Bug#683756: [DSE-Dev] Bug#683756: selinux in permissive mode breaks gdm and X

2012-09-05 Thread debian

Hi Ron,

Am 05.09.2012 02:32, schrieb Ron Murray:


I did some work on the remaining machine today. First I enabled
debugging on the gdm3 daemon, set up an strace, and started gdm. As
before, gdm3 respawned multiple times in short order before I stopped
it.

Only serious thing I could find was this, in one of the Xorg logs:


Are you absolutely sure the context for gdm3 is correct at the machine 
where it doesn't work? You wrote that you relabeled and rebooted and 
that would restore the (wrong) context. Unfortunately (I'm not sure if 
this is a bug - it is intended but I don't like it) reenabling selinux 
after having it disabled triggers an autorelabel. This is what happened 
for me: I had selinux disabled, changed the context for gdm3, rebooted 
with selinux=1 security=selinux, the system did a relabeling on the 
boot, and I got a broken gdm3 right again. You then have to log into a 
VT (e.g. ctrl+alt+f1) and correct the label from the command line. Then 
you can reboot once again (which now will hopefully _not_ relabel) and 
after that it worked for me.
An alternative would be to add the correct label to the local 
configuration but given that a fixed package should be just around the 
corner, a temporary workaround seems okay.


This workaround is necessary for systems running unstable until the fix 
for this bug hits unstable and will be necessary for systems running 
testing until the fixed package migrates.


Cheers,

Mika


--
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org



Bug#683756: [DSE-Dev] Bug#683756: selinux in permissive mode breaks gdm and X

2012-09-05 Thread Ron Murray

On Sep 5, 2012, at 5:11, deb...@mikapflueger.de wrote:

 Hi Ron
 Are you absolutely sure the context for gdm3 is correct at the machine where 
 it doesn't work? You wrote that you relabeled and rebooted and that would 
 restore the (wrong) context. Unfortunately (I'm not sure if this is a bug - 
 it is intended but I don't like it) reenabling selinux after having it 
 disabled triggers an autorelabel. This is what happened for me: I had selinux 
 disabled, changed the context for gdm3, rebooted with selinux=1 
 security=selinux, the system did a relabeling on the boot, and I got a broken 
 gdm3 right again. You then have to log into a VT (e.g. ctrl+alt+f1) and 
 correct the label from the command line. Then you can reboot once again 
 (which now will hopefully _not_ relabel) and after that it worked for me.

Yes, I'm sure the context is correct. I was initially fooled by the 
context-change-on-relabel 'feature', but when gdm gets stuck on that, it 
doesn't respawn. When I fixed the context and rebooted, gdm continually 
respawned as it had done before, and the segfault and backtrack appeared in the 
log. I think we're talking about a different bug now (probably in libextmod).

A better workaround, I found, is to restore libextmod.so to its correct place, 
and add this to xorg.conf:

Section Module
SubSection extmod
Option omit SELinux
EndSubSection
EndSection

   That, at least, retains the other ext mod functions.

 .Ron


--
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org



Bug#683756: selinux in permissive mode breaks gdm and X

2012-09-04 Thread Ron Murray
Package: selinux-policy-default
Version: 2:2.20110726-9
Followup-For: Bug #683756

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

I did some work on the remaining machine today. First I enabled
debugging on the gdm3 daemon, set up an strace, and started gdm. As
before, gdm3 respawned multiple times in short order before I stopped
it.

Only serious thing I could find was this, in one of the Xorg logs:

