https://bugzilla.suse.com/show_bug.cgi?id=1222978 Bug ID: 1222978 Summary: [SELinux] gnome-control-center (users) unable to set AutoLogin Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team@suse.de Reporter: rbrown@suse.com QA Contact: qa-bugs@suse.de Target Milestone: --- Found By: --- Blocker: --- GNOME Control Center has the ability to set autologin, as button in a users account, requiring Polkit escalation in order to be able to set it Polkit is doing it's thing fine..but SELinux blocks it :) Audit.log output below type=USER_ACCT msg=audit(1713364967.267:211): pid=23024 uid=1000 auid=1000 ses=3 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_unix acct="ilmehtar" exe="/usr/libexec/polkit-1/polkit-agent-helper-1" hostname=? addr=? terminal=? res=success' type=AVC msg=audit(1713364970.590:212): avc: denied { write } for pid=1269 comm="accounts-daemon" name="sysconfig" dev="overlay" ino=283 scontext=system_u:system_r:accountsd_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=dir permissive=1 type=AVC msg=audit(1713364970.590:213): avc: denied { add_name } for pid=1269 comm="accounts-daemon" name="displaymanager.new.1025417169" scontext=system_u:system_r:accountsd_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=dir permissive=1 type=AVC msg=audit(1713364970.590:214): avc: denied { create } for pid=1269 comm="accounts-daemon" name="displaymanager.new.1025417169" scontext=system_u:system_r:accountsd_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=file permissive=1 type=AVC msg=audit(1713364970.593:215): avc: denied { write } for pid=1269 comm="accounts-daemon" path="/etc/sysconfig/displaymanager.new.1025417169" dev="overlay" ino=1179107 scontext=system_u:system_r:accountsd_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=file permissive=1 type=AVC msg=audit(1713364970.593:216): avc: denied { remove_name } for pid=1269 comm="accounts-daemon" name="displaymanager.new.1025417169" dev="overlay" ino=1179107 scontext=system_u:system_r:accountsd_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=dir permissive=1 type=AVC msg=audit(1713364970.593:217): avc: denied { rename } for pid=1269 comm="accounts-daemon" name="displaymanager.new.1025417169" dev="overlay" ino=1179107 scontext=system_u:system_r:accountsd_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=file permissive=1 type=AVC msg=audit(1713364970.593:218): avc: denied { unlink } for pid=1269 comm="accounts-daemon" name="displaymanager" dev="overlay" ino=31627 scontext=system_u:system_r:accountsd_t:s0 tcontext=system_u:object_r:etc_t:s0 tclass=file permissive=1 Not the most severe issue in the world (I personally dislike the feature)..but I have users who are super passionate about it, so at least I can now say the issue is filed in the right place :) -- You are receiving this mail because: You are on the CC list for the bug.