I recently enabled SELinux on my Debian Wheezy system, in permissive mode (I have confirmed that it is indeed operating in permissive mode). However, after the file labelling double-reboot, gdm3 doesn't seem to start properly. The SELinux setup details are in What's missing with my SELinux installation? (until there is a proper answer on that question, make sure to also check the comments on the question as they contain vital information).

Specifically, gdm3 just sits spinning the doughnut "wait" mouse cursor. I can move the mouse around, but even several minutes (fifteen minutes and counting at the time of this writing), I don't get the login dialog box.

Logging into a text-based shell and issuing startx with an old-school ~/.xsession does give me my usual desktop virtually instantly, so it's not a general problem with X, although it did give off a complaint about unable to start something that had to do with notifications. (That might be related simply to running multiple unrelated X client sessions on the same host.)

I checked /var/log/messages and there's a small handful of selinux "denied" entries in there from during the boot, but nothing that seems related to either X or gdm3. I also don't see anything out of the ordinary in /var/log/X* or /var/log/gdm3/*. Considering that I'm running in permissive mode, SELinux shouldn't be getting in the way.

How do I figure out what's wrong? How do I fix it? (I have no particular reason to use gdm3 other than that it's what was enabled by default on Wheezy; if the fix is "use some other display manager", I'm perfectly fine with that, but if so I appreciate specific steps to change that.)

The question Debian 7 black screen after loading OS appears to be about a similar issue but indicates there is no mouse cursor either, but it has no answers, no comments, might have nothing at all to do with SELinux (which I feel is likely to be the culprit here, somehow), and hasn't seen any activity for half a year.

  • 1
    have you filtered your AVC denials through audit2allow to see more meaningful messages (ausearch -m avc -ts recent | audit2allow)? – dawud Jun 13 '14 at 17:57
  • 1
    That is not consistent with having "denials" in your logs, please post a sample of your /var/log/messages – dawud Jun 13 '14 at 17:59
  • @dawud Removing -ts recent gives me suggested rules for apcupsd_t, auditd_t, cupsd_config_t, dhcpc_t, fsadm_t, getty_t, hostname_t, ifconfig_t, iptables_t, loadkeys_t, local_login_t, mount_t, rpcd_t, setfiles_t, setrans_t, udev_t, unconfined_t and unlabeled_t. Out of those, it seems like getty_t, hostname_t and local_login_t might reasonably be related. But I still fail to see why this would have much impact with SELinux in permissive mode? – a CVn Jun 13 '14 at 18:03
  • The -ts recent was an example. Use the timeframe you feel is correct (today, for example). Indeed, it shouldn't matter there are denials if SELinux is in permissive mode. Sadly, SELinux in Debian is not completely integrated yet, and there are a lot of rough edges. – dawud Jun 13 '14 at 18:06
  • @dawud Well, even removing the -ts specifier entirely gives a totally reasonable amount of output. – a CVn Jun 13 '14 at 18:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.