On Wed, 2013-01-02 at 20:54 -0600, Ian Pilcher wrote:
> I just went through the process of setting up Xvnc with XDMCP on F18,
> and I ran into an SELinux-related issue.
>
> I have configured KDM to accept XDMCP queries from localhost, and I'm
> starting Xvnc with the following systemd unit file:
>
> /etc/systemd/system/xvnc@.service:
>
> [Unit]
> Description=VNC remote display %I
> After=syslog.target
>
> [Service]
> Type=simple
> User=nobody
> ExecStart=/usr/bin/Xvnc -SecurityTypes None -query 127.0.0.1 %i
>
> [Install]
> WantedBy=multi-user.target
>
> When I first did this, KDM was unable to talk to Xvnc:
>
> /var/log/kdm.log:
>
> /usr/bin/xrdb: Permission denied
> /usr/bin/xrdb: Can't open display ':10'
> kdmgreet: cannot connect to X server :10
>
> /var/log/audit/audit.log:
>
> type=AVC msg=audit(1357179264.974:426): avc: denied { connectto }
> for pid=11481 comm="kdm_greet"
> path=002F746D702F2E5831312D756E69782F583130
> scontext=system_u:system_r:xdm_t:s0-s0:c0.c1023
> tcontext=system_u:system_r:initrc_t:s0 tclass=unix_stream_socket
>
> The problem was that Xvnc was running as initrc_t, because /usr/bin/Xvnc
> was labeled as bin_t. Changing the label to xserver_exec_t makes the
> process run as xserver_t, KDM is able to connect to the server, and
> everything appears to be working.
>
> Is there a reason I'm not seeing that the context of /usr/bin/Xvnc
> should *not* be changed to xserver_exec_t? If not, I'll go ahead and
> BZ this.
>
> Thanks!
>
I am not quite sure but it would be interesting to see what happens in
you label xvnc executab;e file type unconfined_exec_t
--
selinux mailing list
selinux@xxxxxxxxxxxxxxxxxxxxxxx
https://admin.fedoraproject.org/mailman/listinfo/selinux