 
[   498.407] Backtrace:
[   498.407] 0: /usr/bin/Xorg (xorg_backtrace+0x36) [0x7feccd3b7ae6]
[   498.407] 1: /usr/bin/Xorg (0x7feccd239000+0x182609) [0x7feccd3bb609]
[   498.407] 2: /lib/x86_64-linux-gnu/libpthread.so.0 (0x7feccc561000+0xf030) 
[0x7feccc570030]
[   498.407] 3: /usr/lib/xorg/modules/extensions/libextmod.so 
(0x7fecca361000+0x18cda) [0x7fecca379cda]
[   498.407] 4: /usr/lib/xorg/modules/extensions/libextmod.so 
(0x7fecca361000+0x19b90) [0x7fecca37ab90]
[   498.407] 5: /usr/bin/Xorg (_CallCallbacks+0x34) [0x7feccd290594]
[   498.407] 6: /usr/bin/Xorg (XaceHook+0xe8) [0x7feccd329a28]
[   498.408] 7: /usr/bin/Xorg (0x7feccd239000+0x1175c0) [0x7feccd3505c0]
[   498.408] 8: /usr/bin/Xorg (0x7feccd239000+0x12082c) [0x7feccd35982c]
[   498.408] 9: /usr/bin/Xorg (0x7feccd239000+0x52e41) [0x7feccd28be41]
[   498.408] 10: /usr/bin/Xorg (0x7feccd239000+0x41ed5) [0x7feccd27aed5]
[   498.408] 11: /lib/x86_64-linux-gnu/libc.so.6 (__libc_start_main+0xfd) 
[0x7feccb28bead]
[   498.408] 12: /usr/bin/Xorg (0x7feccd239000+0x421ad) [0x7feccd27b1ad]
[   498.408] 
[   498.408] Segmentation fault at address (nil)
[   498.408] 
Fatal server error:
[   498.408] Caught signal 11 (Segmentation fault). Server aborting
[   498.408] 
[   498.408] 

 

   Other logs seemed to reflect this (Couldn't connect to X server,
etc). As an experiment, and in the absence of anything else to try, I
moved /usr/lib/xorg/modules/extensions/libextmod.so temporarily out of
the way and started gdm3, and this time it worked -- login screen
appeared, and I was able to log in and use the machine normally.

   Clearly some things won't work on the box now, but I can live with
that for now. I think we have a pointer to the problem: it seems
there's a bug in libextmod. A 'strings' command on libextmod.so gives
lots of selinux references, which probably don't come into play with
selinux turned off, but may do so even in permissive mode.

   It's odd, though, that it only happens on some boxes and not
others. This particular box has an nVidia video card and I'm using the
proprietary drivers, but I have another box with roughly the same
setup and it worked after I did the context change on /usr/sbin/gdm3.

   I don't really want to start delving into the X sources at my stage
in life. Should we pass this on to the X maintainers? Or start a new
bug?

 .Ron


- -- System Information:
Debian Release: wheezy/sid
  APT prefers testing
  APT policy: (500, 'testing'), (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 3.5.3-khufu-0 (SMP w/2 CPU cores; PREEMPT)
Locale: LANG=C, LC_CTYPE=C (charmap=ANSI_X3.4-1968)
Shell: /bin/sh linked to /bin/dash

Versions of packages selinux-policy-default depends on:
ii  libpam-modules   1.1.3-7.1
ii  libselinux1  2.1.9-5
ii  libsepol12.1.4-3
ii  policycoreutils  2.1.10-9
ii  python   2.7.3~rc2-1

Versions of packages selinux-policy-default recommends:
ii  checkpolicy  2.1.8-2
ii  setools  3.3.7-3

Versions of packages selinux-policy-default suggests:
ii  logcheck1.3.15
pn  syslog-summary  none

- -- Configuration Files:
/etc/selinux/default/modules/active/file_contexts.local [Errno 13] Permission 
denied: u'/etc/selinux/default/modules/active/file_contexts.local'

- -- no debconf information

-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.12 (GNU/Linux)

