Gentoo Archives: gentoo-hardened

From: Sven Vermeulen <swift@g.o>
To: gentoo-hardened@l.g.o
Subject: Re: [gentoo-hardened] Gnome wrong Selinux user role.
Date: Mon, 27 Feb 2012 20:15:52
Message-Id: 20120227201520.GB3773@gentoo.org
In Reply to: Re: [gentoo-hardened] Gnome wrong Selinux user role. by Cor Legmaat
1 On Mon, Feb 27, 2012 at 09:53:41PM +0200, Cor Legmaat wrote:
2 > >> This is what I get with gnome-terminal:
3 > >>> cor@k53s ~ $ id -Z
4 > >>> system_u:system_r:initrc_t
5 > >>> cor@k53s ~ $ ssh 127.0.0.1
6 > >>> Last login: Mon Feb 27 20:01:41 SAST 2012 from k53s.cor.za.net on pts/1
7 > >>> cor@k53s ~ $ id -Z
8 > >>> staff_u:staff_r:staff_t
9 [...]
10
11 Hmm, being in initrc_t isn't correct either; I'd at least expect it to be
12 xdm_t.
13
14 Can you check the file context of your gdm binary?
15
16 ~# ls -Z /usr/sbin/gdm
17
18 It should be xdm_exec_t (yes, xdm_exec_t, not gdm_exec_t). If not, set it that
19 way (and tell me which path the binary is at so I can update the policy).
20
21 ~# chcon -t xdm_exec_t /usr/sbin/gdm
22
23 If the system complains about an unknown type, make sure you have the
24 xserver module loaded:
25
26 ~# emerge selinux-xserver
27 ~# semodule -l | grep xserver
28 ~# rlpkg gdm
29 ~# ls -Z /usr/sbin/gdm
30
31 Wkr,
32 Sven Vermeulen

Replies

Subject Author
Re: [gentoo-hardened] Gnome wrong Selinux user role. Hinnerk van Bruinehsen <h.v.bruinehsen@×××××××××.de>