ceos/ly
1
0
Fork 0
mirror of https://codeberg.org/fairyglade/ly.git synced 2026-08-09 07:09:13 +02:00
Code Issues Projects Releases Packages Wiki Activity

Updated readme to address SELinux problems

Browse source 
These readme clarifications refer to my experience on openSUSE Tumbleweed but the same logic applies to all systems that use SELinux for file security enforcement, including Fedora. This readme change references issue #494 where @mystie and @nicknitride each confirmed that ausearch | audit2allow work on their respective systems of Fedora 39 and 44. The purpose of this PR is to streamline the diagnostic and fix application process that's been confirmed to work but has yet to be documented in the repository.

audit2allow is being preferred here over chcon as a new policy rule is persistent and survives any potential filesystem relabels. The [!WARNING] is scooched underneath Fedora installation instructions and has been modified to address all SELinux systems, including Fedora. I don't include openSUSE installation instructions here as I cloned and built from source, but both distributions use SELinux and therefore the fix applies to both. @nicknitride also reports this fix works for Pop!_OS LTS but I wasn't comfortable including it in the commit.
This commit is contained in:
dumbsplash 2026-06-18 22:35:09 +02:00
commit 396e8b6536
1 changed files with 29 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

33
readme.md
View file

@ -39,13 +39,40 @@ Join us on Matrix over at [#ly-dm:matrix.org](https://matrix.to/#/#ly-dm:matrix.
### Fedora
> [!WARNING]
> You may encounter issues with SELinux on Fedora. It is recommended to add a rule for Ly as it currently does not ship one.
```
# dnf install kernel-devel pam-devel libxcb-devel zig xorg-x11-xauth xorg-x11-server brightnessctl
```
> [!WARNING]
> Distributions using SELinux such as Fedora and openSUSE Tumbleweed may encounter issues. It is recommended to add a rule for Ly as it currently does not ship one.
If encountering session launch failures:
```
sudo ausearch -m avc -ts recent
```
If SELinux is denying process context transition, you will see this output.
```
denied { transition } for pid=XXXX comm="ly" path="/usr/bin/bash"
scontext=system_u:system_r:unconfined_service_t:s0
tcontext=unconfined_u:unconfined_r:unconfined_t:s0
tclass=process permissive=0
```
Pipe this output into `audit2allow` to generate a security module package. This will persist regardless of changes to filesystem permissions.
```
sudo ausearch -m avc -ts recent | audit2allow -M ly-local
```
```
sudo semodule -i ly-local.pp
```
*This fix has been confirmed on Fedora 39 and 44 and openSUSE Tumbleweed. (#494)*
### FreeBSD
```