login with kdm and home directories on nfs4

[Martin (KDE)]

Hallo,

I don't know if this is kde specificm but I try if here.

My home directorys are stored on a NFS4 server and can are mounted by 
netfs script. the sub directories are accessable by the corresponding 
user and everything is fine - most of the time.

After a reboot the first login fails with the error message "can not 
change to home directory. Using / instead" and i get lots of messages 
from selinux in /var/log/messages:

"setroubleshoot: SELinux hindert kdm (xdm_t) "mount" am Zugriff auf 
nfs_t. For complete SELinux messages. run sealert -l 
82ea4c8a-4442-492f-8e11-f831b24821b4"

which says something like SELinux prevents kdm (xdm_t) "mount" to 
access nfs_t. The sealert result is not very informative for me.

Yesterday I switched from NFSv3 to NFSv4. There were no such Problems 
with NFSv3.

If this is not the right list, dan you please guide me to the right 
one?

Kindly

Martin

Fedora 10, KDE 4.1.3

[Rex Dieter]

Martin (KDE) wrote:
>  Hallo,
>  
>  I don't know if this is kde specificm but I try if here.
>  
>  My home directorys are stored on a NFS4 server and can are mounted by 
>  netfs script. the sub directories are accessable by the corresponding 
>  user and everything is fine - most of the time.
>  
>  After a reboot the first login fails with the error message "can not 
>  change to home directory. Using / instead" and i get lots of messages 
>  from selinux in /var/log/messages:
>  
>  "setroubleshoot: SELinux hindert kdm (xdm_t) "mount" am Zugriff auf 
>  nfs_t. For complete SELinux messages. run sealert -l 
>  82ea4c8a-4442-492f-8e11-f831b24821b4"
>  
>  which says something like SELinux prevents kdm (xdm_t) "mount" to 
>  access nfs_t. The sealert result is not very informative for me.
>  
>  Yesterday I switched from NFSv3 to NFSv4. There were no such Problems 
>  with NFSv3.
>  
>  If this is not the right list, dan you please guide me to the right 
>  one? 
This is almost certainly not a kde-specific issue, I'd suggest starting 
with filing a bug against selinux-policy-targetted or ask on the selinux 
mailing list:
http://www.redhat.com/mailman/listinfo/fedora-selinux-list

-- Rex

-- Rex

[Martin (KDE)]

Am Dienstag, 6. Januar 2009 schrieb Rex Dieter:
>  Martin (KDE) wrote:
>  > Hallo,
>  >
>  > I don't know if this is kde specificm but I try if here.
>  >
>  > My home directorys are stored on a NFS4 server and can are
>  > mounted by netfs script. the sub directories are accessable by
>  > the corresponding user and everything is fine - most of the time.
>  >
>  > After a reboot the first login fails with the error message "can
>  > not change to home directory. Using / instead" and i get lots of
>  > messages from selinux in /var/log/messages:
>  >
>  > "setroubleshoot: SELinux hindert kdm (xdm_t) "mount" am Zugriff
>  > auf nfs_t. For complete SELinux messages. run sealert -l
>  > 82ea4c8a-4442-492f-8e11-f831b24821b4"
>  >
>  > which says something like SELinux prevents kdm (xdm_t) "mount" to
>  > access nfs_t. The sealert result is not very informative for me.
>  >
>  > Yesterday I switched from NFSv3 to NFSv4. There were no such
>  > Problems with NFSv3.
>  >
>  > If this is not the right list, dan you please guide me to the
>  > right one?
>
>  This is almost certainly not a kde-specific issue, I'd suggest
>  starting with filing a bug against selinux-policy-targetted or ask
>  on the selinux mailing list:
>  http://www.redhat.com/mailman/listinfo/fedora-selinux-list 
Thanks. I will subscribe to the selinux list and look further.

>  -- Rex
>
>  -- Rex 
Martin

[Oron Peled]

On Tuesday, 6 בJanuary 2009, Martin (KDE) wrote:
>  > > My home directorys are stored on a NFS4 server and can are
>  > > mounted by netfs script. the sub directories are accessable by
>  > > the corresponding user and everything is fine - most of the time.
>  > > ...
>  > > which says something like SELinux prevents kdm (xdm_t) "mount" to
>  > > access nfs_t. The sealert result is not very informative for me. 
Just another data point -- I use nfs4 + KDM on a small SOHO network
and don't have these issues. Three users (including me) use KDE desktop
and one of my kids uses GNOME.

I migrated from nfs3 to nfs4 back in F7 or F8 (forgot which)
and keep using it until now (F10 updated daily).
[Is your install up to date?]

I've alternated between gdm and kdm through the years. My current choice is
kdm at least until gdm will be configurable again ;-(

My biggest gripe with kdm is that due to the way KDE handles i18n (through
system-settings and not environment variables), kdm does not have a language
selection box in it's login widget and is therefore a non-starter for GNOME
desktop users with i18n needs.

