gdm + selinux problem

Dr. Michael J. Chudobiak mjc at avtechpulse.com
Fri Nov 23 13:50:10 UTC 2007


Hi all,

After an F7 -> F8 upgrade, I can't start the xorg server in enforcing 
mode. Logs say things like:

type=AVC msg=audit(1195824979.681:23): avc:  denied  { getattr } for 
pid=2585 comm="gdm-binary" path="/tmp/.X11-unix" dev=dm-0 ino=8871462 
scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 
tcontext=system_u:object_r:initrc_tmp_t:s0 tclass=dir
type=SYSCALL msg=audit(1195824979.681:23): arch=40000003 syscall=196 
success=yes exit=0 a0=8090daf a1=bfb4d320 a2=c2bff4 a3=3 items=0 ppid=1 
pid=2585 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 
fsgid=0 tty=(none) comm="gdm-binary" exe="/usr/sbin/gdm-binary" 
subj=system_u:system_r:xdm_t:s0-s0:c0.c1023 key=(null)


audit2allow says:

#============= cupsd_t ==============
allow cupsd_t nscd_t:nscd shmemserv;

#============= iptables_t ==============
allow iptables_t nscd_t:nscd shmemserv;

#============= nfsd_t ==============
allow nfsd_t nscd_t:nscd { shmemserv getserv };

#============= ntpd_t ==============
allow ntpd_t nscd_t:nscd shmemserv;

#============= sendmail_t ==============
allow sendmail_t fail2ban_log_t:file append;
allow sendmail_t initrc_t:unix_stream_socket { read write };
allow sendmail_t nscd_t:nscd shmemserv;

#============= system_mail_t ==============
allow system_mail_t nscd_t:nscd shmemserv;

#============= xdm_t ==============
allow xdm_t initrc_tmp_t:dir { getattr setattr };

#============= xdm_xserver_t ==============
allow xdm_xserver_t initrc_tmp_t:dir { write getattr search add_name };
allow xdm_xserver_t initrc_tmp_t:sock_file create;



Now... how would this have happened? Should I just run the above 
commands to fix everything, or is there a deeper bug / issue?

Help appreciated!


- Mike




More information about the fedora-selinux-list mailing list