iQIcBAEBAgAGBQJQRp2FAAoJEDHYrtWvbQ1Kf6IP/iJKrX3KzwNy0Ftw9B1kIAAK
IvV+aygCCxqbi8+SGvL+2bwXGcU8dgvFOLA5SI9tzuepwz/azkYzZ1UfcHhnM4o/
1TsU2/AdXZUEuMSzkJ2i0iW+TnlQd7KLYAdiRUYCNn4wtNeEsN7dQycx3go7Gk1E
PpeqW1p4yvJvpOyDGYmCq/1/faJMcUk8l6oq21S7YtEiANHckJNC4Q9o09gEVV4W
u1q/vsPYjwRsYaOGSTC4apmwNP1wL9kqkzRKmn/PwXBAGrdatx+uZ8Y4z5g+yIVa
x7G+88C+hKSrP/7C6nDiipjaqTs4/FAkjmjDU74KEu8xMEv1e9DuaWEIw2kx30Df
+WRiXJ5e9aR6Qtj14STQt1a8pJTnrx1pCe0qmTevr40YrHa7MBhJiSknBFqgG2Ta
Jx1yxAxNmql9HgmyYRkvQfB4I6i8heojmPam/T9Ln38VbpUn22GXK2h3JR5HbDe4
odm5J1R/PYYVY3PhWfnDMgRpEmRDKStpt5MyvRJcZLrMHkw1yq3Zt0Ho/OJSQOeU
Yv0re9OSDAjfmXLK/YnmLY3ARksghQEdwPVpano64IGsXToiD7Tb9ZntUTo5yy/K
4nOX8fAOUOAkGEDhI651RCW+Rhk8Wzrebar4NNbXVJIfqOomDncVwNaKSDCrdFnd
G5RGy/F+XCppwt7PO3D5
=CZNI
-END PGP SIGNATURE-


-- 
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org



Bug#683756: selinux in permissive mode breaks gdm and X

2012-08-30 Thread Ron Murray
On 08/29/12 06:27, Laurent Bigonville wrote:
 Hello,

 Alright, I got it.

 /usr/sbin/gdm3 is not labeled with the right context.

 On my machine here it's labeled:

 -rwxr-xr-x. 1 root root system_u:object_r:xdm_exec_t:SystemLow 160296 jun 25 
 20:29 /usr/sbin/gdm3

 And by default in wheezy it's labeled as bin_t.

 Could you please confirm that changing the label on the /usr/sbin/gdm3
 executable is fixing your issue?

 Cheers

 Laurent Bigonville

OK, we progress. The label change fixed it on two of the three machines
I'm having the problem with. On the other, starting it up in selinux
permissive mode (after the relabelling and subsequent reboot) causes
gdm3 to respawn continually. I'll try another strace session on that one
to see if that turns up anything, but I can't get to the machine until
next week (it's my work machine).

Thanks,

 .Ron


-- 
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org



Bug#683756: selinux in permissive mode breaks gdm and X

2012-08-29 Thread Laurent Bigonville
Hello,

Alright, I got it.

/usr/sbin/gdm3 is not labeled with the right context.

On my machine here it's labeled:

-rwxr-xr-x. 1 root root system_u:object_r:xdm_exec_t:SystemLow 160296 jun 25 
20:29 /usr/sbin/gdm3

And by default in wheezy it's labeled as bin_t.

Could you please confirm that changing the label on the /usr/sbin/gdm3
executable is fixing your issue?

Cheers

Laurent Bigonville


-- 
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org



Bug#683756: selinux in permissive mode breaks gdm and X

2012-08-29 Thread piruthiviraj natarajan
You want us to change the type bin_t into what?
I assumed that you want to relabel the type and I tried relabelling
#chcon -t xdm_exec_t /usr/sbin/gdm3

 but it didn't work. Still stuck with a black screen. I had to disable the
selinux at boot to login to X.
Now I am at
#ls -Z /usr/sbin/gdm3
system_u:object_r:xdm_exec_t:s0 /usr/sbin/gdm3


Bug#683756: selinux in permissive mode breaks gdm and X

2012-08-29 Thread Laurent Bigonville
Le Wed, 29 Aug 2012 16:45:02 +0530,
piruthiviraj natarajan piruthivi...@gmail.com a écrit :

 You want us to change the type bin_t into what?
 I assumed that you want to relabel the type and I tried relabelling
 #chcon -t xdm_exec_t /usr/sbin/gdm3
 
  but it didn't work. Still stuck with a black screen. I had to
 disable the selinux at boot to login to X.
 Now I am at
 #ls -Z /usr/sbin/gdm3
 system_u:object_r:xdm_exec_t:s0 /usr/sbin/gdm3

That should fix the described issue if selinux is in permissive mode,
not enforcing mode. We are still far to have GNOME working in enforcing
mode.

