https://bugzilla.suse.com/show_bug.cgi?id=1223900 https://bugzilla.suse.com/show_bug.cgi?id=1223900#c3 --- Comment #3 from Giacomo Comes --- I figured out what exactly the problem is. redshift provides a apparmor profile: /etc/apparmor.d/usr.bin.redshift such profile include: Which in turn grant access to the xauth file: owner @{HOME}/.Xauthority r, owner @{HOME}/.local/share/sddm/.Xauthority r, owner @{run}/gdm{,3}/*/database r, owner @{run}/lightdm/authority/[0-9]* r, owner @{run}/lightdm/*/xauthority r, owner @{run}/user/*/gdm/Xauthority r, owner @{run}/user/*/X11/Xauthority r, owner @{run}/user/*/xauth_* r, sddm up to 0.19 was putting the xauth file in: @{run}/user/*/xauth_* Since 0.20 the xauth file is located in: /tmp/xauth_[A-Za-z]* which is not included in any apparmor's abstracion file. Possible solutions are (in my preferred order): 1) revert the change in sddm and put the xauth file in the previous location 2) add in the apparmor's profile abstractions/X an entry for sddm's new xauth file location 3) add in redshift's profile such entry. I can prepare a SR for redshift to fix the issue but that's only a workaround. Some other programs that are using abstractions/X profile to allow access to the user's xauth file will have the same problem. Solution 1 or 2 is the appropriate fix. -- You are receiving this mail because: You are on the CC list for the bug.

https://bugzilla.suse.com/show_bug.cgi?id=1223900 https://bugzilla.suse.com/show_bug.cgi?id=1223900#c6 --- Comment #6 from Christian Boltz --- (In reply to Giacomo Comes from comment #5)

There are at least two more entries that should go in :

owner /tmp/xauth_* r, (for sddm)

Agreed, even if "yet another path" is annoying. Submitted upstream as https://gitlab.com/apparmor/apparmor/-/merge_requests/1249 I'll also include the patch in the next submission to Tumbleweed.

owner @{run}/user/*/.mutter-Xwaylandauth.* (for gnome on Xwayland)

That rule already exists since 2020. Do you have any audit.log entries that show issues with this file? -- You are receiving this mail because: You are on the CC list for the bug.

https://bugzilla.suse.com/show_bug.cgi?id=1223900 https://bugzilla.suse.com/show_bug.cgi?id=1223900#c8 --- Comment #8 from Giacomo Comes ---

...

owner @{run}/user/*/.mutter-Xwaylandauth.* (for gnome on Xwayland)

That rule already exists since 2020. Do you have any audit.log entries that show issues with this file?

You are right, my mistake. The rule is already there. I was having trouble with redshift on gnome on wayland, but it turns out the issue was unrelated to XAUTHORITY and apparmor. -- You are receiving this mail because: You are on the CC list for the bug.