Users cannot log in using sddm on Fedora 23

[Andrej Podzimek]

Hello!

After a Fedora 23 installation, users can't log in with sddm. A "login failed" message is displayed by sddm, sometimes preceded by a short switch to the tty and back. Users can log into a text console just fine. Also starting a Plasma desktop using startx works perfectly fine.

Because sddm's logs report helper failures with codes 2 and 15, I tried this:

	# cp -a /usr/libexec/sddm-helper /usr/libexec/sddm-helper-binary
	# cat > /usr/libexec/sddm-helper <<-WRAPPER
	#!/bin/bash
	strace -f /usr/libexec/sddm-helper-binary "$@" 2>/tmp/sddm
	WRAPPER

Here's the entire strace output obtained from a login attempt using the wrapper above: https://andrej.podzimek.org/dell-strace-0.txt The strace dump shows (among other glitches) something like a file descriptor leak. But the most important thing seems to be the following:

	[pid  1818] execve("/usr/sbin/unix_chkpwd", ["/usr/sbin/unix_chkpwd", "andrej", "nullok"], [/* 0 vars */]) = -1 EPERM (Operation not permitted)
	[pid  1820] execve("/usr/sbin/unix_chkpwd", ["/usr/sbin/unix_chkpwd", "andrej", "nullok"], [/* 0 vars */]) = -1 EPERM (Operation not permitted)

I tried to make /etc/shadow readable, but that didn't help. Also tried to do setenforce 0 and that didn't help either. :( Last but not least, rebooting with SELinux in permissive mode does away with the EPERM error, but sddm logins hang forever, with no chance to retry.

I looked at recent sddm bugs such as this one: https://bugzilla.redhat.com/show_bug.cgi?id=1265813 But I don't think other sddm issues could be directly related, because the failure pattern is different, i.e., I can't see any segfaults here and my user IDs are in the correct range (uid 1001 in the attached log). :(

What's wrong here? Why does sddm fail on Fedora 23? The hardware, just if it happens to matter:
DMI: Dell Inc. Inspiron 7548/0AM6R0, BIOS A00 11/19/2014

Cheers,
Andrej