[SELinux] gnome-initial-setup / useradd / accountsd denials

[hanthor]

Issue Summary

During gnome-initial-setup (Gnome 49/50), critical SELinux denials prevent the successful creation of the initial user and session setup. Multiple services are denied IPC access to GDM's userdb socket, and incorrect labeling of /var/home blocks useradd and gdm-session-worker.

Detailed Analysis of Audit Logs

Analysis of ausearch -m AVC,USER_AVC reveals:

1. GDM UserDB IPC Denials:

   • Multiple domains are denied connectto to /run/systemd/userdb/org.gnome.DisplayManager (in xdm_t).
   • Affected domains: useradd_t, policykit_t, policykit_auth_t, NetworkManager_t, colord_t, and systemd_tmpfiles_t.
   • Sample denial: avc: denied { connectto } for pid=2621 comm="useradd" path="/run/systemd/userdb/org.gnome.DisplayManager" scontext=system_u:system_r:useradd_t:s0 tcontext=system_u:system_r:xdm_t:s0-s0:c0.c1023 tclass=unix_stream_socket

2. Home Directory Labeling Inconsistency:

   • /var/home and its sub-items are being assigned default_t or unlabeled_t, which restricts useradd_t.
   • useradd is denied create, add_name, setattr, and read on directories and skeleton files like .bash_logout.
   • Sample denial: avc: denied { create } for pid=2621 comm="useradd" name="james" scontext=system_u:system_r:useradd_t:s0 tcontext=system_u:object_r:default_t:s0 tclass=dir

3. GDM Session Worker:

   • gdm-session-worker (xdm_t) is denied create and add_name for .cache within the new user's home due to the labeling issue.

4. Boot/EFI Denials:

   • systemd-logind is denied getattr and search on /boot/efi (unlabeled_t).

Proposed Policy Fix

I have generated a draft policy module (tunaos_gnome_fix.te) to allow these interactions.

Wait! The root cause for some of these is likely missing file context definitions for the /var/home tree in TunaOS.

Recommended Actions

1. Update File Contexts: Ensure /var/home is handled like /home in the policy (e.g., semanage fcontext -a -e /home /var/home).
2. Apply Policy Module: Integrate the necessary IPC permissions between the mentioned domains and xdm_t.

---

Created automatically by TunaOS Gemini CLI.

[hanthor]

Root Cause Update: SELinux Policy Version Mismatch

Analysis confirms a version mismatch between the desktop environment and the security policy:

• System: GNOME 50 (from Fedora 44 repositories)
• Installed Policy:
• Expected Policy: Fedora 44 uses >= 43.3.

The current 43.1 policy lacks the updated IPC definitions and file contexts required by GNOME 50's internal changes (such as the GDM UserDB socket and tree).

Recommendation for Maintainers: Prioritize rebasing to at least 43.3 in the TunaOS COPIR to support GNOME 49/50 components.