Upgrade F13 -> F14: gdm-session-wor / login denials

[Christoph A.]

Hi,

I did an upgrade from f13 to f14 (preupgrade method),
after the reboot network was not working.

My next step was:
touch /.autorelabel
reboot

after the reboot, relabeling took place and after finishing the usual
reboot occurred.

Since the relabeling the machines gdm is not starting anymore.
Logins on the tty (ctrl+alt+F2) are also not working. login attempts
result in an immediate logout.

Booting with selinux=0 as boot option works fine (gdm starts, login works).

In the logfiles one can find these AVCs:

[   28.919108] type=1400 audit(1306418925.312:5): avc:  denied  {
entrypoint } for  pid=2067 comm="gdm-session-wor"
path="/etc/X11/xinit/Xsession" dev=dm-1 ino=3539578
scontext=unconfined_u:system_r:abrt_helper_t:s0-s0:c0.c1023
tcontext=system_u:object_r:bin_t:s0 tclass=file

gdm-binary[1875]: WARNING: GdmDisplay: display lasted 1.689620 seconds
WARNING: GdmLocalDisplayFactory: maximum number of X display failures
reached: check X server log for errors

kernel: [   53.017140] type=1400 audit(1306418949.453:11): avc:  denied
 { entrypoint } for  pid=2227 comm="login" path="/bin/bash" dev=dm-1
ino=262272 scontext=unconfined_u:system_r:abrt_helper_t:s0-s0:c0.c1023
tcontext=system_u:object_r:shell_exec_t:s0 tclass=filekernel: [
53.020348] init: tty (/dev/tty2) main process ended, respawning

Any hints how to fix this?

thanks,
Christoph A.

[Dominick Grift]

On Thu, 2011-05-26 at 16:39 +0200, Christoph A. wrote:

>  kernel: [   53.017140] type=1400 audit(1306418949.453:11): avc: 
> denied
>   { entrypoint } for  pid=2227 comm="login" path="/bin/bash" dev=dm-1
>  ino=262272 scontext=unconfined_u:system_r:abrt_helper_t:s0-s0:c0.c1023
>  tcontext=system_u:object_r:shell_exec_t:s0 tclass=filekernel: [
>  53.020348] init: tty (/dev/tty2) main process ended, respawning
>  
>  Any hints how to fix this? 
Yes i have seen this before. It seems to be a bug in the f13 -> f14
upgrade path.

Try this on your own risk:

setenforce 0
yum erase selinux-policy selinux-policy-targeted
mv /etc/selinux/targeted /etc/selinux/targeted.backup
yum install selinux-policy selinux-policy-targeted
(check /etc/selinux/config to see whether SELINUX=enforcing and not
disabled
touch /.autorelabel && reboot

>  thanks,
>  Christoph A.
>  
>  --
>  selinux mailing list
>  selinux(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/selinux

[Christoph A.]

On 05/26/2011 04:44 PM, Dominick Grift wrote:
>  Try this on your own risk:
>  
>  setenforce 0
>  yum erase selinux-policy selinux-policy-targeted
>  mv /etc/selinux/targeted /etc/selinux/targeted.backup
>  yum install selinux-policy selinux-policy-targeted
>  (check /etc/selinux/config to see whether SELINUX=enforcing and not
>  disabled
>  touch /.autorelabel && reboot 
Resolved the issue for me - thanks.
Christoph

[Christoph A.]

On 05/26/2011 04:39 PM, Christoph A. wrote:
>  Any hints how to fix this? 
I'll try:
https://bugzilla.redhat.com/show_bug.cgi?id=702865#c13

[Dominick Grift]

On Thu, 2011-05-26 at 16:45 +0200, Christoph A. wrote:
>  On 05/26/2011 04:39 PM, Christoph A. wrote:
>  > Any hints how to fix this?
>  
>  I'll try:
>  https://bugzilla.redhat.com/show_bug.cgi?id=702865#c13 
Basically the same solution, yes

>  --
>  selinux mailing list
>  selinux(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/selinux

[Christoph A.]

On 05/26/2011 04:50 PM, Dominick Grift wrote:
>  Basically the same solution, yes 
thanks for your fast reply.
(I didn't see your reply before posting my reply)

We will see how it goes.

I suppose a lot of people will run into this issue in the coming month
before f13 reaches EOL.

Christoph

[Miroslav Grepl]

On 05/26/2011 04:52 PM, Christoph A. wrote:
>  On 05/26/2011 04:50 PM, Dominick Grift wrote:
> > Basically the same solution, yes
>  thanks for your fast reply.
>  (I didn't see your reply before posting my reply)
>
>  We will see how it goes.
>
>  I suppose a lot of people will run into this issue in the coming month
>  before f13 reaches EOL.
>
>  Christoph 
Yes, I will do a new update ASAP.
>  --
>  selinux mailing list
>  selinux(a)lists.fedoraproject.org
>  https://admin.fedoraproject.org/mailman/listinfo/selinux