From 396e8b653607e39ac1649760fb603ccc0998a3a9 Mon Sep 17 00:00:00 2001 From: dumbsplash Date: Thu, 18 Jun 2026 22:35:09 +0200 Subject: [PATCH] Updated readme to address SELinux problems These readme clarifications refer to my experience on openSUSE Tumbleweed but the same logic applies to all systems that use SELinux for file security enforcement, including Fedora. This readme change references issue #494 where @mystie and @nicknitride each confirmed that ausearch | audit2allow work on their respective systems of Fedora 39 and 44. The purpose of this PR is to streamline the diagnostic and fix application process that's been confirmed to work but has yet to be documented in the repository. audit2allow is being preferred here over chcon as a new policy rule is persistent and survives any potential filesystem relabels. The [!WARNING] is scooched underneath Fedora installation instructions and has been modified to address all SELinux systems, including Fedora. I don't include openSUSE installation instructions here as I cloned and built from source, but both distributions use SELinux and therefore the fix applies to both. @nicknitride also reports this fix works for Pop!_OS LTS but I wasn't comfortable including it in the commit. --- readme.md | 33 ++++++++++++++++++++++++++++++--- 1 file changed, 30 insertions(+), 3 deletions(-) diff --git a/readme.md b/readme.md index 620929e..7647e66 100644 --- a/readme.md +++ b/readme.md @@ -39,13 +39,40 @@ Join us on Matrix over at [#ly-dm:matrix.org](https://matrix.to/#/#ly-dm:matrix. ### Fedora -> [!WARNING] -> You may encounter issues with SELinux on Fedora. It is recommended to add a rule for Ly as it currently does not ship one. - ``` # dnf install kernel-devel pam-devel libxcb-devel zig xorg-x11-xauth xorg-x11-server brightnessctl ``` +> [!WARNING] +> Distributions using SELinux such as Fedora and openSUSE Tumbleweed may encounter issues. It is recommended to add a rule for Ly as it currently does not ship one. + +If encountering session launch failures: + +``` + sudo ausearch -m avc -ts recent +``` + +If SELinux is denying process context transition, you will see this output. + +``` + denied { transition } for pid=XXXX comm="ly" path="/usr/bin/bash" + scontext=system_u:system_r:unconfined_service_t:s0 + tcontext=unconfined_u:unconfined_r:unconfined_t:s0 + tclass=process permissive=0 +``` + +Pipe this output into `audit2allow` to generate a security module package. This will persist regardless of changes to filesystem permissions. + +``` + sudo ausearch -m avc -ts recent | audit2allow -M ly-local +``` + +``` + sudo semodule -i ly-local.pp +``` + +*This fix has been confirmed on Fedora 39 and 44 and openSUSE Tumbleweed. (#494)* + ### FreeBSD ```