Description of problem: I believe this happens during boot. Current Rawhide (07-29) won't reach gdm with SELinux in enforcing mode; I'm reporting all the AVCs I can find. Works fine with enforcing=0 . SELinux is preventing /usr/bin/dbus-daemon from 'bind' accesses on the netlink_selinux_socket . ***** Plugin catchall (100. confidence) suggests *************************** If you believe that dbus-daemon should be allowed bind access on the netlink_selinux_socket by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # grep dbus-daemon /var/log/audit/audit.log | audit2allow -M mypol # semodule -i mypol.pp Additional Information: Source Context system_u:system_r:xdm_t:s0-s0:c0.c1023 Target Context system_u:system_r:xdm_t:s0-s0:c0.c1023 Target Objects [ netlink_selinux_socket ] Source dbus-daemon Source Path /usr/bin/dbus-daemon Port <Unknown> Host (removed) Source RPM Packages dbus-1.6.12-1.fc20.x86_64 Target RPM Packages Policy RPM selinux-policy-3.12.1-67.fc20.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Permissive Host Name (removed) Platform Linux (removed) 3.11.0-0.rc3.git0.1.fc20.x86_64 #1 SMP Mon Jul 29 19:50:04 UTC 2013 x86_64 x86_64 Alert Count 2 First Seen 2013-07-29 16:58:13 PDT Last Seen 2013-07-29 16:58:13 PDT Local ID 1f0ba889-85d6-49fa-b0c7-b57ab518fa85 Raw Audit Messages type=AVC msg=audit(1375142293.348:380): avc: denied { bind } for pid=1046 comm="dbus-daemon" scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tclass=netlink_selinux_socket type=SYSCALL msg=audit(1375142293.348:380): arch=x86_64 syscall=bind success=yes exit=0 a0=3 a1=7fff680bfeb0 a2=c a3=7fff680bfc70 items=0 ppid=1042 pid=1046 auid=4294967295 uid=42 gid=42 euid=42 suid=42 fsuid=42 egid=42 sgid=42 fsgid=42 ses=4294967295 tty=(none) comm=dbus-daemon exe=/usr/bin/dbus-daemon subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null) Hash: dbus-daemon,xdm_t,xdm_t,netlink_selinux_socket,bind Additional info: reporter: libreport-2.1.6 hashmarkername: setroubleshoot kernel: 3.11.0-0.rc3.git0.1.fc20.x86_64 type: libreport
It also tries 'create' as well as 'bind' (I have another AVC for that).
Note, I built a Rawhide live image and that doesn't boot to GDM unless I pass enforcing=0 either, but I don't see any AVCs. So this _may_ not be the cause of the boot issue, I may need to dig deeper in the logs. I'll take a closer look today.