SELinux prevents xauth from accessing per session auth files in user's home directory

[Antoine Martin]

If selinux is enforcing, xauth just fails...
So we have a workaround in place where we pass the global XAUTHORITY to the server and it uses that if /selinux/enforcing==1

Not ideal. I can't see any easy way of being able to create new xauth files with selinux enabled. PITA

See also: ​NX bug

[Antoine Martin]

And now on Fedora 17 we have a different problem, which is that xauth wants to access /dev/urandom (for whatever reason) and SELinux generates an alert..

Here is an example of the command line we run:

/usr/bin/xauth add :61 MIT-MAGIC-COOKIE-1 a274142fd0250a21b6245496ca740a68

Upstream bug file ​here

This is the SELinux module generated to workaround the issue:

module xauth_urandom 1.0;

require {
	type xauth_t;
	type urandom_device_t;
	class chr_file read;
}

allow xauth_t urandom_device_t:chr_file read;

[Antoine Martin]

Fixed in selinux-policy-3.10.0-149.fc17