VNC GDM SELinux problem

JSLayton · 01-14-2008, 10:12 AM

I setup my server to allow me access through VNC and GDM by using the numerous tutorials out on the net. It will allow me to login, however, if I try and access some things, it won't let me, such as the add/remove software link through the applications menu. Also, when I clicked on system, administration, display it gives me this error from SELinux. Any ideas what I can do to fix this? I would like to be able to do anything that I could do at the console, through VNC.

Code:

Summary
    SELinux is preventing /usr/bin/Xorg (xdm_xserver_t) "read write" to
    /var/log/Xorg.setup.log (var_log_t).

Detailed Description
    SELinux denied access requested by /usr/bin/Xorg. It is not expected that
    this access is required by /usr/bin/Xorg and this access may signal an
    intrusion attempt. It is also possible that the specific version or
    configuration of the application is causing it to require additional access.

Allowing Access
    Sometimes labeling problems can cause SELinux denials.  You could try to
    restore the default system file context for /var/log/Xorg.setup.log,
    restorecon -v /var/log/Xorg.setup.log If this does not work, there is
    currently no automatic way to allow this access. Instead,  you can generate
    a local policy module to allow this access - see
    http://fedora.redhat.com/docs/selinux-faq-fc5/#id2961385 Or you can disable
    SELinux protection altogether. Disabling SELinux protection is not
    recommended. Please file a http://bugzilla.redhat.com/bugzilla/enter_bug.cgi
    against this package.

Additional Information        

Source Context                system_u:system_r:xdm_xserver_t:s0
Target Context                system_u:object_r:var_log_t:s0
Target Objects                /var/log/Xorg.setup.log [ file ]
Affected RPM Packages         xorg-x11-server-Xorg-1.3.0.0-33.fc8 [application]
Policy RPM                    selinux-policy-3.0.8-44.fc8
Selinux Enabled               True
Policy Type                   targeted
MLS Enabled                   True
Enforcing Mode                Enforcing
Plugin Name                   plugins.catchall_file
Host Name                     fedora.localdomain
Platform                      Linux fedora.localdomain 2.6.23.1-42.fc8 #1 SMP
                              Tue Oct 30 13:55:12 EDT 2007 i686 i686
Alert Count                   1
First Seen                    Mon 14 Jan 2008 10:05:33 AM CST
Last Seen                     Mon 14 Jan 2008 10:05:33 AM CST
Local ID                      4e9f3e5c-3a4b-438f-98e7-12b74303b7de
Line Numbers                  

Raw Audit Messages            

avc: denied { read write } for comm=Xorg dev=dm-0 egid=0 euid=0
exe=/usr/bin/Xorg exit=0 fsgid=0 fsuid=0 gid=0 items=0
path=/var/log/Xorg.setup.log pid=3870
scontext=system_u:system_r:xdm_xserver_t:s0 sgid=0
subj=system_u:system_r:xdm_xserver_t:s0 suid=0 tclass=file
tcontext=system_u:object_r:var_log_t:s0 tty=(none) uid=0

nomb · 01-14-2008, 02:51 PM

Does setroubleshooter give you any additional info?
What are the labels on /var/log/ and /var/log/xorg.setup.log? (ls -Z)
Have you tried running in promiscuous mode to see what output you get?

nomb