https://bugs.kde.org/show_bug.cgi?id=457064
Bug ID: 457064
Summary: Using KDE Plasma with SELinux restricted users cause
weird AVC's with SELinux running as permissive and
makes restricted login impossible with SELinux running
as enforcing
Product: frameworks-kwindowsystem
Version: 5.96.0
Platform: Other
OS: Linux
Status: REPORTED
Severity: normal
Priority: NOR
Component: general
Assignee: kwin-bugs-n...@kde.org
Reporter: roger.k.truss...@gmail.com
Target Milestone: ---
SUMMARY
***
NOTE: If you are reporting a crash, please try to attach a backtrace with debug
symbols.
See
https://community.kde.org/Guidelines_and_HOWTOs/Debugging/How_to_create_useful_crash_reports
***
STEPS TO REPRODUCE
1. Install the Fedora Workstation 36 KDE Spin and apply all updates
2. Edit the "/etc/selinux/config" file and put SELinux in permissive mode
because the following steps won't work in "enforcing" mode.
2. Create a new Linux user and use "sudo semanage login" to map that new Linux
user onto the SELinux user "user_u"
3. Reboot and login as that restricted user
OBSERVED RESULT
You will see interesting AVC's such as:
SELinux is preventing plasmashell from watch access on the directory /
SELinux is preventing plasmashell from watch access on the file /etc/passwd.
SELinux is preventing ksmserver-logou from watch access on the file
/etc/passwd.
SELinux is preventing kwin_wayland from write access on the file /tmp/#118
EXPECTED RESULT
I kinda expected that maybe the KDE login mechanism would be modular or at
least use a standard PAM and not need direct access to any sensitive system
resources. I understand if temporary files need to be stored in the user
directory.
I was hoping to create SELinux restricted accounts on this Fedora Workstation
that would not need direct access to any sensitive system resources.
I'm still trying to wrap my head around how Wayland and modern window managers
work.
I just assumed that maybe things like sddm and the Wayland compositor would
both run as daemons with root level permissions and the Wayland clients would
run with the same system permissions as the "logged in user". Perhaps having
the compositor and sddm both running as root would block or confuse the
communication between the clients and the compositor. I just don't know. Sorry.
SOFTWARE/OS VERSIONS
Windows:
macOS:
Linux/KDE Plasma: Fedora Workstation 36 KDE Spin: kernel:
5.18.13-200.fc36.x86_64
(available in About System)
KDE Plasma Version: 5.25.3
KDE Frameworks Version: 5.96.0
Qt Version: 5.15.3
ADDITIONAL INFORMATION
--
You are receiving this mail because:
You are watching all bug changes.
