Package: selinux-policy-default Version: 2:2.20250213-10 Severity: important Tags: patch
Dear Maintainer,
On Debian Trixie with SELinux enforcing, pam_systemd session creation can make
org.freedesktop.login1 disappear from the system bus even though
systemd-logind.service continues to report active/running. The immediate cause
is an SELinux denial when systemd-logind receives a pidfd from an unconfined
PAM client via SCM_RIGHTS:
avc: denied { use } for pid=728 comm="systemd-logind"
path="anon_inode:[pidfd]" dev="pidfs" ino=1045
scontext=system_u:system_r:systemd_logind_t:s0
tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=fd
permissive=0
After this denial, loginctl and later PAM sessions wait for the system D-Bus
activation timeout:
Failed to list sessions: Failed to activate service
'org.freedesktop.login1': timed out (service_start_timeout=25000ms)
The measured loginctl failure takes 25.00 seconds. At the same time:
$ systemctl is-active systemd-logind
active
$ systemctl show systemd-logind -p MainPID -p ActiveState -p SubState
MainPID=728
ActiveState=active
SubState=running
$ busctl --system list | grep org.freedesktop.login1
org.freedesktop.login1 - - - (activatable) - - -
I reproduced this independently on a disposable VM made from Debian's current
Trixie generic cloud image. The VM was Debian 13.6, ARM64, kernel
6.12.107+deb13-cloud-arm64 (package 6.12.107-1), systemd and libpam-systemd
257.13-1~deb13u1, and selinux-policy-default 2:2.20250213-10. No restart of the
system D-Bus occurred.
Minimal reproduction
--------------------
1. Install selinux-policy-default and enable SELinux enforcing on a Debian
Trixie system. Relabel and reboot as required.
2. Confirm the shell is unconfined and logind initially owns login1:
getenforce
id -Z
systemctl restart systemd-logind
busctl --system list | grep org.freedesktop.login1
loginctl list-sessions
3. Create a PAM session and immediately query logind again:
su -c true -
loginctl list-sessions
The first command returns quickly and produces the fd-use AVC. The second then
waits 25 seconds and fails. Restarting systemd-logind restores login1 until the
next denial.
Fix
---
Upstream refpolicy already fixed this in commit
a742066011070c6696eda00442a46d1e9970a614:
https://github.com/SELinuxProject/refpolicy/commit/a742066011070c6696eda00442a46d1e9970a614
The native refpolicy change is:
optional_policy(`
unconfined_dbus_send(systemd_logind_t)
unconfined_use_fds(systemd_logind_t)
')
The equivalent compatibility rule is:
(allow systemd_logind_t unconfined_t (fd (use)))
After installing that compatibility rule, restarting logind, and keeping
SELinux enforcing, 20 consecutive su plus loginctl iterations succeeded without
a new matching AVC. loginctl returned in milliseconds and login1 remained
owned.
I also prepared a DEP-3 quilt backport of the upstream change against Debian's
2:2.20250213-10 Salsa commit f213b3d6b688cc10f267c29092b281d96dda3782.
The package builds successfully with dpkg-buildpackage -b -us -uc. After
removing the compatibility module and installing the rebuilt
selinux-policy-default package in the disposable VM, another 20 consecutive
session/loginctl iterations succeeded under enforcing SELinux with no matching
AVC.
For completeness, I inspected the source of 2:2.20250213-13~deb13u1 from
trixie-proposed-updates on 2026-09-10; its patch series did not contain this
upstream rule.
The attached reproduction log records the exact versions, raw failure,
successful compatibility test, package build, and rebuilt-package test. The
attached patch is the one-line upstream-native refpolicy change rather than a
Debian-specific raw CIL rule.
Regards,
Blake Lee
debian-refpolicy-logind-repro.log
Description: debian-refpolicy-logind-repro.log
debian-refpolicy-logind.patch
Description: debian-refpolicy-logind.patch