-- 
Oron Peled                                 Voice: [phone]
oron(a)actcom.co.il                  http://www.actcom.co.il/~oron
MCSE: Minesweeper Consultant and Solitaire Expert.

[Kevin Kofler]

On Tuesday 06 January 2009, Oron Peled wrote:
>  My biggest gripe with kdm is that due to the way KDE handles i18n
> (through
>  system-settings and not environment variables), kdm does not have a
>  language selection box in it's login widget and is therefore a non-starter
>  for GNOME desktop users with i18n needs. 
Well, if there's just one local language, it can be set systemwide with 
system-config-language. The problem starts when there are users using 
different languages sharing the same machine.

        Kevin Kofler

[Oron Peled]

On Tuesday, 6 בJanuary 2009, Kevin Kofler wrote:
>  On Tuesday 06 January 2009, Oron Peled wrote:
>  > My biggest gripe with kdm is that due to the way KDE handles i18n (through
>  > system-settings and not environment variables), kdm does not have a
>  > language selection box in it's login widget and is therefore a non-starter
>  > for GNOME desktop users with i18n needs.
>  
>  Well, if there's just one local language, it can be set systemwide with 
>  system-config-language. The problem starts when there are users using 
>  different languages sharing the same machine. 
You've hit the exact use-case. When some family members from abroad
are visiting I want them to (temporarily) login using a different locale.

Rethinking, I now realize this is even more important:
 - System wide locale changing can only be done by root (me)
   while locale is a personal choice. E.g: I prefer English
   while my younger kid still need a native language desktop.

 - Changing locale with KDM + KDE-session involves: logging in,
   changing from system-settings, logging out, logging in again.
   Why not let the user select it during login?

 - The language selected in system-settings has no effect on the
   environment settings (check via the locale command). This looks
   like a bug (miss-feature?) to me.

What do you say?

-- 
Oron Peled                                 Voice: [phone]
oron(a)actcom.co.il                  http://www.actcom.co.il/~oron
"Linux is free. Clue is not." - Eric S. Raymond

[Martin (KDE)]

Oron Peled schrieb:
>  On Tuesday, 6 בJanuary 2009, Martin (KDE) wrote:
> >>> My home directorys are stored on a NFS4 server and can are
> >>> mounted by netfs script. the sub directories are accessable by
> >>> the corresponding user and everything is fine - most of the time.
> >>> ...
> >>> which says something like SELinux prevents kdm (xdm_t) "mount" to
> >>> access nfs_t. The sealert result is not very informative for me.
>  
>  Just another data point -- I use nfs4 + KDM on a small SOHO network
>  and don't have these issues. Three users (including me) use KDE desktop
>  and one of my kids uses GNOME. 
Are you running SELinux in permisive mode? I think this was the default 
up to fedora 8. Yesterday I added a SELinux policy to allow kdm mounting 
nfs volumes (afaik nfs4 mounts the master volume at startup and the 
underlaying volumes as they are needed - and that seems to be the 
problem). But I had no time to check this in deep.

>  
>  I migrated from nfs3 to nfs4 back in F7 or F8 (forgot which)
>  and keep using it until now (F10 updated daily).
>  [Is your install up to date?] 
Yes, my fedora is up to date. usually it updates automatically, checked 
every now and then by the system administrator (me).

>  
>  I've alternated between gdm and kdm through the years. My current choice is
>  kdm at least until gdm will be configurable again ;-( 
I prefere KDM (I know it much better to configure than GDM). And all my 
users (a small SOHO net too) are using KDE so far (besides using windows 
for gamimg).

>  
>  My biggest gripe with kdm is that due to the way KDE handles i18n (through
>  system-settings and not environment variables), kdm does not have a language
>  selection box in it's login widget and is therefore a non-starter for GNOME
>  desktop users with i18n needs.
>   
I don't use Gnome. So I don't know anything about changing language 
settings within Gnome.

Martin

[Oron Peled]

On Wednesday, 7 בJanuary 2009, Martin (KDE) wrote:
>  Oron Peled schrieb:
>  > On Tuesday, 6 בJanuary 2009, Martin (KDE) wrote:
>  >>>> My home directorys are stored on a NFS4 server and can are
>  >>>> mounted by netfs script. the sub directories are accessable by
>  >>>> the corresponding user and everything is fine - most of the time.
>  >>>> ...
>  >>>> which says something like SELinux prevents kdm (xdm_t) "mount"
> to
>  >>>> access nfs_t. The sealert result is not very informative for me.
>  > 
>  > Just another data point -- I use nfs4 + KDM on a small SOHO network
>  > and don't have these issues. Three users (including me) use KDE desktop
>  > and one of my kids uses GNOME.
>  
>  Are you running SELinux in permisive mode? I think this was the default 
>  up to fedora 8. 
$ /usr/sbin/sestatus
SELinux status:                 enabled
SELinuxfs mount:                /selinux
Current mode:                   enforcing
Mode from config file:          enforcing
Policy version:                 23
Policy from config file:        targeted