Cheers

Laurent Bigonville


--
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org



Bug#683756: [DSE-Dev] Bug#683756: selinux in permissive mode breaks gdm and X

2012-08-29 Thread Mika Pflüger
Hi,

Am Wed, 29 Aug 2012 14:23:29 +0200
schrieb Laurent Bigonville bi...@debian.org:

 Le Wed, 29 Aug 2012 16:45:02 +0530,
 piruthiviraj natarajan piruthivi...@gmail.com a écrit :
 
  You want us to change the type bin_t into what?
  I assumed that you want to relabel the type and I tried relabelling
  #chcon -t xdm_exec_t /usr/sbin/gdm3
  
   but it didn't work. Still stuck with a black screen. I had to
  disable the selinux at boot to login to X.
  Now I am at
  #ls -Z /usr/sbin/gdm3
  system_u:object_r:xdm_exec_t:s0 /usr/sbin/gdm3
 
 That should fix the described issue if selinux is in permissive mode,
 not enforcing mode. We are still far to have GNOME working in
 enforcing mode.

Yes, you found the culprit. Thanks a lot! I just couldn't imagine the
label having any influence on the functionality in permissive mode.
Well, I still don't really understand, but it works. (-:

Cheers + thanks,

Mika


signature.asc
Description: PGP signature


Bug#683756: [DSE-Dev] Bug#683756: Bug#683756: selinux in permissive mode breaks gdm and X

2012-08-29 Thread Andreas Kuckartz
Mika Pflüger:
 I just couldn't imagine the label having any influence on the 
 functionality in permissive mode. Well, I still don't really 
 understand, but it works. (-:

I also would really like to understand how the label could break gdm
in permissive mode.

I do not like unexplained this can't happen situations in the
context of security features or software.

Cheers,
Andreas


-- 
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org



Bug#683756: selinux in permissive mode breaks gdm and X

2012-08-29 Thread Laurent Bigonville
Le 29 Aug 2012 22:42:19 +0200,
Andreas Kuckartz a.kucka...@ping.de a écrit :

 Mika Pflüger:
  I just couldn't imagine the label having any influence on the 
  functionality in permissive mode. Well, I still don't really 
  understand, but it works. (-:
 
 I also would really like to understand how the label could break gdm
 in permissive mode.
 
 I do not like unexplained this can't happen situations in the
 context of security features or software.

My understanding (according the tiny knowledge I have regarding selinux)
is that pam is trying to set a context, but that for some reason there
is no default context that can be set and pam is asking interactively
in which context it should run and then everything is getting stuck.

My 2¢

Laurent Bigonville


--
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org



Bug#683756: selinux in permissive mode breaks gdm and X

2012-08-28 Thread Laurent Bigonville
Hi,

Could you please check if you have the selinux-policy-default package
installed?

Also, what is the semanage login -l command giving you?

Cheers

Laurent Bigonville


-- 
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org



Bug#683756: selinux in permissive mode breaks gdm and X

2012-08-28 Thread piruthiviraj natarajan
I have the selinux-policy-default package installed.


root@debian:~# semanage login -l

Login NameSELinux User  MLS/MCS
Range

__default__   unconfined_u  systemLow-systemHigh

root  unconfined_u  systemLow-systemHigh

system_u  system_u  systemLow-systemHigh

root@debian:~#


Bug#683756: selinux in permissive mode breaks gdm and X

2012-08-28 Thread Mika Pflüger
Hi,

Am Tue, 28 Aug 2012 19:00:46 +0200
schrieb Laurent Bigonville bi...@debian.org:

 Could you please check if you have the selinux-policy-default package
 installed?

yes, it is recommended by selinux-basics, thus I have it installed.
 
 Also, what is the semanage login -l command giving you?

