Ubuntu
gdm package

gdm login context incorrect

Bug #430205 reported by Caleb Case
8
This bug affects 1 person
Affects Status Importance Assigned to Milestone
gdm (Ubuntu)
Fix Released
Medium
Kees Cook
Ubuntu ubuntu-9.10

Bug Description

Binary package hint: gdm

To replicate:

* apt-get install selinux
* reboot
* login
* open a terminal and check your context (id -Z)

The context should be unconfined_t, however, because the new GDM handles SELinux differently the context will end up being gdm_t. GDM now handles transitions via PAM: http://marc.info/?l=selinux&m=125250111327104&w=2

Revision history for this message
Caleb Case (calebcase) wrote :
Changed in gdm (Ubuntu):
status: New → In Progress
Revision history for this message
Sebastien Bacher (seb128) wrote :

Thank you for your bug report, I don't know enough about selinux to understand the issue but setting the priority to low since that doesn't seem something any standard user will notice

Changed in gdm (Ubuntu):
importance: Undecided → Low
summary: - [karmic] gdm login context incorrect
+ gdm login context incorrect
Revision history for this message
Kees Cook (kees) wrote :

This may need some adjustment. I will be reviewing this early next week for Karmic. Thanks for the patch!

Changed in gdm (Ubuntu):
assignee: nobody → Kees Cook (kees)
milestone: none → ubuntu-9.10-beta
Revision history for this message
Steve Langasek (vorlon) wrote :

The proposed PAM config uses pam_sepermit for auth in gdm. Why is this needed, when login doesn't use this? Should SELinux handling not be identical between login and gdm?

Can this be generalized to other services as well (i.e., put it in as a PAM profile hooked into pam-auth-update)?

Revision history for this message
Martin Pitt (pitti) wrote :

Unsubscribing sponsors for now, while this is being reviewed by Kees, and there are some open questions.

Kees Cook (kees)
Changed in gdm (Ubuntu):
milestone: ubuntu-9.10-beta → ubuntu-9.10
importance: Low → Medium
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package gdm - 2.28.0-0ubuntu13

---------------
gdm (2.28.0-0ubuntu13) karmic; urgency=low

  * debian/gdm{,-autologin}.pam: correctly handle SELinux transitions,
    thanks to Caleb Case (LP: #430205).

 -- Kees Cook <email address hidden> Tue, 06 Oct 2009 16:49:25 -0700

Changed in gdm (Ubuntu):
status: In Progress → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.