2

I've had a Fedora 25 installation for a day or two in a VM, the Cinnamon spin.

In my last session I ran a few programs, installed Wine, but didn't do a dnf update, edit my .bash_profile, or make any significant changes that I can recall.

Suddenly, when I attempt to log in, the screen reverts to a cursor on black for about 0.5 seconds (seeming to crash) then the login screen comes back.

I can log in successfully as root, using the same UI, so it seems isolated to my user account.

If I Ctrl+Alt+F5, I can login successfully, but I see an odd error:

Last login: Wed Mar 1 14:02:58 on tty5
 -- craig: /home/craig: change directory failed: Permission denied
Logging in with home = "/".
[craig@localhost /]$ cd
[craig@localhost ~]$ ls -la ~ | grep "\.$"
drwx------. 26 craig craig    4096 Mar  1 13:17 .
drwxr-xr-x. 26 root  root     4096 Feb 28 07:58 ..
[craig@localhost ~]$

(Typed the above by hand so excuse any typos.)

I tried changing my home directory permissions to 755 but the result is the same. (Both for graphical and tty login.)

I've done a bit of research, I do not have an ~/.XAuthority file. I do have .xsession-errors, but it doesn't seem to be updated when my login attempts fail. (It's a couple hours old.)

fpaste link for .xsession-errors

I have general working knowledge of Unix, but not a lot of experience with Fedora/Cinnamon. Where should I look next?

Update:

SELinux Alert Browser shows the below options:

Related AVCs from ausearch -m AVC are:

type=AVC msg=audit(1488394978.226:257): avc: denied { search } for pid=1426 comm="login" name="craig" dev="dm-2" ino=2621441 scontext=system_u:system_r:local_login_t:s0-s0:c0.c1023 tcontext=system_u:object_r:unlabeled_t:s0 tclass=dir permissive=0

  • Any AVCs in audit? What about SELinux labels? – Jakuje Mar 1 '17 at 19:19
  • I'm not sure how to check any of that - let me do some research and get back to you, or if you have any one-liners, I'm happy to run them and post the output. – Craig Otis Mar 1 '17 at 19:39
  • This seems somewhat promising: i.imgur.com/XxmI1PX.png – Craig Otis Mar 1 '17 at 20:21
1

As proposed in the SELinux Alert browser

/sbin/restorecon -v /home/craig

should resolve the problems.

What was wrong?

From the AVC:

type=AVC msg=audit(1488394978.226:257): avc: denied { search } for pid=1426 comm="login" name="craig" dev="dm-2" ino=2621441 scontext=system_u:system_r:local_login_t:s0-s0:c0.c1023 tcontext=system_u:object_r:unlabeled_t:s0 tclass=dir permissive=0

You can read that your home directory (name="craig") had a wrong label (unlabeled_t), instead of the expected type (user_home_dir_t from the screenshot). SELinux has is MAC (Mandatory Access Control) and the login was trying to do something that was not allowed by the policy, it was forbidden.

It was probably caused by some manipulation of your home directory.

  • I'll give this a try - but I'm a little confused as to what happened in the first place? I see that restorecon -v shows "changes in file labels", but I don't understand exactly what this does. – Craig Otis Mar 1 '17 at 20:39
  • To find out what happened, you would have to share the whole AVC message that was produced (ausearch -m AVC should list all of the AVCs). restorecon is fixing the labels to the correct ones if they happened to get wrong (for whatever reason). – Jakuje Mar 1 '17 at 20:42
  • with space ... sorry: ausearch -m AVC – Jakuje Mar 1 '17 at 20:47
  • Seems kind of unexciting: paste.fedoraproject.org/paste/… Am I correct in understanding that SELinux killed my login attempt/Cinnamon process because it tried to do something out-of-bounds? SELinux is something I have zero experience with, so you should assume no prior knowledge on my part. :-) – Craig Otis Mar 1 '17 at 20:49
  • 1
    Worked great - thanks for explaining the details - a lot to learn since RHEL 4... :-) – Craig Otis Mar 1 '17 at 20:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.