gdm + selinux problem

[Daniel J Walsh]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Dr. Michael J. Chudobiak wrote:
>>> #============= xdm_t ==============
>>> allow xdm_t initrc_tmp_t:dir { getattr setattr };
>>>
>>> #============= xdm_xserver_t ==============
>>> allow xdm_xserver_t initrc_tmp_t:dir { write getattr search add_name };
>>> allow xdm_xserver_t initrc_tmp_t:sock_file create;
>>>
>>> Now... how would this have happened? Should I just run the above
>>> commands to fix everything, or is there a deeper bug / issue?
>>>
>> Looks like you might have some labeliing problems, but first update to
>> the latest version of selinux-policy
>>
>> yum -y upgrade selinux-policy
>>
>>
>> And see if most of these have been fixed.
> 
> 
> Daniel,
> 
> After updating another machine (F7 -> F8), I still get gdm failures due
> to selinux, as originally reported. The problem has not be fixed by
> recent rpms. See below:
> 
> [root at titus log]# rpm -qa | grep selinux
> libselinux-python-2.0.43-1.fc8
> selinux-policy-devel-3.0.8-64.fc8
> libselinux-devel-2.0.43-1.fc8
> selinux-policy-3.0.8-64.fc8
> selinux-policy-targeted-3.0.8-64.fc8
> libselinux-2.0.43-1.fc8
> 
> [root at titus log]# ps ax | grep gdm
>  2264 ?        Ss     0:00 /usr/sbin/gdm-binary -nodaemon
>  2355 ?        Ss     0:00 /bin/sh /etc/gdm/XKeepsCrashing
>  2372 ?        S      0:00 /usr/libexec/gdmopen -l /bin/sh -c
> /etc/gdm/XKeepsCrashing -noopen
>  2373 tty7     Ss+    0:00 /bin/sh /etc/gdm/XKeepsCrashing -noopen
>  2779 pts/0    S+     0:00 grep gdm
> 
> [root at titus log]# audit2allow -i messages
> ...snip...
> #============= xdm_t ==============
> allow xdm_t default_t:file write;
> allow xdm_t initrc_tmp_t:dir { getattr search setattr };
> #============= xdm_xserver_t ==============
> allow xdm_xserver_t initrc_tmp_t:dir { write remove_name getattr search
> add_name };
> allow xdm_xserver_t initrc_tmp_t:sock_file { create unlink };
> 
> 
> Disabling selinux lets gdm / xorg run correctly.
> 
> I tried removing all selinux rpms, rm -rf /etc/selinux, re-installing
> selinux, and touching /.autorelabel. No better.
> 
> - Mike
Please attach your audit.log?

ps -eZ | grep initrc_t


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.8 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org

iEYEARECAAYFAkd5VdoACgkQrlYvE4MpobOvcACg48bDjbIVbi9LkG59W2aZZSHa
4/8AoMYPw8SxUsaXXI5Pwm+7jtaqDzTW
=uPzY
-----END PGP SIGNATURE-----