On my real machine running testing for years:
$ LANG=C sudo semanage login -l

Login Name SELinux User   MLS/MCS Range

__default__unconfined_u   s0-s0:c0.c1023
root   unconfined_u   s0-s0:c0.c1023
system_u   system_u   s0-s0:c0.c1023   


On my freshly installed virtual machine:
$ LANG=C sudo semanage login -l

Login Name SELinux User   MLS/MCS Range

__default__unconfined_u   SystemLow-SystemHigh
root   unconfined_u   SystemLow-SystemHigh
system_u   system_u   SystemLow-SystemHigh 

Cheers,

Mika

-- 
Own your own computer. Don't use Windows 7. http://windows7sins.org


signature.asc
Description: PGP signature


Bug#683756: selinux in permissive mode breaks gdm and X

2012-08-28 Thread Ron Murray
On 08/28/12 13:00, Laurent Bigonville wrote:
 Hi,

 Could you please check if you have the selinux-policy-default package
 installed?

 Also, what is the semanage login -l command giving you?

 Cheers

 Laurent Bigonville

selinux-policy-default package is installed.

semanage login -l gets me:

 ~# semanage login -l

 Login NameSELinux User  MLS/MCS Range

 __default__   unconfined_u  s0-s0:c0.c1023
 root  unconfined_u  s0-s0:c0.c1023
 system_u  system_u  s0-s0:c0.c1023

Thanks,

 .Ron


-- 
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org



Bug#683756: selinux in permissive mode breaks gdm and X

2012-08-27 Thread piruthiviraj natarajan
The enforcing mode of selinux  breaks the gdm3 too.


Bug#683756: selinux in permissive mode breaks gdm and X

2012-08-14 Thread Laurent Bigonville
tag 683756 + moreinfo
thanks

Le Mon, 13 Aug 2012 22:33:14 -0400,
Ron Murray r...@rjmx.net a écrit :

 Running gdm3 in debug mode, I get this in the gdm slave log:
 
  -
 gdm-welcome][4275]: DEBUG(+): GdmSessionWorker: received pam message
 of type 2 with payload 'Would you like to enter a security context?
 [N]  ' -
 
So it appears that the reason gdm is hanging is that it's been
 asked for a security context, which it has no way of answering. How
 do I give it a securty context?
 
I'm not sure at this point whether I'm looking at a gdm3 bug or an
 selinux bug. I'm also (naturally) wondering why nobody else has
 reported this.

I'm running selinux in permissive mode and using GDM3 as DM and I've no
problem with it.

Could you look in /etc/pam.d/ and see and see what are call to
pam_selinux module in the gdm3 related services?

Also what is the version of gdm3 package? Since 3.4.1-1 pam
configuration includes call to pam_selinux.so.


One other thing that may or may not be important: I did an strace
 of a gdm3 startup, and just before that message was sent, there's
 this:
 
  -
 [pid  7921] open(/etc/selinux/default/logins/Debian-gdm, O_RDONLY)
 = -1 ENOENT (No such file or directory) -
 
Note that the /etc/selinux/default/logins/ directory does not
 exist on any of my boxes. Should it?

I'm not sure about this.

Cheers

Laurent Bigonville


--
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org



Bug#683756: selinux in permissive mode breaks gdm and X

2012-08-14 Thread Ron Murray
On 08/14/12 05:03, Laurent Bigonville wrote:
 I'm running selinux in permissive mode and using GDM3 as DM and I've no
 problem with it.

 Could you look in /etc/pam.d/ and see and see what are call to
 pam_selinux module in the gdm3 related services?

 Also what is the version of gdm3 package? Since 3.4.1-1 pam
 configuration includes call to pam_selinux.so.