$ rpmquery selinux-policy
selinux-policy-3.5.13-34.fc10.noarch

$ mount | grep /home
argon:/home on /home type nfs4 (rw,intr,clientaddr=192.0.0.73,addr=192.0.0.72)

>  Yesterday I added a SELinux policy to allow kdm mounting 
>  nfs volumes (afaik nfs4 mounts the master volume at startup and the 
>  underlaying volumes as they are needed - and that seems to be the 
>  problem). But I had no time to check this in deep. 
That must be your problem, as all my nfs4 mounts are static via /etc/fstab:
  argon:/         /nfs4mounts   nfs4    rw,intr 0 0
  argon:/home     /home         nfs4    rw,intr 0 0

There is an /nfs4mounts/home and you can access the home directories in
that path as well. When I started using nfs4 I used to bind-mount /home
to my /nfs4mounts/home (because of nfs4 hierarchical mount structure
I thought there is no alternative). However, I later found out there
is no problem with the simple structure I now use.


>  I don't use Gnome. So I don't know anything about changing
> language 
>  settings within Gnome. 
There is nothing special in GNOME. If you change your language in KDE,
open Konsole and run the 'date' command the output would be in the
system default language and not in your current desktop language.

If you would change the environment (e.g: LANG=es_ES in your shell) 
you would notice that the output changes appropriately in the same
shell or its sub-processes (The same mechanism would work for GNOME
applications btw).

-- 
Oron Peled                                 Voice: [phone]
oron(a)actcom.co.il                  http://www.actcom.co.il/~oron
linux/reboot.h: #define LINUX_REBOOT_MAGIC1  0xfee1dead

[Martin (KDE)]

Oron Peled schrieb:
>  On Wednesday, 7 בJanuary 2009, Martin (KDE) wrote:
> > Oron Peled schrieb:
> >> On Tuesday, 6 בJanuary 2009, Martin (KDE) wrote:
> >>>>> My home directorys are stored on a NFS4 server and can are
> >>>>> mounted by netfs script. the sub directories are accessable by
> >>>>> the corresponding user and everything is fine - most of the time.
> >>>>> ...
> >>>>> which says something like SELinux prevents kdm (xdm_t)
> "mount" to
> >>>>> access nfs_t. The sealert result is not very informative for me.
> >> Just another data point -- I use nfs4 + KDM on a small SOHO network
> >> and don't have these issues. Three users (including me) use KDE desktop
> >> and one of my kids uses GNOME.
> > Are you running SELinux in permisive mode? I think this was the default 
> > up to fedora 8.
>  
>  $ /usr/sbin/sestatus
>  SELinux status:                 enabled
>  SELinuxfs mount:                /selinux
>  Current mode:                   enforcing
>  Mode from config file:          enforcing
>  Policy version:                 23
>  Policy from config file:        targeted
>  
>  $ rpmquery selinux-policy
>  selinux-policy-3.5.13-34.fc10.noarch
>  
>  $ mount | grep /home
>  argon:/home on /home type nfs4 (rw,intr,clientaddr=192.0.0.73,addr=192.0.0.72)
>  
> > Yesterday I added a SELinux policy to allow kdm mounting 
> > nfs volumes (afaik nfs4 mounts the master volume at startup and the 
> > underlaying volumes as they are needed - and that seems to be the 
> > problem). But I had no time to check this in deep.
>  
>  That must be your problem, as all my nfs4 mounts are static via /etc/fstab:
>    argon:/         /nfs4mounts   nfs4    rw,intr 0 0
>    argon:/home     /home         nfs4    rw,intr 0 0
>  
>  There is an /nfs4mounts/home and you can access the home directories in
>  that path as well. When I started using nfs4 I used to bind-mount /home
>  to my /nfs4mounts/home (because of nfs4 hierarchical mount structure
>  I thought there is no alternative). However, I later found out there
>  is no problem with the simple structure I now use. 
Ah, now I get it. If my sollution is not working as expected I try 
explicit mounting nfs4 volumes. As you said, I thought it is not 
possible any longer.

>  
>  
> > I don't use Gnome. So I don't know anything about changing language 
> > settings within Gnome.
>  
>  There is nothing special in GNOME. If you change your language in KDE,
>  open Konsole and run the 'date' command the output would be in the
>  system default language and not in your current desktop language.
>  
>  If you would change the environment (e.g: LANG=es_ES in your shell) 
>  you would notice that the output changes appropriately in the same
>  shell or its sub-processes (The same mechanism would work for GNOME
>  applications btw).
>   
I see the difference. As we are all german and I am the only one using 
the command line this is no problem for my setup. May be it is a good 
idea to fill a bugreport/whishlist entry at kde.

Thanks for pointing the nfs4 stuff out

Martin