Invoking "Select" in "SELinux Configuration" opens a window that is immediately closed

[Ricky-Tigg]

Component: policycoreutils-gui.noarch 2.9-5.fc31 @fedora
Environment: Wayland

Installed packages along with policycoreutils-gui, in Gnome:

Those icons are respectively listed in Gnome as follow:

$ gsettings get org.gnome.shell favorite-apps
['sepolicy.desktop', 'selinux-polgengui.desktop', 'system-config-selinux.desktop']

1. A common icon is associated to different applications (SELinux Policy..., SELinux Manag..., ).

Loading from GUI SELinux Policy Management Tool (left-sided icon) opens that window (partial view):

Associated process:

$ ps -aux | grep selinux
root       26906  0.0  0.2 244212 21140 ?        S    14:36   0:00 /usr/bin/python3 -Es /usr/share/system-config-selinux/selinux_server.py

2. Titles of application listed by Gnome and the one of opened window resulting from that invocation do not match.

3. Invoking Select ... opens a window that is immediately closed.

4. Attempt to load from CLI does not open application window:

$ rpm -ql policycoreutils-gui | grep selinux.py
/usr/share/system-config-selinux/system-config-selinux.py
$ /usr/share/system-config-selinux/system-config-selinux.py
Traceback (most recent call last):
  File "/usr/share/system-config-selinux/system-config-selinux.py", line 100, in __init__
    self.add_page(booleansPage.booleansPage(xml))
  File "/usr/share/system-config-selinux/booleansPage.py", line 142, in __init__
    self.load(self.filter)
  File "/usr/share/system-config-selinux/booleansPage.py", line 212, in load
    self.booleans = seobject.booleanRecords()
  File "/usr/lib/python3.7/site-packages/seobject.py", line 2682, in __init__
    semanageRecords.__init__(self, args)
  File "/usr/lib/python3.7/site-packages/seobject.py", line 256, in __init__
    self.sh = self.get_handle(self.store)
  File "/usr/lib/python3.7/site-packages/seobject.py", line 285, in get_handle
    raise ValueError(_("SELinux policy is not managed or store cannot be accessed."))
ValueError: SELinux policy is not managed or store cannot be accessed.

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/share/system-config-selinux/system-config-selinux.py", line 196, in <module>
    app = childWindow()
  File "/usr/share/system-config-selinux/system-config-selinux.py", line 108, in __init__
    self.error(e.message)
AttributeError: 'ValueError' object has no attribute 'message'

[stephensmalley]

Recommend opening a bug on Fedora's bugzilla on that package/version. Not sure if this is an upstream issue but let's start there since these tools were all originally developed in Fedora and then contributed upstream.

[bachradsusi]

system-config-selinux needs to be run as root. In Fedora, it's accomplished using pkexec:

^&^ cat /usr/bin/system-config-selinux
#!/usr/bin/sh

exec /usr/bin/pkexec /usr/share/system-config-selinux/system-config-selinux.py

Please run /usr/bin/system-config-selinux instead of /usr/share/system-config-selinux/system-config-selinux.py which is not in the standard PATH.

[Ricky-Tigg]

Hey. That one I had run with success with the intention to launch application associated to icon SELinux Manag.... when sudo is omitted, as it was the case, Gnome prompts for password autentification.

Here is was I had get:

$ which system-config-selinux
/usr/bin/system-config-selinux
$ system-config-selinux

** (system-config-selinux.py:5417): WARNING **: 09:19:11.258: AT-SPI: Could not obtain desktop path or name


** (system-config-selinux.py:5417): WARNING **: 09:19:11.260: atk-bridge: GetRegisteredEvents returned message with unknown signature

** (system-config-selinux.py:5417): WARNING **: 09:19:11.260: atk-bridge: get_device_events_reply: unknown signature

** (system-config-selinux.py:5417): WARNING **: 09:19:11.261: atk-bridge: get_device_events_reply: unknown signature

That very application I had had the intention to launch from CLI by using ...system-config-selinux.py, was SELinux Policy Management Tool. However, an eligible path to a binary file matching sepolicy.desktop is missing as illustrated:

$ rpm -ql policycoreutils-gui
/usr/bin/selinux-polgengui
/usr/bin/system-config-selinux
[...]
/usr/share/applications/selinux-polgengui.desktop
/usr/share/applications/sepolicy.desktop
/usr/share/applications/system-config-selinux.desktop
[...]
/usr/share/system-config-selinux
[...]

[bachradsusi]

https://lore.kernel.org/selinux/20221208194335.479739-1-lautrbach@redhat.com/