  Here's the selinux lines in /etc/pam.d/gdm3*:
 khufu:/etc/pam.d# grep pam_selinux gdm3*
 gdm3:session [success=ok ignore=ignore module_unknown=ignore
 default=bad]pam_selinux.so close
 gdm3:session [success=ok ignore=ignore module_unknown=ignore
 default=bad]pam_selinux.so open
 gdm3-autologin:session [success=ok ignore=ignore module_unknown=ignore
 default=bad]pam_selinux.so close
 gdm3-autologin:session [success=ok ignore=ignore module_unknown=ignore
 default=bad]pam_selinux.so open

   As for the gdm3 version, 'dpkg --status gdm3' gets me:
 Version: 3.4.1-2

Thanks,

 .Ron


-- 
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org



Bug#683756: selinux in permissive mode breaks gdm and X

2012-08-13 Thread Ron Murray
Package: selinux-policy-default
Version: 2:2.20110726-9
Followup-For: Bug #683756

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Running gdm3 in debug mode, I get this in the gdm slave log:

 -
gdm-welcome][4275]: DEBUG(+): GdmSessionWorker: received pam message of type 2 
with payload 'Would you like to enter a security context? [N]  '
 -

   So it appears that the reason gdm is hanging is that it's been asked
for a security context, which it has no way of answering. How do I
give it a securty context?

   I'm not sure at this point whether I'm looking at a gdm3 bug or an
selinux bug. I'm also (naturally) wondering why nobody else has
reported this.

   One other thing that may or may not be important: I did an strace
of a gdm3 startup, and just before that message was sent, there's
this:

 -
[pid  7921] open(/etc/selinux/default/logins/Debian-gdm, O_RDONLY) = -1 
ENOENT (No such file or directory)
 -

   Note that the /etc/selinux/default/logins/ directory does not
exist on any of my boxes. Should it?


- -- System Information:
Debian Release: wheezy/sid
  APT prefers testing
  APT policy: (500, 'testing'), (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 3.5.1-khufu-0 (SMP w/2 CPU cores; PREEMPT)
Locale: LANG=C, LC_CTYPE=C (charmap=ANSI_X3.4-1968)
Shell: /bin/sh linked to /bin/dash

Versions of packages selinux-policy-default depends on:
ii  libpam-modules   1.1.3-7.1
ii  libselinux1  2.1.9-5
ii  libsepol12.1.4-3
ii  policycoreutils  2.1.10-9
ii  python   2.7.3~rc2-1

Versions of packages selinux-policy-default recommends:
ii  checkpolicy  2.1.8-2
ii  setools  3.3.7-3

Versions of packages selinux-policy-default suggests:
ii  logcheck1.3.15
pn  syslog-summary  none

- -- Configuration Files:
/etc/selinux/default/modules/active/file_contexts.local [Errno 13] Permission 
denied: u'/etc/selinux/default/modules/active/file_contexts.local'

- -- no debconf information

-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.12 (GNU/Linux)

iQIcBAEBAgAGBQJQKbjcAAoJEDHYrtWvbQ1K3yQP/jToa2CaXwcwluinljbPBdHf
ysVKUt5hP1FSKkn5Rr+0QO0rYRXvNFqVPuYVxft6jZBuq1rYe/7MEv4eSTer1k3A
EXm2LiKYA/aKePdJM00205YG8Kr/bmULJhdlx3yIEQiqX3c7zLxX0MJ5ZpAJQn8T
/K4Ba2s25WDWmOZHGAehy5JmhF6j5pAOEYnRdITBpymRK6qB9letN8be9V+5kT4L
ePNGjPl5o9+2IJePbtD1WPQfM3K6x1SPc0BFgm3NBs/uxIDeCRsRJjNECTc9y8XI
PL2vWahjN/DCX2kll95otbbLlBFhvnUgMXQox8XX64gb4H7K7WyYl6kdqY/c4SC7
s/1odhaHiLhqb0MnKspxYH3Yx4ggdyM0P5Lc3w9o4mKC31pu6axuqdF2wyZjFLZ7
aOxisMVu87jL7IN5KKsqKZ52gbCE1sZtlNMplyPmz70VKFkhSv416RcKOUFVKMGp
awA3CZKvh4lE4icHP2l+yRkAXmMsk16MlkNLURwZ4OcICQ8G3HnX5DeUaJnVze5Y
CP7/63+YCDvsv6Bm4gqzsJ2i5G8GV8IFYyDqN++TcD71Oh5glAVeN9Pr6GZO2T0g
wB60jeuK45baRece2ouiXfRJTxnPbTlFppMEPQ8S/V58QZXhX0RAyknJRnFOob7x
FGEynIJ6GVWEaI3Az5xd
=OZZT
-END PGP SIGNATURE-


-- 
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org



Bug#683756: selinux in permissive mode breaks gdm and X

2012-08-03 Thread Ron Murray
Package: selinux-policy-default
Version: 2:2.20110726-9
Severity: normal

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Since the last selinux update (around July 6), running selinux in
permissive mode stops gdm3 and X from working for me (haven't tried
enforced mode).

