Bug 998935 - Failed to acquire org.freedesktop.ConsoleKit: An SELinux policy prevents this sender from sending this message
Failed to acquire org.freedesktop.ConsoleKit: An SELinux policy prevents this...
Product: Fedora
Classification: Fedora
Component: selinux-policy (Show other bugs)
All Linux
unspecified Severity medium
: ---
: ---
Assigned To: Miroslav Grepl
Fedora Extras Quality Assurance
: Reopened
: 998939 (view as bug list)
Depends On:
  Show dependency treegraph
Reported: 2013-08-20 07:29 EDT by fedorauser
Modified: 2013-08-22 13:27 EDT (History)
4 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2013-08-22 13:27:32 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
relevant log lines from /var/log/messages starting at the point where the user performs the loing (lightdm) (8.14 KB, text/plain)
2013-08-20 07:29 EDT, fedorauser
no flags Details

  None (edit)
Description fedorauser 2013-08-20 07:29:28 EDT
Created attachment 788440 [details]
relevant log lines from /var/log/messages starting at the point where the user performs the loing (lightdm)

Description of problem:
I'm running a freshly installed Fedora 19 with MATE.
After providing the password at the login screen (lightdm), a SELinux log entry is created and a ConsoleKit timeout appears in /var/log/messages.
I suspect that this is the reason for the ~51 seconds delay before the complete desktop appears - more details below.

Version-Release number of selected component (if applicable):
rpm -qa *selinux*

rpm -qa dbus*

How reproducible:
always (I can reproduce this in a seconds F19/MATE installation running in a VirtualBox)

Steps to Reproduce:
1. Install Fedora 19 and choose MATE as your desktop environment
2. After the installation is complete enter the password at the login screen (lightdm)
3. observe/confirm the ~51 seconds delay before the destop environment appears (taskbars, Applications menu,..)

Actual results:
It takes ~51 seconds till the desktop environment appears after lightdm got the password from the user.
Note the following log entry:

console-kit-daemon[1565]: console-kit-daemon[1565]: WARNING: Failed to acquire org.freedesktop.ConsoleKit: An SELinux policy prevents this sender from sending this message to this recipient, 0 matched rules; type="method_call", sender=":1.25" (uid=0 pid=1426 comm="lightdm --session-child 14 19 ") interface="org.freedesktop.ConsoleKit.Manager" member="OpenSessionWithParameters" error name="(unset)" requested_reply="0" destination="org.freedesktop.ConsoleKit" (uid=0 pid=1565 comm="/usr/sbin/console-kit-daemon --no-daemon ")


dbus[768]: [system] Failed to activate service 'org.freedesktop.ConsoleKit': timed out

Expected results:
The desktop environment should appear within a few seconds.

Additional info:

comments for the attached logfile:
@14:12:59: the user did hit enter at the lightdem login screen
@14:13:51: the complete desktop environment appears
Comment 1 Daniel Walsh 2013-08-20 07:55:21 EDT
Any avc messages or user_avc messages?

Can you yum -y update 

And see if a policy update fixes your problem?
Comment 2 Daniel Walsh 2013-08-20 07:56:53 EDT
*** Bug 998939 has been marked as a duplicate of this bug. ***
Comment 3 fedorauser 2013-08-20 09:49:46 EDT
Hi Dan,

thanks for your fast reaction.

According to yum I'm running latest version (no updates available).

Here is the user_avc I see when doing a tail -f audit.log while logging in:

type=USER_AVC msg=audit(1377005973.010:706): pid=773 uid=81 auid=4294967295 ses=4294967295  subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc:  denied  { send_msg } for msgtype=method_call interface=org.freedesktop.ConsoleKit.Manager member=OpenSessionWithParameters dest=org.freedesktop.ConsoleKit spid=12681 tpid=1942 scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tcontext=system_u:system_r:initrc_t:s0 tclass=dbus  exe="/usr/bin/dbus-daemon" sauid=81 hostname=? addr=? terminal=?'
Comment 4 Miroslav Grepl 2013-08-22 09:27:33 EDT
Please execute

# restorecon -R -v /usr/sbin

the problem is with Consolekit running as initrc_t.
Comment 5 fedorauser 2013-08-22 13:07:35 EDT
restorecon didn't fix the problem:

restorecon  -R -v /usr/sbin/
restorecon reset /usr/sbin/rngd context system_u:object_r:bin_t:s0->system_u:object_r:rngd_exec_t:s0
restorecon reset /usr/sbin/iscsiadm context system_u:object_r:bin_t:s0->system_u:object_r:iscsid_exec_t:s0

Is '/usr/sbin/console-kit-daemon' labeled correctly? (I assume this is the relevant file here.)

ls -lZ /usr/sbin/console-kit-daemon 
-rwxr-xr-x. root root system_u:object_r:bin_t:s0       /usr/sbin/console-kit-daemon
Comment 6 fedorauser 2013-08-22 13:27:32 EDT
After updating to:

I run restorecon again:
restorecon  -R -v /usr/sbin/
restorecon reset /usr/sbin/console-kit-daemon context system_u:object_r:bin_t:s0->system_u:object_r:consolekit_exec_t:s0

works now - thanks! (but I wouldn't say that this was not a bug, since an update fixed it.)

Note You need to log in before you can comment on or make changes to this bug.