13:07:32 UTC
Oh, forgot to mention: Installed with mate-desktop (if it matters)

Comment 22 Albert-Jan Yzelman 2013-11-22 10:29:03 UTC
Found related issue: fresh install of F19 LXDE spin, *all* logins were slow. Not just root. After running out of patience today when login-to-desktop-screen took 20 seconds, found this bug. Solution on top works:

# yum reinstall selinux-policy-targeted
# restorecon -R -v /usr/sbin

Prior-fix log output is below. Would recommend you to find a way to push the above fix during regular yum updates, if LXDE is installed.

Nov 22 10:54:47 localhost.localdomain systemd-logind[354]: New session 1 of user <user>.
Nov 22 10:54:47 localhost.localdomain lxdm-binary[966]: pam_unix(lxdm:session): session opened for user albert by (uid=0)
Nov 22 10:54:47 localhost.localdomain dbus[362]: [system] Activating via systemd: service name='org.freedesktop.ConsoleKit' unit='console-kit-daemon.service'
Nov 22 10:54:47 localhost.localdomain dbus-daemon[362]: dbus[362]: [system] Activating via systemd: service name='org.freedesktop.ConsoleKit' unit='console-kit-daemon.service'
Nov 22 10:54:47 localhost.localdomain systemd[1]: Starting Console Manager...
Nov 22 10:54:47 localhost.localdomain dbus-daemon[362]: dbus[362]: [system] Successfully activated service 'org.freedesktop.ConsoleKit'
Nov 22 10:54:47 localhost.localdomain dbus[362]: [system] Successfully activated service 'org.freedesktop.ConsoleKit'
Nov 22 10:54:47 localhost.localdomain console-kit-daemon[983]: console-kit-daemon[983]: WARNING: Failed to acquire org.freedesktop.ConsoleKit: An SELinux policy prevents this sender from sending this message 
Nov 22 10:54:47 localhost.localdomain console-kit-daemon[983]: console-kit-daemon[983]: WARNING: Could not acquire name; bailing out
Nov 22 10:54:47 localhost.localdomain console-kit-daemon[983]: WARNING: Failed to acquire org.freedesktop.ConsoleKit: An SELinux policy prevents this sender from sending this message to this recipient, 0 matc
Nov 22 10:54:47 localhost.localdomain console-kit-daemon[983]: WARNING: Could not acquire name; bailing out
Nov 22 10:54:47 localhost.localdomain systemd[1]: Started Console Manager.
Nov 22 10:54:47 localhost.localdomain systemd[1]: console-kit-daemon.service: main process exited, code=exited, status=1/FAILURE
Nov 22 10:54:47 localhost.localdomain systemd[1]: Unit console-kit-daemon.service entered failed state.
...
Nov 22 10:55:12 localhost.localdomain dbus-daemon[362]: dbus[362]: [system] Failed to activate service 'org.freedesktop.ConsoleKit': timed out
Nov 22 10:55:12 localhost.localdomain dbus[362]: [system] Failed to activate service 'org.freedesktop.ConsoleKit': timed out
...


Note You need to log in before you can comment on or make changes to this bug.