Bootup proceeds normally until X starts up, then all I get is a black
screen with the rotating DIN plug (or whatever it is). GDM never
presents me with a logon screen.

I've tried switching to slim, which does give me a logon screen, but
all session types that I've tried fail: I just get a blank screen with
the big black X.

This happens on three different machines: two desktops (both with
nVidia graphics, using the proprietary module) and a laptop (ATI
graphics, using ATI's proprietary module).

I'm surprised this happens, since I was under the impression that
permissive mode didn't enforce anything. I've had no trouble with it
in the past.

I've been running with selinux disabled on all three boxes since this
problem surfaced.

- -- System Information:
Debian Release: wheezy/sid
  APT prefers testing
  APT policy: (500, 'testing'), (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 3.5.0-khufu-0 (SMP w/2 CPU cores; PREEMPT)
Locale: LANG=C, LC_CTYPE=C (charmap=ANSI_X3.4-1968)
Shell: /bin/sh linked to /bin/dash

Versions of packages selinux-policy-default depends on:
ii  libpam-modules   1.1.3-7.1
ii  libselinux1  2.1.9-5
ii  libsepol12.1.4-3
ii  policycoreutils  2.1.10-9
ii  python   2.7.3~rc2-1

Versions of packages selinux-policy-default recommends:
ii  checkpolicy  2.1.8-2
ii  setools  3.3.7-3

Versions of packages selinux-policy-default suggests:
ii  logcheck1.3.15
pn  syslog-summary  none

- -- Configuration Files:
/etc/selinux/default/modules/active/file_contexts.local
(empty file)

- -- no debconf information

-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.12 (GNU/Linux)

iQIcBAEBAgAGBQJQGzMfAAoJEDHYrtWvbQ1KzFMP/jcSUssKbJ1WB4rZNpBRvX5H
tQxyjCXsV1nntf7kTN0zrhWvh+urtiDFXR4ABX3NJPDFnUX/TSOqkiHjyXjDewBO
TaJzEVP/Te1EeoGu6wBYf0pcV0+rD2r4HJ330NALzzSnnvlFk5UvaClhY1U3tnCV
u/jS5qceLaPD15mzARNd1AfH/u7YZpJU1yUSt7v37AtQjmhMPYzY7lGyLwD1vyNy
LISTleyChXuHZlHaz2PyhgToM8hct0nuEElIusDtvbkw0yN52gUcnimFMnEdymOv
093XCWR+ReWRFl20ZiZ148shypQZru/qt+U+MSF8CNbVxCn4K0p5mf9wbXvjo66G
rUUJYLegWJjYU6zkCTdWEk83AVXWQ0fgFy3SFpjiUsZr0eYjOdMfVeTB06klfVo1
FbslDwWzAdhzWzZWUOCRHapl+cG+jFInXyv7jDVCw0mGtDRPFmNE/1BuS+C7hDbj
P9LC2KEvODSswO+tH7McJYRXMd0A2GBY40NPN5tFWJEd/Qm+5Pxcf/0RKctXEuUn
3Rp/0+JtW8xYtOtGJrbAmvVJu+mbBh8ciMhKGVB4RA9obLoyl5T2Dte0cl2sU/3E
JZopFsUk8O1uIwinVXMAo3tRwt4NOqHSHlP6LCAV8CA59Sai5q7k/da8SYB4XywL
kQfkPlle2iU/jbxG87Cq
=fwQv
-END PGP SIGNATURE-


-- 
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org